@ai-digital-factory/lmt-cli 0.1.5 → 1.0.0

package/dist/index.js

@@ -1,3540 +1,12 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res, err) => function __init() {
-  if (err) throw err[0];
-  try {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-  } catch (e) {
-    throw err = [e], e;
-  }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
 
-// ../../packages/contracts/src/price-cross.ts
-var init_price_cross = __esm({
-  "../../packages/contracts/src/price-cross.ts"() {
-    "use strict";
-  }
-});
-
-// ../../packages/contracts/src/price-cross-time.ts
-var IST_OFFSET_MS;
-var init_price_cross_time = __esm({
-  "../../packages/contracts/src/price-cross-time.ts"() {
-    "use strict";
-    IST_OFFSET_MS = 330 * 6e4;
-  }
-});
-
-// ../../packages/contracts/src/price-cross-live.ts
-var init_price_cross_live = __esm({
-  "../../packages/contracts/src/price-cross-live.ts"() {
-    "use strict";
-    init_price_cross_time();
-  }
-});
-
-// ../../packages/contracts/src/index.ts
-function isOperatorMarketProtection(value) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 2 && value <= 90;
-}
-function validateEntryCategories(value) {
-  if (!Array.isArray(value) || value.some((category) => typeof category !== "string" || !ENTRY_CATEGORIES.includes(category)) || new Set(value).size !== value.length) {
-    throw new Error("entryCategories must be a list of supported Entry Categories with no duplicates.");
-  }
-  return [...value];
-}
-var OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS, OPERATOR_SESSION_EXPIRY_WARNING_MS, DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS, ZERODHA_SESSION_ADMISSION_HEADER, ZERODHA_SESSION_ADMISSION_VERIFY, ENTRY_CATEGORIES, API_PATHS;
-var init_src = __esm({
-  "../../packages/contracts/src/index.ts"() {
-    "use strict";
-    init_price_cross();
-    init_price_cross_live();
-    init_price_cross_time();
-    OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS = 24 * 60 * 60;
-    OPERATOR_SESSION_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
-    DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS = 7 * 24 * 60 * 60;
-    ZERODHA_SESSION_ADMISSION_HEADER = "x-lmt-session-admission";
-    ZERODHA_SESSION_ADMISSION_VERIFY = "verify";
-    ENTRY_CATEGORIES = [
-      "NSE EQ",
-      "BSE EQ",
-      "NFO FUT",
-      "NFO CE",
-      "NFO PE",
-      "BFO FUT",
-      "BFO CE",
-      "BFO PE"
-    ];
-    API_PATHS = {
-      health: "/api/health",
-      unlockOperatorSession: "/api/operator-session/unlock",
-      reportOperatorActivity: "/api/operator-session/activity",
-      operatorSession: "/api/operator-session",
-      logoutUnauthenticatedOperator: "/api/unauthenticated-operator/logout",
-      zerodhaSession: "/api/zerodha/session",
-      logoutAuthenticatedOperator: "/api/authenticated-operator/logout",
-      operators: "/api/operators",
-      startOperatorLogin: "/api/operators/login",
-      operatorLoginEvents: "/api/operators/login/events",
-      operatorLoginOtp: "/api/operators/login/otp",
-      cancelOperatorLogin: "/api/operators/login/cancel",
-      zerodhaAccessToken: "/api/zerodha/access-token",
-      zerodhaAccessTokenRecovery: "/api/zerodha/access-token/recovery",
-      zerodhaAccessTokenPublication: "/api/zerodha/access-token/publication",
-      zerodhaCredentials: "/api/zerodha/credentials",
-      entryCategorySettings: "/api/settings/entry-categories",
-      operatorSettings: "/api/settings",
-      marketProtectionSettings: "/api/settings/market-protection",
-      operatorEgress: "/api/operator-egress",
-      validateInstrument: "/api/instruments/validate",
-      startMarketFeed: "/api/market/feed/start",
-      stopMarketFeed: "/api/market/feed/stop",
-      marketFeedStream: "/api/market/feed/stream",
-      marketWatch: "/api/market-watch",
-      marketWatchRowCount: "/api/settings/market-watch-row-count",
-      previousInstruments: "/api/market-watch/previous-instruments",
-      candleHistoryLatest: "/api/candle-history/latest",
-      candleHistoryExport: "/api/candle-history/export",
-      candleExportOnDemand: "/api/candle-history/export/on-demand",
-      candleHistoryExportShare: "/api/candle-history/export/share",
-      candleHistory: "/api/candle-history",
-      zerodhaHistoricalCandles: "/api/zerodha/historical-candles",
-      applyMarketWatchRow: "/api/market-watch/apply",
-      clearMarketWatchRow: "/api/market-watch/clear",
-      placeMarketWatchOrder: "/api/market-watch/orders/place",
-      retryMarketWatchPlace: "/api/market-watch/orders/place-retry",
-      exitMarketWatchOrder: "/api/market-watch/orders/exit",
-      cancelMarketWatchOrder: "/api/market-watch/orders/cancel",
-      assignPriceCrossPair: "/api/price-cross/pairs/assign",
-      unpairPriceCrossPair: "/api/price-cross/pairs/unpair",
-      priceCrossReport: "/api/price-cross/report",
-      priceCrossReportShare: "/api/price-cross/report/share",
-      priceCrossPairs: "/api/price-cross/pairs",
-      priceCrossHistory: "/api/price-cross/history"
-    };
-  }
-});
-
-// src/profile-name.ts
-function assertClientProfileName(profile) {
-  if (!clientProfilePattern.test(profile)) throw new Error(CLIENT_PROFILE_NAME_ERROR);
-}
-var CLIENT_PROFILE_NAME_ERROR, clientProfilePattern;
-var init_profile_name = __esm({
-  "src/profile-name.ts"() {
-    "use strict";
-    CLIENT_PROFILE_NAME_ERROR = "Profile must be 1\u201364 letters, digits, dots, underscores, or hyphens, starting with a letter or digit.";
-    clientProfilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-  }
-});
-
-// src/gate-api-client.ts
-function redactSecrets(message, secrets) {
-  let redacted = message;
-  for (const secret of secrets) {
-    if (secret) redacted = redacted.split(secret).join("[REDACTED]");
-  }
-  return redacted.replace(
-    /((?:access_token|request_token|api_key|password|username|otp|totp|token|cookie)\s*[=:]\s*["']?)[^"'&\s,;}]*/gi,
-    "$1[REDACTED]"
-  );
-}
-function messageFromBody(body, fallback, secrets = []) {
-  const message = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : fallback;
-  return redactSecrets(message, secrets);
-}
-function redactEvent(event, secrets) {
-  if ("message" in event && typeof event.message === "string") {
-    return { ...event, message: redactSecrets(event.message, secrets) };
-  }
-  return event;
-}
-async function readJson(response) {
-  try {
-    return await response.json();
-  } catch {
-    return void 0;
-  }
-}
-function transportErrorDetail(error) {
-  if (!(error instanceof Error)) return void 0;
-  const cause = error.cause;
-  if (cause instanceof Error) {
-    const code = cause.code;
-    return code ? String(code) : cause.message;
-  }
-  return error.message;
-}
-async function requestOrThrow(request, unavailableMessage, signal, targetUrl, secrets = []) {
-  try {
-    return await request();
-  } catch (error) {
-    if (signal?.aborted) throw new Error("The action exceeded its deadline.");
-    if (error instanceof OperatorSessionRejectedError || error instanceof ZerodhaLoginAttemptUnavailableError) throw error;
-    const detail = transportErrorDetail(error);
-    const at = targetUrl ? ` [${targetUrl}]` : "";
-    throw new Error(redactSecrets(detail ? `${unavailableMessage} (${detail})${at}` : `${unavailableMessage}${at}`, secrets));
-  }
-}
-function responseCookies(response) {
-  const responseHeaders = response.headers;
-  const setCookies = responseHeaders.getSetCookie?.() ?? [];
-  const values = setCookies.length > 0 ? setCookies : [response.headers.get("set-cookie") ?? ""];
-  const cookies = {};
-  for (const value of values) {
-    for (const match of value.matchAll(/(?:^|,\s*)(lmt_operator_session|lmt_client_id)=([^;,\s]+)/g)) {
-      if (match[1] === "lmt_operator_session") cookies.operatorSessionCookie = `${match[1]}=${match[2]}`;
-      if (match[1] === "lmt_client_id") cookies.clientIdentityCookie = `${match[1]}=${match[2]}`;
-    }
-  }
-  return cookies;
-}
-function clientIdFromCookie(cookie) {
-  return cookie?.startsWith("lmt_client_id=") ? cookie.slice("lmt_client_id=".length) : void 0;
-}
-function observedOperator(body) {
-  if (!body || typeof body !== "object" || !("operators" in body)) return void 0;
-  const list = body.operators;
-  if (!Array.isArray(list) || list.length !== 1) return void 0;
-  const first = list[0];
-  return first && typeof first === "object" && "id" in first && typeof first.id === "string" ? first.id : void 0;
-}
-function rejectionReason(body) {
-  return body && typeof body === "object" && "reason" in body && typeof body.reason === "string" ? body.reason : void 0;
-}
-function delay(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal.aborted) {
-      resolve();
-      return;
-    }
-    const timer = setTimeout(resolve, ms);
-    signal.addEventListener("abort", () => {
-      clearTimeout(timer);
-      resolve();
-    }, { once: true });
-  });
-}
-function parseEventFrame(frame) {
-  const data = frame.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
-  if (!data) return void 0;
-  let event;
-  try {
-    event = JSON.parse(data);
-  } catch {
-    throw new Error("Origin returned an invalid Zerodha login update.");
-  }
-  if (!event || typeof event !== "object" || !("type" in event) || typeof event.attemptId !== "string" || !event.attemptId || "message" in event && typeof event.message !== "string" || event.type === "status" && (event.operatorId !== "OPERATOR_1" && event.operatorId !== "OPERATOR_2" || !["loading", "awaiting_otp", "succeeded", "failed"].includes(event.status) || event.failedOtpAttempts !== void 0 && (!Number.isInteger(event.failedOtpAttempts) || event.failedOtpAttempts < 0)) || event.type === "attempt_error" && (!["login_attempt_cancelled", "login_attempt_expired", "login_attempt_not_found"].includes(event.error) || typeof event.message !== "string") || event.type !== "status" && event.type !== "attempt_error") {
-    throw new Error("Origin returned an invalid Zerodha login update.");
-  }
-  if (event.type === "attempt_error") return { type: event.type, attemptId: event.attemptId, error: event.error, message: event.message };
-  return {
-    type: event.type,
-    attemptId: event.attemptId,
-    operatorId: event.operatorId,
-    status: event.status,
-    ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
-    ...event.message === void 0 ? {} : { message: event.message }
-  };
-}
-function createGateApi(origin, fetchImpl = fetch, options = {}) {
-  let cookies = { ...options.cookies ?? {} };
-  let metadata = {};
-  const clientProfile = options.profile;
-  if (clientProfile !== void 0) assertClientProfileName(clientProfile);
-  const otpValues = /* @__PURE__ */ new Set();
-  let actionDeadlineSignal;
-  function combineSignals2(...signals) {
-    const present = signals.filter((signal) => signal !== void 0);
-    if (present.length === 0) return void 0;
-    if (present.length === 1) return present[0];
-    return AbortSignal.any(present);
-  }
-  function sessionSecrets() {
-    return [cookies.operatorSessionCookie, cookies.clientIdentityCookie].filter((cookie) => Boolean(cookie)).flatMap((cookie) => [cookie, cookie.slice(cookie.indexOf("=") + 1)]);
-  }
-  function headers(extra) {
-    const result = new Headers(extra);
-    const cookie = [cookies.operatorSessionCookie, cookies.clientIdentityCookie].filter(Boolean).join("; ");
-    if (cookie) result.set("cookie", cookie);
-    result.set("x-lmt-client-kind", "cli");
-    if (clientProfile) result.set("x-lmt-client-profile", clientProfile);
-    return result;
-  }
-  function rememberCookies(response, acceptSessionCookie = false) {
-    const received = responseCookies(response);
-    if (received.clientIdentityCookie) cookies.clientIdentityCookie = received.clientIdentityCookie;
-    if (acceptSessionCookie && received.operatorSessionCookie) cookies.operatorSessionCookie = received.operatorSessionCookie;
-    metadata = {
-      ...metadata.requestId ? { requestId: metadata.requestId } : {},
-      ...metadata.buildId ? { buildId: metadata.buildId } : {},
-      ...response.headers.get("x-request-id") ? { requestId: response.headers.get("x-request-id") } : {},
-      ...response.headers.get("x-lmt-build-id") ? { buildId: response.headers.get("x-lmt-build-id") } : {}
-    };
-  }
-  function actionSignal(explicitSignal) {
-    const timeout = options.timeoutMs && options.timeoutMs > 0 ? AbortSignal.timeout(options.timeoutMs) : void 0;
-    return combineSignals2(options.signal, actionDeadlineSignal, explicitSignal, timeout);
-  }
-  async function rejectAbsentSession(response, path5) {
-    if (response.status !== 401 || path5 === API_PATHS.unlockOperatorSession || path5 === API_PATHS.logoutUnauthenticatedOperator) return;
-    const body = await readJson(response.clone());
-    if (body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
-      delete cookies.operatorSessionCookie;
-      throw new OperatorSessionRejectedError(rejectionReason(body));
-    }
-  }
-  async function postJson(path5, body, explicitSignal, secrets = []) {
-    const signal = actionSignal(explicitSignal);
-    const url = `${origin}${path5}`;
-    const response = await requestOrThrow(
-      () => fetchImpl(url, {
-        method: "POST",
-        headers: headers({ "content-type": "application/json", accept: "application/json" }),
-        body: JSON.stringify(body),
-        ...signal ? { signal } : {}
-      }),
-      "Could not reach the selected Live Market Terminal Origin.",
-      signal,
-      url,
-      [...sessionSecrets(), ...otpValues, ...secrets]
-    );
-    rememberCookies(response);
-    await rejectAbsentSession(response, path5);
-    return response;
-  }
-  async function getJson(path5, explicitSignal, extraHeaders) {
-    const signal = actionSignal(explicitSignal);
-    const url = `${origin}${path5}`;
-    const response = await requestOrThrow(
-      () => fetchImpl(url, {
-        method: "GET",
-        headers: headers({ accept: "application/json", ...extraHeaders }),
-        cache: "no-store",
-        ...signal ? { signal } : {}
-      }),
-      "Could not reach the selected Live Market Terminal Origin.",
-      signal,
-      url,
-      [...sessionSecrets(), ...otpValues]
-    );
-    rememberCookies(response);
-    await rejectAbsentSession(response, path5);
-    return response;
-  }
-  async function settingsWrite(path5, body) {
-    let response;
-    try {
-      response = await fetchImpl(origin + path5, {
-        method: "PUT",
-        headers: headers({ "content-type": "application/json", accept: "application/json" }),
-        body: JSON.stringify(body),
-        signal: actionSignal()
-      });
-    } catch {
-      throw new SettingsActionError("submission_uncertain", true);
-    }
-    rememberCookies(response);
-    await rejectAbsentSession(response, path5);
-    if (!response.ok) {
-      const result = await readJson(response).catch(() => void 0);
-      const codes = [
-        "settings_conflict",
-        "settings_version_required",
-        "invalid_settings",
-        "trade_cycle_active",
-        "settings_save_failed",
-        "token_conflict",
-        "token_rejected",
-        "replacement_confirmation_required",
-        "token_write_pending",
-        "invalid_request",
-        "zerodha_session_absent",
-        "validation_failed",
-        "credentials_changed",
-        "replacement_blocked",
-        "token_changed",
-        "invalid_token_request",
-        "token_write_unresolved",
-        "active_trading_confirmation",
-        "validation_unavailable",
-        "unresolved_order",
-        "sharing_token_unavailable",
-        "token_recovery_unavailable",
-        "settings_recovery_required"
-      ];
-      const code = typeof result?.error === "string" && codes.includes(result.error) ? result.error : "operation_rejected";
-      const serverMessage = typeof result?.message === "string" && result.message.trim() ? result.message.trim() : void 0;
-      const relayMessage = serverMessage && (code === "token_rejected" || code === "validation_unavailable" || code === "invalid_token_request") ? serverMessage : void 0;
-      throw new SettingsActionError(code, code === "settings_save_failed" || response.status >= 500, relayMessage);
-    }
-    return response;
-  }
-  async function priceCrossMutation(path5, body, accept) {
-    let response;
-    try {
-      response = await fetchImpl(origin + path5, {
-        method: "POST",
-        headers: headers({ "content-type": "application/json", accept: "application/json" }),
-        body: JSON.stringify(body),
-        signal: actionSignal()
-      });
-    } catch {
-      throw new PriceCrossActionError("submission_uncertain", true);
-    }
-    rememberCookies(response);
-    await rejectAbsentSession(response, path5);
-    const parsed = await readJson(response);
-    if (response.ok) {
-      if (accept(parsed)) return parsed;
-      throw new PriceCrossActionError("submission_uncertain", true);
-    }
-    const refusal = priceCrossRefusal(parsed, response.status);
-    if (response.status >= 500 && refusal.code !== "store_unavailable") throw new PriceCrossActionError("submission_uncertain", true);
-    throw refusal;
-  }
-  function priceCrossRefusal(body, status) {
-    const result = body;
-    const code = typeof result?.error === "string" && /^[a-z][a-z0-9_]{0,63}$/.test(result.error) ? result.error : `http_${status}`;
-    const message = typeof result?.message === "string" && result.message.trim() ? redactSecrets(result.message.trim(), sessionSecrets()) : void 0;
-    return new PriceCrossActionError(code, false, message);
-  }
-  async function priceCrossRead(path5, body) {
-    const response = body === void 0 ? await getJson(path5) : await postJson(path5, body);
-    if (!response.ok) throw priceCrossRefusal(await readJson(response), response.status);
-    return response;
-  }
-  function ordinarySettings(body) {
-    if (!body || !Number.isSafeInteger(body.settingsVersion) || !Number.isInteger(body.rowCount) || body.rowCount < 1 || body.rowCount > 20 || !isOperatorMarketProtection(body.marketProtection) || !Array.isArray(body.entryCategories)) {
-      throw new SettingsActionError("invalid_response");
-    }
-    return { settingsVersion: body.settingsVersion, rowCount: body.rowCount, marketProtection: body.marketProtection, entryCategories: validateEntryCategories(body.entryCategories) };
-  }
-  const api = {
-    async getTokenMetadata() {
-      const response = await getJson(API_PATHS.zerodhaCredentials);
-      const body = await readJson(response);
-      if (!response.ok || !body?.accessTokenMetadata) throw new SettingsActionError("token_metadata_unavailable");
-      const { fingerprint, version, updatedAt, writePending } = body.accessTokenMetadata;
-      return { fingerprint, version, updatedAt, ...writePending === void 0 ? {} : { writePending } };
-    },
-    async getSettings() {
-      const response = await getJson(API_PATHS.operatorSettings);
-      if (!response.ok) throw new SettingsActionError("settings_read_failed");
-      return ordinarySettings(await readJson(response));
-    },
-    async saveSettings(request) {
-      const response = await settingsWrite(API_PATHS.operatorSettings, request);
-      try {
-        const body = await readJson(response);
-        if (body.outcome !== "saved" && body.outcome !== "unchanged") throw new Error("Invalid outcome");
-        return { outcome: body.outcome, settings: ordinarySettings(body.settings) };
-      } catch {
-        throw new SettingsActionError("submission_uncertain", true);
-      }
-    },
-    async replaceToken(request) {
-      const response = await settingsWrite(API_PATHS.zerodhaAccessToken, request);
-      try {
-        const body = await readJson(response);
-        if (body.outcome !== "verified" && body.outcome !== "replaced") throw new Error("Invalid outcome");
