aimeat 2.4.0 → 2.6.0

package/dist/src/services/build-app-prompt.js

@@ -96,7 +96,8 @@ export function buildAppPrompt(config, opts = {}) {
     body += '```\n';
     body += 'Works only when logged in. After a write, read it back to confirm it persisted.\n';
     body += 'A key is a plain string: `get(key)` / `getPublic(gaii, key)` always return the LATEST value — never append a version, index or `:0`/`:N` suffix to a key, and read back the SAME key you wrote (a store-as-`x` / read-as-`x:0` mismatch just 404s and your UI shows nothing). To page a large list, store it as ONE array under one key (or shard with your OWN explicit id scheme), not a magic version suffix.\n';
-    body += 'Shared feeds, journals, comments and discussions are ALL built this way — one public key per entry, `getPublic()` to read others\'. Never reach for Boards (deprecated, removal-bound) or organism workspaces as an app\'s data layer. When a rule must be enforced server-side (only-author-can-delete, one-vote-per-user), that logic goes into an extension — see the extension guide, not into boards/organisms.\n\n';
+    body += 'Shared feeds, journals, comments and discussions are ALL built this way — one public key per entry, `getPublic()` to read others\'. Never reach for Boards (deprecated, removal-bound) or organism workspaces as an app\'s data layer. When a rule must be enforced server-side (only-author-can-delete, one-vote-per-user), that logic goes into an extension — see the extension guide, not into boards/organisms.\n';
+    body += 'If you RENDER content an agent wrote, read it with `getPublicEntry(gaii, key)` instead: it returns the same entry plus `provenance` — how that content was made, including the model and the `sources` the writer declared. `getPublic()` returns the bare value and cannot carry it. Showing agent-written text with no origin, when the node is holding the record that explains it, is the gap the label is meant to close.\n\n';
     // Reading what the owner's AGENTS produced. This is the single most common "my app shows
     // nothing" cause for fleet-facing apps: agent output is NOT in the owner's namespace, and an
     // app-grant token gets no automatic broadening, so an unscoped list() legitimately returns [].

package/dist/src/services/build-app-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-app-prompt.js","sourceRoot":"","sources":["../../../src/services/build-app-prompt.ts"],"names":[],"mappings":"AAqEA,4FAA4F;AAC5F,4FAA4F;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,yFAAyF;AACzF,yFAAyF;AACzF,8EAA8E;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAWrF,MAAM,QAAQ,GAA2B,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC;AAClF,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAC5B,MAAoB,EACpB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,SAAS,CAAC;IAExD,gFAAgF;IAChF,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,iDAAiD,CAAC;IAC9G,IAAI,IAAI,2EAA2E,CAAC;IAEpF,qFAAqF;IACrF,IAAI,IAAI,yCAAyC,CAAC;IAClD,IAAI,IAAI,8DAA8D,GAAG,OAAO,GAAG,sBAAsB,CAAC;IAC1G,IAAI,IAAI,mHAAmH,CAAC;IAC5H,IAAI,IAAI,6IAA6I,CAAC;IACtJ,IAAI,IAAI,0OAA0O,CAAC;IACnP,IAAI,IAAI,8wBAA8wB,CAAC;IAEvxB,wFAAwF;IACxF,2FAA2F;IAC3F,0FAA0F;IAC1F,IAAI,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAE5C,eAAe;IACf,IAAI,IAAI,oBAAoB,CAAC;IAC7B,IAAI,IAAI,kVAAkV,CAAC;IAC3V,IAAI,IAAI,8TAA8T,CAAC;IACvU,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,YAAY,CAAC;IACrB,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,uEAAuE,CAAC;IAChF,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,8DAA8D,CAAC;IACvE,IAAI,IAAI,4CAA4C,CAAC;IACrD,IAAI,IAAI,+EAA+E,CAAC;IACxF,IAAI,IAAI,uBAAuB,CAAC;IAChC,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,iFAAiF,CAAC;IAC1F,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,qCAAqC,CAAC;IAC9C,IAAI,IAAI,sCAAsC,CAAC;IAC/C,IAAI,IAAI,IAAI,GAAG,WAAW,CAAC;IAC3B,IAAI,IAAI,SAAS,CAAC;IAElB,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,0FAA0F;IAC1F,mCAAmC;IACnC,IAAI,IAAI,oDAAoD,CAAC;IAC7D,IAAI,IAAI,2XAA2X,CAAC;IACpY,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,gDAAgD,CAAC;IACzD,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,0HAA0H,CAAC;IACnI,IAAI,IAAI,oGAAoG,CAAC;IAC7G,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,+UAA+U,CAAC;IAExV,IAAI,IAAI,gCAAgC,CAAC;IACzC,IAAI,IAAI,mNAAmN,CAAC;IAC5N,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,kHAAkH,CAAC;IAC3H,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,6KAA6K,GAAG,OAAO,GAAG,2BAA2B,CAAC;IAC9N,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,yLAAyL,CAAC;IAElM,eAAe;IACf,IAAI,IAAI,oBAAoB,CAAC;IAC7B,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