aimeat 2.0.0 → 2.2.0

package/dist/scripts/check-openapi.js

@@ -0,0 +1,139 @@
+/**
+ * @file check-openapi.ts
+ * @description Pre-commit / CI guard for `openapi.yaml`. Rule 3 makes the spec the canonical API
+ *   contract, but nothing verified it was still machine-readable — and it had quietly stopped being
+ *   so in two different ways, both found live on main:
+ *
+ *     1. A DANGLING $ref (`#/components/schemas/SuccessEnvelope`; the schema is `AimeatEnvelope`)
+ *        broke `pnpm generate:types` outright. Rule 3's OWN tool could not run.
+ *     2. A PORTABILITY trap: `description: Whole document portion public? }` inside a flow mapping.
+ *        The repo's `yaml` package and openapi-typescript both accept it, so nothing here complained
+ *        — but PyYAML rejects it, and PyYAML is what most Python OpenAPI tooling is built on
+ *        (openapi-spec-validator, prance, datamodel-code-generator). A consumer would have seen a
+ *        syntax error instead of our API, and we would never have known.
+ *
+ *   So this checks three things, cheapest first, and each one exists because it already failed.
+ * @structure
+ *   - parse with the `yaml` package (genuine syntax errors)
+ *   - resolve every internal `$ref` (the break that stopped codegen)
+ *   - flag unquoted flow-mapping scalars containing `?` (accepted here, rejected by YAML 1.1 parsers)
+ * @usage  pnpm check:openapi   (exits non-zero on a parse error, a dangling $ref, or a portability trap)
+ * @version-history
+ *   v1.0.0 — 2026-07-26 — Initial guard, after both failure modes were found live on main.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { parse as parseYaml, parseDocument, visit, isCollection } from 'yaml';
+const here = dirname(fileURLToPath(import.meta.url));
+const SPEC = join(here, '..', '..', 'openapi.yaml');
+const raw = readFileSync(SPEC, 'utf8');
+// ── 1. Does it parse at all? ────────────────────────────────────────────────
+let doc;
+try {
+    doc = parseYaml(raw, { strict: true });
+}
+catch (err) {
+    console.error('✗ openapi.yaml does not parse');
+    console.error(`  ${err.message}`);
+    process.exit(1);
+}
+// ── 2. Does every internal $ref resolve? ────────────────────────────────────
+/** Resolve a `#/a/b/c` JSON pointer against the document. undefined when it dangles. */
+function resolvePointer(root, ref) {
+    const parts = ref.slice(2).split('/').map(p => p.replace(/~1/g, '/').replace(/~0/g, '~'));
+    let node = root;
+    for (const part of parts) {
+        if (node === null || typeof node !== 'object')
+            return undefined;
+        node = node[part];
+        if (node === undefined)
+            return undefined;
+    }
+    return node;
+}
+const dangling = [];
+let refCount = 0;
+function walk(node, path) {
+    if (Array.isArray(node)) {
+        node.forEach((v, i) => walk(v, `${path}/${i}`));
+        return;
+    }
+    if (node === null || typeof node !== 'object')
+        return;
+    for (const [key, value] of Object.entries(node)) {
+        if (key === '$ref' && typeof value === 'string') {
+            // Only internal pointers are ours to guarantee; an external file/URL ref is the
+            // codegen tool's business.
+            if (value.startsWith('#/')) {
+                refCount++;
+                if (resolvePointer(doc, value) === undefined)
+                    dangling.push({ path, ref: value });
+            }
+            continue;
+        }
+        walk(value, `${path}/${key.replace(/~/g, '~0').replace(/\//g, '~1')}`);
+    }
+}
+walk(doc, '#');
+// ── 3. Portability: plain scalars inside { } that YAML 1.1 parsers reject ───
+// `?` is an indicator character. Inside a flow collection a PLAIN (unquoted) scalar containing one
+// is accepted by the `yaml` package but rejected by PyYAML, so the spec parses here and fails for a
+// Python consumer. Quoting the value fixes it and costs nothing.
+//
+// This walks the AST rather than the text: a line-based scan cannot tell a real flow mapping from a
+// `{ … }` that is merely prose inside a block description, and this file is full of the latter (12
+// false positives on the first attempt). Node type PLAIN + an ancestor collection with flow=true is
+// the exact condition, and nothing else.
+const portability = [];
+const lineStarts = [0];
+for (let i = 0; i < raw.length; i++)
+    if (raw[i] === '\n')
+        lineStarts.push(i + 1);
+const lineOf = (offset) => {
+    let lo = 0, hi = lineStarts.length - 1;
+    while (lo < hi) {
+        const mid = (lo + hi + 1) >> 1;
+        if (lineStarts[mid] <= offset)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    return lo + 1;
+};
+const cst = parseDocument(raw);
+visit(cst, {
+    Scalar(_key, node, path) {
+        if (node.type !== 'PLAIN')
+            return;
+        const value = typeof node.value === 'string' ? node.value : '';
+        if (!value.includes('?'))
+            return;
+        const inFlow = path.some(p => isCollection(p) && p.flow === true);
+        if (!inFlow)
+            return;
+        const line = node.range ? lineOf(node.range[0]) : 0;
+        portability.push({ line, text: raw.split(/\r?\n/)[line - 1]?.trim() ?? value });
+    },
+});
+// ── Report ──────────────────────────────────────────────────────────────────
+let failed = false;
+if (dangling.length) {
+    failed = true;
+    console.error(`✗ ${dangling.length} dangling $ref(s) — \`pnpm generate:types\` cannot run:`);
+    for (const d of dangling)
+        console.error(`  ${d.ref}\n    at ${d.path}`);
+}
+if (portability.length) {
+    failed = true;
+    console.error(`✗ ${portability.length} unquoted flow scalar(s) containing "?" — this file parses here but`);
+    console.error('  fails in PyYAML-based OpenAPI tooling. Quote the value:');
+    for (const p of portability)
+        console.error(`  openapi.yaml:${p.line}  ${p.text.slice(0, 110)}`);
+}
+if (failed)
+    process.exit(1);
+const spec = doc;
+console.log(`✓ openapi.yaml parses, all ${refCount} internal $refs resolve, no flow-scalar portability traps `
+    + `— ${Object.keys(spec.paths ?? {}).length} paths, ${Object.keys(spec.components?.schemas ?? {}).length} schemas.`);
+//# sourceMappingURL=check-openapi.js.map

