@ai-digital-factory/lmt-cli 0.1.6 → 1.0.0

package/dist/chunk-7J2U4G5L.js

@@ -0,0 +1,1394 @@
+import {
+  CLIENT_PROFILE_NAME_ERROR,
+  CONTROLLER_LOGIN_STEP,
+  CONTROLLER_SESSION,
+  CREDENTIAL_PROVISION_STEP,
+  CliProfileStore,
+  LocalConfigError,
+  OperatorCredentialsRejectedError,
+  OperatorSessionRejectedError,
+  PriceCrossActionError,
+  SettingsActionError,
+  SmsReadError,
+  ZerodhaLoginAttemptUnavailableError,
+  ZerodhaLoginFailedError,
+  assertClientProfileName,
+  createGateApi,
+  isLoginRequired,
+  ownerOf,
+  profileNameOf,
+  readOperatorLoginCredentials,
+  reportSessionStatus,
+  resolveCliApiOrigin,
+  resolveCliTarget
+} from "./chunk-4N3XUBM4.js";
+
+// src/candle-export-download.ts
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { link, mkdtemp, rm } from "node:fs/promises";
+import path from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+async function downloadCandleExport(url, output, signal, fetchImpl = fetch) {
+  if (new URL(url).protocol !== "https:") throw new Error("Candle Export download requires an HTTPS URL.");
+  const destination = path.resolve(output);
+  const directory = await mkdtemp(path.join(path.dirname(destination), ".lmt-candle-export-"));
+  try {
+    const response = await fetchImpl(url, { signal, credentials: "omit" });
+    if (!response.ok || !response.body) {
+      await response.body?.cancel();
+      throw new Error(`Candle Export download failed (HTTP ${response.status}).`);
+    }
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const measure = new Transform({ transform(chunk, _encoding, callback) {
+      bytes += chunk.length;
+      hash.update(chunk);
+      callback(null, chunk);
+    } });
+    const temporary = path.join(directory, "workbook.xlsx");
+    await pipeline(
+      Readable.fromWeb(response.body),
+      measure,
+      createWriteStream(temporary, { flags: "wx", mode: 384 }),
+      { signal }
+    );
+    signal.throwIfAborted();
+    await link(temporary, destination);
+    return { path: destination, bytes, sha256: hash.digest("hex") };
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+
+// src/action-deadline.ts
+function withinActionDeadline(operation, signal, deadlineMessage) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(new Error(deadlineMessage));
+    if (signal.aborted) {
+      void operation.catch(() => void 0);
+      abort();
+      return;
+    }
+    signal.addEventListener("abort", abort, { once: true });
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      }
+    );
+  });
+}
+
+// src/operator-actions.ts
+function profileTarget(target) {
+  return {
+    environment: target.environment,
+    origin: target.origin,
+    operatorId: target.operatorId
+  };
+}
+function responseMetadata(api) {
+  const metadata = api.responseMetadata();
+  return Object.keys(metadata).length > 0 ? metadata : void 0;
+}
+function combineSignals(...signals) {
+  const present = signals.filter((signal) => signal !== void 0);
+  if (present.length === 1) return present[0];
+  return AbortSignal.any(present);
+}
+function isTransientGateReachabilityError(error) {
+  if (!(error instanceof Error)) return false;
+  return /Could not reach the selected Live Market Terminal Origin/.test(error.message) || /Broker is unreachable/.test(error.message) || /Gate health returned HTTP 5\d\d/.test(error.message);
+}
+function waitForSignal(operation, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new Error("The action exceeded its deadline."));
+      return;
+    }
+    const onAbort = () => reject(new Error("The action exceeded its deadline."));
+    signal.addEventListener("abort", onAbort, { once: true });
+    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
+function createOperatorSessionActions(options) {
+  const selectedTarget = profileTarget(options.target);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  let api;
+  async function loadApi() {
+    if (api) return api;
+    const cookies = await options.store.getSession(options.profile, selectedTarget);
+    api = createGateApi(resolveCliApiOrigin(options.target), fetchImpl, {
+      ...typeof options.profile === "string" ? { profile: options.profile } : {},
+      ...cookies ? { cookies } : {},
+      timeoutMs,
+      ...options.signal ? { signal: options.signal } : {}
+    });
+    return api;
+  }
+  async function persistCurrentCookies(client, signal) {
+    const write = options.store.saveSession(options.profile, selectedTarget, client.getCookies());
+    if (signal) await waitForSignal(write, signal);
+    else await write;
+  }
+  async function withAction(action, requestedSignal) {
+    const deadlineAt = Date.now() + timeoutMs;
+    const signal = combineSignals(options.signal, requestedSignal, AbortSignal.timeout(timeoutMs));
+    const client = await waitForSignal(loadApi(), signal);
+    client.setActionSignal(signal);
+    try {
+      return await waitForSignal(action(client, signal, deadlineAt), signal);
+    } finally {
+      client.setActionSignal(options.signal);
+    }
+  }
+  async function resumeSessionWithClient(client, signal) {
+    try {
+      const observation = await waitForSignal(
+        client.confirmOperatorSessionPresent(options.target.operatorId),
+        signal
+      );
+      await persistCurrentCookies(client, signal);
+      return {
+        observedOperator: observation.operatorId,
+        ...observation.clientId ? { clientId: observation.clientId } : {},
+        ...responseMetadata(client) ? { metadata: responseMetadata(client) } : {}
+      };
+    } catch (error) {
+      if (!signal.aborted && !client.getCookies().operatorSessionCookie) {
+        await persistCurrentCookies(client, signal).catch(() => void 0);
+      }
+      throw error;
+    }
+  }
+  async function statusWithClient(client, signal) {
+    try {
+      const observation = await waitForSignal(client.status(options.target.operatorId), signal);
+      await persistCurrentCookies(client, signal);
+      return {
+        observedOperator: observation.operatorId,
+        ...observation.clientId ? { clientId: observation.clientId } : {},
+        ...responseMetadata(client) ? { metadata: responseMetadata(client) } : {}
+      };
+    } catch (error) {
+      if (!signal.aborted && !client.getCookies().operatorSessionCookie) {
+        await persistCurrentCookies(client, signal).catch(() => void 0);
+      }
+      throw error;
+    }
+  }
+  async function tryRenewOperatorActivity(client, signal) {
+    try {
+      await waitForSignal(client.reportOperatorActivity(), signal);
+      await persistCurrentCookies(client, signal);
+    } catch (error) {
+      if (error instanceof OperatorSessionRejectedError) throw error;
+    }
+  }
+  async function loginWithClient(client, username, password, signal) {
+    try {
+      await waitForSignal(client.unlock(username, password, signal), signal);
+      await persistCurrentCookies(client, signal);
+      const result = await statusWithClient(client, signal);
+      await tryRenewOperatorActivity(client, signal);
+      return result;
+    } catch (error) {
+      if (!signal.aborted) await persistCurrentCookies(client, signal).catch(() => void 0);
+      throw error;
+    }
+  }
+  return {
+    getApi() {
+      return loadApi();
+    },
+    get api() {
+      if (!api) throw new Error("Operator client has not been initialized.");
+      return api;
+    },
+    loginWithPassword(username, password, requestedSignal) {
+      return withAction((client, signal) => loginWithClient(client, username, password, signal), requestedSignal);
+    },
+    loginFromSms() {
+      return withAction(async (client, signal, deadlineAt) => {
+        const smsCredential = await waitForSignal(options.store.getSmsCredential(), signal);
+        if (!smsCredential) throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
+        const credentials = await waitForSignal(
+          (options.readLoginCredentials ?? readOperatorLoginCredentials)({
+            operatorId: options.target.operatorId,
+            gateScope: options.target.gateScope,
+            smsEndpoint: options.target.smsEndpoint,
+            smsCredential,
