@trenchwork/erosolar 1.1.30 → 1.1.32

package/dist/core/artifactStore.js

@@ -0,0 +1,105 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const DEFAULT_ROOT = join(homedir(), '.erosolar', 'artifacts');
+const INDEX_FILE = 'index.json';
+export class ArtifactStore {
+    root;
+    indexCache = null;
+    constructor(root = DEFAULT_ROOT) {
+        this.root = root;
+        if (!existsSync(root)) {
+            mkdirSync(root, { recursive: true });
+        }
+    }
+    put(content, meta = {}) {
+        const buf = typeof content === 'string' ? Buffer.from(content) : content;
+        const id = createHash('sha256').update(buf).digest('hex');
+        const blobPath = this.blobPath(id);
+        if (!existsSync(blobPath)) {
+            mkdirSync(dirname(blobPath), { recursive: true });
+            writeFileSync(blobPath, buf);
+        }
+        const record = {
+            id,
+            size: buf.length,
+            createdAt: new Date().toISOString(),
+        };
+        if (meta.mimeType !== undefined)
+            record.mimeType = meta.mimeType;
+        if (meta.source !== undefined)
+            record.source = meta.source;
+        if (meta.tags !== undefined)
+            record.tags = meta.tags;
+        if (meta.description !== undefined)
+            record.description = meta.description;
+        this.writeMeta(record);
+        return { id, size: buf.length, summary: this.buildSummary(record, buf) };
+    }
+    get(id) {
+        const blobPath = this.blobPath(id);
+        if (!existsSync(blobPath))
+            throw new Error(`Artifact not found: ${id}`);
+        return readFileSync(blobPath);
+    }
+    getString(id) {
+        return this.get(id).toString();
+    }
+    has(id) {
+        return existsSync(this.blobPath(id));
+    }
+    meta(id) {
+        return this.loadIndex()[id] ?? null;
+    }
+    list(filter) {
+        let out = Object.values(this.loadIndex());
+        if (filter?.source)
+            out = out.filter((a) => a.source === filter.source);
+        if (filter?.tag)
+            out = out.filter((a) => a.tags?.includes(filter.tag));
+        return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    }
+    blobPath(id) {
+        return join(this.root, id.slice(0, 2), id);
+    }
+    indexPath() {
+        return join(this.root, INDEX_FILE);
+    }
+    loadIndex() {
+        if (this.indexCache)
+            return this.indexCache;
+        const p = this.indexPath();
+        if (!existsSync(p)) {
+            this.indexCache = {};
+            return this.indexCache;
+        }
+        try {
+            this.indexCache = JSON.parse(readFileSync(p, 'utf8'));
+        }
+        catch {
+            this.indexCache = {};
+        }
+        return this.indexCache;
+    }
+    writeMeta(record) {
+        const idx = this.loadIndex();
+        idx[record.id] = record;
+        writeFileSync(this.indexPath(), JSON.stringify(idx, null, 2), 'utf8');
+    }
+    buildSummary(record, buf) {
+        const head = buf.length > 200
+            ? buf.subarray(0, 200).toString().replace(/\n/g, ' ') + '…'
+            : buf.toString();
+        const tags = record.tags?.length ? ` tags=${record.tags.join(',')}` : '';
+        const source = record.source ? ` source=${record.source}` : '';
+        return `artifact id=${record.id.slice(0, 12)}… size=${record.size}B${source}${tags} preview=${head}`;
+    }
+}
+let shared = null;
+export function getSharedArtifactStore() {
+    if (!shared)
+        shared = new ArtifactStore();
+    return shared;
+}
+//# sourceMappingURL=artifactStore.js.map

package/dist/core/artifactStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactStore.js","sourceRoot":"","sources":["../../src/core/artifactStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkB1C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,MAAM,OAAO,aAAa;IACP,IAAI,CAAS;IACtB,UAAU,GAA4C,IAAI,CAAC;IAEnE,YAAY,OAAe,YAAY;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAwB,EAAE,OAAkC,EAAE;QAChE,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAqB;YAC/B,EAAE;YACF,IAAI,EAAE,GAAG,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,EAAU;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,EAAU;QACb,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,MAA0C;QAC7C,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,MAAM;YAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,GAAG;YAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,QAAQ,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,UAAW,CAAC;IAC1B,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAEO,YAAY,CAAC,MAAwB,EAAE,GAAW;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG;YAC3B,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG;YAC3D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,IAAI,YAAY,IAAI,EAAE,CAAC;IACvG,CAAC;CACF;AAED,IAAI,MAAM,GAAyB,IAAI,CAAC;AAExC,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/auth.d.ts

@@ -0,0 +1,15 @@
+export declare const FIREBASE_PROJECT_ID = "erosolar-1b0db";
+export declare function getAuthStatus(): {
+    email?: string;
+    uid?: string;
+    authenticated: boolean;
+};
+/**
+ * Get a non-expired Firebase ID token, refreshing transparently when the
+ * cached one is within 30s of expiring. Throws if the user is not signed
+ * in or the refresh token has been revoked.
