synomem 0.3.0 → 0.5.0

package/dist/config.js

@@ -62,7 +62,14 @@ export const configSchema = policySchema.extend({
     backend: backendSchema,
 });
 export function resolveHome(explicitHome) {
-    const candidate = explicitHome ?? process.env.SYNOMEM_HOME ?? resolve(homedir(), '.agents');
+    /*
+     * `~/.synomem`, resolved as an exact directory.
+     *
+     * No detection of or migration from `~/.agents`: the project is greenfield,
+     * and code that quietly moves somebody's database is worse than a clear
+     * message telling them where the new home is.
+     */
+    const candidate = explicitHome ?? process.env.SYNOMEM_HOME ?? resolve(homedir(), '.synomem');
     if (candidate.includes('\0'))
         throw new SynomemError('UNSAFE_PATH', 'Storage home contains NUL.');
     return resolve(candidate);

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IAC1B,WAAW,EAAE,WAAW;IACxB,iBAAiB,EAAE,WAAW;IAC9B,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,KAAK;IAC/B,kBAAkB,EAAE,KAAK;IACzB,qBAAqB,EAAE,KAAK;IAC5B,UAAU,EAAE;QACV,iBAAiB,EAAE,IAAI;QACvB,mBAAmB,EAAE,IAAI;QACzB,kBAAkB,EAAE,IAAI;QACxB,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CACrB,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/E,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;oBAC3E,CAAC,MAAM,CAAC,QAAQ;oBAChB,CAAC,MAAM,CAAC,QAAQ;oBAChB,CAAC,MAAM,CAAC,MAAM;oBACd,CAAC,MAAM,CAAC,IAAI;oBACZ,MAAM,CAAC,QAAQ,KAAK,GAAG,CACxB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,EACD,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAClF;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC/C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC9B,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;QAChC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;KAC/B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,YAAqB;IAC/C,MAAM,SAAS,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5F,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,UAAmB,EACnB,QAAiC,EACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,wCAAwC,EAAE;YACjF,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB;QAC5B,GAAG,QAAQ;QACX,GAAG,eAAe;QAClB,GAAG,QAAQ;QACX,UAAU,EAAE;YACV,GAAG,QAAQ,CAAC,UAAU;YACtB,GAAG,eAAe,CAAC,UAAU;YAC7B,GAAG,QAAQ,EAAE,UAAU;SACxB;QACD,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,mCAAmC,EAAE;YAC5E,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,UAAmB;IAC1C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAClD,IAAI,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAClF,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC1E,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACrF,MAAM,wBAAwB,GAAG,eAAe,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACjF,MAAM,qBAAqB,GAAG,eAAe,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAgD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IAC1B,WAAW,EAAE,WAAW;IACxB,iBAAiB,EAAE,WAAW;IAC9B,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,KAAK;IAC/B,kBAAkB,EAAE,KAAK;IACzB,qBAAqB,EAAE,KAAK;IAC5B,UAAU,EAAE;QACV,iBAAiB,EAAE,IAAI;QACvB,mBAAmB,EAAE,IAAI;QACzB,kBAAkB,EAAE,IAAI;QACxB,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CACrB,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/E,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;oBAC3E,CAAC,MAAM,CAAC,QAAQ;oBAChB,CAAC,MAAM,CAAC,QAAQ;oBAChB,CAAC,MAAM,CAAC,MAAM;oBACd,CAAC,MAAM,CAAC,IAAI;oBACZ,MAAM,CAAC,QAAQ,KAAK,GAAG,CACxB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,EACD,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAClF;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC/C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;IACrC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC9B,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;QAChC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;KAC/B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,YAAqB;IAC/C;;;;;;OAMG;IACH,MAAM,SAAS,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7F,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,UAAmB,EACnB,QAAiC,EACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,wCAAwC,EAAE;YACjF,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB;QAC5B,GAAG,QAAQ;QACX,GAAG,eAAe;QAClB,GAAG,QAAQ;QACX,UAAU,EAAE;YACV,GAAG,QAAQ,CAAC,UAAU;YACtB,GAAG,eAAe,CAAC,UAAU;YAC7B,GAAG,QAAQ,EAAE,UAAU;SACxB;QACD,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,mCAAmC,EAAE;YAC5E,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,UAAmB;IAC1C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAClD,IAAI,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAClF,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC1E,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACrF,MAAM,wBAAwB,GAAG,eAAe,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACjF,MAAM,qBAAqB,GAAG,eAAe,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAgD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,55 @@
+import { type PromptIo } from './prompt.js';
+export type BackendChoice = 'local' | 'remote';
+export type AuthChoice = 'browser' | 'access-key';
+export type CredentialStoreChoice = 'auto' | 'keychain' | 'file' | 'environment';
+export interface ConfigInitOptions {
+    backend?: BackendChoice;
+    home?: string;
+    auth?: AuthChoice;
+    workspace?: string;
+    accessToken?: string;
+    credentialStore?: CredentialStoreChoice;
+    yes?: boolean;
+}
+export interface ConfigPlan {
+    backend: BackendChoice;
+    home: string;
+    serviceUrl?: string;
+    auth?: AuthChoice;
+    workspaceId?: string;
+    credentialStore?: CredentialStoreChoice;
+}
+/**
+ * Where a credential can actually be kept on this platform.
+ *
+ * Reported rather than assumed: offering macOS Keychain on Linux, or a Secret
+ * Service that is not running, produces a setup that appears to succeed and
+ * then cannot read its own credential back.
+ */
+export declare function credentialStoreChoices(platform?: NodeJS.Platform): Array<{
+    value: CredentialStoreChoice;
+    label: string;
+    detail?: string;
+}>;
+/** Refuses to guess when there is nobody to ask. */
+export declare function assertInteractive(io: PromptIo): void;
+/**
+ * Stores an access key in a restricted file.
+ *
+ * Separate from `config.json` so a configuration file can be read, copied or
+ * pasted into an issue without carrying a secret with it.
+ */
+export declare function writeCredentialFile(home: string, token: string): string;
+/** A key's identifying prefix. Never the key. */
+export declare function credentialFingerprint(token: string): string;
+export declare function environmentInstructions(token: string): string;
+/** The interactive flow, returning the plan it settled on. */
+export declare function runConfigWizard(io: PromptIo, options?: {
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<ConfigPlan>;
+/** Reads an access key without ever accepting it as an argument. */
+export declare function readAccessToken(io: PromptIo): Promise<string>;
+export declare function confirmPlan(io: PromptIo, plan: ConfigPlan): Promise<boolean>;
+export declare function homeExists(home: string): boolean;
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAcA,OAAO,EAAmC,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC;AAEjF,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,KAAK,CAAC;IAAE,KAAK,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuCzE;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAkBpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQvE;AAED,iDAAiD;AACjD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED,8DAA8D;AAC9D,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACvD,OAAO,CAAC,UAAU,CAAC,CAsErB;AAED,oEAAoE;AACpE,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBlF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}

