@trenchwork/erosolar 1.1.16

package/dist/core/auth.js

@@ -0,0 +1,291 @@
+import * as http from 'node:http';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+const AUTH_FILE = path.join(os.homedir(), '.erosolar', 'auth.json');
+const FIREBASE_API_KEY = "AIzaSyDmD4RbVRClZaM2yF2Q9Qkt-18ST7Y29X4";
+export const FIREBASE_PROJECT_ID = 'erosolar-1b0db';
+// Login site reads ?port=NNNNN and posts the token to http://localhost:NNNNN/callback.
+// We pick the first free port in this range so simultaneous logins from multiple
+// terminals (or a stale prior process) don't deadlock on a single hard-coded port.
+const AUTH_PORT_START = 59999;
+const AUTH_PORT_END = 60099;
+function readAuthFile() {
+    try {
+        if (!fs.existsSync(AUTH_FILE))
+            return null;
+        const data = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
+        if (data && typeof data === 'object')
+            return data;
+    }
+    catch (_) {
+        // Corrupt auth.json — treat as logged out.
+    }
+    return null;
+}
+function writeAuthFile(state) {
+    const authDir = path.dirname(AUTH_FILE);
+    // 0o700 on the parent directory and 0o600 on the file. The file holds
+    // a Firebase ID token plus a long-lived refresh token; on multi-user
+    // systems anything looser leaves them readable by other local accounts.
+    // mkdir's mode is best-effort — only applies to a brand-new directory.
+    if (!fs.existsSync(authDir))
+        fs.mkdirSync(authDir, { recursive: true, mode: 0o700 });
+    // Atomic write: stage to a tmp file and rename. Two concurrent writers
+    // (e.g. the CLI and a background poll script invoked at the same time)
+    // would otherwise race on the file and one could read a half-written
+    // JSON. rename() on the same filesystem is atomic on POSIX and Windows.
+    const tmp = `${AUTH_FILE}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, AUTH_FILE);
+}
+export function getAuthStatus() {
+    const data = readAuthFile();
+    if (data && data.authenticated && data.email) {
+        return { email: data.email, uid: data.uid, authenticated: true };
+    }
+    return { authenticated: false };
+}
+/**
+ * Decode a JWT's payload without verifying — we only use this to find the
+ * token's `exp` claim so we know when to refresh. Verification happens
+ * server-side at every Firebase call.
+ */
+function decodeJwtExp(jwt) {
+    try {
+        const [, payload] = jwt.split('.');
+        if (!payload)
+            return null;
+        const decoded = JSON.parse(Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8'));
+        return typeof decoded.exp === 'number' ? decoded.exp * 1000 : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Exchange a refresh token for a new ID token via Firebase's secureToken
+ * endpoint. Returns the new state (still missing email/uid; caller merges).
+ */
+async function refreshIdToken(refreshToken) {
+    const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
+    });
+    if (!res.ok) {
+        throw new Error(`token refresh failed: HTTP ${res.status}`);
+    }
+    const data = await res.json();
+    if (!data.id_token || !data.refresh_token) {
+        throw new Error('token refresh: missing id_token/refresh_token in response');
+    }
+    const expiresInSec = parseInt(data.expires_in || '3600', 10);
+    return {
+        idToken: data.id_token,
+        refreshToken: data.refresh_token,
+        expiresAt: Date.now() + expiresInSec * 1000 - 30 * 1000, // 30s safety margin
+    };
+}
+/**
+ * Get a non-expired Firebase ID token, refreshing transparently when the
+ * cached one is within 30s of expiring. Throws if the user is not signed
+ * in or the refresh token has been revoked.
+ */
+export async function getValidIdToken() {
+    const state = readAuthFile();
+    if (!state || !state.authenticated || !state.token) {
+        throw new Error('not signed in — run `erosolar` to log in');
+    }
+    // If we know the expiry and we're still well within it, just return the token.
+    const exp = state.tokenExpiresAt ?? decodeJwtExp(state.token);
+    if (exp && exp - Date.now() > 60 * 1000) {
+        return state.token;
+    }
+    // Need a fresh token. Refresh if we have a refresh token, otherwise the
+    // user must re-auth (their auth.json predates the refresh-token rollout).
+    if (!state.refreshToken) {
+        throw new Error('session expired — re-run `erosolar` to log in again');
+    }
+    const fresh = await refreshIdToken(state.refreshToken);
+    const updated = {
+        ...state,
+        token: fresh.idToken,
+        refreshToken: fresh.refreshToken,
+        tokenExpiresAt: fresh.expiresAt,
+    };
+    writeAuthFile(updated);
+    return fresh.idToken;
+}
+export function getAuthUid() {
+    const state = readAuthFile();
+    return state?.uid || null;
+}
+/**
+ * Bind an http server to the first free port in [start, end].
+ * Resolves with the bound port; rejects only if every port is in use.
+ */
+function bindToFreePort(server, start, end) {
+    return new Promise((resolve, reject) => {
+        let port = start;
+        const tryListen = () => {
+            // Single-shot listeners so we can swap them between attempts.
+            const onError = (err) => {
+                server.removeListener('listening', onListening);
+                if (err.code === 'EADDRINUSE' && port < end) {
+                    port += 1;
+                    setImmediate(tryListen);
