@synap-core/cli 1.12.2 → 1.13.1-next.20261102.ec3d166

package/dist/lib/agents-config.d.ts

@@ -18,6 +18,15 @@ export declare function listAgents(): Array<{
 export declare function getAgent(name: string): AgentProfile | null;
 export declare function addAgent(name: string, profile: AgentProfile): void;
 export declare function removeAgent(name: string): void;
+/** Every agent name this machine has a key for: `synap agents create` plus connected surfaces. */
+export declare function savedAgentNames(): string[];
+/**
+ * Why `name` cannot be used as an agent, or null when it can. A name with no
+ * saved key must be refused by whoever asked for it: `resolveAgentOverride`
+ * answers null for it and `resolveHubConfig` then falls through to the next
+ * key it finds, so a typo would quietly run as another identity.
+ */
+export declare function unknownAgentMessage(name: string): string | null;
 /** Resolve agent config from SYNAP_AGENT env var. Returns null if not set.
  * cfg.agents holds named agents (synap agents create). cfg.agentKeys holds
  * surface-provisioned identities (synap connect --target=<surface>). Both represent

package/dist/lib/agents-config.js

@@ -30,6 +30,26 @@ export function removeAgent(name) {
     delete cfg.agents[name];
     writeConfig(cfg);
 }
+/** Every agent name this machine has a key for: `synap agents create` plus connected surfaces. */
+export function savedAgentNames() {
+    const cfg = readConfig();
+    return [...new Set([...Object.keys(cfg.agents ?? {}), ...Object.keys(cfg.agentKeys ?? {})])].sort();
+}
+/**
+ * Why `name` cannot be used as an agent, or null when it can. A name with no
+ * saved key must be refused by whoever asked for it: `resolveAgentOverride`
+ * answers null for it and `resolveHubConfig` then falls through to the next
+ * key it finds, so a typo would quietly run as another identity.
+ */
+export function unknownAgentMessage(name) {
+    const cfg = readConfig();
+    if (cfg.agents?.[name] || cfg.agentKeys?.[name]?.hubApiKey)
+        return null;
+    const saved = savedAgentNames();
+    return saved.length
+        ? `No saved agent named "${name}". Saved agents: ${saved.join(", ")}.`
+        : `No saved agent named "${name}", and none are saved on this machine. Create one with \`synap agents create\`.`;
+}
 /** Resolve agent config from SYNAP_AGENT env var. Returns null if not set.
  * cfg.agents holds named agents (synap agents create). cfg.agentKeys holds
  * surface-provisioned identities (synap connect --target=<surface>). Both represent

package/dist/lib/agents-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-config.js","sourceRoot":"","sources":["../../src/lib/agents-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAwBrE,iGAAiG;AACjG,SAAS,UAAU;IACjB,OAAO,cAAc,CAAmB,WAAW,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB;IACxC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAqB;IAC1D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3B,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;sFAGsF;AACtF,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;YACnC,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"agents-config.js","sourceRoot":"","sources":["../../src/lib/agents-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAwBrE,iGAAiG;AACjG,SAAS,UAAU;IACjB,OAAO,cAAc,CAAmB,WAAW,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB;IACxC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAqB;IAC1D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3B,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,yBAAyB,IAAI,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACtE,CAAC,CAAC,yBAAyB,IAAI,iFAAiF,CAAC;AACrH,CAAC;AAED;;;sFAGsF;AACtF,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;YACnC,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/atomic-file.d.ts

@@ -17,7 +17,7 @@
 export declare class ConfigUnreadableError extends Error {
     readonly file: string;
     readonly cause: unknown;
-    constructor(file: string, cause: unknown);
+    constructor(file: string, cause: unknown, hint?: string);
 }
 /** Parsed JSON object, or `null` ONLY when the file does not exist. Throws on anything else. */
 export declare function readJsonStrict<T = Record<string, unknown>>(file: string): T | null;
@@ -46,3 +46,22 @@ export declare function copySecretBackup(src: string, dst: string): void;
  * client's own config directory.
  */
 export declare function ensureSecretDir(dir: string): void;
+/**
+ * JSONC → JSON: drop `//` and `/* *\/` comments and trailing commas, OUTSIDE
+ * strings only (a URL's `//` and a `,}` inside a string are kept).
+ */
+export declare function stripJsonc(text: string): string;
+/**
+ * A client's JSON/JSONC config: the parsed object, `{}` ONLY when the file does
+ * not exist. A file that exists but cannot be read or parsed THROWS
+ * `ConfigUnreadableError` — the caller must not write.
+ */
+export declare function readClientConfig<T extends object = Record<string, unknown>>(file: string): T;
+/** Where `writeClientConfig` keeps the file as it was before Synap's last write. */
+export declare function clientConfigBackupPath(file: string): string;
+/**
+ * Write a client's config (0600): copy the current file to `<file>.synap.bak`
+ * first, so whatever the rewrite drops (JSONC comments, formatting) is one
+ * `mv` away.
+ */
+export declare function writeClientConfig(file: string, value: unknown): void;

