@aventurevc/aventure-cli 0.8.180 → 0.8.182

package/dist/aventure-cli/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{enableCompileCache as e}from"node:module";e();var{CommanderError:t}=await import(`../chunks/commander-Cj79cOD4.js`),{logWarn:n,setStderrLogging:r}=await import(`../chunks/logging-SpDUtMAq.js`),{readRuntimePackage:i}=await import(`../chunks/package-N5oYCiVc.js`),{locateRuntimeManifest:a}=await import(`../chunks/runtime-identity-Bva_KyCh.js`),{materializeCliOAuthBearerCredential:o,materializeSavedCliOAuthBearerCredential:s}=await import(`../chunks/oauth-bearer-credential-nO_y4YXf.js`),{materializeCliApiKeyBearerCredential:c}=await import(`../chunks/api-key-bearer-credential-CbAZG3UK.js`),{commandAuthMaterializationMode:l}=await import(`../chunks/startup-auth-G6Utbedw.js`),{setTextAllFields:u}=await import(`../chunks/text-field-CxrRvM47.js`),{cliMachineOutputSelected:d}=await import(`../chunks/output-mode-BszZ_T22.js`),{GENERATED_OPENAPI_COMMAND_SPECS:f}=await import(`../chunks/openapi-commands-EyRhLowQ.js`),p=process.argv.slice(2);d(p)&&r(!1),p.includes(`--all-fields`)&&u(!0);try{a();let e=l(p,f);if(e===`stored`||e===`optional`)try{await(e===`stored`?s():o()),await c()}catch(e){n({component:i().bin[0],event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:e})}await import(`../chunks/aventure-cli-1wY4a8zo.js`)}catch(e){if(!(e instanceof t))throw e;process.stderr.write(`${e.message}\n`),process.exitCode=e.exitCode}export{};
+import{enableCompileCache as e}from"node:module";e();var{CommanderError:t}=await import(`../chunks/commander-Cj79cOD4.js`),{logWarn:n,setStderrLogging:r}=await import(`../chunks/logging-B7HscXAR.js`),{readRuntimePackage:i}=await import(`../chunks/package-N5oYCiVc.js`),{locateRuntimeManifest:a}=await import(`../chunks/runtime-identity-Bva_KyCh.js`),{materializeCliOAuthBearerCredential:o,materializeSavedCliOAuthBearerCredential:s}=await import(`../chunks/oauth-bearer-credential-Hs2M6E5C.js`),{materializeCliApiKeyBearerCredential:c}=await import(`../chunks/api-key-bearer-credential-BQEuNZq_.js`),{commandAuthMaterializationMode:l}=await import(`../chunks/startup-auth-BgliDNpy.js`),{setTextAllFields:u}=await import(`../chunks/text-field-CxrRvM47.js`),{cliMachineOutputSelected:d}=await import(`../chunks/output-mode-ClwZIjEf.js`),{GENERATED_OPENAPI_COMMAND_SPECS:f}=await import(`../chunks/openapi-commands-BJPh7WgV.js`),p=process.argv.slice(2);d(p)&&r(!1),p.includes(`--all-fields`)&&u(!0);try{a();let e=l(p,f);if(e===`stored`||e===`optional`)try{await(e===`stored`?s():o()),await c()}catch(e){n({component:i().bin[0],event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:e})}await import(`../chunks/aventure-cli-ByArqREK.js`)}catch(e){if(!(e instanceof t))throw e;process.stderr.write(`${e.message}\n`),process.exitCode=e.exitCode}export{};

package/dist/aventure-cli/unified-operations.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "MCP_GENERATION_CONTRACT",
-  "generatedAt": "2026-10-14T15:01:41.253Z",
-  "totalOperations": 146,
+  "generatedAt": "2026-10-14T21:07:15.209Z",
+  "totalOperations": 133,
   "note": "Projection of MCP_GENERATION_CONTRACT - see mcp/scripts/build-unified-operations.ts header for SSOT rules.",
   "operations": [
     {
@@ -44,26 +44,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "authorizeOperations",
-      "method": "POST",
-      "path": "/v1/auth/me/permissions",
-      "resource": "auth",
-      "intent": "write",
-      "cliCommand": "auth me permissions authorize",
-      "cliPath": [
-        "auth",
-        "me",
-        "permissions",
-        "authorize"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "AuthOperationFilterSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/auth/operation-filter",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getAuthProviderCatalog",
       "method": "GET",
@@ -83,25 +63,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "updateAdditionalUsage",
-      "method": "PATCH",
-      "path": "/v1/billing/additional-usage",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing additional-usage update",
