@ai-digital-factory/lmt-cli 0.1.6 → 1.0.0

package/dist/chunk-4N3XUBM4.js

@@ -0,0 +1,1483 @@
+// src/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+var repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../../../../"
+);
+var packagedConfigPath = fileURLToPath(new URL("../lmt.config.json", import.meta.url));
+var DEFAULT_CONFIG_PATH = existsSync(packagedConfigPath) ? packagedConfigPath : path.join(repoRoot, "lmt.config.json");
+function resolveCanonicalOrigin(value, environment) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`lmt.config.json does not contain the ${environment} Origin.`);
+  }
+  let origin;
+  try {
+    origin = new URL(value.trim());
+  } catch {
+    throw new Error(`${environment} Origin must be an absolute HTTP URL.`);
+  }
+  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
+    throw new Error(
+      `${environment} Origin must be an HTTP URL without credentials or a fragment.`
+    );
+  }
+  if (origin.pathname !== "/" || origin.search) {
+    throw new Error(`${environment} Origin must not include a path or query string.`);
+  }
+  return origin.origin;
+}
+var LOCAL_CONFIG_FILE = "lmt.config.local.json";
+var LocalConfigError = class extends Error {
+  code = "invalid_local_config";
+};
+function findCheckoutRoot(workingDirectory) {
+  let directory = path.resolve(workingDirectory);
+  for (; ; ) {
+    if (existsSync(path.join(directory, ".git"))) return directory;
+    const parent = path.dirname(directory);
+    if (parent === directory) return void 0;
+    directory = parent;
+  }
+}
+function checkoutLocalOrigin(workingDirectory) {
+  const root = findCheckoutRoot(workingDirectory);
+  if (!root) return void 0;
+  const file = path.join(root, LOCAL_CONFIG_FILE);
+  if (!existsSync(file)) return void 0;
+  let config;
+  try {
+    config = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    throw new LocalConfigError(`Could not read ${file} as JSON.`);
+  }
+  const value = config?.environments?.local?.origin;
+  if (value === void 0) return void 0;
+  try {
+    return resolveCanonicalOrigin(value, "local");
+  } catch (error) {
+    throw new LocalConfigError(`${file}: ${error instanceof Error ? error.message : "invalid local Origin."}`);
+  }
+}
+function resolveTargetOrigin(environment, canonicalOrigin, workingDirectory = process.cwd()) {
+  const origin = resolveCanonicalOrigin(canonicalOrigin, environment);
+  return environment === "local" && checkoutLocalOrigin(workingDirectory) || origin;
+}
+function resolveCliTarget(env = process.env, configPath = DEFAULT_CONFIG_PATH, workingDirectory = process.cwd()) {
+  const environment = env.LMT_ENV?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("The CLI supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt.config.json does not contain the ${environment} environment.`);
+  }
+  const origin = resolveTargetOrigin(environment, selected.origin, workingDirectory);
+  const smsEndpoint = typeof config.smsEndpoint === "string" ? config.smsEndpoint.trim() : "";
+  if (!smsEndpoint) throw new Error("lmt.config.json does not contain smsEndpoint.");
+  const gateScope = typeof selected.gateScope === "string" ? selected.gateScope.trim() : "";
+  if (!gateScope) throw new Error(`lmt.config.json does not contain the ${environment} Gate scope.`);
+  const operators = selected.brokerOperatorIds;
+  if (!Array.isArray(operators) || operators.length !== 1 || operators[0] !== "OPERATOR_1") {
+    throw new Error(`${environment} must have exactly one configured Operator: OPERATOR_1.`);
+  }
+  let smsUrl;
+  try {
+    smsUrl = new URL(smsEndpoint);
+  } catch {
+    throw new Error("smsEndpoint must be an absolute HTTP URL.");
+  }
+  if (!/^https?:$/.test(smsUrl.protocol) || smsUrl.username || smsUrl.password || smsUrl.hash) {
+    throw new Error("smsEndpoint must be an HTTP URL without credentials or a fragment.");
+  }
+  return {
+    environment,
+    origin,
+    gateScope,
+    smsEndpoint: smsUrl.origin,
+    operatorId: "OPERATOR_1"
+  };
+}
+function resolveCliApiOrigin(target) {
+  return target.origin;
+}
+
+// src/profile-name.ts
+var CLIENT_PROFILE_NAME_ERROR = "Profile must be 1\u201364 letters, digits, dots, underscores, or hyphens, starting with a letter or digit.";
+var clientProfilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function assertClientProfileName(profile) {
+  if (!clientProfilePattern.test(profile)) throw new Error(CLIENT_PROFILE_NAME_ERROR);
+}
+
+// src/profile-store.ts
+import { randomUUID } from "node:crypto";
+import {
+  chmod,
+  constants,
+  lstat,
+  mkdir,
+  open,
+  rename,
+  unlink
+} from "node:fs/promises";
+import path2 from "node:path";
+var CONTROLLER_SESSION = /* @__PURE__ */ Symbol("lmt.controller-session");
+function ownerOf(profile) {
+  return profile ?? CONTROLLER_SESSION;
+}
+function profileNameOf(owner) {
+  return owner === CONTROLLER_SESSION ? void 0 : owner;
+}
+var FILE_NAME = "secrets.pem";
+var OWNER_ONLY_DIRECTORY = 448;
+var OWNER_ONLY_FILE = 384;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 20;
+function emptyRecord() {
+  return { version: 2, profiles: {} };
+}
+function targetsEqual(left, right) {
+  return left.environment === right.environment && left.origin === right.origin && left.operatorId === right.operatorId;
+}
+function assertCookie(value, name) {
+  if (value !== void 0 && !new RegExp(`^${name}=[A-Za-z0-9._~-]+$`).test(value)) {
+    throw new Error(`The ${name} cookie is not valid.`);
+  }
+}
+function ownerId() {
+  return typeof process.getuid === "function" ? process.getuid() : void 0;
+}
+async function ensureOwnerOnly(pathname, kind) {
+  let info;
+  try {
+    info = await lstat(pathname);
+  } catch (error) {
+    if (error.code === "ENOENT") throw error;
+    throw new Error("Could not inspect the protected CLI profile storage.");
+  }
+  if (info.isSymbolicLink() || (kind === "directory" ? !info.isDirectory() : !info.isFile())) {
+    throw new Error(`The protected CLI profile ${kind} must be a regular ${kind}.`);
+  }
+  const uid = ownerId();
+  if (uid !== void 0 && info.uid !== uid) {
+    throw new Error(`The protected CLI profile ${kind} must be owned by the current user.`);
+  }
+  const expectedMode = kind === "directory" ? OWNER_ONLY_DIRECTORY : OWNER_ONLY_FILE;
+  if ((info.mode & 511) === expectedMode) return;
+  try {
+    await chmod(pathname, expectedMode);
+  } catch {
+    throw new Error(`Could not set protected CLI profile ${kind} permissions.`);
+  }
+  const updated = await lstat(pathname);
+  if ((updated.mode & 511) !== expectedMode) {
+    const mode = expectedMode.toString(8).padStart(4, "0");
+    throw new Error(`The protected CLI profile ${kind} must have mode ${mode}.`);
+  }
+}
+function parseLegacyTargetKey(key) {
+  try {
+    const parsed = JSON.parse(key);
+    if (!Array.isArray(parsed) || parsed.length !== 3) return void 0;
+    const [environment, origin, operatorId] = parsed;
+    if (environment !== "local" && environment !== "dev") return void 0;
+    if (typeof origin !== "string" || !origin.trim()) return void 0;
+    if (operatorId !== "OPERATOR_1") return void 0;
+    return { environment, origin: origin.trim(), operatorId };
+  } catch {
+    return void 0;
+  }
+}
+function migrateLegacyRecord(record) {
+  const migrated = emptyRecord();
+  if (record.smsCredential?.trim()) migrated.smsCredential = record.smsCredential;
+  for (const [profileName, profileRecord] of Object.entries(record.profiles ?? {})) {
+    const sessions = [];
+    for (const [targetKey, stored] of Object.entries(profileRecord.targets ?? {})) {
+      const target = parseLegacyTargetKey(targetKey);
+      if (!target) continue;
+      sessions.push({
+        ...target,
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {},
+        updatedAt: stored.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    if (sessions.length > 0) migrated.profiles[profileName] = { sessions };
+  }
+  return migrated;
+}
+function normalizeSession(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const session = value;
+  if (session.environment !== "local" && session.environment !== "dev") return void 0;
+  if (typeof session.origin !== "string" || !session.origin.trim()) return void 0;
