@synap-core/cli 1.11.0 → 1.12.2

package/dist/commands/proton-setup.js

@@ -0,0 +1,577 @@
+/**
+ * synap proton-setup  (HIDDEN)
+ *
+ * One-shot provisioning for the Proton Mail ↔ Synap bridge — a fork of
+ * `bridge-setup` (the Discord bridge) for the SOVEREIGN self-host Proton path:
+ * a locally-run, headless Proton Bridge decrypts Proton's end-to-end-encrypted
+ * mail and exposes it as plain IMAP/SMTP on localhost; this command wires that
+ * bridge up to a Synap pod. See the catalog's `synap-app/packages/
+ * workspace-templates/capabilities/proton.capability.json` for the template
+ * (vault ref `proton-account`, tool `proton`) and its documented
+ * MUTUAL-EXCLUSIVITY rule against the `mailgun` template's Proton-forward path
+ * — do not run both for the same mailbox (double-ingest).
+ *
+ * CREDENTIAL MODEL: the operator enters their Proton ACCOUNT credentials
+ * (email + password + optional TOTP seed + optional mailbox password for
+ * two-password-mode accounts) ONCE, here — NOT a Bridge-generated password.
+ * They are assembled into one JSON secret
+ * (`{"email","password","totpSeed","mailboxPassword"}`, last two optional) and
+ * stored in the pod vault under ref `proton-account`. The headless bridge redeems
+ * that secret and auto-logs-in with it on boot (implemented in the
+ * synap-proton-bridge repo); no manual `protonmail-bridge login` step remains. If
+ * Proton throws a one-time human-verification challenge (more likely on
+ * datacenter/VPS IPs), a URL appears in the bridge logs to click once — see
+ * `printNextSteps`.
+ *
+ * Automates everything that CAN be automated:
+ *
+ *   1. lets you CHOOSE which saved pod the bridge connects to (kept separate
+ *      from your global CLI pod via the "proton" surface override), then
+ *      resolves a durable hub key + workspace from it
+ *   2. sanity-checks pod reachability + key scope (GET /capabilities)
+ *   3. applies the bridge's OWN capability definition (POST /capabilities/apply)
+ *      — read from the bridge repo so there is ONE source of truth
+ *   4. writes the bridge .env (pod creds + vault ref), preserving any other
+ *      existing keys, and purges any raw Proton env credentials once vaulted
+ *   5. prints the one-time human-verification note (only a human can click it)
+ *
+ * Hidden on purpose: this is a dogfood/dev convenience, not a first-class
+ * surface. Not shown in `synap --help`.
+ *
+ * The bridge lands data POD-WIDE by default. An OPTIONAL project scope can be
+ * picked interactively (or via --project-id); --workspace-id remains an
+ * advanced/legacy escape hatch to pin a single workspace, never prompted.
+ *
+ * Usage:
+ *   synap proton-setup [--bridge-dir <path>] [--pod <profile-name>]
+ *     [--workspace-id <uuid>] [--project-id <uuid>] [--pod-url <url>] [--api-key <key>]
+ *     [--proton-email <email>] [--proton-password <password>]
+ *     [--proton-totp-seed <seed>] [--proton-mailbox-password <password>]
+ */
+import path from "node:path";
+import os from "node:os";
+import fs from "node:fs";
+import { writeSecretFile } from "../lib/atomic-file.js";
+import { createRequire } from "node:module";
+import chalk from "chalk";
+import ora from "ora";
+import prompts from "prompts";
+import { hubGet, hubPost, resolveUserId, renderHubError } from "../lib/hub-client.js";
+import { fetchProjects } from "../lib/project.js";
+import { checkPodHealth, getSurfaceAgentKey, setSurfaceAgentKey, listPodProfiles, getSurfacePodName, setSurfacePod, podNotFoundError, } from "../lib/pod.js";
+import { enrollAgentIfNeeded, ensureAgentGovernance, provisionAgentKey, configureAgentContext, } from "../lib/targets.js";
+import { log, banner } from "../utils/logger.js";
+const DEFAULT_BRIDGE_DIR = path.join(os.homedir(), "Documents", "Code", "synap-proton-bridge");
+/**
+ * Pick the pod the BRIDGE connects to — independent of the global CLI pod.
+ *
+ * The bridge is the "proton" surface, so we resolve/persist its pod via the
+ * per-surface override (setSurfacePod) and NEVER touch the global activePod.