-      "cliPath": [
-        "billing",
-        "additional-usage",
-        "update"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingAdditionalUsageMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/additional-usage-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getAiCredits",
       "method": "GET",
@@ -121,44 +82,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "createBillingCheckoutSession",
-      "method": "POST",
-      "path": "/v1/billing/checkout-sessions",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing checkout-sessions create",
-      "cliPath": [
-        "billing",
-        "checkout-sessions",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingCheckoutMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/checkout-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
-    {
-      "operationId": "createBillingCreditPurchase",
-      "method": "POST",
-      "path": "/v1/billing/credit-purchases",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing credit-purchases create",
-      "cliPath": [
-        "billing",
-        "credit-purchases",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingCreditPurchaseMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/credit-purchase-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getBillingCreditPurchase",
       "method": "GET",
@@ -178,44 +101,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "createBillingPlanChangePreview",
-      "method": "POST",
-      "path": "/v1/billing/plan-change-previews",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing plan-change-previews create",
-      "cliPath": [
-        "billing",
-        "plan-change-previews",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingPlanChangeMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/plan-change-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
-    {
-      "operationId": "createBillingPlanChange",
-      "method": "POST",
-      "path": "/v1/billing/plan-changes",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing plan-changes create",
-      "cliPath": [
-        "billing",
-        "plan-changes",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingPlanChangeMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/plan-change-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "listPlans",
       "method": "GET",
@@ -235,25 +120,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "createBillingPortalSession",
-      "method": "POST",
-      "path": "/v1/billing/portal-sessions",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing portal-sessions create",
-      "cliPath": [
-        "billing",
-        "portal-sessions",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingPortalMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/portal-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getBillingSubscription",
       "method": "GET",
@@ -273,25 +139,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "updateBillingSubscription",
-      "method": "PATCH",
-      "path": "/v1/billing/subscription",
-      "resource": "billing",
-      "intent": "write",
-      "cliCommand": "billing subscription update",
-      "cliPath": [
-        "billing",
-        "subscription",
-        "update"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "BillingSubscriptionMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/billing/subscription-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getBillingNextCharge",
       "method": "GET",
@@ -337,17 +184,17 @@
       "method": "POST",
       "path": "/v1/enrichments",
       "resource": "enrichments",
-      "intent": "write",
+      "intent": "job",
       "cliCommand": "enrichments enrich",
       "cliPath": [
         "enrichments",
         "enrich"
       ],
-      "mcpTool": "aventure_write",
+      "mcpTool": "aventure_job",
       "bodySchemaName": "EnrichmentBatchSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/enrichment/batch",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -621,18 +468,18 @@
       "method": "POST",