package/dist/configure.js

@@ -0,0 +1,193 @@
+/**
+ * `synomem config` — the onboarding wizard, and its deterministic equivalent.
+ *
+ * Two rules shape this file. Every interactive step has a non-interactive
+ * counterpart, so an agent can configure a machine without a terminal. And the
+ * wizard refuses to run at all when nobody is there to answer: a setup program
+ * that blocks forever on a pipe is worse than one that says which flags it
+ * needs.
+ */
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { cloudApiUrl } from './cloud.js';
+import { SynomemError } from './errors.js';
+import { resolveHome } from './config.js';
+import { ask, askSecret, confirm, select } from './prompt.js';
+/**
+ * Where a credential can actually be kept on this platform.
+ *
+ * Reported rather than assumed: offering macOS Keychain on Linux, or a Secret
+ * Service that is not running, produces a setup that appears to succeed and
+ * then cannot read its own credential back.
+ */
+export function credentialStoreChoices(platform = process.platform) {
+    const native = platform === 'darwin'
+        ? { value: 'keychain', label: 'macOS Keychain', detail: 'Recommended.' }
+        : platform === 'win32'
+            ? /*
+               * Windows has no native option here yet, so the restricted file is
+               * the recommendation rather than Credential Manager. Offering a
+               * store the credential layer cannot actually read back would fail
+               * at the first use, after the wizard had already told the person
+               * their credential was safely stored.
+               */
+                {
+                    value: 'file',
+                    label: 'A restricted file in the Synomem home',
+                    detail: 'Recommended on Windows until Credential Manager support lands.',
+                }
+            : {
+                value: 'keychain',
+                label: 'Secret Service (libsecret)',
+                detail: 'Recommended where a desktop keyring is running.',
+            };
+    return [
+        native,
+        ...(native.value === 'file'
+            ? []
+            : [
+                {
+                    value: 'file',
+                    label: 'A restricted file in the Synomem home',
+                    detail: 'Mode 0600. Use on headless machines with no keyring.',
+                },
+            ]),
+        {
+            value: 'environment',
+            label: 'Print environment-variable instructions',
+            detail: 'Nothing is stored. Synomem never edits your shell profile.',
+        },
+    ];
+}
+/** Refuses to guess when there is nobody to ask. */
+export function assertInteractive(io) {
+    if (io.interactive)
+        return;
+    throw new SynomemError('INVALID_INPUT', [
+        'synomem config needs an interactive terminal.',
+        '',
+        'For automation, use the deterministic form instead:',
+        '',
+        '  synomem config init --backend local --yes',
+        '',
+        '  synomem config init --backend remote --auth access-key \\',
+        '    --workspace <workspace-id> --access-token-stdin --yes',
+        '',
+        'Pipe the token in rather than passing it as an argument: an argument is',
+        'kept by both the shell history and the process list.',
+    ].join('\n'));
+}
+/**
+ * Stores an access key in a restricted file.
+ *
+ * Separate from `config.json` so a configuration file can be read, copied or
+ * pasted into an issue without carrying a secret with it.
+ */
+export function writeCredentialFile(home, token) {
+    const directory = join(home, 'credentials');
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    chmodSync(directory, 0o700);
+    const path = join(directory, 'installation.json');
+    writeFileSync(path, `${JSON.stringify({ accessToken: token }, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return path;
+}
+/** A key's identifying prefix. Never the key. */
+export function credentialFingerprint(token) {
+    const head = token.slice(0, 12);
+    return `${head}${token.length > 12 ? '\u2026' : ''}`;
+}
+export function environmentInstructions(token) {
+    return [
+        'Set this value for the current shell:',
+        '',
+        `  export SYNOMEM_ACCESS_TOKEN='${token}'`,
+        '',
+        'To persist it, add that to a secret-aware shell configuration or to your',
+        'agent runtime environment. Synomem will not edit your shell profile for',
+        'you: silently rewriting a dotfile is not a thing a setup program should do.',
+    ].join('\n');
+}
+/** The interactive flow, returning the plan it settled on. */
+export async function runConfigWizard(io, options = {}) {
+    assertInteractive(io);
+    const env = options.env ?? process.env;
+    io.output.write([
+        '',
+        'Welcome to Synomem',
+        '',
+        'Synomem gives agents durable notes, messages, tasks, todos, kudos,',
+        'and shared coordination.',
+        '',
+    ].join('\n'));
+    const backend = await select(io, 'Where should Synomem store canonical state?', [
+        {
+            value: 'local',
+            label: 'Local \u2014 SQLite on this machine',
+            detail: 'Nothing is uploaded. One implicit workspace.',
+        },
+        {