+                    return;
+                }
+                reject(err);
+            };
+            const onListening = () => {
+                server.removeListener('error', onError);
+                resolve(port);
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            // Pin to IPv4 explicitly. `'localhost'` resolves to ::1 (IPv6) first on
+            // macOS, but browsers + curl frequently hit 127.0.0.1 (IPv4). Without
+            // this, the CLI happily listens on ::1 while the browser's `fetch`
+            // and `<img>` callback fail with ECONNREFUSED, leaving the CLI stuck
+            // on "Waiting for browser login…" forever.
+            server.listen(port, '127.0.0.1');
+        };
+        tryListen();
+    });
+}
+export async function requireAuth() {
+    const status = getAuthStatus();
+    if (status.authenticated) {
+        return; // Already logged in
+    }
+    const chalk = (await import('chalk')).default;
+    console.log(chalk.yellow('\nAuthentication required to use Erosolar Coder.'));
+    console.log(chalk.dim('Waiting for browser login...'));
+    const open = (await import('open')).default;
+    // Success page served on every /callback hit. The browser fans out THREE
+    // delivery channels (fetch, image beacon, navigation) per login.html — the
+    // first one to land triggers Firebase verification; later ones get this
+    // page back so the user's tab ends up on a real page that auto-closes
+    // instead of ERR_CONNECTION_REFUSED.
+    const SUCCESS_HTML = `
+    <!DOCTYPE html>
+    <html>
+      <head>
+        <title>Login Successful</title>
+        <style>
+          body { background: #0f0f11; color: #d4af37; font-family: sans-serif; text-align: center; padding-top: 50px; }
+          h1 { color: #d4af37; }
+        </style>
+      </head>
+      <body>
+        <h1>Login successful!</h1>
+        <p>You can safely close this window and return to your terminal.</p>
+        <script>setTimeout(() => window.close(), 2000);</script>
+      </body>
+    </html>
+  `;
+    return new Promise(async (resolve, reject) => {
+        let authComplete = false;
+        let closeTimer = null;
+        const finishCallback = (res) => {
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(SUCCESS_HTML);
+        };
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://${req.headers.host}`);
+            if (url.pathname === '/callback') {
+                // Idempotent: once we've successfully captured a token, replay the
+                // success page for every subsequent /callback hit. Without this, the
+                // navigation channel arrives ~600ms after the fetch+image channels,
+                // by which point the server would have closed and the user's tab
+                // would render ERR_CONNECTION_REFUSED.
+                if (authComplete) {
+                    finishCallback(res);
+                    return;
+                }
+                const token = url.searchParams.get('token');
+                const refreshToken = url.searchParams.get('refresh') || undefined;
+                if (token) {
+                    try {
+                        // Verify token with Firebase
+                        const verifyRes = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:lookup?key=${FIREBASE_API_KEY}`, {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ idToken: token })
+                        });
+                        const data = await verifyRes.json();
+                        if (data.users && data.users.length > 0) {
+                            // Re-check after the await: a concurrent callback may have
+                            // already finished verification while we were awaiting.
+                            if (authComplete) {
+                                finishCallback(res);
+                                return;
+                            }
+                            authComplete = true;
+                            const email = data.users[0].email;
+                            const uid = data.users[0].localId;
+                            // Save auth state. Capture refreshToken if the site provided
+                            // one so long-running CLI sessions can mint fresh ID tokens
+                            // past the 1h expiry.
+                            writeAuthFile({
+                                authenticated: true,
+                                email,
+                                uid,
+                                token,
+                                tokenExpiresAt: decodeJwtExp(token) || Date.now() + 60 * 60 * 1000 - 30 * 1000,
+                                refreshToken,
+                            });
+                            finishCallback(res);
+                            console.log(chalk.green(`\n✓ Successfully logged in as ${email}`));
+                            resolve();
+                            // Keep the server alive briefly so the browser's late
+                            // navigation channel can land on the success page (which
+                            // auto-closes the tab) instead of seeing
+                            // ERR_CONNECTION_REFUSED. Unref so the timer doesn't keep an
+                            // otherwise-idle CLI process alive.
+                            closeTimer = setTimeout(() => server.close(), 8000);
+                            if (typeof closeTimer.unref === 'function')