package/dist/scripts/check-openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-openapi.js","sourceRoot":"","sources":["../../scripts/check-openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAE9E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAEvC,+EAA+E;AAC/E,IAAI,GAAY,CAAC;AACjB,IAAI,CAAC;IACD,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACX,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,wFAAwF;AACxF,SAAS,cAAc,CAAC,IAAa,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,QAAQ,GAAoC,EAAE,CAAC;AACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB,SAAS,IAAI,CAAC,IAAa,EAAE,IAAY;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO;IACX,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACzE,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,gFAAgF;YAChF,2BAA2B;YAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,EAAE,CAAC;gBACX,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS;QACb,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;AACL,CAAC;AACD,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEf,+EAA+E;AAC/E,mGAAmG;AACnG,oGAAoG;AACpG,iEAAiE;AACjE,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,yCAAyC;AACzC,MAAM,WAAW,GAAqC,EAAE,CAAC;AACzD,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;AACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;IAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACjF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE;IACtC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM;YAAE,EAAE,GAAG,GAAG,CAAC;;YAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;AAC/B,KAAK,CAAC,GAAG,EAAE;IACP,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI;QACnB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO;QAClC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAK,CAAwB,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;CACJ,CAAC,CAAC;AAEH,+EAA+E;AAC/E,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;IAClB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,yDAAyD,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACrB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,MAAM,qEAAqE,CAAC,CAAC;IAC5G,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,IAAI,MAAM;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE5B,MAAM,IAAI,GAAG,GAA8F,CAAC;AAC5G,OAAO,CAAC,GAAG,CACP,8BAA8B,QAAQ,4DAA4D;MAChG,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,WAAW,CACtH,CAAC"}

package/dist/scripts/embed-viewport.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @file embed-viewport.ts
+ * @description Keeps the copy of aimeat-viewport.js that is embedded inside other cortex packs
+ *   byte-identical to the source. Cortex packs are served live and each declares a single script
+ *   tag with no `requires`, so a pack that needs the shared camera cannot simply depend on it —
+ *   splitting a pack into two files would break every app carrying the old single tag. The camera
+ *   is therefore copied INTO the consuming pack between generated markers, and this script is the
+ *   only thing allowed to write that region. `--check` (pre-commit + CI) fails on drift, so the
+ *   duplicate can never quietly diverge from the source.
+ * @structure
+ *   - SOURCE / TARGETS  → the camera file and every pack that embeds it
+ *   - detectEol/toEol   → preserve each target's existing line endings (Windows checkouts)
+ *   - main()            → write mode (default) or --check mode (exit 1 on drift)
+ * @usage
+ *   pnpm sync:viewport     # rewrite the embedded region in every target
+ *   pnpm check:viewport    # verify, non-zero exit on drift
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial (TARGET-051 Slice 1): aimeat-dag embeds aimeat-viewport.
+ *   v1.1.0 — 2026-07-25 — Also assert every pack's VERSION constant matches its manifest;
+ *     they crossed once already (constant 1.0.1 while the manifest said 1.0.2).
+ */
+export {};
+//# sourceMappingURL=embed-viewport.d.ts.map

package/dist/scripts/embed-viewport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed-viewport.d.ts","sourceRoot":"","sources":["../../scripts/embed-viewport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/scripts/embed-viewport.js