       "path": "/v1/entities/{entityId}/enrichments",
       "resource": "entities",
-      "intent": "write",
+      "intent": "job",
       "cliCommand": "entities enrichments enrich",
       "cliPath": [
         "entities",
         "enrichments",
         "enrich"
       ],
-      "mcpTool": "aventure_write",
+      "mcpTool": "aventure_job",
       "bodySchemaName": "EnrichmentPromptSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/enrichment/prompt",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -1588,17 +1435,17 @@
       "method": "POST",
       "path": "/v1/lookup-jobs",
       "resource": "lookup-jobs",
-      "intent": "write",
+      "intent": "job",
       "cliCommand": "lookup-jobs create",
       "cliPath": [
         "lookup-jobs",
         "create"
       ],
-      "mcpTool": "aventure_write",
+      "mcpTool": "aventure_job",
       "bodySchemaName": "LookupJobMutationSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/lookup/job-mutation",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -1633,7 +1480,7 @@
       "bodySchemaName": "LookupJobMutationSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/lookup/job-mutation",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -1727,25 +1574,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "createNewsFeedback",
-      "method": "POST",
-      "path": "/v1/news/feedback",
-      "resource": "news",
-      "intent": "write",
-      "cliCommand": "news feedback create",
-      "cliPath": [
-        "news",
-        "feedback",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "NewsFeedbackSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/news/feedback",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "lookupNews",
       "method": "GET",
@@ -1764,25 +1592,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "unsubscribeNewsSubscription",
-      "method": "DELETE",
-      "path": "/v1/news/subscriptions",
-      "resource": "news",
-      "intent": "delete",
-      "cliCommand": "news subscriptions unsubscribe",
-      "cliPath": [
-        "news",
-        "subscriptions",
-        "unsubscribe"
-      ],
-      "mcpTool": "aventure_delete",
-      "bodySchemaName": "NewsSubscriptionKeySchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/news/subscription-key",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": true
-    },
     {
       "operationId": "listNewsSubscriptions",
       "method": "GET",
@@ -1802,45 +1611,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "subscribeNewsSubscription",
-      "method": "PUT",
-      "path": "/v1/news/subscriptions",
-      "resource": "news",
-      "intent": "write",
-      "cliCommand": "news subscriptions subscribe",
-      "cliPath": [
-        "news",
-        "subscriptions",
-        "subscribe"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "NewsSubscriptionSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/news/subscription",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
-    {
-      "operationId": "sendNewsSubscriptionTestEvent",
-      "method": "POST",
-      "path": "/v1/news/subscriptions/{subscriptionId}/test-events",
-      "resource": "news",
-      "intent": "write",
-      "cliCommand": "news subscriptions test-events send",
-      "cliPath": [
-        "news",
-        "subscriptions",
-        "test-events",
-        "send"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": null,
-      "bodySchemaImport": null,
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "listPeople",
       "method": "GET",
@@ -2016,18 +1786,18 @@
       "method": "POST",
       "path": "/v1/people/{personId}/enrichments",
       "resource": "people",
-      "intent": "write",
+      "intent": "job",
       "cliCommand": "people enrichments enrich",
       "cliPath": [
         "people",
         "enrichments",
         "enrich"
       ],
-      "mcpTool": "aventure_write",
+      "mcpTool": "aventure_job",
       "bodySchemaName": "EnrichmentPromptSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/enrichment/prompt",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -2432,17 +2202,17 @@