-        return { outcome: body.outcome, sharing: body.sharing, metadata: body.metadata, message: "Token operation completed." };
-      } catch {
-        throw new SettingsActionError("submission_uncertain", true);
-      }
-    },
-    async exportCandles(request) {
-      const response = await postJson(API_PATHS.candleExportOnDemand, request);
-      const body = await readJson(response);
-      if (!response.ok || !body || !("url" in body) || typeof body.url !== "string" || !("filename" in body)) {
-        throw new Error(messageFromBody(body, "Could not publish Candle Export.", sessionSecrets()));
-      }
-      return body;
-    },
-    async listPriceCrossPairs() {
-      const body = await readJson(await priceCrossRead(API_PATHS.priceCrossPairs));
-      if (!body || !Array.isArray(body.active) || !Array.isArray(body.past)) throw new PriceCrossActionError("invalid_response");
-      return { active: body.active, past: body.past };
-    },
-    assignPriceCrossPair(request) {
-      return priceCrossMutation(API_PATHS.assignPriceCrossPair, request, (body) => !!body && typeof body === "object" && "pair" in body && !!body.pair && typeof body.pair.pairId === "string");
-    },
-    unpairPriceCrossPair(request) {
-      return priceCrossMutation(API_PATHS.unpairPriceCrossPair, request, (body) => !!body && typeof body === "object" && "outcome" in body && (body.outcome === "unpaired" || body.outcome === "already_unpaired"));
-    },
-    async downloadPriceCrossReport(pairId) {
-      const response = await priceCrossRead(API_PATHS.priceCrossReport, { pairId });
-      const filename = /filename="([^"]+)"/.exec(response.headers.get("content-disposition") ?? "")?.[1];
-      const count = Number(response.headers.get("x-price-cross-decision-count"));
-      const bytes = new Uint8Array(await response.arrayBuffer());
-      if (!filename || bytes.length === 0) throw new PriceCrossActionError("invalid_response");
-      return { bytes, filename, decisionCount: response.headers.has("x-price-cross-decision-count") && Number.isSafeInteger(count) ? count : null };
-    },
-    publishPriceCrossReport(pairId) {
-      return priceCrossMutation(API_PATHS.priceCrossReportShare, { pairId }, (body) => !!body && typeof body === "object" && "url" in body && typeof body.url === "string" && "filename" in body && typeof body.filename === "string");
-    },
-    setActionSignal(signal) {
-      actionDeadlineSignal = signal;
-      if (!signal) otpValues.clear();
-    },
-    setCookies(next) {
-      cookies = { ...next };
-    },
-    getCookies() {
-      return { ...cookies };
-    },
-    clearOperatorSession() {
-      delete cookies.operatorSessionCookie;
-    },
-    responseMetadata() {
-      return { ...metadata };
-    },
-    async unlock(username, password, signal) {
-      const response = await postJson(API_PATHS.unlockOperatorSession, { username, password }, signal, [username, password]);
-      const body = await readJson(response);
-      if (!response.ok || !body || !("operatorSession" in body) || body.operatorSession !== "present") {
-        if (body && typeof body === "object" && "error" in body && body.error === "incorrect_credentials") {
-          throw new OperatorCredentialsRejectedError();
-        }
-        throw new Error(messageFromBody(body, "Could not unlock the Operator Session.", [username, password]));
-      }
-      const receivedCookie = responseCookies(response).operatorSessionCookie;
-      if (!receivedCookie) throw new Error("Origin unlocked the Operator Session without returning its session cookie.");
-      cookies.operatorSessionCookie = receivedCookie;
-      otpValues.clear();
-    },
-    async reportOperatorActivity() {
-      const response = await postJson(API_PATHS.reportOperatorActivity, {}, void 0);
-      if (response.status === 404) return;
-      const body = await readJson(response);
-      if (response.status === 401 && body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
-        this.clearOperatorSession();
-        throw new OperatorSessionRejectedError(rejectionReason(body));
-      }
-      if (!response.ok || !body || !("operatorSession" in body) || body.operatorSession !== "present") {
-        throw new Error(messageFromBody(
-          body,
-          `Origin did not accept Operator Activity (HTTP ${response.status}).`,
-          sessionSecrets()
-        ));
-      }
-      rememberCookies(response, true);
-    },
-    async confirmOperatorSessionPresent(expectedOperatorId) {
-      const healthPath = API_PATHS.health;
-      const response = await getJson(healthPath);
-      const body = await readJson(response);
-      if (response.status === 401 && body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
-        this.clearOperatorSession();
-        throw new OperatorSessionRejectedError(rejectionReason(body));
-      }
-      if (body && typeof body === "object" && "service" in body && body.service === "live-market-terminal-gate" && "operatorSession" in body && (body.operatorSession === "present" || body.operatorSession === "absent")) {
-        if (!response.ok) {
-          throw new Error(messageFromBody(body, `Gate health returned HTTP ${response.status} from GET ${origin}${healthPath}.`, sessionSecrets()));
-        }
-        if (body.operatorSession === "absent") {
-          this.clearOperatorSession();
-          throw new OperatorSessionRejectedError(rejectionReason(body));
-        }
-        const clientId = clientIdFromCookie(cookies.clientIdentityCookie);
-        return { operatorId: expectedOperatorId, ...clientId ? { clientId } : {} };
-      }
-      const service = body && typeof body === "object" && "service" in body ? String(body.service) : void 0;
-      const hint = service === "live-market-terminal-broker" ? " The public Origin /api proxy reached Broker instead of Gate; point its proxy at Gate (default 8788)." : !response.ok ? ` Gate health returned HTTP ${response.status}.` : "";
-      throw new Error(messageFromBody(
-        body,
-        `Origin returned an invalid Gate health response from GET ${origin}${healthPath}.${hint}`,
-        sessionSecrets()
-      ));
-    },
-    async status(expectedOperatorId) {
-      const session = await this.confirmOperatorSessionPresent(expectedOperatorId);
-      const operatorsResponse = await getJson(API_PATHS.operators);
-      const operatorsBody = await readJson(operatorsResponse);
-      if (!operatorsResponse.ok) {
-        throw new Error(messageFromBody(operatorsBody, "Could not inspect the authenticated Operator.", sessionSecrets()));
-      }
-      const operatorId = observedOperator(operatorsBody);
-      if (!operatorId) throw new Error("Origin returned an invalid or ambiguous Operator Directory.");
-      if (operatorId !== expectedOperatorId) {
-        this.clearOperatorSession();
-        throw new Error(`The saved session reached ${operatorId}, but this target expects ${expectedOperatorId}.`);
-      }
-      return session;
-    },
-    async logout() {
-      if (!cookies.operatorSessionCookie) return;
-      const response = await requestOrThrow(
-        () => postJson(API_PATHS.logoutUnauthenticatedOperator, {}),
-        "Could not reach the selected Live Market Terminal Origin to log out."
-      );
-      const body = await readJson(response);
-      if (!response.ok || !body || typeof body !== "object" || !("operatorSession" in body) || body.operatorSession !== "absent") {
-        throw new Error(messageFromBody(body, `Origin did not confirm Operator logout (HTTP ${response.status}).`, sessionSecrets()));
-      }
-      this.clearOperatorSession();
-    },
-    async startLogin() {
-      const response = await requestOrThrow(
-        () => postJson(API_PATHS.startOperatorLogin, {}),
-        "Could not reach the selected Origin to start Login with Zerodha."
-      );
-      const body = await readJson(response);
-      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "started" || typeof body.attemptId !== "string") {
-        const code = body && typeof body === "object" && "error" in body && typeof body.error === "string" && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(body.error) ? body.error : void 0;
-        throw Object.assign(new Error(messageFromBody(body, "Could not start Login with Zerodha.", sessionSecrets())), code ? { code } : {});
-      }
-      otpValues.clear();
-      return { attemptId: body.attemptId, operatorId: body.operatorId };
-    },
-    async submitOtp(attemptId, otp) {
-      otpValues.add(otp);
-      const response = await requestOrThrow(
-        () => postJson(API_PATHS.operatorLoginOtp, { attemptId, otp }),
-        "Could not reach the selected Origin to submit the OTP."
-      );
-      const body = await readJson(response);
-      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "loading") {
-        const message = messageFromBody(body, "Could not submit the Zerodha OTP.", [...sessionSecrets(), ...otpValues]);
-        if (body && typeof body === "object" && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) {
-          throw new ZerodhaLoginAttemptUnavailableError(message);
-        }
-        throw new Error(message);
-      }
-    },
-    async watchLoginAttempt(attemptId, onEvent, signal) {
-      const requestSignal = actionSignal(signal) ?? signal;
-      requestSignal.addEventListener("abort", () => otpValues.clear(), { once: true });
-      const url = `${origin}${API_PATHS.operatorLoginEvents}?attemptId=${encodeURIComponent(attemptId)}`;
-      while (!requestSignal.aborted) {
-        let response;
-        try {
-          response = await fetchImpl(url, {
-            method: "GET",
-            headers: headers({ accept: "text/event-stream" }),
-            cache: "no-store",
-            signal: requestSignal
-          });
-          rememberCookies(response);
-        } catch {
-          if (requestSignal.aborted) return;
-          await delay(500, requestSignal);
-          continue;
-        }
-        await rejectAbsentSession(response, API_PATHS.operatorLoginEvents);
-        if (!response.ok || !response.body) {
-          const body = await readJson(response);
-          otpValues.clear();
-          const message = messageFromBody(body, "Could not receive Zerodha login updates.", sessionSecrets());
-          if (body && typeof body === "object" && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) throw new ZerodhaLoginAttemptUnavailableError(message);
-          throw new Error(message);
-        }
-        const reader = response.body.getReader();
-        const cancelReader = () => {
-          void reader.cancel().catch(() => void 0);
-        };
-        requestSignal.addEventListener("abort", cancelReader, { once: true });
-        const decoder = new TextDecoder();
-        let buffer = "";
-        let completed = false;
-        try {
-          while (!requestSignal.aborted) {
-            let chunk;
-            try {
-              chunk = await reader.read();
-            } catch {
-              break;
-            }
-            const { done, value } = chunk;
-            buffer += decoder.decode(value, { stream: !done });
-            let boundary = buffer.search(/\r?\n\r?\n/);
-            while (boundary >= 0) {
-              const frame = buffer.slice(0, boundary);
-              const separator = buffer.slice(boundary).match(/^\r?\n\r?\n/)?.[0] ?? "\n\n";
-              buffer = buffer.slice(boundary + separator.length);
-              const event = parseEventFrame(frame);
-              if (event) {
-                const safeEvent = redactEvent(event, [...sessionSecrets(), ...otpValues]);
-                onEvent(safeEvent);
-                if (safeEvent.type === "attempt_error") {
-                  otpValues.clear();
-                  throw new ZerodhaLoginAttemptUnavailableError(safeEvent.message);
-                }
-                if (safeEvent.status === "failed") {
-                  otpValues.clear();
-                  throw new ZerodhaLoginFailedError(safeEvent.message ?? "Login with Zerodha failed.");
-                }
-                if (safeEvent.status === "succeeded") {
-                  otpValues.clear();
-                  completed = true;
-                  return;
-                }
-              }
-              boundary = buffer.search(/\r?\n\r?\n/);
-            }
-            if (done) break;
-          }
-        } finally {
-          requestSignal.removeEventListener("abort", cancelReader);
-          await reader.cancel().catch(() => void 0);
-        }
-        if (completed || requestSignal.aborted) return;
-        await delay(250, requestSignal);
-      }
-    },
-    async confirmZerodhaSession() {
-      const response = await requestOrThrow(
-        () => getJson(API_PATHS.zerodhaSession, void 0, { [ZERODHA_SESSION_ADMISSION_HEADER]: ZERODHA_SESSION_ADMISSION_VERIFY }),
-        "Could not verify the Zerodha Session with the selected Origin."
-      );
-      const body = await readJson(response);
-      if (!response.ok || !body || typeof body !== "object" || !("zerodhaSession" in body) || body.zerodhaSession !== "present") {
-        const code = body && typeof body === "object" && "error" in body && body.error === "zerodha_session_restoring" ? "verification" in body && body.verification === "unavailable" ? "zerodha_verification_unavailable" : "zerodha_session_restoring" : body && typeof body === "object" && "error" in body && body.error === "zerodha_session_absent" ? "zerodha_session_absent" : "zerodha_verification_unavailable";
-        throw Object.assign(new Error(messageFromBody(body, "Zerodha Session is not present on the Broker.", sessionSecrets())), { code });
-      }
-      return body;
-    }
-  };
-  return api;
-}
-var SettingsActionError, PRICE_CROSS_UNCERTAIN_MESSAGE, PriceCrossActionError, OperatorSessionRejectedError, ZerodhaLoginFailedError, ZerodhaLoginAttemptUnavailableError, OperatorCredentialsRejectedError;
-var init_gate_api_client = __esm({
-  "src/gate-api-client.ts"() {
-    "use strict";
-    init_src();
-    init_profile_name();
-    SettingsActionError = class extends Error {
-      constructor(code, uncertain = false, messageOverride) {
-        super(messageOverride ?? (uncertain ? "Submission could not be confirmed. Read current Settings or token metadata before another submission." : code === "settings_conflict" ? "Settings changed elsewhere. Read saved Settings and submit again with its version." : code === "active_trading_confirmation" ? "Another device has active trading. Review it, then explicitly submit continueReplacement: true to continue." : code === "token_changed" ? "The token changed. Read token metadata and review a fresh submission." : code === "token_write_unresolved" ? "A token write is unresolved. Resolve interrupted save in Web before replacing." : code === "unresolved_order" ? "An Order remains unresolved. Reconcile it before replacing the token." : "The Settings or token operation was rejected."));
-        this.code = code;
-        this.uncertain = uncertain;
-      }
-      code;
-      uncertain;
-    };
-    PRICE_CROSS_UNCERTAIN_MESSAGE = "Submission could not be confirmed and was not retried. Run pair list before another submission.";
-    PriceCrossActionError = class extends Error {
-      constructor(code, uncertain = false, message) {
-        super(message ?? (uncertain ? PRICE_CROSS_UNCERTAIN_MESSAGE : "The Price Cross request was rejected."));
-        this.code = code;
-        this.uncertain = uncertain;
-        this.name = "PriceCrossActionError";
-        if (uncertain) this.recovery = "Read current and past pairs with pair list; the CLI never repeats a submission.";
-      }
-      code;
-      uncertain;
-      recovery;
-    };
-    OperatorSessionRejectedError = class extends Error {
-      constructor(reason) {
-        super("The saved Operator Session was rejected by Gate.");
-        this.reason = reason;
-        this.name = "OperatorSessionRejectedError";
-      }
-      reason;
-      code = "operator_login_required";
-    };
-    ZerodhaLoginFailedError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "ZerodhaLoginFailedError";
-      }
-    };
-    ZerodhaLoginAttemptUnavailableError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "ZerodhaLoginAttemptUnavailableError";
-      }
-    };
-    OperatorCredentialsRejectedError = class extends Error {
-      code = "incorrect_credentials";
-      constructor() {
-        super("Incorrect Operator Login Username or Password.");
-        this.name = "OperatorCredentialsRejectedError";
-      }
-    };
-  }
-});
-
-// src/gate-api.ts
-var init_gate_api = __esm({
-  "src/gate-api.ts"() {
-    "use strict";
-    init_gate_api_client();
-  }
-});
-
-// src/action-deadline.ts
-function withinActionDeadline(operation, signal, deadlineMessage) {
-  return new Promise((resolve, reject) => {
-    const abort = () => reject(new Error(deadlineMessage));
-    if (signal.aborted) {
-      void operation.catch(() => void 0);
-      abort();
-      return;
-    }
-    signal.addEventListener("abort", abort, { once: true });
-    operation.then(
-      (value) => {
-        signal.removeEventListener("abort", abort);
-        resolve(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", abort);
-        reject(error);
-      }
-    );
-  });
-}
-var init_action_deadline = __esm({
-  "src/action-deadline.ts"() {
-    "use strict";
-  }
-});
-
-// src/zerodha-actions.ts
-async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp, options = {}) {
-  const started = Date.now();
-  let observedState;
-  let observedOperator2;
-  api.setActionSignal?.(signal);
-  try {
-    if (signal.aborted) throw new Error("Zerodha login observation exceeded its deadline.");
-    if (action === "status") {
-      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
-      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
-      return { status: "succeeded", observedState: "present", ...session.operatorId ? { observedOperator: session.operatorId } : {}, elapsedMs: Date.now() - started };
-    }
-    if (action === "login") {
-      const attempt = await withinActionDeadline(api.startLogin(), signal, "Zerodha login observation exceeded its deadline.");
-      attemptId = attempt.attemptId;
-      if (attempt.operatorId !== operatorId) throw new Error("Zerodha login reached an unexpected Operator.");
-    }
-    if (!attemptId) throw new Error("Zerodha login requires an attempt identifier.");
-    if (action === "otp") {
-      if (!otp) throw new Error("Zerodha OTP input is required.");
-      await withinActionDeadline(api.submitOtp(attemptId, otp), signal, "Zerodha login observation exceeded its deadline.");
-    }
-    const observer = new AbortController();
-    const observationSignal = AbortSignal.any([signal, observer.signal]);
-    let result;
-    try {
-      await withinActionDeadline(api.watchLoginAttempt(attemptId, (event) => {
-        if (observer.signal.aborted || signal.aborted) return;
-        if (event.attemptId !== attemptId || event.type === "status" && event.operatorId !== operatorId) {
-          throw new Error("Origin returned an unexpected Zerodha login attempt.");
-        }
-        if (event.type === "status") {
-          observedState = event.status;
-          observedOperator2 = event.operatorId;
-        }
-        options.onObservation?.(event);
-        if (event.type === "status" && (event.status === "awaiting_otp" || event.status === "succeeded")) {
-          result = {
-            status: event.status,
-            attemptId,
-            observedOperator: observedOperator2,
-            observedState,
-            ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
-            ...event.message ? { message: event.message } : {}
-          };
-          observer.abort();
-        }
-      }, observationSignal), observationSignal, "Zerodha login observation exceeded its deadline.");