+  if (session.operatorId !== "OPERATOR_1") return void 0;
+  if (typeof session.updatedAt !== "string" || !session.updatedAt.trim()) return void 0;
+  if (session.operatorSessionCookie !== void 0 && typeof session.operatorSessionCookie !== "string") return void 0;
+  if (session.clientIdentityCookie !== void 0 && typeof session.clientIdentityCookie !== "string") return void 0;
+  return {
+    environment: session.environment,
+    origin: session.origin.trim(),
+    operatorId: session.operatorId,
+    updatedAt: session.updatedAt,
+    ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
+  };
+}
+function normalizeControllerSession(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const session = value;
+  if (session.environment !== "local" && session.environment !== "dev") return void 0;
+  if (session.operatorId !== "OPERATOR_1") return void 0;
+  if (typeof session.updatedAt !== "string" || !session.updatedAt.trim()) return void 0;
+  if (session.operatorSessionCookie !== void 0 && typeof session.operatorSessionCookie !== "string") return void 0;
+  if (session.clientIdentityCookie !== void 0 && typeof session.clientIdentityCookie !== "string") return void 0;
+  return {
+    environment: session.environment,
+    operatorId: session.operatorId,
+    updatedAt: session.updatedAt,
+    ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
+  };
+}
+function parseRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("The protected CLI profile file is not valid JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("The protected CLI profile file has an unsupported format.");
+  }
+  const record = parsed;
+  if (record.version === 1) {
+    return migrateLegacyRecord(parsed);
+  }
+  if (record.version !== 2 || !record.profiles || typeof record.profiles !== "object" || Array.isArray(record.profiles)) {
+    throw new Error("The protected CLI profile file has an unsupported version or format.");
+  }
+  if (record.smsCredential !== void 0 && (typeof record.smsCredential !== "string" || !record.smsCredential.trim())) {
+    throw new Error("The protected CLI profile file has an invalid SMS credential record.");
+  }
+  const profiles = {};
+  for (const [profileName, profileValue] of Object.entries(record.profiles)) {
+    if (!profileValue || typeof profileValue !== "object" || Array.isArray(profileValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessionsValue = profileValue.sessions;
+    if (!Array.isArray(sessionsValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessions = sessionsValue.map(normalizeSession).filter((session) => session !== void 0);
+    if (sessions.length !== sessionsValue.length) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    if (sessions.length > 0) profiles[profileName] = { sessions };
+  }
+  let controllerSessions = [];
+  if (record.controllerSessions !== void 0) {
+    if (!Array.isArray(record.controllerSessions)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    controllerSessions = record.controllerSessions.map(normalizeControllerSession).filter((session) => session !== void 0);
+    if (controllerSessions.length !== record.controllerSessions.length) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+  }
+  return {
+    version: 2,
+    ...typeof record.smsCredential === "string" && record.smsCredential.trim() ? { smsCredential: record.smsCredential } : {},
+    ...controllerSessions.length > 0 ? { controllerSessions } : {},
+    profiles
+  };
+}
+function sessionMatches(owner, session, target) {
+  if (profileNameOf(owner) === void 0) return session.environment === target.environment && session.operatorId === target.operatorId;
+  return session.origin !== void 0 && targetsEqual({ ...session, origin: session.origin }, target);
+}
+function assertOwner(owner) {
+  const profile = profileNameOf(owner);
+  if (profile !== void 0) assertClientProfileName(profile);
+}
+function sessionsOf(record, owner) {
+  const profile = profileNameOf(owner);
+  return [...profile === void 0 ? record.controllerSessions ?? [] : record.profiles[profile]?.sessions ?? []];
+}
+function setSessions(record, owner, sessions) {
+  const profile = profileNameOf(owner);
+  if (profile === void 0) {
+    if (sessions.length === 0) delete record.controllerSessions;
+    else record.controllerSessions = sessions;
+  } else if (sessions.length === 0) {
+    delete record.profiles[profile];
+  } else {
+    record.profiles[profile] = { sessions };
+  }
+}
+function storedSession(owner, target, cookies) {
+  return {
+    environment: target.environment,
+    ...profileNameOf(owner) === void 0 ? {} : { origin: target.origin },
+    operatorId: target.operatorId,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
+    ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
+  };
+}
+function sessionHasCookies(session) {
+  return Boolean(session.operatorSessionCookie || session.clientIdentityCookie);
+}
+var CliProfileStore = class {
+  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS) {
+    this.lockWaitMs = lockWaitMs;
+    this.directory = path2.join(homeDirectory, ".lmt");
+    this.filePath = path2.join(this.directory, FILE_NAME);
+    this.lockPath = path2.join(this.directory, `${FILE_NAME}.lock`);
+  }
+  lockWaitMs;
+  directory;
+  filePath;
+  lockPath;
+  async getSmsCredential() {
+    return this.withLock(async () => (await this.readRecord()).smsCredential);
+  }
+  async saveSmsCredential(credential) {
+    if (!credential.trim() || /[\r\n]/.test(credential)) throw new Error("SMS credential input must be a non-empty single line.");
+    await this.withLock(async () => {
+      const record = await this.readRecordForSmsCredentialUpdate();
+      record.smsCredential = credential;
+      await this.writeRecord(record);
+    });
+  }
+  async getSession(owner, target) {
+    assertOwner(owner);
+    return this.withLock(async () => {
+      const stored = sessionsOf(await this.readRecord(), owner).find((session) => sessionMatches(owner, session, target));
+      if (!stored) return void 0;
+      return {
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {}
+      };
+    });
+  }
+  async saveSession(owner, target, cookies) {
+    assertOwner(owner);
+    assertCookie(cookies.operatorSessionCookie, "lmt_operator_session");
+    assertCookie(cookies.clientIdentityCookie, "lmt_client_id");
+    if (!cookies.operatorSessionCookie && !cookies.clientIdentityCookie) return;
+    await this.update((record) => {
+      const sessions = sessionsOf(record, owner);
+      const index = sessions.findIndex((session) => sessionMatches(owner, session, target));
+      const next = storedSession(owner, target, cookies);
+      if (index >= 0) sessions[index] = next;
+      else sessions.push(next);
+      setSessions(record, owner, sessions);
+    });
+  }
+  async clearOperatorSession(owner, target) {
+    assertOwner(owner);
+    await this.update((record) => {
+      const sessions = sessionsOf(record, owner);
+      const index = sessions.findIndex((session) => sessionMatches(owner, session, target));
+      if (index < 0) return;
+      const { operatorSessionCookie: _cleared, ...remaining } = sessions[index];
+      sessions[index] = { ...remaining, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      setSessions(record, owner, sessions.filter(sessionHasCookies));
+    });
+  }
+  async removeTarget(owner, target) {
+    assertOwner(owner);
+    await this.update((record) => {
+      setSessions(record, owner, sessionsOf(record, owner).filter((session) => !sessionMatches(owner, session, target)));
+    });
+  }
+  async update(mutator) {
+    await this.withLock(async () => {
+      const record = await this.readRecord();
+      mutator(record);
+      await this.writeRecord(record);
+    });
+  }
+  async withLock(operation) {
+    await this.ensureDirectory();
+    const started = Date.now();
+    let lock;
+    while (!lock) {
+      try {
+        lock = await open(this.lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+        await lock.chmod(OWNER_ONLY_FILE);
+        await lock.writeFile(`${process.pid}
+`);
+        await lock.sync();
+      } catch (error) {
+        if (error.code !== "EEXIST") {
+          throw new Error("Could not acquire the protected CLI profile storage lock.");
