@synap-core/cli 1.11.0 → 1.12.2

package/dist/lib/approval-poll.d.ts

@@ -4,8 +4,8 @@
  * The create→approve→poll shape used by both:
  *   - CP login (`login()` in auth.ts) — poll the CP for a session token + pod,
  *     gated by a pollSecret Bearer header.
- *   - Pod agent-key approval (`provisionAgentKey` in targets.ts) — poll the pod
- *     for key activation, gated by the human API key.
+ *   - (Pod agent-key approval no longer polls here: it waits on the pending
+ *     key's own `/auth/key-state` — `waitForKeyLive` in key-approval.ts.)
  *
  * No localhost server, no redirect back to the CLI — the browser only APPROVES
  * a pending record; the CLI holds a secret and polls for the outcome. Every
@@ -16,6 +16,23 @@ export interface PollForApprovalOptions<T> {
     url: string;
     /** Auth/other headers sent on every poll (e.g. Bearer pollSecret). */
     headers?: Record<string, string>;
+    /** HTTP method. Default GET. */
+    method?: "GET" | "POST";
+    /** JSON body sent on every poll (POST), e.g. an RFC 8628 `device_code`. */
+    body?: string;
+    /**
+     * Hand a 4xx JSON body to the predicates instead of treating it as a blip.
+     * RFC 8628 answers every not-yet-approved poll with a 400
+     * (`authorization_pending`, `slow_down`, `access_denied`, `expired_token`).
+     * 5xx and unparsable bodies stay transient. Default false.
+     */
+    readErrorBodies?: boolean;
+    /**
+     * The delay before the next poll, given the parsed response and the current
+     * delay — RFC 8628 §3.5 `slow_down` widens it for the rest of the wait.
+     * Default: unchanged.
+     */
+    nextIntervalMs?: (data: unknown, currentMs: number) => number;
     /** Delay between polls. Default 2000ms. */
     intervalMs?: number;
     /** Overall deadline. Default 120_000ms. */
@@ -32,6 +49,18 @@ export interface PollForApprovalOptions<T> {
     rejectedError?: string;
     /** Error thrown when the deadline elapses. */
     timeoutError?: string;
+    /**
+     * Called once per loop iteration, after the fetch attempt. `data` is the
+     * parsed body, or null when the tick was a network blip / non-2xx / unparsable.
+     *
+     * Exists so a caller waiting minutes (corpus import) can show a heartbeat
+     * WITHOUT forking a second poll loop. Optional and default-undefined — the
+     * approval callers (CP login, agent-key) are byte-for-byte unaffected.
+     */
+    onTick?: (info: {
+        data: unknown | null;
+        elapsedMs: number;
+    }) => void;
 }
 /**
  * Poll `url` until the response is approved (→ resolve with `onApproved`),