-    } catch (error) {
-      if (!observer.signal.aborted || !result) throw error;
-    }
-    if (signal.aborted || !result) throw new Error("Zerodha login observation exceeded its deadline.");
-    if (result.status === "succeeded") {
-      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
-      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
-    }
-    return { ...result, elapsedMs: Date.now() - started };
-  } catch (cause) {
-    const error = cause instanceof Error ? cause : new Error("Zerodha action failed.");
-    Object.assign(error, {
-      ...attemptId ? { attemptId, recovery: "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
-      ...observedState ? { observedState } : {},
-      ...observedOperator2 ? { observedOperator: observedOperator2 } : {},
-      elapsedMs: Date.now() - started
-    });
-    throw error;
-  } finally {
-    api.setActionSignal?.();
-  }
-}
-var init_zerodha_actions = __esm({
-  "src/zerodha-actions.ts"() {
-    "use strict";
-    init_action_deadline();
-  }
-});
-
-// src/credential-app.tsx
-var credential_app_exports = {};
-__export(credential_app_exports, {
-  CredentialProvisionApp: () => CredentialProvisionApp
-});
-import { useState } from "react";
-import { Box, Text, useInput } from "ink";
-import { jsx, jsxs } from "react/jsx-runtime";
-function CredentialProvisionApp({ store }) {
-  const [credential, setCredential] = useState("");
-  const [state, setState] = useState("input");
-  const [error, setError] = useState("");
-  useInput((input, key) => {
-    if (state !== "input") return;
-    if (key.return) {
-      if (!credential.trim()) {
-        setError("Enter the SMS read credential.");
-        return;
-      }
-      setState("saving");
-      setError("");
-      void store.saveSmsCredential(credential).then(() => {
-        setCredential("");
-        setState("saved");
-      }).catch((error2) => {
-        setCredential("");
-        setError(error2 instanceof Error ? error2.message : "Could not save the protected SMS credential.");
-        setState("input");
-      });
-    } else if (key.backspace || key.delete) {
-      setCredential((value) => value.slice(0, -1));
-      setError("");
-    } else if (input && !key.ctrl && !key.meta && !/[\r\n]/.test(input)) {
-      setCredential((value) => value + input);
-      setError("");
-    }
-  });
-  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", gap: 1, children: [
-    /* @__PURE__ */ jsx(Text, { bold: true, children: "Live Market Terminal" }),
-    state === "input" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx(Text, { children: "SMS read credential" }),
-      /* @__PURE__ */ jsxs(Text, { children: [
-        "\u2022".repeat(credential.length),
-        /* @__PURE__ */ jsx(Text, { inverse: true, children: " " })
-      ] }),
-      /* @__PURE__ */ jsx(Text, { children: "Press Enter to save it in protected local profile storage." })
-    ] }),
-    state === "saving" && /* @__PURE__ */ jsx(Text, { children: "Saving the protected SMS credential\u2026" }),
-    state === "saved" && /* @__PURE__ */ jsx(Text, { children: "SMS credential saved." }),
-    error ? /* @__PURE__ */ jsx(Text, { color: "red", children: error }) : null
-  ] });
-}
-var init_credential_app = __esm({
-  "src/credential-app.tsx"() {
-    "use strict";
-  }
-});
-
-// src/app.tsx
-var app_exports = {};
-__export(app_exports, {
-  LoginApp: () => LoginApp
-});
-import { useEffect, useRef, useState as useState2 } from "react";
-import { Box as Box2, Text as Text2, useInput as useInput2 } from "ink";
-import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
-function formatZerodhaValidationReport(report) {
-  return [
-    "Scenario: zerodha-session",
-    `Outcome: ${report.outcome}`,
-    `Reason: ${report.reason}`,
-    `Target: ${report.target.environment} ${report.target.origin}`,
-    `Profile: ${report.profile}`,
-    `Observed Operator: ${report.observedOperator ?? "not observed"}`,
-    `Observed state: ${report.observedState ?? "not observed"}`,
-    `Attempt: ${report.attemptId ?? "not observed"}`,
-    `Elapsed: ${report.elapsedMs} ms`,
-    `Request ID: ${report.requestId ?? "unavailable"}`,
-    `Build ID: ${report.buildId ?? "unavailable"}`,
-    ...report.failedOtpAttempts === void 0 ? [] : [`Failed OTP attempts: ${report.failedOtpAttempts}`],
-    ...report.message ? [report.message] : [],
-    ...report.nextStep ? [`Next step: ${report.nextStep}`] : []
-  ].join("\n");
-}
-function formatValidationReport(report) {
-  const lines = [
-    `Outcome: ${report.outcome}`,
-    `Reason: ${report.reason}`,
-    `Target: ${report.target.environment} ${report.target.origin}`,
-    `Profile: ${report.profile}`,
-    `Expected Operator: ${report.expectedOperator}`,
-    `Observed Operator: ${report.observedOperator ?? "not observed"}`,
-    `Elapsed: ${report.elapsedMs} ms`,
-    `Request ID: ${report.requestId ?? "unavailable"}`,
-    `Build ID: ${report.buildId ?? "unavailable"}`,
-    `Temporary Profile: ${report.temporaryProfile}`,
-    "Observations:",
-    ...report.observations.length ? report.observations.map((observation) => `  - ${observation}`) : ["  - none"],
-    `Cleanup: ${report.cleanup.outcome}`,
-    `Removed Profiles: ${report.cleanup.removedProfiles.length ? report.cleanup.removedProfiles.join(", ") : "none"}`
-  ];
-  if (report.cleanup.error) {
-    lines.push(`Cleanup Error: ${report.cleanup.error.code}: ${report.cleanup.error.message}`);
-  }
-  return lines.join("\n");
-}
-function LoginApp({ api, expectedOperatorId = "OPERATOR_1", actionTimeoutMs = 3e4, onResumeSession, onReportOperatorActivity, onStatus, onValidate, onValidateZerodha, onLogout }) {
-  const [step, setStep] = useState2(onResumeSession ? "checking" : "username");
-  const [username, setUsername] = useState2("");
-  const [password, setPassword] = useState2("");
-  const [otp, setOtp] = useState2("");
-  const [progress, setProgress] = useState2(null);
-  const [error, setError] = useState2("");
-  const [menuMessage, setMenuMessage] = useState2("");
-  const [validationReport, setValidationReport] = useState2(null);
-  const [zerodhaValidationReport, setZerodhaValidationReport] = useState2(null);
-  const [resumeAttemptInput, setResumeAttemptInput] = useState2("");
-  const validatingZerodha = useRef(false);
-  const [selectedMenuIndex, setSelectedMenuIndex] = useState2(0);
-  const attemptId = useRef(null);
-  const watcher = useRef(null);
-  const loginInputDeadline = useRef(null);
-  const zerodhaLoginDeadline = useRef(null);
-  useEffect(() => {
-    return () => {
-      watcher.current?.abort();
-      if (loginInputDeadline.current) clearTimeout(loginInputDeadline.current.timer);
-      if (zerodhaLoginDeadline.current) clearTimeout(zerodhaLoginDeadline.current.timer);
-      api.setActionSignal?.();
-    };
-  }, []);
-  useEffect(() => {
-    if (!onResumeSession) return;
-    void onResumeSession().then(({ step: step2, hint }) => {
-      clearLoginDeadline();
-      if (hint) setError(hint);
-      else setError("");
-      setStep(step2);
-    }).catch(() => {
-      clearLoginDeadline();
-      setStep("username");
-    });
-  }, [onResumeSession]);
-  useEffect(() => {
-    if (step !== "menu" || !onReportOperatorActivity) return;
-    void onReportOperatorActivity().catch(() => void 0);
-    const interval = setInterval(() => {
-      void onReportOperatorActivity().catch(() => void 0);
-    }, 5 * 6e4);
-    return () => clearInterval(interval);
-  }, [step, onReportOperatorActivity]);
-  function clearLoginDeadline() {
-    if (loginInputDeadline.current) clearTimeout(loginInputDeadline.current.timer);
-    loginInputDeadline.current = null;
-  }
-  function ensureLoginDeadline() {
-    if (loginInputDeadline.current && !loginInputDeadline.current.signal.aborted) return loginInputDeadline.current.signal;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), actionTimeoutMs);
-    loginInputDeadline.current = { signal: controller.signal, timer };
-    controller.signal.addEventListener("abort", () => {
-      if (loginInputDeadline.current?.signal !== controller.signal) return;
-      clearLoginDeadline();
-      setUsername("");
-      setPassword("");
-      setError("Operator Login exceeded its deadline.");
-      setStep("username");
-    }, { once: true });
-    return controller.signal;
-  }
-  function clearZerodhaLoginDeadline(controller) {
-    const current = zerodhaLoginDeadline.current;
-    if (!current || controller && current.controller !== controller) return;
-    clearTimeout(current.timer);
-    zerodhaLoginDeadline.current = null;
-    api.setActionSignal?.();
-  }
-  async function unlock() {
-    if (!password) {
-      setError("Enter the Operator Login Password.");
-      return;
-    }
-    setError("");
-    setStep("unlocking");
-    const signal = ensureLoginDeadline();
-    try {
-      await api.unlock(username.trim(), password, signal);
-      if (signal.aborted) throw new Error("Operator Login exceeded its deadline.");
-      clearLoginDeadline();
-      setPassword("");
-      setStep("menu");
-    } catch (cause) {
-      const timedOut = signal.aborted;
-      clearLoginDeadline();
-      setError(timedOut ? "Operator Login exceeded its deadline." : cause instanceof Error ? cause.message : "Could not unlock the Operator Session.");
-      if (timedOut) {
-        setUsername("");
-        setPassword("");
-      }
-      setStep("username");
-    }
-  }
-  function applyLoginEvent(event, signal, action) {
-    if (signal.aborted || event.type !== "status") return;
-    attemptId.current = event.attemptId;
-    setProgress({
-      status: event.status === "succeeded" ? "succeeded" : "awaiting_otp",
-      attemptId: event.attemptId,
-      observedState: event.status,
-      observedOperator: event.operatorId,
-      ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts }
-    });
-    if (event.status === "loading") setStep(action === "login" ? "waiting" : "verifying");
-  }
-  async function runLoginAction(action, controller, code) {
-    try {
-      const result = await runZerodhaAction(
-        api,
-        action,
-        expectedOperatorId,
-        controller.signal,
-        action === "otp" ? attemptId.current ?? void 0 : void 0,
-        code,
-        { onObservation: (event) => applyLoginEvent(event, controller.signal, action) }
-      );
-      if (controller.signal.aborted) return;
-      attemptId.current = result.attemptId ?? null;
-      setProgress(result);
-      setOtp("");
-      if (result.status === "awaiting_otp") {
-        setError(result.message ?? "");
-        setStep("otp");
-      } else {
-        clearZerodhaLoginDeadline(controller);
-        setStep("success");
-      }
-    } catch (cause) {
-      if (controller.signal.aborted) return;
-      clearZerodhaLoginDeadline(controller);
-      setOtp("");
-      const recovery = cause;
-      if (recovery?.attemptId) attemptId.current = recovery.attemptId;
-      setError(`${cause instanceof Error ? cause.message : "Login with Zerodha failed."}${recovery?.attemptId ? ` Attempt: ${recovery.attemptId}. ${recovery.recovery ?? "Observe this exact attempt with the same target and profile."}` : ""}`);
-      setStep(cause instanceof OperatorSessionRejectedError ? "username" : "menu");
-    }
-  }
-  async function beginLogin() {
-    validatingZerodha.current = false;
-    setZerodhaValidationReport(null);
-    setError("");
-    setProgress(null);
-    attemptId.current = null;
-    setStep("starting");
-    const controller = new AbortController();
-    watcher.current?.abort();
-    watcher.current = controller;
-    const timer = setTimeout(() => {
-      if (zerodhaLoginDeadline.current?.controller !== controller) return;
-      controller.abort();
-      clearZerodhaLoginDeadline(controller);
-      setOtp("");
-      setError(`Login with Zerodha exceeded its deadline.${attemptId.current ? ` Observe attempt ${attemptId.current} with the same target and profile.` : ""}`);
-      setStep("menu");
-    }, actionTimeoutMs);
-    zerodhaLoginDeadline.current = { controller, timer };
-    await runLoginAction("login", controller);
-  }
-  async function submitOtp() {
-    if (!/^\d{6}$/.test(otp)) {
-      setError("Enter the 6-digit Zerodha OTP.");
-      return;
-    }
-    if (!attemptId.current || !watcher.current || watcher.current.signal.aborted) {
-      setOtp("");
-      setError("The Zerodha login attempt is no longer active.");
-      setStep("menu");
-      return;
-    }
-    const code = otp;
-    setOtp("");
-    setError("");
-    setStep("verifying");
-    if (validatingZerodha.current) await runValidation(watcher.current, attemptId.current, code);
-    else await runLoginAction("otp", watcher.current, code);
-  }
-  function checkZerodhaSession() {
-    setError("");
-    setMenuMessage("");
-    setStep("checking");
-    const controller = new AbortController();
-    watcher.current = controller;
-    const timer = setTimeout(() => controller.abort(), actionTimeoutMs);
-    void runZerodhaAction(api, "status", expectedOperatorId, controller.signal).then(() => {
-      setMenuMessage("Zerodha Session confirmed by Gate.");
-      setStep("menu");
-    }).catch((cause) => {
-      setError(cause instanceof Error ? cause.message : "Could not check the Zerodha Session.");
-      setStep(cause instanceof OperatorSessionRejectedError ? "username" : "menu");
-    }).finally(() => {
-      clearTimeout(timer);
-    });
-  }
-  function checkOperatorSession() {
-    if (!onStatus) return;
-    setError("");
-    setMenuMessage("");
-    setValidationReport(null);
-    setStep("checking");
-    void onStatus().then((message) => {
-      setMenuMessage(message);
-      setStep("menu");
-    }).catch((cause) => {
-      setError(cause instanceof Error ? cause.message : "Could not check the Operator Session.");
-      if (cause instanceof OperatorSessionRejectedError) {
-        setUsername("");
-        setPassword("");
-        setStep("username");
-      } else {
-        setStep("menu");
-      }
-    });
-  }
-  function validateOperatorSession() {
-    if (!onValidate) return;
-    setError("");
-    setMenuMessage("");
-    setValidationReport(null);
-    setStep("validating");
-    void onValidate().then((result) => {
-      setValidationReport(result);
-      setStep("menu");
-    }).catch((cause) => {
-      setValidationReport(null);
-      setError(cause instanceof Error ? cause.message : "Operator Session validation failed.");
-      setStep("menu");
-    });
-  }
-  async function runValidation(controller, selectedAttempt, code) {
-    if (!onValidateZerodha) return;
-    try {
-      const result = await onValidateZerodha({
-        attemptId: selectedAttempt,
-        otp: code,
-        signal: controller.signal,
-        onObservation: (event) => applyLoginEvent(event, controller.signal, code ? "otp" : "login")
-      });
-      if (watcher.current !== controller) return;
-      setOtp("");
-      setZerodhaValidationReport(result);
-      attemptId.current = result.attemptId ?? null;
-      if (!controller.signal.aborted && result.attemptId && ["awaiting_otp", "otp_rejected"].includes(result.reason)) {
-        setStep("otp");
-      } else {
-        clearZerodhaLoginDeadline(controller);
-        validatingZerodha.current = false;
-        if (result.reason === "operator_login_required") {
-          setUsername("");
-          setPassword("");
-        }
-        setStep(result.reason === "operator_login_required" ? "username" : "menu");
-      }
-    } catch (cause) {
-      if (watcher.current !== controller) return;
-      clearZerodhaLoginDeadline(controller);
-      validatingZerodha.current = false;
-      setOtp("");
-      const message = cause instanceof Error ? cause.message : "Zerodha Session validation failed.";
-      setError(code ? message.replaceAll(code, "[REDACTED]") : message);
-      setStep("menu");
-    }
-  }
-  async function beginValidation(selectedAttempt) {
-    watcher.current?.abort();
-    clearZerodhaLoginDeadline();
-    const controller = new AbortController();
-    const started = Date.now();
-    watcher.current = controller;
-    validatingZerodha.current = true;
-    attemptId.current = selectedAttempt ?? null;
-    setOtp("");
-    setProgress(null);
-    setError("");
-    setMenuMessage("");
-    setValidationReport(null);
-    setZerodhaValidationReport(null);
-    setStep("validatingZerodha");
-    const timer = setTimeout(() => {
-      if (zerodhaLoginDeadline.current?.controller !== controller) return;
-      controller.abort();
-      clearZerodhaLoginDeadline(controller);
-      validatingZerodha.current = false;
-      setOtp("");
-      setZerodhaValidationReport((previous) => previous ? {
-        ...previous,
-        outcome: "fail",
-        reason: "deadline_exceeded",
-        exitCode: 1,
-        message: "The Zerodha Session validation exceeded its deadline.",
-        elapsedMs: Date.now() - started,
-        nextStep: `Observe attempt ${previous.attemptId} with the same target and profile; explicitly start again only if Gate reports it inactive.`
-      } : previous);
-      setError(`Zerodha Session validation exceeded its deadline.${attemptId.current ? ` Observe attempt ${attemptId.current} with the same target and profile.` : ""}`);
-      setStep("menu");
-    }, actionTimeoutMs);
-    zerodhaLoginDeadline.current = { controller, timer };
-    await runValidation(controller, selectedAttempt);
-  }
-  function resumeValidation() {
-    setError("");
-    setResumeAttemptInput("");
-    setStep("validationAttempt");
-  }
-  function logoutOperatorSession() {
-    if (!onLogout) return;
-    setError("");
-    setStep("loggingOut");
-    void onLogout().then(() => {
-      setUsername("");
-      setPassword("");
-      setMenuMessage("");
-      setValidationReport(null);
-      setZerodhaValidationReport(null);
-      setStep("username");
-    }).catch((cause) => {
-      setError(cause instanceof Error ? cause.message : "Could not log out the Operator Session.");
-      setStep("menu");
-    });
-  }
-  const menuActions = [
-    { shortcut: "1", label: "Login with Zerodha", run: () => {
-      void beginLogin();
-    } },
-    ...onStatus ? [{ shortcut: "2", label: "Check Operator Session", run: checkOperatorSession }] : [],
-    ...onValidate ? [{ shortcut: "3", label: "Validate Operator Session", run: validateOperatorSession }] : [],
-    ...onLogout ? [{ shortcut: "4", label: "Logout Operator Session", run: logoutOperatorSession }] : [],
-    { shortcut: "5", label: "Check Zerodha Session", run: checkZerodhaSession },
-    ...onValidateZerodha ? [
-      { shortcut: "6", label: "Validate Zerodha Session", run: () => {
-        void beginValidation();
-      } },
-      { shortcut: "7", label: "Resume Zerodha Validation", run: resumeValidation }
-    ] : []
-  ];
-  const activeMenuIndex = Math.min(selectedMenuIndex, menuActions.length - 1);
-  useInput2((input, key) => {
-    if (step === "username") {
-      if (key.ctrl && input === "u") {
-        if (username.length > 0) ensureLoginDeadline();
-        setUsername("");
-      } else if (key.return) {
-        if (!username.trim()) setError("Enter the Operator Login Username.");
-        else {
-          setError("");
-          setStep("password");
-        }
-      } else if (key.backspace || key.delete) {
-        if (username.length > 0) ensureLoginDeadline();
-        setUsername((value) => value.slice(0, -1));
-      } else if (input && !key.ctrl && !key.meta) {
-        ensureLoginDeadline();
-        setUsername((value) => value + input);
-      }
-      return;
-    }
-    if (step === "password") {
-      if (key.escape) setStep("username");
-      else if (key.ctrl && input === "u") {
-        if (password.length > 0) ensureLoginDeadline();
-        setPassword("");
-      } else if (key.return) void unlock();
