@abloatai/transaction 0.37.0

package/dist/auth/apiKey.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Authentication and URL resolution for the `Ablo()` client.
+ *
+ * Each function here makes one decision: it resolves a configuration value with
+ * the right precedence, or fails with an actionable message. Together they let
+ * the client constructor read as a sequence of named steps rather than a chain
+ * of fallbacks.
+ *
+ * The environment surface is deliberately small: `ABLO_API_KEY` is the only
+ * value read from the environment. Every other routing or authentication
+ * override is an explicit option, so an app never picks up hidden behavior from
+ * a stray environment variable.
+ */
+import type { KeyEnvironment } from '../environment.js';
+import { type CredentialProvider } from './credentialResult.js';
+import { assertBrowserSafety } from './browserCredentialSafety.js';
+export { assertBrowserSafety };
+/**
+ * The credential-resolver callable type. It is defined alongside
+ * {@link createEndpointCredentialResolver} in `./credentialEndpoint` and
+ * re-exported here so importers of this module keep working. See that module
+ * for the full contract.
+ */
+export type { CredentialProvider } from './credentialResult.js';
+/**
+ * The client options that decide a credential.
+ *
+ * This is the ONE declaration of that set. The resolvers below read it, and the
+ * transport configs that accept these options derive from it rather than listing
+ * the fields again — a second list is how `authEndpoint` came to be supported at
+ * runtime, named in an error message, and absent from the type a caller writes
+ * against.
+ */
+export interface AuthClientOptions {
+    readonly apiKey?: string | CredentialProvider | null;
+    /** A route that mints the token, instead of a key the process holds. */
+    readonly authEndpoint?: string | CredentialProvider | null;
+    /** A token the caller already has, used as-is. */
+    readonly authToken?: string | null;
+    readonly baseURL?: string | null;
+    readonly dangerouslyAllowBrowser?: boolean;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly authTimeoutMs?: number;
+    readonly allowCrossOriginAuthEndpoint?: boolean;
+}
+export interface AuthResolveInput {
+    /**
+     * The full set of options the caller passed to the client constructor. Each
+     * resolver reads only the fields it needs; passing the whole object avoids
+     * threading many separate parameters through every helper.
+     */
+    readonly options: AuthClientOptions;
+    readonly env: Record<string, string | undefined>;
+}
+/**
+ * Read `process.env` defensively. Works in browser (where `process`
+ * is undefined), Node, and edge runtimes that expose a partial
+ * process polyfill.
+ */
+export declare function readProcessEnv(): Record<string, string | undefined>;
+export declare function resolveApiKey(input: AuthResolveInput): string | CredentialProvider | null;
+/**
+ * Narrow a resolved `apiKey` to the single resolver the credential lifecycle
+ * needs: an async `() => token | null`, or `null` when auth is static — a plain
+ * long-lived key string with no refresh, which is the common case.
+ *
+ * The short-lived per-user browser path passes a credential provider, and the
+ * SDK then drives the whole credential lifecycle
+ * from it: mint-before-connect, the proactive refresh timer with its
+ * wake/online/focus re-mint, and the reactive `credential_stale` re-mint. The
+ * resolver follows the provider contract end to end: resolve a token,
+ * resolve `null` when the login is gone (terminal — surfaces `session_expired`
+ * and signs the user out), or throw on a transient failure (backs off, without
+ * signing out).
+ */
+export declare function resolveCredentialResolver(apiKey: string | CredentialProvider | null): CredentialProvider | null;
+export declare function resolveAuthToken(input: AuthResolveInput): string | null;
+/**
+ * The credential axis, not a second copy of it. `environment.ts` documents two
+ * incidents caused by conflating the plane a request runs on with the mode a
+ * credential was minted in, and states the credential axis must not grow when
+ * planes do — so the CLI mismatch path reads the canonical vocabulary rather
+ * than restating its members here.