+ * That lets the operator keep a personal pod as their CLI default while the
+ * Proton bridge points at a different (e.g. team / client) pod.
+ *
+ * Order: explicit --pod-url/--api-key escape hatch → --pod <name> →
+ * single saved profile (auto) → interactive picker (default = the pod already
+ * assigned to the proton surface, else the CLI-active one).
+ */
+async function resolveBridgePod(opts) {
+    // 1. Raw URL+key escape hatch — bypasses profiles entirely.
+    if (opts.podUrl && opts.apiKey) {
+        return {
+            cfg: { podUrl: opts.podUrl, apiKey: opts.apiKey, userId: process.env.SYNAP_USER_ID ?? "cli" },
+            podName: null,
+        };
+    }
+    const profiles = listPodProfiles();
+    if (profiles.length === 0) {
+        throw new Error("No pod profiles saved. Run `synap pods add` first, or pass --pod-url and --api-key.");
+    }
+    // 2. Resolve which profile to use.
+    let chosen;
+    if (opts.pod) {
+        chosen = profiles.find((p) => p.name === opts.pod);
+        if (!chosen)
+            throw podNotFoundError(opts.pod);
+    }
+    else if (profiles.length === 1) {
+        chosen = profiles[0];
+        log.dim(`Using your only saved pod profile: ${chosen.name}`);
+    }
+    else {
+        const defaultName = getSurfacePodName("proton") ?? profiles.find((p) => p.active)?.name ?? profiles[0].name;
+        const initial = Math.max(0, profiles.findIndex((p) => p.name === defaultName));
+        const { picked } = await prompts({
+            type: "select",
+            name: "picked",
+            message: "Which data pod should the Proton bridge connect to?",
+            initial,
+            choices: profiles.map((p) => ({
+                title: `${p.name}${p.active ? " (CLI default)" : ""}`,
+                description: p.config.podUrl,
+                value: p.name,
+            })),
+        });
+        if (!picked)
+            throw new Error("No pod selected — aborting.");
+        chosen = profiles.find((p) => p.name === picked);
+    }
+    // Remember the choice for the proton surface — without changing the CLI default.
+    setSurfacePod("proton", chosen.name);
+    const c = chosen.config;
+    return {
+        cfg: {
+            podUrl: c.podUrl,
+            apiKey: c.hubApiKey,
+            userId: c.agentUserId,
+            workspaceId: c.workspaceId || undefined,
+        },
+        podName: chosen.name,
+    };
+}
+export async function protonSetup(opts) {
+    banner();
+    log.heading("Proton Mail bridge — one-shot setup");
+    // ── 1. Choose the pod the BRIDGE connects to (independent of the CLI pod) ──
+    let cfg;
+    let bridgePodName = null;
+    try {
+        const resolved = await resolveBridgePod(opts);
+        cfg = resolved.cfg;
+        bridgePodName = resolved.podName;
+    }
+    catch (err) {
+        log.error(err.message);
+        log.dim("Run `synap init` or `synap pods add` first to save a pod + key.");
+        process.exit(1);
+    }
+    if (!cfg.podUrl || !cfg.apiKey) {
+        log.error("No pod URL / API key resolved. Run `synap init` first.");
+        process.exit(1);
+    }
+    // ── 2. Pod health ────────────────────────────────────────────────────────
+    const health = await checkPodHealth(cfg.podUrl);
+    if (!health.healthy) {
+        log.error(`Pod not reachable at ${cfg.podUrl}`);
+        process.exit(1);
+    }
+    log.success(`Pod healthy: ${cfg.podUrl}${bridgePodName ? ` (profile: ${bridgePodName})` : ""}`);
+    // ── 3. Resolve scope — pod-wide by default, workspace/project optional ───
+    const { workspaceId, projectId } = await resolveScope(opts, cfg);
+    log.dim(workspaceId ? `Workspace: ${workspaceId} (explicit pin)` : "Workspace: pod-wide (no pin)");
+    if (projectId)
+        log.dim(`Project: ${projectId}`);
+    // ── 3b. Key + scope sanity check (GET /capabilities needs hub-protocol.read) ─
+    const probe = ora("Checking key scope…").start();
+    try {
+        await hubGet("/capabilities", { workspaceId }, cfg);
+        probe.succeed("Key valid (hub-protocol scope OK)");
+    }
+    catch (err) {
+        probe.fail("Key/scope check failed");
+        renderHubError(err);
+        log.dim("The key may be expired or missing scope. Run `synap keys rotate` or `synap init`.");
+        process.exit(1);
+    }
+    // ── 3c. Provision a Proton AGENT key linked to the operator ──────────────
+    // The bridge must run as a real backend agent — NOT with the operator's raw
+    // key. An agent key carries linkedUserId=<operator>; the backend remaps its
+    // reads to the operator's data floor (hub-protocol-rest.ts auth middleware)
+    // while attributing writes to the agent for governed proposals. All the
+    // operator-key work below (capability apply, vault grant) keeps using `cfg`.