-      else if (key.backspace || key.delete) {
-        if (password.length > 0) ensureLoginDeadline();
-        setPassword((value) => value.slice(0, -1));
-      } else if (input && !key.ctrl && !key.meta) {
-        ensureLoginDeadline();
-        setPassword((value) => value + input);
-      }
-      return;
-    }
-    if (step === "validationAttempt") {
-      if (key.escape) setStep("menu");
-      else if (key.return) {
-        if (!/^[a-zA-Z0-9_-]{1,200}$/.test(resumeAttemptInput)) setError("Enter an explicit valid Zerodha attempt ID.");
-        else void beginValidation(resumeAttemptInput);
-      } else if (key.backspace || key.delete) setResumeAttemptInput((value) => value.slice(0, -1));
-      else if (input && !key.ctrl && !key.meta) setResumeAttemptInput((value) => (value + input).slice(0, 200));
-      return;
-    }
-    if (step === "menu") {
-      if (key.upArrow) {
-        setSelectedMenuIndex((index) => (index - 1 + menuActions.length) % menuActions.length);
-      } else if (key.downArrow) {
-        setSelectedMenuIndex((index) => (index + 1) % menuActions.length);
-      } else if (key.return) {
-        menuActions[activeMenuIndex]?.run();
-      } else {
-        const shortcutAction = menuActions.find((action) => action.shortcut === input);
-        shortcutAction?.run();
-      }
-      return;
-    }
-    if (step === "otp") {
-      if (key.escape && validatingZerodha.current) {
-        watcher.current?.abort();
-        clearZerodhaLoginDeadline();
-        validatingZerodha.current = false;
-        setOtp("");
-        setStep("menu");
-      } else if (key.return) void submitOtp();
-      else if (key.backspace || key.delete) setOtp((value) => value.slice(0, -1));
-      else if (input) setOtp((value) => (value + input.replace(/\D/g, "")).slice(0, 6));
-    }
-  });
-  if (step === "success") {
-    return /* @__PURE__ */ jsx2(Text2, { children: "You have reached operator page" });
-  }
-  return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", gap: 1, children: [
-    /* @__PURE__ */ jsx2(Text2, { bold: true, children: "Live Market Terminal" }),
-    step === "username" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { children: "Operator Login Username" }),
-      /* @__PURE__ */ jsxs2(Text2, { children: [
-        username,
-        /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
-      ] }),
-      /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to continue \xB7 Ctrl+U to clear" })
-    ] }),
-    step === "password" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { children: "Operator Login Password" }),
-      /* @__PURE__ */ jsxs2(Text2, { children: [
-        "\u2022".repeat(password.length),
-        /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
-      ] }),
-      /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to log in \xB7 Esc to edit username \xB7 Ctrl+U to clear" })
-    ] }),
-    step === "unlocking" && /* @__PURE__ */ jsx2(Text2, { children: "Unlocking Operator Session\u2026" }),
-    step === "menu" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { children: "Select an action" }),
-      menuActions.map((action, index) => {
-        const selected = index === activeMenuIndex;
-        return /* @__PURE__ */ jsxs2(Text2, { color: selected ? "cyan" : void 0, bold: selected, children: [
-          selected ? "\u203A" : " ",
-          " ",
-          action.shortcut,
-          " ",
-          action.label
-        ] }, action.shortcut);
-      }),
-      /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Use \u2191/\u2193 to move, Enter to select, or a number shortcut." }),
-      menuMessage ? /* @__PURE__ */ jsx2(Text2, { children: menuMessage }) : null,
-      validationReport ? /* @__PURE__ */ jsx2(Text2, { children: formatValidationReport(validationReport) }) : null
-    ] }),
-    step === "checking" && /* @__PURE__ */ jsx2(Text2, { children: "Checking Operator Session\u2026" }),
-    step === "validating" && /* @__PURE__ */ jsx2(Text2, { children: "Validating Operator Session\u2026" }),
-    step === "validatingZerodha" && /* @__PURE__ */ jsx2(Text2, { children: "Validating Zerodha Session\u2026" }),
-    step === "validationAttempt" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { children: "Zerodha attempt ID" }),
-      /* @__PURE__ */ jsxs2(Text2, { children: [
-        resumeAttemptInput,
-        /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
-      ] }),
-      /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to observe this attempt \xB7 Esc to return" })
-    ] }),
-    zerodhaValidationReport ? /* @__PURE__ */ jsx2(Text2, { children: formatZerodhaValidationReport(zerodhaValidationReport) }) : null,
-    step === "loggingOut" && /* @__PURE__ */ jsx2(Text2, { children: "Logging out of the Operator Session\u2026" }),
-    step === "starting" && /* @__PURE__ */ jsx2(Text2, { children: "Starting Login with Zerodha\u2026" }),
-    step === "waiting" && /* @__PURE__ */ jsx2(Text2, { children: "Connecting to Zerodha\u2026" }),
-    step === "otp" && /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { children: "Zerodha OTP" }),
-      /* @__PURE__ */ jsxs2(Text2, { children: [
-        "\u2022".repeat(otp.length),
-        /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
-      ] }),
-      validatingZerodha.current ? /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "Enter to submit \xB7 Esc to return and resume later" }) : null
-    ] }),
-    step === "verifying" && /* @__PURE__ */ jsx2(Text2, { children: "Verifying Zerodha login\u2026" }),
-    progress?.attemptId ? /* @__PURE__ */ jsxs2(Text2, { children: [
-      "Attempt: ",
-      progress.attemptId
-    ] }) : null,
-    progress?.observedState ? /* @__PURE__ */ jsxs2(Text2, { children: [
-      "Zerodha state: ",
-      progress.observedState
-    ] }) : null,
-    progress?.failedOtpAttempts !== void 0 ? /* @__PURE__ */ jsxs2(Text2, { children: [
-      "Failed OTP attempts: ",
-      progress.failedOtpAttempts
-    ] }) : null,
-    error ? /* @__PURE__ */ jsx2(Text2, { color: "red", children: error }) : null
-  ] });
-}
-var init_app = __esm({
-  "src/app.tsx"() {
-    "use strict";
-    init_gate_api();
-    init_zerodha_actions();
-  }
-});
-
-// src/index.ts
-import path4 from "node:path";
-import { realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-
-// src/config.ts
-import { existsSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-var repoRoot = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  "../../../../"
-);
-var packagedConfigPath = fileURLToPath(new URL("../lmt.config.json", import.meta.url));
-var DEFAULT_CONFIG_PATH = existsSync(packagedConfigPath) ? packagedConfigPath : path.join(repoRoot, "lmt.config.json");
-function resolveCanonicalOrigin(value, environment) {
-  if (typeof value !== "string" || !value.trim()) {
-    throw new Error(`lmt.config.json does not contain the ${environment} Origin.`);
-  }
-  let origin;
-  try {
-    origin = new URL(value.trim());
-  } catch {
-    throw new Error(`${environment} Origin must be an absolute HTTP URL.`);
-  }
-  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
-    throw new Error(
-      `${environment} Origin must be an HTTP URL without credentials or a fragment.`
-    );
-  }
-  if (origin.pathname !== "/" || origin.search) {
-    throw new Error(`${environment} Origin must not include a path or query string.`);
-  }
-  return origin.origin;
-}
-function resolveCliTarget(env = process.env, configPath = DEFAULT_CONFIG_PATH) {
-  const environment = env.LMT_ENV?.trim();
-  if (environment !== "local" && environment !== "dev") {
-    if (environment === "prod") {
-      throw new Error("The CLI supports local or dev targets only; prod is not permitted.");
-    }
-    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
-  }
-  let config;
-  try {
-    config = JSON.parse(readFileSync(configPath, "utf8"));
-  } catch {
-    throw new Error("Could not read the deployment configuration lmt.config.json.");
-  }
-  const selected = config.environments?.[environment];
-  if (!selected) {
-    throw new Error(`lmt.config.json does not contain the ${environment} environment.`);
-  }
-  const origin = resolveCanonicalOrigin(selected.origin, environment);
-  const smsEndpoint = typeof config.smsEndpoint === "string" ? config.smsEndpoint.trim() : "";
-  if (!smsEndpoint) throw new Error("lmt.config.json does not contain smsEndpoint.");
-  const gateScope = typeof selected.gateScope === "string" ? selected.gateScope.trim() : "";
-  if (!gateScope) throw new Error(`lmt.config.json does not contain the ${environment} Gate scope.`);
-  const operators = selected.brokerOperatorIds;
-  if (!Array.isArray(operators) || operators.length !== 1 || operators[0] !== "OPERATOR_1") {
-    throw new Error(`${environment} must have exactly one configured Operator: OPERATOR_1.`);
-  }
-  let smsUrl;
-  try {
-    smsUrl = new URL(smsEndpoint);
-  } catch {
-    throw new Error("smsEndpoint must be an absolute HTTP URL.");
-  }
-  if (!/^https?:$/.test(smsUrl.protocol) || smsUrl.username || smsUrl.password || smsUrl.hash) {
-    throw new Error("smsEndpoint must be an HTTP URL without credentials or a fragment.");
-  }
-  return {
-    environment,
-    origin,
-    gateScope,
-    smsEndpoint: smsUrl.origin,
-    operatorId: "OPERATOR_1"
-  };
-}
-function resolveCliApiOrigin(target) {
-  return target.origin;
-}
-
-// src/operator-actions.ts
-init_gate_api();
-
-// src/sms.ts
-import { spawn } from "node:child_process";
-var SmsReadError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "SmsReadError";
-  }
-  code;
-};
-async function readSmsSecret(options) {
-  if (!options.credential.trim()) {
-    throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
-  }
-  if (!options.name.trim() || !options.scope.trim() || !options.endpoint.trim()) {
-    throw new SmsReadError("sms_unavailable", "SMS configuration is incomplete.");
-  }
-  if (options.signal?.aborted) throw new SmsReadError("sms_unavailable", "SMS access was cancelled.");
-  const command = options.command ?? "npx";
-  const args = options.command ? ["read", options.name] : ["--yes", "--package=@ai-digital-factory/sms-cli@0.1.2", "sms", "read", options.name];
-  return new Promise((resolve, reject) => {
-    let child;
-    try {
-      child = spawn(command, args, {
-        env: {
-          ...process.env,
-          SMS_ENDPOINT: options.endpoint,
-          SMS_CREDENTIAL: options.credential,
-          SMS_SCOPE: options.scope
-        },
-        stdio: ["ignore", "pipe", "ignore"]
-      });
-    } catch {
-      reject(new SmsReadError("sms_unavailable", "SMS access is unavailable."));
-      return;
-    }
-    const chunks = [];
-    let length = 0;
-    let settled = false;
-    const finish = (error, result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      options.signal?.removeEventListener("abort", onAbort);
-      if (error) reject(error);
-      else resolve(result ?? "");
-    };
-    const onAbort = () => {
-      child.kill("SIGTERM");
-      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
-    };
-    const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
-    }, options.timeoutMs ?? 3e4);
-    options.signal?.addEventListener("abort", onAbort, { once: true });
-    child.stdout.on("data", (chunk) => {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      length += buffer.length;
-      if (length > 1048576) {
-        child.kill("SIGTERM");
-        finish(new SmsReadError("sms_unavailable", "SMS returned an oversized secret record."));
-        return;
-      }
-      chunks.push(buffer);
-    });
-    child.on("error", () => finish(new SmsReadError("sms_unavailable", "SMS access is unavailable.")));
-    child.on("close", (code) => {
-      if (code !== 0) {
-        finish(new SmsReadError("sms_unavailable", "SMS access is unavailable for the selected Gate scope."));
-        return;
-      }
-      const value = Buffer.concat(chunks).toString("utf8").trimEnd();
-      if (!value.trim()) {
-        finish(new SmsReadError("sms_unavailable", "SMS returned an empty secret record."));
-        return;
-      }
-      finish(void 0, value);
-    });
-  });
-}
-async function readOperatorLoginCredentials(input) {
-  let raw;
-  try {
-    raw = await (input.secretReader ?? readSmsSecret)({
-      name: "live-market-terminal-operator-directory",
-      scope: input.gateScope,
-      endpoint: input.smsEndpoint,
-      credential: input.smsCredential,
-      ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
-      ...input.signal ? { signal: input.signal } : {},
-      ...input.command ? { command: input.command } : {}
-    });
-  } catch (error) {
-    if (error instanceof SmsReadError) throw error;
-    throw new SmsReadError("sms_unavailable", "Operator Directory is unavailable from the selected Gate scope.");
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || !("operators" in parsed) || !Array.isArray(parsed.operators)) {
-      throw new Error();
-    }
-    const matches = parsed.operators.filter(
-      (entry2) => entry2 && typeof entry2 === "object" && "operatorId" in entry2 && entry2.operatorId === input.operatorId
-    );
-    if (matches.length !== 1) throw new Error();
-    const entry = matches[0];
-    if (typeof entry.loginUsername !== "string" || !entry.loginUsername.trim() || typeof entry.loginPassword !== "string" || !entry.loginPassword.trim()) throw new Error();
-    return { username: entry.loginUsername.trim(), password: entry.loginPassword };
-  } catch {
-    throw new SmsReadError("invalid_operator_directory", "The selected Gate Operator Directory is invalid or does not contain exactly one configured Operator.");
-  }
-}
-
-// src/operator-actions.ts
-function profileTarget(target) {
-  return {
-    environment: target.environment,
-    origin: target.origin,
-    operatorId: target.operatorId
-  };
-}
-function responseMetadata(api) {
-  const metadata = api.responseMetadata();
-  return Object.keys(metadata).length > 0 ? metadata : void 0;
-}
-function combineSignals(...signals) {
-  const present = signals.filter((signal) => signal !== void 0);
-  if (present.length === 1) return present[0];
-  return AbortSignal.any(present);
-}
-function isTransientGateReachabilityError(error) {
-  if (!(error instanceof Error)) return false;
-  return /Could not reach the selected Live Market Terminal Origin/.test(error.message) || /Broker is unreachable/.test(error.message) || /Gate health returned HTTP 5\d\d/.test(error.message);
-}
-function waitForSignal(operation, signal) {
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) {
-      reject(new Error("The action exceeded its deadline."));
-      return;
-    }
-    const onAbort = () => reject(new Error("The action exceeded its deadline."));
-    signal.addEventListener("abort", onAbort, { once: true });
-    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
-  });
-}
-function createOperatorSessionActions(options) {
-  const selectedTarget = profileTarget(options.target);
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const timeoutMs = options.timeoutMs ?? 3e4;
-  let api;
-  async function loadApi() {
-    if (api) return api;
-    const cookies = await options.store.getSession(options.profile, selectedTarget);
-    api = createGateApi(resolveCliApiOrigin(options.target), fetchImpl, {
-      profile: options.profile,
-      ...cookies ? { cookies } : {},
-      timeoutMs,
-      ...options.signal ? { signal: options.signal } : {}
-    });
-    return api;
-  }
-  async function persistCurrentCookies(client, signal) {
-    const write = options.store.saveSession(options.profile, selectedTarget, client.getCookies());
-    if (signal) await waitForSignal(write, signal);
-    else await write;
-  }
-  async function withAction(action, requestedSignal) {
-    const deadlineAt = Date.now() + timeoutMs;
-    const signal = combineSignals(options.signal, requestedSignal, AbortSignal.timeout(timeoutMs));
-    const client = await waitForSignal(loadApi(), signal);
-    client.setActionSignal(signal);
-    try {
-      return await waitForSignal(action(client, signal, deadlineAt), signal);
-    } finally {
-      client.setActionSignal(options.signal);
-    }
-  }
-  async function resumeSessionWithClient(client, signal) {
-    try {
-      const observation = await waitForSignal(
-        client.confirmOperatorSessionPresent(options.target.operatorId),
-        signal
-      );
-      await persistCurrentCookies(client, signal);
-      return {
-        observedOperator: observation.operatorId,
-        ...observation.clientId ? { clientId: observation.clientId } : {},
-        ...responseMetadata(client) ? { metadata: responseMetadata(client) } : {}
-      };
-    } catch (error) {
-      if (!signal.aborted && !client.getCookies().operatorSessionCookie) {
-        await persistCurrentCookies(client, signal).catch(() => void 0);
-      }
-      throw error;
-    }
-  }
-  async function statusWithClient(client, signal) {
-    try {
-      const observation = await waitForSignal(client.status(options.target.operatorId), signal);
-      await persistCurrentCookies(client, signal);
-      return {
-        observedOperator: observation.operatorId,
-        ...observation.clientId ? { clientId: observation.clientId } : {},
-        ...responseMetadata(client) ? { metadata: responseMetadata(client) } : {}
-      };
-    } catch (error) {
-      if (!signal.aborted && !client.getCookies().operatorSessionCookie) {
-        await persistCurrentCookies(client, signal).catch(() => void 0);
-      }
-      throw error;
-    }
-  }
-  async function tryRenewOperatorActivity(client, signal) {
-    try {
-      await waitForSignal(client.reportOperatorActivity(), signal);
-      await persistCurrentCookies(client, signal);
-    } catch (error) {
-      if (error instanceof OperatorSessionRejectedError) throw error;
-    }
-  }
-  async function loginWithClient(client, username, password, signal) {
-    try {
-      await waitForSignal(client.unlock(username, password, signal), signal);
-      await persistCurrentCookies(client, signal);
-      const result = await statusWithClient(client, signal);
-      await tryRenewOperatorActivity(client, signal);
-      return result;
-    } catch (error) {
-      if (!signal.aborted) await persistCurrentCookies(client, signal).catch(() => void 0);
-      throw error;
-    }
-  }
-  return {
-    getApi() {
-      return loadApi();
-    },
-    get api() {
-      if (!api) throw new Error("Operator client has not been initialized.");
-      return api;
-    },
-    loginWithPassword(username, password, requestedSignal) {
-      return withAction((client, signal) => loginWithClient(client, username, password, signal), requestedSignal);
-    },
-    loginFromSms() {
-      return withAction(async (client, signal, deadlineAt) => {
-        const smsCredential = await waitForSignal(options.store.getSmsCredential(), signal);
-        if (!smsCredential) throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
-        const credentials = await waitForSignal(
-          (options.readLoginCredentials ?? readOperatorLoginCredentials)({
-            operatorId: options.target.operatorId,
-            gateScope: options.target.gateScope,
-            smsEndpoint: options.target.smsEndpoint,
-            smsCredential,
-            timeoutMs: Math.max(1, deadlineAt - Date.now()),
-            signal,
-            ...options.secretReader ? { secretReader: options.secretReader } : {}
-          }),
-          signal
-        );
-        return loginWithClient(client, credentials.username, credentials.password, signal);
-      });
-    },
-    async resumeInteractiveSession() {
-      const saved = await options.store.getSession(options.profile, selectedTarget);
-      if (!saved?.operatorSessionCookie) return { step: "username" };