+ */
+type CliMode = KeyEnvironment;
+type StaticApiKeySource = 'option' | 'env';
+interface StaticApiKey {
+    readonly key: string;
+    readonly source: StaticApiKeySource;
+}
+interface CliCredentialSnapshot {
+    readonly mode: CliMode;
+    readonly activeProfile: string;
+    readonly storedKey?: string;
+}
+export interface CliKeyMismatch {
+    readonly source: StaticApiKeySource;
+    readonly configuredKeyPrefix: string;
+    readonly configuredMode?: CliMode;
+    readonly cliMode: CliMode;
+    readonly storedKeyPrefix?: string;
+    readonly kind: 'mode_mismatch' | 'key_override';
+    readonly message: string;
+}
+/** Infer the sandbox or production mode from an Ablo key's prefix. */
+export declare function modeFromApiKey(key: string): CliMode | undefined;
+export declare function describeCliKeyMismatch(configured: StaticApiKey, cli: CliCredentialSnapshot): CliKeyMismatch | null;
+export declare function warnIfCliKeyMismatch(input: AuthResolveInput, warn?: (message: string) => void): Promise<void>;
+export { ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, ABLO_DEFAULT_BASE_URL } from './hostedEndpoints.js';
+/**
+ * Normalizes older hosted host names to the current public API domain.
+ * Self-hosted or custom URLs pass through unchanged; only the retired
+ * first-party host names are rewritten.
+ */
+export declare function normalizeAbloHostedBaseUrl(rawUrl: string): string;
+export declare function resolveBaseURL(input: AuthResolveInput): string;
+/**
+ * Guards against using a secret `apiKey` in a browser. A secret key is
+ * server-side only by default: shipping an `sk_live_...` key to a browser would
+ * expose it in every visitor's network tab. Callers opt in explicitly when the
+ * browser instead holds a minted session token (`ek_`/`rk_`) or routes through a
+ * server proxy. Throws {@link AbloAuthenticationError} when a secret key is
+ * detected in a browser without opt-in.
+ */
+/**
+ * Rejects the REMOVED `databaseUrl` dial-in option loudly. The option is gone
+ * from the types, but an untyped or stale caller could still pass it — and
+ * silently ignoring it would reroute their writes to Ablo-hosted storage,
+ * the opposite of what that option used to promise. A construction-time throw
+ * turns a wrong-storage surprise into a clear migration instruction.
+ */
+export declare function rejectRemovedDatabaseUrlOption(options: object): void;
+/**
+ * Resolves a credential provider to its current string value, or
+ * returns a plain string key as-is. Called at request time so a rotating
+ * credential picks up new values between requests. Returns `null` when no key
+ * was configured.
+ */
+export declare function resolveApiKeyValue(apiKey: string | CredentialProvider | null): Promise<string | null>;
+/**
+ * Translates a WebSocket URL into the matching HTTP API base URL, defaulting to
+ * `${url}/api` when the caller has not overridden `bootstrapBaseUrl`. The
+ * bootstrap helper, the hydration coordinator, the credential-exchange flow, and
+ * the identity flow all derive their base URL through this one function, so the
+ * derivation stays consistent across them.
+ *
+ * When both `wss://` and `https://` are valid, the ws-to-http rewrite preserves
+ * the protocol family: ws becomes http and wss becomes https.
+ */
+export declare function resolveBootstrapBaseUrl(input: {
+    readonly url: string;
+    readonly bootstrapBaseUrl?: string;
+}): string;
+//# sourceMappingURL=apiKey.d.ts.map

package/dist/auth/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../src/auth/apiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;;GAKG;AACH,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACrD,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;IAC3D,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAKnE;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,gBAAgB,GACtB,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAkDpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,GACzC,kBAAkB,GAAG,IAAI,CAG3B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAEvE;AAED;;;;;;GAMG;AACH,KAAK,OAAO,GAAG,cAAc,CAAC;AAC9B,KAAK,kBAAkB,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3C,UAAU,YAAY;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAI/D;AAiID,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,YAAY,EACxB,GAAG,EAAE,qBAAqB,GACzB,cAAc,GAAG,IAAI,CAsCvB;AAID,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAID,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAShH;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAiCjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAUpE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,GACzC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,MAAM,CAYT"}

package/dist/auth/apiKey.js

@@ -0,0 +1,408 @@
+/**
+ * Authentication and URL resolution for the `Ablo()` client.