       "method": "POST",
       "path": "/v1/research-runs",
       "resource": "research-runs",
-      "intent": "write",
+      "intent": "job",
       "cliCommand": "research-runs create",
       "cliPath": [
         "research-runs",
         "create"
       ],
-      "mcpTool": "aventure_write",
+      "mcpTool": "aventure_job",
       "bodySchemaName": "HarnessRunCreateSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/harness/run-create",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {
@@ -2612,25 +2382,6 @@
       "scope": "read",
       "destructive": false
     },
-    {
-      "operationId": "createSharedSearch",
-      "method": "POST",
-      "path": "/v1/search/shared",
-      "resource": "search",
-      "intent": "write",
-      "cliCommand": "search shared create",
-      "cliPath": [
-        "search",
-        "shared",
-        "create"
-      ],
-      "mcpTool": "aventure_write",
-      "bodySchemaName": "SharedSearchMutationSchema",
-      "bodySchemaImport": "@aventurevc/api-schemas/shared/search-mutation",
-      "auth": "bearer",
-      "scope": "write",
-      "destructive": false
-    },
     {
       "operationId": "getSharedSearch",
       "method": "GET",
@@ -2740,7 +2491,7 @@
       "bodySchemaName": "SearchSchema",
       "bodySchemaImport": "@aventurevc/api-schemas/search/search",
       "auth": "bearer",
-      "scope": "write",
+      "scope": "read",
       "destructive": false
     },
     {

package/dist/chunks/api-key-bearer-credential-BQEuNZq_.js

@@ -0,0 +1 @@
+import{t as e}from"./api-key-bearer-credential-Cxons3cm.js";export{e as materializeCliApiKeyBearerCredential};

package/dist/chunks/{api-key-bearer-credential-08YUx1xO.js → api-key-bearer-credential-Cxons3cm.js}

@@ -1,4 +1,4 @@
-import{o as e,r as t}from"./logging-BkyFCiym.js";import{a as n,t as r,u as i}from"./env-Casn05NX.js";import{i as a,l as o,o as s,w as c,y as l}from"./person-owner-BJgNYLKX.js";import{a as u}from"./package-DPDX5zmx.js";import{r as d}from"./response-problem-DpVA-CLe.js";import{execFile as f}from"node:child_process";import{dirname as p,join as m}from"node:path";import{homedir as h,platform as g}from"node:os";import{setTimeout as _}from"node:timers/promises";import{randomUUID as v}from"node:crypto";import{AsyncLocalStorage as ee}from"node:async_hooks";import{chmod as te,mkdir as y,readFile as b,rename as x,rm as S,stat as ne,writeFile as C}from"node:fs/promises";function w(e){let t=e.trim();if(t.length===0)throw Error(`API host must not be blank`);let n=new URL(ae(t)?t:`${oe(t)}://${t}`),r=E(n.hostname);if(n.protocol!==`https:`&&n.protocol!==`http:`||n.username.length>0||n.password.length>0||n.pathname!==`/`&&n.pathname!==``||n.search.length>0||n.hash.length>0)throw Error(`API host must contain only an HTTP(S) host and optional port`);if(n.protocol===`http:`&&!r)throw Error(`stored credentials require HTTPS except for loopback API hosts`);return{host:n.host.toLowerCase(),origin:n.origin,isLoopback:r}}function T(e){let t=w(e);return t.isLoopback?w(n()).host:t.host}function re(e){return{...e,host:w(e.host).origin}}function ie(e){let t=w(e);if(t.isLoopback)return`http://localhost:3000`;if(t.host===`api.aventure.vc`)return`https://aventure.vc`;throw Error(`no first-party browser origin is configured for API host ${t.host}`)}function ae(e){return/^[a-z][a-z\d+.-]*:\/\//iu.test(e)}function oe(e){let t=e.split(`/`,1)[0]?.toLowerCase()??``;try{return E(new URL(`http://${t}`).hostname)?`http`:`https`}catch{return`https`}}function E(e){let t=e.toLowerCase();return t===`localhost`||t===`127.0.0.1`||t===`0.0.0.0`||t===`[::1]`}var D=l({createdAt:a({offset:!0}),description:c().nullish(),expiresAt:a({offset:!0}).nullish(),id:c().regex(/^ak_[0-9A-Fa-f]{32}$/),lastUsedAt:a({offset:!0}).nullish(),name:c(),revocationReason:c().nullish(),scopes:o(c()),status:s([`ACTIVE`,`REVOKED`,`EXPIRED`]),subject:c(),updatedAt:a({offset:!0})});function O(e,t=[]){let n=e instanceof Error?e.message:String(e);return d(n,t)}function se(e,t=[]){let n=d(e.title,t),r=d(e.detail?.trim()??