+            timeoutMs: Math.max(1, deadlineAt - Date.now()),
+            signal,
+            ...options.secretReader ? { secretReader: options.secretReader } : {}
+          }),
+          signal
+        );
+        return loginWithClient(client, credentials.username, credentials.password, signal);
+      });
+    },
+    async resumeInteractiveSession() {
+      const saved = await options.store.getSession(options.profile, selectedTarget);
+      if (!saved?.operatorSessionCookie) return { step: "username" };
+      const maxAttempts = 8;
+      for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+        try {
+          await withAction(async (client, signal) => {
+            await resumeSessionWithClient(client, signal);
+            await tryRenewOperatorActivity(client, signal);
+          });
+          return { step: "menu" };
+        } catch (error) {
+          const retryable = isTransientGateReachabilityError(error) && attempt < maxAttempts - 1;
+          if (retryable) {
+            await new Promise((resolve) => setTimeout(resolve, 1e3));
+            continue;
+          }
+          const hint = error instanceof OperatorSessionRejectedError ? error.message : error instanceof Error ? error.message : void 0;
+          return { step: "username", ...hint ? { hint } : {} };
+        }
+      }
+      return { step: "username" };
+    },
+    reportOperatorActivity(requestedSignal) {
+      return withAction((client, signal) => tryRenewOperatorActivity(client, signal), requestedSignal).then(() => void 0);
+    },
+    status() {
+      return withAction((client, signal) => statusWithClient(client, signal));
+    },
+    statusWithBrokerProof() {
+      return withAction((client, signal) => statusWithClient(client, signal));
+    },
+    logout() {
+      return withAction(async (client, signal) => {
+        await waitForSignal(client.logout(), signal);
+        await waitForSignal(options.store.removeTarget(options.profile, selectedTarget), signal);
+      });
+    }
+  };
+}
+
+// src/protected-input.ts
+var ProtectedInputError = class extends Error {
+  code = "invalid_invocation";
+};
+async function readProtectedOtp(stdin, signal) {
+  if (stdin.isTTY) throw new ProtectedInputError("OTP requires piped protected stdin; interactive mode provides masked entry.");
+  const chunks = [];
+  let size = 0;
+  try {
+    const iterator = stdin[Symbol.asyncIterator]();
+    while (true) {
+      if (signal.aborted) throw new Error("The action exceeded its deadline.");
+      const next = await new Promise((resolve, reject) => {
+        const abort = () => {
+          stdin.destroy?.();
+          reject(new Error("The action exceeded its deadline."));
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        Promise.resolve(iterator.next()).then(resolve, () => reject(new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line."))).finally(() => signal.removeEventListener("abort", abort));
+      });
+      if (next.done) break;
+      size += typeof next.value === "string" ? Buffer.byteLength(next.value) : next.value.byteLength;
+      if (size > 8) {
+        stdin.destroy?.();
+        throw new ProtectedInputError("OTP input is too large; provide one six-digit line.");
+      }
+      chunks.push(Buffer.from(next.value));
+    }
+    const buffer = Buffer.concat(chunks);
+    try {
+      const value = buffer.toString("utf8");
+      if (!/^\d{6}(?:\r?\n)?$/.test(value)) throw new ProtectedInputError("OTP input must be one six-digit line.");
+      return value.slice(0, 6);
+    } finally {
+      buffer.fill(0);
+    }
+  } catch (error) {
+    if (signal.aborted || error instanceof ProtectedInputError) throw error;
+    throw new ProtectedInputError("Could not read OTP from protected stdin; provide one six-digit line.");
+  } finally {
+    for (const chunk of chunks) chunk.fill(0);
+  }
+}
+
+// src/zerodha-actions.ts
+async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp, options = {}) {
+  const started = Date.now();
+  let observedState;
+  let observedOperator;
+  api.setActionSignal?.(signal);
+  try {
+    if (signal.aborted) throw new Error("Zerodha login observation exceeded its deadline.");
+    if (action === "status") {
+      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
+      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
+      return { status: "succeeded", observedState: "present", ...session.operatorId ? { observedOperator: session.operatorId } : {}, elapsedMs: Date.now() - started };
+    }
+    if (action === "login") {
+      const attempt = await withinActionDeadline(api.startLogin(), signal, "Zerodha login observation exceeded its deadline.");
+      attemptId = attempt.attemptId;
+      if (attempt.operatorId !== operatorId) throw new Error("Zerodha login reached an unexpected Operator.");
+    }
+    if (!attemptId) throw new Error("Zerodha login requires an attempt identifier.");
+    if (action === "otp") {
+      if (!otp) throw new Error("Zerodha OTP input is required.");
+      await withinActionDeadline(api.submitOtp(attemptId, otp), signal, "Zerodha login observation exceeded its deadline.");
+    }
+    const observer = new AbortController();
+    const observationSignal = AbortSignal.any([signal, observer.signal]);
+    let result;
+    try {
+      await withinActionDeadline(api.watchLoginAttempt(attemptId, (event) => {
+        if (observer.signal.aborted || signal.aborted) return;
+        if (event.attemptId !== attemptId || event.type === "status" && event.operatorId !== operatorId) {
+          throw new Error("Origin returned an unexpected Zerodha login attempt.");
+        }
+        if (event.type === "status") {
+          observedState = event.status;
+          observedOperator = event.operatorId;
+        }
+        options.onObservation?.(event);
+        if (event.type === "status" && (event.status === "awaiting_otp" || event.status === "succeeded")) {
+          result = {
+            status: event.status,
+            attemptId,
+            observedOperator,
+            observedState,
+            ...event.failedOtpAttempts === void 0 ? {} : { failedOtpAttempts: event.failedOtpAttempts },
+            ...event.message ? { message: event.message } : {}
+          };
+          observer.abort();
+        }
+      }, observationSignal), observationSignal, "Zerodha login observation exceeded its deadline.");
+    } catch (error) {
+      if (!observer.signal.aborted || !result) throw error;
+    }
+    if (signal.aborted || !result) throw new Error("Zerodha login observation exceeded its deadline.");
+    if (result.status === "succeeded") {
+      const session = await withinActionDeadline(api.confirmZerodhaSession(), signal, "Zerodha login observation exceeded its deadline.");
+      if (session.operatorId && session.operatorId !== operatorId) throw new Error("Origin returned an unexpected Zerodha Session Operator.");
+    }
+    return { ...result, elapsedMs: Date.now() - started };
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : new Error("Zerodha action failed.");
+    Object.assign(error, {
+      ...attemptId ? { attemptId, recovery: "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
+      ...observedState ? { observedState } : {},
+      ...observedOperator ? { observedOperator } : {},
+      elapsedMs: Date.now() - started
+    });
+    throw error;
+  } finally {
+    api.setActionSignal?.();
+  }
+}
+
+// src/zerodha-validation.ts
+async function runZerodhaValidation(options) {
+  const started = performance.now();
+  const caller = options.callerProfile ?? CONTROLLER_SESSION;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 12e4);
+  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+  const observations = [];
+  let api;
+  let otp;
+  let result = {
+    scenario: "zerodha-session",
+    outcome: "fail",
+    reason: "validation_action_failed",
+    exitCode: 1,
+    target: { environment: options.target.environment, origin: options.target.origin },
+    ...options.callerProfile ? { profile: options.callerProfile } : {},
+    ...options.attemptId ? { attemptId: options.attemptId } : {},
+    observations,
+    nextStep: null