package/dist/lib/approval-poll.js

@@ -4,8 +4,8 @@
  * The create→approve→poll shape used by both:
  *   - CP login (`login()` in auth.ts) — poll the CP for a session token + pod,
  *     gated by a pollSecret Bearer header.
- *   - Pod agent-key approval (`provisionAgentKey` in targets.ts) — poll the pod
- *     for key activation, gated by the human API key.
+ *   - (Pod agent-key approval no longer polls here: it waits on the pending
+ *     key's own `/auth/key-state` — `waitForKeyLive` in key-approval.ts.)
  *
  * No localhost server, no redirect back to the CLI — the browser only APPROVES
  * a pending record; the CLI holds a secret and polls for the outcome. Every
@@ -18,27 +18,40 @@
  * and simply retried until the deadline.
  */
 export async function pollForApproval(opts) {
-    const intervalMs = opts.intervalMs ?? 2000;
+    let intervalMs = opts.intervalMs ?? 2000;
     const timeoutMs = opts.timeoutMs ?? 120_000;
     const requestTimeoutMs = opts.requestTimeoutMs ?? 30_000;
-    const deadline = Date.now() + timeoutMs;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutMs;
+    const tick = (data) => opts.onTick?.({ data, elapsedMs: Date.now() - startedAt });
     while (Date.now() < deadline) {
         await new Promise((r) => setTimeout(r, intervalMs));
         let res;
         try {
             res = await fetch(opts.url, {
-                headers: opts.headers,
+                method: opts.method ?? "GET",
+                headers: opts.body ? { "Content-Type": "application/json", ...opts.headers } : opts.headers,
+                ...(opts.body ? { body: opts.body } : {}),
                 signal: AbortSignal.timeout(requestTimeoutMs),
             });
         }
         catch {
+            tick(null);
             continue; // network blip — retry
         }
-        if (!res.ok)
+        const readable = res.ok || (opts.readErrorBodies === true && res.status >= 400 && res.status < 500);
+        if (!readable) {
+            tick(null);
             continue; // transient (throttle/5xx) — retry
+        }
         const data = (await res.json().catch(() => null));
-        if (data === null)
+        if (data === null) {
+            tick(null);
             continue;
+        }
+        tick(data);
+        if (opts.nextIntervalMs)
+            intervalMs = opts.nextIntervalMs(data, intervalMs);
         if (opts.isRejected(data)) {
             throw new Error(opts.rejectedError ?? "Request was rejected.");
         }

package/dist/lib/approval-poll.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-poll.js","sourceRoot":"","sources":["../../src/lib/approval-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAyBH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA+B;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAExC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAEpD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,uBAAuB;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,SAAS,CAAC,mCAAmC;QAE1D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;QAC7D,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAE5B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,uBAAuB;IACzB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,iCAAiC,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"approval-poll.js","sourceRoot":"","sources":["../../src/lib/approval-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmDH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA+B;IAE/B,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAQ,EAAE,CAC1C,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IAE7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAEpD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;gBAC3F,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,CAAC;YACX,SAAS,CAAC,uBAAuB;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,CAAC;YACX,SAAS,CAAC,mCAAmC;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;QAC7D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACX,IAAI,IAAI,CAAC,cAAc;YAAE,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,uBAAuB;IACzB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,iCAAiC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/lib/atomic-file.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Config writes that cannot half-happen, and config reads that cannot mistake
+ * a broken file for an empty one.
+ *
+ * `~/.synap/config.json` holds every pod profile and every agent key. Two
+ * defects could wipe it:
+ *  1. `fs.writeFileSync` truncates first, then writes — a crash, a full disk or
+ *     a concurrent reader between the two sees (or keeps) an empty/partial file.
+ *  2. A parse failure was read as `{}` ("start fresh"), and the next write then
+ *     persisted that `{}` merged with one field — every other profile gone.
+ *
+ * So: write a temp file in the same directory, fsync it, rename it over the
+ * target (atomic on POSIX), keeping the target's mode (0600 for ~/.synap). And
+ * a file that exists but does not parse THROWS — it is never an empty config.
+ */
+/** The file exists but is not valid JSON — never to be treated as empty. */
+export declare class ConfigUnreadableError extends Error {
+    readonly file: string;
+    readonly cause: unknown;
+    constructor(file: string, cause: unknown);
+}
+/** Parsed JSON object, or `null` ONLY when the file does not exist. Throws on anything else. */
+export declare function readJsonStrict<T = Record<string, unknown>>(file: string): T | null;
+/**
+ * Write `data` to `file` atomically: temp file in the same directory → fsync →
+ * rename. The mode is `opts.mode`, else the existing file's mode, else 0600.
+ */
+export declare function writeFileAtomic(file: string, data: string, opts?: {
+    mode?: number;
+}): void;
+/**
+ * The ONE door for a file that holds a credential and is written in place.
+ *
+ * `fs.writeFileSync(f, d, { mode: 0o600 })` applies the mode only when it
+ * CREATES the file — an existing 0644 file keeps 0644. So write, then chmod.
+ * Accepts the same `{ mode }` options object so call sites swap in by name.
+ */
+export declare function writeSecretFile(file: string, data: string, opts?: {
+    mode?: number;
+}): void;
+/** Copy a file that may hold credentials (a `.bak`) and force it to 0600. */
+export declare function copySecretBackup(src: string, dst: string): void;
+/**
+ * Create `dir` (and parents) as 0700 and tighten it if it already existed.
+ * Only for directories Synap owns (`~/.synap`, `~/.synap/contexts`) — never a
+ * client's own config directory.
+ */
+export declare function ensureSecretDir(dir: string): void;