+ *
+ * Each function here makes one decision: it resolves a configuration value with
+ * the right precedence, or fails with an actionable message. Together they let
+ * the client constructor read as a sequence of named steps rather than a chain
+ * of fallbacks.
+ *
+ * The environment surface is deliberately small: `ABLO_API_KEY` is the only
+ * value read from the environment. Every other routing or authentication
+ * override is an explicit option, so an app never picks up hidden behavior from
+ * a stray environment variable.
+ */
+import { AbloValidationError } from '../errors.js';
+import { ABLO_HOSTED_API_DOMAIN, ABLO_DEFAULT_BASE_URL } from './hostedEndpoints.js';
+import { isCredentialEndpoint, createEndpointCredentialResolver } from './credentialEndpoint.js';
+import { credentialToken, } from './credentialResult.js';
+import { assertBrowserSafety, protectBrowserCredentialProvider, } from './browserCredentialSafety.js';
+export { assertBrowserSafety };
+/**
+ * Read `process.env` defensively. Works in browser (where `process`
+ * is undefined), Node, and edge runtimes that expose a partial
+ * process polyfill.
+ */
+export function readProcessEnv() {
+    const maybeGlobal = globalThis;
+    return maybeGlobal.process?.env ?? {};
+}
+export function resolveApiKey(input) {
+    // `authEndpoint` is the option that names a session-mint route: a URL the
+    // client exchanges for a short-lived token, or an async resolver for custom
+    // exchanges. It is resolved into a `CredentialProvider` here — the single point
+    // shared by every client variant (WebSocket, HTTP, and protocol clients) — so
+    // every downstream consumer sees the same resolver and the credential
+    // lifecycle drives renewal off it.
+    const endpoint = input.options.authEndpoint;
+    const configured = input.options.apiKey;
+    if (endpoint != null) {
+        if (configured != null) {
+            throw new AbloValidationError('Ablo: pass either `apiKey` (a key the process holds) or `authEndpoint` ' +
+                '(a route that mints the token) — not both; the client cannot know ' +
+                'which credential to use.', { code: 'invalid_options', param: 'authEndpoint' });
+        }
+        if (typeof endpoint === 'function') {
+            return protectBrowserCredentialProvider(endpoint, input.options.dangerouslyAllowBrowser);
+        }
+        if (!isCredentialEndpoint(endpoint)) {
+            throw new AbloValidationError('`authEndpoint` expects a URL or path (e.g. \'/api/ablo-session\') or an ' +
+                'async resolver — a key string belongs in `apiKey`.', { code: 'invalid_options', param: 'authEndpoint' });
+        }
+        return protectBrowserCredentialProvider(createEndpointCredentialResolver(endpoint, {
+            fetch: input.options.fetch,
+            timeoutMs: input.options.authTimeoutMs,
+            allowCrossOrigin: input.options.allowCrossOriginAuthEndpoint,
+        }), input.options.dangerouslyAllowBrowser);
+    }
+    if (typeof configured === 'string' && isCredentialEndpoint(configured)) {
+        throw new AbloValidationError('`apiKey` no longer accepts an endpoint. Move this value to `authEndpoint`.', { code: 'invalid_options', param: 'apiKey' });
+    }
+    if (typeof configured === 'function') {
+        return protectBrowserCredentialProvider(configured, input.options.dangerouslyAllowBrowser);
+    }
+    return configured ?? input.env.ABLO_API_KEY ?? null;
+}
+/**
+ * Narrow a resolved `apiKey` to the single resolver the credential lifecycle
+ * needs: an async `() => token | null`, or `null` when auth is static — a plain
+ * long-lived key string with no refresh, which is the common case.
+ *
+ * The short-lived per-user browser path passes a credential provider, and the
+ * SDK then drives the whole credential lifecycle
+ * from it: mint-before-connect, the proactive refresh timer with its
+ * wake/online/focus re-mint, and the reactive `credential_stale` re-mint. The
+ * resolver follows the provider contract end to end: resolve a token,
+ * resolve `null` when the login is gone (terminal — surfaces `session_expired`
+ * and signs the user out), or throw on a transient failure (backs off, without
+ * signing out).