+ */
+export declare function getValidIdToken(): Promise<string>;
+export declare function getAuthUid(): string | null;
+export declare function requireAuth(): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AA6GpD,wBAAgB,aAAa,IAAI;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAMxF;AA6CD;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CA2BvD;AAED,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAG1C;AAuCD,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAuIjD"}

package/dist/core/auth.js

@@ -0,0 +1,345 @@
+import * as http from 'node:http';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+const AUTH_FILE = path.join(os.homedir(), '.erosolar', 'auth.json');
+const FIREBASE_API_KEY = "AIzaSyDmD4RbVRClZaM2yF2Q9Qkt-18ST7Y29X4";
+export const FIREBASE_PROJECT_ID = 'erosolar-1b0db';
+// Trenchwork Lambda backend that mints + redeems the PKCE codes.
+const TRENCHWORK_API_BASE = 'https://cfqeqx4lt9.execute-api.us-east-1.amazonaws.com/api';
+// Login site reads ?port=NNNNN&challenge=… and POSTs a one-time exchange
+// `code` to http://localhost:NNNNN/callback. We pick the first free port
+// in this range so simultaneous logins from multiple terminals (or a
+// stale prior process) don't deadlock on a single hard-coded port.
+const AUTH_PORT_START = 59999;
+const AUTH_PORT_END = 60099;
+// Base64url encoder used by the PKCE code_verifier / code_challenge
+// pair. Spec: RFC 7636 §4.1.
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function newCodeVerifier() {
+    // 32 bytes → 43 chars base64url. Inside RFC 7636's 43–128 char range.
+    return base64url(crypto.randomBytes(32));
+}
+function deriveCodeChallenge(verifier) {
+    return base64url(crypto.createHash('sha256').update(verifier).digest());
+}
+// Redeem `code + verifier` against the Lambda. Returns a Firebase
+// custom token that the CLI then exchanges via Identity Toolkit's
+// signInWithCustomToken to obtain its own ID + refresh token.
+async function redeemExchangeCode(code, verifier) {
+    const res = await fetch(`${TRENCHWORK_API_BASE}/cliExchangeRedeem`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code, codeVerifier: verifier }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`code redeem failed (HTTP ${res.status}): ${text.slice(0, 200)}`);
+    }
+    const data = JSON.parse(text);
+    if (!data.customToken || !data.uid) {
+        throw new Error('redeem response missing customToken/uid');
+    }
+    return { customToken: data.customToken, uid: data.uid, email: data.email };
+}
+// Sign in with the custom token to get a refresh-token-bearing session.
+// Identity Toolkit's signInWithCustomToken accepts a custom JWT
+// (signed by the Firebase Admin service account on the Lambda) and
+// returns a long-lived refresh token + a fresh ID token.
+async function exchangeCustomTokenForSession(customToken) {
+    const res = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${FIREBASE_API_KEY}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: customToken, returnSecureToken: true }),
+    });
+    if (!res.ok) {
+        const t = await res.text().catch(() => '');
+        throw new Error(`customToken exchange failed (HTTP ${res.status}): ${t.slice(0, 200)}`);
+    }
+    const data = await res.json();
+    if (!data.idToken || !data.refreshToken) {
+        throw new Error('customToken exchange: missing idToken/refreshToken');
+    }
+    return {
+        idToken: data.idToken,
+        refreshToken: data.refreshToken,
+        expiresAt: Date.now() + (Number.parseInt(data.expiresIn || '3600', 10) * 1000) - 30 * 1000,
+    };
+}
+function readAuthFile() {
+    try {
+        if (!fs.existsSync(AUTH_FILE))
+            return null;
+        const data = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
+        if (data && typeof data === 'object')
+            return data;
+    }
+    catch (_) {
+        // Corrupt auth.json — treat as logged out.