+            value: 'remote',
+            label: 'Synomem Cloud \u2014 shared across machines and agents',
+            detail: 'Organizations, workspaces, roles and administration.',
+        },
+    ]);
+    const home = await ask(io, 'Where should Synomem store its data?', resolveHome(options.home));
+    if (backend === 'local') {
+        return { backend, home };
+    }
+    const serviceUrl = cloudApiUrl(env);
+    io.output.write(`\nConnecting to Synomem Cloud at ${serviceUrl}\n`);
+    const auth = await select(io, 'How would you like to sign in?', [
+        {
+            value: 'browser',
+            label: 'Sign in with your browser',
+            detail: 'Opens the authorization server and returns through a loopback callback.',
+        },
+        {
+            value: 'access-key',
+            label: 'Use an installation access key',
+            detail: 'Create one at https://portal.synomem.ai/installations',
+        },
+    ]);
+    /*
+     * Deliberately no workspace prompt here.
+     *
+     * A hosted workspace ID looks like `ws-04psqx2rkt8ttft7a1t2z69r97`, and the
+     * credential authorized in the next step already knows which workspace it
+     * reaches -- an installation key is bound to exactly one, and a browser
+     * sign-in can list the ones the account belongs to. Asking first means
+     * asking a person to go and look something up that we are about to be told.
+     */
+    const credentialStore = auth === 'access-key'
+        ? await select(io, 'Where should Synomem store this credential?', credentialStoreChoices())
+        : 'auto';
+    return { backend, home, serviceUrl, auth, credentialStore };
+}
+/** Reads an access key without ever accepting it as an argument. */
+export async function readAccessToken(io) {
+    const token = await askSecret(io, 'Installation access key');
+    if (!token)
+        throw new SynomemError('INVALID_INPUT', 'No access key was provided.');
+    return token;
+}
+export async function confirmPlan(io, plan) {
+    io.output.write([
+        '',
+        'Synomem will be configured as:',
+        '',
+        `  Backend:   ${plan.backend === 'local' ? 'Local SQLite' : 'Synomem Cloud'}`,
+        `  Home:      ${plan.home}`,
+        ...(plan.serviceUrl ? [`  Service:   ${plan.serviceUrl}`] : []),
+        ...(plan.workspaceId ? [`  Workspace: ${plan.workspaceId}`] : []),
+        ...(plan.credentialStore && plan.credentialStore !== 'auto'
+            ? [`  Credential: ${plan.credentialStore}`]
+            : []),
+        '',
+    ].join('\n'));
+    return await confirm(io, 'Apply this?');
+}
+export function homeExists(home) {
+    return existsSync(home);
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AAyB7E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GACV,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE;QACjF,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC;;;;;;iBAMG;gBACH;oBACE,KAAK,EAAE,MAAe;oBACtB,KAAK,EAAE,uCAAuC;oBAC9C,MAAM,EAAE,gEAAgE;iBACzE;YACH,CAAC,CAAC;gBACE,KAAK,EAAE,UAAmB;gBAC1B,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,iDAAiD;aAC1D,CAAC;IACV,OAAO;QACL,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,KAAK,EAAE,MAAe;oBACtB,KAAK,EAAE,uCAAuC;oBAC9C,MAAM,EAAE,sDAAsD;iBAC/D;aACF,CAAC;QACN;YACE,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,yCAAyC;YAChD,MAAM,EAAE,4DAA4D;SACrE;KACF,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,EAAY;IAC5C,IAAI,EAAE,CAAC,WAAW;QAAE,OAAO;IAC3B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf;QACE,+CAA+C;QAC/C,EAAE;QACF,qDAAqD;QACrD,EAAE;QACF,6CAA6C;QAC7C,EAAE;QACF,6DAA6D;QAC7D,2DAA2D;QAC3D,EAAE;QACF,yEAAyE;QACzE,sDAAsD;KACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO;QACL,uCAAuC;QACvC,EAAE;QACF,kCAAkC,KAAK,GAAG;QAC1C,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAY,EACZ,UAAsD,EAAE;IAExD,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,oEAAoE;QACpE,0BAA0B;QAC1B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAgB,EAAE,EAAE,6CAA6C,EAAE;QAC7F;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,qCAAqC;YAC5C,MAAM,EAAE,8CAA8C;SACvD;QACD;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,wDAAwD;YAC/D,MAAM,EAAE,sDAAsD;SAC/D;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,sCAAsC,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9F,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,UAAU,IAAI,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAa,EAAE,EAAE,gCAAgC,EAAE;QAC1E;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,yEAAyE;SAClF;QACD;YACE,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,gCAAgC;YACvC,MAAM,EAAE,uDAAuD;SAChE;KACF,CAAC,CAAC;IAEH;;;;;;;;OAQG;IAEH,MAAM,eAAe,GACnB,IAAI,KAAK,YAAY;QACnB,CAAC,CAAC,MAAM,MAAM,CACV,EAAE,EACF,6CAA6C,EAC7C,sBAAsB,EAAE,CACzB;QACH,CAAC,CAAC,MAAM,CAAC;IAEb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC9D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAY;IAChD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,IAAgB;IAC9D,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,gBAAgB,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7E,gBAAgB,IAAI,CAAC,IAAI,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,KAAK,MAAM;YACzD,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,MAAM,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/credentials.d.ts

