@synap-core/eve 0.1.0

package/dist/chunk-JO5H5G6U.js

@@ -0,0 +1,1529 @@
+import { createRequire as __eveCreateRequire } from 'module'; const require = __eveCreateRequire(import.meta.url);
+import {
+  LEGACY_CODER_ENGINE_SLUGS,
+  agentsToProvision
+} from "./chunk-5TBV2VHZ.js";
+import {
+  POD_DEPLOY_DIR_CANDIDATES,
+  SYNAP_BACKEND_CONTAINERS,
+  findPodDeployDir,
+  resolveSynapUrlOnHost,
+  restartBackendContainer
+} from "./chunk-O5WTCVMZ.js";
+import {
+  readAgentKey,
+  readEveSecrets,
+  writeAgentKey,
+  writeCodeEngine,
+  writeEveSecrets
+} from "./chunk-T7GCAJK5.js";
+
+// ../@eve/lifecycle/dist/chunk-6JFSP4GT.js
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { exec as execCallback } from "child_process";
+import { promisify } from "util";
+import { randomBytes } from "crypto";
+import {
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  existsSync,
+  mkdirSync,
+  unlinkSync
+} from "fs";
+import { join, dirname } from "path";
+import { randomUUID } from "crypto";
+var ENV_FILENAME = ".env";
+function envPath(deployDir) {
+  return join(deployDir, ENV_FILENAME);
+}
+function readEnvVar(deployDir, key) {
+  const path = envPath(deployDir);
+  if (!existsSync(path)) return null;
+  const text = readFileSync(path, "utf-8");
+  let last = null;
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trimStart();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 0) continue;
+    if (line.slice(0, eq).trim() === key) {
+      last = line.slice(eq + 1);
+    }
+  }
+  return last;
+}
+function readEnvFile(deployDir) {
+  const path = envPath(deployDir);
+  const out = /* @__PURE__ */ new Map();
+  if (!existsSync(path)) return out;
+  const text = readFileSync(path, "utf-8");
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trimStart();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 0) continue;
+    const k = line.slice(0, eq).trim();
+    if (!k) continue;
+    out.set(k, line.slice(eq + 1));
+  }
+  return out;
+}
+function writeEnvVar(deployDir, key, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+    throw new Error(`writeEnvVar: invalid env var name ${JSON.stringify(key)}`);
+  }
+  const path = envPath(deployDir);
+  if (!existsSync(dirname(path))) {
+    mkdirSync(dirname(path), { recursive: true });
+  }
+  const existed = existsSync(path);
+  const original = existed ? readFileSync(path, "utf-8") : "";
+  const hadTrailingNewline = original.endsWith("\n");
+  let previous = null;
+  let found = false;
+  const sourceText = hadTrailingNewline ? original.slice(0, -1) : original;
+  const lines = sourceText === "" ? [] : sourceText.split(/\r?\n/);
+  const out = [];
+  for (const line of lines) {
+    const trimmed = line.trimStart();
+    if (!trimmed || trimmed.startsWith("#")) {
+      out.push(line);
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      out.push(line);
+      continue;
+    }
+    const k = line.slice(0, eq).trim();
+    if (k !== key) {
+      out.push(line);
+      continue;
+    }
+    const val = line.slice(eq + 1);
+    if (!found) {
+      previous = val;
+      found = true;
+      if (value !== null) {
+        out.push(`${key}=${value}`);
+      }
+    }
+  }
+  if (!found && value !== null) {
+    out.push(`${key}=${value}`);
+  }
+  let next = out.join("\n");
+  if (next.length > 0) next += "\n";
+  if (existed && next === original) {
+    return { changed: false, previous };
+  }
+  const tmp = `${path}.tmp-${process.pid}`;
+  try {
+    writeFileSync(tmp, next, { mode: 384 });
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  return { changed: true, previous };
+}
+var OPENAPI_TIMEOUT_MS = 4e3;
+var AUTH_TIMEOUT_MS = 6e3;
+var ENTITY_POST_TIMEOUT_MS = 6e3;
+var SSE_TIMEOUT_MS = 35e3;
+var ME_TIMEOUT_MS = 6e3;
+var DELETE_TIMEOUT_MS = 4e3;
+var AUTH_NAME = "Synap auth";
+var DISCOVERY_NAME = "Synap public discovery";
+var IDEMPOTENCY_NAME = "Synap idempotency replay";
+var EVENTS_NAME = "Synap event stream";
+var SUB_TOKENS_NAME = "Synap sub-token mode";
+async function runHubProtocolProbes(opts) {
+  const synapUrl = opts.synapUrl.replace(/\/+$/, "");
+  const apiKey = opts.apiKey;
+  const signal = opts.signal;
+  const runner = opts.runner ?? new FetchRunner();
+  const onRunnerNote = opts.onRunnerNote;
+  const auth = await probeSynapAuth(runner, synapUrl, apiKey, signal, onRunnerNote);
+  if (auth.status !== "pass") {
+    const skipMsg = auth.status === "skip" ? "Skipped \u2014 Synap URL or API key missing" : "Skipped \u2014 auth probe didn't pass";
+    return [
+      auth,
+      skipDiag("hub-protocol-idempotency", IDEMPOTENCY_NAME, skipMsg),
+      skipDiag("hub-protocol-events", EVENTS_NAME, skipMsg),
+      skipDiag("hub-protocol-sub-tokens", SUB_TOKENS_NAME, skipMsg)
+    ];
+  }
+  const [idem, sse, subTokens] = await Promise.all([
+    probeIdempotency(runner, synapUrl, apiKey, signal),
+    probeEventStream(runner, synapUrl, apiKey, signal),
+    probeSubTokens(runner, synapUrl, apiKey, signal)
+  ]);
+  return [auth, idem, sse, subTokens];
+}
+async function probeSynapAuth(runner, synapUrl, apiKey, outer, onRunnerNote) {
+  const start = Date.now();
+  if (!synapUrl) {
+    return {
+      id: "hub-protocol-openapi",
+      name: AUTH_NAME,
+      status: "skip",
+      message: "Synap apiUrl not configured in secrets",
+      fix: "Re-run setup or open the AI page \u2192 Save",
+      durationMs: Date.now() - start
+    };
+  }
+  if (!apiKey) {
+    return {
+      id: "hub-protocol-openapi",
+      name: AUTH_NAME,
+      status: "skip",
+      message: "Synap API key missing \u2014 auth probe needs Bearer auth",
+      fix: "Re-install Synap (`eve add synap`) to provision an API key",
+      durationMs: Date.now() - start
+    };
+  }
+  void onRunnerNote;
+  const result = await getAuthStatus({
+    synapUrl,
+    apiKey,
+    runner,
+    signal: outer,
+    timeoutMs: AUTH_TIMEOUT_MS
+  });
+  if (result.ok) {
+    return {
+      id: "hub-protocol-openapi",
+      name: AUTH_NAME,
+      status: "pass",
+      message: authPassMessage(result.status),
+      durationMs: Date.now() - start
+    };
+  }
+  return failureToDiagnostic(result.failure, synapUrl, Date.now() - start);
+}
+function authPassMessage(s) {
+  const userTag = s.userId.slice(0, 8);
+  const emailPart = s.userEmail ?? "no email";
+  const scopes = s.scopes.length > 0 ? `[${s.scopes.join(", ")}]` : "[no scopes]";