@@ -0,0 +1,116 @@
+/**
+ * @file embed-viewport.ts
+ * @description Keeps the copy of aimeat-viewport.js that is embedded inside other cortex packs
+ *   byte-identical to the source. Cortex packs are served live and each declares a single script
+ *   tag with no `requires`, so a pack that needs the shared camera cannot simply depend on it —
+ *   splitting a pack into two files would break every app carrying the old single tag. The camera
+ *   is therefore copied INTO the consuming pack between generated markers, and this script is the
+ *   only thing allowed to write that region. `--check` (pre-commit + CI) fails on drift, so the
+ *   duplicate can never quietly diverge from the source.
+ * @structure
+ *   - SOURCE / TARGETS  → the camera file and every pack that embeds it
+ *   - detectEol/toEol   → preserve each target's existing line endings (Windows checkouts)
+ *   - main()            → write mode (default) or --check mode (exit 1 on drift)
+ * @usage
+ *   pnpm sync:viewport     # rewrite the embedded region in every target
+ *   pnpm check:viewport    # verify, non-zero exit on drift
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial (TARGET-051 Slice 1): aimeat-dag embeds aimeat-viewport.
+ *   v1.1.0 — 2026-07-25 — Also assert every pack's VERSION constant matches its manifest;
+ *     they crossed once already (constant 1.0.1 while the manifest said 1.0.2).
+ */
+import { readFileSync, writeFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, dirname, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO = join(__dirname, '..');
+const BUNDLED = join(REPO, 'public', 'cortex-bundled');
+const SOURCE = join(BUNDLED, 'aimeat-viewport.js');
+const TARGETS = [join(BUNDLED, 'aimeat-dag.js')];
+const BEGIN = '/* BEGIN embedded aimeat-viewport — GENERATED, DO NOT EDIT (pnpm sync:viewport) */';
+const END = '/* END embedded aimeat-viewport */';
+/** Windows checkouts may hold CRLF; keep whatever the target already uses. */
+function detectEol(text) {
+    return text.includes('\r\n') ? '\r\n' : '\n';
+}
+function toEol(text, eol) {
+    const lf = text.replace(/\r\n/g, '\n');
+    return eol === '\n' ? lf : lf.replace(/\n/g, '\r\n');
+}
+function main() {
+    const check = process.argv.includes('--check');
+    const source = readFileSync(SOURCE, 'utf-8');
+    let drifted = 0;
+    for (const target of TARGETS) {
+        const rel = relative(REPO, target).replace(/\\/g, '/');
+        const current = readFileSync(target, 'utf-8');
+        const eol = detectEol(current);
+        const begin = current.indexOf(BEGIN);
+        const end = current.indexOf(END);
+        if (begin === -1 || end === -1 || end < begin) {
+            console.error(`✗ ${rel}: embed markers missing or out of order.`);
+            console.error(`  Expected a region delimited by:\n    ${BEGIN}\n    ${END}`);
+            process.exit(1);
+        }
+        const head = current.slice(0, begin + BEGIN.length);
+        const tail = current.slice(end);
+        const body = toEol(source, eol);
+        const next = head + eol + body + (body.endsWith(eol) ? '' : eol) + tail;
+        if (next === current) {
+            if (!check)
+                console.log(`✓ ${rel}: already in sync`);
+            continue;
+        }
+        drifted++;
+        if (check) {
+            console.error(`✗ ${rel}: embedded aimeat-viewport has drifted from public/cortex-bundled/aimeat-viewport.js`);
+        }
+        else {
+            writeFileSync(target, next, 'utf-8');
+            console.log(`✓ ${rel}: embedded region updated`);
+        }
+    }
+    drifted += checkVersions(check);
+    if (check) {
+        if (drifted > 0) {
+            console.error(`\n${drifted} problem(s). Run: pnpm sync:viewport (embed) and align the versions by hand.`);
+            process.exit(1);
+        }
+        console.log('✓ embedded aimeat-viewport is in sync; pack VERSION constants match their manifests');
+    }
+}
+/**
+ * A cortex pack that exposes a VERSION constant must report the version its manifest declares.
+ * These drift trivially — the manifest gets bumped to make the seeder republish, the constant is
+ * forgotten, and from then on the lib lies to anyone reading it from the console. Checking it is
+ * three lines; noticing it in production is not.
+ */
+function checkVersions(check) {
+    let bad = 0;
+    for (const file of readdirSync(BUNDLED)) {
+        if (!file.endsWith('.js'))
+            continue;
+        const js = readFileSync(join(BUNDLED, file), 'utf-8');
+        const yamlPath = join(BUNDLED, file.replace(/\.js$/, '.yaml'));
+        if (!existsSync(yamlPath))
+            continue;
+        // Only the pack's OWN constant, not one embedded from another pack.
+        const own = js.split(BEGIN)[0] + (js.includes(END) ? js.split(END).slice(1).join(END) : '');
+        const m = own.match(/VERSION:\s*'([\d.]+)'/);
+        if (!m)
+            continue;
+        const y = readFileSync(yamlPath, 'utf-8').match(/^\s*version:\s*"([\d.]+)"/m);
+        if (!y)
+            continue;
+        if (m[1] !== y[1]) {
+            bad++;
+            console.error(`✗ ${file}: VERSION constant is ${m[1]} but ${file.replace(/\.js$/, '.yaml')} declares ${y[1]}`);
+        }
+        else if (!check) {
+            console.log(`✓ ${file}: VERSION ${m[1]} matches its manifest`);
+        }
+    }
+    return bad;
+}
+main();
+//# sourceMappingURL=embed-viewport.js.map

