@synap-core/cli 1.7.0 → 1.10.0

package/dist/lib/auth.js

@@ -1,12 +1,16 @@
 /**
  * CLI Authentication Module
  *
- * Browser-based OAuth flow:
- * 1. Start temporary HTTP server on localhost (random port)
- * 2. Open browser to synap.live/auth/cli?callback=http://localhost:PORT/callback
- * 3. User logs in via Better Auth (email/password, Google, GitHub)
- * 4. synap.live redirects to localhost callback with session token
- * 5. CLI stores token in ~/.synap/credentials.json
+ * Browser-based poll approval flow (see login() below):
+ * 1. POST ${CP}/auth/cli-request → { requestId, pollSecret }
+ * 2. Open browser to ${LANDING_URL}/cli?request=<requestId>
+ * 3. User signs in via Better Auth + picks a pod → browser POSTs the approval
+ * 4. CLI polls GET ${CP}/auth/cli-request/<requestId> with the pollSecret until
+ *    the credential payload (session token + pod) comes back
+ * 5. CLI stores it in ~/.synap/credentials.json
+ *
+ * (waitForPodCallback below still uses a localhost server — that's the separate
+ * managed-pod provisioning path, not login.)
  */
 import http from "node:http";
 import { execSync } from "node:child_process";
@@ -132,97 +136,104 @@ function openBrowser(url) {
         throw new Error("Could not open browser");
     }
 }
+/**
+ * Browser login via the CP poll-based approval flow.
+ *
+ * 1. POST /auth/cli-request → { requestId, pollSecret }.
+ * 2. Open the browser at `${LANDING_URL}/cli?request=<id>` — the user signs in
+ *    and picks a pod, which POSTs the approval to the CP.
+ * 3. Poll GET /auth/cli-request/<id> with the pollSecret until the CP returns
+ *    the credential payload (session token + chosen pod).
+ *
+ * No localhost server, no https→http redirect: the three fragile hops of the
+ * old flow are gone. Returns null on timeout/denied/failure (callers surface
+ * their own message), preserving the previous contract.
+ *
+ * The BROWSER host is a CLI concern, owned by `LANDING_URL` (default
+ * synap.live, env-overridable) — NOT the CP's `approveUrl`. The CP builds that
+ * from its own FRONTEND_URL, which is the ADMIN dashboard (dashboard.synap.live),
+ * the wrong place to send a user. We take only the `requestId` from the CP and
+ * build the landing URL ourselves, exactly as the old flow owned LANDING_URL.
+ */
 export async function login() {
-    return new Promise((resolve) => {
-        const server = http.createServer((req, res) => {
-            const url = new URL(req.url ?? "/", `http://localhost`);
-            if (url.pathname === "/callback") {
-                const token = url.searchParams.get("token");
-                const email = url.searchParams.get("email");
-                const userId = url.searchParams.get("userId");
-                const expiresAt = url.searchParams.get("expiresAt");
-                const cbPodId = url.searchParams.get("podId") ?? undefined;
-                const cbPodUrl = url.searchParams.get("podUrl") ?? undefined;
-                if (token && email && userId) {
-                    const creds = {
-                        token,
-                        email,
-                        userId,
-                        expiresAt: expiresAt ||
-                            new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(),
-                        ...(cbPodId ? { podId: cbPodId } : {}),
-                        ...(cbPodUrl ? { podUrl: cbPodUrl } : {}),
-                    };
-                    writeCredentials(creds);
-                    // Send success page
-                    res.writeHead(200, { "Content-Type": "text/html" });
-                    res.end(`<!DOCTYPE html>
-<html>
-<head><title>Synap CLI</title></head>
-<body style="font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #0a0a0a; color: #e5e5e5;">
-  <div style="text-align: center;">
-    <h1 style="font-size: 24px; margin-bottom: 8px;">Authenticated</h1>
-    <p style="color: #888;">You can close this window and return to the terminal.</p>
-  </div>
-</body>
-</html>`);
-                    cleanup();
-                    resolve(creds);
-                }
-                else {
-                    res.writeHead(400, { "Content-Type": "text/html" });
-                    res.end(`<!DOCTYPE html>
-<html>
-<head><title>Synap CLI</title></head>
-<body style="font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #0a0a0a; color: #e5e5e5;">
-  <div style="text-align: center;">
-    <h1 style="font-size: 24px; color: #ef4444; margin-bottom: 8px;">Authentication Failed</h1>
-    <p style="color: #888;">Missing token. Please try again.</p>
-  </div>
-</body>
-</html>`);
-                }
-            }
-            else {
-                res.writeHead(404);
-                res.end();
-            }
-        });
-        // Listen on random port
-        server.listen(0, "127.0.0.1", () => {
-            const addr = server.address();
-            if (!addr || typeof addr === "string") {
-                cleanup();
-                resolve(null);
-                return;
-            }
-            const port = addr.port;
-            const callbackUrl = `http://localhost:${port}/callback`;
-            const loginUrl = `${LANDING_URL}/cli?callback=${encodeURIComponent(callbackUrl)}`;
-            try {
-                openBrowser(loginUrl);
-            }
-            catch {
-                // Browser didn't open — show manual URL
-                console.log(`\n  Open this URL in your browser:\n`);
-                console.log(`  ${loginUrl}\n`);
-            }
+    const { pollForApproval } = await import("./approval-poll.js");
+    // 1. Create the login request on the CP (unauthenticated).
+    let created;
+    try {
+        const res = await fetch(`${CP_URL}/auth/cli-request`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            signal: AbortSignal.timeout(15000),
         });
-        // Timeout after 120 seconds
-        const timeout = setTimeout(() => {
-            cleanup();
-            resolve(null);
-        }, 120_000);
-        function cleanup() {
-            clearTimeout(timeout);
-            try {
-                server.close();
-            }
-            catch {
-                // ignore
-            }
+        if (!res.ok)
+            return null;
+        created = (await res.json());
+    }
+    catch {
+        return null;
+    }
+    const { requestId, pollSecret, userCode } = created;
+    if (!requestId || !pollSecret || !userCode)
+        return null;
+    // The CLI already owns its (self-hosted) pod locally — `synap login` is
+    // ACCOUNT auth, not pod selection. Pass the active pod's host so the browser
+    // can SHOW "your CLI is using <pod>" instead of forcing a redundant re-pick.
+    let podLabel = "";
+    try {
+        const { listPodProfiles } = await import("./pod.js");
+        const active = listPodProfiles().find((p) => p.active);
+        if (active?.config.podUrl) {
+            podLabel = new URL(active.config.podUrl).host;
         }
-    });
+    }
+    catch {
+        // no active pod / unreadable config — browser falls back to account-only
+    }
+    // 2. Show the device code, then open the browser to the approve screen on the
+    //    LANDING host (never the CP's dashboard-derived approveUrl). The user must
+    //    enter this code in the browser to approve — it binds the login to this
+    //    terminal so a phished approve link can't authorize someone else.
+    const approveUrl = `${LANDING_URL}/cli?request=${encodeURIComponent(requestId)}` +
+        (podLabel ? `&pod=${encodeURIComponent(podLabel)}` : "");
+    console.log(`\n  Enter this code in your browser to authorize the login:\n`);
+    console.log(`      ${userCode}\n`);
+    try {
+        openBrowser(approveUrl);
+    }
+    catch {
+        console.log(`  Open this URL in your browser:\n`);
+        console.log(`  ${approveUrl}\n`);
+    }
+    // 3. Poll for approval — the payload IS the StoredCredentials.
+    try {
+        const creds = await pollForApproval({
+            url: `${CP_URL}/auth/cli-request/${requestId}`,
+            headers: { Authorization: `Bearer ${pollSecret}` },
+            isApproved: (d) => d.status === "approved",
+            isRejected: (d) => {
+                const s = d.status;
+                return s === "denied" || s === "expired";
+            },
+            onApproved: (d) => {
+                const p = d;
+                return {
+                    token: p.token,
+                    email: p.email,
+                    userId: p.userId,
+                    expiresAt: p.expiresAt ||
+                        new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+                    ...(p.podId ? { podId: p.podId } : {}),
+                    ...(p.podUrl ? { podUrl: p.podUrl } : {}),
+                };
+            },
+        });
+        writeCredentials(creds);
+        return creds;
+    }
+    catch {
+        // Timed out or denied — callers print their own guidance.
+        return null;
+    }
 }
 export async function waitForPodCallback(timeoutMs = 300_000 // 5-minute window
 ) {