,sEAAsE,CAAC;IAC/E,IAAI,IAAI,2FAA2F,CAAC;IACpG,IAAI,IAAI,sDAAsD,CAAC;IAC/D,IAAI,IAAI,sFAAsF,CAAC;IAC/F,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,sDAAsD,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,oZAAoZ,CAAC;IAC7Z,IAAI,IAAI,0ZAA0Z,CAAC;IAEna,yFAAyF;IACzF,6FAA6F;IAC7F,+FAA+F;IAC/F,IAAI,IAAI,6DAA6D,CAAC;IACtE,IAAI,IAAI,6TAA6T,CAAC;IACtU,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,qFAAqF,CAAC;IAC9F,IAAI,IAAI,iGAAiG,CAAC;IAC1G,IAAI,IAAI,sEAAsE,CAAC;IAC/E,IAAI,IAAI,iGAAiG,CAAC;IAC1G,IAAI,IAAI,sFAAsF,CAAC;IAC/F,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,6YAA6Y,CAAC;IACtZ,IAAI,IAAI,0YAA0Y,CAAC;IAEnZ,oGAAoG;IACpG,qGAAqG;IACrG,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,wwBAAwwB,CAAC;IACjxB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,4GAA4G,CAAC;IACrH,IAAI,IAAI,gHAAgH,CAAC;IACzH,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,uGAAuG,CAAC;IAChH,IAAI,IAAI,yGAAyG,CAAC;IAClH,IAAI,IAAI,2EAA2E,CAAC;IACpF,IAAI,IAAI,wGAAwG,CAAC;IACjH,IAAI,IAAI,8GAA8G,CAAC;IACvH,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,wOAAwO,CAAC;IAEjP,4FAA4F;IAC5F,IAAI,IAAI,2CAA2C,CAAC;IACpD,IAAI,IAAI,gNAAgN,CAAC;IACzN,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,2EAA2E,CAAC;IACpF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6DAA6D,CAAC;IAClG,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,+NAA+N,CAAC;IAExO,KAAK;IACL,IAAI,IAAI,0BAA0B,CAAC;IACnC,IAAI,IAAI,kMAAkM,CAAC;IAC3M,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,2BAA2B,GAAG,WAAW,CAAC;IAC9E,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,sGAAsG,CAAC;IAC/G,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iGAAiG,CAAC;IAE1G,iGAAiG;IACjG,+FAA+F;IAC/F,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,0NAA0N,CAAC;IACnO,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,kEAAkE,CAAC;IAC3E,IAAI,IAAI,qFAAqF,CAAC;IAC9F,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iXAAiX,CAAC;IAC1X,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,6FAA6F,CAAC;IACtG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,mNAAmN,CAAC;IAC5N,IAAI,IAAI,sgBAAsgB,CAAC;IAE/gB,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,uFAAuF;IACvF,IAAI,IAAI,mEAAmE,CAAC;IAC5E,IAAI,IAAI,8SAA8S,CAAC;IACvT,IAAI,IAAI,keAAke,CAAC;IAC3e,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,kEAAkE,CAAC;IAC3E,IAAI,IAAI,4GAA4G,CAAC;IACrH,IAAI,IAAI,kGAAkG,CAAC;IAC3G,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kSAAkS,CAAC;IAC3S,IAAI,IAAI,yNAAyN,CAAC;IAClO,IAAI,IAAI,yUAAyU,CAAC;IAClV,IAAI,IAAI,iQAAiQ,CAAC;IAC1Q,IAAI,IAAI,mPAAmP,CAAC;IAC5P,IAAI,IAAI,2jBAA2jB,CAAC;IAEpkB,0BAA0B;IAC1B,IAAI,IAAI,0CAA0C,CAAC;IACnD,IAAI,IAAI,+GAA+G,CAAC;IACxH,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,+BAA+B,CAAC;IACxC,IAAI,IAAI,6EAA6E,CAAC;IACtF,IAAI,IAAI,+EAA+E,CAAC;IACxF,IAAI,IAAI,uDAAuD,CAAC;IAChE,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,qDAAqD,CAAC;IAC9D,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,sFAAsF,CAAC;IAE/F,yFAAyF;IACzF,sFAAsF;IACtF,IAAI,IAAI,wDAAwD,CAAC;IACjE,IAAI,IAAI,uRAAuR,CAAC;IAChS,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,yEAAyE,CAAC;IAClF,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,ydAAyd,CAAC;IAEle,mEAAmE;IACnE,IAAI,IAAI,qDAAqD,CAAC;IAC9D,IAAI,IAAI,mZAAmZ,CAAC;IAC5Z,IAAI,IAAI,qUAAqU,CAAC;IAC9U,IAAI,IAAI,UAAU,CAAC;IACnB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,qHAAqH,CAAC;IAC9H,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,6GAA6G,CAAC;IACtH,IAAI,IAAI,mGAAmG,CAAC;IAC5G,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,kCAAkC,GAAG,WAAW,CAAC;IACrF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,wFAAwF,CAAC;IACjG,IAAI,IAAI,mCAAmC,CAAC;IAC5C,IAAI,IAAI,sBAAsB,CAAC;IAC/B,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,yIAAyI,CAAC;IAClJ,IAAI,IAAI,QAAQ,CAAC;IACjB,IAAI,IAAI,+BAA+B,CAAC;IACxC,IAAI,IAAI,2GAA2G,CAAC;IACpH,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kcAAkc,CAAC;IAE3c,oBAAoB;IACpB,IAAI,IAAI,yBAAyB,CAAC;IAClC,IAAI,IAAI,2XAA2X,CAAC;IACpY,IAAI,IAAI,kbAAkb,CAAC;IAC3b,IAAI,IAAI,unBAAunB,CAAC;IAChoB,IAAI,IAAI,SAAS,CAAC;IAClB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,uKAAuK,CAAC;IAChL,IAAI,IAAI,4HAA4H,CAAC;IACrI,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,yGAAyG,CAAC;IAClH,IAAI,IAAI,6EAA6E,CAAC;IACtF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kTAAkT,CAAC;IAC3T,IAAI,IAAI,4rBAA4rB,CAAC;IACrsB,IAAI,IAAI,8UAA8U,CAAC;IAEvV,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,IAAI,sCAAsC,CAAC;IAC/C,IAAI,IAAI,8lBAA8lB,CAAC;IACvmB,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,gTAAgT,CAAC;IACzT,IAAI,IAAI,0SAA0S,CAAC;IACnT,IAAI,IAAI,yUAAyU,CAAC;IAClV,IAAI,IAAI,mSAAmS,CAAC;IAC5S,IAAI,IAAI,2WAA2W,CAAC;IACpX,IAAI,IAAI,qSAAqS,CAAC;IAC9S,IAAI,IAAI,sSAAsS,CAAC;IAC/S,IAAI,IAAI,kbAAkb,CAAC;IAE3b,+FAA+F;IAC/F,gGAAgG;IAChG,sGAAsG;IACtG,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,iIAAiI,CAAC;IAC1I,IAAI,IAAI,oMAAoM,CAAC;IAC7M,IAAI,IAAI,yQAAyQ,CAAC;IAClR,IAAI,IAAI,2WAA2W,CAAC;IACpX,IAAI,IAAI,2LAA2L,CAAC;IACpM,IAAI,IAAI,0KAA0K,CAAC;IACnL,IAAI,IAAI,uMAAuM,CAAC;IAEhN,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,IAAI,IAAI,yDAAyD,CAAC;IAClE,IAAI,IAAI,oMAAoM,CAAC;IAC7M,IAAI,IAAI,8aAA8a,CAAC;IACvb,IAAI,IAAI,mQAAmQ,CAAC;IAC5Q,IAAI,IAAI,0LAA0L,CAAC;IACnM,IAAI,IAAI,mMAAmM,CAAC;IAC5M,IAAI,IAAI,kFAAkF,CAAC;IAC3F,IAAI,IAAI,2DAA2D,CAAC;IACpE,IAAI,IAAI,SAAS,CAAC;IAClB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,6IAA6I,CAAC;IACtJ,IAAI,IAAI,+DAA+D,CAAC;IACxE,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,yCAAyC,CAAC;IAClD,IAAI,IAAI,4HAA4H,CAAC;IACrI,IAAI,IAAI,wGAAwG,CAAC;IACjH,IAAI,IAAI,8FAA8F,CAAC;IACvG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iaAAia,CAAC;IAE1a,wFAAwF;IACxF,6FAA6F;IAC7F,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,0LAA0L,CAAC;IACnM,IAAI,IAAI,maAAma,CAAC;IAC5a,IAAI,IAAI,6SAA6S,CAAC;IACtT,IAAI,IAAI,0NAA0N,CAAC;IACnO,IAAI,IAAI,oYAAoY,CAAC;IAC7Y,IAAI,IAAI,iUAAiU,CAAC;IAC1U,IAAI,IAAI,gOAAgO,CAAC;IAEzO,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,IAAI,6DAA6D,CAAC;IACtE,IAAI,IAAI,iNAAiN,CAAC;IAC1N,IAAI,IAAI,oTAAoT,CAAC;IAC7T,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,mKAAmK,CAAC;IAC5K,IAAI,IAAI,wMAAwM,CAAC;IACjN,IAAI,IAAI,0UAA0U,CAAC;IACnV,IAAI,IAAI,wQAAwQ,CAAC;IAEjR,QAAQ;IACR,IAAI,IAAI,uBAAuB,CAAC;IAChC,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,mTAAmT,CAAC;IAC5T,IAAI,IAAI,kLAAkL,CAAC;IAC3L,IAAI,IAAI,sRAAsR,CAAC;IAC/R,IAAI,IAAI,+DAA+D,CAAC;IAExE,4FAA4F;IAC5F,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,IAAI,kDAAkD,CAAC;QAC3D,IAAI,IAAI,+HAA+H,GAAG,OAAO,GAAG,6dAA6d,CAAC;IACpnB,CAAC;IAED,6FAA6F;IAC7F,IAAI,IAAI,yDAAyD,CAAC;IAClE,IAAI,IAAI,4oBAA4oB,CAAC;IACrpB,IAAI,IAAI,ubAAub,CAAC;IAChc,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/B,IAAI,IAAI,qfAAqf,CAAC;IAE9f,sDAAsD;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,wDAAwD,CAAC;QACjE,IAAI,IAAI,sHAAsH,CAAC;QAC/H,IAAI,IAAI,UAAU,GAAG,OAAO,GAAG,qBAAqB,CAAC;QACrD,IAAI,IAAI,sIAAsI,CAAC;QAC/I,IAAI,IAAI,qBAAqB,CAAC;QAC9B,IAAI,IAAI,iKAAiK,CAAC;QAC1K,IAAI,IAAI,mYAAmY,CAAC;IAC9Y,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,GAAG,wFAAwF,GAAG,MAAM,GAAG,iGAAiG,GAAG,MAAM,GAAG,OAAO,CAAC;IACpO,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,6DAA6D,CAAC;QACtE,IAAI,IAAI,mBAAmB,GAAG,IAAI,GAAG,MAAM,CAAC;QAC5C,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC5B,IAAI,IAAI,kCAAkC,CAAC;QAC3C,IAAI,IAAI,uJAAuJ,CAAC;QAChK,IAAI,IAAI,wPAAwP,CAAC;QACjQ,IAAI,IAAI,gCAAgC,CAAC;QACzC,IAAI,IAAI,iIAAiI,CAAC;QAC1I,IAAI,IAAI,yFAAyF,CAAC;QAClG,IAAI,IAAI,8GAA8G,CAAC;QACvH,IAAI,IAAI,wSAAwS,CAAC;QACjT,IAAI,IAAI,8GAA8G,CAAC;IACzH,CAAC;IACD,IAAI,IAAI,IAAI,CAAC;IAEb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"build-app-prompt.js","sourceRoot":"","sources":["../../../src/services/build-app-prompt.ts"],"names":[],"mappings":"AAqEA,4FAA4F;AAC5F,4FAA4F;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,yFAAyF;AACzF,yFAAyF;AACzF,8EAA8E;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAWrF,MAAM,QAAQ,GAA2B,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC;AAClF,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAC5B,MAAoB,EACpB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,SAAS,CAAC;IAExD,gFAAgF;IAChF,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,iDAAiD,CAAC;IAC9G,IAAI,IAAI,2EAA2E,CAAC;IAEpF,qFAAqF;IACrF,IAAI,IAAI,yCAAyC,CAAC;IAClD,IAAI,IAAI,8DAA8D,GAAG,OAAO,GAAG,sBAAsB,CAAC;IAC1G,IAAI,IAAI,mHAAmH,CAAC;IAC5H,IAAI,IAAI,6IAA6I,CAAC;IACtJ,IAAI,IAAI,0OAA0O,CAAC;IACnP,IAAI,IAAI,8wBAA8wB,CAAC;IAEvxB,wFAAwF;IACxF,2FAA2F;IAC3F,0FAA0F;IAC1F,IAAI,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAE5C,eAAe;IACf,IAAI,IAAI,oBAAoB,CAAC;IAC7B,IAAI,IAAI,kVAAkV,CAAC;IAC3V,IAAI,IAAI,8TAA8T,CAAC;IACvU,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,YAAY,CAAC;IACrB,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,uEAAuE,CAAC;IAChF,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,8DAA8D,CAAC;IACvE,IAAI,IAAI,4CAA4C,CAAC;IACrD,IAAI,IAAI,+EAA+E,CAAC;IACxF,IAAI,IAAI,uBAAuB,CAAC;IAChC,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,iFAAiF,CAAC;IAC1F,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,IAAI,CAAC;IACb,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,qCAAqC,CAAC;IAC9C,IAAI,IAAI,sCAAsC,CAAC;IAC/C,IAAI,IAAI,IAAI,GAAG,WAAW,CAAC;IAC3B,IAAI,IAAI,SAAS,CAAC;IAElB,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,0FAA0F;IAC1F,mCAAmC;IACnC,IAAI,IAAI,oDAAoD,CAAC;IAC7D,IAAI,IAAI,2XAA2X,CAAC;IACpY,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,gDAAgD,CAAC;IACzD,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,0HAA0H,CAAC;IACnI,IAAI,IAAI,oGAAoG,CAAC;IAC7G,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,+UAA+U,CAAC;IAExV,IAAI,IAAI,gCAAgC,CAAC;IACzC,IAAI,IAAI,mNAAmN,CAAC;IAC5N,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,kHAAkH,CAAC;IAC3H,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,6KAA6K,GAAG,OAAO,GAAG,2BAA2B,CAAC;IAC9N,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,yLAAyL,CAAC;IAElM,eAAe;IACf,IAAI,IAAI,oBAAoB,CAAC;IAC7B,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,sEAAsE,CAAC;IAC/E,IAAI,IAAI,2FAA2F,CAAC;IACpG,IAAI,IAAI,sDAAsD,CAAC;IAC/D,IAAI,IAAI,sFAAsF,CAAC;IAC/F,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,sDAAsD,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,oZAAoZ,CAAC;IAC7Z,IAAI,IAAI,wZAAwZ,CAAC;IACja,IAAI,IAAI,oaAAoa,CAAC;IAE7a,yFAAyF;IACzF,6FAA6F;IAC7F,+FAA+F;IAC/F,IAAI,IAAI,6DAA6D,CAAC;IACtE,IAAI,IAAI,6TAA6T,CAAC;IACtU,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,qFAAqF,CAAC;IAC9F,IAAI,IAAI,iGAAiG,CAAC;IAC1G,IAAI,IAAI,sEAAsE,CAAC;IAC/E,IAAI,IAAI,iGAAiG,CAAC;IAC1G,IAAI,IAAI,sFAAsF,CAAC;IAC/F,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,6YAA6Y,CAAC;IACtZ,IAAI,IAAI,0YAA0Y,CAAC;IAEnZ,oGAAoG;IACpG,qGAAqG;IACrG,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,wwBAAwwB,CAAC;IACjxB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,4GAA4G,CAAC;IACrH,IAAI,IAAI,gHAAgH,CAAC;IACzH,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,uGAAuG,CAAC;IAChH,IAAI,IAAI,yGAAyG,CAAC;IAClH,IAAI,IAAI,2EAA2E,CAAC;IACpF,IAAI,IAAI,wGAAwG,CAAC;IACjH,IAAI,IAAI,8GAA8G,CAAC;IACvH,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,wOAAwO,CAAC;IAEjP,4FAA4F;IAC5F,IAAI,IAAI,2CAA2C,CAAC;IACpD,IAAI,IAAI,gNAAgN,CAAC;IACzN,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,2EAA2E,CAAC;IACpF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6DAA6D,CAAC;IAClG,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,+NAA+N,CAAC;IAExO,KAAK;IACL,IAAI,IAAI,0BAA0B,CAAC;IACnC,IAAI,IAAI,kMAAkM,CAAC;IAC3M,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,2BAA2B,GAAG,WAAW,CAAC;IAC9E,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,uFAAuF,CAAC;IAChG,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,sGAAsG,CAAC;IAC/G,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iGAAiG,CAAC;IAE1G,iGAAiG;IACjG,+FAA+F;IAC/F,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,0NAA0N,CAAC;IACnO,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,oFAAoF,CAAC;IAC7F,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,kEAAkE,CAAC;IAC3E,IAAI,IAAI,qFAAqF,CAAC;IAC9F,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iXAAiX,CAAC;IAC1X,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,6FAA6F,CAAC;IACtG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,mNAAmN,CAAC;IAC5N,IAAI,IAAI,sgBAAsgB,CAAC;IAE/gB,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,uFAAuF;IACvF,IAAI,IAAI,mEAAmE,CAAC;IAC5E,IAAI,IAAI,8SAA8S,CAAC;IACvT,IAAI,IAAI,keAAke,CAAC;IAC3e,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,kEAAkE,CAAC;IAC3E,IAAI,IAAI,4GAA4G,CAAC;IACrH,IAAI,IAAI,kGAAkG,CAAC;IAC3G,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,+FAA+F,CAAC;IACxG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kSAAkS,CAAC;IAC3S,IAAI,IAAI,yNAAyN,CAAC;IAClO,IAAI,IAAI,yUAAyU,CAAC;IAClV,IAAI,IAAI,iQAAiQ,CAAC;IAC1Q,IAAI,IAAI,mPAAmP,CAAC;IAC5P,IAAI,IAAI,2jBAA2jB,CAAC;IAEpkB,0BAA0B;IAC1B,IAAI,IAAI,0CAA0C,CAAC;IACnD,IAAI,IAAI,+GAA+G,CAAC;IACxH,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,+BAA+B,CAAC;IACxC,IAAI,IAAI,6EAA6E,CAAC;IACtF,IAAI,IAAI,+EAA+E,CAAC;IACxF,IAAI,IAAI,uDAAuD,CAAC;IAChE,IAAI,IAAI,mFAAmF,CAAC;IAC5F,IAAI,IAAI,qDAAqD,CAAC;IAC9D,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,sFAAsF,CAAC;IAE/F,yFAAyF;IACzF,sFAAsF;IACtF,IAAI,IAAI,wDAAwD,CAAC;IACjE,IAAI,IAAI,uRAAuR,CAAC;IAChS,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,yEAAyE,CAAC;IAClF,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,ydAAyd,CAAC;IAEle,mEAAmE;IACnE,IAAI,IAAI,qDAAqD,CAAC;IAC9D,IAAI,IAAI,mZAAmZ,CAAC;IAC5Z,IAAI,IAAI,qUAAqU,CAAC;IAC9U,IAAI,IAAI,UAAU,CAAC;IACnB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,qHAAqH,CAAC;IAC9H,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,6GAA6G,CAAC;IACtH,IAAI,IAAI,mGAAmG,CAAC;IAC5G,IAAI,IAAI,WAAW,CAAC;IACpB,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,6BAA6B,GAAG,WAAW,CAAC;IAChF,IAAI,IAAI,eAAe,GAAG,OAAO,GAAG,kCAAkC,GAAG,WAAW,CAAC;IACrF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,oEAAoE,CAAC;IAC7E,IAAI,IAAI,wFAAwF,CAAC;IACjG,IAAI,IAAI,mCAAmC,CAAC;IAC5C,IAAI,IAAI,sBAAsB,CAAC;IAC/B,IAAI,IAAI,iBAAiB,CAAC;IAC1B,IAAI,IAAI,0FAA0F,CAAC;IACnG,IAAI,IAAI,yIAAyI,CAAC;IAClJ,IAAI,IAAI,QAAQ,CAAC;IACjB,IAAI,IAAI,+BAA+B,CAAC;IACxC,IAAI,IAAI,2GAA2G,CAAC;IACpH,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kcAAkc,CAAC;IAE3c,oBAAoB;IACpB,IAAI,IAAI,yBAAyB,CAAC;IAClC,IAAI,IAAI,2XAA2X,CAAC;IACpY,IAAI,IAAI,kbAAkb,CAAC;IAC3b,IAAI,IAAI,unBAAunB,CAAC;IAChoB,IAAI,IAAI,SAAS,CAAC;IAClB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,uKAAuK,CAAC;IAChL,IAAI,IAAI,4HAA4H,CAAC;IACrI,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,yGAAyG,CAAC;IAClH,IAAI,IAAI,6EAA6E,CAAC;IACtF,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,kTAAkT,CAAC;IAC3T,IAAI,IAAI,4rBAA4rB,CAAC;IACrsB,IAAI,IAAI,8UAA8U,CAAC;IAEvV,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,IAAI,sCAAsC,CAAC;IAC/C,IAAI,IAAI,8lBAA8lB,CAAC;IACvmB,IAAI,IAAI,mDAAmD,CAAC;IAC5D,IAAI,IAAI,gTAAgT,CAAC;IACzT,IAAI,IAAI,0SAA0S,CAAC;IACnT,IAAI,IAAI,yUAAyU,CAAC;IAClV,IAAI,IAAI,mSAAmS,CAAC;IAC5S,IAAI,IAAI,2WAA2W,CAAC;IACpX,IAAI,IAAI,qSAAqS,CAAC;IAC9S,IAAI,IAAI,sSAAsS,CAAC;IAC/S,IAAI,IAAI,kbAAkb,CAAC;IAE3b,+FAA+F;IAC/F,gGAAgG;IAChG,sGAAsG;IACtG,IAAI,IAAI,0EAA0E,CAAC;IACnF,IAAI,IAAI,iIAAiI,CAAC;IAC1I,IAAI,IAAI,oMAAoM,CAAC;IAC7M,IAAI,IAAI,yQAAyQ,CAAC;IAClR,IAAI,IAAI,2WAA2W,CAAC;IACpX,IAAI,IAAI,2LAA2L,CAAC;IACpM,IAAI,IAAI,0KAA0K,CAAC;IACnL,IAAI,IAAI,uMAAuM,CAAC;IAEhN,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,IAAI,IAAI,yDAAyD,CAAC;IAClE,IAAI,IAAI,oMAAoM,CAAC;IAC7M,IAAI,IAAI,8aAA8a,CAAC;IACvb,IAAI,IAAI,mQAAmQ,CAAC;IAC5Q,IAAI,IAAI,0LAA0L,CAAC;IACnM,IAAI,IAAI,mMAAmM,CAAC;IAC5M,IAAI,IAAI,kFAAkF,CAAC;IAC3F,IAAI,IAAI,2DAA2D,CAAC;IACpE,IAAI,IAAI,SAAS,CAAC;IAClB,IAAI,IAAI,oHAAoH,CAAC;IAC7H,IAAI,IAAI,6IAA6I,CAAC;IACtJ,IAAI,IAAI,+DAA+D,CAAC;IACxE,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,yCAAyC,CAAC;IAClD,IAAI,IAAI,4HAA4H,CAAC;IACrI,IAAI,IAAI,wGAAwG,CAAC;IACjH,IAAI,IAAI,8FAA8F,CAAC;IACvG,IAAI,IAAI,OAAO,CAAC;IAChB,IAAI,IAAI,iaAAia,CAAC;IAE1a,wFAAwF;IACxF,6FAA6F;IAC7F,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,IAAI,gEAAgE,CAAC;IACzE,IAAI,IAAI,0LAA0L,CAAC;IACnM,IAAI,IAAI,maAAma,CAAC;IAC5a,IAAI,IAAI,6SAA6S,CAAC;IACtT,IAAI,IAAI,0NAA0N,CAAC;IACnO,IAAI,IAAI,oYAAoY,CAAC;IAC7Y,IAAI,IAAI,iUAAiU,CAAC;IAC1U,IAAI,IAAI,gOAAgO,CAAC;IAEzO,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,IAAI,6DAA6D,CAAC;IACtE,IAAI,IAAI,iNAAiN,CAAC;IAC1N,IAAI,IAAI,oTAAoT,CAAC;IAC7T,IAAI,IAAI,oOAAoO,CAAC;IAC7O,IAAI,IAAI,mKAAmK,CAAC;IAC5K,IAAI,IAAI,wMAAwM,CAAC;IACjN,IAAI,IAAI,0UAA0U,CAAC;IACnV,IAAI,IAAI,wQAAwQ,CAAC;IAEjR,QAAQ;IACR,IAAI,IAAI,uBAAuB,CAAC;IAChC,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,qEAAqE,CAAC;IAC9E,IAAI,IAAI,kDAAkD,CAAC;IAC3D,IAAI,IAAI,gGAAgG,CAAC;IACzG,IAAI,IAAI,yFAAyF,CAAC;IAClG,IAAI,IAAI,mTAAmT,CAAC;IAC5T,IAAI,IAAI,kLAAkL,CAAC;IAC3L,IAAI,IAAI,sRAAsR,CAAC;IAC/R,IAAI,IAAI,+DAA+D,CAAC;IAExE,4FAA4F;IAC5F,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,IAAI,kDAAkD,CAAC;QAC3D,IAAI,IAAI,+HAA+H,GAAG,OAAO,GAAG,6dAA6d,CAAC;IACpnB,CAAC;IAED,6FAA6F;IAC7F,IAAI,IAAI,yDAAyD,CAAC;IAClE,IAAI,IAAI,4oBAA4oB,CAAC;IACrpB,IAAI,IAAI,ubAAub,CAAC;IAChc,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/B,IAAI,IAAI,qfAAqf,CAAC;IAE9f,sDAAsD;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,wDAAwD,CAAC;QACjE,IAAI,IAAI,sHAAsH,CAAC;QAC/H,IAAI,IAAI,UAAU,GAAG,OAAO,GAAG,qBAAqB,CAAC;QACrD,IAAI,IAAI,sIAAsI,CAAC;QAC/I,IAAI,IAAI,qBAAqB,CAAC;QAC9B,IAAI,IAAI,iKAAiK,CAAC;QAC1K,IAAI,IAAI,mYAAmY,CAAC;IAC9Y,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,GAAG,wFAAwF,GAAG,MAAM,GAAG,iGAAiG,GAAG,MAAM,GAAG,OAAO,CAAC;IACpO,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,6DAA6D,CAAC;QACtE,IAAI,IAAI,mBAAmB,GAAG,IAAI,GAAG,MAAM,CAAC;QAC5C,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC5B,IAAI,IAAI,kCAAkC,CAAC;QAC3C,IAAI,IAAI,uJAAuJ,CAAC;QAChK,IAAI,IAAI,wPAAwP,CAAC;QACjQ,IAAI,IAAI,gCAAgC,CAAC;QACzC,IAAI,IAAI,iIAAiI,CAAC;QAC1I,IAAI,IAAI,yFAAyF,CAAC;QAClG,IAAI,IAAI,8GAA8G,CAAC;QACvH,IAAI,IAAI,wSAAwS,CAAC;QACjT,IAAI,IAAI,8GAA8G,CAAC;IACzH,CAAC;IACD,IAAI,IAAI,IAAI,CAAC;IAEb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/src/services/connections/attach.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @file attach.ts
+ * @description Connecting an account by SUPPLYING a credential rather than by an authorization
+ *   round (TARGET-057). The other half of the connect surface, and the one that existed as a
+ *   provider entry before it existed as a route.