+  return `Auth OK \u2014 user ${userTag} (${emailPart}), scopes ${scopes}, key age ${s.ageDays}d`;
+}
+function failureToDiagnostic(failure, synapUrl, durationMs) {
+  switch (failure.reason) {
+    case "key_revoked":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || "API key was revoked or never registered",
+        fix: "eve auth renew",
+        durationMs
+      };
+    case "expired":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || "API key expired",
+        fix: "eve auth renew",
+        durationMs
+      };
+    case "invalid_format":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || "API key format is malformed",
+        fix: "Re-run `eve install` or `eve auth renew`",
+        durationMs
+      };
+    case "no_auth":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: "No bearer key sent \u2014 internal probe bug or missing agents.eve.hubApiKey",
+        fix: "Run: eve auth provision  (or check ~/.eve/secrets/secrets.json has agents.eve.hubApiKey set)",
+        durationMs
+      };
+    case "missing_scope":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || `Key lacks required scope '${failure.missingScope ?? "?"}'`,
+        fix: failure.missingScope ? `eve auth grant ${failure.missingScope}` : "Re-mint the agent key with the required scopes (eve auth renew)",
+        durationMs
+      };
+    case "backend_unhealthy":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || `Backend returned ${failure.httpStatus}`,
+        fix: "docker logs synap-backend-backend-1 --tail 50",
+        durationMs
+      };
+    case "transport":
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: `Cannot reach pod at ${synapUrl} (${failure.message})`,
+        fix: "Run `eve doctor` for a deeper view (check Synap container is running)",
+        durationMs
+      };
+    case "unknown":
+    default:
+      return {
+        id: "hub-protocol-openapi",
+        name: AUTH_NAME,
+        status: "fail",
+        message: failure.message || `Auth check failed (${failure.httpStatus})`,
+        durationMs
+      };
+  }
+}
+async function probeSynapDiscovery(runner, synapUrl, outer) {
+  const start = Date.now();
+  if (!synapUrl) {
+    return {
+      id: "hub-protocol-discovery",
+      name: DISCOVERY_NAME,
+      status: "skip",
+      message: "Synap apiUrl not configured",
+      durationMs: Date.now() - start
+    };
+  }
+  const url = `${synapUrl.replace(/\/+$/, "")}/api/hub/openapi.json`;
+  const res = await runner.httpGet(
+    url,
+    { Accept: "application/json" },
+    { signal: outer, timeoutMs: OPENAPI_TIMEOUT_MS }
+  );
+  if (res.status === 0) {
+    return {
+      id: "hub-protocol-discovery",
+      name: DISCOVERY_NAME,
+      status: "skip",
+      message: `Could not reach ${url} (${res.error ?? "network error"})`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (res.status === 200) {
+    let version = "?";
+    try {
+      const parsed = JSON.parse(res.body);
+      if (typeof parsed.openapi === "string") version = parsed.openapi;
+    } catch {
+    }
+    return {
+      id: "hub-protocol-discovery",
+      name: DISCOVERY_NAME,
+      status: "pass",
+      message: `Public openapi.json reachable (OpenAPI ${version})`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return {
+      id: "hub-protocol-discovery",
+      name: DISCOVERY_NAME,
+      status: "skip",
+      message: `Backend still requires auth on /api/hub/openapi.json (${res.status}) \u2014 predates the public-discovery release`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (res.status === 404) {
+    return {
+      id: "hub-protocol-discovery",
+      name: DISCOVERY_NAME,
+      status: "skip",
+      message: "Older backend \u2014 /api/hub/openapi.json not exposed",
+      durationMs: Date.now() - start
+    };
+  }
+  return {
+    id: "hub-protocol-discovery",
+    name: DISCOVERY_NAME,
+    status: "skip",
+    message: `Unexpected status ${res.status} from ${url}`,
+    durationMs: Date.now() - start
+  };
+}
+async function probeIdempotency(runner, synapUrl, apiKey, outer) {
+  const start = Date.now();
+  if (!synapUrl || !apiKey) {
+    return skipDiag("hub-protocol-idempotency", IDEMPOTENCY_NAME, "Skipped \u2014 Synap URL or API key missing");
+  }
+  const url = `${synapUrl}/api/hub/entities`;
+  const idempotencyKey = randomUUID();
+  const body = {
+    profileSlug: "note",
+    title: "eve-doctor-idempotency-smoke",
+    source: "openwebui-pipeline"
+  };
+  const bodyJson = JSON.stringify(body);
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "Idempotency-Key": idempotencyKey
+  };
+  const post = () => runner.httpPost(url, headers, bodyJson, {
+    signal: outer,
+    timeoutMs: ENTITY_POST_TIMEOUT_MS
+  });
+  const first = await post();
+  if (first.status === 0) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: `Cannot reach ${url} (${first.error ?? "network error"})`,
+      fix: "Check the Synap container is running and the URL is reachable",
+      durationMs: Date.now() - start
+    };
+  }
+  if (first.status === 401 || first.status === 403) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: `API key rejected \u2014 ${first.status} from POST /api/hub/entities`,
+      fix: "Re-run setup to mint a fresh agent API key",
+      durationMs: Date.now() - start
+    };
+  }
+  if (first.status === 404) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: "POST /api/hub/entities not available \u2014 backend version too old",
+      fix: "Update Synap (`eve update synap`)",
+      durationMs: Date.now() - start
+    };
+  }
+  if (first.status < 200 || first.status >= 300) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: `First POST returned ${first.status}: ${truncate(first.body)}`,
+      durationMs: Date.now() - start
+    };
+  }
+  const second = await post();
+  if (second.status === 0) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: `Second POST failed (${second.error ?? "network error"}) \u2014 couldn't verify replay`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (second.status < 200 || second.status >= 300) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: `Second POST returned ${second.status}: ${truncate(second.body)}`,
+      durationMs: Date.now() - start
+    };
+  }
+  const entityId = extractEntityId(first.body);
+  if (entityId) {
+    void deleteEntityBestEffort(synapUrl, apiKey, entityId, runner);
+  }
+  const replayHeader = second.headers["x-idempotent-replay"];