package/dist/lib/atomic-file.js

@@ -0,0 +1,129 @@
+/**
+ * Config writes that cannot half-happen, and config reads that cannot mistake
+ * a broken file for an empty one.
+ *
+ * `~/.synap/config.json` holds every pod profile and every agent key. Two
+ * defects could wipe it:
+ *  1. `fs.writeFileSync` truncates first, then writes — a crash, a full disk or
+ *     a concurrent reader between the two sees (or keeps) an empty/partial file.
+ *  2. A parse failure was read as `{}` ("start fresh"), and the next write then
+ *     persisted that `{}` merged with one field — every other profile gone.
+ *
+ * So: write a temp file in the same directory, fsync it, rename it over the
+ * target (atomic on POSIX), keeping the target's mode (0600 for ~/.synap). And
+ * a file that exists but does not parse THROWS — it is never an empty config.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+/** The file exists but is not valid JSON — never to be treated as empty. */
+export class ConfigUnreadableError extends Error {
+    file;
+    cause;
+    constructor(file, cause) {
+        super(`${file} exists but could not be read as JSON (${cause instanceof Error ? cause.message : String(cause)}). ` +
+            `Nothing was written. Fix the file, or move it aside and run \`synap init\` again.`);
+        this.file = file;
+        this.cause = cause;
+        this.name = "ConfigUnreadableError";
+    }
+}
+/** Parsed JSON object, or `null` ONLY when the file does not exist. Throws on anything else. */
+export function readJsonStrict(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw new ConfigUnreadableError(file, err);
+    }
+    try {
+        const v = JSON.parse(raw);
+        if (!v || typeof v !== "object" || Array.isArray(v))
+            throw new Error("not a JSON object");
+        return v;
+    }
+    catch (err) {
+        throw new ConfigUnreadableError(file, err);
+    }
+}
+/**
+ * Write `data` to `file` atomically: temp file in the same directory → fsync →
+ * rename. The mode is `opts.mode`, else the existing file's mode, else 0600.
+ */
+export function writeFileAtomic(file, data, opts = {}) {
+    const dir = path.dirname(file);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    let mode = opts.mode;
+    if (mode === undefined) {
+        try {
+            mode = fs.statSync(file).mode & 0o777;
+        }
+        catch {
+            mode = 0o600;
+        }
+    }
+    const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+    const fd = fs.openSync(tmp, "wx", mode);
+    try {
+        fs.writeFileSync(fd, data);
+        fs.fsyncSync(fd);
+    }
+    catch (err) {
+        fs.closeSync(fd);
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+    fs.closeSync(fd);
+    // openSync's mode is filtered by the umask; set it exactly.
+    fs.chmodSync(tmp, mode);
+    try {
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+    // Persist the rename itself (best-effort: not every platform can fsync a dir).
+    try {
+        const dfd = fs.openSync(dir, "r");
+        try {
+            fs.fsyncSync(dfd);
+        }
+        finally {
+            fs.closeSync(dfd);
+        }
+    }
+    catch {
+        /* Windows / unsupported */
+    }
+}
+/**
+ * The ONE door for a file that holds a credential and is written in place.
+ *
+ * `fs.writeFileSync(f, d, { mode: 0o600 })` applies the mode only when it
+ * CREATES the file — an existing 0644 file keeps 0644. So write, then chmod.
+ * Accepts the same `{ mode }` options object so call sites swap in by name.
+ */
+export function writeSecretFile(file, data, opts = {}) {
+    const mode = opts.mode ?? 0o600;
+    fs.writeFileSync(file, data, { mode });
+    fs.chmodSync(file, mode);
+}
+/** Copy a file that may hold credentials (a `.bak`) and force it to 0600. */
+export function copySecretBackup(src, dst) {
+    fs.copyFileSync(src, dst);
+    fs.chmodSync(dst, 0o600);
+}
+/**
+ * Create `dir` (and parents) as 0700 and tighten it if it already existed.
+ * Only for directories Synap owns (`~/.synap`, `~/.synap/contexts`) — never a
+ * client's own config directory.
+ */
+export function ensureSecretDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+}
+//# sourceMappingURL=atomic-file.js.map