+                                closeTimer.unref();
+                        }
+                        else {
+                            throw new Error('Invalid token');
+                        }
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'text/plain' });
+                        res.end('Authentication failed.');
+                        if (!authComplete) {
+                            server.close();
+                            reject(new Error('Authentication failed'));
+                        }
+                    }
+                }
+                else {
+                    res.writeHead(400, { 'Content-Type': 'text/plain' });
+                    res.end('No token provided.');
+                }
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        });
+        let boundPort;
+        try {
+            boundPort = await bindToFreePort(server, AUTH_PORT_START, AUTH_PORT_END);
+        }
+        catch (e) {
+            console.error(chalk.red(`Error: Could not bind any port in ${AUTH_PORT_START}-${AUTH_PORT_END}. ` +
+                `Free a port in that range and try again.`));
+            reject(e);
+            return;
+        }
+        const loginUrl = `https://ero.solar/login?port=${boundPort}`;
+        open(loginUrl).catch(() => {
+            console.log(`Please manually open this URL in your browser:\n${chalk.cyan(loginUrl)}`);
+        });
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACpE,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,uFAAuF;AACvF,iFAAiF;AACjF,mFAAmF;AACnF,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,aAAa,GAAG,KAAK,CAAC;AAc5B,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAiB,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,YAAoB;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mDAAmD,gBAAgB,EAAE,EAAE;QAC7F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,0CAA0C,kBAAkB,CAAC,YAAY,CAAC,EAAE;KACnF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwE,CAAC;IACpG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,oBAAoB;KAC9E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,OAAO,GAAc;QACzB,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,SAAS;KAChC,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAmB,EAAE,KAAa,EAAE,GAAW;IACrE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,MAAM,SAAS,GAAG,GAAG,EAAE;YACrB,8DAA8D;YAC9D,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;gBAC7C,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBAC5C,IAAI,IAAI,CAAC,CAAC;oBACV,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC,CAAC;QAEF,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,oBAAoB;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAE5C,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;GAgBpB,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,UAAU,GAA0B,IAAI,CAAC;QAE7C,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAE,EAAE;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,uCAAuC;gBACvC,IAAI,YAAY,EAAE,CAAC;oBACjB,cAAc,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;gBAClE,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC;wBACH,6BAA6B;wBAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,iEAAiE,gBAAgB,EAAE,EAAE;4BACjH,MAAM,EAAE,MAAM;4BACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;4BAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;yBACzC,CAAC,CAAC;wBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAA2D,CAAC;wBAE7F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxC,2DAA2D;4BAC3D,wDAAwD;4BACxD,IAAI,YAAY,EAAE,CAAC;gCACjB,cAAc,CAAC,GAAG,CAAC,CAAC;gCACpB,OAAO;4BACT,CAAC;4BACD,YAAY,GAAG,IAAI,CAAC;4BAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;4BAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;4BAElC,6DAA6D;4BAC7D,4DAA4D;4BAC5D,sBAAsB;4BACtB,aAAa,CAAC;gCACZ,aAAa,EAAE,IAAI;gCACnB,KAAK;gCACL,GAAG;gCACH,KAAK;gCACL,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI;gCAC9E,YAAY;6BACb,CAAC,CAAC;4BAEH,cAAc,CAAC,GAAG,CAAC,CAAC;4BAEpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,CAAC;4BACnE,OAAO,EAAE,CAAC;4BAEV,sDAAsD;4BACtD,yDAAyD;4BACzD,yCAAyC;4BACzC,6DAA6D;4BAC7D,oCAAoC;4BACpC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;4BACpD,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gCAAE,UAAU,CAAC,KAAK,EAAE,CAAC;wBACjE,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;wBACnC,CAAC;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;wBACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBAClC,IAAI,CAAC,YAAY,EAAE,CAAC;4BAClB,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,qCAAqC,eAAe,IAAI,aAAa,IAAI;gBACzE,0CAA0C,CAC3C,CACF,CAAC;YACF,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,gCAAgC,SAAS,EAAE,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxB,OAAO,CAAC,GAAG,CAAC,mDAAmD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/bashCommandGuidance.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Centralized guidance for bash command flows.
+ * Keeps publish/git heuristics in one place so bash tooling stays concise.
+ */
+export type BashFlowSeverity = 'info' | 'warning' | 'critical';
+export interface BashFlowWarning {
+    readonly code: string;
+    readonly message: string;
+    readonly suggestion?: string;
+    readonly severity?: BashFlowSeverity;
+}
+/**
+ * Analyze a bash command for common workflow gaps (publish, git efficiency).
+ */
+export declare function analyzeBashFlow(command: string): BashFlowWarning[];
+//# sourceMappingURL=bashCommandGuidance.d.ts.map