package/dist/lib/atomic-file.js

@@ -20,9 +20,9 @@ import { randomBytes } from "node:crypto";
 export class ConfigUnreadableError extends Error {
     file;
     cause;
-    constructor(file, cause) {
+    constructor(file, cause, hint = "Fix the file, or move it aside and run `synap init` again.") {
         super(`${file} exists but could not be read as JSON (${cause instanceof Error ? cause.message : String(cause)}). ` +
-            `Nothing was written. Fix the file, or move it aside and run \`synap init\` again.`);
+            `Nothing was written. ${hint}`);
         this.file = file;
         this.cause = cause;
         this.name = "ConfigUnreadableError";
@@ -126,4 +126,102 @@ export function ensureSecretDir(dir) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     fs.chmodSync(dir, 0o700);
 }
+// ─── A client's OWN config file (Zed, VS Code, Claude Code, Claude Desktop…) ──
+//
+// These files belong to the person, not to Synap: their theme, LSPs, hooks,
+// permissions and other MCP servers live there. `synap connect` used to read a
+// file it could not parse as `{}` and write that back with one Synap entry —
+// the whole file gone. Zed hit it on EVERY second run: a regex comment-strip
+// also ate the `//` inside the `https://…/mcp` string Synap had written itself.
+// So: a strings-aware JSONC read, a refusal (never `{}`) when it still does not
+// parse, and a `.synap.bak` copy of the previous file before any write.
+/**
+ * JSONC → JSON: drop `//` and `/* *\/` comments and trailing commas, OUTSIDE
+ * strings only (a URL's `//` and a `,}` inside a string are kept).
+ */
+export function stripJsonc(text) {
+    let out = "";
+    let lastSig = -1; // index in `out` of the last non-whitespace char emitted
+    let i = 0;
+    let inStr = false;
+    while (i < text.length) {
+        const c = text[i];
+        if (inStr) {
+            out += c;
+            if (c === "\\") {
+                out += text[i + 1] ?? "";
+                i += 2;
+                lastSig = out.length - 1;
+                continue;
+            }
+            if (c === '"')
+                inStr = false;
+            lastSig = out.length - 1;
+            i++;
+            continue;
+        }
+        if (c === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+        }
+        else if (c === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            i = end < 0 ? text.length : end + 2;
+        }
+        else {
+            if ((c === "}" || c === "]") && lastSig >= 0 && out[lastSig] === ",") {
+                out = out.slice(0, lastSig) + out.slice(lastSig + 1);
+            }
+            if (c === '"')
+                inStr = true;
+            out += c;
+            if (!/\s/.test(c))
+                lastSig = out.length - 1;
+            i++;
+        }
+    }
+    return out;
+}
+const CLIENT_CONFIG_HINT = "Synap never replaces a config it cannot read. Fix the file (or move it aside), then run the command again.";
+/**
+ * A client's JSON/JSONC config: the parsed object, `{}` ONLY when the file does
+ * not exist. A file that exists but cannot be read or parsed THROWS
+ * `ConfigUnreadableError` — the caller must not write.
+ */
+export function readClientConfig(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new ConfigUnreadableError(file, err, CLIENT_CONFIG_HINT);
+    }
+    if (raw.trim() === "")
+        return {};
+    try {
+        const v = JSON.parse(stripJsonc(raw));
+        if (!v || typeof v !== "object" || Array.isArray(v))
+            throw new Error("not a JSON object");
+        return v;
+    }
+    catch (err) {
+        throw new ConfigUnreadableError(file, err, CLIENT_CONFIG_HINT);
+    }
+}
+/** Where `writeClientConfig` keeps the file as it was before Synap's last write. */
+export function clientConfigBackupPath(file) {
+    return `${file}.synap.bak`;
+}
+/**
+ * Write a client's config (0600): copy the current file to `<file>.synap.bak`
+ * first, so whatever the rewrite drops (JSONC comments, formatting) is one
+ * `mv` away.
+ */
+export function writeClientConfig(file, value) {
+    if (fs.existsSync(file))
+        copySecretBackup(file, clientConfigBackupPath(file));
+    writeSecretFile(file, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+}
 //# sourceMappingURL=atomic-file.js.map