+    }
+    return null;
+}
+function writeAuthFile(state) {
+    const authDir = path.dirname(AUTH_FILE);
+    // 0o700 on the parent directory and 0o600 on the file. The file holds
+    // a Firebase ID token plus a long-lived refresh token; on multi-user
+    // systems anything looser leaves them readable by other local accounts.
+    // mkdir's mode is best-effort — only applies to a brand-new directory.
+    if (!fs.existsSync(authDir))
+        fs.mkdirSync(authDir, { recursive: true, mode: 0o700 });
+    // Atomic write: stage to a tmp file and rename. Two concurrent writers
+    // (e.g. the CLI and a background poll script invoked at the same time)
+    // would otherwise race on the file and one could read a half-written
+    // JSON. rename() on the same filesystem is atomic on POSIX and Windows.
+    const tmp = `${AUTH_FILE}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, AUTH_FILE);
+}
+export function getAuthStatus() {
+    const data = readAuthFile();
+    if (data && data.authenticated && data.email) {
+        return { email: data.email, uid: data.uid, authenticated: true };
+    }
+    return { authenticated: false };
+}
+/**
+ * Decode a JWT's payload without verifying — we only use this to find the
+ * token's `exp` claim so we know when to refresh. Verification happens
+ * server-side at every Firebase call.
+ */
+function decodeJwtExp(jwt) {
+    try {
+        const [, payload] = jwt.split('.');
+        if (!payload)
+            return null;
+        const decoded = JSON.parse(Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8'));
+        return typeof decoded.exp === 'number' ? decoded.exp * 1000 : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Exchange a refresh token for a new ID token via Firebase's secureToken
+ * endpoint. Returns the new state (still missing email/uid; caller merges).
+ */
+async function refreshIdToken(refreshToken) {
+    const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
+    });
+    if (!res.ok) {
+        throw new Error(`token refresh failed: HTTP ${res.status}`);
+    }
+    const data = await res.json();
+    if (!data.id_token || !data.refresh_token) {
+        throw new Error('token refresh: missing id_token/refresh_token in response');
+    }
+    const expiresInSec = parseInt(data.expires_in || '3600', 10);
+    return {
+        idToken: data.id_token,
+        refreshToken: data.refresh_token,
+        expiresAt: Date.now() + expiresInSec * 1000 - 30 * 1000, // 30s safety margin
+    };
+}
+/**
+ * Get a non-expired Firebase ID token, refreshing transparently when the
+ * cached one is within 30s of expiring. Throws if the user is not signed
+ * in or the refresh token has been revoked.
+ */
+export async function getValidIdToken() {
+    const state = readAuthFile();
+    if (!state || !state.authenticated || !state.token) {
+        throw new Error('not signed in — run `erosolar` to log in');
+    }
+    // If we know the expiry and we're still well within it, just return the token.
+    const exp = state.tokenExpiresAt ?? decodeJwtExp(state.token);
+    if (exp && exp - Date.now() > 60 * 1000) {
+        return state.token;
+    }
+    // Need a fresh token. Refresh if we have a refresh token, otherwise the
+    // user must re-auth (their auth.json predates the refresh-token rollout).
+    if (!state.refreshToken) {
+        throw new Error('session expired — re-run `erosolar` to log in again');
+    }
+    const fresh = await refreshIdToken(state.refreshToken);
+    const updated = {
+        ...state,
+        token: fresh.idToken,
+        refreshToken: fresh.refreshToken,
+        tokenExpiresAt: fresh.expiresAt,
+    };
+    writeAuthFile(updated);
+    return fresh.idToken;
+}
+export function getAuthUid() {
+    const state = readAuthFile();
+    return state?.uid || null;
+}
+/**
+ * Bind an http server to the first free port in [start, end].
+ * Resolves with the bound port; rejects only if every port is in use.
+ */
+function bindToFreePort(server, start, end) {
+    return new Promise((resolve, reject) => {
+        let port = start;
+        const tryListen = () => {
+            // Single-shot listeners so we can swap them between attempts.
+            const onError = (err) => {
+                server.removeListener('listening', onListening);
+                if (err.code === 'EADDRINUSE' && port < end) {
+                    port += 1;
+                    setImmediate(tryListen);
+                    return;
+                }
+                reject(err);
+            };
+            const onListening = () => {
+                server.removeListener('error', onError);
+                resolve(port);
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            // Pin to IPv4 explicitly. `'localhost'` resolves to ::1 (IPv6) first on
+            // macOS, but browsers + curl frequently hit 127.0.0.1 (IPv4). Without
+            // this, the CLI happily listens on ::1 while the browser's `fetch`
+            // and `<img>` callback fail with ECONNREFUSED, leaving the CLI stuck
+            // on "Waiting for browser login…" forever.