package/dist/lib/atomic-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-file.js","sourceRoot":"","sources":["../../src/lib/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,IAAY,EACZ,KAAc;QAEvB,KAAK,CACH,GAAG,IAAI,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;YAC1G,mFAAmF,CACtF,CAAC;QANO,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAAS;QAMvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAA8B,IAAY;IACtE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1F,OAAO,CAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjB,4DAA4D;IAC5D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACvD,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/lib/auth.d.ts

@@ -39,6 +39,12 @@ export declare function isLoggedIn(): Promise<{
  * Get a token from: https://synap.live/account/tokens
  */
 export declare function loginWithToken(token: string): Promise<StoredCredentials | null>;
+/**
+ * Best effort: try to open a browser on THIS machine. Never throws, never
+ * blocks long. Callers print the URL first, so a box with no browser (SSH,
+ * a server) still has the one instruction it needs.
+ */
+export declare function openBrowser(url: string): boolean;
 /**
  * Browser login via the CP poll-based approval flow.
  *
@@ -65,20 +71,19 @@ export interface PodCallbackResult {
 }
 export declare function waitForPodCallback(timeoutMs?: number): Promise<PodCallbackResult | null>;
 export declare function getCpUrl(): string;
+/** One pod as the CP's `GET /pods` lists it (routes/pods.ts, `podUrl(pod)`). */
 export interface Pod {
     id: string;
     subdomain: string;
     customDomain: string | null;
     status: string;
-    region: string;
-    url: string;
+    podUrl?: string;
 }
-export declare function listPods(token: string): Promise<Pod[]>;
 /**
- * Get the remote OpenClaw provisioning status from the CP.
- * Returns null if not provisioned or on network error.
+ * The pod's public URL. The CP sends it as `podUrl`; when absent, derive it the
+ * way the CP does (lib/pod-public-url.ts): the custom domain wins over
+ * `<subdomain>.synap.live`. Reading a non-existent `url` field here once sent
+ * a custom-domain pod (pod.antoinesrvt.synap.live) to perso.synap.live.
  */
-export declare function getOpenClawRemoteStatus(cpToken: string, podId: string): Promise<{
-    status: "not_provisioned" | "provisioning" | "running" | "error";
-    url: string | null;
-} | null>;
+export declare function podUrlOf(pod: Pick<Pod, "podUrl" | "customDomain" | "subdomain">): string;
+export declare function listPods(token: string): Promise<Pod[]>;