@@ -1,4 +1,17 @@
 import type { ActorIdentity } from './types.js';
+/**
+ * An installation access key.
+ *
+ * Not an OAuth credential: it has no refresh, no token endpoint and no client,
+ * and it authorizes a MACHINE rather than a person. Keeping it a distinct shape
+ * stops code treating it as refreshable, which would mean silently failing to
+ * renew something that never expires that way.
+ */
+export interface StoredInstallationKey {
+    kind: 'installation-key';
+    accessToken: string;
+}
+export type StoredCredential = StoredOAuthCredential | StoredInstallationKey;
 export interface StoredOAuthCredential {
     accessToken: string;
     refreshToken?: string;
@@ -9,8 +22,8 @@ export interface StoredOAuthCredential {
     scope: string;
 }
 export interface CredentialStore {
-    get(reference: string): Promise<StoredOAuthCredential | undefined>;
-    set(reference: string, credential: StoredOAuthCredential): Promise<void>;
+    get(reference: string): Promise<StoredCredential | undefined>;
+    set(reference: string, credential: StoredCredential): Promise<void>;
     delete(reference: string): Promise<boolean>;
 }
 export declare function credentialReference(baseUrl: string, workspaceId: string, actor: ActorIdentity): string;

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IACnE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,GACnB,MAAM,CAUR;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;AAqD5B,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;gBAElC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,uBAAuB,CAAA;KAAO;IAKjF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAkBlE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCxE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBjD,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAC9D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,GACnB,MAAM,CAUR;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;AAqD5B,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;gBAElC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,uBAAuB,CAAA;KAAO;IAKjF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAkBlE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCxE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBjD,OAAO,CAAC,WAAW;CAQpB"}

package/dist/credentials.js

@@ -120,8 +120,16 @@ export class OsCredentialStore {
                 : this.unsupported();
         return result.code === 0;
     }
+    /*
+     * Windows Credential Manager is not implemented yet. `cmdkey` can write a
+     * generic credential but deliberately will not read the secret back, so a
+     * store built on it would accept a credential and then never return it --
+     * worse than saying so plainly.
+     */
     unsupported() {
-        throw new SynomemError('CONFIG_INVALID', 'Interactive credential storage is currently supported on macOS and Linux with secret-tool.');
+        throw new SynomemError('CONFIG_INVALID', this.platform === 'win32'
+            ? 'Windows Credential Manager storage is not supported yet. Run `synomem config init` and choose the restricted-file store, or set SYNOMEM_ACCESS_TOKEN.'
+            : 'Operating-system credential storage needs the macOS Keychain, or secret-tool on Linux. Run `synomem config init` and choose the restricted-file store, or set SYNOMEM_ACCESS_TOKEN.');
     }
 }
 //# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAkBtC,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,WAAmB,EACnB,KAAoB;IAEpB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM;QAChC,WAAW;QACX,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KAC1C,CAAC,CACH;SACA,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAcD,KAAK,UAAU,OAAO,CACpB,UAAkB,EAClB,UAAoB,EACpB,KAAc;IAEd,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YACtD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,OAAO,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE,IAAI,IAAI,CAAC;SAChB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmC,CAAC;QACnE,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,MAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAkB;IAC1B,GAAG,CAA0B;IAE9C,YAAY,UAAyE,EAAE;QACrF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,uBAAuB;gBACvB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAAiC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,mBAAmB,EACnB;gBACE,sBAAsB;gBACtB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;gBACJ,0BAA0B;gBAC1B,IAAI;gBACJ,IAAI;aACL,EACD,GAAG,UAAU,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,aAAa,EACb;oBACE,OAAO;oBACP,kCAAkC;oBAClC,SAAS;oBACT,WAAW;oBACX,SAAS;oBACT,SAAS;iBACV,EACD,UAAU,CACX;gBACH,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,yBAAyB;gBACzB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;aACZ,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW;QACjB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,4FAA4F,CAC7F,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAiCtC,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,WAAmB,EACnB,KAAoB;IAEpB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM;QAChC,WAAW;QACX,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KAC1C,CAAC,CACH;SACA,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAcD,KAAK,UAAU,OAAO,CACpB,UAAkB,EAClB,UAAoB,EACpB,KAAc;IAEd,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YACtD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,OAAO,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE,IAAI,IAAI,CAAC;SAChB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmC,CAAC;QACnE,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,MAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAkB;IAC1B,GAAG,CAA0B;IAE9C,YAAY,UAAyE,EAAE;QACrF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,uBAAuB;gBACvB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAAiC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,mBAAmB,EACnB;gBACE,sBAAsB;gBACtB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;gBACJ,0BAA0B;gBAC1B,IAAI;gBACJ,IAAI;aACL,EACD,GAAG,UAAU,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,aAAa,EACb;oBACE,OAAO;oBACP,kCAAkC;oBAClC,SAAS;oBACT,WAAW;oBACX,SAAS;oBACT,SAAS;iBACV,EACD,UAAU,CACX;gBACH,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,yBAAyB;gBACzB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;aACZ,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,WAAW;QACjB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,IAAI,CAAC,QAAQ,KAAK,OAAO;YACvB,CAAC,CAAC,uJAAuJ;YACzJ,CAAC,CAAC,qLAAqL,CAC1L,CAAC;IACJ,CAAC;CACF"}