``,t);return`${e.status} ${n}${r?` — ${r}`:``}`}function ce(){if(g()===`win32`){let e=process.env.APPDATA??m(h(),`AppData`,`Roaming`);return m(e,`aventure`,`config.json`)}let e=process.env.XDG_CONFIG_HOME??m(h(),`.config`);return m(e,`aventure`,`config.json`)}function le(){let e=process.env[r.authToken];return typeof e==`string`&&e.length>0?{present:!0,source:`env`}:{present:!1,source:null}}function k(e,t){return typeof e==`object`&&!!e&&`code`in e&&e.code===t}var ue=2;function de(e,t){return j(e,t).redactedUrl}async function fe(e,t,n){let r=j(e,t);return await A(new URL(r.openerUrl),n)}async function A(e,t){let n=t.environment??process.env,r=t.operatingSystem??g(),i=M(t.noBrowser,n,r);if(i!==null)return{state:`skipped`,reason:i};let a=pe(r,e.toString());if(a===null)return{state:`failed`,reason:`unsupported browser-opening platform: ${r}`};try{return await me(a.command,a.arguments),{state:`opened`,reason:null}}catch{return{state:`failed`,reason:`browser opener failed`}}}function j(e,t){let{id:n,verificationUrl:r,pollSecret:i}=e,a,o;try{a=new URL(r),o=new URL(t)}catch{throw Error(`broker returned an invalid browser verification URL`)}if(o.username.length>0||o.password.length>0||o.pathname!==`/`||o.search.length>0||o.hash.length>0)throw Error(`configured browser origin must contain only an origin`);let s=E(o.hostname);if(o.protocol!==`https:`&&!(o.protocol===`http:`&&s))throw Error(`configured browser origin must use HTTPS except for loopback development`);let c=new URLSearchParams(a.hash.slice(1)),l=[...c.keys()],u=c.getAll(`cliAuthorizationId`),d=c.getAll(`browserSecret`),f=d[0]??``;if(a.origin!==o.origin||a.protocol!==o.protocol||a.username.length>0||a.password.length>0||a.pathname!==`/settings/developer`||a.search.length>0||l.length!==ue||u.length!==1||u[0]!==n||d.length!==1||f.length===0||i.length===0||f===i)throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let p;try{p=decodeURIComponent(r)}catch{throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`)}if(r.includes(i)||p.includes(i))throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let m=new URL(a);return m.hash=new URLSearchParams({cliAuthorizationId:n,browserSecret:`<redacted>`}).toString(),{openerUrl:r,redactedUrl:m.toString()}}function M(e,t,n){return e?`--no-browser was set`:n===`darwin`&&t.CODEX_SESSION_ID?`macOS Codex browser process boundary`:t.SSH_CONNECTION||t.SSH_CLIENT||t.SSH_TTY?`SSH/headless session detected`:(n===`linux`||n===`freebsd`)&&!t.DISPLAY&&!t.WAYLAND_DISPLAY?`no graphical display detected`:null}function pe(e,t){return e===`darwin`?{command:`open`,arguments:[t]}:e===`win32`?{command:`rundll32.exe`,arguments:[`url.dll,FileProtocolHandler`,t]}:e===`linux`||e===`freebsd`?{command:`xdg-open`,arguments:[t]}:null}function me(e,t){return new Promise((n,r)=>{f(e,[...t],{timeout:5e3,windowsHide:!0},e=>e?r(e):n())})}var he=100,N=3e4,ge=6e4,P=new ee;function F(){return m(p(ce()),`credentials.json`)}function I(e){return`OS keyring is unusable (${e}); the credential will be stored in ${F()} (mode 0600).\n`}async function L(e,t){let n=(await W())[e]?.[t];if(n!==void 0)return{record:{provider:`file`,value:n}};try{let n=await(await U(e,t)).getPassword()??void 0;return n===void 0?{}:{record:{provider:`keyring`,value:n}}}catch(e){return{keyringFailure:H(e)}}}async function R(e,t,n){if((await W())[e]?.[t]!==void 0)return await z(e,t,n,`file store holds this account`);let r;try{let i=await U(e,t);if(await i.setPassword(n),await i.getPassword()===n)return await q(e,t,void 0),`keyring`;r=`Error: keyring readback did not match`}catch(e){r=H(e,[n])}return await z(e,t,n,r)}async function z(e,t,n,r){if(await q(e,t,n),(await W())[e]?.[t]!==n)throw Error(`credential storage did not confirm a durable write (keyring: ${r}; file: readback did not match)`);return`file`}async function B(e,t){try{let n=await U(e,t),r;try{await n.deleteCredential()}catch(e){r=e}let i;try{i=await n.getPassword()??void 0}catch(e){throw Error(`OS keyring removal outcome is unknown (${H(r??e)})`,{cause:e})}if(i!