+        }
+        try {
+          await ensureOwnerOnly(this.lockPath, "file");
+        } catch (lockError) {
+          if (lockError.code === "ENOENT") continue;
+          throw lockError;
+        }
+        if (Date.now() - started >= this.lockWaitMs) {
+          throw new Error("Timed out waiting for the protected CLI profile storage lock.");
+        }
+        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await operation();
+    } finally {
+      await lock.close().catch(() => void 0);
+      await unlink(this.lockPath).catch(() => void 0);
+    }
+  }
+  async ensureDirectory() {
+    let created = false;
+    try {
+      await mkdir(this.directory, { mode: OWNER_ONLY_DIRECTORY });
+      created = true;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new Error("Could not create the protected CLI profile directory.");
+      }
+    }
+    if (created) {
+      try {
+        await chmod(this.directory, OWNER_ONLY_DIRECTORY);
+      } catch {
+        throw new Error("Could not set protected CLI profile directory permissions.");
+      }
+    }
+    await ensureOwnerOnly(this.directory, "directory");
+  }
+  isRecoverableStoreFormatError(error) {
+    if (!(error instanceof Error)) return false;
+    return error.message === "The protected CLI profile file is not valid JSON." || error.message === "The protected CLI profile file has an unsupported format." || error.message === "The protected CLI profile file has an unsupported version or format." || error.message === "The protected CLI profile file has an invalid SMS credential record.";
+  }
+  async archiveUnreadableStoreFile() {
+    const backupPath = `${this.filePath}.corrupt.${Date.now()}.bak`;
+    try {
+      await rename(this.filePath, backupPath);
+    } catch {
+      throw new Error("Could not repair the protected CLI profile file.");
+    }
+  }
+  async readRecordForSmsCredentialUpdate() {
+    try {
+      return await this.readRecord();
+    } catch (error) {
+      if (!this.isRecoverableStoreFormatError(error)) throw error;
+      await this.archiveUnreadableStoreFile();
+      return emptyRecord();
+    }
+  }
+  async readRecord() {
+    try {
+      const info = await lstat(this.filePath);
+      if (info.isSymbolicLink() || !info.isFile()) {
+        throw new Error("The protected CLI profile file must be a regular file.");
+      }
+      await ensureOwnerOnly(this.filePath, "file");
+      const handle = await open(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      try {
+        return parseRecord(await handle.readFile("utf8"));
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") return emptyRecord();
+      if (error instanceof Error && error.message.startsWith("The protected CLI profile")) throw error;
+      throw new Error("Could not read the protected CLI profile file.");
+    }
+  }
+  async writeRecord(record) {
+    const normalized = {
+      version: 2,
+      ...record.smsCredential ? { smsCredential: record.smsCredential } : {},
+      ...record.controllerSessions?.length ? {
+        controllerSessions: record.controllerSessions.map((session) => ({
+          environment: session.environment,
+          operatorId: session.operatorId,
+          ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+          ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
+          updatedAt: session.updatedAt
+        }))
+      } : {},
+      profiles: Object.fromEntries(
+        Object.entries(record.profiles).map(([profileName, profileRecord]) => [
+          profileName,
+          {
+            sessions: profileRecord.sessions.map((session) => ({
+              environment: session.environment,
+              origin: session.origin,
+              operatorId: session.operatorId,
+              ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+              ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
+              updatedAt: session.updatedAt
+            }))
+          }
+        ])
+      )
+    };
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const content = `${JSON.stringify(normalized, null, 2)}
+`;
+    let handle;
+    try {
+      handle = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+      await handle.chmod(OWNER_ONLY_FILE);
+      await handle.writeFile(content, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      await rename(temporaryPath, this.filePath);
+      const directoryHandle = await open(this.directory, constants.O_RDONLY);
+      try {
+        await directoryHandle.sync();
+      } finally {
+        await directoryHandle.close();
+      }
+    } catch {
+      if (handle) await handle.close().catch(() => void 0);
+      await unlink(temporaryPath).catch(() => void 0);
+      throw new Error("Could not atomically update the protected CLI profile file.");
+    }
+  }
+};
+
+// ../../packages/contracts/src/price-cross-time.ts
+var IST_OFFSET_MS = 330 * 6e4;
+
+// ../../packages/contracts/src/index.ts
+var OPERATOR_SESSION_EXPIRY_TRACE_GRACE_SECONDS = 24 * 60 * 60;
+var OPERATOR_SESSION_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_OPERATOR_SESSION_IDLE_HINT_SECONDS = 7 * 24 * 60 * 60;
+var ZERODHA_SESSION_ADMISSION_HEADER = "x-lmt-session-admission";
+var ZERODHA_SESSION_ADMISSION_VERIFY = "verify";
+function isOperatorMarketProtection(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 2 && value <= 90;
+}
+var ENTRY_CATEGORIES = [
+  "NSE EQ",
+  "BSE EQ",
+  "NFO FUT",
+  "NFO CE",
+  "NFO PE",
+  "BFO FUT",
+  "BFO CE",
+  "BFO PE"
+];
+function validateEntryCategories(value) {
+  if (!Array.isArray(value) || value.some((category) => typeof category !== "string" || !ENTRY_CATEGORIES.includes(category)) || new Set(value).size !== value.length) {
+    throw new Error("entryCategories must be a list of supported Entry Categories with no duplicates.");
+  }
+  return [...value];
+}
+var API_PATHS = {
+  health: "/api/health",
+  unlockOperatorSession: "/api/operator-session/unlock",
+  reportOperatorActivity: "/api/operator-session/activity",
+  operatorSession: "/api/operator-session",
+  logoutUnauthenticatedOperator: "/api/unauthenticated-operator/logout",
+  zerodhaSession: "/api/zerodha/session",
+  logoutAuthenticatedOperator: "/api/authenticated-operator/logout",
+  operators: "/api/operators",
+  startOperatorLogin: "/api/operators/login",
+  operatorLoginEvents: "/api/operators/login/events",
+  operatorLoginOtp: "/api/operators/login/otp",
+  cancelOperatorLogin: "/api/operators/login/cancel",
+  zerodhaAccessToken: "/api/zerodha/access-token",
+  zerodhaAccessTokenRecovery: "/api/zerodha/access-token/recovery",
+  zerodhaAccessTokenPublication: "/api/zerodha/access-token/publication",
+  zerodhaCredentials: "/api/zerodha/credentials",
+  entryCategorySettings: "/api/settings/entry-categories",
+  operatorSettings: "/api/settings",
+  marketProtectionSettings: "/api/settings/market-protection",
+  operatorEgress: "/api/operator-egress",
+  validateInstrument: "/api/instruments/validate",
+  instrumentSearch: "/api/instruments/search",
+  startMarketFeed: "/api/market/feed/start",
+  stopMarketFeed: "/api/market/feed/stop",
+  marketFeedStream: "/api/market/feed/stream",
+  marketWatch: "/api/market-watch",
+  marketWatchRowCount: "/api/settings/market-watch-row-count",
+  previousInstruments: "/api/market-watch/previous-instruments",
+  candleHistoryLatest: "/api/candle-history/latest",
+  candleHistoryExport: "/api/candle-history/export",
+  candleExportOnDemand: "/api/candle-history/export/on-demand",
+  candleHistoryExportShare: "/api/candle-history/export/share",
+  candleHistory: "/api/candle-history",
+  zerodhaHistoricalCandles: "/api/zerodha/historical-candles",
+  applyMarketWatchRow: "/api/market-watch/apply",
+  addMarketWatchRow: "/api/market-watch/rows",
+  removeMarketWatchRow: "/api/market-watch/remove",
+  clearMarketWatchRow: "/api/market-watch/clear",
+  placeMarketWatchOrder: "/api/market-watch/orders/place",
+  retryMarketWatchPlace: "/api/market-watch/orders/place-retry",
+  exitMarketWatchOrder: "/api/market-watch/orders/exit",
+  cancelMarketWatchOrder: "/api/market-watch/orders/cancel",
+  assignPriceCrossPair: "/api/price-cross/pairs/assign",
+  unpairPriceCrossPair: "/api/price-cross/pairs/unpair",