+    const agentKey = await provisionProtonAgentKey(cfg.podUrl, cfg.apiKey, cfg.workspaceId);
+    // ── 4. Provision the capability (vault credential + tool) ────────────────
+    const bridgeDir = opts.bridgeDir ?? DEFAULT_BRIDGE_DIR;
+    const protonCredentials = await resolveProtonCredentials(opts);
+    const protonCredentialsJson = protonCredentials
+        ? JSON.stringify(protonCredentials)
+        : undefined;
+    const { vaultRef, secretId } = await applyBridgeCapability(bridgeDir, workspaceId, cfg, protonCredentialsJson);
+    // ── 5. Choose agent governance mode ──────────────────────────────────
+    const protonAgentUserId = getSurfaceAgentKey("proton")?.agentUserId;
+    if (protonAgentUserId) {
+        await ensureAgentGovernance(cfg, protonAgentUserId, opts.governance);
+    }
+    // ── 6. Grant the bridge redeem access — credentials live ONLY in the vault ─
+    let granted = false;
+    if (secretId && protonCredentialsJson) {
+        // Grant to the AGENT (the bridge's redeem identity), not the operator.
+        const agentUserId = getSurfaceAgentKey("proton")?.agentUserId;
+        granted = await grantRedeemAccess(secretId, cfg, agentUserId);
+    }
+    // ── 7. Write the bridge .env ─────────────────────────────────────────────
+    const envPath = path.join(bridgeDir, ".env");
+    const managed = {
+        SYNAP_POD_URL: cfg.podUrl,
+        // The bridge runs as the Proton AGENT (linked to the operator), not with
+        // the operator's raw key. Reads remap to the operator floor; writes are
+        // governed as the agent.
+        SYNAP_HUB_API_KEY: agentKey,
+    };
+    // Pod-wide by default: SYNAP_WORKSPACE_ID/SYNAP_PROJECT_ID are only written
+    // when the operator explicitly pinned a workspace (--workspace-id) or chose
+    // a project in the picker. Neither is required.
+    if (workspaceId)
+        managed.SYNAP_WORKSPACE_ID = workspaceId;
+    if (projectId)
+        managed.SYNAP_PROJECT_ID = projectId;
+    // The account credentials are NEVER written to .env — they live in the pod
+    // vault (one JSON secret: email/password/totpSeed) and the bridge redeems
+    // them on boot via this ref to auto-log-in. (Requires the grant below to
+    // land; if it didn't, we warn loudly rather than leaking creds to env.)
+    // The bridge reads SYNAP_PROTON_CREDENTIALS_REF (see
+    // synap-proton-bridge/src/synapCapabilities.js).
+    if (vaultRef)
+        managed.SYNAP_PROTON_CREDENTIALS_REF = vaultRef;
+    try {
+        // Once the credentials are in the vault, purge any stale raw env copies.
+        // Also purge a stale scope pin from a prior run — re-running pod-wide (no
+        // --workspace-id / no project picked) must actually clear an old pin, not
+        // leave it dangling since managed only WRITES the keys it resolves.
+        const removeKeys = [
+            ...(vaultRef
+                ? [
+                    "PROTON_BRIDGE_PASSWORD",
+                    "SYNAP_PROTON_PASSWORD_REF",
+                    "PROTON_EMAIL",
+                    "PROTON_PASSWORD",
+                    "PROTON_TOTP_SEED",
+                ]
+                : []),
+            ...(workspaceId ? [] : ["SYNAP_WORKSPACE_ID"]),
+            ...(projectId ? [] : ["SYNAP_PROJECT_ID"]),
+        ];
+        upsertEnv(envPath, managed, removeKeys);
+        log.success(`Wrote pod credentials → ${envPath}`);
+    }
+    catch (err) {
+        log.warn(`Could not write ${envPath}: ${err.message}`);
+        log.dim("Set these manually in the bridge .env:");
+        for (const [k, v] of Object.entries(managed)) {
+            log.dim(`  ${k}=${k === "SYNAP_HUB_API_KEY" ? "<key>" : v}`);
+        }
+    }
+    // ── 8. Next steps (the human-only remainder) ─────────────────────────────
+    printNextSteps(bridgeDir, {
+        hasCredentials: Boolean(protonCredentialsJson),
+        vaultRef,
+        granted,
+    });
+}
+// ── Helpers ─────────────────────────────────────────────────────────────────
+/**
+ * Provision a Proton AGENT key linked to the operator, via the shared
+ * `provisionAgentKey()` wrapper (same door every target in `lib/targets.ts`
+ * uses). The resulting key carries linkedUserId=<operator>, so the backend
+ * remaps its reads/redeems to the operator's data floor.