+  if (replayHeader !== "true") {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: "Backend doesn't echo X-Idempotent-Replay \u2014 idempotency middleware not mounted",
+      fix: "Update Synap (`eve update synap`) \u2014 needs 2026-05+ Hub Protocol",
+      durationMs: Date.now() - start
+    };
+  }
+  if (first.body !== second.body) {
+    return {
+      id: "hub-protocol-idempotency",
+      name: IDEMPOTENCY_NAME,
+      status: "fail",
+      message: "Backend created a duplicate entity (idempotency middleware not honouring the key)",
+      fix: "Update Synap (`eve update synap`) \u2014 needs 2026-05+ Hub Protocol",
+      durationMs: Date.now() - start
+    };
+  }
+  return {
+    id: "hub-protocol-idempotency",
+    name: IDEMPOTENCY_NAME,
+    status: "pass",
+    message: "Replay confirmed \u2014 same Idempotency-Key returns the cached response",
+    durationMs: Date.now() - start
+  };
+}
+async function probeEventStream(runner, synapUrl, apiKey, outer) {
+  const start = Date.now();
+  if (!synapUrl || !apiKey) {
+    return skipDiag("hub-protocol-events", EVENTS_NAME, "Skipped \u2014 Synap URL or API key missing");
+  }
+  const url = `${synapUrl}/api/hub/events/stream`;
+  const headers = { Authorization: `Bearer ${apiKey}`, Accept: "text/event-stream" };
+  const stream = await runner.httpStream(url, headers, { signal: outer, timeoutMs: SSE_TIMEOUT_MS });
+  if (!stream.ok) {
+    if (stream.error === "stream-not-supported") {
+      return skipDiag(
+        "hub-protocol-events",
+        EVENTS_NAME,
+        "Skipped \u2014 SSE probing not supported by current runner (e.g. docker-exec wget without unbuffered piping)"
+      );
+    }
+    if (stream.status === 401 || stream.status === 403) {
+      return {
+        id: "hub-protocol-events",
+        name: EVENTS_NAME,
+        status: "fail",
+        message: `API key rejected on /api/hub/events/stream (${stream.status})`,
+        fix: "Re-run setup to mint a fresh agent API key",
+        durationMs: Date.now() - start
+      };
+    }
+    if (stream.status === 404) {
+      return {
+        id: "hub-protocol-events",
+        name: EVENTS_NAME,
+        status: "fail",
+        message: "GET /api/hub/events/stream not available \u2014 backend version too old",
+        fix: "Update Synap (`eve update synap`)",
+        durationMs: Date.now() - start
+      };
+    }
+    if (stream.status === 0) {
+      const aborted = stream.error?.toLowerCase().includes("abort") || stream.error?.toLowerCase().includes("timeout");
+      return {
+        id: "hub-protocol-events",
+        name: EVENTS_NAME,
+        status: "fail",
+        message: aborted ? `No SSE response within ${SSE_TIMEOUT_MS / 1e3}s \u2014 proxy may be killing the stream` : `Cannot open event stream at ${url} (${stream.error ?? "network error"})`,
+        fix: aborted ? "Check reverse-proxy buffering: nginx needs `proxy_buffering off` for SSE" : "Check the Synap container is running",
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      id: "hub-protocol-events",
+      name: EVENTS_NAME,
+      status: "fail",
+      message: `Event stream returned ${stream.status} (${stream.error ?? "no body"})`,
+      durationMs: Date.now() - start
+    };
+  }
+  let received = false;
+  let receivedKind = "";
+  let buffer = "";
+  let readError = null;
+  try {
+    if (stream.chunks) {
+      for await (const chunk of stream.chunks) {
+        buffer += chunk;
+        const lines = buffer.split("\n");
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (trimmed.startsWith("event:")) {
+            const kind = trimmed.slice(6).trim();
+            if (kind === "heartbeat" || kind === "event") {
+              received = true;
+              receivedKind = kind;
+              break;
+            }
+          }
+        }
+        if (received) break;
+      }
+    }
+  } catch (err) {
+    if (!(err instanceof Error && err.name === "AbortError")) {
+      readError = err instanceof Error ? err : new Error(String(err));
+    }
+  } finally {
+    await stream.close();
+  }
+  if (readError) {
+    return {
+      id: "hub-protocol-events",
+      name: EVENTS_NAME,
+      status: "fail",
+      message: `Stream read error: ${readError.message}`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (!received) {
+    return {
+      id: "hub-protocol-events",
+      name: EVENTS_NAME,
+      status: "fail",
+      message: `No heartbeat received within ${SSE_TIMEOUT_MS / 1e3}s \u2014 stream may be proxied without flush`,
+      fix: "Check reverse-proxy: SSE needs `proxy_buffering off` and no response gzip",
+      durationMs: Date.now() - start
+    };
+  }
+  return {
+    id: "hub-protocol-events",
+    name: EVENTS_NAME,
+    status: "pass",
+    message: `Stream open \u2014 received \`${receivedKind}\` frame within ${SSE_TIMEOUT_MS / 1e3}s`,
+    durationMs: Date.now() - start
+  };
+}
+async function probeSubTokens(runner, synapUrl, apiKey, outer) {
+  const start = Date.now();
+  if (!synapUrl || !apiKey) {
+    return skipDiag("hub-protocol-sub-tokens", SUB_TOKENS_NAME, "Skipped \u2014 Synap URL or API key missing");
+  }
+  const url = `${synapUrl}/api/hub/users/me`;
+  const externalUserId = `eve-doctor-smoke-${Date.now()}`;
+  const fetchMe = async (extraHeaders) => {
+    const res = await runner.httpGet(
+      url,
+      {
+        Authorization: `Bearer ${apiKey}`,
+        Accept: "application/json",
+        ...extraHeaders
+      },
+      { signal: outer, timeoutMs: ME_TIMEOUT_MS }
+    );
+    if (res.status === 0) {
+      return {
+        ok: false,
+        status: 0,
+        message: res.error ?? "network error"
+      };
+    }
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, status: res.status, message: truncate(res.body) };
+    }
+    let id = null;
+    try {
+      const parsed = JSON.parse(res.body);
+      const candidate = parsed.id ?? parsed.user?.id;
+      if (typeof candidate === "string") id = candidate;
+    } catch {
+      return { ok: false, status: res.status, message: "response was not JSON" };
+    }
+    return { ok: true, userId: id, status: res.status };
+  };
+  const parent = await fetchMe({});
+  if (!parent.ok) {
+    if (parent.status === 401 || parent.status === 403) {
+      return {
+        id: "hub-protocol-sub-tokens",
+        name: SUB_TOKENS_NAME,
+        status: "fail",