+  priceCrossReport: "/api/price-cross/report",
+  priceCrossReportShare: "/api/price-cross/report/share",
+  priceCrossPairs: "/api/price-cross/pairs",
+  priceCrossHistory: "/api/price-cross/history",
+  priceCrossCloseChart: "/api/price-cross/close-chart"
+};
+
+// src/gate-api-client.ts
+var SettingsActionError = class extends Error {
+  constructor(code, uncertain = false, messageOverride) {
+    super(messageOverride ?? (uncertain ? "Submission could not be confirmed. Read current Settings or token metadata before another submission." : code === "settings_conflict" ? "Settings changed elsewhere. Read saved Settings and submit again with its version." : code === "active_trading_confirmation" ? "Another device has active trading. Review it, then explicitly submit continueReplacement: true to continue." : code === "token_changed" ? "The token changed. Read token metadata and review a fresh submission." : code === "token_write_unresolved" ? "A token write is unresolved. Resolve interrupted save in Web before replacing." : code === "unresolved_order" ? "An Order remains unresolved. Reconcile it before replacing the token." : "The Settings or token operation was rejected."));
+    this.code = code;
+    this.uncertain = uncertain;
+  }
+  code;
+  uncertain;
+};
+var PRICE_CROSS_UNCERTAIN_MESSAGE = "Submission could not be confirmed and was not retried. Run pair list before another submission.";
+var PriceCrossActionError = class extends Error {
+  constructor(code, uncertain = false, message) {
+    super(message ?? (uncertain ? PRICE_CROSS_UNCERTAIN_MESSAGE : "The Price Cross request was rejected."));
+    this.code = code;
+    this.uncertain = uncertain;
+    this.name = "PriceCrossActionError";
+    if (uncertain) this.recovery = "Read current and past pairs with pair list; the CLI never repeats a submission.";
+  }
+  code;
+  uncertain;
+  recovery;
+};
+var OperatorSessionRejectedError = class extends Error {
+  constructor(reason) {
+    super("The saved Operator Session was rejected by Gate.");
+    this.reason = reason;
+    this.name = "OperatorSessionRejectedError";
+  }
+  reason;
+  code = "operator_login_required";
+};
+var ZerodhaLoginFailedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZerodhaLoginFailedError";
+  }
+};
+var ZerodhaLoginAttemptUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZerodhaLoginAttemptUnavailableError";
+  }
+};
+var OperatorCredentialsRejectedError = class extends Error {
+  code = "incorrect_credentials";
+  constructor() {
+    super("Incorrect Operator Login Username or Password.");
+    this.name = "OperatorCredentialsRejectedError";
+  }
+};
+function redactSecrets(message, secrets) {
+  let redacted = message;
+  for (const secret of secrets) {
+    if (secret) redacted = redacted.split(secret).join("[REDACTED]");
+  }
+  return redacted.replace(
+    /((?:access_token|request_token|api_key|password|username|otp|totp|token|cookie)\s*[=:]\s*["']?)[^"'&\s,;}]*/gi,
+    "$1[REDACTED]"
+  );
+}
+function messageFromBody(body, fallback, secrets = []) {
+  const message = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : fallback;
+  return redactSecrets(message, secrets);
+}
+function redactEvent(event, secrets) {
+  if ("message" in event && typeof event.message === "string") {
+    return { ...event, message: redactSecrets(event.message, secrets) };
+  }
+  return event;
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+function transportErrorDetail(error) {
+  if (!(error instanceof Error)) return void 0;
+  const cause = error.cause;
+  if (cause instanceof Error) {
+    const code = cause.code;
+    return code ? String(code) : cause.message;
+  }
+  return error.message;
+}
+async function requestOrThrow(request, unavailableMessage, signal, targetUrl, secrets = []) {
+  try {
+    return await request();
+  } catch (error) {
+    if (signal?.aborted) throw new Error("The action exceeded its deadline.");
+    if (error instanceof OperatorSessionRejectedError || error instanceof ZerodhaLoginAttemptUnavailableError) throw error;
+    const detail = transportErrorDetail(error);
+    const at = targetUrl ? ` [${targetUrl}]` : "";
+    throw new Error(redactSecrets(detail ? `${unavailableMessage} (${detail})${at}` : `${unavailableMessage}${at}`, secrets));
+  }
+}
+function responseCookies(response) {
+  const responseHeaders = response.headers;
+  const setCookies = responseHeaders.getSetCookie?.() ?? [];
+  const values = setCookies.length > 0 ? setCookies : [response.headers.get("set-cookie") ?? ""];
+  const cookies = {};
+  for (const value of values) {
+    for (const match of value.matchAll(/(?:^|,\s*)(lmt_operator_session|lmt_client_id)=([^;,\s]+)/g)) {
+      if (match[1] === "lmt_operator_session") cookies.operatorSessionCookie = `${match[1]}=${match[2]}`;
+      if (match[1] === "lmt_client_id") cookies.clientIdentityCookie = `${match[1]}=${match[2]}`;
+    }
+  }
+  return cookies;
+}
+function clientIdFromCookie(cookie) {
+  return cookie?.startsWith("lmt_client_id=") ? cookie.slice("lmt_client_id=".length) : void 0;
+}
+function observedOperator(body) {
+  if (!body || typeof body !== "object" || !("operators" in body)) return void 0;
+  const list = body.operators;
+  if (!Array.isArray(list) || list.length !== 1) return void 0;
+  const first = list[0];
+  return first && typeof first === "object" && "id" in first && typeof first.id === "string" ? first.id : void 0;
+}
+function rejectionReason(body) {
+  return body && typeof body === "object" && "reason" in body && typeof body.reason === "string" ? body.reason : void 0;
+}
+function delay(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    const timer = setTimeout(resolve, ms);
+    signal.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve();
+    }, { once: true });
+  });
+}
+function parseEventFrame(frame) {
+  const data = frame.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+  if (!data) return void 0;
+  let event;
+  try {
+    event = JSON.parse(data);
+  } catch {
+    throw new Error("Origin returned an invalid Zerodha login update.");
+  }
+  if (!event || typeof event !== "object" || !("type" in event) || typeof event.attemptId !== "string" || !event.attemptId || "message" in event && typeof event.message !== "string" || event.type === "status" && (event.operatorId !== "OPERATOR_1" && event.operatorId !== "OPERATOR_2" || !["loading", "awaiting_otp", "succeeded", "failed"].includes(event.status) || event.failedOtpAttempts !== void 0 && (!Number.isInteger(event.failedOtpAttempts) || event.failedOtpAttempts < 0)) || event.type === "attempt_error" && (!["login_attempt_cancelled", "login_attempt_expired", "login_attempt_not_found"].includes(event.error) || typeof event.message !== "string") || event.type !== "status" && event.type !== "attempt_error") {
+    throw new Error("Origin returned an invalid Zerodha login update.");
+  }
+  if (event.type === "attempt_error") return { type: event.type, attemptId: event.attemptId, error: event.error, message: event.message };
+  return {
+    type: event.type,
+    attemptId: event.attemptId,
+    operatorId: event.operatorId,
+    status: event.status,
+    ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
+    ...event.message === void 0 ? {} : { message: event.message }
+  };
+}
+var HTTP_CLIENT_KIND = "cli";
+var BROWSER_CLIENT_KIND = "cli-browser";
+function createGateApi(origin, fetchImpl = fetch, options = {}) {
+  let cookies = { ...options.cookies ?? {} };
+  let metadata = {};
+  const clientProfile = options.profile;
+  if (clientProfile !== void 0) assertClientProfileName(clientProfile);
+  const otpValues = /* @__PURE__ */ new Set();
+  let actionDeadlineSignal;
+  function combineSignals(...signals) {
+    const present = signals.filter((signal) => signal !== void 0);
+    if (present.length === 0) return void 0;
+    if (present.length === 1) return present[0];
+    return AbortSignal.any(present);
+  }
+  function sessionSecrets() {
+    return [cookies.operatorSessionCookie, cookies.clientIdentityCookie].filter((cookie) => Boolean(cookie)).flatMap((cookie) => [cookie, cookie.slice(cookie.indexOf("=") + 1)]);
+  }
+  function headers(extra) {
+    const result = new Headers(extra);