package/dist/discover.d.ts

@@ -0,0 +1,48 @@
+export interface DiscoveredWorkspace {
+    id: string;
+    displayName: string;
+}
+export interface DiscoveredOrganization {
+    id: string;
+    slug: string;
+    displayName: string;
+    role: string;
+    workspaces: DiscoveredWorkspace[];
+}
+export interface DiscoveryOptions {
+    baseUrl: string;
+    accessToken: string;
+    /** Injected by tests. Defaults to the global fetch. */
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+}
+/**
+ * The single workspace an installation access key can address.
+ *
+ * Answered by the data plane rather than the control plane: an installation key
+ * is not an account principal, so it cannot list organizations, but it can
+ * always say where it is bound.
+ */
+export declare function discoverBoundWorkspace(options: DiscoveryOptions): Promise<{
+    workspaceId: string;
+    actor: {
+        kind: string;
+        id: string;
+        displayName?: string;
+    };
+}>;
+/**
+ * Every organization this account belongs to, each with its workspaces.
+ *
+ * Organizations are listed even when they hold no workspaces yet, because
+ * "you belong to this organization and it is empty" is a different and more
+ * useful answer than omitting it and appearing to have found nothing.
+ */
+export declare function discoverOrganizations(options: DiscoveryOptions): Promise<DiscoveredOrganization[]>;
+/** Flattens discovery into the choices a person picks from. */
+export declare function workspaceChoices(organizations: DiscoveredOrganization[]): Array<{
+    value: string;
+    label: string;
+    detail?: string;
+}>;
+//# sourceMappingURL=discover.d.ts.map

package/dist/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA2CD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAS7F;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAsBnC;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,sBAAsB,EAAE,GACtC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1D"}