package/dist/lib/auth.js

@@ -13,25 +13,29 @@
  * managed-pod provisioning path, not login.)
  */
 import http from "node:http";
-import { execSync } from "node:child_process";
+import { openExternalUrl } from "./safe-open.js";
 import fs from "node:fs";
+import { ensureSecretDir, writeSecretFile } from "./atomic-file.js";
 import path from "node:path";
 import os from "node:os";
 const CP_URL = process.env.SYNAP_CP_URL || "https://api.synap.live";
 const LANDING_URL = process.env.SYNAP_LANDING_URL || "https://synap.live";
+/**
+ * How long a CLI login request lives on the CP (CLI_AUTH_TTL_SECONDS in
+ * synap-control-plane-api/src/lib/cli-auth.ts). Used only when the CP does not
+ * send `expiresAt`. Sign-in may happen on another device (a box over SSH), so
+ * the CLI waits as long as the request lives, not a couple of minutes.
+ */
+const CLI_LOGIN_REQUEST_TTL_MS = 15 * 60_000;
 const CREDENTIALS_DIR = path.join(os.homedir(), ".synap");
 const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
 // ─── Credential Storage ────────────────────────────────────────────────────
 function ensureCredentialsDir() {
-    if (!fs.existsSync(CREDENTIALS_DIR)) {
-        fs.mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 0o700 });
-    }
+    ensureSecretDir(CREDENTIALS_DIR);
 }
 function writeCredentials(creds) {
     ensureCredentialsDir();
-    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), {
-        mode: 0o600,
-    });
+    writeSecretFile(CREDENTIALS_FILE, JSON.stringify(creds, null, 2));
 }
 export function getStoredToken() {
     try {
@@ -115,26 +119,14 @@ export async function loginWithToken(token) {
     return creds;
 }
 // ─── Browser Login Flow ────────────────────────────────────────────────────
-function openBrowser(url) {
-    try {
-        switch (process.platform) {
-            case "darwin":
-                execSync(`open "${url}"`);
-                break;
-            case "linux":
-                execSync(`xdg-open "${url}"`);
-                break;
-            case "win32":
-                execSync(`start "" "${url}"`);
-                break;
-            default:
-                // Can't open browser — caller handles fallback
-                throw new Error("Unsupported platform");
-        }
-    }
-    catch {
-        throw new Error("Could not open browser");
-    }
+/**
+ * Best effort: try to open a browser on THIS machine. Never throws, never
+ * blocks long. Callers print the URL first, so a box with no browser (SSH,
+ * a server) still has the one instruction it needs.
+ */
+export function openBrowser(url) {
+    // argv only, http(s) only, no headless-Linux attempt — `safe-open.ts`.
+    return openExternalUrl(url);
 }
 /**
  * Browser login via the CP poll-based approval flow.
@@ -175,6 +167,10 @@ export async function login() {
     const { requestId, pollSecret, userCode } = created;
     if (!requestId || !pollSecret || !userCode)
         return null;
+    const expiresAtMs = created.expiresAt ? Date.parse(created.expiresAt) : NaN;
+    const waitMs = Number.isFinite(expiresAtMs) && expiresAtMs > Date.now()
+        ? expiresAtMs - Date.now()
+        : CLI_LOGIN_REQUEST_TTL_MS;
     // The CLI already owns its (self-hosted) pod locally — `synap login` is
     // ACCOUNT auth, not pod selection. Pass the active pod's host so the browser
     // can SHOW "your CLI is using <pod>" instead of forcing a redundant re-pick.
@@ -195,20 +191,18 @@ export async function login() {
     //    terminal so a phished approve link can't authorize someone else.
     const approveUrl = `${LANDING_URL}/cli?request=${encodeURIComponent(requestId)}` +
         (podLabel ? `&pod=${encodeURIComponent(podLabel)}` : "");
-    console.log(`\n  Enter this code in your browser to authorize the login:\n`);
-    console.log(`      ${userCode}\n`);
-    try {
-        openBrowser(approveUrl);
-    }
-    catch {
-        console.log(`  Open this URL in your browser:\n`);
-        console.log(`  ${approveUrl}\n`);
-    }
+    // The link + code are THE instruction (works from any device, e.g. over
+    // SSH); opening a browser here is only a shortcut.
+    console.log(`\n  Open this link on any device and enter the code:\n`);
+    console.log(`      ${approveUrl}`);
+    console.log(`      Code: ${userCode}\n`);
+    openBrowser(approveUrl);
     // 3. Poll for approval — the payload IS the StoredCredentials.
     try {
         const creds = await pollForApproval({
             url: `${CP_URL}/auth/cli-request/${requestId}`,
             headers: { Authorization: `Bearer ${pollSecret}` },
+            timeoutMs: waitMs,
             isApproved: (d) => d.status === "approved",
             isRejected: (d) => {
                 const s = d.status;
@@ -277,13 +271,9 @@ export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