package/dist/lib/atomic-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-file.js","sourceRoot":"","sources":["../../src/lib/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,IAAY,EACZ,KAAc;QAEvB,KAAK,CACH,GAAG,IAAI,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;YAC1G,mFAAmF,CACtF,CAAC;QANO,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAAS;QAMvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAA8B,IAAY;IACtE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1F,OAAO,CAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjB,4DAA4D;IAC5D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACvD,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"atomic-file.js","sourceRoot":"","sources":["../../src/lib/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,IAAY,EACZ,KAAc,EACvB,IAAI,GAAG,4DAA4D;QAEnE,KAAK,CACH,GAAG,IAAI,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;YAC1G,wBAAwB,IAAI,EAAE,CACjC,CAAC;QAPO,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAAS;QAOvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAA8B,IAAY;IACtE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1F,OAAO,CAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjB,4DAA4D;IAC5D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,OAA0B,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACvD,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,yDAAyD;IAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC;gBACP,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC7B,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACzB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC5B,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;AAE/G;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAA6C,IAAY;IACvF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAO,CAAC;QACrE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAO,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAY,CAAC;QACjD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1F,OAAO,CAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,GAAG,IAAI,YAAY,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/lib/auth.d.ts

@@ -12,6 +12,15 @@
  * (waitForPodCallback below still uses a localhost server — that's the separate
  * managed-pod provisioning path, not login.)
  */
+export declare const CP_URL: string;
+/**
+ * The managed control plane's public MCP connector (decision 7c31a585,
+ * 2026-10-30): what a person pastes into claude.ai, ChatGPT or any OAuth MCP
+ * client. A self-hosted control plane keeps `<cp>/mcp` (`mcpConnectorUrl`).
+ */
+export declare const MANAGED_MCP_URL = "https://mcp.synap.live";
+/** The connector URL of a control plane: the managed one's public host, else `<cp>/mcp`. */
+export declare function mcpConnectorUrl(cpOrigin: string): string;
 export interface StoredCredentials {
     token: string;
     expiresAt: string;
@@ -35,8 +44,8 @@ export declare function isLoggedIn(): Promise<{
  * Store a manually provided API token (Better Auth session token).
  * Validates against the CP before saving.
  *
- * Usage: synap login --token <token>
- * Get a token from: https://synap.live/account/tokens
+ * Not wired to any command: `synap login` has no --token flag (it uses the
+ * device-approval flow below, which works from a box without a browser).
  */
 export declare function loginWithToken(token: string): Promise<StoredCredentials | null>;
 /**
@@ -69,6 +78,23 @@ export interface PodCallbackResult {
     podUrl: string;
     workspaceId?: string;
 }
+export type PodCallbackVerdict = {
+    ok: true;
+    result: PodCallbackResult;
+} | {
+    ok: false;
+    status: 400 | 403;
+    reason: string;
+};
+/**
+ * Judge one hit on the loopback `/callback`. The URL it carries becomes THE pod
+ * this CLI signs in to and writes into every agent config, and anything that
+ * reaches 127.0.0.1:<port> during the wait can hit it (a local process, or a
+ * web page that finds the port). So it must carry the `state` this CLI put in
+ * `cli_callback` (only the provision page it opened has it), and the pod URL
+ * must be https. A refused hit does not end the wait.
+ */
+export declare function judgePodCallback(url: URL, expectedState: string): PodCallbackVerdict;
 export declare function waitForPodCallback(timeoutMs?: number): Promise<PodCallbackResult | null>;
 export declare function getCpUrl(): string;
 /** One pod as the CP's `GET /pods` lists it (routes/pods.ts, `podUrl(pod)`). */