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR;gBACE,+CAA+C;gBAC/C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;gBAE7D,IAAI,KAAK,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAsB;wBAC/B,KAAK;wBACL,KAAK;wBACL,MAAM;wBACN,SAAS,EACP,SAAS;4BACT,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;wBAC9D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C,CAAC;oBACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBAExB,oBAAoB;oBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASV,CAAC,CAAC;oBAEA,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASV,CAAC,CAAC;gBACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,QAAQ,GAAG,GAAG,WAAW,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAElF,IAAI,CAAC;gBACH,WAAW,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;gBACxC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;gBAErE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,IAAI,CAAC;gBACH,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,EAAE,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6F,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,wBAAwB,CAAC;AACvD,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;AAExD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAaxE,8EAA8E;AAE9E,SAAS,oBAAoB;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IAChD,oBAAoB,EAAE,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU;IAK9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6CAA6C;YAC7C,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QAEF,yEAAyE;QACzE,yEAAyE;QACzE,gBAAgB,CAAC;YACf,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;IAC3E,MAAM,KAAK,GAAsB;QAC/B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR;gBACE,+CAA+C;gBAC/C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,OAAoE,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExD,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,UAAU,GACd,GAAG,WAAW,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC7D,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAoB;YACrD,GAAG,EAAE,GAAG,MAAM,qBAAqB,SAAS,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyB,CAAC,MAAM,KAAK,UAAU;YACnE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAyB,CAAC,MAAM,CAAC;gBAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC;YAC3C,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAOT,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EACP,CAAC,CAAC,SAAS;wBACX,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC9D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAG,OAAO,CAAC,kBAAkB;;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;gBAErE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;;;;;QASR,CAAC,CAAC;gBAEF,OAAO,EAAE,CAAC;gBACV,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,YAAY,GAAG,GAAG,WAAW,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAE5G,IAAI,CAAC;gBACH,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,OAAO;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,QAAQ;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IACnD,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CACnG,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,EAAE,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6F,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/bundle-version.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The installed `@synap-core/workspace-templates` version — the "is my bundle
+ * stale?" winner signal the catalog merge door compares against each CP row's
+ * `sourcePackage.version`.
+ *
+ * Resolved from the installed package.json. The package subpath is blocked by
+ * `exports`, so we walk up from the resolved entry. On failure we return "" —
+ * unparseable ⇒ the door keeps the bundle (safe default). Shared by `launch`
+ * and `market` so there is ONE copy.
+ */
+export declare function bundledTemplatesVersion(): string;