+ */
+export function resolveCredentialResolver(apiKey) {
+    if (typeof apiKey === 'function')
+        return apiKey;
+    return null;
+}
+export function resolveAuthToken(input) {
+    return input.options.authToken ?? null;
+}
+function keyPrefix(key) {
+    return `${key.slice(0, 12)}…`;
+}
+/** Infer the sandbox or production mode from an Ablo key's prefix. */
+export function modeFromApiKey(key) {
+    if (/^(sk|rk)_test_/.test(key))
+        return 'sandbox';
+    if (/^(sk|rk)_live_/.test(key))
+        return 'production';
+    return undefined;
+}
+function resolveStaticApiKey(input) {
+    if (typeof input.options.apiKey === 'string') {
+        return { key: input.options.apiKey, source: 'option' };
+    }
+    if (input.options.apiKey !== undefined && input.options.apiKey !== null) {
+        return null;
+    }
+    const envKey = input.env.ABLO_API_KEY;
+    if (typeof envKey === 'string' && envKey.length > 0) {
+        return { key: envKey, source: 'env' };
+    }
+    return null;
+}
+function readProfileKeys(value) {
+    if (!value || typeof value !== 'object')
+        return {};
+    const profiles = {};
+    for (const [name, raw] of Object.entries(value)) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const row = raw;
+        const sandbox = row.sandbox;
+        const production = row.production;
+        profiles[name] = {
+            sandbox: sandbox && typeof sandbox === 'object' ? sandbox : undefined,
+            production: production && typeof production === 'object' ? production : undefined,
+        };
+    }
+    return profiles;
+}
+function legacyProfileKeys(value) {
+    if (!value)
+        return { sandbox: undefined, production: undefined };
+    const sandbox = value.sandbox;
+    const production = value.production;
+    if ((sandbox && typeof sandbox === 'object') ||
+        (production && typeof production === 'object')) {
+        return {
+            sandbox: sandbox && typeof sandbox === 'object' ? sandbox : undefined,
+            production: production && typeof production === 'object' ? production : undefined,
+        };
+    }
+    if (typeof value.apiKey === 'string') {
+        return { sandbox: { apiKey: value.apiKey }, production: undefined };
+    }
+    return { sandbox: undefined, production: undefined };
+}
+function normalizeCliMode(value) {
+    return value === 'sandbox' || value === 'production' ? value : undefined;
+}
+function activeProjectSlug(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const slug = value.slug;
+    return typeof slug === 'string' && slug.length > 0 ? slug : undefined;
+}
+function importNodeBuiltin(specifier) {
+    // Node-only runtime import (CLI credential snapshot). The call is dead in
+    // browser/edge builds — guarded by `process.versions.node` and `window`
+    // checks in the callers — but bundlers still try to resolve the dynamic
+    // `import()` and Turbopack fails the build on the unanalyzable specifier.
+    // The magic comments tell each bundler to emit the import verbatim and never
+    // resolve it. Keep both so webpack and Turbopack consumers are covered.
+    return import(/* webpackIgnore: true */ /* turbopackIgnore: true */ specifier);
+}
+async function readJsonIfPresent(path) {
+    try {
+        const { readFile } = await importNodeBuiltin('node:fs/promises');
+        const text = await readFile(path, 'utf8');
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readCliCredentialSnapshot(env) {
+    const processLike = globalThis.process;
+    if (!processLike?.versions?.node)
+        return null;
+    if (typeof window !== 'undefined')
+        return null;
+    const [{ homedir }, { join }] = await Promise.all([
+        importNodeBuiltin('node:os'),
+        importNodeBuiltin('node:path'),
+    ]);
+    const dir = env.ABLO_CONFIG_DIR
+        ?? (env.XDG_CONFIG_HOME ? join(env.XDG_CONFIG_HOME, 'ablo') : join(homedir(), '.config', 'ablo'));
+    const [cfg, creds] = await Promise.all([
+        readJsonIfPresent(join(dir, 'config.json')),