package/dist/lib/auth.js

@@ -13,12 +13,24 @@
  * managed-pod provisioning path, not login.)
  */
 import http from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { openExternalUrl } from "./safe-open.js";
 import fs from "node:fs";
 import { ensureSecretDir, writeSecretFile } from "./atomic-file.js";
 import path from "node:path";
 import os from "node:os";
-const CP_URL = process.env.SYNAP_CP_URL || "https://api.synap.live";
+export const CP_URL = process.env.SYNAP_CP_URL || "https://api.synap.live";
+/**
+ * The managed control plane's public MCP connector (decision 7c31a585,
+ * 2026-10-30): what a person pastes into claude.ai, ChatGPT or any OAuth MCP
+ * client. A self-hosted control plane keeps `<cp>/mcp` (`mcpConnectorUrl`).
+ */
+export const MANAGED_MCP_URL = "https://mcp.synap.live";
+/** The connector URL of a control plane: the managed one's public host, else `<cp>/mcp`. */
+export function mcpConnectorUrl(cpOrigin) {
+    const origin = cpOrigin.replace(/\/$/, "");
+    return origin === "https://api.synap.live" ? MANAGED_MCP_URL : `${origin}/mcp`;
+}
 const LANDING_URL = process.env.SYNAP_LANDING_URL || "https://synap.live";
 /**
  * How long a CLI login request lives on the CP (CLI_AUTH_TTL_SECONDS in
@@ -98,8 +110,8 @@ export async function isLoggedIn() {
  * Store a manually provided API token (Better Auth session token).
  * Validates against the CP before saving.
  *
- * Usage: synap login --token <token>
- * Get a token from: https://synap.live/account/tokens
+ * Not wired to any command: `synap login` has no --token flag (it uses the
+ * device-approval flow below, which works from a box without a browser).
  */
 export async function loginWithToken(token) {
     const res = await fetch(`${CP_URL}/auth/me`, {
@@ -229,14 +241,47 @@ export async function login() {
         return null;
     }
 }
+/**
+ * Judge one hit on the loopback `/callback`. The URL it carries becomes THE pod
+ * this CLI signs in to and writes into every agent config, and anything that
+ * reaches 127.0.0.1:<port> during the wait can hit it (a local process, or a
+ * web page that finds the port). So it must carry the `state` this CLI put in
+ * `cli_callback` (only the provision page it opened has it), and the pod URL
+ * must be https. A refused hit does not end the wait.
+ */
+export function judgePodCallback(url, expectedState) {
+    const state = url.searchParams.get("state") ?? "";
+    const a = Buffer.from(state);
+    const b = Buffer.from(expectedState);
+    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+        return { ok: false, status: 403, reason: "This link was not opened by the Synap CLI waiting here." };
+    }
+    let pod;
+    try {
+        pod = new URL(url.searchParams.get("podUrl") ?? "");
+    }
+    catch {
+        return { ok: false, status: 400, reason: "The pod address is missing or not a URL." };
+    }
+    if (pod.protocol !== "https:" || pod.username || pod.password) {
+        return { ok: false, status: 400, reason: "The pod address must be a plain https URL." };
+    }
+    const workspaceId = url.searchParams.get("workspaceId") ?? undefined;
+    return { ok: true, result: { podUrl: pod.origin, workspaceId } };
+}
 export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
 ) {
+    const expectedState = randomBytes(24).toString("base64url");
     return new Promise((resolve) => {
         const server = http.createServer((req, res) => {
             const url = new URL(req.url ?? "/", `http://localhost`);
             if (url.pathname === "/callback") {
-                const podUrl = url.searchParams.get("podUrl");
-                const workspaceId = url.searchParams.get("workspaceId") ?? undefined;
+                const verdict = judgePodCallback(url, expectedState);
+                if (!verdict.ok) {
+                    res.writeHead(verdict.status, { "Content-Type": "text/plain; charset=utf-8" });
+                    res.end(verdict.reason);
+                    return; // keep waiting for the real one
+                }
                 res.writeHead(200, { "Content-Type": "text/html" });
                 res.end(`<!DOCTYPE html>
 <html>
@@ -249,12 +294,7 @@ export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
 </body>
 </html>`);
                 cleanup();
-                if (podUrl) {
-                    resolve({ podUrl, workspaceId });
-                }
-                else {
-                    resolve(null);
-                }
+                resolve(verdict.result);
             }
             else {
                 res.writeHead(404);
@@ -269,7 +309,7 @@ export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
                 return;
             }
             const port = addr.port;
-            const callbackUrl = `http://localhost:${port}/callback`;
+            const callbackUrl = `http://localhost:${port}/callback?state=${expectedState}`;
             const provisionUrl = `${LANDING_URL}/account/pod/provision?cli_callback=${encodeURIComponent(callbackUrl)}`;
             console.log(`\n  Open this link to create your pod:\n`);
             console.log(`  ${provisionUrl}\n`);