-      const maxAttempts = 8;
-      for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-        try {
-          await withAction(async (client, signal) => {
-            await resumeSessionWithClient(client, signal);
-            await tryRenewOperatorActivity(client, signal);
-          });
-          return { step: "menu" };
-        } catch (error) {
-          const retryable = isTransientGateReachabilityError(error) && attempt < maxAttempts - 1;
-          if (retryable) {
-            await new Promise((resolve) => setTimeout(resolve, 1e3));
-            continue;
-          }
-          const hint = error instanceof OperatorSessionRejectedError ? error.message : error instanceof Error ? error.message : void 0;
-          return { step: "username", ...hint ? { hint } : {} };
-        }
-      }
-      return { step: "username" };
-    },
-    reportOperatorActivity(requestedSignal) {
-      return withAction((client, signal) => tryRenewOperatorActivity(client, signal), requestedSignal).then(() => void 0);
-    },
-    status() {
-      return withAction((client, signal) => statusWithClient(client, signal));
-    },
-    statusWithBrokerProof() {
-      return withAction((client, signal) => statusWithClient(client, signal));
-    },
-    logout() {
-      return withAction(async (client, signal) => {
-        await waitForSignal(client.logout(), signal);
-        await waitForSignal(options.store.removeTarget(options.profile, selectedTarget), signal);
-      });
-    }
-  };
-}
-
-// src/profile-store.ts
-init_profile_name();
-import { randomUUID } from "node:crypto";
-import {
-  chmod,
-  constants,
-  lstat,
-  mkdir,
-  open,
-  rename,
-  unlink
-} from "node:fs/promises";
-import path2 from "node:path";
-var FILE_NAME = "secrets.pem";
-var OWNER_ONLY_DIRECTORY = 448;
-var OWNER_ONLY_FILE = 384;
-var LOCK_WAIT_MS = 5e3;
-var LOCK_RETRY_MS = 20;
-function emptyRecord() {
-  return { version: 2, profiles: {} };
-}
-function targetsEqual(left, right) {
-  return left.environment === right.environment && left.origin === right.origin && left.operatorId === right.operatorId;
-}
-function assertCookie(value, name) {
-  if (value !== void 0 && !new RegExp(`^${name}=[A-Za-z0-9._~-]+$`).test(value)) {
-    throw new Error(`The ${name} cookie is not valid.`);
-  }
-}
-function ownerId() {
-  return typeof process.getuid === "function" ? process.getuid() : void 0;
-}
-async function ensureOwnerOnly(pathname, kind) {
-  let info;
-  try {
-    info = await lstat(pathname);
-  } catch (error) {
-    if (error.code === "ENOENT") throw error;
-    throw new Error("Could not inspect the protected CLI profile storage.");
-  }
-  if (info.isSymbolicLink() || (kind === "directory" ? !info.isDirectory() : !info.isFile())) {
-    throw new Error(`The protected CLI profile ${kind} must be a regular ${kind}.`);
-  }
-  const uid = ownerId();
-  if (uid !== void 0 && info.uid !== uid) {
-    throw new Error(`The protected CLI profile ${kind} must be owned by the current user.`);
-  }
-  const expectedMode = kind === "directory" ? OWNER_ONLY_DIRECTORY : OWNER_ONLY_FILE;
-  if ((info.mode & 511) === expectedMode) return;
-  try {
-    await chmod(pathname, expectedMode);
-  } catch {
-    throw new Error(`Could not set protected CLI profile ${kind} permissions.`);
-  }
-  const updated = await lstat(pathname);
-  if ((updated.mode & 511) !== expectedMode) {
-    const mode = expectedMode.toString(8).padStart(4, "0");
-    throw new Error(`The protected CLI profile ${kind} must have mode ${mode}.`);
-  }
-}
-function parseLegacyTargetKey(key) {
-  try {
-    const parsed = JSON.parse(key);
-    if (!Array.isArray(parsed) || parsed.length !== 3) return void 0;
-    const [environment, origin, operatorId] = parsed;
-    if (environment !== "local" && environment !== "dev") return void 0;
-    if (typeof origin !== "string" || !origin.trim()) return void 0;
-    if (operatorId !== "OPERATOR_1") return void 0;
-    return { environment, origin: origin.trim(), operatorId };
-  } catch {
-    return void 0;
-  }
-}
-function migrateLegacyRecord(record) {
-  const migrated = emptyRecord();
-  if (record.smsCredential?.trim()) migrated.smsCredential = record.smsCredential;
-  for (const [profileName, profileRecord] of Object.entries(record.profiles ?? {})) {
-    const sessions = [];
-    for (const [targetKey, stored] of Object.entries(profileRecord.targets ?? {})) {
-      const target = parseLegacyTargetKey(targetKey);
-      if (!target) continue;
-      sessions.push({
-        ...target,
-        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
-        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {},
-        updatedAt: stored.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
-      });
-    }
-    if (sessions.length > 0) migrated.profiles[profileName] = { sessions };
-  }
-  return migrated;
-}
-function normalizeSession(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const session = value;
-  if (session.environment !== "local" && session.environment !== "dev") return void 0;
-  if (typeof session.origin !== "string" || !session.origin.trim()) return void 0;
-  if (session.operatorId !== "OPERATOR_1") return void 0;
-  if (typeof session.updatedAt !== "string" || !session.updatedAt.trim()) return void 0;
-  if (session.operatorSessionCookie !== void 0 && typeof session.operatorSessionCookie !== "string") return void 0;
-  if (session.clientIdentityCookie !== void 0 && typeof session.clientIdentityCookie !== "string") return void 0;
-  return {
-    environment: session.environment,
-    origin: session.origin.trim(),
-    operatorId: session.operatorId,
-    updatedAt: session.updatedAt,
-    ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
-    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
-  };
-}
-function parseRecord(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error("The protected CLI profile file is not valid JSON.");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("The protected CLI profile file has an unsupported format.");
-  }
-  const record = parsed;
-  if (record.version === 1) {
-    return migrateLegacyRecord(parsed);
-  }
-  if (record.version !== 2 || !record.profiles || typeof record.profiles !== "object" || Array.isArray(record.profiles)) {
-    throw new Error("The protected CLI profile file has an unsupported version or format.");
-  }
-  if (record.smsCredential !== void 0 && (typeof record.smsCredential !== "string" || !record.smsCredential.trim())) {
-    throw new Error("The protected CLI profile file has an invalid SMS credential record.");
-  }
-  const profiles = {};
-  for (const [profileName, profileValue] of Object.entries(record.profiles)) {
-    if (!profileValue || typeof profileValue !== "object" || Array.isArray(profileValue)) {
-      throw new Error("The protected CLI profile file has an unsupported version or format.");
-    }
-    const sessionsValue = profileValue.sessions;
-    if (!Array.isArray(sessionsValue)) {
-      throw new Error("The protected CLI profile file has an unsupported version or format.");
-    }
-    const sessions = sessionsValue.map(normalizeSession).filter((session) => session !== void 0);
-    if (sessions.length !== sessionsValue.length) {
-      throw new Error("The protected CLI profile file has an unsupported version or format.");
-    }
-    if (sessions.length > 0) profiles[profileName] = { sessions };
-  }
-  return {
-    version: 2,
-    ...typeof record.smsCredential === "string" && record.smsCredential.trim() ? { smsCredential: record.smsCredential } : {},
-    profiles
-  };
-}
-function findSessionIndex(sessions, target) {
-  return sessions.findIndex((session) => targetsEqual(session, target));
-}
-function sessionHasCookies(session) {
-  return Boolean(session.operatorSessionCookie || session.clientIdentityCookie);
-}
-var CliProfileStore = class {
-  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS, directoryName = ".lmt") {
-    this.lockWaitMs = lockWaitMs;
-    this.directory = path2.join(homeDirectory, directoryName);
-    this.filePath = path2.join(this.directory, FILE_NAME);
-    this.lockPath = path2.join(this.directory, `${FILE_NAME}.lock`);
-  }
-  lockWaitMs;
-  directory;
-  filePath;
-  lockPath;
-  async getSmsCredential() {
-    return this.withLock(async () => (await this.readRecord()).smsCredential);
-  }
-  async saveSmsCredential(credential) {
-    if (!credential.trim() || /[\r\n]/.test(credential)) throw new Error("SMS credential input must be a non-empty single line.");
-    await this.withLock(async () => {
-      const record = await this.readRecordForSmsCredentialUpdate();
-      record.smsCredential = credential;
-      await this.writeRecord(record);
-    });
-  }
-  async getSession(profile, target) {
-    assertClientProfileName(profile);
-    return this.withLock(async () => {
-      const stored = (await this.readRecord()).profiles[profile]?.sessions.find((session) => targetsEqual(session, target));
-      if (!stored) return void 0;
-      return {
-        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
-        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {}
-      };
-    });
-  }
-  async saveSession(profile, target, cookies) {
-    assertClientProfileName(profile);
-    assertCookie(cookies.operatorSessionCookie, "lmt_operator_session");
-    assertCookie(cookies.clientIdentityCookie, "lmt_client_id");
-    if (!cookies.operatorSessionCookie && !cookies.clientIdentityCookie) return;
-    await this.update((record) => {
-      const profileRecord = record.profiles[profile] ?? { sessions: [] };
-      const index = findSessionIndex(profileRecord.sessions, target);
-      const next = {
-        ...target,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
-        ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
-      };
-      if (!sessionHasCookies(next)) {
-        if (index >= 0) profileRecord.sessions.splice(index, 1);
-      } else if (index >= 0) {
-        profileRecord.sessions[index] = next;
-      } else {
-        profileRecord.sessions.push(next);
-      }
-      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
-      else record.profiles[profile] = profileRecord;
-    });
-  }
-  async clearOperatorSession(profile, target) {
-    assertClientProfileName(profile);
-    await this.update((record) => {
-      const profileRecord = record.profiles[profile];
-      if (!profileRecord) return;
-      const index = findSessionIndex(profileRecord.sessions, target);
-      if (index < 0) return;
-      const stored = profileRecord.sessions[index];
-      delete stored.operatorSessionCookie;
-      stored.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.cleanEmptySession(profileRecord, index);
-      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
-    });
-  }
-  async removeTarget(profile, target) {
-    assertClientProfileName(profile);
-    await this.update((record) => {
-      const profileRecord = record.profiles[profile];
-      if (!profileRecord) return;
-      profileRecord.sessions = profileRecord.sessions.filter((session) => !targetsEqual(session, target));
-      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
-    });
-  }
-  cleanEmptySession(profileRecord, index) {
-    const stored = profileRecord.sessions[index];
-    if (stored && !sessionHasCookies(stored)) profileRecord.sessions.splice(index, 1);
-  }
-  async update(mutator) {
-    await this.withLock(async () => {
-      const record = await this.readRecord();
-      mutator(record);
-      await this.writeRecord(record);
-    });
-  }
-  async withLock(operation) {
-    await this.ensureDirectory();
-    const started = Date.now();
-    let lock;
-    while (!lock) {
-      try {
-        lock = await open(this.lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
-        await lock.chmod(OWNER_ONLY_FILE);
-        await lock.writeFile(`${process.pid}
-`);
-        await lock.sync();
-      } catch (error) {
-        if (error.code !== "EEXIST") {
-          throw new Error("Could not acquire the protected CLI profile storage lock.");
-        }
-        try {
-          await ensureOwnerOnly(this.lockPath, "file");
-        } catch (lockError) {
-          if (lockError.code === "ENOENT") continue;
-          throw lockError;
-        }
-        if (Date.now() - started >= this.lockWaitMs) {
-          throw new Error("Timed out waiting for the protected CLI profile storage lock.");
-        }
-        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
-      }
-    }
-    try {
-      return await operation();
-    } finally {
-      await lock.close().catch(() => void 0);
-      await unlink(this.lockPath).catch(() => void 0);
-    }
-  }
-  async ensureDirectory() {
-    let created = false;
-    try {
-      await mkdir(this.directory, { mode: OWNER_ONLY_DIRECTORY });
-      created = true;
-    } catch (error) {
-      if (error.code !== "EEXIST") {
-        throw new Error("Could not create the protected CLI profile directory.");
-      }
-    }
-    if (created) {
-      try {
-        await chmod(this.directory, OWNER_ONLY_DIRECTORY);
-      } catch {
-        throw new Error("Could not set protected CLI profile directory permissions.");
-      }
-    }
-    await ensureOwnerOnly(this.directory, "directory");
-  }
-  isRecoverableStoreFormatError(error) {
-    if (!(error instanceof Error)) return false;
-    return error.message === "The protected CLI profile file is not valid JSON." || error.message === "The protected CLI profile file has an unsupported format." || error.message === "The protected CLI profile file has an unsupported version or format." || error.message === "The protected CLI profile file has an invalid SMS credential record.";
-  }
-  async archiveUnreadableStoreFile() {
-    const backupPath = `${this.filePath}.corrupt.${Date.now()}.bak`;
-    try {
-      await rename(this.filePath, backupPath);
-    } catch {
-      throw new Error("Could not repair the protected CLI profile file.");
-    }
-  }
-  async readRecordForSmsCredentialUpdate() {
-    try {
-      return await this.readRecord();
-    } catch (error) {
-      if (!this.isRecoverableStoreFormatError(error)) throw error;
-      await this.archiveUnreadableStoreFile();
-      return emptyRecord();
-    }
-  }
-  async readRecord() {
-    try {
-      const info = await lstat(this.filePath);
-      if (info.isSymbolicLink() || !info.isFile()) {
-        throw new Error("The protected CLI profile file must be a regular file.");
-      }
-      await ensureOwnerOnly(this.filePath, "file");
-      const handle = await open(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-      try {
-        return parseRecord(await handle.readFile("utf8"));
-      } finally {
-        await handle.close();
-      }
-    } catch (error) {
-      if (error.code === "ENOENT") return emptyRecord();
-      if (error instanceof Error && error.message.startsWith("The protected CLI profile")) throw error;
-      throw new Error("Could not read the protected CLI profile file.");
-    }
-  }
-  async writeRecord(record) {
-    const normalized = {
-      version: 2,
-      ...record.smsCredential ? { smsCredential: record.smsCredential } : {},
-      profiles: Object.fromEntries(
-        Object.entries(record.profiles).map(([profileName, profileRecord]) => [
-          profileName,
-          {
-            sessions: profileRecord.sessions.map((session) => ({
-              environment: session.environment,
-              origin: session.origin,
-              operatorId: session.operatorId,
-              ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
-              ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
-              updatedAt: session.updatedAt
-            }))
-          }
-        ])
-      )
-    };
-    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
-    const content = `${JSON.stringify(normalized, null, 2)}
-`;
-    let handle;
-    try {
-      handle = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
-      await handle.chmod(OWNER_ONLY_FILE);
-      await handle.writeFile(content, "utf8");
-      await handle.sync();
-      await handle.close();
-      handle = void 0;
-      await rename(temporaryPath, this.filePath);
-      const directoryHandle = await open(this.directory, constants.O_RDONLY);
-      try {
-        await directoryHandle.sync();
-      } finally {
-        await directoryHandle.close();
-      }
-    } catch {
-      if (handle) await handle.close().catch(() => void 0);
-      await unlink(temporaryPath).catch(() => void 0);
-      throw new Error("Could not atomically update the protected CLI profile file.");
-    }
-  }
-};
-
-// src/zerodha-validation.ts
-init_action_deadline();
-init_gate_api();
-init_profile_name();
-
-// src/protected-input.ts
-var ProtectedInputError = class extends Error {
-  code = "invalid_invocation";
-};
-async function readProtectedOtp(stdin, signal) {
-  if (stdin.isTTY) throw new ProtectedInputError("OTP requires piped protected stdin; interactive mode provides masked entry.");
-  const chunks = [];
-  let size = 0;
-  try {
-    const iterator = stdin[Symbol.asyncIterator]();
-    while (true) {
-      if (signal.aborted) throw new Error("The action exceeded its deadline.");
-      const next = await new Promise((resolve, reject) => {
-        const abort = () => {
-          stdin.destroy?.();
-          reject(new Error("The action exceeded its deadline."));
-        };
-        signal.addEventListener("abort", abort, { once: true });
-        Promise.resolve(iterator.next()).then(resolve, () => reject(new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line."))).finally(() => signal.removeEventListener("abort", abort));
-      });
-      if (next.done) break;
-      size += typeof next.value === "string" ? Buffer.byteLength(next.value) : next.value.byteLength;
-      if (size > 8) {
-        stdin.destroy?.();
-        throw new ProtectedInputError("OTP input is too large; provide one six-digit line.");
-      }
-      chunks.push(Buffer.from(next.value));
-    }
-    const buffer = Buffer.concat(chunks);
-    try {
-      const value = buffer.toString("utf8");
-      if (!/^\d{6}(?:\r?\n)?$/.test(value)) throw new ProtectedInputError("OTP input must be one six-digit line.");
-      return value.slice(0, 6);
-    } finally {
-      buffer.fill(0);
-    }
-  } catch (error) {
-    if (signal.aborted || error instanceof ProtectedInputError) throw error;
-    throw new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line.");
-  } finally {
-    for (const chunk of chunks) chunk.fill(0);
-  }
-}
-
-// src/zerodha-validation.ts
-init_zerodha_actions();
-async function runZerodhaValidation(options) {
-  const started = performance.now();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 12e4);
-  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
-  const observations = [];
-  let api;
-  let otp;
-  let result = {
-    scenario: "zerodha-session",
-    outcome: "fail",
-    reason: "validation_action_failed",
-    exitCode: 1,
-    target: { environment: options.target.environment, origin: options.target.origin },
-    profile: options.callerProfile,
-    ...options.attemptId ? { attemptId: options.attemptId } : {},
-    observations,
-    nextStep: null
-  };
-  const safeText = (message) => (otp ? message.replaceAll(otp, "[REDACTED]") : message).replace(/lmt_(?:operator_session|client_id)=[^\s,;]+/g, "[REDACTED]").replace(/(password|token|credential|cookie)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]");
-  const resumeStep = () => result.attemptId ? `Use the same environment and profile: validate zerodha-session --attempt ${result.attemptId} --otp-stdin. Observe without --otp-stdin; start explicitly only if Gate reports the attempt inactive.` : "Run validate zerodha-session again after resolving the reported prerequisite.";
-  try {