+  };
+  const safeText = (message) => (otp ? message.replaceAll(otp, "[REDACTED]") : message).replace(/lmt_(?:operator_session|client_id)=[^\s,;]+/g, "[REDACTED]").replace(/(password|token|credential|cookie)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]");
+  const resumeStep = () => result.attemptId ? `Use the same environment and profile: validate zerodha-session --attempt ${result.attemptId} --otp-stdin. Observe without --otp-stdin; start explicitly only if Gate reports the attempt inactive.` : "Run validate zerodha-session again after resolving the reported prerequisite.";
+  try {
+    if (!["local", "dev"].includes(options.target.environment)) throw Object.assign(new Error("The CLI supports local or dev targets only; prod is not permitted."), { code: "invalid_target" });
+    if (options.callerProfile !== void 0) try {
+      assertClientProfileName(options.callerProfile);
+    } catch {
+      throw new ProtectedInputError(CLIENT_PROFILE_NAME_ERROR);
+    }
+    if (options.attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(options.attemptId)) throw new ProtectedInputError("--attempt must be a valid Zerodha attempt ID.");
+    if (options.readOtp && !options.attemptId) throw new ProtectedInputError("OTP submission requires an explicit --attempt ID from a prior login or validation.");
+    const actions = createOperatorSessionActions({
+      target: options.target,
+      profile: caller,
+      store: options.store,
+      timeoutMs: options.timeoutMs ?? 12e4,
+      signal,
+      ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
+    });
+    api = await withinActionDeadline(actions.getApi(), signal, "The Zerodha Session validation exceeded its deadline.");
+    const operator = await actions.status();
+    result.observedOperator = operator.observedOperator;
+    if (options.readOtp) {
+      otp = await withinActionDeadline(options.readOtp(signal), signal, "The Zerodha Session validation exceeded its deadline.");
+      if (!/^\d{6}$/.test(otp)) throw new ProtectedInputError("OTP input must be one six-digit line.");
+    }
+    const action = options.attemptId ? options.readOtp ? "otp" : "observe" : "login";
+    const login = await runZerodhaAction(api, action, options.target.operatorId, signal, options.attemptId, otp, {
+      onObservation(event) {
+        result.attemptId = event.attemptId;
+        if (event.type === "status") {
+          result.observedState = event.status;
+          result.observedOperator = event.operatorId;
+          observations.push(event.status);
+          if (event.failedOtpAttempts !== void 0) result.failedOtpAttempts = event.failedOtpAttempts;
+          if (event.message) result.message = safeText(event.message);
+        }
+        options.onObservation?.(event);
+      }
+    });
+    result.attemptId = login.attemptId;
+    if (login.status === "awaiting_otp") {
+      const rejected = !!options.readOtp && (login.failedOtpAttempts ?? 0) > 0;
+      result = { ...result, outcome: rejected ? "fail" : "blocked", reason: rejected ? "otp_rejected" : "awaiting_otp", exitCode: rejected ? 1 : 4, nextStep: resumeStep() };
+    } else {
+      result = { ...result, outcome: "pass", reason: "zerodha_session_validated", exitCode: 0, nextStep: null };
+    }
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : void 0;
+    if (error?.attemptId) result.attemptId = error.attemptId;
+    if (error?.observedState) result.observedState = error.observedState;
+    if (error?.observedOperator) result.observedOperator = error.observedOperator;
+    const code = error?.code;
+    if (signal.aborted) {
+      result.reason = "deadline_exceeded";
+      result.message = "The Zerodha Session validation exceeded its deadline.";
+    } else if (cause instanceof OperatorSessionRejectedError) {
+      result.outcome = "blocked";
+      result.reason = "operator_login_required";
+      result.exitCode = caller === CONTROLLER_SESSION ? 4 : 3;
+      result.message = caller === CONTROLLER_SESSION ? "The Controller Session has no valid Operator Session." : "No valid Operator Session is available; run login with this environment and profile first.";
+    } else if (code && ["zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(code)) {
+      result.outcome = "blocked";
+      result.reason = code;
+      result.exitCode = 4;
+      result.message = safeText(error.message);
+    } else {
+      result.reason = cause instanceof ProtectedInputError ? "invalid_invocation" : cause instanceof ZerodhaLoginAttemptUnavailableError ? "login_attempt_inactive" : cause instanceof ZerodhaLoginFailedError ? "zerodha_login_failed" : code ?? "validation_action_failed";
+      result.exitCode = cause instanceof ProtectedInputError || code === "invalid_target" ? 2 : 1;
+      result.message = error ? safeText(error.message) : "The Zerodha Session validation failed.";
+    }
+    result.nextStep = result.reason === "operator_login_required" ? caller === CONTROLLER_SESSION ? CONTROLLER_LOGIN_STEP : "Run login with the selected environment and profile, then explicitly start Zerodha validation." : result.reason === "zerodha_credentials_missing" ? "Provision the selected Operator's Broker-owned Zerodha credentials, then explicitly start validation." : result.reason === "secret_store_unavailable" ? "Restore Broker access to its secret store, then explicitly start validation." : result.reason === "operator_not_configured" ? "Configure the selected Operator on Broker, then explicitly start validation." : resumeStep();
+    if (cause instanceof OperatorSessionRejectedError && api && !signal.aborted) {
+      await options.store.saveSession(caller, options.target, api.getCookies()).catch(() => void 0);
+    }
+  } finally {
+    otp = void 0;
+    clearTimeout(timer);
+  }
+  const metadata = api?.responseMetadata();
+  return { ...result, elapsedMs: Math.round(performance.now() - started), requestId: metadata?.requestId ?? null, buildId: metadata?.buildId ?? null };
+}
+
+// src/pair-commands.ts
+import { createHash as createHash2 } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import path2 from "node:path";
+var PairInvocationError = class extends Error {
+  code = "invalid_invocation";
+};
+var PAIR_USAGE = "Use pair list, pair assign --ce ROW --pe ROW --lots N, pair unpair PAIR_ID --confirm, or pair report PAIR_ID [--publish | --output PATH].";
+var VALUE_OPTIONS = /* @__PURE__ */ new Set(["--env", "--profile", "--timeout", "--ce", "--pe", "--lots", "--output"]);
+var FLAG_OPTIONS = /* @__PURE__ */ new Set(["--confirm", "--publish"]);
+var PAIR_ID = /^[A-Za-z0-9_-]{1,200}$/;
+function isPairInvocation(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--env" || token === "--profile" || token === "--timeout") {
+      index += 1;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    return token === "pair";
+  }
+  return false;
+}
+function parsePairArguments(argv, parseTimeout2, validateProfile) {
+  const options = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const positional = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (VALUE_OPTIONS.has(token)) {
+      const value = argv[index + 1];
+      if (value === void 0 || value.startsWith("--")) throw new PairInvocationError(`Invalid or incomplete command argument: ${token}`);
+      if (options.has(token)) throw new PairInvocationError(`Argument ${token} may be specified only once.`);
+      options.set(token, value);
+      index += 1;
+    } else if (FLAG_OPTIONS.has(token)) {
+      if (flags.has(token)) throw new PairInvocationError(`Argument ${token} may be specified only once.`);
+      flags.add(token);
+    } else if (token.startsWith("--")) {
+      throw new PairInvocationError(`Unsupported command option: ${token.split("=")[0]}`);
+    } else positional.push(token);
+  }
+  const [, action, pairId, ...extra] = positional;
+  const allowed = {
+    list: [],
+    assign: ["--ce", "--pe", "--lots"],
+    unpair: ["--confirm"],
+    report: ["--publish", "--output"]
+  };
+  if (!action || !(action in allowed) || extra.length > 0 || [...options.keys(), ...flags].some((key) => !["--env", "--profile", "--timeout", ...allowed[action]].includes(key))) {