+        readJsonIfPresent(join(dir, 'credentials.json')),
+    ]);
+    const mode = normalizeCliMode(cfg?.mode) ?? normalizeCliMode(creds?.mode);
+    const activeProfile = activeProjectSlug(cfg?.activeProject) ?? 'default';
+    const profiles = {
+        ...readProfileKeys(creds?.profiles),
+        ...readProfileKeys(cfg?.profiles),
+    };
+    if (!profiles[activeProfile]) {
+        const legacy = { ...legacyProfileKeys(cfg), ...legacyProfileKeys(creds) };
+        if (legacy.sandbox?.apiKey || legacy.production?.apiKey) {
+            profiles[activeProfile] = legacy;
+        }
+    }
+    const effectiveMode = mode ?? (Object.keys(profiles).length > 0 ? 'sandbox' : undefined);
+    if (!effectiveMode)
+        return null;
+    return {
+        mode: effectiveMode,
+        activeProfile,
+        ...(profiles[activeProfile]?.[effectiveMode]?.apiKey
+            ? { storedKey: profiles[activeProfile][effectiveMode].apiKey }
+            : {}),
+    };
+}
+export function describeCliKeyMismatch(configured, cli) {
+    const configuredMode = modeFromApiKey(configured.key);
+    const configuredKeyPrefix = keyPrefix(configured.key);
+    const storedKeyPrefix = cli.storedKey ? keyPrefix(cli.storedKey) : undefined;
+    const sourceLabel = configured.source === 'env' ? 'ABLO_API_KEY' : 'configured apiKey';
+    if (configuredMode && configuredMode !== cli.mode) {
+        return {
+            source: configured.source,
+            configuredKeyPrefix,
+            configuredMode,
+            cliMode: cli.mode,
+            ...(storedKeyPrefix ? { storedKeyPrefix } : {}),
+            kind: 'mode_mismatch',
+            message: `${sourceLabel} is a ${configuredMode} key (${configuredKeyPrefix}) but the Ablo CLI is in ` +
+                `${cli.mode} mode${storedKeyPrefix ? ` (active stored key ${storedKeyPrefix})` : ''}. ` +
+                `Requests will use ${configuredMode}. Use the ${cli.mode} key, unset ABLO_API_KEY, ` +
+                `or run \`ablo mode ${configuredMode}\` intentionally.`,
+        };
+    }
+    if (configured.source === 'env' && cli.storedKey && configured.key !== cli.storedKey) {
+        return {
+            source: configured.source,
+            configuredKeyPrefix,
+            ...(configuredMode ? { configuredMode } : {}),
+            cliMode: cli.mode,
+            storedKeyPrefix,
+            kind: 'key_override',
+            message: `ABLO_API_KEY (${configuredKeyPrefix}) overrides the CLI's stored active ${cli.mode} key ` +
+                `(${storedKeyPrefix}). Requests will use the environment key. Unset ABLO_API_KEY to use ` +
+                '`ablo status` / `ablo mode` credentials.',
+        };
+    }
+    return null;
+}
+let warnedCliKeyMismatch = false;
+export async function warnIfCliKeyMismatch(input, warn) {
+    if (warnedCliKeyMismatch)
+        return;
+    if (input.env.NODE_ENV === 'production')
+        return;
+    const configured = resolveStaticApiKey(input);
+    if (!configured)
+        return;
+    const cli = await readCliCredentialSnapshot(input.env);
+    if (!cli)
+        return;
+    const mismatch = describeCliKeyMismatch(configured, cli);
+    if (!mismatch)
+        return;
+    warnedCliKeyMismatch = true;
+    if (warn)
+        warn(mismatch.message);
+    else if (typeof console !== 'undefined')
+        console.warn('[Ablo]', mismatch.message);
+}
+// Declared in `./hostedEndpoints`, the single source of the hosted domain, and
+// re-exported here so existing import paths keep working.
+export { ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, ABLO_DEFAULT_BASE_URL } from './hostedEndpoints.js';
+const LEGACY_HOSTED_API_HOSTS = new Set([
+    'mesh.ablo.finance',
+    'mesh-staging.ablo.finance',
+    'api.ablo.finance',
+    'sync-staging.ablo.finance',
+]);
+/**
+ * Normalizes older hosted host names to the current public API domain.
+ * Self-hosted or custom URLs pass through unchanged; only the retired
+ * first-party host names are rewritten.