package/dist/lib/bundle-version.js

@@ -0,0 +1,33 @@
+/**
+ * The installed `@synap-core/workspace-templates` version — the "is my bundle
+ * stale?" winner signal the catalog merge door compares against each CP row's
+ * `sourcePackage.version`.
+ *
+ * Resolved from the installed package.json. The package subpath is blocked by
+ * `exports`, so we walk up from the resolved entry. On failure we return "" —
+ * unparseable ⇒ the door keeps the bundle (safe default). Shared by `launch`
+ * and `market` so there is ONE copy.
+ */
+import { createRequire } from "node:module";
+import path from "node:path";
+import fs from "node:fs";
+export function bundledTemplatesVersion() {
+    try {
+        const require = createRequire(import.meta.url);
+        let dir = path.dirname(require.resolve("@synap-core/workspace-templates"));
+        for (let i = 0; i < 6; i++) {
+            const pj = path.join(dir, "package.json");
+            if (fs.existsSync(pj)) {
+                const parsed = JSON.parse(fs.readFileSync(pj, "utf8"));
+                if (parsed.name === "@synap-core/workspace-templates")
+                    return parsed.version ?? "";
+            }
+            dir = path.dirname(dir);
+        }
+    }
+    catch {
+        /* fall through to the safe default */
+    }
+    return "";
+}
+//# sourceMappingURL=bundle-version.js.map