+ *
+ *   THE APP PASSWORD IS KEPT ALONGSIDE THE SESSION, deliberately. A session expires and its refresh
+ *   token can be rotated away or rejected; the secret the user handed over does not expire, so a
+ *   dead session can be re-minted without sending them back to a settings page to find something
+ *   they already gave us. That is the whole practical advantage of a non-expiring credential and
+ *   throwing it away after the first exchange would waste it.
+ *
+ *   THE SECRET IS NEVER ECHOED. Not in the response, not in an error, not in a log line. The only
+ *   thing that comes back is the connection, and the connection's projection has no credential in
+ *   it at any level.
+ * @structure attachCredential · mintSession
+ * @usage import { attachCredential } from './attach.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 6.
+ */
+import type { ConnectContext } from './oauth.js';
+import type { ConnectionCredential, ConnectionMode, ConnectionRecord } from '../../models/connection-schemas.js';
+export type AttachResult = {
+    ok: true;
+    connection: ConnectionRecord;
+    created: boolean;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+/** What a mint produced: the session, plus who it belongs to at the provider. */
+export interface MintedSession {
+    credential: ConnectionCredential;
+    externalId: string;
+    accountLabel: string;
+    expiresAt: string | null;
+}
+/**
+ * Exchange a supplied secret for a session.
+ *
+ * Exported because `refresh.ts` needs it too: re-minting from the stored app password is what a
+ * session-shaped connection falls back to when its refresh is rejected, and having two copies of
+ * this exchange is how the two paths drift.
+ */
+export declare function mintSession(providerId: string, fields: Record<string, string>, baseUrl: string): Promise<MintedSession | {
+    error: string;
+}>;
+/**
+ * Connect an account from a credential the user supplied.
+ *
+ * Re-attaching an account that is already connected UPDATES that row, exactly as re-authorising
+ * does on the OAuth side — which is what makes "my app password stopped working, here is a new one"
+ * a repair rather than a way to accumulate duplicates.
+ */
+export declare function attachCredential(ctx: ConnectContext, input: {
+    principal: string;
+    provider: string;
+    mode: ConnectionMode;
+    fields: Record<string, string>;
+}): Promise<AttachResult>;
+//# sourceMappingURL=attach.d.ts.map

package/dist/src/services/connections/attach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EACV,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EACvD,MAAM,oCAAoC,CAAC;AAK5C,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,oBAAoB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAClE,OAAO,CAAC,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA0E5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACnG,OAAO,CAAC,YAAY,CAAC,CAkDvB"}

package/dist/src/services/connections/attach.js

@@ -0,0 +1,168 @@
+/**
+ * @file attach.ts
+ * @description Connecting an account by SUPPLYING a credential rather than by an authorization
+ *   round (TARGET-057). The other half of the connect surface, and the one that existed as a
+ *   provider entry before it existed as a route.
+ *
+ *   THE APP PASSWORD IS KEPT ALONGSIDE THE SESSION, deliberately. A session expires and its refresh
+ *   token can be rotated away or rejected; the secret the user handed over does not expire, so a
+ *   dead session can be re-minted without sending them back to a settings page to find something
+ *   they already gave us. That is the whole practical advantage of a non-expiring credential and
+ *   throwing it away after the first exchange would waste it.
+ *
+ *   THE SECRET IS NEVER ECHOED. Not in the response, not in an error, not in a log line. The only
+ *   thing that comes back is the connection, and the connection's projection has no credential in
+ *   it at any level.
+ * @structure attachCredential · mintSession
+ * @usage import { attachCredential } from './attach.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 6.
+ */
+import { randomUUID } from 'node:crypto';
+import { safeFetch } from '../../utils/url-validator.js';
+import { sealCredential } from './credential.js';
+import { findProvider } from './providers.js';
+/** Bluesky's default Personal Data Server. A user on their own PDS supplies it as a field later. */
+const BLUESKY_PDS = 'https://bsky.social';
+/**
+ * Exchange a supplied secret for a session.
+ *
+ * Exported because `refresh.ts` needs it too: re-minting from the stored app password is what a
+ * session-shaped connection falls back to when its refresh is rejected, and having two copies of
+ * this exchange is how the two paths drift.
+ */
+export async function mintSession(providerId, fields, baseUrl) {
+    const identifier = (fields.identifier ?? '').trim();
+    const password = fields.password ?? '';
+    if (!identifier || !password)
+        return { error: 'both a handle and a secret are required' };
+    if (providerId === 'bluesky') {
+        try {
+            const r = await safeFetch(`${BLUESKY_PDS}/xrpc/com.atproto.server.createSession`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ identifier, password }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (!r.ok) {
+                // Deliberately not the provider's raw body: a failed login response can echo the identifier
+                // and sometimes the attempt itself. The actionable half is that the pair was refused.
+                return { error: r.status === 401
+                        ? 'Bluesky refused that handle and app password. Check it is an APP password, not your account password.'
+                        : `Bluesky refused the sign-in (HTTP ${r.status})` };
+            }
+            const j = await r.json();
+            const accessJwt = typeof j.accessJwt === 'string' ? j.accessJwt : '';
+            const did = typeof j.did === 'string' ? j.did : '';
+            if (!accessJwt || !did)
+                return { error: 'Bluesky returned no usable session' };
+            return {
+                credential: {
+                    shape: 'session',
+                    accessToken: accessJwt,
+                    ...(typeof j.refreshJwt === 'string' ? { refreshToken: j.refreshJwt } : {}),
+                    // The secret is kept so a dead session can be re-minted; `pds` so a user on their own
+                    // server is a field change rather than a code change.
+                    extra: { appPassword: password, identifier, pds: BLUESKY_PDS, did },
+                },
+                externalId: did,
+                accountLabel: typeof j.handle === 'string' ? `@${j.handle}` : did,
+                // AT Proto does not state a lifetime here. Null means "do not pre-emptively refresh"; the
+                // 401-then-refresh path handles expiry when it actually arrives.