+ */
+export function normalizeAbloHostedBaseUrl(rawUrl) {
+    const trimmed = rawUrl.trim();
+    if (!trimmed)
+        return trimmed;
+    // A scheme-less value (e.g. `api-staging.abloatai.com`) is treated as a
+    // relative URL: `new URL()` throws on it, and a later `fetch` would resolve it
+    // against the current page — producing a 404 from the app's own origin.
+    // Prepending a scheme makes the base absolute. `https` matches
+    // {@link ABLO_HOSTED_HTTP_BASE_URL}; the socket layer derives `wss` from it.
+    // An existing scheme (ws, wss, http, or https) is preserved untouched.
+    const schemed = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+    try {
+        const url = new URL(schemed);
+        // Canonicalize the scheme to the HTTP family: accept all four schemes
+        // (http, https, ws, wss), normalize at this single entry point, and let
+        // each layer derive its own protocol (the socket layer maps http to ws and
+        // https to wss; fetch uses the URL as-is). Without this, a `ws://` base URL
+        // reaches HTTP consumers un-normalized and the client fails at startup
+        // instead of connecting.
+        if (url.protocol === 'ws:')
+            url.protocol = 'http:';
+        if (url.protocol === 'wss:')
+            url.protocol = 'https:';
+        if (!LEGACY_HOSTED_API_HOSTS.has(url.hostname)) {
+            return url.toString().replace(/\/+$/, '');
+        }
+        url.hostname = ABLO_HOSTED_API_DOMAIN;
+        if (url.protocol === 'http:')
+            url.protocol = 'https:';
+        return url.toString().replace(/\/+$/, '');
+    }
+    catch {
+        return schemed;
+    }
+}
+export function resolveBaseURL(input) {
+    return normalizeAbloHostedBaseUrl(input.options.baseURL ?? ABLO_DEFAULT_BASE_URL);
+}
+/**
+ * Guards against using a secret `apiKey` in a browser. A secret key is
+ * server-side only by default: shipping an `sk_live_...` key to a browser would
+ * expose it in every visitor's network tab. Callers opt in explicitly when the
+ * browser instead holds a minted session token (`ek_`/`rk_`) or routes through a
+ * server proxy. Throws {@link AbloAuthenticationError} when a secret key is
+ * detected in a browser without opt-in.
+ */
+/**
+ * Rejects the REMOVED `databaseUrl` dial-in option loudly. The option is gone
+ * from the types, but an untyped or stale caller could still pass it — and
+ * silently ignoring it would reroute their writes to Ablo-hosted storage,
+ * the opposite of what that option used to promise. A construction-time throw
+ * turns a wrong-storage surprise into a clear migration instruction.
+ */
+export function rejectRemovedDatabaseUrlOption(options) {
+    const legacyValue = Reflect.get(options, 'databaseUrl');
+    if (legacyValue == null)
+        return;
+    throw new AbloValidationError('The `databaseUrl` option was removed. Your database connects through ' +
+        '`ablo connect` now: Ablo writes it directly with a scoped DML role and ' +
+        'confirms through its replication stream. Run `npx ablo connect` to ' +
+        'register it, then construct the client with your API key only.', { code: 'invalid_body' });
+}
+/**
+ * Resolves a credential provider to its current string value, or
+ * returns a plain string key as-is. Called at request time so a rotating
+ * credential picks up new values between requests. Returns `null` when no key
+ * was configured.
+ */
+export async function resolveApiKeyValue(apiKey) {
+    if (apiKey == null)
+        return null;
+    if (typeof apiKey === 'function')
+        return credentialToken(await apiKey());
+    return apiKey;
+}
+/**
+ * Translates a WebSocket URL into the matching HTTP API base URL, defaulting to
+ * `${url}/api` when the caller has not overridden `bootstrapBaseUrl`. The
+ * bootstrap helper, the hydration coordinator, the credential-exchange flow, and
+ * the identity flow all derive their base URL through this one function, so the
+ * derivation stays consistent across them.
+ *
+ * When both `wss://` and `https://` are valid, the ws-to-http rewrite preserves
+ * the protocol family: ws becomes http and wss becomes https.