             const port = addr.port;
             const callbackUrl = `http://localhost:${port}/callback`;
             const provisionUrl = `${LANDING_URL}/account/pod/provision?cli_callback=${encodeURIComponent(callbackUrl)}`;
-            try {
-                openBrowser(provisionUrl);
-            }
-            catch {
-                console.log(`\n  Open this URL in your browser to provision your pod:\n`);
-                console.log(`  ${provisionUrl}\n`);
-            }
+            console.log(`\n  Open this link to create your pod:\n`);
+            console.log(`  ${provisionUrl}\n`);
+            openBrowser(provisionUrl);
         });
         const timeout = setTimeout(() => {
             cleanup();
@@ -304,6 +294,17 @@ export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
 export function getCpUrl() {
     return CP_URL;
 }
+/**
+ * The pod's public URL. The CP sends it as `podUrl`; when absent, derive it the
+ * way the CP does (lib/pod-public-url.ts): the custom domain wins over
+ * `<subdomain>.synap.live`. Reading a non-existent `url` field here once sent
+ * a custom-domain pod (pod.antoinesrvt.synap.live) to perso.synap.live.
+ */
+export function podUrlOf(pod) {
+    if (pod.podUrl)
+        return pod.podUrl.replace(/\/+$/, "");
+    return pod.customDomain ? `https://${pod.customDomain}` : `https://${pod.subdomain}.synap.live`;
+}
 export async function listPods(token) {
     const res = await fetch(`${CP_URL}/pods`, {
         headers: { Authorization: `Bearer ${token}` },
@@ -316,22 +317,4 @@ export async function listPods(token) {
     // Only show active/provisioning pods — not deleted/archived
     return (data.pods ?? []).filter((p) => p.status === "active" || p.status === "provisioning" || p.status === "syncing_intelligence");
 }
-/**
- * Get the remote OpenClaw provisioning status from the CP.
- * Returns null if not provisioned or on network error.
- */
-export async function getOpenClawRemoteStatus(cpToken, podId) {
-    try {
-        const res = await fetch(`${getCpUrl()}/openclaw/status?podId=${encodeURIComponent(podId)}`, {
-            headers: { Authorization: `Bearer ${cpToken}` },
-            signal: AbortSignal.timeout(8000),
-        });
-        if (!res.ok)
-            return null;
-        return (await res.json());
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR;gBACE,+CAA+C;gBAC/C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,OAAoE,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExD,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,UAAU,GACd,GAAG,WAAW,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC7D,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAoB;YACrD,GAAG,EAAE,GAAG,MAAM,qBAAqB,SAAS,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,CAAC,MAAM,KAAK,UAAU;YACnE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAyB,CAAC,MAAM,CAAC;gBAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC;YAC3C,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAOT,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EACP,CAAC,CAAC,SAAS;wBACX,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC9D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;gBAErE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,IAAI,CAAC;gBACH,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,EAAE,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6F,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,eAAe,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,uEAAuE;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,OAAwF,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GACV,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1B,CAAC,CAAC,wBAAwB,CAAC;IAE/B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,UAAU,GACd,GAAG,WAAW,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC7D,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,wEAAwE;IACxE,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,UAAU,CAAC,CAAC;IAExB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAoB;YACrD,GAAG,EAAE,GAAG,MAAM,qBAAqB,SAAS,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,CAAC,MAAM,KAAK,UAAU;YACnE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAyB,CAAC,MAAM,CAAC;gBAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC;YAC3C,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAOT,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EACP,CAAC,CAAC,SAAS;wBACX,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC9D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;gBAErE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACnC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAuD;IAC9E,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,SAAS,aAAa,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC"}