+ *
+ * idempotent: true — REUSE the existing valid key rather than rotate it. A
+ * live bridge holds this key in its .env; minting fresh would revoke it and
+ * 401 the bridge until it's redeployed. `requireApproval: false` keeps this a
+ * one-shot, non-interactive mint rather than opening a browser approval wait.
+ *
+ * @param podUrl      Pod base URL.
+ * @param operatorKey The operator's raw hub key (authorizes the provisioning).
+ * @param workspaceId Workspace to enroll the agent into (omit for all).
+ * @returns the Proton agent key to write as SYNAP_HUB_API_KEY.
+ */
+async function provisionProtonAgentKey(podUrl, operatorKey, workspaceId) {
+    const spinner = ora("Provisioning Proton agent key…").start();
+    let hubApiKey;
+    let agentUserId;
+    try {
+        const result = await provisionAgentKey(podUrl, operatorKey, "proton", {
+            requireApproval: false,
+            idempotent: true,
+        });
+        hubApiKey = result.hubApiKey;
+        agentUserId = result.agentUserId;
+        spinner.succeed(result.reused
+            ? "Proton agent key reused (same key — no rotation, no bridge restart needed)"
+            : "Proton agent key minted (new key — redeploy the bridge to pick it up)");
+    }
+    catch (err) {
+        spinner.fail("Could not provision the Proton agent key");
+        log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    // Persist so downstream steps (governance lookup, .env write) can read it back.
+    setSurfaceAgentKey("proton", { hubApiKey, agentUserId });
+    // Enroll the agent user into the operator's workspace(s) using the OPERATOR
+    // key (before the bridge ever uses the agent key).
+    await enrollAgentIfNeeded(podUrl, operatorKey, agentUserId, workspaceId);
+    // Same CONTEXT.md routing file every other provisioned agent gets.
+    try {
+        await configureAgentContext(podUrl, operatorKey, "proton", agentUserId);
+    }
+    catch (err) {
+        log.warn(`Agent context wizard failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return hubApiKey;
+}
+/**
+ * Resolve the OPTIONAL scope the bridge writes into — pod-wide by default.
+ *
+ * Workspace: an explicit --workspace-id is the only way to pin one (advanced/
+ * legacy escape hatch) — never prompted, never required.
+ *
+ * Project: a peer, independent lens. --project-id skips the prompt; otherwise
+ * offer a picker with "Pod-wide (no project)" as the default alongside the
+ * operator's existing projects. No projects on the pod → skip the prompt.
+ */
+async function resolveScope(opts, cfg) {
+    const workspaceId = opts.workspaceId;
+    let projectId = opts.projectId;
+    if (!projectId) {
+        const projects = await fetchProjects(cfg);
+        if (projects.length > 0) {
+            const { picked } = await prompts({
+                type: "select",
+                name: "picked",
+                message: "Which project should the bridge write into? (optional — pod-wide by default)",
+                initial: 0,
+                choices: [
+                    { title: "Pod-wide (no project)", value: "" },
+                    ...projects.map((p) => ({ title: p.name, description: p.id, value: p.id })),
+                ],
+            });
+            projectId = picked || undefined;
+        }
+    }
+    return { workspaceId, projectId };
+}
+/**
+ * Prompt for the Proton ACCOUNT credentials (email/password/optional TOTP
+ * seed/optional mailbox password) — the same credentials you sign in to
+ * proton.me with. These are NOT a Bridge-generated password: the headless
+ * bridge uses them to auto-log-in on boot (implemented in the synap-proton-bridge
+ * repo). The password, TOTP seed, and mailbox password are secrets —
+ * prompted with `type: "password"` (never echoed) and stored ONLY in the pod
+ * vault; the email may be shown/passed as a flag.