+            server.listen(port, '127.0.0.1');
+        };
+        tryListen();
+    });
+}
+export async function requireAuth() {
+    const status = getAuthStatus();
+    if (status.authenticated) {
+        return; // Already logged in
+    }
+    const chalk = (await import('chalk')).default;
+    console.log(chalk.yellow('\nAuthentication required to use Trenchwork.'));
+    console.log(chalk.dim('Waiting for browser login...'));
+    const open = (await import('open')).default;
+    // Success page served on every /callback hit. The browser fans out THREE
+    // delivery channels (fetch, image beacon, navigation) per login.html — the
+    // first one to land triggers Firebase verification; later ones get this
+    // page back so the user's tab ends up on a real page that auto-closes
+    // instead of ERR_CONNECTION_REFUSED.
+    const SUCCESS_HTML = `
+    <!DOCTYPE html>
+    <html>
+      <head>
+        <title>Login Successful</title>
+        <style>
+          body { background: #0f0f11; color: #d4af37; font-family: sans-serif; text-align: center; padding-top: 50px; }
+          h1 { color: #d4af37; }
+        </style>
+      </head>
+      <body>
+        <h1>Login successful!</h1>
+        <p>You can safely close this window and return to your terminal.</p>
+        <script>setTimeout(() => window.close(), 2000);</script>
+      </body>
+    </html>
+  `;
+    // PKCE pair generated locally before we open the browser. The
+    // verifier never leaves this process; only its SHA-256 challenge
+    // travels through the browser URL. Replaces the legacy "?token=…&
+    // refresh=…" fan-out (refresh tokens in URLs land in browser history
+    // and per-request server logs — CISA "Bad Practices").
+    const codeVerifier = newCodeVerifier();
+    const codeChallenge = deriveCodeChallenge(codeVerifier);
+    return new Promise(async (resolve, reject) => {
+        let authComplete = false;
+        let closeTimer = null;
+        const finishCallback = (res) => {
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(SUCCESS_HTML);
+        };
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://${req.headers.host}`);
+            if (url.pathname === '/callback') {
+                // Idempotent: once we've successfully captured a code, replay the
+                // success page for every subsequent /callback hit. Without this, the
+                // navigation channel arrives ~600ms after the fetch+image channels,
+                // by which point the server would have closed and the user's tab
+                // would render ERR_CONNECTION_REFUSED.
+                if (authComplete) {
+                    finishCallback(res);
+                    return;
+                }
+                const code = url.searchParams.get('code');
+                if (code) {
+                    try {
+                        const { customToken, uid, email } = await redeemExchangeCode(code, codeVerifier);
+                        // Re-check after the await: a concurrent callback may have
+                        // already finished redemption while we were awaiting.
+                        if (authComplete) {
+                            finishCallback(res);
+                            return;
+                        }
+                        const session = await exchangeCustomTokenForSession(customToken);
+                        if (authComplete) {
+                            finishCallback(res);
+                            return;
+                        }
+                        authComplete = true;
+                        writeAuthFile({
+                            authenticated: true,
+                            email,
+                            uid,
+                            token: session.idToken,
+                            tokenExpiresAt: session.expiresAt,
+                            refreshToken: session.refreshToken,
+                        });
+                        finishCallback(res);
+                        console.log(chalk.green(`\n✓ Successfully logged in as ${email || uid}`));
+                        resolve();
+                        // Keep the server alive briefly so the browser's late
+                        // navigation channel lands on the success page (which
+                        // auto-closes the tab) instead of seeing
+                        // ERR_CONNECTION_REFUSED. Unref so the timer doesn't keep an
+                        // otherwise-idle CLI process alive.