+                expiresAt: null,
+            };
+        }
+        catch (err) {
+            return { error: `could not reach Bluesky: ${err.message}` };
+        }
+    }
+    if (providerId === 'fake-static') {
+        try {
+            const r = await safeFetch(`${baseUrl}/session`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ identifier, password }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (!r.ok)
+                return { error: `the test provider refused the credential (HTTP ${r.status})` };
+            const j = await r.json();
+            const accessJwt = typeof j.accessJwt === 'string' ? j.accessJwt : '';
+            const did = typeof j.did === 'string' ? j.did : '';
+            if (!accessJwt || !did)
+                return { error: 'the test provider returned no usable session' };
+            return {
+                credential: {
+                    shape: 'session',
+                    accessToken: accessJwt,
+                    ...(typeof j.refreshJwt === 'string' ? { refreshToken: j.refreshJwt } : {}),
+                    extra: { appPassword: password, identifier, pds: baseUrl, did },
+                },
+                externalId: did,
+                accountLabel: typeof j.handle === 'string' ? `@${j.handle}` : did,
+                expiresAt: null,
+            };
+        }
+        catch (err) {
+            return { error: `could not reach the test provider: ${err.message}` };
+        }
+    }
+    return { error: `no supplied-credential recipe for ${providerId}` };
+}
+/**
+ * Connect an account from a credential the user supplied.
+ *
+ * Re-attaching an account that is already connected UPDATES that row, exactly as re-authorising
+ * does on the OAuth side — which is what makes "my app password stopped working, here is a new one"
+ * a repair rather than a way to accumulate duplicates.
+ */
+export async function attachCredential(ctx, input) {
+    const provider = findProvider(ctx.providers, input.provider);
+    if (!provider)
+        return { ok: false, code: 'UNKNOWN_PROVIDER', reason: `no provider '${input.provider}'` };
+    if (!provider.enabled) {
+        return { ok: false, code: 'PROVIDER_DISABLED', reason: provider.disabledReason ?? 'provider is disabled' };
+    }
+    if (!provider.attachFields) {
+        // The two paths never overlap: a provider with an authorization round must go through it, or a
+        // caller could skip the consent screen by posting here instead.
+        return { ok: false, code: 'NEEDS_AUTHORIZATION', reason: `${provider.id} is connected by approving it at the provider, not by supplying a credential` };
+    }
+    for (const f of provider.attachFields) {
+        if (!input.fields[f.name]) {
+            return { ok: false, code: 'MISSING_FIELD', reason: `${f.label} is required` };
+        }
+    }
+    const minted = await mintSession(provider.id, input.fields, ctx.config.connectFakeBaseUrl);
+    if ('error' in minted)
+        return { ok: false, code: 'ATTACH_FAILED', reason: minted.error };
+    const credential = sealCredential(minted.credential, ctx.key);
+    const now = new Date().toISOString();
+    const existing = await ctx.storage.findConnection(input.principal, provider.id, minted.externalId, null);
+    if (existing) {
+        await ctx.storage.updateConnectionCredential(existing.id, credential, minted.expiresAt);
+        const refreshed = await ctx.storage.getConnection(existing.id);
+        return { ok: true, connection: refreshed ?? existing, created: false };
+    }
+    const connection = {
+        id: randomUUID(),
+        principal: input.principal,
+        mode: input.mode,
+        provider: provider.id,
+        instance: null,
+        accountLabel: minted.accountLabel,
+        externalId: minted.externalId,
+        credential,
+        credentialShape: 'session',
+        scopes: provider.scopes,
+        expiresAt: minted.expiresAt,
+        status: 'active',
+        lastOkAt: now,
+        lastError: null,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await ctx.storage.createConnection(connection);
+    return { ok: true, connection, created: true };
+}
+//# sourceMappingURL=attach.js.map

package/dist/src/services/connections/attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach.js","sourceRoot":"","sources":["../../../../src/services/connections/attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAM9C,oGAAoG;AACpG,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAc1C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAAE,MAA8B,EAAE,OAAe;IAEnE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IAE1F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,WAAW,wCAAwC,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,4FAA4F;gBAC5F,sFAAsF;gBACtF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG;wBAC9B,CAAC,CAAC,uGAAuG;wBACzG,CAAC,CAAC,qCAAqC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAoF,CAAC;YAC3G,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YAC/E,OAAO;gBACL,UAAU,EAAE;oBACV,KAAK,EAAE,SAAS;oBAChB,WAAW,EAAE,SAAS;oBACtB,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,sFAAsF;oBACtF,sDAAsD;oBACtD,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;iBACpE;gBACD,UAAU,EAAE,GAAG;gBACf,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG;gBACjE,0FAA0F;gBAC1F,iEAAiE;gBACjE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,4BAA6B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,kDAAkD,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAoF,CAAC;YAC3G,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACzF,OAAO;gBACL,UAAU,EAAE;oBACV,KAAK,EAAE,SAAS;oBAChB,WAAW,EAAE,SAAS;oBACtB,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;iBAChE;gBACD,UAAU,EAAE,GAAG;gBACf,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG;gBACjE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,sCAAuC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,qCAAqC,UAAU,EAAE,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAmB,EACnB,KAAoG;IAEpG,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,IAAI,sBAAsB,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,+FAA+F;QAC/F,gEAAgE;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,8EAA8E,EAAE,CAAC;IAC1J,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3F,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAEzF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACzG,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,IAAI,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU;QACV,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/src/services/connections/credential.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @file credential.ts
+ * @description Sealing and opening an outbound connection's credential (TARGET-057). The one place
+ *   a token is turned into ciphertext and back, so there is exactly one place to audit.
+ *
+ *   The whole credential is sealed as a single JSON document rather than field by field. That keeps
+ *   the three shapes (oauth2 / static / session) storable in one column, and it means a future
+ *   provider that needs an extra field does not need a migration to hold it.
+ *
+ *   NOTHING HERE LOGS. A decrypt failure returns null with a caller-facing reason; it never prints
+ *   the ciphertext, the key state or the provider's response. A secret that reaches a log has left
+ *   the node as surely as one that reaches an API response.
+ * @structure sealCredential · openCredential · requireEncryptionKey
+ * @usage import { sealCredential, openCredential } from './credential.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import type { AimeatConfig } from '../../config.js';
+import type { ConnectionCredential } from '../../models/connection-schemas.js';
+/**
+ * The node's master key, or null when none is configured.
+ *
+ * Callers must refuse the whole operation on null rather than continue. There is no degraded mode
+ * here: storing a token in the clear because a key was missing is worse than not storing it, and
+ * extension secrets already take this same path.
+ */
+export declare function requireEncryptionKey(config: AimeatConfig): Buffer | null;
+/** Seal a credential for storage. Returns `iv:tag:ct`. */
+export declare function sealCredential(credential: ConnectionCredential, key: Buffer): string;
+/**
+ * Open a stored credential. Returns null when the ciphertext cannot be read — a rotated key, a
+ * truncated column, a row restored from a backup taken under a different key.