+ */
+export function resolveBootstrapBaseUrl(input) {
+    if (input.bootstrapBaseUrl) {
+        // Coerce ws/wss to http/https on the override path as well. This base URL is
+        // used for HTTP fetches (identity resolution, credential exchange, and
+        // bootstrap), and the browser `fetch` rejects ws and wss schemes outright.
+        // The override can legitimately arrive with a WebSocket scheme when a caller
+        // derives it as `${baseUrl}/api` from a WebSocket base URL, so normalize it
+        // here rather than failing at fetch time.
+        return ensureApiSuffix(normalizeAbloHostedBaseUrl(input.bootstrapBaseUrl).replace(/^ws/, 'http'));
+    }
+    const url = normalizeAbloHostedBaseUrl(input.url);
+    return ensureApiSuffix(url.replace(/^ws/, 'http'));
+}
+/**
+ * Ensures the HTTP base ends in the `/api` route segment that every endpoint is
+ * mounted under.
+ *
+ * A hosted deployment that sets a custom `baseURL` or `bootstrapBaseUrl` (a
+ * custom subdomain, a staging host, and so on) without the `/api` suffix would
+ * send every credential exchange to `…/v1/capabilities` instead of
+ * `…/api/v1/capabilities`, producing a 404 that surfaces as `exchange_failed`.
+ * Since the client builds routes relative to this base and no valid deployment
+ * serves them from the root, appending a single trailing `/api` here is always
+ * correct, and it is idempotent for callers who already include it.
+ */
+function ensureApiSuffix(httpBase) {
+    const trimmed = httpBase.replace(/\/+$/, '');
+    try {
+        const u = new URL(trimmed);
+        const segments = u.pathname.split('/').filter(Boolean);
+        if (segments[segments.length - 1] === 'api')
+            return trimmed;
+        u.pathname = `${u.pathname.replace(/\/+$/, '')}/api`;
+        return u.toString().replace(/\/+$/, '');
+    }
+    catch {
+        // Should be unreachable after `normalizeAbloHostedBaseUrl`, which yields an
+        // absolute URL, but fall back to a string check rather than throwing.
+        return trimmed.endsWith("/api") ? trimmed : `${trimmed}/api`;
+    }
+}
+//# sourceMappingURL=apiKey.js.map

package/dist/auth/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.js","sourceRoot":"","sources":["../../src/auth/apiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAA2B,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EACL,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AA0C/B;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,WAAW,GAAG,UAEnB,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAuB;IAEvB,0EAA0E;IAC1E,4EAA4E;IAC5E,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE;gBACvE,oEAAoE;gBACpE,0BAA0B,EAC5B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,gCAAgC,CACrC,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,uBAAuB,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,mBAAmB,CAC3B,0EAA0E;gBACxE,oDAAoD,EACtD,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,gCAAgC,CAAC,gCAAgC,CAAC,QAAQ,EAAE;YACjF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;YACtC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,4BAA4B;SAC7D,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,4EAA4E,EAC5E,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,gCAAgC,CACrC,UAAU,EACV,KAAK,CAAC,OAAO,CAAC,uBAAuB,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA0C;IAE1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;AACzC,CAAC;AAiCD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuB;IAClD,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAqE,EAAE,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG;YACf,OAAO,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACrE,UAAU,EAAE,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAqC;IAErC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IACE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC;QACxC,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,EAC9C,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACrE,UAAU,EAAE,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAI,SAAiB;IAC7C,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,MAAM,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,SAAS,CAAe,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,CAC1C,kBAAkB,CACnB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,GAAuC;IAC9E,MAAM,WAAW,GAAI,UAEnB,CAAC,OAAO,CAAC;IACX,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,iBAAiB,CAA2B,SAAS,CAAC;QACtD,iBAAiB,CAA6B,WAAW,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe;WAC1B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3C,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,SAAS,CAAC;IAEzE,MAAM,QAAQ,GAAG;QACf,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;QACnC,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;KAClC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACxD,QAAQ,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,aAAa;QACb,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM;YAClD,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAAwB,EACxB,GAA0B;IAE1B,MAAM,cAAc,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAEvF,IAAI,cAAc,IAAI,cAAc,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,mBAAmB;YACnB,cAAc;YACd,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,eAAe;YACrB,OAAO,EACL,GAAG,WAAW,SAAS,cAAc,SAAS,mBAAmB,2BAA2B;gBAC5F,GAAG,GAAG,CAAC,IAAI,QAAQ,eAAe,CAAC,CAAC,CAAC,uBAAuB,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;gBACvF,qBAAqB,cAAc,aAAa,GAAG,CAAC,IAAI,4BAA4B;gBACpF,sBAAsB,cAAc,mBAAmB;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACrF,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,mBAAmB;YACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,eAAe;YACf,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,iBAAiB,mBAAmB,uCAAuC,GAAG,CAAC,IAAI,OAAO;gBAC1F,IAAI,eAAe,sEAAsE;gBACzF,0CAA0C;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAuB,EACvB,IAAgC;IAEhC,IAAI,oBAAoB;QAAE,OAAO;IACjC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO;IAChD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,oBAAoB,GAAG,IAAI,CAAC;IAC5B,IAAI,IAAI;QAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC5B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,0DAA0D;AAC1D,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEhH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,mBAAmB;IACnB,2BAA2B;IAC3B,kBAAkB;IAClB,2BAA2B;CAC5B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAE7B,wEAAwE;IACxE,+EAA+E;IAC/E,wEAAwE;IACxE,+DAA+D;IAC/D,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,yBAAyB;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;YAAE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;QACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAErD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,GAAG,CAAC,QAAQ,GAAG,sBAAsB,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,MAAM,WAAW,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,WAAW,IAAI,IAAI;QAAE,OAAO;IAChC,MAAM,IAAI,mBAAmB,CAC3B,uEAAuE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,gEAAgE,EAClE,EAAE,IAAI,EAAE,cAAc,EAAE,CACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA0C;IAE1C,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,eAAe,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAGvC;IACC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,0CAA0C;QAC1C,OAAO,eAAe,CAAC,0BAA0B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,OAAO,CAAC;QAC5D,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC;QACrD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,sEAAsE;QACtE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/auth/bootstrapScope.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The hand-off the identity flow performs once a credential resolves: it names
+ * the account scope and the sync groups everything downstream should read under.
+ *
+ * The core defines the port; the consumer supplies the implementation. That
+ * keeps identity resolution — which is settlement's business — from depending on
+ * whatever happens to materialise rows on the other side of it (ADR 0016). The
+ * reactive engine's `BootstrapFetcher` satisfies this structurally.
+ */
+export interface BootstrapScope {
+    /** Bind subsequent reads to one account's cache partition. */
+    setCacheScope(cacheScope: string): void;
+    /** Narrow subsequent reads to the sync groups the credential authorises. */
+    setSyncGroups(syncGroups: readonly string[] | undefined): void;
+}
+//# sourceMappingURL=bootstrapScope.d.ts.map

package/dist/auth/bootstrapScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapScope.d.ts","sourceRoot":"","sources":["../../src/auth/bootstrapScope.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,4EAA4E;IAC5E,aAAa,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;CAChE"}

package/dist/auth/bootstrapScope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bootstrapScope.js.map

package/dist/auth/bootstrapScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapScope.js","sourceRoot":"","sources":["../../src/auth/bootstrapScope.ts"],"names":[],"mappings":""}

package/dist/auth/browserCredentialSafety.d.ts

@@ -0,0 +1,7 @@
+import { type CredentialProvider } from './credentialResult.js';
+export declare function assertBrowserSafety(input: {
+    readonly apiKey: string | CredentialProvider | null;
+    readonly dangerouslyAllowBrowser: boolean | undefined;
+}): void;
+export declare function protectBrowserCredentialProvider(provider: CredentialProvider, dangerouslyAllowBrowser: boolean | undefined): CredentialProvider;
+//# sourceMappingURL=browserCredentialSafety.d.ts.map

package/dist/auth/browserCredentialSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserCredentialSafety.d.ts","sourceRoot":"","sources":["../../src/auth/browserCredentialSafety.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAE/B,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,SAAS,CAAC;CACvD,GAAG,IAAI,CASP;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,kBAAkB,EAC5B,uBAAuB,EAAE,OAAO,GAAG,SAAS,GAC3C,kBAAkB,CAcpB"}