+    throw new PairInvocationError(PAIR_USAGE);
+  }
+  const environment = options.get("--env"), profile = options.get("--profile");
+  if (!environment) throw new PairInvocationError("Headless commands require --env local|dev.");
+  if (profile !== void 0) validateProfile(profile);
+  const target = { environment, ...profile !== void 0 ? { profile } : {}, ...options.has("--timeout") ? { timeoutMs: parseTimeout2(options.get("--timeout")) } : {} };
+  if (action === "list") {
+    if (pairId !== void 0) throw new PairInvocationError(PAIR_USAGE);
+    return { kind: "pair", action, ...target };
+  }
+  if (action === "assign") {
+    if (pairId !== void 0) throw new PairInvocationError(PAIR_USAGE);
+    const ce = options.get("--ce"), pe = options.get("--pe"), lots = options.get("--lots");
+    if (!ce || !pe || !lots || !/^\d{1,3}$/.test(ce) || !/^\d{1,3}$/.test(pe) || !/^-?\d{1,6}$/.test(lots)) {
+      throw new PairInvocationError("pair assign requires --ce ROW --pe ROW --lots N as whole numbers.");
+    }
+    return { kind: "pair", action, ceRow: Number(ce), peRow: Number(pe), pairLots: Number(lots), ...target };
+  }
+  if (!pairId || !PAIR_ID.test(pairId)) throw new PairInvocationError(`pair ${action} requires a Price Cross pair ID from pair list.`);
+  if (action === "unpair") {
+    if (!flags.has("--confirm")) {
+      throw new PairInvocationError("pair unpair requires --confirm. Unpair closes any paper position at its latest complete close.");
+    }
+    return { kind: "pair", action, pairId, ...target };
+  }
+  const publish = flags.has("--publish");
+  if (publish && options.has("--output")) throw new PairInvocationError("--output downloads the workbook; --publish returns a URL. Choose one.");
+  return { kind: "pair", action: "report", pairId, publish, ...options.has("--output") ? { output: options.get("--output") } : {}, ...target };
+}
+async function runPairCommand(command, api) {
+  if (command.action === "list") return { pairs: await api.listPriceCrossPairs() };
+  if (command.action === "assign") {
+    const { pair } = await api.assignPriceCrossPair({ ceRow: command.ceRow, peRow: command.peRow, pairLots: command.pairLots });
+    return { reason: "pair_assigned", pair };
+  }
+  if (command.action === "unpair") {
+    const { pairs: _pairs, ...unpair } = await api.unpairPriceCrossPair({ pairId: command.pairId, confirmExit: true });
+    return { reason: unpair.outcome, unpair: { pairId: command.pairId, ...unpair } };
+  }
+  if (command.publish) {
+    const published = await api.publishPriceCrossReport(command.pairId);
+    return { reason: "report_published", report: { pairId: command.pairId, published: true, url: published.url, filename: published.filename } };
+  }
+  const download = await api.downloadPriceCrossReport(command.pairId);
+  const output = path2.resolve(command.output ?? path2.basename(download.filename));
+  await writeFile(output, download.bytes, { flag: command.output ? "w" : "wx" });
+  return { reason: "report_downloaded", report: {
+    pairId: command.pairId,
+    published: false,
+    filename: download.filename,
+    path: output,
+    bytes: download.bytes.length,
+    sha256: createHash2("sha256").update(download.bytes).digest("hex"),
+    decisionCount: download.decisionCount
+  } };
+}
+
+// src/validation-scenario.ts
+import { randomUUID } from "node:crypto";
+function makeTemporaryProfile(callerProfile = "cli") {
+  const suffix = `${Date.now().toString(36)}-${process.pid.toString(36)}-${randomUUID().slice(0, 8)}`;
+  const prefix = callerProfile.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 20) || "cli";
+  return `${prefix}-validate-${suffix}`;
+}
+function safeFailureMessage(error) {
+  if (error instanceof Error) {
+    return error.message.replace(/lmt_(?:operator_session|client_id)=[A-Za-z0-9._~-]+/g, "[REDACTED]").replace(/(password|token|credential|cookie)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]");
+  }
+  return "The Operator Session validation failed.";
+}
+function gateUnavailable(error) {
+  return error instanceof Error && /Could not reach the selected Live Market Terminal Origin/.test(error.message);
+}
+function deadline(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new DOMException("The operation timed out.", "TimeoutError")), ms);
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+function waitForSignal2(operation, signal, deadlineMessage) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new Error(deadlineMessage));
+      return;
+    }
+    const onAbort = () => reject(new Error(deadlineMessage));
+    signal.addEventListener("abort", onAbort, { once: true });
+    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
+function actionOptions(options, profile, timeoutMs, signal) {
+  return {
+    target: options.target,
+    profile,
+    store: options.store,
+    timeoutMs,
+    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
+    signal,
+    ...options.secretReader ? { secretReader: options.secretReader } : {},
+    ...options.readLoginCredentials ? { readLoginCredentials: options.readLoginCredentials } : {}
+  };
+}
+async function runOperatorSessionValidation(options) {
+  const started = performance.now();
+  const actionTimeoutMs = options.timeoutMs ?? 12e4;
+  const actionDeadlineAt = Date.now() + actionTimeoutMs;
+  const actionDeadline = deadline(actionTimeoutMs);
+  const actionTimeoutSignal = actionDeadline.signal;
+  const actionSignal = options.signal ? AbortSignal.any([options.signal, actionTimeoutSignal]) : actionTimeoutSignal;
+  const temporaryProfile = makeTemporaryProfile(options.callerProfile);
+  const invalidProfile = `${temporaryProfile.slice(0, 54)}-invalid`;
+  const observations = [];
+  let outcome = "fail";
+  let reason = "scenario_failed";
+  let observedOperator;
+  let requestId;
+  let buildId;
+  let cleanup = { outcome: "success", removedProfiles: [] };
+  try {
+    const smsCredential = await waitForSignal2(
+      options.store.getSmsCredential(),
+      actionSignal,
+      "The validation exceeded its deadline."
+    );
+    if (!smsCredential) {
+      outcome = "blocked";
+      reason = "sms_credential_missing";
+      observations.push("Protected SMS credential is not provisioned.");
+    } else {
+      let credentials;
+      try {
+        credentials = await waitForSignal2(
+          (options.readLoginCredentials ?? readOperatorLoginCredentials)({
+            operatorId: options.target.operatorId,
+            gateScope: options.target.gateScope,
+            smsEndpoint: options.target.smsEndpoint,
+            smsCredential,
+            timeoutMs: Math.max(1, actionDeadlineAt - Date.now()),
+            signal: actionSignal,
+            ...options.secretReader ? { secretReader: options.secretReader } : {}
+          }),
+          actionSignal,
+          "The validation exceeded its deadline."
+        );
+      } catch (error) {
+        if (actionSignal.aborted) {
+          outcome = "fail";
+          reason = "deadline_exceeded";
+          observations.push("The validation exceeded its deadline while reading the Operator Directory.");
+        } else if (error instanceof SmsReadError && ["sms_credential_missing", "sms_unavailable"].includes(error.code)) {
+          outcome = "blocked";
+          reason = error.code;
+          observations.push("Operator Directory credentials could not be read from the selected Gate SMS scope.");
+        } else {
+          outcome = "fail";
+          reason = error instanceof SmsReadError ? error.code : "operator_directory_invalid";
+          observations.push("The selected Gate Operator Directory could not provide the configured Operator credentials.");
+        }
+      }
+      if (outcome === "fail" && reason === "scenario_failed" && credentials) {
+        const validActions = createOperatorSessionActions(actionOptions(options, temporaryProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
+        try {
+          const login = await waitForSignal2(
+            validActions.loginWithPassword(credentials.username, credentials.password),
+            actionSignal,
+            "The validation exceeded its deadline."