+    const cookie = [cookies.operatorSessionCookie, cookies.clientIdentityCookie].filter(Boolean).join("; ");
+    if (cookie) result.set("cookie", cookie);
+    result.set("x-lmt-client-kind", HTTP_CLIENT_KIND);
+    if (clientProfile) result.set("x-lmt-client-profile", clientProfile);
+    return result;
+  }
+  function rememberCookies(response, acceptSessionCookie = false) {
+    const received = responseCookies(response);
+    if (received.clientIdentityCookie) cookies.clientIdentityCookie = received.clientIdentityCookie;
+    if (acceptSessionCookie && received.operatorSessionCookie) cookies.operatorSessionCookie = received.operatorSessionCookie;
+    metadata = {
+      ...metadata.requestId ? { requestId: metadata.requestId } : {},
+      ...metadata.buildId ? { buildId: metadata.buildId } : {},
+      ...response.headers.get("x-request-id") ? { requestId: response.headers.get("x-request-id") } : {},
+      ...response.headers.get("x-lmt-build-id") ? { buildId: response.headers.get("x-lmt-build-id") } : {}
+    };
+  }
+  function actionSignal(explicitSignal) {
+    const timeout = options.timeoutMs && options.timeoutMs > 0 ? AbortSignal.timeout(options.timeoutMs) : void 0;
+    return combineSignals(options.signal, actionDeadlineSignal, explicitSignal, timeout);
+  }
+  async function rejectAbsentSession(response, path3) {
+    if (response.status !== 401 || path3 === API_PATHS.unlockOperatorSession || path3 === API_PATHS.logoutUnauthenticatedOperator) return;
+    const body = await readJson(response.clone());
+    if (body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
+      delete cookies.operatorSessionCookie;
+      throw new OperatorSessionRejectedError(rejectionReason(body));
+    }
+  }
+  async function postJson(path3, body, explicitSignal, secrets = []) {
+    const signal = actionSignal(explicitSignal);
+    const url = `${origin}${path3}`;
+    const response = await requestOrThrow(
+      () => fetchImpl(url, {
+        method: "POST",
+        headers: headers({ "content-type": "application/json", accept: "application/json" }),
+        body: JSON.stringify(body),
+        ...signal ? { signal } : {}
+      }),
+      "Could not reach the selected Live Market Terminal Origin.",
+      signal,
+      url,
+      [...sessionSecrets(), ...otpValues, ...secrets]
+    );
+    rememberCookies(response);
+    await rejectAbsentSession(response, path3);
+    return response;
+  }
+  async function getJson(path3, explicitSignal, extraHeaders) {
+    const signal = actionSignal(explicitSignal);
+    const url = `${origin}${path3}`;
+    const response = await requestOrThrow(
+      () => fetchImpl(url, {
+        method: "GET",
+        headers: headers({ accept: "application/json", ...extraHeaders }),
+        cache: "no-store",
+        ...signal ? { signal } : {}
+      }),
+      "Could not reach the selected Live Market Terminal Origin.",
+      signal,
+      url,
+      [...sessionSecrets(), ...otpValues]
+    );
+    rememberCookies(response);
+    await rejectAbsentSession(response, path3);
+    return response;
+  }
+  async function settingsWrite(path3, body) {
+    let response;
+    try {
+      response = await fetchImpl(origin + path3, {
+        method: "PUT",
+        headers: headers({ "content-type": "application/json", accept: "application/json" }),
+        body: JSON.stringify(body),
+        signal: actionSignal()
+      });
+    } catch {
+      throw new SettingsActionError("submission_uncertain", true);
+    }
+    rememberCookies(response);
+    await rejectAbsentSession(response, path3);
+    if (!response.ok) {
+      const result = await readJson(response).catch(() => void 0);
+      const codes = [
+        "settings_conflict",
+        "settings_version_required",
+        "invalid_settings",
+        "trade_cycle_active",
+        "settings_save_failed",
+        "token_conflict",
+        "token_rejected",
+        "replacement_confirmation_required",
+        "token_write_pending",
+        "invalid_request",
+        "zerodha_session_absent",
+        "validation_failed",
+        "credentials_changed",
+        "replacement_blocked",
+        "token_changed",
+        "invalid_token_request",
+        "token_write_unresolved",
+        "active_trading_confirmation",
+        "validation_unavailable",
+        "unresolved_order",
+        "sharing_token_unavailable",
+        "token_recovery_unavailable",
+        "settings_recovery_required"
+      ];
+      const code = typeof result?.error === "string" && codes.includes(result.error) ? result.error : "operation_rejected";
+      const serverMessage = typeof result?.message === "string" && result.message.trim() ? result.message.trim() : void 0;
+      const relayMessage = serverMessage && (code === "token_rejected" || code === "validation_unavailable" || code === "invalid_token_request") ? serverMessage : void 0;
+      throw new SettingsActionError(code, code === "settings_save_failed" || response.status >= 500, relayMessage);
+    }
+    return response;
+  }
+  async function priceCrossMutation(path3, body, accept) {
+    let response;
+    try {
+      response = await fetchImpl(origin + path3, {
+        method: "POST",
+        headers: headers({ "content-type": "application/json", accept: "application/json" }),
+        body: JSON.stringify(body),
+        signal: actionSignal()
+      });
+    } catch {
+      throw new PriceCrossActionError("submission_uncertain", true);
+    }
+    rememberCookies(response);
+    await rejectAbsentSession(response, path3);
+    const parsed = await readJson(response);
+    if (response.ok) {
+      if (accept(parsed)) return parsed;
+      throw new PriceCrossActionError("submission_uncertain", true);
+    }
+    const refusal = priceCrossRefusal(parsed, response.status);
+    if (response.status >= 500 && refusal.code !== "store_unavailable") throw new PriceCrossActionError("submission_uncertain", true);
+    throw refusal;
+  }
+  function priceCrossRefusal(body, status) {
+    const result = body;
+    const code = typeof result?.error === "string" && /^[a-z][a-z0-9_]{0,63}$/.test(result.error) ? result.error : `http_${status}`;
+    const message = typeof result?.message === "string" && result.message.trim() ? redactSecrets(result.message.trim(), sessionSecrets()) : void 0;
+    return new PriceCrossActionError(code, false, message);
+  }
+  async function priceCrossRead(path3, body) {
+    const response = body === void 0 ? await getJson(path3) : await postJson(path3, body);
+    if (!response.ok) throw priceCrossRefusal(await readJson(response), response.status);
+    return response;
+  }
+  function readRefusal(body, status, fallback) {
+    const result = body;
+    const code = typeof result?.error === "string" && /^[a-z][a-z0-9_]{0,63}$/.test(result.error) ? result.error : fallback;
+    const reported = typeof result?.message === "string" && result.message.trim() ? redactSecrets(result.message.trim(), sessionSecrets()) : void 0;
+    if (status >= 500) return new SettingsActionError(code, false, `${reported ?? "Gate or Broker is temporarily unavailable."} Nothing was changed; try again.`);
+    return new SettingsActionError(code, false, reported);
+  }
+  function ordinarySettings(body) {
+    if (!body || !Number.isSafeInteger(body.settingsVersion) || !isOperatorMarketProtection(body.marketProtection) || !Array.isArray(body.entryCategories)) {
+      throw new SettingsActionError("invalid_response");
+    }
+    return { settingsVersion: body.settingsVersion, marketProtection: body.marketProtection, entryCategories: validateEntryCategories(body.entryCategories) };
+  }
+  const api = {
+    async getTokenMetadata() {
+      const response = await getJson(API_PATHS.zerodhaCredentials);
+      const body = await readJson(response);
+      if (!response.ok) throw readRefusal(body, response.status, "token_metadata_unavailable");
+      if (!body?.accessTokenMetadata) throw new SettingsActionError("token_metadata_unavailable");
+      const { fingerprint, version, updatedAt, writePending } = body.accessTokenMetadata;
+      return { fingerprint, version, updatedAt, ...writePending === void 0 ? {} : { writePending } };
+    },
+    async getSettings() {
+      const response = await getJson(API_PATHS.operatorSettings);