package/dist/core/bashCommandGuidance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bashCommandGuidance.d.ts","sourceRoot":"","sources":["../../src/core/bashCommandGuidance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAoClE"}

package/dist/core/bashCommandGuidance.js

@@ -0,0 +1,40 @@
+/**
+ * Centralized guidance for bash command flows.
+ * Keeps publish/git heuristics in one place so bash tooling stays concise.
+ */
+/**
+ * Analyze a bash command for common workflow gaps (publish, git efficiency).
+ */
+export function analyzeBashFlow(command) {
+    const warnings = [];
+    const normalized = command.toLowerCase();
+    if (!normalized.trim()) {
+        return warnings;
+    }
+    // Git efficiency: avoid repeated status calls in a single command chain.
+    const gitStatusMatches = normalized.match(/git status/g);
+    if (gitStatusMatches && gitStatusMatches.length > 1) {
+        warnings.push({
+            code: 'GIT_REDUNDANT_STATUS',
+            message: 'Multiple git status calls detected in one command',
+            suggestion: 'Combine git operations: git add -A && git commit -m "msg" && git push',
+            severity: 'info',
+        });
+    }
+    // Publish flow completeness for npm-style commands.
+    if (normalized.includes('npm publish')) {
+        const hasVersionStep = /\b(?:npm|pnpm|yarn)\s+version\b/.test(normalized);
+        const hasBuildOrTests = /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?(build|test|lint|prepare)\b/.test(normalized);
+        const hasGitPush = /\bgit\s+push\b/.test(normalized);
+        if (!(hasVersionStep && hasBuildOrTests && hasGitPush)) {
+            warnings.push({
+                code: 'NPM_INCOMPLETE_WORKFLOW',
+                message: 'npm publish detected without a complete release flow',
+                suggestion: 'Include version bump, build/tests, and git push or use npm_publish to automate the full release',
+                severity: 'warning',
+            });
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=bashCommandGuidance.js.map