+        message: `API key rejected on /api/hub/users/me (${parent.status})`,
+        fix: "Re-run setup to mint a fresh agent API key",
+        durationMs: Date.now() - start
+      };
+    }
+    if (parent.status === 404) {
+      return {
+        id: "hub-protocol-sub-tokens",
+        name: SUB_TOKENS_NAME,
+        status: "fail",
+        message: "GET /api/hub/users/me not available \u2014 backend version too old",
+        fix: "Update Synap (`eve update synap`)",
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      id: "hub-protocol-sub-tokens",
+      name: SUB_TOKENS_NAME,
+      status: "fail",
+      message: `Couldn't fetch parent user (${parent.status || "network error"}): ${parent.message}`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (!parent.userId) {
+    return {
+      id: "hub-protocol-sub-tokens",
+      name: SUB_TOKENS_NAME,
+      status: "fail",
+      message: "Backend returned /users/me without an id field",
+      durationMs: Date.now() - start
+    };
+  }
+  const sub = await fetchMe({ "X-External-User-Id": externalUserId });
+  if (!sub.ok) {
+    return {
+      id: "hub-protocol-sub-tokens",
+      name: SUB_TOKENS_NAME,
+      status: "fail",
+      message: `Couldn't fetch user with X-External-User-Id (${sub.status || "network error"}): ${sub.message}`,
+      durationMs: Date.now() - start
+    };
+  }
+  if (!sub.userId) {
+    return {
+      id: "hub-protocol-sub-tokens",
+      name: SUB_TOKENS_NAME,
+      status: "fail",
+      message: "Backend returned /users/me without an id field on sub-token call",
+      durationMs: Date.now() - start
+    };
+  }
+  if (parent.userId === sub.userId) {
+    return {
+      id: "hub-protocol-sub-tokens",
+      name: SUB_TOKENS_NAME,
+      status: "skip",
+      message: "Multi-user mode: OFF \u2014 X-External-User-Id ignored (HUB_PROTOCOL_SUB_TOKENS=false)",
+      durationMs: Date.now() - start
+    };
+  }
+  return {
+    id: "hub-protocol-sub-tokens",
+    name: SUB_TOKENS_NAME,
+    status: "pass",
+    message: `Multi-user mode: ON \u2014 sub-token resolved to a separate user id (parent=${shortId(parent.userId)}, sub=${shortId(sub.userId)})`,
+    durationMs: Date.now() - start
+  };
+}
+function skipDiag(id, name, message) {
+  return { id, name, status: "skip", message, durationMs: 0 };
+}
+function truncate(text, max = 160) {
+  const oneline = text.replace(/\s+/g, " ").trim();
+  return oneline.length > max ? `${oneline.slice(0, max)}\u2026` : oneline;
+}
+function shortId(id) {
+  return id.length > 8 ? `\u2026${id.slice(-8)}` : id;
+}
+function extractEntityId(text) {
+  try {
+    const parsed = JSON.parse(text);
+    const direct = parsed.id;
+    if (typeof direct === "string") return direct;
+    const nested = parsed.entity?.id;
+    if (typeof nested === "string") return nested;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function deleteEntityBestEffort(synapUrl, apiKey, entityId, runner) {
+  const r = runner ?? new FetchRunner();
+  try {
+    await r.httpDelete(
+      `${synapUrl}/api/hub/entities/${encodeURIComponent(entityId)}`,
+      { Authorization: `Bearer ${apiKey}` },
+      { timeoutMs: DELETE_TIMEOUT_MS }
+    );
+  } catch {
+  }
+}
+function combineSignals(outer, timeoutMs) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  let onAbort = null;
+  if (outer) {
+    if (outer.aborted) {
+      ac.abort();
+    } else {
+      onAbort = () => ac.abort();
+      outer.addEventListener("abort", onAbort);
+    }
+  }
+  return {
+    signal: ac.signal,
+    cleanup: () => {
+      clearTimeout(timer);
+      if (onAbort && outer) outer.removeEventListener("abort", onAbort);
+    }
+  };
+}
+function headersToRecord(h) {
+  const out = {};
+  h.forEach((value, key) => {
+    out[key.toLowerCase()] = value;
+  });
+  return out;
+}
+function isFetchTransportError(err) {
+  if (!(err instanceof Error)) return false;
+  const cause = err.cause;
+  const code = cause?.code;
+  if (code === "ECONNREFUSED" || code === "EHOSTUNREACH" || code === "ENOTFOUND" || code === "EAI_AGAIN") {
+    return true;
+  }
+  const msg = err.message || "";
+  return /\bECONNREFUSED\b|\bEHOSTUNREACH\b|\bENOTFOUND\b/.test(msg);
+}
+var FetchRunner = class {
+  name = "fetch";
+  async httpGet(url, headers, opts = {}) {
+    return this.request("GET", url, headers, void 0, opts);
+  }
+  async httpPost(url, headers, body, opts = {}) {
+    return this.request("POST", url, headers, body, opts);
+  }
+  async httpDelete(url, headers, opts = {}) {
+    return this.request("DELETE", url, headers, void 0, opts);
+  }
+  async request(method, url, headers, body, opts) {
+    const ac = combineSignals(opts.signal, opts.timeoutMs ?? 6e3);
+    try {
+      const res = await fetch(url, {
+        method,
+        headers,
+        body,
+        signal: ac.signal
+      });
+      const text = await res.text();
+      return {
+        status: res.status,
+        body: text,
+        headers: headersToRecord(res.headers)
+      };
+    } catch (err) {
+      return {
+        status: 0,
+        body: "",
+        headers: {},
+        error: err instanceof Error ? err.message : "network error"
+      };
+    } finally {
+      ac.cleanup();
+    }
+  }
+  async httpStream(url, headers, opts = {}) {
+    const ac = combineSignals(opts.signal, opts.timeoutMs ?? 35e3);
+    let res;
+    try {
+      res = await fetch(url, { method: "GET", headers, signal: ac.signal });
+    } catch (err) {
+      ac.cleanup();
+      return {
+        ok: false,
+        status: 0,
+        headers: {},
+        close: async () => {
+        },
+        error: err instanceof Error ? err.message : "network error"
+      };
+    }
+    if (!res.ok || !res.body) {
+      try {
+        await res.body?.cancel();
+      } catch {
+      }
+      ac.cleanup();
+      return {
+        ok: false,
+        status: res.status,
+        headers: headersToRecord(res.headers),
+        close: async () => {
+        },
+        error: res.body ? void 0 : "no body"
+      };
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    async function* iterate() {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) return;
+        if (value) yield decoder.decode(value, { stream: true });
+      }
+    }
+    const close = async () => {
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      ac.cleanup();
+    };
+    return {
+      ok: true,