package/dist/scripts/embed-viewport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed-viewport.js","sourceRoot":"","sources":["../../scripts/embed-viewport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAEjD,MAAM,KAAK,GAAG,oFAAoF,CAAC;AACnG,MAAM,GAAG,GAAG,oCAAoC,CAAC;AAEjD,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,GAAkB;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI;IACX,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,0CAA0C,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,0CAA0C,KAAK,SAAS,GAAG,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAExE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,mBAAmB,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,OAAO,EAAE,CAAC;QACV,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,sFAAsF,CAAC,CAAC;QAChH,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,2BAA2B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,8EAA8E,CAAC,CAAC;YAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,oEAAoE;QACpE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,GAAG,EAAE,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/src/auth/sse-domain-scopes.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @file sse-domain-scopes.ts
+ * @description Authorization for the SSE live-update stream: which change DOMAINS a given
+ *   principal may be told about. The stream carries no payload (only domain names), but a
+ *   domain name plus its timing is still metadata: an app granted `memory:read` must not
+ *   learn that the owner's messages, wallet or agent tasks just changed. H-2 app-origin
+ *   isolation fences an app's DATA access; this fences its CHANGE-NOTIFICATION access the
+ *   same way, using the very same scope vocabulary the owner approved at sign-in.
+ *
+ *   Owner sessions (a human on the apex portal) see everything — the whole keyspace is
+ *   theirs. Every other principal (app grant, agent, ecosystem app, anonymous) is RESTRICTED:
+ *   a domain is forwarded only when the principal holds the scope that domain maps to, and a
+ *   domain absent from the map is DENIED. Deny-by-default is deliberate: a new domain added
+ *   elsewhere in the node must not silently start leaking to sandboxed apps. Adding the
+ *   mapping is a one-line, reviewable decision.
+ * @structure DOMAIN_SCOPE (domain → required scope) · isOwnerPrincipal · allowedDomains ·
+ *   filterDomains
+ * @usage
+ *   const restricted = !isOwnerPrincipal(req.auth!);
+ *   const allow = allowedDomains(req.auth!.scopes);        // Set<string> | null (null = all)
+ *   const visible = filterDomains(['memory', 'wallet'], allow);
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial: scope-gated SSE domains (an app-grant stream no longer
+ *     sees every domain in the owner's keyspace).
+ */
+/**
+ * Change domain → the scope a RESTRICTED principal must hold to be told about it.
+ * Keys are the domain strings passed to `emitChange(domain, …)`. Anything not listed here
+ * is invisible to restricted principals (operator/infra domains: config, features, admin-*,
+ * federation, disputes, appeals, verification, totp, ghii, owners, consent, flags, feedback,
+ * instances, extensions, cortex, skills, portfolio, ecosystem-apps, presence, realtime).
+ */
+export declare const DOMAIN_SCOPE: Readonly<Record<string, string>>;
+/**
+ * True for a human owner session on the apex portal — the principal whose keyspace this is.
+ * An app grant carries roles ['app'] (never 'owner'), so it is restricted even though it acts
+ * on the owner's behalf; agents and ecosystem apps are restricted for the same reason.
+ */
+export declare function isOwnerPrincipal(auth: {
+    roles?: string[];
+}): boolean;
+/**
+ * The domains a restricted principal holding `scopes` may be told about, or `null` when no
+ * filtering applies (owner sessions). A wildcard scope ('*') also disables filtering — the
+ * node's own dev/default-scope escape hatch, unchanged in meaning here.
+ */
+export declare function allowedDomains(scopes: string[] | undefined): Set<string> | null;
+/** Keep only the domains this principal may see. `allow === null` passes everything through. */
+export declare function filterDomains(domains: string[], allow: Set<string> | null): string[];
+//# sourceMappingURL=sse-domain-scopes.d.ts.map

package/dist/src/auth/sse-domain-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-domain-scopes.d.ts","sourceRoot":"","sources":["../../../src/auth/sse-domain-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqDxD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAQ/E;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAGpF"}