+      if (!response.ok) throw readRefusal(await readJson(response), response.status, "settings_read_failed");
+      return ordinarySettings(await readJson(response));
+    },
+    async saveSettings(request) {
+      const response = await settingsWrite(API_PATHS.operatorSettings, request);
+      try {
+        const body = await readJson(response);
+        if (body.outcome !== "saved" && body.outcome !== "unchanged") throw new Error("Invalid outcome");
+        return { outcome: body.outcome, settings: ordinarySettings(body.settings) };
+      } catch {
+        throw new SettingsActionError("submission_uncertain", true);
+      }
+    },
+    async replaceToken(request) {
+      const response = await settingsWrite(API_PATHS.zerodhaAccessToken, request);
+      try {
+        const body = await readJson(response);
+        if (body.outcome !== "verified" && body.outcome !== "replaced") throw new Error("Invalid outcome");
+        return { outcome: body.outcome, sharing: body.sharing, metadata: body.metadata, message: "Token operation completed." };
+      } catch {
+        throw new SettingsActionError("submission_uncertain", true);
+      }
+    },
+    async exportCandles(request) {
+      const response = await postJson(API_PATHS.candleExportOnDemand, request);
+      const body = await readJson(response);
+      if (!response.ok || !body || !("url" in body) || typeof body.url !== "string" || !("filename" in body)) {
+        throw new Error(messageFromBody(body, "Could not publish Candle Export.", sessionSecrets()));
+      }
+      return body;
+    },
+    async listPriceCrossPairs() {
+      const body = await readJson(await priceCrossRead(API_PATHS.priceCrossPairs));
+      if (!body || !Array.isArray(body.active) || !Array.isArray(body.past)) throw new PriceCrossActionError("invalid_response");
+      return { active: body.active, past: body.past };
+    },
+    assignPriceCrossPair(request) {
+      return priceCrossMutation(API_PATHS.assignPriceCrossPair, request, (body) => !!body && typeof body === "object" && "pair" in body && !!body.pair && typeof body.pair.pairId === "string");
+    },
+    unpairPriceCrossPair(request) {
+      return priceCrossMutation(API_PATHS.unpairPriceCrossPair, request, (body) => !!body && typeof body === "object" && "outcome" in body && (body.outcome === "unpaired" || body.outcome === "already_unpaired"));
+    },
+    async downloadPriceCrossReport(pairId) {
+      const response = await priceCrossRead(API_PATHS.priceCrossReport, { pairId });
+      const filename = /filename="([^"]+)"/.exec(response.headers.get("content-disposition") ?? "")?.[1];
+      const count = Number(response.headers.get("x-price-cross-decision-count"));
+      const bytes = new Uint8Array(await response.arrayBuffer());
+      if (!filename || bytes.length === 0) throw new PriceCrossActionError("invalid_response");
+      return { bytes, filename, decisionCount: response.headers.has("x-price-cross-decision-count") && Number.isSafeInteger(count) ? count : null };
+    },
+    publishPriceCrossReport(pairId) {
+      return priceCrossMutation(API_PATHS.priceCrossReportShare, { pairId }, (body) => !!body && typeof body === "object" && "url" in body && typeof body.url === "string" && "filename" in body && typeof body.filename === "string");
+    },
+    setActionSignal(signal) {
+      actionDeadlineSignal = signal;
+      if (!signal) otpValues.clear();
+    },
+    setCookies(next) {
+      cookies = { ...next };
+    },
+    getCookies() {
+      return { ...cookies };
+    },
+    clearOperatorSession() {
+      delete cookies.operatorSessionCookie;
+    },
+    responseMetadata() {
+      return { ...metadata };
+    },
+    async unlock(username, password, signal) {
+      const response = await postJson(API_PATHS.unlockOperatorSession, { username, password }, signal, [username, password]);
+      const body = await readJson(response);
+      if (!response.ok || !body || !("operatorSession" in body) || body.operatorSession !== "present") {
+        if (body && typeof body === "object" && "error" in body && body.error === "incorrect_credentials") {
+          throw new OperatorCredentialsRejectedError();
+        }
+        throw new Error(messageFromBody(body, "Could not unlock the Operator Session.", [username, password]));
+      }
+      const receivedCookie = responseCookies(response).operatorSessionCookie;
+      if (!receivedCookie) throw new Error("Origin unlocked the Operator Session without returning its session cookie.");
+      cookies.operatorSessionCookie = receivedCookie;
+      otpValues.clear();
+    },
+    async reportOperatorActivity() {
+      const response = await postJson(API_PATHS.reportOperatorActivity, {}, void 0);
+      if (response.status === 404) return;
+      const body = await readJson(response);
+      if (response.status === 401 && body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
+        this.clearOperatorSession();
+        throw new OperatorSessionRejectedError(rejectionReason(body));
+      }
+      if (!response.ok || !body || !("operatorSession" in body) || body.operatorSession !== "present") {
+        throw new Error(messageFromBody(
+          body,
+          `Origin did not accept Operator Activity (HTTP ${response.status}).`,
+          sessionSecrets()
+        ));
+      }
+      rememberCookies(response, true);
+    },
+    async confirmOperatorSessionPresent(expectedOperatorId) {
+      const healthPath = API_PATHS.health;
+      const response = await getJson(healthPath);
+      const body = await readJson(response);
+      if (response.status === 401 && body && typeof body === "object" && "error" in body && body.error === "operator_session_absent") {
+        this.clearOperatorSession();
+        throw new OperatorSessionRejectedError(rejectionReason(body));
+      }
+      if (body && typeof body === "object" && "service" in body && body.service === "live-market-terminal-gate" && "operatorSession" in body && (body.operatorSession === "present" || body.operatorSession === "absent")) {
+        if (!response.ok) {
+          throw new Error(messageFromBody(body, `Gate health returned HTTP ${response.status} from GET ${origin}${healthPath}.`, sessionSecrets()));
+        }
+        if (body.operatorSession === "absent") {
+          this.clearOperatorSession();
+          throw new OperatorSessionRejectedError(rejectionReason(body));
+        }
+        const clientId = clientIdFromCookie(cookies.clientIdentityCookie);
+        return { operatorId: expectedOperatorId, ...clientId ? { clientId } : {} };
+      }
+      const service = body && typeof body === "object" && "service" in body ? String(body.service) : void 0;
+      const hint = service === "live-market-terminal-broker" ? " The public Origin /api proxy reached Broker instead of Gate; point its proxy at Gate (default 8788)." : !response.ok ? ` Gate health returned HTTP ${response.status}.` : "";
+      throw new Error(messageFromBody(
+        body,
+        `Origin returned an invalid Gate health response from GET ${origin}${healthPath}.${hint}`,
+        sessionSecrets()
+      ));
+    },
+    async status(expectedOperatorId) {
+      const session = await this.confirmOperatorSessionPresent(expectedOperatorId);
+      const operatorsResponse = await getJson(API_PATHS.operators);
+      const operatorsBody = await readJson(operatorsResponse);
+      if (!operatorsResponse.ok) {
+        throw new Error(messageFromBody(operatorsBody, "Could not inspect the authenticated Operator.", sessionSecrets()));
+      }
+      const operatorId = observedOperator(operatorsBody);
+      if (!operatorId) throw new Error("Origin returned an invalid or ambiguous Operator Directory.");
+      if (operatorId !== expectedOperatorId) {
+        this.clearOperatorSession();
+        throw new Error(`The saved session reached ${operatorId}, but this target expects ${expectedOperatorId}.`);
+      }
+      return session;
+    },
+    async logout() {
+      if (!cookies.operatorSessionCookie) return;
+      const response = await requestOrThrow(
+        () => postJson(API_PATHS.logoutUnauthenticatedOperator, {}),
+        "Could not reach the selected Live Market Terminal Origin to log out."