+                        closeTimer = setTimeout(() => server.close(), 8000);
+                        if (typeof closeTimer.unref === 'function')
+                            closeTimer.unref();
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'text/plain' });
+                        res.end('Authentication failed.');
+                        if (!authComplete) {
+                            server.close();
+                            reject(new Error(`Authentication failed: ${e.message}`));
+                        }
+                    }
+                }
+                else {
+                    res.writeHead(400, { 'Content-Type': 'text/plain' });
+                    res.end('No code provided.');
+                }
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        });
+        let boundPort;
+        try {
+            boundPort = await bindToFreePort(server, AUTH_PORT_START, AUTH_PORT_END);
+        }
+        catch (e) {
+            console.error(chalk.red(`Error: Could not bind any port in ${AUTH_PORT_START}-${AUTH_PORT_END}. ` +
+                `Free a port in that range and try again.`));
+            reject(e);
+            return;
+        }
+        const loginUrl = `https://trenchwork.org/login?port=${boundPort}&challenge=${encodeURIComponent(codeChallenge)}`;
+        open(loginUrl).catch(() => {
+            console.log(`Please manually open this URL in your browser:\n${chalk.cyan(loginUrl)}`);
+        });
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACpE,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,4DAA4D,CAAC;AAEzF,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,oEAAoE;AACpE,6BAA6B;AAC7B,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AACD,SAAS,eAAe;IACtB,sEAAsE;IACtE,OAAO,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,kEAAkE;AAClE,kEAAkE;AAClE,8DAA8D;AAC9D,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,mBAAmB,oBAAoB,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2D,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED,wEAAwE;AACxE,gEAAgE;AAChE,mEAAmE;AACnE,yDAAyD;AACzD,KAAK,UAAU,6BAA6B,CAAC,WAAmB;IAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gFAAgF,gBAAgB,EAAE,EAAE;QAC1H,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqE,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;KAC3F,CAAC;AACJ,CAAC;AAcD,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAiB,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,YAAoB;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mDAAmD,gBAAgB,EAAE,EAAE;QAC7F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,0CAA0C,kBAAkB,CAAC,YAAY,CAAC,EAAE;KACnF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwE,CAAC;IACpG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,oBAAoB;KAC9E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,OAAO,GAAc;QACzB,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,SAAS;KAChC,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAmB,EAAE,KAAa,EAAE,GAAW;IACrE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,MAAM,SAAS,GAAG,GAAG,EAAE;YACrB,8DAA8D;YAC9D,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;gBAC7C,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBAC5C,IAAI,IAAI,CAAC,CAAC;oBACV,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC,CAAC;QAEF,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,oBAAoB;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAE5C,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;GAgBpB,CAAC;IAEF,8DAA8D;IAC9D,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAExD,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,UAAU,GAA0B,IAAI,CAAC;QAE7C,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAE,EAAE;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,uCAAuC;gBACvC,IAAI,YAAY,EAAE,CAAC;oBACjB,cAAc,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;wBACjF,2DAA2D;wBAC3D,sDAAsD;wBACtD,IAAI,YAAY,EAAE,CAAC;4BAAC,cAAc,CAAC,GAAG,CAAC,CAAC;4BAAC,OAAO;wBAAC,CAAC;wBAElD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,WAAW,CAAC,CAAC;wBACjE,IAAI,YAAY,EAAE,CAAC;4BAAC,cAAc,CAAC,GAAG,CAAC,CAAC;4BAAC,OAAO;wBAAC,CAAC;wBAClD,YAAY,GAAG,IAAI,CAAC;wBAEpB,aAAa,CAAC;4BACZ,aAAa,EAAE,IAAI;4BACnB,KAAK;4BACL,GAAG;4BACH,KAAK,EAAE,OAAO,CAAC,OAAO;4BACtB,cAAc,EAAE,OAAO,CAAC,SAAS;4BACjC,YAAY,EAAE,OAAO,CAAC,YAAY;yBACnC,CAAC,CAAC;wBAEH,cAAc,CAAC,GAAG,CAAC,CAAC;wBAEpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;wBAC1E,OAAO,EAAE,CAAC;wBAEV,sDAAsD;wBACtD,sDAAsD;wBACtD,yCAAyC;wBACzC,6DAA6D;wBAC7D,oCAAoC;wBACpC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;wBACpD,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;4BAAE,UAAU,CAAC,KAAK,EAAE,CAAC;oBACjE,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;wBACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBAClC,IAAI,CAAC,YAAY,EAAE,CAAC;4BAClB,MAAM,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA2B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;wBACtE,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,qCAAqC,eAAe,IAAI,aAAa,IAAI;gBACzE,0CAA0C,CAC3C,CACF,CAAC;YACF,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,qCAAqC,SAAS,cAAc,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;QACjH,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxB,OAAO,CAAC,GAAG,CAAC,mDAAmD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/bashCommandGuidance.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Centralized guidance for bash command flows.
+ * Keeps publish/git heuristics in one place so bash tooling stays concise.
+ */
+export type BashFlowSeverity = 'info' | 'warning' | 'critical';
+export interface BashFlowWarning {
+    readonly code: string;
+    readonly message: string;
+    readonly suggestion?: string;
+    readonly severity?: BashFlowSeverity;
+}
+/**
+ * Analyze a bash command for common workflow gaps (publish, git efficiency).