+          );
+          observedOperator = login.observedOperator;
+          requestId = login.metadata?.requestId;
+          buildId = login.metadata?.buildId;
+          observations.push("Gate accepted the configured Operator Login credentials.");
+          const laterInvocation = createOperatorSessionActions(actionOptions(options, temporaryProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
+          const reused = await waitForSignal2(laterInvocation.statusWithBrokerProof(), actionSignal, "The validation exceeded its deadline.");
+          observedOperator = reused.observedOperator;
+          requestId = reused.metadata?.requestId ?? requestId;
+          buildId = reused.metadata?.buildId ?? buildId;
+          observations.push("A fresh client invocation reused the same Gate session and observed Operator.");
+          const invalidActions = createOperatorSessionActions(actionOptions(options, invalidProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
+          let invalidLoginRejected = false;
+          try {
+            await waitForSignal2(
+              invalidActions.loginWithPassword(credentials.username, `${credentials.password}.invalid`),
+              actionSignal,
+              "The validation exceeded its deadline."
+            );
+          } catch (error) {
+            if (error instanceof OperatorCredentialsRejectedError) {
+              invalidLoginRejected = true;
+              observations.push("Gate rejected invalid credentials from a client without a usable session.");
+            } else {
+              throw error;
+            }
+          }
+          if (!invalidLoginRejected) {
+            outcome = "fail";
+            reason = "invalid_credentials_accepted";
+            observations.push("Gate accepted the invalid Operator Login credentials.");
+          } else {
+            const invalidLaterInvocation = createOperatorSessionActions(actionOptions(options, invalidProfile, Math.max(1, actionDeadlineAt - Date.now()), actionSignal));
+            try {
+              await waitForSignal2(invalidLaterInvocation.statusWithBrokerProof(), actionSignal, "The validation exceeded its deadline.");
+              outcome = "fail";
+              reason = "invalid_login_established_session";
+              observations.push("The unauthenticated test client unexpectedly had a usable Operator Session.");
+            } catch (error) {
+              if (!(error instanceof OperatorSessionRejectedError)) throw error;
+              outcome = "pass";
+              reason = "operator_session_validated";
+              observations.push("Gate confirmed that the invalid-login client has no usable Operator Session.");
+            }
+          }
+        } catch (error) {
+          if (actionSignal.aborted) {
+            outcome = "fail";
+            reason = "deadline_exceeded";
+            observations.push("The Operator Session validation exceeded its deadline.");
+          } else if (gateUnavailable(error)) {
+            outcome = "blocked";
+            reason = "gate_unreachable";
+            observations.push("The selected Gate could not be reached during the validation scenario.");
+          } else {
+            outcome = "fail";
+            reason = error instanceof OperatorSessionRejectedError ? "session_rejected_after_login" : "validation_action_failed";
+            observations.push(safeFailureMessage(error));
+          }
+        }
+      }
+    }
+  } catch (error) {
+    if (actionSignal.aborted) {
+      outcome = "fail";
+      reason = "deadline_exceeded";
+      observations.push("The Operator Session validation exceeded its deadline.");
+    } else if (gateUnavailable(error)) {
+      outcome = "blocked";
+      reason = "gate_unreachable";
+      observations.push("The selected Gate could not be reached.");
+    } else {
+      outcome = "fail";
+      reason = "validation_action_failed";
+      observations.push(safeFailureMessage(error));
+    }
+  } finally {
+    actionDeadline.clear();
+    const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 1e4;
+    const cleanupDeadline = deadline(cleanupTimeoutMs);
+    const cleanupSignal = cleanupDeadline.signal;
+    const removedProfiles = [];
+    let cleanupError;
+    for (const profile of [invalidProfile, temporaryProfile]) {
+      try {
+        const saved = await waitForSignal2(
+          options.store.getSession(profile, options.target),
+          cleanupSignal,
+          "Validation cleanup exceeded its deadline."
+        );
+        if (saved?.operatorSessionCookie) {
+          const cleanupActions = createOperatorSessionActions(actionOptions(options, profile, cleanupTimeoutMs, cleanupSignal));
+          try {
+            await waitForSignal2(cleanupActions.logout(), cleanupSignal, "Validation cleanup exceeded its deadline.");
+          } catch (error) {
+            cleanupError ??= { code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "gate_logout_failed", message: safeFailureMessage(error) };
+          }
+        }
+      } catch (error) {
+        cleanupError ??= {
+          code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "cleanup_store_read_failed",
+          message: safeFailureMessage(error)
+        };
+      }
+      try {
+        await waitForSignal2(
+          options.store.removeTarget(profile, options.target),
+          cleanupSignal,
+          "Validation cleanup exceeded its deadline."
+        );
+        removedProfiles.push(profile);
+      } catch (error) {
+        cleanupError ??= {
+          code: cleanupSignal.aborted ? "cleanup_deadline_exceeded" : "cleanup_store_remove_failed",
+          message: safeFailureMessage(error)
+        };
+      }
+    }
+    cleanupDeadline.clear();
+    cleanup = cleanupError ? { outcome: "fail", removedProfiles, error: cleanupError } : { outcome: "success", removedProfiles };
+    if (cleanupError && outcome === "pass") {
+      outcome = "fail";
+      reason = "cleanup_failed";
+    }
+  }
+  return {
+    target: { environment: options.target.environment, origin: options.target.origin },
+    ...options.callerProfile ? { profile: options.callerProfile } : {},
+    outcome,
+    reason,
+    expectedOperator: options.target.operatorId,
+    ...observedOperator ? { observedOperator } : {},
+    temporaryProfile,
+    observations,
+    elapsedMs: Math.round(performance.now() - started),
+    ...requestId ? { requestId } : {},
+    ...buildId ? { buildId } : {},
+    cleanup
+  };
+}
+
+// src/commands.ts
+var defaultOut = { write: (chunk) => process.stdout.write(chunk) };
+var defaultErr = { write: (chunk) => process.stderr.write(chunk) };
+var ENV_REQUIRED = "Headless commands require --env local|dev.";
+var InvocationError = class extends Error {
+  constructor(message, code = "invalid_invocation") {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function parseTimeout(raw) {
+  const match = /^(\d+(?:\.\d+)?)(ms|s|m)?$/.exec(raw.trim());
+  if (!match) throw new InvocationError("Timeout must be a finite duration such as 30000ms, 30s, or 2m.");
+  const value = Number(match[1]) * (match[2] === "m" ? 6e4 : match[2] === "s" ? 1e3 : 1);
+  if (!Number.isFinite(value) || value < 1 || value > 6e5) {
+    throw new InvocationError("Timeout must be between 1ms and 10m.");
+  }
+  return Math.ceil(value);
+}
+function splitHeadlessArgv(argv) {
+  if (hasArgumentOtp(argv)) throw new InvocationError("--otp arguments are no longer accepted. Use --otp-stdin with an explicit --attempt ID.");
+  if (argv.length === 0 || argv[0] === "interactive") {
+    throw new InvocationError("Choose a headless command or run `live-market-terminal interactive`.");
+  }
+  const options = /* @__PURE__ */ new Map();
+  let credentialStdin = false;
+  let otpStdin = false;
+  const positional = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--otp-stdin") {
+      if (otpStdin) throw new InvocationError("Argument --otp-stdin may be specified only once.");
+      otpStdin = true;
+      continue;
+    }
+    if (token === "--credential-stdin") {
+      if (credentialStdin) throw new InvocationError("Argument --credential-stdin may be specified only once.");