+      );
+      const body = await readJson(response);
+      if (!response.ok || !body || typeof body !== "object" || !("operatorSession" in body) || body.operatorSession !== "absent") {
+        throw new Error(messageFromBody(body, `Origin did not confirm Operator logout (HTTP ${response.status}).`, sessionSecrets()));
+      }
+      this.clearOperatorSession();
+    },
+    async startLogin() {
+      const response = await requestOrThrow(
+        () => postJson(API_PATHS.startOperatorLogin, {}),
+        "Could not reach the selected Origin to start Login with Zerodha."
+      );
+      const body = await readJson(response);
+      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "started" || typeof body.attemptId !== "string") {
+        const code = body && typeof body === "object" && "error" in body && typeof body.error === "string" && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(body.error) ? body.error : void 0;
+        throw Object.assign(new Error(messageFromBody(body, "Could not start Login with Zerodha.", sessionSecrets())), code ? { code } : {});
+      }
+      otpValues.clear();
+      return { attemptId: body.attemptId, operatorId: body.operatorId };
+    },
+    async submitOtp(attemptId, otp) {
+      otpValues.add(otp);
+      const response = await requestOrThrow(
+        () => postJson(API_PATHS.operatorLoginOtp, { attemptId, otp }),
+        "Could not reach the selected Origin to submit the OTP."
+      );
+      const body = await readJson(response);
+      if (!response.ok || !body || typeof body !== "object" || !("status" in body) || body.status !== "loading") {
+        const message = messageFromBody(body, "Could not submit the Zerodha OTP.", [...sessionSecrets(), ...otpValues]);
+        if (body && typeof body === "object" && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) {
+          throw new ZerodhaLoginAttemptUnavailableError(message);
+        }
+        throw new Error(message);
+      }
+    },
+    async watchLoginAttempt(attemptId, onEvent, signal) {
+      const requestSignal = actionSignal(signal) ?? signal;
+      requestSignal.addEventListener("abort", () => otpValues.clear(), { once: true });
+      const url = `${origin}${API_PATHS.operatorLoginEvents}?attemptId=${encodeURIComponent(attemptId)}`;
+      while (!requestSignal.aborted) {
+        let response;
+        try {
+          response = await fetchImpl(url, {
+            method: "GET",
+            headers: headers({ accept: "text/event-stream" }),
+            cache: "no-store",
+            signal: requestSignal
+          });
+          rememberCookies(response);
+        } catch {
+          if (requestSignal.aborted) return;
+          await delay(500, requestSignal);
+          continue;
+        }
+        await rejectAbsentSession(response, API_PATHS.operatorLoginEvents);
+        if (!response.ok || !response.body) {
+          const body = await readJson(response);
+          otpValues.clear();
+          const message = messageFromBody(body, "Could not receive Zerodha login updates.", sessionSecrets());
+          if (body && typeof body === "object" && "error" in body && (body.error === "login_attempt_not_found" || body.error === "login_attempt_expired")) throw new ZerodhaLoginAttemptUnavailableError(message);
+          throw new Error(message);
+        }
+        const reader = response.body.getReader();
+        const cancelReader = () => {
+          void reader.cancel().catch(() => void 0);
+        };
+        requestSignal.addEventListener("abort", cancelReader, { once: true });
+        const decoder = new TextDecoder();
+        let buffer = "";
+        let completed = false;
+        try {
+          while (!requestSignal.aborted) {
+            let chunk;
+            try {
+              chunk = await reader.read();
+            } catch {
+              break;
+            }
+            const { done, value } = chunk;
+            buffer += decoder.decode(value, { stream: !done });
+            let boundary = buffer.search(/\r?\n\r?\n/);
+            while (boundary >= 0) {
+              const frame = buffer.slice(0, boundary);
+              const separator = buffer.slice(boundary).match(/^\r?\n\r?\n/)?.[0] ?? "\n\n";
+              buffer = buffer.slice(boundary + separator.length);
+              const event = parseEventFrame(frame);
+              if (event) {
+                const safeEvent = redactEvent(event, [...sessionSecrets(), ...otpValues]);
+                onEvent(safeEvent);
+                if (safeEvent.type === "attempt_error") {
+                  otpValues.clear();
+                  throw new ZerodhaLoginAttemptUnavailableError(safeEvent.message);
+                }
+                if (safeEvent.status === "failed") {
+                  otpValues.clear();
+                  throw new ZerodhaLoginFailedError(safeEvent.message ?? "Login with Zerodha failed.");
+                }
+                if (safeEvent.status === "succeeded") {
+                  otpValues.clear();
+                  completed = true;
+                  return;
+                }
+              }
+              boundary = buffer.search(/\r?\n\r?\n/);
+            }
+            if (done) break;
+          }
+        } finally {
+          requestSignal.removeEventListener("abort", cancelReader);
+          await reader.cancel().catch(() => void 0);
+        }
+        if (completed || requestSignal.aborted) return;
+        await delay(250, requestSignal);
+      }
+    },
+    async confirmZerodhaSession() {
+      const response = await requestOrThrow(
+        () => getJson(API_PATHS.zerodhaSession, void 0, { [ZERODHA_SESSION_ADMISSION_HEADER]: ZERODHA_SESSION_ADMISSION_VERIFY }),
+        "Could not verify the Zerodha Session with the selected Origin."