+      status: res.status,
+      headers: headersToRecord(res.headers),
+      chunks: iterate(),
+      close
+    };
+  }
+};
+var execAsync = promisify(execCallback);
+var EVE_AGENT_TYPE = "eve";
+var EVE_EXTRA_SCOPES = ["providers.write"];
+var DEFAULT_TIMEOUT_MS = 6e3;
+async function getAuthStatus(opts) {
+  const synapUrl = opts.synapUrl.replace(/\/+$/, "");
+  if (!synapUrl) {
+    return {
+      ok: false,
+      failure: {
+        reason: "no_auth",
+        httpStatus: 0,
+        message: "synapUrl not configured"
+      }
+    };
+  }
+  if (!opts.apiKey) {
+    return {
+      ok: false,
+      failure: {
+        reason: "no_auth",
+        httpStatus: 0,
+        message: "apiKey not configured"
+      }
+    };
+  }
+  const runner = opts.runner ?? new FetchRunner();
+  const url = `${synapUrl}/api/hub/auth/status`;
+  const headers = {
+    Authorization: `Bearer ${opts.apiKey}`,
+    Accept: "application/json"
+  };
+  const res = await runner.httpGet(url, headers, {
+    signal: opts.signal,
+    timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  });
+  if (res.status === 0) {
+    return {
+      ok: false,
+      failure: {
+        reason: "transport",
+        httpStatus: 0,
+        message: res.error ?? "network error"
+      }
+    };
+  }
+  if (res.status >= 500) {
+    return {
+      ok: false,
+      failure: {
+        reason: "backend_unhealthy",
+        httpStatus: res.status,
+        message: `Backend returned ${res.status}`,
+        raw: tryJson(res.body)
+      }
+    };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return parse401(res.status, res.body);
+  }
+  if (res.status === 404) {
+    return {
+      ok: false,
+      failure: {
+        reason: "backend_unhealthy",
+        httpStatus: 404,
+        message: "GET /api/hub/auth/status not available \u2014 backend version too old",
+        raw: tryJson(res.body)
+      }
+    };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    return {
+      ok: false,
+      failure: {
+        reason: "unknown",
+        httpStatus: res.status,
+        message: `Backend returned ${res.status}`,
+        raw: tryJson(res.body)
+      }
+    };
+  }
+  const parsed = tryJson(res.body);
+  if (!parsed || typeof parsed !== "object") {
+    return {
+      ok: false,
+      failure: {
+        reason: "unknown",
+        httpStatus: res.status,
+        message: "auth/status returned non-JSON body"
+      }
+    };
+  }
+  const body = parsed;
+  const keyId = stringOr(body.keyId, "");
+  const userId = stringOr(body.userId, "");
+  const createdAtStr = stringOr(body.createdAt, "");
+  if (!keyId || !userId || !createdAtStr) {
+    return {
+      ok: false,
+      failure: {
+        reason: "unknown",
+        httpStatus: res.status,
+        message: "auth/status payload missing required fields (keyId/userId/createdAt)",
+        raw: parsed
+      }
+    };
+  }
+  const ageDays = computeAgeDays(createdAtStr);
+  const status = {
+    keyId,
+    keyIdPrefix: stringOr(body.keyIdPrefix, keyId.slice(0, 8)),
+    userId,
+    userEmail: stringOrNull(body.userEmail),
+    userName: stringOrNull(body.userName),
+    name: stringOrNull(body.name),
+    scopes: stringArray(body.scopes),
+    createdAt: createdAtStr,
+    expiresAt: stringOrNull(body.expiresAt),
+    lastUsedAt: stringOrNull(body.lastUsedAt),
+    ageDays,
+    parentKeyId: stringOrNull(body.parentKeyId),
+    isActive: true,
+    raw: parsed
+  };
+  return { ok: true, status };
+}
+async function isKeyValid(opts) {
+  const r = await getAuthStatus(opts);
+  return r.ok;
+}
+var RENEW_TIMEOUT_MS = 1e4;
+async function renewAgentKey(opts = {}) {
+  const agentType = opts.agentType ?? "eve";
+  const result = await provisionAgent({
+    agentType,
+    deployDir: opts.deployDir,
+    reason: opts.reason ?? "renew",
+    runner: opts.runner,
+    timeoutMs: opts.timeoutMs,
+    provisioningToken: opts.provisioningToken,
+    idempotent: opts.idempotent
+  });
+  if (result.provisioned) {
+    return {
+      renewed: true,
+      apiKey: result.record.hubApiKey,
+      keyIdPrefix: result.keyIdPrefix,
+      agentType,
+      wasAlreadyPresent: result.wasAlreadyPresent
+    };
+  }
+  return { renewed: false, reason: result.reason, agentType };
+}
+async function provisionAgent(opts) {
+  const agentType = opts.agentType;
+  if (!agentType || agentType.trim().length === 0) {
+    return { provisioned: false, agentType: "", reason: "agentType is required" };
+  }
+  const cwd = opts.deployDir ?? process.env.EVE_HOME ?? process.cwd();
+  const secrets = await readEveSecrets(cwd);
+  const synapUrl = (opts.synapUrl ?? await resolveSynapUrlOnHost(secrets)).trim();
+  if (!synapUrl) {
+    const hasSecrets = !!secrets;
+    return {
+      provisioned: false,
+      agentType,
+      reason: hasSecrets ? "synap pod URL unresolved \u2014 set domain.primary or synap.apiUrl in ~/.eve/secrets.json" : "~/.eve/secrets.json not found \u2014 run `eve setup` first to initialise Eve on this server"
+    };
+  }
+  let tokenLookup = opts.provisioningToken ? { token: opts.provisioningToken, source: "explicit", diagnosticReason: "" } : await resolveProvisioningTokenWithDiagnostics();
+  if (!tokenLookup.token && !opts.provisioningToken) {
+    try {
+      const ensured = await ensurePodProvisioningToken();
+      tokenLookup = {
+        token: ensured.token,
+        source: ensured.source === "generated" ? "file" : "file",
+        diagnosticReason: ""
+      };
+      if (ensured.source === "generated" && ensured.backendRestarted) {
+        await waitForBackend(synapUrl, opts.runner ?? new FetchRunner());
+      }
+    } catch (err) {
+      return {
+        provisioned: false,
+        agentType,
+        reason: tokenLookup.diagnosticReason || `Could not auto-generate PROVISIONING_TOKEN: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
+  if (!tokenLookup.token) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: tokenLookup.diagnosticReason
+    };
+  }
+  const provisioningToken = tokenLookup.token;
+  const runner = opts.runner ?? new FetchRunner();
+  const url = `${synapUrl.replace(/\/+$/, "")}/api/hub/setup/agent`;
+  const previousPrefix = (secrets?.agents?.[agentType]?.hubApiKey ?? secrets?.synap?.apiKey ?? "").slice(0, 8);
+  const body = JSON.stringify({
+    agentType,
+    // Scopes BEYOND the pod's shared agent bundle, granted per-agent.