==void 0)throw Error(`OS keyring did not confirm removal (${H(r)})`,r===void 0?void 0:{cause:r})}finally{await q(e,t,void 0)}}async function V(e,t){let n=`${t}:probe:${v()}`,r=`aventure-cli-credential-probe:${v()}`,i;try{let t=await U(e,n);await t.setPassword(r);let a=await(await U(e,n)).getPassword(),o=await t.deleteCredential(),s=await(await U(e,n)).getPassword()??void 0;if(a!==r)i=`Error: probe readback did not match`;else if(!o||s!==void 0)i=`Error: probe cleanup was not confirmed`;else return{provider:`keyring`}}catch(e){i=H(e,[r])}try{await K(async()=>{await q(e,n,r);let t=(await W())[e]?.[n];if(await q(e,n,void 0),t!==r)throw Error(`probe readback did not match`)})}catch(e){throw Error(`credential storage is unavailable (keyring: ${i}; file ${F()}: ${H(e,[r])})`,{cause:e})}return{provider:`file`,keyringFailure:i}}function H(e,t=[]){if(!(e instanceof Error))return`Error`;let n=e.name||`Error`,[r=``]=O(e,t).trim().split(`
+import{o as e,r as t}from"./logging-D_7xwm_N.js";import{a as n,t as r,u as i}from"./env-gpTPURvt.js";import{i as a,l as o,o as s,w as c,y as l}from"./person-owner-BJgNYLKX.js";import{a as u}from"./package-DPDX5zmx.js";import{r as d}from"./response-problem-D6NByFDg.js";import{execFile as f}from"node:child_process";import{dirname as p,join as m}from"node:path";import{homedir as h,platform as g}from"node:os";import{setTimeout as _}from"node:timers/promises";import{randomUUID as v}from"node:crypto";import{AsyncLocalStorage as ee}from"node:async_hooks";import{chmod as te,mkdir as y,readFile as b,rename as x,rm as S,stat as ne,writeFile as C}from"node:fs/promises";function w(e){let t=e.trim();if(t.length===0)throw Error(`API host must not be blank`);let n=new URL(ae(t)?t:`${oe(t)}://${t}`),r=E(n.hostname);if(n.protocol!==`https:`&&n.protocol!==`http:`||n.username.length>0||n.password.length>0||n.pathname!==`/`&&n.pathname!==``||n.search.length>0||n.hash.length>0)throw Error(`API host must contain only an HTTP(S) host and optional port`);if(n.protocol===`http:`&&!r)throw Error(`stored credentials require HTTPS except for loopback API hosts`);return{host:n.host.toLowerCase(),origin:n.origin,isLoopback:r}}function T(e){let t=w(e);return t.isLoopback?w(n()).host:t.host}function re(e){return{...e,host:w(e.host).origin}}function ie(e){let t=w(e);if(t.isLoopback)return`http://localhost:3000`;if(t.host===`api.aventure.vc`)return`https://aventure.vc`;throw Error(`no first-party browser origin is configured for API host ${t.host}`)}function ae(e){return/^[a-z][a-z\d+.-]*:\/\//iu.test(e)}function oe(e){let t=e.split(`/`,1)[0]?.toLowerCase()??``;try{return E(new URL(`http://${t}`).hostname)?`http`:`https`}catch{return`https`}}function E(e){let t=e.toLowerCase();return t===`localhost`||t===`127.0.0.1`||t===`0.0.0.0`||t===`[::1]`}var D=l({createdAt:a({offset:!0}),description:c().nullish(),expiresAt:a({offset:!0}).nullish(),id:c().regex(/^ak_[0-9A-Fa-f]{32}$/),lastUsedAt:a({offset:!0}).nullish(),name:c(),revocationReason:c().nullish(),scopes:o(c()),status:s([`ACTIVE`,`REVOKED`,`EXPIRED`]),subject:c(),updatedAt:a({offset:!0})});function O(e,t=[]){let n=e instanceof Error?e.message:String(e);return d(n,t)}function se(e,t=[]){let n=d(e.title,t),r=d(e.detail?.trim()??``,t);return`${e.status} ${n}${r?` — ${r}`:``}`}function ce(){if(g()===`win32`){let e=process.env.APPDATA??m(h(),`AppData`,`Roaming`);return m(e,`aventure`,`config.json`)}let e=process.env.XDG_CONFIG_HOME??m(h(),`.config`);return m(e,`aventure`,`config.json`)}function le(){let e=process.env[r.authToken];return typeof e==`string`&&e.length>0?{present:!0,source:`env`}:{present:!1,source:null}}function k(e,t){return typeof e==`object`&&!!e&&`code`in e&&e.code===t}var ue=2;function de(e,t){return j(e,t).redactedUrl}async function fe(e,t,n){let r=j(e,t);return await A(new URL(r.openerUrl),n)}async function A(e,t){let n=t.environment??process.env,r=t.operatingSystem??g(),i=M(t.noBrowser,n,r);if(i!==null)return{state:`skipped`,reason:i};let a=pe(r,e.toString());if(a===null)return{state:`failed`,reason:`unsupported browser-opening platform: ${r}`};try{return await me(a.command,a.arguments),{state:`opened`,reason:null}}catch{return{state:`failed`,reason:`browser opener failed`}}}function j(e,t){let{id:n,verificationUrl:r,pollSecret:i}=e,a,o;try{a=new URL(r),o=new URL(t)}catch{throw Error(`broker returned an invalid browser verification URL`)}if(o.username.length>0||o.password.length>0||o.pathname!