+      credentialStdin = true;
+      continue;
+    }
+    if (token === "--env" || token === "--profile" || token === "--timeout" || token === "--attempt" || token === "--date" || token === "--output") {
+      const value = argv[index + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new InvocationError(`Invalid or incomplete command argument: ${token}`);
+      }
+      if (options.has(token)) throw new InvocationError(`Argument ${token} may be specified only once.`);
+      options.set(token, value);
+      index += 1;
+      continue;
+    }
+    if (token.startsWith("--")) {
+      throw new InvocationError(`Unsupported command option: ${token.split("=")[0]}`);
+    }
+    positional.push(token);
+  }
+  return { positional, options, credentialStdin, otpStdin };
+}
+function parseArguments(argv) {
+  if (!hasArgumentOtp(argv) && isPairInvocation(argv)) return parsePairArguments(argv, parseTimeout, validateCommandProfile);
+  const parsedInput = splitHeadlessArgv(argv.filter((value) => value !== "--stdin"));
+  const commandVerb = parsedInput.positional[0];
+  if (commandVerb === "settings" || commandVerb === "token") {
+    const stdin = argv.includes("--stdin");
+    if (argv.filter((value) => value === "--stdin").length > 1) throw new InvocationError("--stdin may be supplied only once.");
+    const parsed = parsedInput;
+    const [kind2, action] = parsed.positional;
+    if (parsed.positional.length !== 2 || parsed.credentialStdin || parsed.otpStdin || [...parsed.options.keys()].some((key) => !["--env", "--profile", "--timeout"].includes(key)) || !(kind2 === "settings" && (action === "read" && !stdin || action === "save" && stdin) || kind2 === "token" && (action === "replace" && stdin || action === "read" && !stdin))) {
+      throw new InvocationError("Use settings read, settings save --stdin, or token replace --stdin.");
+    }
+    return { kind: kind2, action, ...commandTarget(parsed.options) };
+  }
+  if (argv.includes("--stdin")) throw new InvocationError("--stdin is only supported for Settings save and token replacement.");
+  const { positional, options, credentialStdin, otpStdin } = parsedInput;
+  if (positional[0] === "candle-export") {
+    const instrument = positional[1] === void 0 ? void 0 : parseCandleExportInstrument(positional[1]);
+    const date = options.get("--date");
+    if (positional.length !== 2 || !instrument || credentialStdin || otpStdin || options.has("--attempt") || options.get("--output") === "" || date !== void 0 && !isCandleExportDate(date)) {
+      throw new InvocationError("Use candle-export EXCHANGE:SYMBOL [--date YYYY-MM-DD] [--output PATH].");
+    }
+    const target = commandTarget(options);
+    return {
+      kind: "candle-export",
+      ...instrument,
+      ...target,
+      ...date ? { date } : {},
+      ...options.has("--output") ? { output: options.get("--output") } : {}
+    };
+  }
+  if (options.has("--output")) throw new InvocationError("--output is only supported for candle-export and pair report.");
+  if (options.has("--date")) throw new InvocationError("--date is only supported for candle-export.");
+  if (positional[0] === "zerodha") {
+    const action = positional[1];
+    if (!["login", "observe", "otp", "status"].includes(action) || positional.length !== 2 || credentialStdin) {
+      throw new InvocationError("Use zerodha login, observe, otp, or status.");
+    }
+    const target = commandTarget(options);
+    const attemptId = options.get("--attempt");
+    if (attemptId && (action === "login" || action === "status") || attemptId && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) {
+      throw new InvocationError("--attempt must be a valid Zerodha attempt ID and is only supported for observe and otp.");
+    }
+    if ((action === "observe" || action === "otp") && !attemptId) {
+      throw new InvocationError("--attempt ID is required for zerodha observe and otp. Use the attemptId returned by zerodha login.");
+    }
+    if (action === "otp" && !otpStdin || otpStdin && action !== "otp") {
+      throw new InvocationError("--otp-stdin is required for zerodha otp only. Start with zerodha login, then submit with zerodha otp --attempt ID --otp-stdin.");
+    }
+    return {
+      kind: "zerodha",
+      action,
+      ...target,
+      attemptId,
+      otpStdin
+    };
+  }
+  if (positional[0] === "validate" && positional[1] === "zerodha-session") {
+    if (positional.length !== 2 || credentialStdin) throw new InvocationError("Use validate zerodha-session with optional --attempt ID and --otp-stdin.");
+    const target = commandTarget(options);
+    const attemptId = options.get("--attempt");
+    if (attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) throw new InvocationError("--attempt must be a valid Zerodha attempt ID.");
+    if (otpStdin && !attemptId) throw new InvocationError("--otp-stdin requires an explicit --attempt ID from a prior login or validation.");
+    return { kind: "validate-zerodha", ...target, attemptId, otpStdin };
+  }
+  if (otpStdin || options.has("--attempt")) throw new InvocationError("--otp-stdin and --attempt are Zerodha options only.");
+  if (positional[0] === "credential") {
+    if (positional[1] !== "provision" || positional.length > 2) {
+      throw new InvocationError("Use `credential provision` to provision the protected SMS credential.");
+    }
+    if (!credentialStdin) throw new InvocationError("Pipe the credential with --credential-stdin, or run in a terminal to type it.");
+    const environment = options.get("--env");
+    if (!environment) throw new InvocationError("Headless credential provision requires --env local|dev and --credential-stdin.");
+    return { kind: "credential-provision", environment };
+  }
+  if (credentialStdin) throw new InvocationError("--credential-stdin is only supported for credential provision.");
+  let kind;
+  if (positional[0] === "login" || positional[0] === "status" || positional[0] === "logout") {
+    kind = positional[0];
+    if (positional.length > 1) {
+      throw new InvocationError("Unexpected positional argument; use --help for command syntax.");
+    }
+  } else if (positional[0] === "validate" && positional[1] === "operator-session") {
+    kind = "validate";
+    if (positional.length > 2) {
+      throw new InvocationError("Unexpected positional argument; use --help for command syntax.");
+    }
+  } else if (positional.length === 0) {
+    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
+  } else {
+    throw new InvocationError("Unknown command. Choose login, logout, status, zerodha, credential provision, or validate operator-session|zerodha-session.");
+  }
+  return { kind, ...commandTarget(options) };
+}
+function commandTarget(options) {
+  const environment = options.get("--env");
+  const profile = options.get("--profile");
+  if (!environment) throw new InvocationError(ENV_REQUIRED);
+  if (profile !== void 0) validateCommandProfile(profile);
+  return { environment, profile, ...options.has("--timeout") ? { timeoutMs: parseTimeout(options.get("--timeout")) } : {} };
+}
+function parseCandleExportInstrument(value) {
+  const instrument = /^([A-Za-z][A-Za-z0-9]{0,31}):([^:\s]{1,100})$/.exec(value);
+  return instrument ? { exchange: instrument[1].toUpperCase(), tradingSymbol: instrument[2].toUpperCase() } : void 0;
+}
+function isCandleExportDate(date) {
+  const parsed = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+  return /^\d{4}-\d{2}-\d{2}$/.test(date) && Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === date && date >= "2000-01-01";
+}
+function validateCommandProfile(profile) {
+  try {
+    assertClientProfileName(profile);
+  } catch {
+    throw new InvocationError(CLIENT_PROFILE_NAME_ERROR);
+  }
+}
+function durationFor(command) {
+  return command.kind === "validate" || command.kind === "validate-zerodha" ? command.timeoutMs ?? 12e4 : command.kind === "credential-provision" ? 3e4 : command.timeoutMs ?? 3e4;
+}
+function errorDetails(error, signal) {
+  if (signal?.aborted) return { code: "deadline_exceeded", message: "The action exceeded its deadline.", exitCode: 1 };