+    //
+    // Only `eve` asks, and only for `providers.write`. Writing an ai_providers
+    // row sets the URL the pod sends every prompt to, which is why the pod keeps
+    // that scope out of the default bundle — so requesting it for every agent
+    // here would undo the narrowing rather than satisfy it. `eve` needs it
+    // because it is the operator tool that registers providers (e.g. the
+    // FreeLLMAPI gateway) on the user's behalf.
+    //
+    // The pod refuses this from a weak surface key; we authenticate with the
+    // PROVISIONING_TOKEN, which is operator-grade. An older pod without the
+    // scope ignores the unknown field — the key simply lacks it, and
+    // `upsertPodProvider` then reports the 403 in plain words.
+    ...agentType === EVE_AGENT_TYPE ? { extraScopes: EVE_EXTRA_SCOPES } : {},
+    // Diagnostic hints — backend ignores unknown fields. Useful in pod
+    // logs to attribute key churn ("renew", "migrate", "install") and
+    // to chain new keys back to the previous one if the backend tracks
+    // parentKeyId.
+    name: `eve-${agentType}`,
+    parentKeyIdPrefix: previousPrefix || void 0,
+    reason: opts.reason ?? "provision",
+    idempotent: opts.idempotent ?? false
+  });
+  const headers = {
+    Authorization: `Bearer ${provisioningToken}`,
+    "Content-Type": "application/json",
+    Accept: "application/json"
+  };
+  const res = await runner.httpPost(url, headers, body, {
+    timeoutMs: opts.timeoutMs ?? RENEW_TIMEOUT_MS
+  });
+  if (res.status === 0) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: `Cannot reach ${url} (${res.error ?? "network error"})`
+    };
+  }
+  if (res.status === 202) {
+    const parsed2 = tryJson(res.body);
+    const adminUrl = typeof parsed2 === "object" && parsed2 && typeof parsed2.adminUrl === "string" ? parsed2.adminUrl : null;
+    return {
+      provisioned: false,
+      agentType,
+      reason: `Backend deferred the request (issuer pending approval). Visit ${adminUrl ?? `${synapUrl}/admin/trusted-issuers`} to approve, then retry.`
+    };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: `PROVISIONING_TOKEN rejected (${res.status}) \u2014 token expired, wrong, or backend doesn't accept it. Re-check deploy/.env or run \`eve install\`.`
+    };
+  }
+  if (res.status === 404) {
+    const parsed404 = tryJson(res.body);
+    const isBackend404 = parsed404 !== null && typeof parsed404 === "object" && ("error" in parsed404 || "message" in parsed404);
+    if (isBackend404) {
+      const setupUrl = synapUrl.replace(/127\.0\.0\.1:\d+/, "pod.<your-domain>").replace(/:\d+$/, "");
+      return {
+        provisioned: false,
+        agentType,
+        reason: `No admin account on this pod \u2014 the backend returned 404 because there is no workspace to create the agent in. Create your first admin at ${setupUrl}/setup (or run \`eve auth provision --email <you@example.com>\` to be prompted inline), then retry.`
+      };
+    }
+    return {
+      provisioned: false,
+      agentType,
+      reason: `POST ${url} returned 404 (route not matched). Check Traefik routes with \`eve domain check\` \u2014 or the backend image may be outdated (run \`eve update synap\`). Raw: ${res.body.slice(0, 120)}`
+    };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: `Backend returned ${res.status}: ${res.body.slice(0, 160)}`
+    };
+  }
+  const parsed = tryJson(res.body);
+  if (!parsed || typeof parsed !== "object") {
+    return {
+      provisioned: false,
+      agentType,
+      reason: "Mint response was not JSON"
+    };
+  }
+  const obj = parsed;
+  if (obj.alreadyValid === true) {
+    const serverWorkspaceId = stringOr(obj.workspaceId, "");
+    try {
+      const existing = await readAgentKey(agentType, cwd);
+      if (existing?.hubApiKey) {
+        const updated = {
+          ...existing,
+          ...serverWorkspaceId ? { workspaceId: serverWorkspaceId } : {}
+        };
+        await writeAgentKey(agentType, updated, cwd);
+        return {
+          provisioned: true,
+          agentType,
+          record: updated,
+          keyIdPrefix: (updated.keyId ?? updated.hubApiKey).slice(0, 8),
+          wasAlreadyPresent: true
+        };
+      }
+    } catch {
+    }
+  }
+  const hubApiKey = stringOr(obj.hubApiKey, stringOr(obj.apiKey, ""));
+  if (!hubApiKey) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: "Mint response did not include hubApiKey"
+    };
+  }
+  const agentUserId = stringOr(obj.agentUserId, "");
+  let workspaceId = stringOr(obj.workspaceId, "");
+  if (!workspaceId) {
+    try {
+      const existing = await readAgentKey(agentType, cwd);
+      if (existing?.workspaceId) workspaceId = existing.workspaceId;
+    } catch {
+    }
+  }
+  const keyId = stringOr(obj.keyId, "");
+  const keyIdPrefix = stringOr(
+    obj.keyIdPrefix,
+    keyId.slice(0, 8) || hubApiKey.slice(0, 8)