package/dist/src/auth/sse-domain-scopes.js

@@ -0,0 +1,111 @@
+/**
+ * @file sse-domain-scopes.ts
+ * @description Authorization for the SSE live-update stream: which change DOMAINS a given
+ *   principal may be told about. The stream carries no payload (only domain names), but a
+ *   domain name plus its timing is still metadata: an app granted `memory:read` must not
+ *   learn that the owner's messages, wallet or agent tasks just changed. H-2 app-origin
+ *   isolation fences an app's DATA access; this fences its CHANGE-NOTIFICATION access the
+ *   same way, using the very same scope vocabulary the owner approved at sign-in.
+ *
+ *   Owner sessions (a human on the apex portal) see everything — the whole keyspace is
+ *   theirs. Every other principal (app grant, agent, ecosystem app, anonymous) is RESTRICTED:
+ *   a domain is forwarded only when the principal holds the scope that domain maps to, and a
+ *   domain absent from the map is DENIED. Deny-by-default is deliberate: a new domain added
+ *   elsewhere in the node must not silently start leaking to sandboxed apps. Adding the
+ *   mapping is a one-line, reviewable decision.
+ * @structure DOMAIN_SCOPE (domain → required scope) · isOwnerPrincipal · allowedDomains ·
+ *   filterDomains
+ * @usage
+ *   const restricted = !isOwnerPrincipal(req.auth!);
+ *   const allow = allowedDomains(req.auth!.scopes);        // Set<string> | null (null = all)
+ *   const visible = filterDomains(['memory', 'wallet'], allow);
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial: scope-gated SSE domains (an app-grant stream no longer
+ *     sees every domain in the owner's keyspace).
+ */
+/**
+ * Change domain → the scope a RESTRICTED principal must hold to be told about it.
+ * Keys are the domain strings passed to `emitChange(domain, …)`. Anything not listed here
+ * is invisible to restricted principals (operator/infra domains: config, features, admin-*,
+ * federation, disputes, appeals, verification, totp, ghii, owners, consent, flags, feedback,
+ * instances, extensions, cortex, skills, portfolio, ecosystem-apps, presence, realtime).
+ */
+export const DOMAIN_SCOPE = Object.freeze({
+    // Owner data the app already reads
+    memory: 'memory:read',
+    personal: 'memory:read',
+    files: 'storage:read',
+    // Structured spaces
+    organisms: 'organism:read',
+    schemas: 'organism:read',
+    templates: 'organism:read',
+    csm: 'organism:read',
+    msm: 'organism:read',
+    // Public discovery surfaces
+    catalogue: 'catalogue:read',
+    apps: 'catalogue:read',
+    'app-store': 'catalogue:read',
+    site: 'catalogue:read',
+    // Social
+    boards: 'social:read',
+    groups: 'social:read',
+    matches: 'social:read',
+    // Conversations
+    messages: 'messages:read',
+    'agent-messages': 'messages:read',
+    chat: 'messages:read',
+    // Economy
+    wallet: 'wallet:read',
+    // Knowledge
+    knowledge: 'knowledge:read',
+    packages: 'knowledge:read',
+    // The owner's fleet
+    'agent-tasks': 'task:read',
+    agents: 'task:read',
+    work: 'task:read',
+    actions: 'task:read',
+    'agent-usage': 'task:read',
+    'agent-capabilities': 'task:read',
+    'agent-directives': 'task:read',
+    'agent-onboarding': 'task:read',
+    // Automation
+    workflows: 'workflow:read',
+    scheduler: 'workflow:read',
+    // Nudges
+    notifications: 'notifications:send',
+    push: 'notifications:send',
+});
+/**
+ * True for a human owner session on the apex portal — the principal whose keyspace this is.
+ * An app grant carries roles ['app'] (never 'owner'), so it is restricted even though it acts
+ * on the owner's behalf; agents and ecosystem apps are restricted for the same reason.
+ */
+export function isOwnerPrincipal(auth) {
+    const roles = auth.roles ?? [];
+    if (roles.includes('app') || roles.includes('agent') || roles.includes('ecosystem'))
+        return false;
+    return roles.includes('owner');
+}
+/**
+ * The domains a restricted principal holding `scopes` may be told about, or `null` when no
+ * filtering applies (owner sessions). A wildcard scope ('*') also disables filtering — the
+ * node's own dev/default-scope escape hatch, unchanged in meaning here.
+ */
+export function allowedDomains(scopes) {
+    const held = new Set(scopes ?? []);
+    if (held.has('*'))
+        return null;
+    const out = new Set();
+    for (const [domain, needed] of Object.entries(DOMAIN_SCOPE)) {
+        if (held.has(needed))
+            out.add(domain);
+    }
+    return out;
+}
+/** Keep only the domains this principal may see. `allow === null` passes everything through. */
+export function filterDomains(domains, allow) {
+    if (!allow)
+        return domains;
+    return domains.filter(d => allow.has(d));
+}
+//# sourceMappingURL=sse-domain-scopes.js.map