package/dist/core/bashCommandGuidance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bashCommandGuidance.js","sourceRoot":"","sources":["../../src/core/bashCommandGuidance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,mDAAmD;YAC5D,UAAU,EAAE,uEAAuE;YACnF,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1E,MAAM,eAAe,GAAG,8DAA8D,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,CAAC,CAAC,cAAc,IAAI,eAAe,IAAI,UAAU,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,sDAAsD;gBAC/D,UAAU,EAAE,iGAAiG;gBAC7G,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/constants.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared constants used across the orchestration stack.
+ */
+export declare const TASK_FULLY_COMPLETE = "TASK_FULLY_COMPLETE";
+/**
+ * NO SIMULATIONS POLICY
+ *
+ * This system executes REAL operations only. Simulations, mocks, fake data,
+ * and hypothetical scenarios are strictly forbidden in production output.
+ *
+ * Forbidden patterns:
+ * - "simulated", "simulation", "hypothetical", "theoretical"
+ * - "fake", "mock", "dummy", "pretend", "imaginary"
+ * - "would be", "could be", "might be" (speculative results)
+ * - Creating fictional reports, summaries, or deliverables
+ * - Generating random/synthetic data disguised as real results
+ */
+export declare const NO_SIMULATIONS_POLICY = "STRICT NO-SIMULATION POLICY:\n- Execute REAL operations only - NO simulations, NO mocks, NO fake data\n- Never create fictional reports, summaries, or deliverables\n- Never generate \"simulated\" results or hypothetical outcomes\n- If a task cannot be executed for real, report inability clearly\n- All outputs must be genuine results from actual execution\n- Forbidden words in deliverables: \"simulated\", \"hypothetical\", \"theoretical\", \"mock\", \"fake\"\n";
+/**
+ * Patterns that indicate simulation/fake content in output
+ */
+export declare const SIMULATION_PATTERNS: RegExp[];
+/**
+ * Check if content contains simulation indicators
+ */
+export declare function containsSimulationIndicators(content: string): boolean;
+/**
+ * Extract simulation indicator matches from content
+ */
+export declare function findSimulationIndicators(content: string): string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/core/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,odAOjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,UAa/B,CAAC;AAEF;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CASlE"}

package/dist/core/constants.js

@@ -0,0 +1,62 @@
+/**
+ * Shared constants used across the orchestration stack.
+ */
+export const TASK_FULLY_COMPLETE = 'TASK_FULLY_COMPLETE';
+/**
+ * NO SIMULATIONS POLICY
+ *
+ * This system executes REAL operations only. Simulations, mocks, fake data,
+ * and hypothetical scenarios are strictly forbidden in production output.
+ *
+ * Forbidden patterns:
+ * - "simulated", "simulation", "hypothetical", "theoretical"
+ * - "fake", "mock", "dummy", "pretend", "imaginary"
+ * - "would be", "could be", "might be" (speculative results)
+ * - Creating fictional reports, summaries, or deliverables
+ * - Generating random/synthetic data disguised as real results
+ */
+export const NO_SIMULATIONS_POLICY = `STRICT NO-SIMULATION POLICY:
+- Execute REAL operations only - NO simulations, NO mocks, NO fake data
+- Never create fictional reports, summaries, or deliverables
+- Never generate "simulated" results or hypothetical outcomes
+- If a task cannot be executed for real, report inability clearly
+- All outputs must be genuine results from actual execution
+- Forbidden words in deliverables: "simulated", "hypothetical", "theoretical", "mock", "fake"
+`;
+/**
+ * Patterns that indicate simulation/fake content in output
+ */
+export const SIMULATION_PATTERNS = [
+    /\bsimulat(?:ed?|ion|ing)\b/i,
+    /\bhypothetical\b/i,
+    /\btheoretical(?:ly)?\b/i,
+    /\bfake\s+(?:data|report|result|output)/i,
+    /\bmock(?:ed|ing)?\s+(?:data|report|result|output)/i,
+    /\bdummy\s+(?:data|report|result|output)/i,
+    /\bpretend(?:ed|ing)?\b/i,
+    /\bimaginary\b/i,
+    /\bfictional\b/i,
+    /\bfor\s+(?:demonstration|demo)\s+purposes?\s+only/i,
+    /\bnot\s+(?:a\s+)?real\b/i,
+    /\bwould\s+(?:have\s+)?be(?:en)?\s+(?:the\s+)?result/i,
+];
+/**
+ * Check if content contains simulation indicators
+ */
+export function containsSimulationIndicators(content) {
+    return SIMULATION_PATTERNS.some(pattern => pattern.test(content));
+}
+/**
+ * Extract simulation indicator matches from content
+ */
+export function findSimulationIndicators(content) {
+    const matches = [];
+    for (const pattern of SIMULATION_PATTERNS) {
+        const match = content.match(pattern);
+        if (match) {
+            matches.push(match[0]);
+        }
+    }
+    return matches;
+}
+//# sourceMappingURL=constants.js.map

package/dist/core/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/core/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;CAOpC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,6BAA6B;IAC7B,mBAAmB;IACnB,yBAAyB;IACzB,yCAAyC;IACzC,oDAAoD;IACpD,0CAA0C;IAC1C,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,oDAAoD;IACpD,0BAA0B;IAC1B,sDAAsD;CACvD,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}