package/dist/lib/bundle-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-version.js","sourceRoot":"","sources":["../../src/lib/bundle-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAGpD,CAAC;gBACF,IAAI,MAAM,CAAC,IAAI,KAAK,iCAAiC;oBAAE,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrF,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/lib/capture-lane.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Write-outcome transparency helpers — the glass-box for WRITES.
+ *
+ * Reads route through one verb (`ask`, which says how it routed). Writes route by
+ * KIND into one of three lanes — and every write must report, honestly and in one
+ * line, WHAT happened so the AI is GUIDED by the response, not guessing:
+ *
+ *   | Lane     | Destination                          | Governance      |
+ *   |----------|--------------------------------------|-----------------|
+ *   | user     | pod-wide user_observation            | gate inference  |
+ *   | global   | pod-wide procedural (knowledge_keys) | reviewed        |
+ *   | work     | the active product workspace         | proposal-gated  |
+ *
+ * The cardinal signal is **stored vs proposed**: `stored` = live, recallable now;
+ * `proposed` = gated/refrained — queued for human approval, NOT yet live. Every
+ * write command routes its hub response through `reportWrite` so this signal is
+ * consistent across `capture`, `observe`, `create entity`, `create relation`, `doc`.
+ */
+import { type HubConfig } from "./hub-client.js";
+export type CaptureLane = "ai-self" | "user" | "global" | "work";
+export type Governance = "auto" | "proposed";
+export interface LaneReport {
+    /** One-line lane label. */
+    lane: CaptureLane;
+    /** Resolved destination workspace id (undefined if none could be resolved). */
+    workspaceId?: string;
+    /** Human-friendly workspace name, best-effort resolved from the pod. */
+    workspaceName?: string;
+    /** Whether the write was auto-approved (`auto`) or queued for review (`proposed`). */
+    governance: Governance;
+}
+/**
+ * Derive the lane from the workspace-routing `source` returned by
+ * `resolveKnowledgeWorkspace`. A domain capture always lands in a real product
+ * workspace → the Work lane. (The backend routing endpoint P7b is the SSoT for
+ * resolving user/global lanes; the CLI's lane detection is a best-effort hint.)
+ *
+ *   source                              → lane
+ *   "explicit" / "team" / "active …"    → work
+ */
+export declare function laneFromSource(_source: string): CaptureLane;
+/** Best-effort resolve a workspace name from the pod. Never throws. */
+export declare function resolveWorkspaceName(workspaceId: string, cfg: HubConfig): Promise<string | undefined>;
+/**
+ * Build the `→ stored in … / proposed to …` destination line for human output.
+ * Returns a dim, single-line string (no trailing newline).
+ */
+export declare function formatLaneLine(report: LaneReport): string;
+/** The additive JSON fields that declare lane + destination + governance. */
+export declare function laneJsonFields(report: LaneReport): Record<string, unknown>;
+/** Detect the governance outcome from a hub write response (entity / proposal). */
+export declare function writeGovernance(res: Record<string, unknown>): Governance;
+/**
+ * The ONE honest write reporter. Every write command routes its hub response
+ * through this so the AI gets a consistent, guiding signal:
+ *   • stored   → live now, recallable via `ask`
+ *   • proposed → gated/refrained, awaiting human approval, NOT yet live
+ * One human line + lane line; `--json` adds an `outcome` field while preserving
+ * the original response fields (backward-compatible).
+ */
+export declare function reportWrite(res: Record<string, unknown>, o: {
+    label: string;
+    lane: CaptureLane;
+    workspaceId?: string;
+    cfg: HubConfig;
+    json?: boolean;
+}): Promise<void>;