package/dist/src/auth/sse-domain-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-domain-scopes.js","sourceRoot":"","sources":["../../../src/auth/sse-domain-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC1E,mCAAmC;IACnC,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,aAAa;IACvB,KAAK,EAAE,cAAc;IAErB,oBAAoB;IACpB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,eAAe;IACxB,SAAS,EAAE,eAAe;IAC1B,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,eAAe;IAEpB,4BAA4B;IAC5B,SAAS,EAAE,gBAAgB;IAC3B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,gBAAgB;IAC7B,IAAI,EAAE,gBAAgB;IAEtB,SAAS;IACT,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,aAAa;IAEtB,gBAAgB;IAChB,QAAQ,EAAE,eAAe;IACzB,gBAAgB,EAAE,eAAe;IACjC,IAAI,EAAE,eAAe;IAErB,UAAU;IACV,MAAM,EAAE,aAAa;IAErB,YAAY;IACZ,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,gBAAgB;IAE1B,oBAAoB;IACpB,aAAa,EAAE,WAAW;IAC1B,MAAM,EAAE,WAAW;IACnB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,WAAW;IACpB,aAAa,EAAE,WAAW;IAC1B,oBAAoB,EAAE,WAAW;IACjC,kBAAkB,EAAE,WAAW;IAC/B,kBAAkB,EAAE,WAAW;IAE/B,aAAa;IACb,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAE1B,SAAS;IACT,aAAa,EAAE,oBAAoB;IACnC,IAAI,EAAE,oBAAoB;CAC3B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,OAAiB,EAAE,KAAyB;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/cli/connect/auth.d.ts

@@ -4,6 +4,21 @@ interface AuthArgs {
     agent?: string;
     mode?: string;
 }
+interface DeviceTokenResponse {
+    access_token: string;
+    gaii: string;
+    name: string;
+    owner?: string;
+}
+/**
+ * The canonical, '@'-free owner HANDLE for this agent — taken from the device-token response, NEVER the
+ * raw `--owner` the user typed (which may be an email, e.g. when connecting by email). The account is
+ * resolved server-side (the browser login), and the handle comes back in the response, so keying local
+ * artifacts (token filename, per-agent config) by it keeps `{agent}@{owner}.token` unambiguous and lets
+ * the serve daemon parse it correctly. Prefer the gaii's owner segment (`agent#owner@node`), fall back to
+ * the response `owner`, then to the CLI value with any '@'-suffix stripped.
+ */
+export declare function ownerHandleFrom(tokenData: DeviceTokenResponse, cliOwner: string): string;
 export declare function runAuth(args: AuthArgs): Promise<void>;
 export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/cli/connect/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/cli/connect/auth.ts"],"names":[],"mappings":"AAmCA,UAAU,QAAQ;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAyGD,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAsN3D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/cli/connect/auth.ts"],"names":[],"mappings":"AAmCA,UAAU,QAAQ;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAOD,UAAU,mBAAmB;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKxF;AA8FD,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA0N3D"}

package/dist/src/cli/connect/auth.js

@@ -28,6 +28,22 @@ import { saveConfig, savePerAgentConfig, loadPerAgentConfig } from './config.js'
 import { downloadSkillBundle, readSkillBundleGuide } from './skill-bundle.js';
 import { buildAgentOnboardingInstruction } from './onboarding-prompt.js';
 const VALID_MODES = ['autonomous', 'interactive', 'task-runner', 'coordinator', 'workstation'];
+/**
+ * The canonical, '@'-free owner HANDLE for this agent — taken from the device-token response, NEVER the
+ * raw `--owner` the user typed (which may be an email, e.g. when connecting by email). The account is
+ * resolved server-side (the browser login), and the handle comes back in the response, so keying local
+ * artifacts (token filename, per-agent config) by it keeps `{agent}@{owner}.token` unambiguous and lets
+ * the serve daemon parse it correctly. Prefer the gaii's owner segment (`agent#owner@node`), fall back to
+ * the response `owner`, then to the CLI value with any '@'-suffix stripped.
+ */
+export function ownerHandleFrom(tokenData, cliOwner) {
+    const fromGaii = /#([^@]+)@/.exec(tokenData.gaii);
+    if (fromGaii)
+        return fromGaii[1];
+    if (typeof tokenData.owner === 'string' && tokenData.owner && !tokenData.owner.includes('@'))
+        return tokenData.owner;
+    return cliOwner.includes('@') ? cliOwner.split('@')[0] : cliOwner;
+}
 const DEFAULT_NODE_URL = 'https://aimeat.io';
 const DEFAULT_AGENT_NAME = 'assistant';
 function normalizeNodeUrl(value) {
@@ -288,20 +304,23 @@ export async function runAuth(args) {
     }
     const token = tokenData;
     s.stop('Approved!');
+    // Key ALL local artifacts by the resolved owner HANDLE, not the raw `--owner` (which may be an email).
+    // This keeps `{agent}@{owner}.token` unambiguous so the serve daemon derives the right agent name.
+    const ownerHandle = ownerHandleFrom(token, owner);
     // Before storing the new token, check whether this is the first agent (so it
     // gets marked as `primary: true` in its per-agent config -- multi-agent serve
     // resolves to the primary agent when no agent_name is given).
     const tokensBefore = await listAllTokens();
-    const sameAlreadyExists = tokensBefore.some(t => t.agent === agentName && t.owner === owner);
-    const isFirstAgent = tokensBefore.filter(t => !(t.agent === agentName && t.owner === owner)).length === 0;
-    await storeToken(agentName, owner, token.access_token);
-    success(`Token stored (aimeat:${agentName}@${owner})`);
+    const sameAlreadyExists = tokensBefore.some(t => t.agent === agentName && t.owner === ownerHandle);
+    const isFirstAgent = tokensBefore.filter(t => !(t.agent === agentName && t.owner === ownerHandle)).length === 0;
+    await storeToken(agentName, ownerHandle, token.access_token);
+    success(`Token stored (aimeat:${agentName}@${ownerHandle})`);
     // Per-agent config (~/.aimeat/agents/{agent}/config.yaml). Preserve any
     // existing runner/wake/poll_interval if the agent is being re-connected.
     const existingPerAgent = loadPerAgentConfig(agentName);
     savePerAgentConfig(agentName, {
         agent: agentName,
-        owner,
+        owner: ownerHandle,
         node_url: nodeUrl,
         primary: existingPerAgent?.primary ?? isFirstAgent,
         mode: mode ?? existingPerAgent?.mode,
@@ -313,7 +332,7 @@ export async function runAuth(args) {
     // (`loadConfig().agent`) keep working. The first-registered agent becomes the
     // global's `agent`; later agents do not overwrite it.
     if (isFirstAgent || sameAlreadyExists) {
-        saveConfig({ node_url: nodeUrl, agent: agentName, owner });
+        saveConfig({ node_url: nodeUrl, agent: agentName, owner: ownerHandle });
     }
     client.setToken(token.access_token);
     await downloadAndPrintBundleGuide(client, agentName, success, info, warn);