==`/`||o.search.length>0||o.hash.length>0)throw Error(`configured browser origin must contain only an origin`);let s=E(o.hostname);if(o.protocol!==`https:`&&!(o.protocol===`http:`&&s))throw Error(`configured browser origin must use HTTPS except for loopback development`);let c=new URLSearchParams(a.hash.slice(1)),l=[...c.keys()],u=c.getAll(`cliAuthorizationId`),d=c.getAll(`browserSecret`),f=d[0]??``;if(a.origin!==o.origin||a.protocol!==o.protocol||a.username.length>0||a.password.length>0||a.pathname!==`/settings/developer`||a.search.length>0||l.length!==ue||u.length!==1||u[0]!==n||d.length!==1||f.length===0||i.length===0||f===i)throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let p;try{p=decodeURIComponent(r)}catch{throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`)}if(r.includes(i)||p.includes(i))throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let m=new URL(a);return m.hash=new URLSearchParams({cliAuthorizationId:n,browserSecret:`<redacted>`}).toString(),{openerUrl:r,redactedUrl:m.toString()}}function M(e,t,n){return e?`--no-browser was set`:n===`darwin`&&t.CODEX_SESSION_ID?`macOS Codex browser process boundary`:t.SSH_CONNECTION||t.SSH_CLIENT||t.SSH_TTY?`SSH/headless session detected`:(n===`linux`||n===`freebsd`)&&!t.DISPLAY&&!t.WAYLAND_DISPLAY?`no graphical display detected`:null}function pe(e,t){return e===`darwin`?{command:`open`,arguments:[t]}:e===`win32`?{command:`rundll32.exe`,arguments:[`url.dll,FileProtocolHandler`,t]}:e===`linux`||e===`freebsd`?{command:`xdg-open`,arguments:[t]}:null}function me(e,t){return new Promise((n,r)=>{f(e,[...t],{timeout:5e3,windowsHide:!0},e=>e?r(e):n())})}var he=100,N=3e4,ge=6e4,P=new ee;function F(){return m(p(ce()),`credentials.json`)}function I(e){return`OS keyring is unusable (${e}); the credential will be stored in ${F()} (mode 0600).\n`}async function L(e,t){let n=(await W())[e]?.[t];if(n!==void 0)return{record:{provider:`file`,value:n}};try{let n=await(await U(e,t)).getPassword()??void 0;return n===void 0?{}:{record:{provider:`keyring`,value:n}}}catch(e){return{keyringFailure:H(e)}}}async function R(e,t,n){if((await W())[e]?.[t]!==void 0)return await z(e,t,n,`file store holds this account`);let r;try{let i=await U(e,t);if(await i.setPassword(n),await i.getPassword()===n)return await q(e,t,void 0),`keyring`;r=`Error: keyring readback did not match`}catch(e){r=H(e,[n])}return await z(e,t,n,r)}async function z(e,t,n,r){if(await q(e,t,n),(await W())[e]?.[t]!==n)throw Error(`credential storage did not confirm a durable write (keyring: ${r}; file: readback did not match)`);return`file`}async function B(e,t){try{let n=await U(e,t),r;try{await n.deleteCredential()}catch(e){r=e}let i;try{i=await n.getPassword()??void 0}catch(e){throw Error(`OS keyring removal outcome is unknown (${H(r??e)})`,{cause:e})}if(i!==void 0)throw Error(`OS keyring did not confirm removal (${H(r)})`,r===void 0?void 0:{cause:r})}finally{await q(e,t,void 0)}}async function V(e,t){let n=`${t}:probe:${v()}`,r=`aventure-cli-credential-probe:${v()}`,i;try{let t=await U(e,n);await t.setPassword(r);let a=await(await U(e,n)).getPassword(),o=await t.deleteCredential(),s=await(await U(e,n)).getPassword()??void 0;if(a!==r)i=`Error: probe readback did not match`;else if(!o||s!==void 0)i=`Error: probe cleanup was not confirmed`;else return{provider:`keyring`}}catch(e){i=H(e,[r])}try{await K(async()=>{await q(e,n,r);let t=(await W())[e]?.[n];if(await q(e,n,void 0),t!==r)throw Error(`probe readback did not match`)})}catch(e){throw Error(`credential storage is unavailable (keyring: ${i}; file ${F()}: ${H(e,[r])})`,{cause:e})}return{provider:`file`,keyringFailure:i}}function H(e,t=[]){if(!(e instanceof Error))return`Error`;let n=e.name||`Error`,[r=``]=O(e,t).trim().split(`