+ */
+export declare function analyzeBashFlow(command: string): BashFlowWarning[];
+//# sourceMappingURL=bashCommandGuidance.d.ts.map

package/dist/core/bashCommandGuidance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bashCommandGuidance.d.ts","sourceRoot":"","sources":["../../src/core/bashCommandGuidance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAoClE"}

package/dist/core/bashCommandGuidance.js

@@ -0,0 +1,40 @@
+/**
+ * Centralized guidance for bash command flows.
+ * Keeps publish/git heuristics in one place so bash tooling stays concise.
+ */
+/**
+ * Analyze a bash command for common workflow gaps (publish, git efficiency).
+ */
+export function analyzeBashFlow(command) {
+    const warnings = [];
+    const normalized = command.toLowerCase();
+    if (!normalized.trim()) {
+        return warnings;
+    }
+    // Git efficiency: avoid repeated status calls in a single command chain.
+    const gitStatusMatches = normalized.match(/git status/g);
+    if (gitStatusMatches && gitStatusMatches.length > 1) {
+        warnings.push({
+            code: 'GIT_REDUNDANT_STATUS',
+            message: 'Multiple git status calls detected in one command',
+            suggestion: 'Combine git operations: git add -A && git commit -m "msg" && git push',
+            severity: 'info',
+        });
+    }
+    // Publish flow completeness for npm-style commands.
+    if (normalized.includes('npm publish')) {
+        const hasVersionStep = /\b(?:npm|pnpm|yarn)\s+version\b/.test(normalized);
+        const hasBuildOrTests = /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?(build|test|lint|prepare)\b/.test(normalized);
+        const hasGitPush = /\bgit\s+push\b/.test(normalized);
+        if (!(hasVersionStep && hasBuildOrTests && hasGitPush)) {
+            warnings.push({
+                code: 'NPM_INCOMPLETE_WORKFLOW',
+                message: 'npm publish detected without a complete release flow',
+                suggestion: 'Include version bump, build/tests, and git push or use npm_publish to automate the full release',
+                severity: 'warning',
+            });
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=bashCommandGuidance.js.map

package/dist/core/bashCommandGuidance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bashCommandGuidance.js","sourceRoot":"","sources":["../../src/core/bashCommandGuidance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,mDAAmD;YAC5D,UAAU,EAAE,uEAAuE;YACnF,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1E,MAAM,eAAe,GAAG,8DAA8D,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,CAAC,CAAC,cAAc,IAAI,eAAe,IAAI,UAAU,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,sDAAsD;gBAC/D,UAAU,EAAE,iGAAiG;gBAC7G,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/constants.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared constants used across the orchestration stack.
+ */
+export declare const TASK_FULLY_COMPLETE = "TASK_FULLY_COMPLETE";
+/**
+ * NO SIMULATIONS POLICY
+ *
+ * This system executes REAL operations only. Simulations, mocks, fake data,
+ * and hypothetical scenarios are strictly forbidden in production output.
+ *
+ * Forbidden patterns:
+ * - "simulated", "simulation", "hypothetical", "theoretical"
+ * - "fake", "mock", "dummy", "pretend", "imaginary"
+ * - "would be", "could be", "might be" (speculative results)
+ * - Creating fictional reports, summaries, or deliverables
+ * - Generating random/synthetic data disguised as real results
+ */
+export declare const NO_SIMULATIONS_POLICY = "STRICT NO-SIMULATION POLICY:\n- Execute REAL operations only - NO simulations, NO mocks, NO fake data\n- Never create fictional reports, summaries, or deliverables\n- Never generate \"simulated\" results or hypothetical outcomes\n- If a task cannot be executed for real, report inability clearly\n- All outputs must be genuine results from actual execution\n- Forbidden words in deliverables: \"simulated\", \"hypothetical\", \"theoretical\", \"mock\", \"fake\"\n";
+/**
+ * Patterns that indicate simulation/fake content in output
+ */
+export declare const SIMULATION_PATTERNS: RegExp[];
+/**
+ * Check if content contains simulation indicators
+ */
+export declare function containsSimulationIndicators(content: string): boolean;
+/**
+ * Extract simulation indicator matches from content
+ */
+export declare function findSimulationIndicators(content: string): string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/core/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,odAOjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,UAa/B,CAAC;AAEF;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CASlE"}