+  if (error instanceof InvocationError || error instanceof ProtectedInputError || error instanceof PairInvocationError) {
+    return { code: error.code, message: error.message, exitCode: 2 };
+  }
+  if (error instanceof OperatorSessionRejectedError) {
+    return { code: "operator_login_required", message: "No valid Operator Session is available; run login first.", exitCode: 3 };
+  }
+  if (error instanceof OperatorCredentialsRejectedError) {
+    return { code: "incorrect_credentials", message: "Gate rejected the Operator Login credentials.", exitCode: 1 };
+  }
+  if (error instanceof ZerodhaLoginAttemptUnavailableError) return { code: "login_attempt_inactive", message: error.message, exitCode: 1 };
+  if (error instanceof ZerodhaLoginFailedError) return { code: "zerodha_login_failed", message: error.message, exitCode: 1 };
+  if (error instanceof Error && "code" in error && typeof error.code === "string" && ["zerodha_session_absent", "zerodha_session_restoring", "zerodha_verification_unavailable", "zerodha_credentials_missing", "secret_store_unavailable", "operator_not_configured"].includes(error.code)) {
+    return { code: error.code, message: error.message, exitCode: 1 };
+  }
+  if (error instanceof SmsReadError) {
+    return { code: error.code, message: error.message, exitCode: 1 };
+  }
+  if (error instanceof Error && error.message === "The CLI supports local or dev targets only; prod is not permitted.") {
+    return { code: "invalid_target", message: error.message, exitCode: 2 };
+  }
+  return {
+    code: "action_failed",
+    message: error instanceof Error ? error.message : "The CLI action failed.",
+    exitCode: 1
+  };
+}
+function controllerSessionDetails(details) {
+  if (details.code === "sms_credential_missing") return { ...details, exitCode: 4, nextStep: CREDENTIAL_PROVISION_STEP };
+  if (isLoginRequired(details.code)) {
+    return { ...details, exitCode: 4, nextStep: CONTROLLER_LOGIN_STEP };
+  }
+  return details;
+}
+function emitLine(line, streams, diagnostic) {
+  streams.stdout.write(`${JSON.stringify(line)}
+`);
+  if (diagnostic) streams.stderr.write(`${diagnostic}
+`);
+}
+function emit(envelope, streams, diagnostic) {
+  emitLine(envelope, streams, diagnostic);
+}
+async function readProtectedInput(stdin, signal, label = "SMS credential") {
+  if (!stdin || stdin.isTTY) throw new InvocationError(`${label} requires piped protected stdin.`);
+  const chunks = [];
+  let size = 0;
+  const iterator = stdin[Symbol.asyncIterator]();
+  while (true) {
+    if (signal.aborted) throw new Error("The action exceeded its deadline.");
+    const next = await new Promise((resolve, reject) => {
+      const onAbort = () => {
+        stdin.destroy?.();
+        reject(new Error("The action exceeded its deadline."));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      iterator.next().then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    });
+    if (next.done) break;
+    const chunk = next.value;
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 4096) throw new InvocationError(`${label} input is too large.`);
+    chunks.push(buffer);
+  }
+  const credential = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!credential.trim() || /[\r\n]/.test(credential)) throw new InvocationError(`${label} input must be one non-empty line.`);
+  return credential;
+}
+async function runHeadlessCli(argv, dependencies = {}) {
+  let otp;
+  let securePayload;
+  const protect = (stream) => ({ write(chunk) {
+    let output = otp ? chunk.replaceAll(otp, "[redacted]") : chunk;
+    if (securePayload) output = output.replaceAll(securePayload, "[redacted]");
+    return stream.write(output);
+  } });
+  const streams = { stdout: protect(dependencies.stdout ?? defaultOut), stderr: protect(dependencies.stderr ?? defaultErr) };
+  const started = performance.now();
+  let command;
+  let target;
+  let profile;
+  let owner;
+  let actionApi;
+  let signal;
+  let deadlineTimer;
+  let store;
+  try {
+    command = parseArguments(argv);
+    const timeoutMs = durationFor(command);
+    const deadline2 = new AbortController();
+    deadlineTimer = setTimeout(() => deadline2.abort(), timeoutMs);
+    signal = deadline2.signal;
+    profile = command.profile;
+    try {
+      target = resolveCliTarget({ LMT_ENV: command.environment }, dependencies.configPath, dependencies.workingDirectory);
+    } catch (error) {
+      if (error instanceof LocalConfigError) throw new InvocationError(error.message, error.code);
+      throw new InvocationError(error instanceof Error ? error.message : "The selected target is invalid.", "invalid_target");
+    }
+    store = new CliProfileStore(dependencies.homeDirectory);
+    if (command.kind === "credential-provision") {
+      const credential = await readProtectedInput(dependencies.stdin ?? process.stdin, signal);
+      await store.saveSmsCredential(credential);
+      streams.stdout.write(`${JSON.stringify({ version: 1, command: "credential provision", outcome: "success", environment: target.environment })}
+`);
+      return 0;
+    }
+    profile = command.profile;
+    owner = ownerOf(profile);
+    if (command.kind === "status") {
+      const { report, exitCode } = await reportSessionStatus({
+        target,
+        owner,
+        store,
+        timeoutMs,
+        signal,
+        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {}
+      });
+      emitLine(report, streams, report.outcome === "success" ? void 0 : report.error?.message ?? report.nextStep);
+      return exitCode;
+    }
+    if (command.kind === "validate-zerodha") {
+      const validation = await runZerodhaValidation({
+        target,
+        callerProfile: profile,
+        store,
+        timeoutMs,
+        signal,
+        attemptId: command.attemptId,
+        ...command.otpStdin ? { readOtp: (inputSignal) => readProtectedOtp(dependencies.stdin ?? process.stdin, inputSignal) } : {},
+        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {}
+      });
+      emit({
+        version: 1,
+        command: "validate zerodha-session",
+        outcome: validation.outcome,
+        reason: validation.reason,
+        target: validation.target,
+        profile,
+        observedOperator: validation.observedOperator,
+        attemptId: validation.attemptId,
+        observedState: validation.observedState,
+        elapsedMs: validation.elapsedMs,
+        metadata: { requestId: validation.requestId, buildId: validation.buildId },
+        validation
+      }, streams, validation.exitCode === 0 ? void 0 : `Zerodha Session validation ${validation.outcome}: ${validation.reason}. ${validation.nextStep ?? ""}`);
+      return validation.exitCode;
+    }
+    if (command.kind === "validate") {
+      const validation = await runOperatorSessionValidation({
+        target,
+        callerProfile: profile,
+        store,
+        timeoutMs,
+        signal,
+        ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {},
+        ...dependencies.secretReader ? { secretReader: dependencies.secretReader } : {},
+        ...dependencies.readLoginCredentials ? { readLoginCredentials: dependencies.readLoginCredentials } : {}
+      });
+      const exitCode = validation.outcome === "pass" ? 0 : validation.outcome === "blocked" ? 4 : 1;
+      emit({
+        version: 1,
+        command: "validate operator-session",
+        outcome: validation.outcome,
+        reason: validation.reason,
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        ...validation.observedOperator ? { observedOperator: validation.observedOperator } : {},
+        elapsedMs: validation.elapsedMs,
+        metadata: { requestId: validation.requestId ?? null, buildId: validation.buildId ?? null },
+        validation
+      }, streams, exitCode === 0 ? void 0 : `Operator Session validation ${validation.outcome}: ${validation.reason}.`);
+      return exitCode;
+    }
+    const actions = createOperatorSessionActions({
+      target,
+      profile: owner,
+      store,
+      timeoutMs,
+      signal,
+      ...dependencies.fetchImpl ? { fetchImpl: dependencies.fetchImpl } : {},