 `,1);return r&&r!==n?`${n}: ${r}`:n}async function U(e,t){let n=g(),r=n===`linux`||n===`freebsd`?M(!1,process.env,n):null;if(r!==null)throw Error(`OS keyring unlock prompt is unreachable (${r})`);let{AsyncEntry:i}=await import(`@napi-rs/keyring`);return new i(e,t)}async function W(){let e=F(),t;try{t=await b(e,`utf8`)}catch(e){if(k(e,`ENOENT`))return{};throw e}let n;try{n=JSON.parse(t)}catch(t){return await G(e,t)}return ve(n)?n:await G(e,void 0)}async function G(t,n){let r=`${t}.corrupt-${new Date().toISOString().replace(/[:.]/gu,`-`)}`;try{await x(t,r)}catch(e){if(k(e,`ENOENT`))return{};throw Error(`${t} is not a valid credential file and could not be moved aside`,{cause:e})}return e({component:u().bin[0],event:`credential_file_quarantined`,message:`${t} is not a valid credential file; moved it to ${r} and continuing with an empty file store`,...n===void 0?{}:{error:n}}),{}}async function K(e){if(P.getStore()===!0)return await e();let t=`${F()}.lock`;await y(p(t),{recursive:!0,mode:448});let n=Date.now()+N,r=v();for(;;){try{await C(t,r,{flag:`wx`,mode:384});break}catch(e){if(!k(e,`EEXIST`))throw e}if(await ne(t).then(e=>Date.now()-e.mtimeMs,()=>0)>ge)await S(t,{force:!0});else if(Date.now()>n)throw Error(`credential store is locked by another CLI process (${t})`);else await _(he)}try{return await P.run(!0,e)}finally{await b(t,`utf8`).catch(()=>``)===r&&await S(t,{force:!0})}}async function q(e,t,n){await K(async()=>await _e(e,t,n))}async function _e(e,t,n){let r=F(),i=await W(),a={...i[e]};if(n===void 0?delete a[t]:a[t]=n,Object.keys(a).length===0?delete i[e]:i[e]=a,Object.keys(i).length===0){await S(r,{force:!0});return}await y(p(r),{recursive:!0,mode:448});let o=`${r}.${v()}.tmp`;await C(o,`${JSON.stringify(i,null,2)}\n`,{mode:384}),await te(o,384),await x(o,r)}function ve(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`))}var J=`vc.aventure.aventure-cli`,Y=`aventure-cli-personal-v1`;async function ye(e,t,n){let r=T(e),i=Se(t,n),a;try{a=await R(J,r,i)}catch(e){throw Error(`${O(e,[i,t.secret])}; broker acknowledgment was withheld. Re-run auth status before retrying.`,{cause:e})}return{host:r,provider:a,activation:n,credential:t}}async function X(e){let t=T(e),n;try{n=await L(J,t)}catch(e){return Z(O(e))}let{record:r,keyringFailure:i}=n;return r===void 0?i===void 0?{state:`missing`}:{state:`missing`,keyringFailure:i}:{state:`found`,stored:{host:t,provider:r.provider,...Ce(r.value)}}}async function be(e){let t=await X(e);if(t.state!==`missing`)return t;try{let{keyringFailure:t}=await V(J,T(e));return t===void 0?{state:`missing`}:{state:`missing`,keyringFailure:t}}catch(e){return Z(O(e))}}async function xe(e){await B(J,T(e))}function Z(e){return{state:`unavailable`,summary:e,cause:`storage`}}function Se(e,t){return`${Y}:${t}\n${JSON.stringify(e.apiKey)}\n${e.secret}`}function Ce(e){let t=e.indexOf(`
 `),n=t<0?-1:e.indexOf(`
 `,t+1),r=t<0?e:e.slice(0,t),i=r===`${Y}:active`?`active`:`pending`;if(t<0||n<0||r!==`${Y}:pending`&&r!==`${Y}:active`)throw Error(`OS credential entry has an unsupported format`);let a=e.slice(n+1);if(a.length===0)throw Error(`OS credential entry has an empty secret`);let o;try{o=JSON.parse(e.slice(t+1,n))}catch(e){throw Error(`OS credential entry failed canonical schema validation`,{cause:e})}let s=D.safeParse(o);if(!s.success)throw Error(`OS credential entry failed canonical schema validation`,{cause:s.error});return{activation:i,credential:{apiKey:s.data,secret:a}}}async function we(n){if(Q())return;let a=T(i().host);try{let e=await X(a);if(e.state===`unavailable`){t($(`keyring`,Error(e.summary)));return}e.state===`found`&&e.stored.activation===`active`&&!Q()&&(process.env[r.authToken]=e.stored.credential.secret,n?.(`api-key`))}catch(t){e($(`parse`,t))}}function Q(){return(process.env[r.authToken]?.trim().length??0)>0}function $(e,t){return{component:u().bin[0],event:`api_key_materialization_unavailable`,message:`saved API key could not be loaded; continuing with environment auth`,fields:{source:e},error:t}}export{re as S,se as _,ye as a,w as b,V as c,R as d,A as f,O as g,le as h,X as i,L as l,de as m,xe as n,B as o,fe as p,be as r,I as s,we as t,K as u,D as v,T as x,ie as y};