+      );
+      const body = await readJson(response);
+      if (!response.ok || !body || typeof body !== "object" || !("zerodhaSession" in body) || body.zerodhaSession !== "present") {
+        const code = body && typeof body === "object" && "error" in body && body.error === "zerodha_session_restoring" ? "verification" in body && body.verification === "unavailable" ? "zerodha_verification_unavailable" : "zerodha_session_restoring" : body && typeof body === "object" && "error" in body && body.error === "zerodha_session_absent" ? "zerodha_session_absent" : "zerodha_verification_unavailable";
+        throw Object.assign(new Error(messageFromBody(body, "Zerodha Session is not present on the Broker.", sessionSecrets())), { code });
+      }
+      return body;
+    }
+  };
+  return api;
+}
+
+// src/controller-session.ts
+var CONTROLLER_LOGIN_STEP = "Run `lmt` in a terminal to log in";
+var CREDENTIAL_PROVISION_STEP = "Run `lmt credential provision` to provision the SMS credential";
+var LOGIN_REQUIRED_CODES = /* @__PURE__ */ new Set(["operator_login_required", "zerodha_session_absent"]);
+function isLoginRequired(code) {
+  return LOGIN_REQUIRED_CODES.has(code);
+}
+function sessionUsable(report, need = "logged in") {
+  return report.smsCredential === "present" && report.operatorSession === "valid" && (need === "operator session" || report.zerodha === "authenticated");
+}
+function loginStepFor(owner, environment) {
+  const profile = profileNameOf(owner);
+  return profile === void 0 ? CONTROLLER_LOGIN_STEP : `Run \`lmt login --env ${environment} --profile ${profile}\``;
+}
+var UNAUTHENTICATED_ZERODHA_CODES = /* @__PURE__ */ new Set(["zerodha_session_absent", "zerodha_session_restoring"]);
+async function reportSessionStatus(options) {
+  const { target, owner, store } = options;
+  const profile = profileNameOf(owner);
+  const report = {
+    version: 1,
+    command: "status",
+    outcome: "blocked",
+    environment: target.environment,
+    origin: target.origin,
+    session: profile === void 0 ? "controller" : "profile",
+    ...profile === void 0 ? {} : { profile },
+    smsCredential: await store.getSmsCredential() ? "present" : "missing",
+    operatorSession: "absent",
+    zerodha: "unknown"
+  };
+  const cookies = await store.getSession(owner, target);
+  if (cookies?.operatorSessionCookie) {
+    const api = createGateApi(resolveCliApiOrigin(target), options.fetchImpl ?? fetch, {
+      cookies,
+      ...profile === void 0 ? {} : { profile },
+      timeoutMs: options.timeoutMs,
+      signal: options.signal
+    });
+    try {
+      await api.status(target.operatorId);
+      report.operatorSession = "valid";
+      try {
+        await api.confirmZerodhaSession();
+        report.zerodha = "authenticated";
+      } catch (error) {
+        const code = error.code;
+        if (typeof code !== "string" || !UNAUTHENTICATED_ZERODHA_CODES.has(code)) throw error;
+        report.zerodha = "unauthenticated";
+      }
+    } catch (error) {
+      if (error instanceof OperatorSessionRejectedError && !options.signal.aborted) {
+        report.operatorSession = "expired";
+        await store.clearOperatorSession(owner, target);
+      } else {
+        const message = options.signal.aborted ? "The action exceeded its deadline." : error instanceof Error ? error.message : "Could not determine the session status.";
+        return {
+          report: { ...report, outcome: "failure", error: { code: options.signal.aborted ? "deadline_exceeded" : "action_failed", message } },
+          exitCode: 1
+        };
+      }
+    }
+  }
+  if (report.smsCredential === "missing") return { report: { ...report, nextStep: CREDENTIAL_PROVISION_STEP }, exitCode: 4 };
+  if (!sessionUsable(report)) {
+    return { report: { ...report, nextStep: loginStepFor(owner, target.environment) }, exitCode: 4 };
+  }
+  return { report: { ...report, outcome: "success" }, exitCode: 0 };
+}
+
+// src/sms.ts
+import { spawn } from "node:child_process";
+var SmsReadError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SmsReadError";
+  }
+  code;
+};
+async function readSmsSecret(options) {
+  if (!options.credential.trim()) {
+    throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
+  }
+  if (!options.name.trim() || !options.scope.trim() || !options.endpoint.trim()) {
+    throw new SmsReadError("sms_unavailable", "SMS configuration is incomplete.");
+  }
+  if (options.signal?.aborted) throw new SmsReadError("sms_unavailable", "SMS access was cancelled.");
+  const command = options.command ?? "npx";
+  const args = options.command ? ["read", options.name] : ["--yes", "--package=@ai-digital-factory/sms-cli@0.1.2", "sms", "read", options.name];
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(command, args, {
+        env: {
+          ...process.env,
+          SMS_ENDPOINT: options.endpoint,
+          SMS_CREDENTIAL: options.credential,
+          SMS_SCOPE: options.scope
+        },
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      reject(new SmsReadError("sms_unavailable", "SMS access is unavailable."));
+      return;
+    }
+    const chunks = [];
+    let length = 0;
+    let settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve(result ?? "");
+    };
+    const onAbort = () => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    }, options.timeoutMs ?? 3e4);
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.on("data", (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += buffer.length;
+      if (length > 1048576) {
+        child.kill("SIGTERM");
+        finish(new SmsReadError("sms_unavailable", "SMS returned an oversized secret record."));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    child.on("error", () => finish(new SmsReadError("sms_unavailable", "SMS access is unavailable.")));
+    child.on("close", (code) => {
+      if (code !== 0) {
+        finish(new SmsReadError("sms_unavailable", "SMS access is unavailable for the selected Gate scope."));
+        return;
+      }
+      const value = Buffer.concat(chunks).toString("utf8").trimEnd();
+      if (!value.trim()) {
+        finish(new SmsReadError("sms_unavailable", "SMS returned an empty secret record."));
+        return;
+      }
+      finish(void 0, value);
+    });
+  });
+}
+async function readOperatorLoginCredentials(input) {
+  let raw;
+  try {
+    raw = await (input.secretReader ?? readSmsSecret)({
+      name: "live-market-terminal-operator-directory",
+      scope: input.gateScope,
+      endpoint: input.smsEndpoint,
+      credential: input.smsCredential,
+      ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+      ...input.signal ? { signal: input.signal } : {},
+      ...input.command ? { command: input.command } : {}
+    });
+  } catch (error) {
+    if (error instanceof SmsReadError) throw error;
+    throw new SmsReadError("sms_unavailable", "Operator Directory is unavailable from the selected Gate scope.");
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !("operators" in parsed) || !Array.isArray(parsed.operators)) {
+      throw new Error();
+    }
+    const matches = parsed.operators.filter(
+      (entry2) => entry2 && typeof entry2 === "object" && "operatorId" in entry2 && entry2.operatorId === input.operatorId
+    );
+    if (matches.length !== 1) throw new Error();
+    const entry = matches[0];
+    if (typeof entry.loginUsername !== "string" || !entry.loginUsername.trim() || typeof entry.loginPassword !== "string" || !entry.loginPassword.trim()) throw new Error();
+    return { username: entry.loginUsername.trim(), password: entry.loginPassword };
+  } catch {
+    throw new SmsReadError("invalid_operator_directory", "The selected Gate Operator Directory is invalid or does not contain exactly one configured Operator.");
+  }
+}
+
+export {
+  DEFAULT_CONFIG_PATH,
+  LocalConfigError,
+  resolveTargetOrigin,
+  resolveCliTarget,
+  resolveCliApiOrigin,
+  isOperatorMarketProtection,
+  ENTRY_CATEGORIES,
+  CLIENT_PROFILE_NAME_ERROR,
+  assertClientProfileName,
+  SettingsActionError,
+  PriceCrossActionError,
+  OperatorSessionRejectedError,
+  ZerodhaLoginFailedError,
+  ZerodhaLoginAttemptUnavailableError,
+  OperatorCredentialsRejectedError,
+  BROWSER_CLIENT_KIND,
+  createGateApi,
+  CONTROLLER_SESSION,
+  ownerOf,
+  profileNameOf,
+  CliProfileStore,
+  CONTROLLER_LOGIN_STEP,
+  CREDENTIAL_PROVISION_STEP,
+  isLoginRequired,
+  sessionUsable,
+  reportSessionStatus,
+  SmsReadError,
+  readOperatorLoginCredentials
+};