-    if (!["local", "dev"].includes(options.target.environment)) throw Object.assign(new Error("The CLI supports local or dev targets only; prod is not permitted."), { code: "invalid_target" });
-    try {
-      assertClientProfileName(options.callerProfile);
-    } catch {
-      throw new ProtectedInputError(CLIENT_PROFILE_NAME_ERROR);
-    }
-    if (options.attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(options.attemptId)) throw new ProtectedInputError("--attempt must be a valid Zerodha attempt ID.");
-    if (options.readOtp && !options.attemptId) throw new ProtectedInputError("OTP submission requires an explicit --attempt ID from a prior login or validation.");
-    const actions = createOperatorSessionActions({
-      target: options.target,
-      profile: options.callerProfile,
-      store: options.store,
-      timeoutMs: options.timeoutMs ?? 12e4,
-      signal,
-      ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
-    });
-    api = await withinActionDeadline(actions.getApi(), signal, "The Zerodha Session validation exceeded its deadline.");
-    const operator = await actions.status();
-    result.observedOperator = operator.observedOperator;
-    if (options.readOtp) {
-      otp = await withinActionDeadline(options.readOtp(signal), signal, "The Zerodha Session validation exceeded its deadline.");
-      if (!/^\d{6}$/.test(otp)) throw new ProtectedInputError("OTP input must be one six-digit line.");
-    }
-    const action = options.attemptId ? options.readOtp ? "otp" : "observe" : "login";
-    const login = await runZerodhaAction(api, action, options.target.operatorId, signal, options.attemptId, otp, {
-      onObservation(event) {
-        result.attemptId = event.attemptId;
-        if (event.type === "status") {
-          result.observedState = event.status;
-          result.observedOperator = event.operatorId;
-          observations.push(event.status);
-          if (event.failedOtpAttempts !== void 0) result.failedOtpAttempts = event.failedOtpAttempts;
-          if (event.message) result.message = safeText(event.message);
-        }
-        options.onObservation?.(event);
-      }
-    });
-    result.attemptId = login.attemptId;
-    if (login.status === "awaiting_otp") {
-      const rejected = !!options.readOtp && (login.failedOtpAttempts ?? 0) > 0;
-      result = { ...result, outcome: rejected ? "fail" : "blocked", reason: rejected ? "otp_rejected" : "awaiting_otp", exitCode: rejected ? 1 : 4, nextStep: resumeStep() };
-    } else {
-      result = { ...result, outcome: "pass", reason: "zerodha_session_validated", exitCode: 0, nextStep: null };
-    }
-  } catch (cause) {
-    const error = cause instanceof Error ? cause : void 0;
-    if (error?.attemptId) result.attemptId = error.attemptId;
-    if (error?.observedState) result.observedState = error.observedState;
-    if (error?.observedOperator) result.observedOperator = error.observedOperator;
-    const code = error?.code;
-    if (signal.aborted) {
-      result.reason = "deadline_exceeded";
-      result.message = "The Zerodha Session validation exceeded its deadline.";
-    } else if (cause instanceof OperatorSessionRejectedError) {
-      result.outcome = "blocked";
-      result.reason = "operator_login_required";
-      result.exitCode = 3;
-      result.message = "No valid Operator Session is available; run login with this environment and profile first.";
-    } else if (code && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(code)) {
-      result.outcome = "blocked";
-      result.reason = code;
-      result.exitCode = 4;
-      result.message = safeText(error.message);
-    } else {
-      result.reason = cause instanceof ProtectedInputError ? "invalid_invocation" : cause instanceof ZerodhaLoginAttemptUnavailableError ? "login_attempt_inactive" : cause instanceof ZerodhaLoginFailedError ? "zerodha_login_failed" : code ?? "validation_action_failed";
-      result.exitCode = cause instanceof ProtectedInputError || code === "invalid_target" ? 2 : 1;
-      result.message = error ? safeText(error.message) : "The Zerodha Session validation failed.";
-    }
-    result.nextStep = result.reason === "operator_login_required" ? "Run login with the selected environment and profile, then explicitly start Zerodha validation." : result.reason === "zerodha_credentials_missing" ? "Provision the selected Operator's Broker-owned Zerodha credentials, then explicitly start validation." : result.reason === "secret_store_unavailable" ? "Restore Broker access to its secret store, then explicitly start validation." : result.reason === "operator_not_configured" ? "Configure the selected Operator on Broker, then explicitly start validation." : resumeStep();
-    if (cause instanceof OperatorSessionRejectedError && api && !signal.aborted) {
-      await options.store.saveSession(options.callerProfile, options.target, api.getCookies()).catch(() => void 0);
-    }
-  } finally {
-    otp = void 0;
-    clearTimeout(timer);
-  }
-  const metadata = api?.responseMetadata();
-  return { ...result, elapsedMs: Math.round(performance.now() - started), requestId: metadata?.requestId ?? null, buildId: metadata?.buildId ?? null };
-}
-
-// src/commands.ts
-init_zerodha_actions();
-
-// src/pair-commands.ts
-import { createHash } from "node:crypto";
-import { writeFile } from "node:fs/promises";
-import path3 from "node:path";
-var PairInvocationError = class extends Error {
-  code = "invalid_invocation";
-};
-var PAIR_USAGE = "Use pair list, pair assign --ce ROW --pe ROW --lots N, pair unpair PAIR_ID --confirm, or pair report PAIR_ID [--publish | --output PATH].";
-var VALUE_OPTIONS = /* @__PURE__ */ new Set(["--env", "--profile", "--timeout", "--ce", "--pe", "--lots", "--output"]);
-var FLAG_OPTIONS = /* @__PURE__ */ new Set(["--confirm", "--publish"]);
-var PAIR_ID = /^[A-Za-z0-9_-]{1,200}$/;
-function isPairInvocation(argv) {
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === "--env" || token === "--profile" || token === "--timeout") {
-      index += 1;
-      continue;
-    }
-    if (token.startsWith("--")) continue;
-    return token === "pair";
-  }
-  return false;
-}
-function parsePairArguments(argv, parseTimeout2, validateProfile) {
-  const options = /* @__PURE__ */ new Map();
-  const flags = /* @__PURE__ */ new Set();
-  const positional = [];
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (VALUE_OPTIONS.has(token)) {
-      const value = argv[index + 1];
-      if (value === void 0 || value.startsWith("--")) throw new PairInvocationError(`Invalid or incomplete command argument: ${token}`);
-      if (options.has(token)) throw new PairInvocationError(`Argument ${token} may be specified only once.`);
-      options.set(token, value);
-      index += 1;
-    } else if (FLAG_OPTIONS.has(token)) {
-      if (flags.has(token)) throw new PairInvocationError(`Argument ${token} may be specified only once.`);
-      flags.add(token);
-    } else if (token.startsWith("--")) {
-      throw new PairInvocationError(`Unsupported command option: ${token.split("=")[0]}`);
-    } else positional.push(token);
-  }
-  const [, action, pairId, ...extra] = positional;
-  const allowed = {
-    list: [],
-    assign: ["--ce", "--pe", "--lots"],
-    unpair: ["--confirm"],
-    report: ["--publish", "--output"]
-  };
-  if (!action || !(action in allowed) || extra.length > 0 || [...options.keys(), ...flags].some((key) => !["--env", "--profile", "--timeout", ...allowed[action]].includes(key))) {
-    throw new PairInvocationError(PAIR_USAGE);
-  }
-  const environment = options.get("--env"), profile = options.get("--profile");
-  if (!environment || !profile) throw new PairInvocationError("Headless commands require both --env local|dev and --profile NAME.");
-  validateProfile(profile);
-  const target = { environment, profile, ...options.has("--timeout") ? { timeoutMs: parseTimeout2(options.get("--timeout")) } : {} };
-  if (action === "list") {
-    if (pairId !== void 0) throw new PairInvocationError(PAIR_USAGE);
-    return { kind: "pair", action, ...target };
-  }
-  if (action === "assign") {
-    if (pairId !== void 0) throw new PairInvocationError(PAIR_USAGE);
-    const ce = options.get("--ce"), pe = options.get("--pe"), lots = options.get("--lots");
-    if (!ce || !pe || !lots || !/^\d{1,3}$/.test(ce) || !/^\d{1,3}$/.test(pe) || !/^-?\d{1,6}$/.test(lots)) {
-      throw new PairInvocationError("pair assign requires --ce ROW --pe ROW --lots N as whole numbers.");
-    }
-    return { kind: "pair", action, ceRow: Number(ce), peRow: Number(pe), pairLots: Number(lots), ...target };
-  }
-  if (!pairId || !PAIR_ID.test(pairId)) throw new PairInvocationError(`pair ${action} requires a Price Cross pair ID from pair list.`);
-  if (action === "unpair") {
-    if (!flags.has("--confirm")) {
-      throw new PairInvocationError("pair unpair requires --confirm. Unpair closes any paper position at its latest complete close.");
-    }
-    return { kind: "pair", action, pairId, ...target };
-  }
-  const publish = flags.has("--publish");
-  if (publish && options.has("--output")) throw new PairInvocationError("--output downloads the workbook; --publish returns a URL. Choose one.");
-  return { kind: "pair", action: "report", pairId, publish, ...options.has("--output") ? { output: options.get("--output") } : {}, ...target };
-}
-async function runPairCommand(command, api) {
-  if (command.action === "list") return { pairs: await api.listPriceCrossPairs() };
-  if (command.action === "assign") {
-    const { pair } = await api.assignPriceCrossPair({ ceRow: command.ceRow, peRow: command.peRow, pairLots: command.pairLots });
-    return { reason: "pair_assigned", pair };
-  }
-  if (command.action === "unpair") {
-    const { pairs: _pairs, ...unpair } = await api.unpairPriceCrossPair({ pairId: command.pairId, confirmExit: true });
-    return { reason: unpair.outcome, unpair: { pairId: command.pairId, ...unpair } };
-  }
-  if (command.publish) {
-    const published = await api.publishPriceCrossReport(command.pairId);
-    return { reason: "report_published", report: { pairId: command.pairId, published: true, url: published.url, filename: published.filename } };
-  }
-  const download = await api.downloadPriceCrossReport(command.pairId);
-  const output = path3.resolve(command.output ?? path3.basename(download.filename));
-  await writeFile(output, download.bytes, { flag: command.output ? "w" : "wx" });
-  return { reason: "report_downloaded", report: {
-    pairId: command.pairId,
-    published: false,
-    filename: download.filename,
-    path: output,
-    bytes: download.bytes.length,
-    sha256: createHash("sha256").update(download.bytes).digest("hex"),
-    decisionCount: download.decisionCount
-  } };
-}
-
-// src/commands.ts
-init_gate_api();
-
-// src/validation-scenario.ts
-init_gate_api();
-import { randomUUID as randomUUID2 } from "node:crypto";
-function makeTemporaryProfile(callerProfile) {
-  const suffix = `${Date.now().toString(36)}-${process.pid.toString(36)}-${randomUUID2().slice(0, 8)}`;
-  const prefix = callerProfile.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 20) || "cli";
-  return `${prefix}-validate-${suffix}`;
-}
-function safeFailureMessage(error) {
-  if (error instanceof Error) {
-    return error.message.replace(/lmt_(?:operator_session|client_id)=[A-Za-z0-9._~-]+/g, "[REDACTED]").replace(/(password|token|credential|cookie)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]");
-  }
-  return "The Operator Session validation failed.";
-}
-function gateUnavailable(error) {
-  return error instanceof Error && /Could not reach the selected Live Market Terminal Origin/.test(error.message);
-}
-function waitForSignal2(operation, signal, deadlineMessage) {
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) {
-      reject(new Error(deadlineMessage));
-      return;
-    }
-    const onAbort = () => reject(new Error(deadlineMessage));
-    signal.addEventListener("abort", onAbort, { once: true });
-    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
-  });
-}
-function actionOptions(options, profile, timeoutMs, signal) {
-  return {
-    target: options.target,
-    profile,
-    store: options.store,
-    timeoutMs,
-    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
-    signal,
-    ...options.secretReader ? { secretReader: options.secretReader } : {},
-    ...options.readLoginCredentials ? { readLoginCredentials: options.readLoginCredentials } : {}
-  };
-}
-async function runOperatorSessionValidation(options) {
-  const started = performance.now();
-  const actionTimeoutMs = options.timeoutMs ?? 12e4;
-  const actionDeadlineAt = Date.now() + actionTimeoutMs;
-  const actionTimeoutSignal = AbortSignal.timeout(actionTimeoutMs);
-  const actionSignal = options.signal ? AbortSignal.any([options.signal, actionTimeoutSignal]) : actionTimeoutSignal;
-  const temporaryProfile = makeTemporaryProfile(options.callerProfile);
-  const invalidProfile = `${temporaryProfile.slice(0, 54)}-invalid`;
-  const observations = [];
-  let outcome = "fail";
-  let reason = "scenario_failed";
-  let observedOperator2;
-  let requestId;
-  let buildId;
-  let cleanup = { outcome: "success", removedProfiles: [] };
-  try {
-    const smsCredential = await waitForSignal2(
-      options.store.getSmsCredential(),
-      actionSignal,
-      "The validation exceeded its deadline."
-    );
-    if (!smsCredential) {
-      outcome = "blocked";
-      reason = "sms_credential_missing";
-      observations.push("Protected SMS credential is not provisioned.");
-    } else {
-      let credentials;
-      try {
-        credentials = await waitForSignal2(
-          (options.readLoginCredentials ?? readOperatorLoginCredentials)({
-            operatorId: options.target.operatorId,
-            gateScope: options.target.gateScope,
-            smsEndpoint: options.target.smsEndpoint,
-            smsCredential,
-            timeoutMs: Math.max(1, actionDeadlineAt - Date.now()),
-            signal: actionSignal,
-            ...options.secretReader ? { secretReader: options.secretReader } : {}
-          }),
-          actionSignal,
-          "The validation exceeded its deadline."
-        );
-      } catch (error) {
-        if (actionSignal.aborted) {
-          outcome = "fail";
-          reason = "deadline_exceeded";
-          observations.push("The validation exceeded its deadline while reading the Operator Directory.");
-        } else if (error instanceof SmsReadError && ["sms_credential_missing", "sms_unavailable"].includes(error.code)) {
-          outcome = "blocked";
-          reason = error.code;
-          observations.push("Operator Directory credentials could not be read from the selected Gate SMS scope.");
-        } else {
-          outcome = "fail";
-          reason = error instanceof SmsReadError ? error.code : "operator_directory_invalid";
-          observations.push("The selected Gate Operator Directory could not provide the configured Operator credentials.");
-        }
-      }
-      if (outcome === "fail" && reason === "scenario_failed" && credentials) {
-        const validActions = createOperatorSessionActions(actionOptions(options, temporaryProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
-        try {
-          const login = await waitForSignal2(
-            validActions.loginWithPassword(credentials.username, credentials.password),
-            actionSignal,
-            "The validation exceeded its deadline."
-          );
-          observedOperator2 = login.observedOperator;
-          requestId = login.metadata?.requestId;
-          buildId = login.metadata?.buildId;
-          observations.push("Gate accepted the configured Operator Login credentials.");
-          const laterInvocation = createOperatorSessionActions(actionOptions(options, temporaryProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
-          const reused = await waitForSignal2(laterInvocation.statusWithBrokerProof(), actionSignal, "The validation exceeded its deadline.");
-          observedOperator2 = reused.observedOperator;
-          requestId = reused.metadata?.requestId ?? requestId;
-          buildId = reused.metadata?.buildId ?? buildId;
-          observations.push("A fresh client invocation reused the same Gate session and observed Operator.");
-          const invalidActions = createOperatorSessionActions(actionOptions(options, invalidProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
-          let invalidLoginRejected = false;
-          try {
-            await waitForSignal2(
-              invalidActions.loginWithPassword(credentials.username, `${credentials.password}.invalid`),
-              actionSignal,
-              "The validation exceeded its deadline."
-            );
-          } catch (error) {
-            if (error instanceof OperatorCredentialsRejectedError) {
-              invalidLoginRejected = true;
-              observations.push("Gate rejected invalid credentials from a client without a usable session.");
-            } else {
-              throw error;
-            }
-          }
-          if (!invalidLoginRejected) {
-            outcome = "fail";
-            reason = "invalid_credentials_accepted";
-            observations.push("Gate accepted the invalid Operator Login credentials.");
-          } else {
-            const invalidLaterInvocation = createOperatorSessionActions(actionOptions(options, invalidProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
-            try {
-              await waitForSignal2(invalidLaterInvocation.statusWithBrokerProof(), actionSignal, "The validation exceeded its deadline.");
-              outcome = "fail";
-              reason = "invalid_login_established_session";
-              observations.push("The unauthenticated test client unexpectedly had a usable Operator Session.");
-            } catch (error) {
-              if (!(error instanceof OperatorSessionRejectedError)) throw error;
-              outcome = "pass";
-              reason = "operator_session_validated";
-              observations.push("Gate confirmed that the invalid-login client has no usable Operator Session.");
-            }
-          }
-        } catch (error) {
-          if (actionSignal.aborted) {
-            outcome = "fail";
-            reason = "deadline_exceeded";
-            observations.push("The Operator Session validation exceeded its deadline.");
-          } else if (gateUnavailable(error)) {
-            outcome = "blocked";
-            reason = "gate_unreachable";
-            observations.push("The selected Gate could not be reached during the validation scenario.");
-          } else {
-            outcome = "fail";
-            reason = error instanceof OperatorSessionRejectedError ? "session_rejected_after_login" : "validation_action_failed";
-            observations.push(safeFailureMessage(error));
-          }
-        }
-      }
-    }
-  } catch (error) {
-    if (actionSignal.aborted) {
-      outcome = "fail";
-      reason = "deadline_exceeded";
-      observations.push("The Operator Session validation exceeded its deadline.");
-    } else if (gateUnavailable(error)) {
-      outcome = "blocked";
-      reason = "gate_unreachable";
-      observations.push("The selected Gate could not be reached.");
-    } else {
-      outcome = "fail";
-      reason = "validation_action_failed";
-      observations.push(safeFailureMessage(error));
-    }
-  } finally {
-    const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 1e4;
-    const cleanupSignal = AbortSignal.timeout(cleanupTimeoutMs);
-    const removedProfiles = [];
-    let cleanupError;
-    for (const profile of [invalidProfile, temporaryProfile]) {
-      try {
-        const saved = await waitForSignal2(
-          options.store.getSession(profile, options.target),
-          cleanupSignal,
-          "Validation cleanup exceeded its deadline."