package/dist/src/cli/connect/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/cli/connect/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAKzE,MAAM,WAAW,GAA6B,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAyBzH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;WACtC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;KACrG,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,gBAAwB;IACrD,OAAO;;;;;;;;;;;EAWP,gBAAgB;;;;;;;;;;;;0DAYwC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,MAAoB,EACpB,SAAiB,EACjB,OAAkC,EAClC,IAA+B,EAC/B,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,4CAA4C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,oBAAoB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB,EAAE,OAAuB;IACnE,IAAI,WAAW,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,OAAe,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,OAAgB,IAAI,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5G,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAEhC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,6GAA6G,CAAC,CAAC;QACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,OAAQ,CAAC,IAAI,CAAC;QACnD,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,CAAC,KAAK;YACZ,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8DAA8D,CAAC;QAC9G,CAAC;KACF,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,uHAAuH,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,OAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxF,IAAI,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,KAAK,GAAI,UAAqB,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,gHAAgH,CAAC,CAAC;QACvH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;QAC3C,CAAC,CAAC,MAAM,OAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;QACpH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,SAAS,GAAI,UAAqB,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,8GAA8G,CAAC,CAAC;QACrH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,0CAA0C,SAAS,uDAAuD,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,IAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAiB,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,IAAiB,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,oCAAoC,CAAC,CAAC;gBAC9C,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,4EAA4E;gBAC5E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yEAAyE;gBACzE,mDAAmD;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;oBACvD,IAAI,gBAAgB,EAAE,CAAC;wBACrB,kBAAkB,CAAC,SAAS,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC7D,IAAI,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;wBACrD,IAAI,CAAC,wFAAwF,CAAC,CAAC;oBACjG,CAAC;gBACH,CAAC;gBACD,MAAM,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1E,KAAK,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC1D,UAAU,EAAE,SAAS;YACrB,KAAK;YACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,IAAI,CAAE,QAAQ,CAAC,KAA6B,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAKzB,CAAC;IAEF,CAAC,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,cAAc,CAAC,CAAC;IAEtD,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACjD,IAAI,SAAS,GAA+B,IAAI,CAAC;IAEjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACtD,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU,EAAE,8CAA8C;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1B,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC1B,MAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,UAAU,EAAE,KAAK,CAAC;QAClC,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,KAAK,uBAAuB,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC5B,IAAI,CAAC,UAAU,EAAE,iBAAiB,IAAI,gFAAgF,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEpB,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,YAAY,GAAG,MAAM,aAAa,EAAE,CAAC;IAC3C,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAE1G,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,CAAC,wBAAwB,SAAS,IAAI,KAAK,GAAG,CAAC,CAAC;IAEvD,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACvD,kBAAkB,CAAC,SAAS,EAAE;QAC5B,KAAK,EAAE,SAAS;QAChB,KAAK;QACL,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI,YAAY;QAClD,IAAI,EAAE,IAAI,IAAI,gBAAgB,EAAE,IAAI;QACpC,aAAa,EAAE,gBAAgB,EAAE,aAAa;QAC9C,IAAI,EAAE,gBAAgB,EAAE,IAAI;QAC5B,MAAM,EAAE,gBAAgB,EAAE,MAAM;KACjC,CAAC,CAAC;IAEH,gEAAgE;IAChE,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACtC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE1E,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,oKAAoK,CAAC,CAAC;QAC3K,IAAI,CAAC,gEAAgE,SAAS,cAAc,CAAC,CAAC;QAC9F,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/cli/connect/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAKzE,MAAM,WAAW,GAA6B,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAqBzH;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,SAA8B,EAAE,QAAgB;IAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC;IACrH,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAOD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;WACtC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;KACrG,