+ */
+async function resolveProtonCredentials(opts) {
+    let email = opts.protonEmail;
+    if (!email) {
+        const { value } = await prompts({
+            type: "text",
+            name: "value",
+            message: "Proton account email — Settings → Account and password (proton.me sign-in):",
+        });
+        email = value || undefined;
+    }
+    let password = opts.protonPassword;
+    if (!password) {
+        const { value } = await prompts({
+            type: "password",
+            name: "value",
+            message: "Proton account password — this is your normal proton.me sign-in password, NOT the Organization key/password (leave blank to skip):",
+        });
+        password = value || undefined;
+    }
+    if (!email || !password)
+        return undefined;
+    let totpSeed = opts.protonTotpSeed;
+    if (totpSeed === undefined) {
+        const { value } = await prompts({
+            type: "password",
+            name: "value",
+            message: "(optional) Proton 2FA/TOTP seed — Settings → Account and password → Two-factor authentication, base32 (leave blank if 2FA is off):",
+        });
+        totpSeed = value || "";
+    }
+    let mailboxPassword = opts.protonMailboxPassword;
+    if (mailboxPassword === undefined) {
+        const { value } = await prompts({
+            type: "password",
+            name: "value",
+            message: "(optional) Proton mailbox password — ONLY if two-password mode is on (Settings → Account and password); leave blank otherwise:",
+        });
+        mailboxPassword = value || "";
+    }
+    return { email, password, totpSeed: totpSeed || "", mailboxPassword: mailboxPassword || "" };
+}
+async function applyBridgeCapability(bridgeDir, workspaceId, cfg, protonCredentialsJson) {
+    const spinner = ora("Provisioning capability…").start();
+    // Read the capability definition from the bridge repo — ONE source of truth.
+    // Documented shape (see proton.capability.json): vault ref "proton-account"
+    // (JSON-encoded Proton account credentials), tool "proton". Mirrors
+    // bridge-setup.ts's discord-bot read from synapCapabilities.js's
+    // CAPABILITY_DEFINITION export.
+    const capPath = path.join(bridgeDir, "src", "synapCapabilities.js");
+    let rawDef;
+    try {
+        const require = createRequire(import.meta.url);
+        const resolved = require.resolve(capPath);
+        if (require.cache && require.cache[resolved])
+            delete require.cache[resolved];
+        const mod = require(capPath);
+        rawDef = mod.CAPABILITY_DEFINITION;
+    }
+    catch (err) {
+        spinner.fail("Capability definition not found");
+        log.dim(`  Looked in: ${capPath}`);
+        log.dim(`  ${err.message}`);
+        log.dim("  NOTE: this reads the fork's own synapCapabilities.js (Wave C, built in " +
+            "parallel) — if it doesn't exist yet, the bridge repo isn't ready.");
+        return {};
+    }
+    if (!rawDef) {
+        spinner.fail("No CAPABILITY_DEFINITION export in the bridge");
+        return {};
+    }
+    // Deep-clone + inject the Proton account credentials JSON into the vault
+    // credential. With none provided, drop the vault + credentialRef so we
+    // never store an empty/placeholder secret.
+    const def = JSON.parse(JSON.stringify(rawDef));
+    if (protonCredentialsJson) {
+        for (const v of def.vault ?? []) {
+            if (typeof v.value === "string") {
+                v.value = v.value.replace("{{protonCredentialsJson}}", protonCredentialsJson);
+            }
+        }
+    }
+    else {
+        // No credentials → drop the vault and any tool credentialRef that
+        // referenced it (a bare template-local ref or a vault:// string), so we
+        // never store a placeholder secret or leave a dangling reference.
+        const vaultRefs = new Set((def.vault ?? []).map((v) => v.ref).filter((r) => Boolean(r)));
+        delete def.vault;
+        for (const t of def.tools ?? []) {
+            if (t.credentialRef &&
+                (vaultRefs.has(t.credentialRef) || t.credentialRef.startsWith("vault://"))) {
+                delete t.credentialRef;
+            }
+        }
+        spinner.text = "Provisioning capability (no credentials → structure only)…";
+    }
+    try {
+        const res = (await hubPost("/capabilities/apply", { definition: def, workspaceId }, cfg));
+        const tools = res.created?.tools?.length ?? 0;
+        const skills = res.created?.skills?.length ?? 0;
+        const vaultRef = res.created?.vault?.[0]?.vaultRef;
+        const secretId = res.created?.vault?.[0]?.secretId;
+        spinner.succeed(`Capability provisioned: ${res.capabilityKey ?? "?"} (${vaultRef ? "vault + " : ""}${tools} tool, ${skills} skill)`);
+        return { vaultRef, secretId };
+    }
+    catch (err) {
+        const msg = err.message;
+        spinner.fail("Capability apply failed");
+        log.error(`  ${msg}`);
+        if (protonCredentialsJson) {
+            // The Proton account credentials MUST be vaulted for the bridge to run
+            // — continuing to write a .env and printing "Done" would leave a
+            // crash-looping bridge (redeem 404). A frequent cause is a missing/
+            // empty VAULT_SERVER_KEY on the target pod's backend (the vault can't
+            // encrypt). Fail loud here.