package/dist/lib/batch-approval.d.ts

@@ -0,0 +1,85 @@
+/**
+ * One-click approval for the agent keys `synap init` mints (V1 D5).
+ *
+ * Codex and Cursor each mint their agent key with `requireApproval`, and
+ * `provisionAgentKey` used to open one review page per key and block on it.
+ * Connecting both meant two pages and two clicks, one after the other.
+ *
+ * Now `init` mints every key that needs approval FIRST (deferred), opens ONE
+ * page (`/approve-agents?keys=…` on the pod admin, backed by
+ * `POST /api/hub/setup/agent/pending/approve-batch`), and polls every key
+ * until the person approves them together. The approved keys are then handed
+ * to the installers through `takePreApprovedKey`, so each installer's own
+ * `provisionAgentKey` call returns the key the person already approved instead
+ * of minting a second one.
+ *
+ * A pod older than the batch door has no `/approve-agents` page: `init`
+ * probes the batch lookup door first and, when it is missing, opens each
+ * key's own review page instead (every pod version serves those).
+ */
+import type { TargetName } from "./targets.js";
+/** How a target's installer mints its agent key — ONE table, read by both. */
+export interface KeyMintSpec {
+    agentType: string;
+    idempotent: boolean;
+}
+/**
+ * The targets whose installer mints an agent key that needs the person's
+ * approval. Claude Code mints without approval, so it is not here. The installers read their spec from this table
+ * (`installCodex` / `installCursor`), so the pre-mint cannot ask for a key the
+ * installer would not have asked for.
+ */
+export declare const TARGET_KEY_MINT: Partial<Record<TargetName, KeyMintSpec>>;
+export interface ReadyAgentKey {
+    hubApiKey: string;
+    agentUserId: string;
+}
+/** Take (once) the key already minted — and approved — for `agentType`. */
+export declare function takePreApprovedKey(agentType: string): ReadyAgentKey | undefined;
+/**
+ * Hand an installer a key that is already approved — the device flow returns
+ * one per agent the person approved with the computer (`device-connect.ts`).
+ * The installer's own `provisionAgentKey` call then takes it instead of minting,
+ * and `approveAgentKeysAtOnce` asks for nothing more for that agent.
+ */
+export declare function presetApprovedKey(agentType: string, key: ReadyAgentKey): void;
+/** The ONE review page for several pending keys, on the same origin as a single key's review URL. */
+export declare function batchReviewUrl(reviewUrl: string, keyIds: readonly string[]): string;
+/**
+ * Does this pod serve the batch approval page? Its lookup door answers 401/400
+ * without a signed-in session; a pod older than it answers 404. Unreachable
+ * reads as "no": the per-key pages work on every pod.
+ */
+export declare function podSupportsBatchApproval(podUrl: string): Promise<boolean>;
+/** One pending key, as the wait sees it. */
+export interface PendingKeyWait {
+    podUrl: string;
+    pendingKey: string;
+    pendingToken: string;
+    humanApiKey: string;
+}
+export interface BatchApprovalDeps {
+    provision?: typeof import("./targets.js").provisionAgentKey;
+    /**
+     * Wait for one pending key to go live. Default `waitForKeyLive`: it asks
+     * about the pending key WITH the pending key (`/auth/key-state`), so the
+     * wait still sees the approval when the person's own key is the one that
+     * approval just replaced (2026-10-12). Older pods: the per-key pending door.
+     */
+    wait?: (p: PendingKeyWait) => Promise<import("./key-approval.js").KeyWaitOutcome>;
+    openUrl?: (url: string) => void;
+    supportsBatch?: (podUrl: string) => Promise<boolean>;
+}
+export interface BatchApprovalResult {
+    /** Targets the person did not approve (rejected, timed out, or the mint failed). */
+    notApproved: TargetName[];
+    /** Why, per target, for the one warning line `init` prints. */
+    reasons: Partial<Record<TargetName, string>>;
+}
+/**
+ * Mint every approval-gated key for `targets`, open one page, wait for all.
+ * Returns the targets the person did NOT approve (rejected, timed out, or
+ * failed to mint): `init` skips those instead of asking again, and prints
+ * one line for each.
+ */
+export declare function approveAgentKeysAtOnce(podUrl: string, humanApiKey: string, targets: readonly TargetName[], deps?: BatchApprovalDeps): Promise<BatchApprovalResult>;