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,eAAe,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,uEAAuE;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,OAAwF,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GACV,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1B,CAAC,CAAC,wBAAwB,CAAC;IAE/B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,UAAU,GACd,GAAG,WAAW,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC7D,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,wEAAwE;IACxE,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,UAAU,CAAC,CAAC;IAExB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAoB;YACrD,GAAG,EAAE,GAAG,MAAM,qBAAqB,SAAS,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,CAAC,MAAM,KAAK,UAAU;YACnE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAyB,CAAC,MAAM,CAAC;gBAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC;YAC3C,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAOT,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EACP,CAAC,CAAC,SAAS;wBACX,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC9D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;gBAErE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACnC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAuD;IAC9E,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,SAAS,aAAa,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC;AACjF,CAAC;AACD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,eAAe,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,uEAAuE;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,OAAwF,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GACV,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1B,CAAC,CAAC,wBAAwB,CAAC;IAE/B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,UAAU,GACd,GAAG,WAAW,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC7D,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,wEAAwE;IACxE,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,UAAU,CAAC,CAAC;IAExB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAoB;YACrD,GAAG,EAAE,GAAG,MAAM,qBAAqB,SAAS,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,CAAC,MAAM,KAAK,UAAU;YACnE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAyB,CAAC,MAAM,CAAC;gBAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC;YAC3C,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAOT,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EACP,CAAC,CAAC,SAAS;wBACX,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC9D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAQ,EAAE,aAAqB;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,MAAM,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACxB,OAAO,CAAC,gCAAgC;gBAC1C,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,mBAAmB,aAAa,EAAE,CAAC;YAC/E,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACnC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAuD;IAC9E,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,SAAS,aAAa,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC"}

package/dist/lib/box/egress.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The run box's ONE way out: an HTTP(S) proxy on the provisioner, bound to the
+ * box bridge. A box has no gateway and no resolver; everything it fetches goes
+ * through here, and here decides (runbox design C4 "Egress"):
+ *
+ *   setup phase → the package registries only (PyPI, npm)
+ *   run phase   → the hosts the script declared, nothing else
+ *
+ * A name that passes is resolved HERE, every address it resolves to is checked
+ * against internal ranges (RFC1918, loopback, link-local and cloud metadata,
+ * CGNAT = the tailnet), and the connection goes to the address that was
+ * checked, never to a second lookup — so a declared host that resolves to the
+ * pod (DNS rebinding) is refused. Every refusal is recorded for the evidence
+ * bundle. The bridge firewall is the wall; this is the policy.
+ */
+import http from "node:http";
+import net from "node:net";
+export type BoxPhase = "setup" | "run";
+/** Hosts a box may reach while it installs declared packages. */
+export declare const REGISTRY_HOSTS: readonly string[];
+/** Ports a bare allow entry opens: the web only. */
+export declare const ALLOWED_PORTS: readonly number[];
+export interface BlockedEgress {
+    host: string;
+    port: number;
+    phase: BoxPhase;
+    reason: string;
+    at: string;
+}
+/**
+ * True when a box must not connect to this address. An unparsable address is
+ * forbidden: the check fails closed.
+ */
+export declare function isForbiddenAddress(ip: string): boolean;
+/** Lower-cased, trailing dot dropped, brackets of an IPv6 literal removed. */
+export declare function normalizeHost(host: string): string;
+/**
+ * `host` matches an allow entry exactly, or a `*.example.com` entry as a
+ * strict subdomain (never the apex, never a suffix like `evilexample.com`).
+ */
+export declare function hostMatches(host: string, allow: readonly string[]): boolean;
+export interface EgressPolicy {
+    phase: BoxPhase;
+    /** The script's declared hosts (the run-phase allowlist). */
+    runHosts: readonly string[];
+}
+export type EgressDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * The name-level decision, before any lookup. A bare entry opens the web
+ * ports (80, 443); a `host:port` entry opens that port on that host only.
+ */
+export declare function decideByName(host: string, port: number, policy: EgressPolicy): EgressDecision;
+export type Resolver = (host: string) => Promise<string[]>;
+/**
+ * The full decision: by name, then by every resolved address. Returns the ONE
+ * address to connect to, so the connection never re-resolves.
+ */
+export declare function decideEgress(host: string, port: number, policy: EgressPolicy, resolve?: Resolver): Promise<{
+    allow: true;
+    address: string;
+} | {
+    allow: false;
+    reason: string;
+}>;
+export interface EgressProxyOptions {
+    /** The policy for a box, by its address on the bridge; null = not a live box. */
+    policyFor: (sourceIp: string) => EgressPolicy | null;
+    onBlock: (sourceIp: string, block: BlockedEgress) => void;
+    resolve?: Resolver;
+    /** Connect to the checked address (tests replace it). */
+    connect?: (address: string, port: number) => net.Socket;
+}
+/**
+ * An HTTP proxy: CONNECT for HTTPS (a tunnel to the checked address), and
+ * absolute-form requests for plain HTTP. Anything else is refused.
+ */
+export declare function createEgressProxy(opts: EgressProxyOptions): http.Server;