-        );
-        if (saved?.operatorSessionCookie) {
-          const cleanupActions = createOperatorSessionActions(actionOptions(options, profile, cleanupTimeoutMs, cleanupSignal));
-          try {
-            await waitForSignal2(cleanupActions.logout(), cleanupSignal, "Validation cleanup exceeded its deadline.");
-          } catch (error) {
-            cleanupError ??= { code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "gate_logout_failed", message: safeFailureMessage(error) };
-          }
-        }
-      } catch (error) {
-        cleanupError ??= {
-          code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "cleanup_store_read_failed",
-          message: safeFailureMessage(error)
-        };
-      }
-      try {
-        await waitForSignal2(
-          options.store.removeTarget(profile, options.target),
-          cleanupSignal,
-          "Validation cleanup exceeded its deadline."
-        );
-        removedProfiles.push(profile);
-      } catch (error) {
-        cleanupError ??= {
-          code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "cleanup_store_remove_failed",
-          message: safeFailureMessage(error)
-        };
-      }
-    }
-    cleanup = cleanupError ? { outcome: "fail", removedProfiles, error: cleanupError } : { outcome: "success", removedProfiles };
-    if (cleanupError && outcome === "pass") {
-      outcome = "fail";
-      reason = "cleanup_failed";
-    }
-  }
-  return {
-    target: { environment: options.target.environment, origin: options.target.origin },
-    profile: options.callerProfile,
-    outcome,
-    reason,
-    expectedOperator: options.target.operatorId,
-    ...observedOperator2 ? { observedOperator: observedOperator2 } : {},
-    temporaryProfile,
-    observations,
-    elapsedMs: Math.round(performance.now() - started),
-    ...requestId ? { requestId } : {},
-    ...buildId ? { buildId } : {},
-    cleanup
-  };
-}
-
-// src/commands.ts
-init_profile_name();
-var defaultOut = { write: (chunk) => process.stdout.write(chunk) };
-var defaultErr = { write: (chunk) => process.stderr.write(chunk) };
-var InvocationError = class extends Error {
-  constructor(message, code = "invalid_invocation") {
-    super(message);
-    this.code = code;
-  }
-  code;
-};
-function parseTimeout(raw) {
-  const match = /^(\d+(?:\.\d+)?)(ms|s|m)?$/.exec(raw.trim());
-  if (!match) throw new InvocationError("Timeout must be a finite duration such as 30000ms, 30s, or 2m.");
-  const value = Number(match[1]) * (match[2] === "m" ? 6e4 : match[2] === "s" ? 1e3 : 1);
-  if (!Number.isFinite(value) || value < 1 || value > 6e5) {
-    throw new InvocationError("Timeout must be between 1ms and 10m.");
-  }
-  return Math.ceil(value);
-}
-function splitHeadlessArgv(argv) {
-  if (hasArgumentOtp(argv)) throw new InvocationError("--otp arguments are no longer accepted. Use --otp-stdin with an explicit --attempt ID.");
-  if (argv.length === 0 || argv[0] === "interactive") {
-    throw new InvocationError("Choose a headless command or run `live-market-terminal interactive`.");
-  }
-  const options = /* @__PURE__ */ new Map();
-  let credentialStdin = false;
-  let otpStdin = false;
-  const positional = [];
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === "--otp-stdin") {
-      if (otpStdin) throw new InvocationError("Argument --otp-stdin may be specified only once.");
-      otpStdin = true;
-      continue;
-    }
-    if (token === "--credential-stdin") {
-      if (credentialStdin) throw new InvocationError("Argument --credential-stdin may be specified only once.");
-      credentialStdin = true;
-      continue;
-    }
-    if (token === "--env" || token === "--profile" || token === "--timeout" || token === "--attempt" || token === "--date") {
-      const value = argv[index + 1];
-      if (value === void 0 || value.startsWith("--")) {
-        throw new InvocationError(`Invalid or incomplete command argument: ${token}`);
-      }
-      if (options.has(token)) throw new InvocationError(`Argument ${token} may be specified only once.`);
-      options.set(token, value);
-      index += 1;
-      continue;
-    }
-    if (token.startsWith("--")) {
-      throw new InvocationError(`Unsupported command option: ${token.split("=")[0]}`);
-    }
-    positional.push(token);
-  }
-  return { positional, options, credentialStdin, otpStdin };
-}
-function parseArguments(argv) {
-  if (!hasArgumentOtp(argv) && isPairInvocation(argv)) return parsePairArguments(argv, parseTimeout, validateCommandProfile);
-  const parsedInput = splitHeadlessArgv(argv.filter((value) => value !== "--stdin"));
-  const commandVerb = parsedInput.positional[0];
-  if (commandVerb === "settings" || commandVerb === "token") {
-    const stdin = argv.includes("--stdin");
-    if (argv.filter((value) => value === "--stdin").length > 1) throw new InvocationError("--stdin may be supplied only once.");
-    const parsed = parsedInput;
-    const [kind2, action] = parsed.positional;
-    if (parsed.positional.length !== 2 || parsed.credentialStdin || parsed.otpStdin || [...parsed.options.keys()].some((key) => !["--env", "--profile", "--timeout"].includes(key)) || !(kind2 === "settings" && (action === "read" && !stdin || action === "save" && stdin) || kind2 === "token" && (action === "replace" && stdin || action === "read" && !stdin))) {
-      throw new InvocationError("Use settings read, settings save --stdin, or token replace --stdin.");
-    }
-    const environment2 = parsed.options.get("--env"), profile2 = parsed.options.get("--profile");
-    if (!environment2 || !profile2) throw new InvocationError("Headless commands require --env local|dev and --profile NAME.");
-    validateCommandProfile(profile2);
-    return { kind: kind2, action, environment: environment2, profile: profile2, ...parsed.options.has("--timeout") ? { timeoutMs: parseTimeout(parsed.options.get("--timeout")) } : {} };
-  }
-  if (argv.includes("--stdin")) throw new InvocationError("--stdin is only supported for Settings save and token replacement.");
-  const { positional, options, credentialStdin, otpStdin } = parsedInput;
-  if (positional[0] === "candle-export") {
-    const instrument = positional[1]?.match(/^([A-Za-z][A-Za-z0-9]{0,31}):([^:\s]{1,100})$/);
-    const date = options.get("--date");
-    const parsedDate = date ? /* @__PURE__ */ new Date(`${date}T00:00:00Z`) : void 0;
-    if (positional.length !== 2 || !instrument || credentialStdin || otpStdin || options.has("--attempt") || date !== void 0 && (!/^\d{4}-\d{2}-\d{2}$/.test(date) || !Number.isFinite(parsedDate.getTime()) || parsedDate.toISOString().slice(0, 10) !== date || date < "2000-01-01")) {
-      throw new InvocationError("Use candle-export EXCHANGE:SYMBOL [--date YYYY-MM-DD].");
-    }
-    const environment2 = options.get("--env");
-    const profile2 = options.get("--profile");
-    if (!environment2 || !profile2) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
-    validateCommandProfile(profile2);
-    return {
-      kind: "candle-export",
-      exchange: instrument[1].toUpperCase(),
-      tradingSymbol: instrument[2].toUpperCase(),
-      environment: environment2,
-      profile: profile2,
-      ...date ? { date } : {},
-      ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
-    };
-  }
-  if (options.has("--date")) throw new InvocationError("--date is only supported for candle-export.");
-  if (positional[0] === "zerodha") {
-    const action = positional[1];
-    if (!["login", "observe", "otp", "status"].includes(action) || positional.length !== 2 || credentialStdin) {
-      throw new InvocationError("Use zerodha login, observe, otp, or status.");
-    }
-    const environment2 = options.get("--env");
-    const profile2 = options.get("--profile");
-    if (!environment2 || !profile2) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
-    validateCommandProfile(profile2);
-    const attemptId = options.get("--attempt");
-    if (attemptId && (action === "login" || action === "status") || attemptId && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) {
-      throw new InvocationError("--attempt must be a valid Zerodha attempt ID and is only supported for observe and otp.");
-    }
-    if ((action === "observe" || action === "otp") && !attemptId) {
-      throw new InvocationError("--attempt ID is required for zerodha observe and otp. Use the attemptId returned by zerodha login.");
-    }
-    if (action === "otp" && !otpStdin || otpStdin && action !== "otp") {
-      throw new InvocationError("--otp-stdin is required for zerodha otp only. Start with zerodha login, then submit with zerodha otp --attempt ID --otp-stdin.");
-    }
-    return {
-      kind: "zerodha",
-      action,
-      environment: environment2,
-      profile: profile2,
-      attemptId,
-      otpStdin,
-      ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
-    };
-  }
-  if (positional[0] === "validate" && positional[1] === "zerodha-session") {
-    if (positional.length !== 2 || credentialStdin) throw new InvocationError("Use validate zerodha-session with optional --attempt ID and --otp-stdin.");
-    const environment2 = options.get("--env");
-    const profile2 = options.get("--profile");
-    if (!environment2 || !profile2) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
-    validateCommandProfile(profile2);
-    const attemptId = options.get("--attempt");
-    if (attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) throw new InvocationError("--attempt must be a valid Zerodha attempt ID.");
-    if (otpStdin && !attemptId) throw new InvocationError("--otp-stdin requires an explicit --attempt ID from a prior login or validation.");
-    return {
-      kind: "validate-zerodha",
-      environment: environment2,
-      profile: profile2,
-      attemptId,
-      otpStdin,
-      ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {}
-    };
-  }
-  if (otpStdin || options.has("--attempt")) throw new InvocationError("--otp-stdin and --attempt are Zerodha options only.");
-  if (positional[0] === "credential") {
-    if (positional[1] !== "provision" || positional.length > 2) {
-      throw new InvocationError("Use `credential provision` to provision the protected SMS credential.");
-    }
-    const environment2 = options.get("--env");
-    const profile2 = options.get("--profile");
-    if (!credentialStdin || !environment2 || !profile2) {
-      throw new InvocationError("Headless credential provision requires --env local|dev, --profile NAME, and --credential-stdin.");
-    }
-    validateCommandProfile(profile2);
-    return { kind: "credential-provision", environment: environment2, profile: profile2 };
-  }
-  if (credentialStdin) throw new InvocationError("--credential-stdin is only supported for credential provision.");
-  let kind;
-  if (positional[0] === "login" || positional[0] === "status" || positional[0] === "logout") {
-    kind = positional[0];
-    if (positional.length > 1) {
-      throw new InvocationError("Unexpected positional argument; use --help for command syntax.");
-    }
-  } else if (positional[0] === "validate" && positional[1] === "operator-session") {
-    kind = "validate";
-    if (positional.length > 2) {
-      throw new InvocationError("Unexpected positional argument; use --help for command syntax.");
-    }
-  } else if (positional.length === 0) {
-    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
-  } else {
-    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
-  }
-  const environment = options.get("--env");
-  const profile = options.get("--profile");
-  if (!environment || !profile) throw new InvocationError("Headless commands require both --env local|dev and --profile NAME.");
-  validateCommandProfile(profile);
-  const timeoutMs = options.has("--timeout") ? parseTimeout(options.get("--timeout")) : void 0;
-  return { kind, environment, profile, ...timeoutMs === void 0 ? {} : { timeoutMs } };
-}
-function validateCommandProfile(profile) {
-  try {
-    assertClientProfileName(profile);
-  } catch {
-    throw new InvocationError(CLIENT_PROFILE_NAME_ERROR);
-  }
-}
-function durationFor(command) {
-  return command.kind === "validate" || command.kind === "validate-zerodha" ? command.timeoutMs ?? 12e4 : command.kind === "credential-provision" ? 3e4 : command.timeoutMs ?? 3e4;
-}
-function errorDetails(error, signal) {
-  if (signal?.aborted) return { code: "deadline_exceeded", message: "The action exceeded its deadline.", exitCode: 1 };
-  if (error instanceof InvocationError || error instanceof ProtectedInputError || error instanceof PairInvocationError) {
-    return { code: error.code, message: error.message, exitCode: 2 };
-  }
-  if (error instanceof OperatorSessionRejectedError) {
-    return { code: "operator_login_required", message: "No valid Operator Session is available; run login first.", exitCode: 3 };
-  }
-  if (error instanceof OperatorCredentialsRejectedError) {
-    return { code: "incorrect_credentials", message: "Gate rejected the Operator Login credentials.", exitCode: 1 };
-  }
-  if (error instanceof ZerodhaLoginAttemptUnavailableError) return { code: "login_attempt_inactive", message: error.message, exitCode: 1 };
-  if (error instanceof ZerodhaLoginFailedError) return { code: "zerodha_login_failed", message: error.message, exitCode: 1 };
-  if (error instanceof Error && "code" in error && typeof error.code === "string" && ["zerodha_session_absent", "zerodha_session_restoring", "zerodha_verification_unavailable", "zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(error.code)) {
-    return { code: error.code, message: error.message, exitCode: 1 };
-  }
-  if (error instanceof SmsReadError) {
-    return { code: error.code, message: error.message, exitCode: 1 };
-  }
-  if (error instanceof Error && error.message === "The CLI supports local or dev targets only; prod is not permitted.") {
-    return { code: "invalid_target", message: error.message, exitCode: 2 };
-  }
-  return {
-    code: "action_failed",
-    message: error instanceof Error ? error.message : "The CLI action failed.",
-    exitCode: 1
-  };
-}
-function emit(envelope, streams, diagnostic) {
-  streams.stdout.write(`${JSON.stringify(envelope)}
-`);
-  if (diagnostic) streams.stderr.write(`${diagnostic}
-`);
-}
-async function readProtectedInput(stdin, signal, label = "SMS credential") {
-  if (!stdin || stdin.isTTY) throw new InvocationError(`${label} requires piped protected stdin.`);
-  const chunks = [];
-  let size = 0;
-  const iterator = stdin[Symbol.asyncIterator]();
-  while (true) {
-    if (signal.aborted) throw new Error("The action exceeded its deadline.");
-    const next = await new Promise((resolve, reject) => {
-      const onAbort = () => {
-        stdin.destroy?.();
-        reject(new Error("The action exceeded its deadline."));
-      };
-      signal.addEventListener("abort", onAbort, { once: true });
-      iterator.next().then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
-    });
-    if (next.done) break;
-    const chunk = next.value;
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    size += buffer.length;
-    if (size > 4096) throw new InvocationError(`${label} input is too large.`);
-    chunks.push(buffer);
-  }
-  const credential = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-  if (!credential.trim() || /[\r\n]/.test(credential)) throw new InvocationError(`${label} input must be one non-empty line.`);
-  return credential;
-}
-async function runHeadlessCli(argv, dependencies = {}) {
-  let otp;
-  let securePayload;
-  const protect = (stream) => ({ write(chunk) {
-    let output = otp ? chunk.replaceAll(otp, "[redacted]") : chunk;
-    if (securePayload) output = output.replaceAll(securePayload, "[redacted]");
-    return stream.write(output);
-  } });
-  const streams = { stdout: protect(dependencies.stdout ?? defaultOut), stderr: protect(dependencies.stderr ?? defaultErr) };
-  const started = performance.now();
-  let command;
-  let target;
-  let profile;
-  let actionApi;
-  let signal;
-  let deadlineTimer;
-  let store;
-  try {
-    command = parseArguments(argv);
-    const timeoutMs = durationFor(command);
-    const deadline = new AbortController();
-    deadlineTimer = setTimeout(() => deadline.abort(), timeoutMs);
-    signal = deadline.signal;
-    profile = command.profile;
-    try {
-      target = resolveCliTarget({ LMT_ENV: command.environment }, dependencies.configPath);
-    } catch (error) {
-      throw new InvocationError(error instanceof Error ? error.message : "The selected target is invalid.", "invalid_target");
-    }
-    store = new CliProfileStore(dependencies.homeDirectory);
-    if (command.kind === "credential-provision") {
-      const credential = await readProtectedInput(dependencies.stdin ?? process.stdin, signal);
-      await store.saveSmsCredential(credential);
-      emit({
-        version: 1,
-        command: "credential provision",
-        outcome: "success",
-        reason: "sms_credential_provisioned",
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: { requestId: null, buildId: null }
-      }, streams);
-      return 0;
-    }
-    if (command.kind === "validate-zerodha") {
-      const validation = await runZerodhaValidation({
-        target,
-        callerProfile: profile,
-        store,
-        timeoutMs,
-        signal,
-        attemptId: command.attemptId,
-        ...command.otpStdin ? { readOtp: (inputSignal) => readProtectedOtp(dependencies.stdin ?? process.stdin, inputSignal) } : {},
-        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {}
-      });
-      emit({
-        version: 1,
-        command: "validate zerodha-session",
-        outcome: validation.outcome,
-        reason: validation.reason,
-        target: validation.target,
-        profile,
-        observedOperator: validation.observedOperator,
-        attemptId: validation.attemptId,
-        observedState: validation.observedState,
-        elapsedMs: validation.elapsedMs,
-        metadata: { requestId: validation.requestId, buildId: validation.buildId },
-        validation
-      }, streams, validation.exitCode === 0 ? void 0 : `Zerodha Session validation ${validation.outcome}: ${validation.reason}. ${validation.nextStep ?? ""}`);
-      return validation.exitCode;
-    }
-    if (command.kind === "validate") {
-      const validation = await runOperatorSessionValidation({
-        target,
-        callerProfile: profile,
-        store,
-        timeoutMs,
-        signal,
-        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {},
-        ...dependencies.secretReader ? { secretReader: dependencies.secretReader } : {},
-        ...dependencies.readLoginCredentials ? { readLoginCredentials: dependencies.readLoginCredentials } : {}
-      });
-      const exitCode = validation.outcome === "pass" ? 0 : validation.outcome === "blocked" ? 4 : 1;
-      emit({
-        version: 1,
-        command: "validate operator-session",
-        outcome: validation.outcome,
-        reason: validation.reason,
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        ...validation.observedOperator ? { observedOperator: validation.observedOperator } : {},
-        elapsedMs: validation.elapsedMs,
-        metadata: { requestId: validation.requestId ?? null, buildId: validation.buildId ?? null },
-        validation
-      }, streams, exitCode === 0 ? void 0 : `Operator Session validation ${validation.outcome}: ${validation.reason}.`);
-      return exitCode;
-    }
-    const actions = createOperatorSessionActions({
-      target,
-      profile,
-      store,
-      timeoutMs,
-      signal,
-      ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {},