+            if (/VAULT_SERVER_KEY/i.test(msg)) {
+                log.dim("  The target pod's secret vault is not configured.");
+                log.dim("  Set a durable VAULT_SERVER_KEY (openssl rand -hex 32) in the pod's");
+                log.dim("  deploy/.env, redeploy the backend, then re-run proton-setup.");
+            }
+            process.exit(1);
+        }
+        return {};
+    }
+}
+/**
+ * Grant the bridge principal redeem access to the Proton account credentials
+ * secret — the headless equivalent of the UI "grant access" flow, using the
+ * user's own credentials. After this, the credentials live ONLY in the
+ * vault; the bridge redeems them on boot to auto-log-in.
+ */
+async function grantRedeemAccess(secretId, cfg, agentUserId) {
+    const spinner = ora("Granting the bridge redeem access…").start();
+    try {
+        // The bridge redeems AS the agent: the backend binds redemption to the
+        // agent key's userId (linkedUserId remap → vault_grants.granted_to must be
+        // the AGENT, not the operator). Granting to the operator leaves the bridge
+        // with no_grant. Fall back to the operator only if the agent id is unknown.
+        const principal = agentUserId || (await resolveUserId(cfg));
+        const res = (await hubPost(`/vault/secrets/${secretId}/grant`, { grantedTo: principal, scope: "permanent" }, cfg));
+        if (res.status === "proposed") {
+            // An agent key cannot grant vault access by itself: the pod filed it for
+            // the secret owner's approval. Nothing is granted until it is approved.
+            spinner.warn("Redeem access is waiting for your approval");
+            if (res.reviewUrl)
+                log.dim(`  Approve it: ${res.reviewUrl}`);
+            return false;
+        }
+        spinner.succeed(`Redeem access granted${res.reused ? " (existing)" : ""} — password stays in the vault`);
+        return Boolean(res.grantId);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (msg.includes("404")) {
+            spinner.warn("Grant door not deployed yet — deploy the backend, then re-run this command");
+        }
+        else {
+            spinner.warn(`Grant skipped: ${msg}`);
+        }
+        return false;
+    }
+}
+/**
+ * Upsert KEY=value lines into a dotenv file, preserving comments and any other
+ * keys. Existing managed keys are replaced in place; new ones are appended.
+ */
+function upsertEnv(filePath, kv, remove = []) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+        throw new Error(`bridge dir not found: ${dir}`);
+    }
+    const existing = fs.existsSync(filePath)
+        ? fs.readFileSync(filePath, "utf-8")
+        : "";
+    const lines = existing.length ? existing.split("\n") : [];
+    const remaining = new Map(Object.entries(kv));
+    const removeSet = new Set(remove);
+    const out = [];
+    for (const line of lines) {
+        const m = line.match(/^([A-Z0-9_]+)=/);
+        if (m && removeSet.has(m[1]))
+            continue; // drop purged keys entirely
+        if (m && remaining.has(m[1])) {
+            const key = m[1];
+            out.push(`${key}=${remaining.get(key)}`);
+            remaining.delete(key);
+        }
+        else {
+            out.push(line);
+        }
+    }
+    if (remaining.size) {
+        if (out.length && out[out.length - 1] !== "")
+            out.push("");
+        out.push("# --- Synap pod (written by `synap proton-setup`) ---");
+        for (const [k, v] of remaining)
+            out.push(`${k}=${v}`);
+    }
+    writeSecretFile(filePath, out.join("\n"), { mode: 0o600 });
+}
+function printNextSteps(bridgeDir, state) {
+    log.blank();
+    log.heading("Done");
+    log.blank();
+    if (state.vaultRef && state.granted) {
+        console.log(`  ${chalk.green("✓")} Proton account credentials in the pod vault, bridge granted redeem access — no env password  ${chalk.dim(state.vaultRef)}`);
+    }
+    else if (state.vaultRef && state.hasCredentials) {
+        console.log(`  ${chalk.yellow("⚠")} Credentials stored in the vault (${chalk.dim(state.vaultRef)}) but the redeem GRANT did not land.`);
+        console.log(`     Deploy the backend (grant door) and re-run — the bridge can't log in until the grant exists.`);
+    }
+    console.log(`  ${chalk.green("✓")} Bridge .env written (pod creds; account credentials stay in the vault)`);
+    log.blank();
+    log.heading("Remaining (Proton Bridge — human only, one-time)");
+    log.blank();
+    console.log(`  ${chalk.bold("•")} The bridge auto-logs-in from the vault-stored Proton account credentials on next deploy —`);
+    console.log(`     no manual ${chalk.bold("protonmail-bridge login")} step needed.`);