+ *
+ * Null is a legitimate outcome the caller must handle by parking the connection in `needs_reauth`,
+ * because the honest statement to the owner is "reconnect this account", not a 500. Throwing here
+ * would surface as an unhandled error in whatever background job happened to touch it first.
+ */
+export declare function openCredential(ciphertext: string, key: Buffer): ConnectionCredential | null;
+//# sourceMappingURL=credential.d.ts.map

package/dist/src/services/connections/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAExE;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,UAAU,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAoB3F"}

package/dist/src/services/connections/credential.js

@@ -0,0 +1,66 @@
+/**
+ * @file credential.ts
+ * @description Sealing and opening an outbound connection's credential (TARGET-057). The one place
+ *   a token is turned into ciphertext and back, so there is exactly one place to audit.
+ *
+ *   The whole credential is sealed as a single JSON document rather than field by field. That keeps
+ *   the three shapes (oauth2 / static / session) storable in one column, and it means a future
+ *   provider that needs an extra field does not need a migration to hold it.
+ *
+ *   NOTHING HERE LOGS. A decrypt failure returns null with a caller-facing reason; it never prints
+ *   the ciphertext, the key state or the provider's response. A secret that reaches a log has left
+ *   the node as surely as one that reaches an API response.
+ * @structure sealCredential · openCredential · requireEncryptionKey
+ * @usage import { sealCredential, openCredential } from './credential.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import { encrypt, decrypt, getEncryptionKey } from '../encryption.js';
+import { logger } from '../../utils/logger.js';
+/**
+ * The node's master key, or null when none is configured.
+ *
+ * Callers must refuse the whole operation on null rather than continue. There is no degraded mode
+ * here: storing a token in the clear because a key was missing is worse than not storing it, and
+ * extension secrets already take this same path.
+ */
+export function requireEncryptionKey(config) {
+    return getEncryptionKey(config);
+}
+/** Seal a credential for storage. Returns `iv:tag:ct`. */
+export function sealCredential(credential, key) {
+    return encrypt(JSON.stringify(credential), key);
+}
+/**
+ * Open a stored credential. Returns null when the ciphertext cannot be read — a rotated key, a
+ * truncated column, a row restored from a backup taken under a different key.
+ *
+ * Null is a legitimate outcome the caller must handle by parking the connection in `needs_reauth`,
+ * because the honest statement to the owner is "reconnect this account", not a 500. Throwing here
+ * would surface as an unhandled error in whatever background job happened to touch it first.
+ */
+export function openCredential(ciphertext, key) {
+    try {
+        const parsed = JSON.parse(decrypt(ciphertext, key));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const c = parsed;
+        if (typeof c.accessToken !== 'string' || typeof c.shape !== 'string')
+            return null;
+        return {
+            shape: c.shape,
+            accessToken: c.accessToken,
+            ...(typeof c.refreshToken === 'string' ? { refreshToken: c.refreshToken } : {}),
+            ...(c.extra && typeof c.extra === 'object' ? { extra: c.extra } : {}),
+        };
+    }
+    catch {
+        // The FACT is logged; the exception is not. A failed decrypt's message can carry fragments of
+        // the ciphertext, so passing it to the logger would put key material in the log to satisfy a
+        // rule about visibility. An operator needs to know this happened, not what the bytes were —
+        // and the caller adds which connection it was when it parks the row in needs_reauth.
+        logger.warn('connections: a stored credential could not be opened (rotated key, or a backup restored under another key)');
+        return null;
+    }
+}
+//# sourceMappingURL=credential.js.map

package/dist/src/services/connections/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../../../src/services/connections/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAI/C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,UAAgC,EAAE,GAAW;IAC1E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAW;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAY,CAAC;QAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,CAAC,GAAG,MAAuC,CAAC;QAClD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/services/connections/instance.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @file instance.ts
+ * @description Instance-scoped provider support (TARGET-057): normalising a user-supplied instance
+ *   address, and registering this node as an application at that instance on first contact.
+ *
+ *   THE ADDRESS COMES FROM A USER. That single fact drives this whole file. `mastodon.social` is
+ *   typed into a box by whoever is connecting, and the node then makes an HTTP request to it. That
+ *   is an SSRF vector, and the answer is two layers rather than one: normalise and reject
+ *   syntactically here, then let safeFetch apply the network-level rules (private ranges, redirect
+ *   re-validation) on every request that follows.
+ *
+ *   LAZY REGISTRATION. There is no way to know which instance the next user arrives from, and there
+ *   are thousands, so the client credentials cannot be configuration. The node registers itself the
+ *   first time someone connects from an instance and remembers the result, so the second user
+ *   reuses the first user's registration rather than minting a parallel one.
+ * @structure normalizeInstance · registerAtInstance
+ * @usage import { normalizeInstance, registerAtInstance } from './instance.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import type { Storage } from '../../storage/interface.js';
+/** A normalised instance origin, or the reason it was refused. */
+export type InstanceResult = {
+    ok: true;
+    origin: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Normalise `mastodon.social`, `https://mastodon.social/`, `HTTPS://Mastodon.Social` and friends to
+ * one canonical origin, or refuse.
+ *
+ * Canonicalising matters beyond tidiness: the origin is the storage key for the node's registration
+ * at that instance, so two spellings of one instance would register twice and hold two client
+ * secrets for the same place.
+ *
+ * HTTPS is forced rather than accepted-if-offered. An instance reached over http would carry the
+ * user's authorization code in the clear, and accepting `http://` from a text box is also the
+ * easiest way to reach something that is not on the internet at all.
+ */
+export declare function normalizeInstance(raw: string): InstanceResult;
+/** Client credentials this node holds at one instance. */
+export interface InstanceClient {
+    clientId: string;
+    clientSecret: string;
+}
+/**
+ * The node's application registration at `origin`, registering it if this is the first contact.
+ *
+ * Concurrency is handled by the store rather than here: `upsertProviderClient` is insert-if-new and
+ * returns whatever is now there, so two users arriving from one instance at the same moment
+ * converge on a single registration. The loser of that race has registered an application at the
+ * instance that nothing will ever point at, which is untidy at the instance and harmless to us —
+ * the alternative, a lock held across a network call to a stranger's server, is worse.
+ */
+export declare function registerAtInstance(storage: Storage, key: Buffer, provider: string, origin: string, app: {
+    name: string;
+    redirectUri: string;
+    scopes: string[];
+    website: string;
+}): Promise<InstanceClient | {
+    error: string;
+}>;
+//# sourceMappingURL=instance.d.ts.map

package/dist/src/services/connections/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,kEAAkE;AAClE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA6B7D;AAED,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E,OAAO,CAAC,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAkE7C"}