+  );
+  if (!agentUserId) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: "Mint response missing required field: agentUserId"
+    };
+  }
+  const record = {
+    hubApiKey,
+    agentUserId,
+    workspaceId,
+    keyId: keyId || void 0,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    await writeAgentKey(agentType, record, cwd);
+  } catch (err) {
+    return {
+      provisioned: false,
+      agentType,
+      reason: `Mint succeeded but secrets.json write failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  try {
+    await writeEveSecrets({ pod: { bootstrapToken: provisioningToken } }, cwd);
+  } catch {
+  }
+  return { provisioned: true, agentType, record, keyIdPrefix };
+}
+async function provisionAllAgents(opts) {
+  const cwd = opts.deployDir ?? process.env.EVE_HOME ?? process.cwd();
+  const skipIfPresent = opts.skipIfPresent ?? true;
+  const agents = agentsToProvision(opts.installedComponentIds);
+  const results = [];
+  for (const agent of agents) {
+    if (skipIfPresent) {
+      const existing = await readAgentKey(agent.agentType, cwd);
+      if (existing && existing.hubApiKey) {
+        results.push({
+          provisioned: true,
+          agentType: agent.agentType,
+          record: existing,
+          keyIdPrefix: (existing.keyId ?? existing.hubApiKey).slice(0, 8),
+          wasAlreadyPresent: true
+        });
+        continue;
+      }
+    }
+    const result = await provisionAgent({
+      agentType: agent.agentType,
+      deployDir: cwd,
+      reason: opts.reason ?? "provision-all",
+      runner: opts.runner,
+      synapUrl: opts.synapUrl,
+      provisioningToken: opts.provisioningToken
+    });
+    results.push(result);
+  }
+  return results;
+}
+async function migrateLegacyToAgents(opts) {
+  const cwd = opts.deployDir ?? process.env.EVE_HOME ?? process.cwd();
+  const secretsBefore = await readEveSecrets(cwd);
+  const collapse = await collapseLegacyCoderAgents(secretsBefore, cwd);
+  const eveExisting = await readAgentKey("eve", cwd);
+  const needsPerAgent = !eveExisting || !eveExisting.hubApiKey;
+  if (!needsPerAgent && !collapse.collapsed) {
+    return {
+      migrated: false,
+      results: [],
+      reason: "already migrated \u2014 eve agent key present and no legacy coder slugs"
+    };
+  }
+  const results = await provisionAllAgents({
+    installedComponentIds: opts.installedComponentIds,
+    deployDir: cwd,
+    reason: collapse.collapsed ? "migrate-legacy-coder-collapse" : "migrate-legacy",
+    runner: opts.runner,
+    skipIfPresent: !needsPerAgent
+  });
+  const anyOk = results.some((r) => r.provisioned);
+  return {
+    migrated: anyOk || collapse.collapsed,
+    results,
+    reason: anyOk ? void 0 : collapse.collapsed ? "coder collapse applied; new agent provisioning failed \u2014 see per-agent reasons" : "no agent could be provisioned \u2014 see per-agent reasons",
+    collapsedToEngine: collapse.engine,
+    strippedLegacySlugs: collapse.stripped
+  };
+}
+async function collapseLegacyCoderAgents(secrets, cwd) {
+  if (!secrets) return { collapsed: false, stripped: [] };
+  const agents = secrets.agents ?? {};
+  const presentLegacy = LEGACY_CODER_ENGINE_SLUGS.filter(
+    (slug) => agents[slug] !== void 0
+  );
+  if (presentLegacy.length === 0) {
+    return { collapsed: false, stripped: [] };
+  }
+  const existingChoice = secrets.builder?.codeEngine;
+  const pickedEngine = existingChoice && LEGACY_CODER_ENGINE_SLUGS.includes(existingChoice) ? existingChoice : presentLegacy[0];
+  await writeCodeEngine(pickedEngine, cwd);
+  const nextAgents = {};
+  for (const [slug, rec] of Object.entries(agents)) {
+    if (LEGACY_CODER_ENGINE_SLUGS.includes(slug)) continue;
+    nextAgents[slug] = rec;
+  }
+  await writeEveSecrets({ agents: nextAgents }, cwd);
+  return { collapsed: true, engine: pickedEngine, stripped: presentLegacy };
+}
+async function resolveProvisioningToken() {
+  return (await resolveProvisioningTokenWithDiagnostics()).token;
+}
+async function waitForBackend(synapUrl, runner, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 2e4;
+  const intervalMs = opts.intervalMs ?? 500;
+  const url = `${synapUrl.replace(/\/+$/, "")}/api/hub/health`;
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const res = await runner.httpGet(url, {}, { timeoutMs: 1500 });
+      if (res.status >= 200 && res.status < 500) return;
+    } catch {
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+async function ensurePodProvisioningToken() {
+  const probe = await resolveProvisioningTokenWithDiagnostics();
+  if (probe.token) {
+    return { token: probe.token, source: "existing" };
+  }
+  const deployDir = findPodDeployDir();
+  if (!deployDir) {
+    throw new Error(
+      "No pod deploy directory found \u2014 set SYNAP_DEPLOY_DIR or install synap-backend first (checked: " + POD_DEPLOY_DIR_CANDIDATES.join(", ") + ")."