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,gBAAwB;IACrD,OAAO;;;;;;;;;;;EAWP,gBAAgB;;;;;;;;;;;;0DAYwC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,MAAoB,EACpB,SAAiB,EACjB,OAAkC,EAClC,IAA+B,EAC/B,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,4CAA4C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,oBAAoB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB,EAAE,OAAuB;IACnE,IAAI,WAAW,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,OAAe,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,OAAgB,IAAI,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5G,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAEhC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,6GAA6G,CAAC,CAAC;QACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,OAAQ,CAAC,IAAI,CAAC;QACnD,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,CAAC,KAAK;YACZ,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8DAA8D,CAAC;QAC9G,CAAC;KACF,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,uHAAuH,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,OAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxF,IAAI,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,KAAK,GAAI,UAAqB,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,gHAAgH,CAAC,CAAC;QACvH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;QAC3C,CAAC,CAAC,MAAM,OAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;QACpH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,SAAS,GAAI,UAAqB,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,8GAA8G,CAAC,CAAC;QACrH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,0CAA0C,SAAS,uDAAuD,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,IAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAiB,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,IAAiB,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,oCAAoC,CAAC,CAAC;gBAC9C,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,4EAA4E;gBAC5E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yEAAyE;gBACzE,mDAAmD;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;oBACvD,IAAI,gBAAgB,EAAE,CAAC;wBACrB,kBAAkB,CAAC,SAAS,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC7D,IAAI,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;wBACrD,IAAI,CAAC,wFAAwF,CAAC,CAAC;oBACjG,CAAC;gBACH,CAAC;gBACD,MAAM,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1E,KAAK,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC1D,UAAU,EAAE,SAAS;YACrB,KAAK;YACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,IAAI,CAAE,QAAQ,CAAC,KAA6B,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAKzB,CAAC;IAEF,CAAC,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,cAAc,CAAC,CAAC;IAEtD,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACjD,IAAI,SAAS,GAA+B,IAAI,CAAC;IAEjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACtD,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU,EAAE,8CAA8C;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1B,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC1B,MAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,UAAU,EAAE,KAAK,CAAC;QAClC,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,KAAK,uBAAuB,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC5B,IAAI,CAAC,UAAU,EAAE,iBAAiB,IAAI,gFAAgF,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEpB,uGAAuG;IACvG,mGAAmG;IACnG,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAElD,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,YAAY,GAAG,MAAM,aAAa,EAAE,CAAC;IAC3C,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAEhH,MAAM,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,OAAO,CAAC,wBAAwB,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC;IAE7D,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACvD,kBAAkB,CAAC,SAAS,EAAE;QAC5B,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI,YAAY;QAClD,IAAI,EAAE,IAAI,IAAI,gBAAgB,EAAE,IAAI;QACpC,aAAa,EAAE,gBAAgB,EAAE,aAAa;QAC9C,IAAI,EAAE,gBAAgB,EAAE,IAAI;QAC5B,MAAM,EAAE,gBAAgB,EAAE,MAAM;KACjC,CAAC,CAAC;IAEH,gEAAgE;IAChE,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,YAAY,IAAI,iBAAiB,EAAE,CAAC;QACtC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE1E,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,oKAAoK,CAAC,CAAC;QAC3K,IAAI,CAAC,gEAAgE,SAAS,cAAc,CAAC,CAAC;QAC9F,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/src/cli/connect/keychain.d.ts

@@ -6,6 +6,15 @@ export interface StoredCredential {
     owner: string;
     token: string;
 }
+/**
+ * Parse a `{agent}@{owner}.token` filename into its agent + owner. Split on the FIRST '@' — agent names
+ * are '@'-free (lowercase alphanumeric + hyphens), so it is the authoritative boundary and an owner slug
+ * that itself contains '@' (an email) parses correctly. Returns null for a non-`.token` or shapeless name.
+ */
+export declare function parseTokenFilename(name: string): {
+    agent: string;
+    owner: string;
+} | null;
 /**
  * Scan the tokens directory and return every stored credential. File naming
  * is `{agent}@{owner}.token`; unparseable filenames are skipped silently.