-      ...dependencies.secretReader ? { secretReader: dependencies.secretReader } : {},
-      ...dependencies.readLoginCredentials ? { readLoginCredentials: dependencies.readLoginCredentials } : {}
-    });
-    actionApi = await actions.getApi();
-    if (command.kind === "settings" || command.kind === "token") {
-      await actions.status();
-      let payload;
-      if (command.action !== "read") {
-        securePayload = await readProtectedInput(dependencies.stdin ?? process.stdin, signal, "Settings JSON");
-        try {
-          payload = JSON.parse(securePayload);
-        } catch {
-          throw new InvocationError("Protected stdin must contain one JSON object.");
-        }
-        if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new InvocationError("Protected stdin must contain one JSON object.");
-      }
-      const settings = command.kind === "settings" ? command.action === "read" ? { outcome: "read", settings: await actionApi.getSettings() } : await actionApi.saveSettings(payload) : void 0;
-      const tokenMetadata = command.kind === "token" && command.action === "read" ? await actionApi.getTokenMetadata() : void 0;
-      const token = command.kind === "token" && command.action === "replace" ? await actionApi.replaceToken(payload) : void 0;
-      emit({
-        version: 1,
-        command: command.kind + " " + command.action,
-        outcome: "success",
-        reason: settings?.outcome ?? token?.outcome,
-        ...settings ? { settings: settings.settings } : {},
-        ...token ? { token } : {},
-        ...tokenMetadata ? { tokenMetadata } : {},
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
-      }, streams);
-      return 0;
-    }
-    if (command.kind === "candle-export") {
-      await actions.status();
-      const candleExport = await actionApi.exportCandles({
-        exchange: command.exchange,
-        tradingSymbol: command.tradingSymbol,
-        ...command.date ? { date: command.date } : {}
-      });
-      emit({
-        version: 1,
-        command: command.kind,
-        outcome: "success",
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        observedOperator: target.operatorId,
-        candleExport,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
-      }, streams);
-      return 0;
-    }
-    if (command.kind === "pair") {
-      await actions.status();
-      const result2 = await runPairCommand(command, actionApi);
-      emit({
-        version: 1,
-        command: `pair ${command.action}`,
-        outcome: "success",
-        ...result2,
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        observedOperator: target.operatorId,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
-      }, streams);
-      return 0;
-    }
-    if (command.kind === "zerodha") {
-      await actions.status();
-      if (command.otpStdin) otp = await readProtectedOtp(dependencies.stdin ?? process.stdin, signal);
-      const zerodha = await runZerodhaAction(
-        actionApi,
-        command.action,
-        target.operatorId,
-        signal,
-        command.attemptId,
-        otp
-      );
-      const awaitingOtp = zerodha.status === "awaiting_otp";
-      emit({
-        version: 1,
-        command: `zerodha ${command.action}`,
-        outcome: awaitingOtp ? "blocked" : "success",
-        reason: awaitingOtp ? "awaiting_otp" : "zerodha_session_present",
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        observedOperator: target.operatorId,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: {
-          requestId: actionApi.responseMetadata().requestId ?? null,
-          buildId: actionApi.responseMetadata().buildId ?? null
-        },
-        zerodha
-      }, streams);
-      return awaitingOtp ? 4 : 0;
-    }
-    if (command.kind === "logout") {
-      await actions.logout();
-      emit({
-        version: 1,
-        command: "logout",
-        outcome: "success",
-        reason: "operator_session_cleared",
-        target: { environment: target.environment, origin: target.origin },
-        profile,
-        elapsedMs: Math.round(performance.now() - started),
-        metadata: {
-          requestId: actionApi.responseMetadata().requestId ?? null,
-          buildId: actionApi.responseMetadata().buildId ?? null
-        }
-      }, streams);
-      return 0;
-    }
-    const result = command.kind === "login" ? await actions.loginFromSms() : await actions.status();
-    emit({
-      version: 1,
-      command: command.kind,
-      outcome: "success",
-      reason: command.kind === "login" ? "operator_session_established" : "operator_session_valid",
-      target: { environment: target.environment, origin: target.origin },
-      profile,
-      observedOperator: result.observedOperator,
-      elapsedMs: Math.round(performance.now() - started),
-      metadata: { requestId: result.metadata?.requestId ?? null, buildId: result.metadata?.buildId ?? null }
-    }, streams);
-    return 0;
-  } catch (error) {
-    if (error instanceof OperatorSessionRejectedError && store && actionApi && target && profile && !signal?.aborted) {
-      await store.saveSession(profile, target, actionApi.getCookies()).catch(() => void 0);
-    }
-    const details = error instanceof SettingsActionError || error instanceof PriceCrossActionError ? { code: error.code, message: error.message, exitCode: 1 } : errorDetails(error, signal);
-    const recovery = error instanceof Error ? error : void 0;
-    const attemptId = recovery?.attemptId ?? (command?.kind === "zerodha" ? command.attemptId : void 0);
-    emit({
-      version: 1,
-      command: command?.kind === "zerodha" || command?.kind === "settings" || command?.kind === "token" || command?.kind === "pair" ? `${command.kind} ${command.action}` : command?.kind === "credential-provision" ? "credential provision" : command?.kind === "validate-zerodha" ? "validate zerodha-session" : command?.kind === "validate" ? "validate operator-session" : command?.kind ?? "",
-      outcome: (error instanceof SettingsActionError || error instanceof PriceCrossActionError) && error.uncertain ? "uncertain" : details.exitCode === 4 ? "blocked" : "fail",
-      reason: details.code,
-      ...target ? { target: { environment: target.environment, origin: target.origin } } : command ? { target: { environment: command.environment } } : {},
-      ...profile ? { profile } : {},
-      ...attemptId ? { attemptId, recovery: recovery?.recovery ?? "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
-      ...!attemptId && error instanceof PriceCrossActionError && error.recovery ? { recovery: error.recovery } : {},
-      ...recovery?.observedState ? { observedState: recovery.observedState } : {},
-      ...recovery?.observedOperator ? { observedOperator: recovery.observedOperator } : {},
-      elapsedMs: Math.round(performance.now() - started),
-      metadata: {
-        requestId: actionApi?.responseMetadata().requestId ?? null,
-        buildId: actionApi?.responseMetadata().buildId ?? null
-      },
-      error: { code: details.code, message: details.message }
-    }, streams, details.exitCode === 2 ? `Invalid CLI invocation: ${details.message}` : details.message);
-    return details.exitCode;
-  } finally {
-    otp = void 0;
-    securePayload = void 0;
-    if (deadlineTimer) clearTimeout(deadlineTimer);
-  }
-}
-function hasArgumentOtp(argv) {
-  return argv.some((token) => token === "--otp" || token.startsWith("--otp="));
-}
-
-// src/index.ts
-init_profile_name();
-
-// src/cli-env.ts
-function ensureFetchIgnoresEnvProxy() {
-  process.env.NODE_USE_ENV_PROXY = "0";
-}
-
-// src/help.ts
-function wantsCliHelp(argv) {
-  return argv.includes("--help") || argv.includes("-h") || argv[0] === "help";
-}
-function formatCliHelp() {
-  return `Live Market Terminal CLI
-
-Usage (lmt is an alias of live-market-terminal):
-  live-market-terminal interactive [--env local|dev] [--profile NAME]
-  live-market-terminal interactive credential provision [--env local|dev] [--profile NAME]
-  live-market-terminal login --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal logout --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal candle-export EXCHANGE:SYMBOL [--date YYYY-MM-DD] --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal pair list --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal pair assign --ce ROW --pe ROW --lots N --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal pair unpair PAIR_ID --confirm --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal pair report PAIR_ID [--publish | --output PATH] --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal settings read --env local|dev --profile NAME
-  live-market-terminal settings save --stdin --env local|dev --profile NAME
-  live-market-terminal token read --env local|dev --profile NAME
-  live-market-terminal token replace --stdin --env local|dev --profile NAME
-  live-market-terminal status --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha login --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha observe --attempt ID --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha otp --attempt ID --otp-stdin --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha status --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal validate operator-session --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal validate zerodha-session --env local|dev --profile NAME [--attempt ID [--otp-stdin]] [--timeout DURATION]
-  live-market-terminal credential provision --env local|dev --profile NAME --credential-stdin
-
-Headless options (--env, --profile, --timeout, --attempt, --otp-stdin, --credential-stdin) may appear before or after the command.
-
-From the monorepo root:
-  pnpm cli [--profile NAME]                       # interactive; --env defaults to local
-  pnpm cli --env dev --profile my-dev-session
-  pnpm -s cli:headless status --env local --profile default   # build step runs quietly (-s)
-
-Candle Export publishes a new immutable workbook link and returns its context in candleExport JSON.
-Empty or unavailable sources are explained in the workbook. Export never starts Zerodha login or token recovery.
-
-Price Cross pair commands operate Paper pairs on the owning Broker through Gate; they never save Settings or place Orders.
-pair list returns current and past pairs (JSON pairs.active / pairs.past). Broker refusals keep their reason codes
-(invalid_lots, same_type, already_paired, order_in_flight, flag_disabled, ...) with exit 1.
-pair unpair requires --confirm and returns exit details (unpair.exit) when a paper position closed; a repeat reports already_unpaired.
-pair report downloads the lifetime workbook (default: server filename in the current directory, never overwritten);
---publish returns a new immutable Hosted URL instead.
-A pair assign, unpair or publish timeout after submission is uncertain (exit 1); read pair list before resubmitting.
-The CLI never repeats a submission.
-
-Settings save reads one JSON object from stdin: expectedSettingsVersion plus selected rowCount,
-marketProtection, entryCategories, or complete credentials. Omitted fields are preserved.
-Token replace reads {accessToken?, expected, continueReplacement?, verifyCurrent?} from protected stdin.
-Use verifyCurrent: true with expected from token read to validate the saved token without supplying accessToken.
-Read token metadata through token read. A timeout after submission is uncertain; never retry blindly.
-
-Targets: local and dev only. Production is not permitted.
-
-Zerodha login is two steps: zerodha login, then zerodha otp --attempt ID --otp-stdin.
-Obtain the OTP from Kite after login returns awaiting_otp; expired attempts require a new login.
-OTP arguments (--otp CODE and --otp=CODE) are rejected. Pipe protected input; headless mode never prompts.
-
-Validate Zerodha Session starts a new attempt; resume the returned ID with --attempt ID.
-Supply --otp-stdin only when submitting a human OTP to that exact attempt.
-Validation retains the caller profile session and can replace Broker's active attempt or refresh its shared token.
-Interactive mode offers Validate Zerodha Session and explicit Resume Zerodha Validation.
-Interactive mode restores a saved Operator Session when Gate still accepts it.
-Headless commands write one JSON object per line to stdout; diagnostics go to stderr.
-
-Exit codes (headless):
-  0 success or validation pass
-  1 action failure
-  2 invalid invocation or target
-  3 Operator Login required
-  4 validation blocked or Zerodha awaiting OTP
-
-Options:
-  --env local|dev       Target environment (interactive default: local; headless: required)
-  --profile NAME        Client profile (default: default for interactive)
-  --timeout DURATION    Action deadline, e.g. 45s, 2m, 30000ms (headless)
-  --ce ROW / --pe ROW   Market Watch rows for pair assign (CE leg, PE leg)
-  --lots N              Pair Lots for pair assign; the Broker enforces 1 through its configured maximum
-  --confirm             Required by pair unpair
-  --publish             pair report: publish an immutable snapshot and return its URL
-  --output PATH         pair report: write the downloaded workbook to PATH (overwrites)
-  --date YYYY-MM-DD     Single IST date for candle-export; omitted: latest completed exchange session
-  --attempt ID          Attempt ID returned by zerodha login (required for observe and otp)
-  --otp-stdin           Read one six-digit OTP line from piped protected stdin (maximum 8 bytes)
-  --credential-stdin    Read SMS credential from piped stdin (headless provision)
-  --help, -h            Show this help
-
-Storage: ~/.lmt/secrets.pem (SMS credential and per-profile Gate cookies)
-`;
-}
-
-// src/index.ts
-var CliInvocationError = class extends Error {
-};
-function normalizeArgv(argv) {
-  return argv[0] === "--" ? argv.slice(1) : argv;
-}
-async function bootstrapCli(dependencies = {}) {
-  if (dependencies.runApplication) {
-    await dependencies.runApplication();
-    return;
-  }
-  const argv = normalizeArgv(process.argv.slice(2));
-  if (hasArgumentOtp(argv)) {
-    process.exitCode = await runHeadlessCli(argv);
-    return;
-  }
-  if (wantsCliHelp(argv)) {
-    process.stdout.write(formatCliHelp());
-    return;
-  }
-  if (argv[0] !== "interactive") {
-    process.exitCode = await runHeadlessCli(argv);
-    return;
-  }
-  let parsed;
-  let target;
-  try {
-    parsed = parseInteractiveArguments(argv);
-    target = resolveCliTarget({ LMT_ENV: parsed.environment });
-  } catch (error) {
-    throw new CliInvocationError(error instanceof Error ? error.message : "Invalid interactive CLI configuration.");
-  }
-  const { environment, profile, credentialProvision } = parsed;
-  if (credentialProvision) {
-    const [{ createElement: createElement2 }, { render: render2 }, { CredentialProvisionApp: CredentialProvisionApp2 }] = await Promise.all([
-      import("react"),
-      import("ink"),
-      Promise.resolve().then(() => (init_credential_app(), credential_app_exports))
-    ]);
-    const app2 = render2(createElement2(CredentialProvisionApp2, { store: new CliProfileStore() }));
-    await app2.waitUntilExit();
-    return;
-  }
-  const store = new CliProfileStore();
-  const actions = createOperatorSessionActions({
-    target,
-    profile,
-    store,
-    timeoutMs: 3e4
-  });
-  const client = await actions.getApi();
-  const [{ createElement }, { render }, { LoginApp: LoginApp2 }] = await Promise.all([
-    import("react"),
-    import("ink"),
-    Promise.resolve().then(() => (init_app(), app_exports))
-  ]);
-  const api = {
-    setActionSignal(signal) {
-      client.setActionSignal(signal);
-    },
-    async unlock(username, password, signal) {
-      await actions.loginWithPassword(username, password, signal);
-    },
-    startLogin: () => client.startLogin(),
-    submitOtp: (attemptId, otp) => client.submitOtp(attemptId, otp),
-    watchLoginAttempt: (attemptId, onEvent, signal) => client.watchLoginAttempt(attemptId, onEvent, signal),
-    confirmZerodhaSession: () => client.confirmZerodhaSession()
-  };
-  const app = render(createElement(LoginApp2, {
-    api,
-    expectedOperatorId: target.operatorId,
-    actionTimeoutMs: 3e4,
-    async onResumeSession() {
-      return actions.resumeInteractiveSession();
-    },
-    onReportOperatorActivity: () => actions.reportOperatorActivity(),
-    async onStatus() {
-      const status = await actions.status();
-      return `Operator Session valid: ${status.observedOperator}.`;
-    },
-    async onValidate() {
-      const result = await runOperatorSessionValidation({
-        target,
-        callerProfile: profile,
-        store,
-        timeoutMs: 12e4,
-        cleanupTimeoutMs: 1e4
-      });
-      return result;
-    },
-    onValidateZerodha: (input) => runZerodhaValidation({
-      target,
-      callerProfile: profile,
-      store,
-      timeoutMs: 12e4,
-      signal: input.signal,
-      attemptId: input.attemptId,
-      onObservation: input.onObservation,
-      ...input.otp ? { readOtp: async () => input.otp } : {}
-    }),
-    onLogout: () => actions.logout()
-  }));
-  await app.waitUntilExit();
-}
-function parseInteractiveArguments(argv) {
-  if (argv[1] === "credential" && argv[2] === "provision") {
-    let environment2 = "";
-    let profile2 = "default";
-    const values2 = /* @__PURE__ */ new Set();
-    for (let index = 3; index < argv.length; index += 2) {
-      const flag = argv[index];
-      const value = argv[index + 1];
-      if (!["--env", "--profile"].includes(flag) || value === void 0 || value.startsWith("--")) {
-        throw new Error(`Invalid interactive argument: ${flag ?? ""}`.trim());
-      }
-      if (values2.has(flag)) throw new Error(`Argument ${flag} may be specified only once.`);
-      values2.add(flag);
-      if (flag === "--env") environment2 = value;
-      if (flag === "--profile") profile2 = value;
-    }
-    assertClientProfileName(profile2);
-    return { environment: values2.has("--env") ? environment2 : "local", profile: profile2, credentialProvision: true };
-  }
-  let environment = "";
-  let profile = "default";
-  const values = /* @__PURE__ */ new Set();
-  for (let index = 1; index < argv.length; index += 2) {
-    const flag = argv[index];
-    const value = argv[index + 1];
-    if (!["--env", "--profile"].includes(flag) || value === void 0 || value.startsWith("--")) {
-      throw new Error(`Invalid interactive argument: ${flag ?? ""}`.trim());
-    }
-    if (values.has(flag)) throw new Error(`Argument ${flag} may be specified only once.`);
-    values.add(flag);
-    if (flag === "--env") environment = value;
-    if (flag === "--profile") profile = value;
-  }
-  assertClientProfileName(profile);
-  return { environment: values.has("--env") ? environment : "local", profile, credentialProvision: false };
-}
-var invokedFile = process.argv[1];
-if (invokedFile && path4.resolve(fileURLToPath2(import.meta.url)) === realpathSync(invokedFile)) {
-  ensureFetchIgnoresEnvProxy();
-  bootstrapCli().catch((error) => {
-    const message = error instanceof Error ? error.message : "CLI failed to start.";
-    process.stderr.write(`${message}
+// src/bin.ts
+var MINIMUM_NODE_MAJOR = 22;
+var found = process.versions.node;
+if (Number(found.split(".")[0]) < MINIMUM_NODE_MAJOR) {
+  process.stderr.write(`lmt needs Node ${MINIMUM_NODE_MAJOR} or newer (found ${found}). Install it with: nvm install 24
 `);
-    process.exitCode = error instanceof CliInvocationError ? 2 : 1;
-  });
+  process.exit(1);
 }
-export {
-  bootstrapCli,
-  normalizeArgv,
-  parseInteractiveArguments
-};
+var { runCliMain } = await import("./src-MZYWVU46.js");
+runCliMain();