+    );
+  }
+  const token = randomBytes(32).toString("hex");
+  const result = writeEnvVar(deployDir, "PROVISIONING_TOKEN", token);
+  const envFilePath = join2(deployDir, ".env");
+  const backendRestarted = restartBackendContainer(deployDir);
+  void result;
+  return {
+    token,
+    source: "generated",
+    writtenTo: envFilePath,
+    backendRestarted
+  };
+}
+async function resolveProvisioningTokenWithDiagnostics() {
+  const envName = process.env.EVE_PROVISIONING_TOKEN !== void 0 ? "EVE_PROVISIONING_TOKEN" : process.env.PROVISIONING_TOKEN !== void 0 ? "PROVISIONING_TOKEN" : null;
+  const envValue = process.env.EVE_PROVISIONING_TOKEN ?? process.env.PROVISIONING_TOKEN;
+  if (envName !== null && (envValue ?? "").trim().length === 0) {
+    return {
+      token: null,
+      source: "empty",
+      diagnosticReason: `${envName} is set but empty. Either unset it (so we can fall back to the pod's deploy/.env) or assign a real value (\`openssl rand -hex 32\`).`
+    };
+  }
+  if (envValue && envValue.trim().length > 0) {
+    return { token: envValue.trim(), source: "env", diagnosticReason: "" };
+  }
+  const dirCandidates = [
+    process.env.SYNAP_DEPLOY_DIR,
+    "/opt/synap-backend/deploy",
+    "/opt/synap-backend",
+    "/opt/synap/deploy",
+    "/opt/synap",
+    "/opt/synap-pod/deploy",
+    "/opt/synap-pod",
+    "/srv/synap-backend/deploy",
+    "/srv/synap/deploy"
+  ].filter((d) => typeof d === "string" && d.length > 0);
+  let fileFoundEmpty = false;
+  let fileFoundEmptyAt = "";
+  for (const dir of dirCandidates) {
+    const envPath2 = join2(dir, ".env");
+    if (!existsSync2(envPath2)) continue;
+    const probe = readEnvFileVarWithStatus(envPath2, "PROVISIONING_TOKEN");
+    if (probe.value) {
+      return { token: probe.value, source: "file", diagnosticReason: "" };
+    }
+    if (probe.status === "found-empty" && !fileFoundEmpty) {
+      fileFoundEmpty = true;
+      fileFoundEmptyAt = envPath2;
+    }
+  }
+  const dockerProbe = await readProvisioningTokenFromDockerWithStatus();
+  if (dockerProbe.value) {
+    return { token: dockerProbe.value, source: "docker", diagnosticReason: "" };
+  }
+  if (fileFoundEmpty || dockerProbe.status === "found-empty") {
+    const where = fileFoundEmpty ? fileFoundEmptyAt : "the running synap-backend container's env";
+    return {
+      token: null,
+      source: "empty",
+      diagnosticReason: `PROVISIONING_TOKEN is empty in ${where}. The pod was deployed without filling it in. Fix: \`openssl rand -hex 32\` and write the value into the pod's deploy/.env, then \`docker compose up -d backend\` (or \`docker restart synap-backend-backend-1\`) and retry. See \`eve auth bootstrap-token\` for an automated path once supported.`
+    };
+  }
+  return {
+    token: null,
+    source: "missing",
+    diagnosticReason: "PROVISIONING_TOKEN unavailable. Set EVE_PROVISIONING_TOKEN, or ensure the pod's deploy/.env is readable. PROVISIONING_TOKEN was generated when synap-backend was first installed and lives in deploy/.env on the pod host."
+  };
+}
+function readEnvFileVarWithStatus(envPath2, key) {
+  try {
+    const text = readFileSync2(envPath2, "utf-8");
+    let sawEmpty = false;
+    for (const raw of text.split(/\r?\n/)) {
+      const line = raw.trim();
+      if (!line || line.startsWith("#")) continue;
+      const eq = line.indexOf("=");
+      if (eq < 0) continue;
+      if (line.slice(0, eq).trim() === key) {
+        const value = line.slice(eq + 1).trim();
+        if (value.length > 0) return { value, status: "found" };
+        sawEmpty = true;
+      }
+    }
+    return { value: null, status: sawEmpty ? "found-empty" : "absent" };
+  } catch {
+    return { value: null, status: "absent" };
+  }
+}
+async function readProvisioningTokenFromDockerWithStatus() {
+  let sawEmpty = false;
+  for (const container of SYNAP_BACKEND_CONTAINERS) {
+    try {
+      const { stdout: out } = await execAsync(
+        `docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' ${container}`,
+        { encoding: "utf-8", timeout: 4e3 }
+      );
+      for (const raw of out.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line) continue;
+        const eq = line.indexOf("=");
+        if (eq < 0) continue;
+        if (line.slice(0, eq) === "PROVISIONING_TOKEN") {
+          const value = line.slice(eq + 1).trim();
+          if (value.length > 0) return { value, status: "found" };
+          sawEmpty = true;
+        }
+      }
+    } catch {
+    }
+  }
+  return { value: null, status: sawEmpty ? "found-empty" : "absent" };
+}
+var STRUCTURED_REASONS = /* @__PURE__ */ new Set([
+  "key_revoked",
+  "missing_scope",
+  "expired",
+  "invalid_format",
+  "no_auth"
+]);
+function parse401(httpStatus, body) {
+  const parsed = tryJson(body);
+  if (parsed && typeof parsed === "object") {
+    const obj = parsed;
+    const reasonStr = stringOr(obj.reason, "");
+    if (reasonStr && STRUCTURED_REASONS.has(reasonStr)) {
+      return {
+        ok: false,
+        failure: {
+          reason: reasonStr,
+          httpStatus,
+          message: stringOr(obj.message, `unauthorized (${reasonStr})`),
+          missingScope: stringOr(obj.missingScope, "") || void 0,
+          keyIdPrefix: stringOr(obj.keyIdPrefix, "") || void 0,
+          raw: parsed
+        }
+      };
+    }
+  }
+  return {
+    ok: false,
+    failure: {
+      reason: "key_revoked",
+      httpStatus,
+      message: `unauthorized (${httpStatus}) \u2014 backend did not return a structured envelope`,
+      raw: parsed ?? body
+    }
+  };
+}
+function stringOr(v, fallback) {
+  return typeof v === "string" ? v : fallback;
+}
+function stringOrNull(v) {
+  return typeof v === "string" ? v : null;
+}
+function stringArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter((x) => typeof x === "string");
+}
+function tryJson(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function computeAgeDays(createdAt) {
+  const t = Date.parse(createdAt);
+  if (Number.isNaN(t)) return 0;
+  const ms = Date.now() - t;
+  if (ms <= 0) return 0;
+  return Math.floor(ms / (1e3 * 60 * 60 * 24));
+}
+
+export {
+  readEnvVar,
+  readEnvFile,
+  writeEnvVar,
+  runHubProtocolProbes,
+  probeSynapDiscovery,
+  truncate,
+  shortId,
+  extractEntityId,
+  deleteEntityBestEffort,
+  combineSignals,
+  isFetchTransportError,
+  FetchRunner,
+  getAuthStatus,
+  isKeyValid,
+  renewAgentKey,
+  provisionAgent,
+  provisionAllAgents,
+  migrateLegacyToAgents,
+  resolveProvisioningToken,
+  waitForBackend,
+  ensurePodProvisioningToken
+};
+//# sourceMappingURL=chunk-JO5H5G6U.js.map