package/dist/lib/capture-lane.js

@@ -0,0 +1,136 @@
+/**
+ * Write-outcome transparency helpers — the glass-box for WRITES.
+ *
+ * Reads route through one verb (`ask`, which says how it routed). Writes route by
+ * KIND into one of three lanes — and every write must report, honestly and in one
+ * line, WHAT happened so the AI is GUIDED by the response, not guessing:
+ *
+ *   | Lane     | Destination                          | Governance      |
+ *   |----------|--------------------------------------|-----------------|
+ *   | user     | pod-wide user_observation            | gate inference  |
+ *   | global   | pod-wide procedural (knowledge_keys) | reviewed        |
+ *   | work     | the active product workspace         | proposal-gated  |
+ *
+ * The cardinal signal is **stored vs proposed**: `stored` = live, recallable now;
+ * `proposed` = gated/refrained — queued for human approval, NOT yet live. Every
+ * write command routes its hub response through `reportWrite` so this signal is
+ * consistent across `capture`, `observe`, `create entity`, `create relation`, `doc`.
+ */
+import chalk from "chalk";
+import { log } from "../utils/logger.js";
+import { hubGet } from "./hub-client.js";
+import { unwrapList } from "./unwrapList.js";
+/**
+ * Derive the lane from the workspace-routing `source` returned by
+ * `resolveKnowledgeWorkspace`. A domain capture always lands in a real product
+ * workspace → the Work lane. (The backend routing endpoint P7b is the SSoT for
+ * resolving user/global lanes; the CLI's lane detection is a best-effort hint.)
+ *
+ *   source                              → lane
+ *   "explicit" / "team" / "active …"    → work
+ */
+export function laneFromSource(_source) {
+    return "work";
+}
+/** Best-effort resolve a workspace name from the pod. Never throws. */
+export async function resolveWorkspaceName(workspaceId, cfg) {
+    try {
+        const res = (await hubGet("/workspaces", {}, cfg));
+        const list = unwrapList(res, ["workspaces"]);
+        const match = list.find((w) => String(w.id ?? "") === workspaceId);
+        return match ? String(match.name ?? match.id ?? "") : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A human-readable lane label for terminal output. */
+function laneLabel(lane) {
+    switch (lane) {
+        case "ai-self":
+            return "agent memory";
+        case "user":
+            return "user observations";
+        case "global":
+            return "global runbooks";
+        case "work":
+            return "workspace";
+    }
+}
+/**
+ * Build the `→ stored in … / proposed to …` destination line for human output.
+ * Returns a dim, single-line string (no trailing newline).
+ */
+export function formatLaneLine(report) {
+    const place = report.workspaceName ?? report.workspaceId ?? laneLabel(report.lane);
+    const laneTag = chalk.dim(`[${laneLabel(report.lane)}]`);
+    if (report.governance === "proposed") {
+        return chalk.dim(`→ proposed to ${place} (awaiting approval) `) + laneTag;
+    }
+    return chalk.dim(`→ stored in ${place} (auto-approved) `) + laneTag;
+}
+/** The additive JSON fields that declare lane + destination + governance. */
+export function laneJsonFields(report) {
+    return {
+        lane: report.lane,
+        workspaceId: report.workspaceId,
+        workspaceName: report.workspaceName,
+        governance: report.governance,
+    };
+}
+/** Detect the governance outcome from a hub write response (entity / proposal). */
+export function writeGovernance(res) {
+    return res.status === "proposed" ||
+        Boolean(res.proposalId) ||
+        Number(res.proposalsCreated ?? 0) > 0
+        ? "proposed"
+        : "auto";
+}
+/**
+ * The ONE honest write reporter. Every write command routes its hub response
+ * through this so the AI gets a consistent, guiding signal:
+ *   • stored   → live now, recallable via `ask`
+ *   • proposed → gated/refrained, awaiting human approval, NOT yet live
+ * One human line + lane line; `--json` adds an `outcome` field while preserving
+ * the original response fields (backward-compatible).
+ */
+export async function reportWrite(res, o) {
+    const governance = writeGovernance(res);
+    const report = {
+        lane: o.lane,
+        workspaceId: o.workspaceId,
+        workspaceName: o.workspaceId
+            ? await resolveWorkspaceName(o.workspaceId, o.cfg)
+            : o.lane === "global" || o.lane === "user"
+                ? "pod-wide"
+                : undefined,
+        governance,
+    };
+    const id = String(res.id ?? res.entityId ?? "");
+    const proposalId = String(res.proposalId ?? "");
+    if (o.json) {
+        console.log(JSON.stringify({
+            ...res,
+            outcome: governance === "proposed" ? "proposed" : "stored",
+            ...laneJsonFields(report),
+        }, null, 2));
+        return;
+    }
+    if (governance === "proposed") {
+        // A proposal is normal (a PR under review), NOT a failure — neutral tone,
+        // never an alarm. The agent keeps composing; it just goes live on approval.
+        log.info(`${o.label} — proposed (under review)`);
+        if (proposalId)
+            log.dim(`  proposal: ${proposalId.slice(0, 8)}`);
+        // Expose the stable proposed entity ID so the AI can reference this entity
+        // in cross-write proposal graphs (e.g. create entity B linked to entity A).
+        const proposedEntityId = String(res.proposedEntityId ?? "");
+        if (proposedEntityId)
+            log.dim(`  entity: ${proposedEntityId.slice(0, 8)}`);
+    }
+    else {
+        log.success(`${o.label}${id ? "  " + chalk.dim(id.slice(0, 8)) : ""}`);
+    }
+    console.log("  " + formatLaneLine(report));
+}
+//# sourceMappingURL=capture-lane.js.map

package/dist/lib/capture-lane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-lane.js","sourceRoot":"","sources":["../../src/lib/capture-lane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAkB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAmB7C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,GAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,CAA4B,CAAC;QAC9E,MAAM,IAAI,GAAG,UAAU,CAA0B,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,IAAiB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,KAAK,MAAM;YACT,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,KAAK,uBAAuB,CAAC,GAAG,OAAO,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,KAAK,mBAAmB,CAAC,GAAG,OAAO,CAAC;AACtE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAA4B;IAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU;QAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAA4B,EAC5B,CAMC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,aAAa,EAAE,CAAC,CAAC,WAAW;YAC1B,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC;YAClD,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBACxC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,SAAS;QACf,UAAU;KACX,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEhD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,GAAG,GAAG;YACN,OAAO,EAAE,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAC1D,GAAG,cAAc,CAAC,MAAM,CAAC;SAC1B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,4EAA4E;QAC5E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC;QACjD,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,gBAAgB;YAAE,GAAG,CAAC,GAAG,CAAC,aAAa,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC"}