package/dist/discover.js

@@ -0,0 +1,106 @@
+/*
+ * Finding out which workspace a credential belongs to, so nobody has to type
+ * one from memory.
+ *
+ * A hosted workspace ID looks like `ws-04psqx2rkt8ttft7a1t2z69r97`. Asking a
+ * person to enter that during setup is asking them to leave and go find it, and
+ * the credential they just authorized already knows the answer -- or knows
+ * enough to offer a short list.
+ *
+ * Two credentials, two routes, because they carry different authority:
+ *
+ *   An installation access key is bound to exactly one workspace. There is
+ *   nothing to choose, so `discoverBoundWorkspace` reads it off the data plane
+ *   and setup asks nothing at all.
+ *
+ *   A browser sign-in authorizes an ACCOUNT, which may reach several
+ *   organizations, each with several workspaces. `discoverOrganizations` lists
+ *   them for selection.
+ */
+import { SynomemError } from './errors.js';
+async function readJson(options, path) {
+    const request = options.fetch ?? globalThis.fetch;
+    const url = new URL(path, options.baseUrl.endsWith('/') ? options.baseUrl : `${options.baseUrl}/`);
+    let response;
+    try {
+        response = await request(url, {
+            headers: { authorization: `Bearer ${options.accessToken}`, accept: 'application/json' },
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+    }
+    catch (error) {
+        throw new SynomemError('REMOTE_UNAVAILABLE', `Could not reach ${url.origin}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new SynomemError('REMOTE_PROTOCOL', `${url.pathname} did not return JSON.`);
+    }
+    if (!response.ok || body.ok !== true || body.data === undefined) {
+        // 401 and 403 are the ones a person can act on, so they keep their own
+        // codes rather than being flattened into a generic protocol error.
+        const code = response.status === 401 ? 'AUTH_REQUIRED' : response.status === 403 ? 'AUTH_FORBIDDEN' : null;
+        const message = body.error?.message ?? `${url.pathname} returned ${response.status}.`;
+        throw new SynomemError(code ?? 'REMOTE_PROTOCOL', message);
+    }
+    return body.data;
+}
+/**
+ * The single workspace an installation access key can address.
+ *
+ * Answered by the data plane rather than the control plane: an installation key
+ * is not an account principal, so it cannot list organizations, but it can
+ * always say where it is bound.
+ */
+export async function discoverBoundWorkspace(options) {
+    const identity = await readJson(options, 'v1/identity');
+    if (!identity.workspaceId) {
+        throw new SynomemError('REMOTE_PROTOCOL', 'The service did not report a bound workspace.');
+    }
+    return { workspaceId: identity.workspaceId, actor: identity.actor };
+}
+/**
+ * Every organization this account belongs to, each with its workspaces.
+ *
+ * Organizations are listed even when they hold no workspaces yet, because
+ * "you belong to this organization and it is empty" is a different and more
+ * useful answer than omitting it and appearing to have found nothing.
+ */
+export async function discoverOrganizations(options) {
+    const me = await readJson(options, 'v1/me');
+    const organizations = [];
+    for (const organization of me.organizations ?? []) {
+        const workspaces = await readJson(options, `v1/organizations/${encodeURIComponent(organization.id)}/workspaces`);
+        organizations.push({
+            id: organization.id,
+            slug: organization.slug,
+            displayName: organization.displayName,
+            role: organization.role,
+            workspaces: (workspaces ?? []).map((workspace) => ({
+                id: workspace.id,
+                displayName: workspace.displayName,
+            })),
+        });
+    }
+    return organizations;
+}
+/** Flattens discovery into the choices a person picks from. */
+export function workspaceChoices(organizations) {
+    const choices = [];
+    for (const organization of organizations) {
+        for (const workspace of organization.workspaces) {
+            choices.push({
+                value: workspace.id,
+                // The organization is part of the label, not the detail: two
+                // organizations may both have a workspace called "Production", and the
+                // label is the only part a person is guaranteed to read.
+                label: `${organization.displayName} / ${workspace.displayName}`,
+                detail: workspace.id,
+            });
+        }
+    }
+    return choices;
+}
+//# sourceMappingURL=discover.js.map

package/dist/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA6B3C,KAAK,UAAU,QAAQ,CAAI,OAAyB,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,EACJ,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,CACxE,CAAC;IACF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mBAAmB,GAAG,CAAC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,QAAQ,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtF,MAAM,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAG5B,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,QAAQ,CAEtB,OAAO,EAAE,OAAO,CAAC,CAAC;IACrB,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,YAAY,IAAI,EAAE,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,OAAO,EACP,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CACrE,CAAC;QACF,aAAa,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACjD,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,WAAW,EAAE,SAAS,CAAC,WAAW;aACnC,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAC9B,aAAuC;IAEvC,MAAM,OAAO,GAA6D,EAAE,CAAC;IAC7E,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,SAAS,CAAC,EAAE;gBACnB,6DAA6D;gBAC7D,uEAAuE;gBACvE,yDAAyD;gBACzD,KAAK,EAAE,GAAG,YAAY,CAAC,WAAW,MAAM,SAAS,CAAC,WAAW,EAAE;gBAC/D,MAAM,EAAE,SAAS,CAAC,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}