+      ...dependencies.secretReader ? { secretReader: dependencies.secretReader } : {},
+      ...dependencies.readLoginCredentials ? { readLoginCredentials: dependencies.readLoginCredentials } : {}
+    });
+    actionApi = await actions.getApi();
+    if (command.kind === "settings" || command.kind === "token") {
+      await actions.status();
+      let payload;
+      if (command.action !== "read") {
+        securePayload = await readProtectedInput(dependencies.stdin ?? process.stdin, signal, "Settings JSON");
+        try {
+          payload = JSON.parse(securePayload);
+        } catch {
+          throw new InvocationError("Protected stdin must contain one JSON object.");
+        }
+        if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new InvocationError("Protected stdin must contain one JSON object.");
+      }
+      const settings = command.kind === "settings" ? command.action === "read" ? { outcome: "read", settings: await actionApi.getSettings() } : await actionApi.saveSettings(payload) : void 0;
+      const tokenMetadata = command.kind === "token" && command.action === "read" ? await actionApi.getTokenMetadata() : void 0;
+      const token = command.kind === "token" && command.action === "replace" ? await actionApi.replaceToken(payload) : void 0;
+      emit({
+        version: 1,
+        command: command.kind + " " + command.action,
+        outcome: "success",
+        reason: settings?.outcome ?? token?.outcome,
+        ...settings ? { settings: settings.settings } : {},
+        ...token ? { token } : {},
+        ...tokenMetadata ? { tokenMetadata } : {},
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
+      }, streams);
+      return 0;
+    }
+    if (command.kind === "candle-export") {
+      await actions.status();
+      const candleExport = await actionApi.exportCandles({
+        exchange: command.exchange,
+        tradingSymbol: command.tradingSymbol,
+        ...command.date ? { date: command.date } : {}
+      });
+      const download = command.output !== void 0 ? await downloadCandleExport(candleExport.url, command.output, signal, dependencies.fetchImpl) : void 0;
+      emit({
+        version: 1,
+        command: command.kind,
+        outcome: "success",
+        ...download ? { download } : {},
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        observedOperator: target.operatorId,
+        candleExport,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
+      }, streams);
+      return 0;
+    }
+    if (command.kind === "pair") {
+      await actions.status();
+      const result2 = await runPairCommand(command, actionApi);
+      emit({
+        version: 1,
+        command: `pair ${command.action}`,
+        outcome: "success",
+        ...result2,
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        observedOperator: target.operatorId,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: { requestId: actionApi.responseMetadata().requestId ?? null, buildId: actionApi.responseMetadata().buildId ?? null }
+      }, streams);
+      return 0;
+    }
+    if (command.kind === "zerodha") {
+      await actions.status();
+      if (command.otpStdin) otp = await readProtectedOtp(dependencies.stdin ?? process.stdin, signal);
+      const zerodha = await runZerodhaAction(
+        actionApi,
+        command.action,
+        target.operatorId,
+        signal,
+        command.attemptId,
+        otp
+      );
+      const awaitingOtp = zerodha.status === "awaiting_otp";
+      emit({
+        version: 1,
+        command: `zerodha ${command.action}`,
+        outcome: awaitingOtp ? "blocked" : "success",
+        reason: awaitingOtp ? "awaiting_otp" : "zerodha_session_present",
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        observedOperator: target.operatorId,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: {
+          requestId: actionApi.responseMetadata().requestId ?? null,
+          buildId: actionApi.responseMetadata().buildId ?? null
+        },
+        zerodha
+      }, streams);
+      return awaitingOtp ? 4 : 0;
+    }
+    if (command.kind === "logout") {
+      await actions.logout();
+      emit({
+        version: 1,
+        command: "logout",
+        outcome: "success",
+        reason: "operator_session_cleared",
+        target: { environment: target.environment, origin: target.origin },
+        profile,
+        elapsedMs: Math.round(performance.now() - started),
+        metadata: {
+          requestId: actionApi.responseMetadata().requestId ?? null,
+          buildId: actionApi.responseMetadata().buildId ?? null
+        }
+      }, streams);
+      return 0;
+    }
+    const result = await actions.loginFromSms();
+    emit({
+      version: 1,
+      command: command.kind,
+      outcome: "success",
+      reason: "operator_session_established",
+      target: { environment: target.environment, origin: target.origin },
+      profile,
+      observedOperator: result.observedOperator,
+      elapsedMs: Math.round(performance.now() - started),
+      metadata: { requestId: result.metadata?.requestId ?? null, buildId: result.metadata?.buildId ?? null }
+    }, streams);
+    return 0;
+  } catch (error) {
+    if (error instanceof OperatorSessionRejectedError && store && actionApi && target && owner !== void 0 && !signal?.aborted) {
+      await store.saveSession(owner, target, actionApi.getCookies()).catch(() => void 0);
+    }
+    const failure = error instanceof SettingsActionError || error instanceof PriceCrossActionError ? { code: error.code, message: error.message, exitCode: 1 } : errorDetails(error, signal);
+    const details = owner !== void 0 && profileNameOf(owner) === void 0 ? controllerSessionDetails(failure) : failure;
+    const recovery = error instanceof Error ? error : void 0;
+    const attemptId = recovery?.attemptId ?? (command?.kind === "zerodha" ? command.attemptId : void 0);
+    emit({
+      version: 1,
+      command: command?.kind === "zerodha" || command?.kind === "settings" || command?.kind === "token" || command?.kind === "pair" ? `${command.kind} ${command.action}` : command?.kind === "credential-provision" ? "credential provision" : command?.kind === "validate-zerodha" ? "validate zerodha-session" : command?.kind === "validate" ? "validate operator-session" : command?.kind ?? "",
+      outcome: (error instanceof SettingsActionError || error instanceof PriceCrossActionError) && error.uncertain ? "uncertain" : details.exitCode === 4 ? "blocked" : "fail",
+      reason: details.code,
+      ...target ? { target: { environment: target.environment, origin: target.origin } } : command ? { target: { environment: command.environment } } : {},
+      ...profile ? { profile } : {},
+      ...attemptId ? { attemptId, recovery: recovery?.recovery ?? "Observe this exact attempt with the same target and profile; start explicitly only if Gate reports it inactive." } : {},
+      ...!attemptId && error instanceof PriceCrossActionError && error.recovery ? { recovery: error.recovery } : {},
+      ...recovery?.observedState ? { observedState: recovery.observedState } : {},
+      ...recovery?.observedOperator ? { observedOperator: recovery.observedOperator } : {},
+      ...details.nextStep ? { nextStep: details.nextStep } : {},
+      elapsedMs: Math.round(performance.now() - started),
+      metadata: {
+        requestId: actionApi?.responseMetadata().requestId ?? null,
+        buildId: actionApi?.responseMetadata().buildId ?? null
+      },
+      error: { code: details.code, message: details.message }
+    }, streams, details.exitCode === 2 ? `Invalid CLI invocation: ${details.message}` : details.message);
+    return details.exitCode;
+  } finally {
+    otp = void 0;
+    securePayload = void 0;
+    if (deadlineTimer) clearTimeout(deadlineTimer);
+  }
+}
+function hasArgumentOtp(argv) {
+  return argv.some((token) => token === "--otp" || token.startsWith("--otp="));
+}
+
+export {
+  downloadCandleExport,
+  createOperatorSessionActions,
+  runPairCommand,
+  runOperatorSessionValidation,
+  runZerodhaAction,
+  runZerodhaValidation,
+  parseCandleExportInstrument,
+  isCandleExportDate,
+  runHeadlessCli,
+  hasArgumentOtp
+};