+    console.log(`  ${chalk.bold("•")} If Proton demands a one-time human-verification challenge (more likely on datacenter/VPS IPs),`);
+    console.log(`     its URL appears in ${chalk.cyan("pm2 logs proton-bridge")} — click it once in a browser; it typically won't ask again.`);
+    console.log(`  ${chalk.bold("•")} IMAP: ${chalk.dim("127.0.0.1:1143")}  ·  SMTP: ${chalk.dim("127.0.0.1:1025")} (StartTLS, self-signed cert)`);
+    if (!state.hasCredentials) {
+        console.log(`  ${chalk.bold("•")} Proton account credentials not provisioned — re-run with ${chalk.cyan("--proton-email/--proton-password")} (stores them in the vault)`);
+    }
+    log.blank();
+    console.log(`  Then: ${chalk.green(`cd ${bridgeDir} && npm start`)}`);
+    log.blank();
+}
+//# sourceMappingURL=proton-setup.js.map

package/dist/commands/proton-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proton-setup.js","sourceRoot":"","sources":["../../src/commands/proton-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAoB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAkB,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAwBjD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,EAAE,CAAC,OAAO,EAAE,EACZ,WAAW,EACX,MAAM,EACN,qBAAqB,CACtB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAqB;IAErB,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,EAAE;YAC7F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,IAAI,MAA+E,CAAC;IACpF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,sCAAsC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GACf,iBAAiB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;QAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qDAAqD;YAC9D,OAAO;YACP,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;gBAC5B,KAAK,EAAE,CAAC,CAAC,IAAI;aACd,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5D,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IACpD,CAAC;IAED,iFAAiF;IACjF,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,CAAC,CAAC,WAAW;YACrB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;SACxC;QACD,OAAO,EAAE,MAAM,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,EAAE,CAAC;IACT,GAAG,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAEnD,8EAA8E;IAC9E,IAAI,GAAc,CAAC;IACnB,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACnB,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,gBAAgB,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhG,4EAA4E;IAC5E,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,iBAAiB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;IACnG,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC;IAEhD,gFAAgF;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,KAAK,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAExF,4EAA4E;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,qBAAqB,GAAG,iBAAiB;QAC7C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CACxD,SAAS,EACT,WAAW,EACX,GAAG,EACH,qBAAqB,CACtB,CAAC;IAEF,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IACpE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,qBAAqB,EAAE,CAAC;QACtC,uEAAuE;QACvE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;QAC9D,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,GAAG,CAAC,MAAM;QACzB,yEAAyE;QACzE,wEAAwE;QACxE,yBAAyB;QACzB,iBAAiB,EAAE,QAAQ;KAC5B,CAAC;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,WAAW;QAAE,OAAO,CAAC,kBAAkB,GAAG,WAAW,CAAC;IAC1D,IAAI,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpD,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,qDAAqD;IACrD,iDAAiD;IACjD,IAAI,QAAQ;QAAE,OAAO,CAAC,4BAA4B,GAAG,QAAQ,CAAC;IAE9D,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC;oBACE,wBAAwB;oBACxB,2BAA2B;oBAC3B,cAAc;oBACd,iBAAiB;oBACjB,kBAAkB;iBACnB;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;SAC3C,CAAC;QACF,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,cAAc,CAAC,SAAS,EAAE;QACxB,cAAc,EAAE,OAAO,CAAC,qBAAqB,CAAC;QAC9C,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,WAAmB,EACnB,WAA+B;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE9D,IAAI,SAAiB,CAAC;IACtB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE;YACpE,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,OAAO,CAAC,OAAO,CACb,MAAM,CAAC,MAAM;YACX,CAAC,CAAC,4EAA4E;YAC9E,CAAC,CAAC,uEAAuE,CAC5E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gFAAgF;IAChF,kBAAkB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAEzE,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CACzB,IAAkD,EAClD,GAAiD;IAEjD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAErC,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;gBAC/B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8EAA8E;gBACvF,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE;oBAC7C,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;iBAC5E;aACF,CAAC,CAAC;YACH,SAAS,GAAI,MAAiB,IAAI,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAqB;IAIrB,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;QACH,KAAK,GAAI,KAAgB,IAAI,SAAS,CAAC;IACzC,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;YAC9B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,OAAO;YACb,OAAO,EACL,oIAAoI;SACvI,CAAC,CAAC;QACH,QAAQ,GAAI,KAAgB,IAAI,SAAS,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE1C,IAAI,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;YAC9B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,OAAO;YACb,OAAO,EACL,oIAAoI;SACvI,CAAC,CAAC;QACH,QAAQ,GAAI,KAAgB,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC;IACjD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;YAC9B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,OAAO;YACb,OAAO,EACL,gIAAgI;SACnI,CAAC,CAAC;QACH,eAAe,GAAI,KAAgB,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,WAA+B,EAC/B,GAAiD,EACjD,qBAAyC;IAEzC,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IACxD,6EAA6E;IAC7E,4EAA4E;IAC5E,oEAAoE;IACpE,iEAAiE;IACjE,gCAAgC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACpE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAwC,CAAC;QACpE,MAAM,GAAG,GAAG,CAAC,qBAAqB,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,GAAG,CACL,2EAA2E;YACzE,mEAAmE,CACtE,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAG5C,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAC3E,CAAC;QACF,OAAO,GAAG,CAAC,KAAK,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IACE,CAAC,CAAC,aAAa;gBACf,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;gBACD,OAAO,CAAC,CAAC,aAAa,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,4DAA4D,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CACxB,qBAAqB,EACrB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,EAChC,GAAG,CACJ,CAOA,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACnD,OAAO,CAAC,OAAO,CACb,2BAA2B,GAAG,CAAC,aAAa,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,UAAU,MAAM,SAAS,CACpH,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACtB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,uEAAuE;YACvE,iEAAiE;YACjE,oEAAoE;YACpE,sEAAsE;YACtE,4BAA4B;YAC5B,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;gBAC9D,GAAG,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,GAAiD,EACjD,WAAoB;IAEpB,MAAM,OAAO,GAAG,GAAG,CAAC,oCAAoC,CAAC,CAAC,KAAK,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CACxB,kBAAkB,QAAQ,QAAQ,EAClC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAC5C,GAAG,CACJ,CAKA,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,yEAAyE;YACzE,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,OAAO,CACb,wBAAwB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gCAAgC,CACxF,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAChB,QAAgB,EAChB,EAA0B,EAC1B,SAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,4BAA4B;QACpE,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,CAAC,CAAC;YAC1C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CACrB,SAAiB,EACjB,KAAuE;IAEvE,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iGAAiG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjK,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QACxI,OAAO,CAAC,GAAG,CAAC,mGAAmG,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IAC5G,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;IAC9H,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IACnI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,8DAA8D,CAAC,CAAC;IAC3I,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC/I,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,6DAA6D,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,6BAA6B,CAAC,CAAC;IAC5K,CAAC;IACD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,eAAe,CAAC,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,CAAC;AACd,CAAC"}

package/dist/commands/providers.d.ts

@@ -35,4 +35,27 @@ export declare function providersPull(opts: {
     target?: string;
     podUrl?: string;
     apiKey?: string;
+    showKey?: boolean;
+}): Promise<void>;
+/**
+ * Store a per-user API key override for a provider.
+ *
+ * synap providers set-key <providerId> [--workspace <id>]
+ */
+export declare function providersSetKey(opts: {
+    providerId: string;
+    workspaceId?: string;
+    apiKey?: string;
+    podUrl?: string;
+    hubApiKey?: string;
+}): Promise<void>;
+/**
+ * List user/workspace-level key overrides.
+ *
+ * synap providers list-keys [--workspace <id>]
+ */
+export declare function providersListKeys(opts: {
+    workspaceId?: string;
+    podUrl?: string;
+    hubApiKey?: string;
 }): Promise<void>;