@crewx/sdk 0.9.0-rc.110 → 0.9.0-rc.112

package/dist/account/index.js

@@ -1,2 +1,2 @@
-'use strict';var dotenv=require('dotenv'),I=require('path'),M=require('os'),z=require('fs'),crypto=require('crypto');function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var I__namespace=/*#__PURE__*/_interopNamespace(I);var M__namespace=/*#__PURE__*/_interopNamespace(M);var z__namespace=/*#__PURE__*/_interopNamespace(z);var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var v="CREWX_ACCOUNT_BASE_URL",S="CREWX_ACCOUNT_ISSUER",N="CREWX_MARKETPLACE_URL",x="CREWX_TARGET",W="CREWX_MARKETPLACE_DISABLED",y=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),R=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),L=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function D(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function X(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function P(t){let e=t[x];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function F(t){let e=t[W]?.trim().toLowerCase();return e==="1"||e==="true"}function b(t){return t==="local"?R:y}function V(t=process.env){let e=P(t),n=t[v];return n!==void 0?D(n,"ACCOUNT_BASE_URL_INVALID",true):b(e).accountBaseUrl}function pe(t=process.env){let e=P(t);if(F(t))throw new i("MARKETPLACE_DISABLED");let n=t[N];return n!==void 0?D(n,"MARKETPLACE_URL_INVALID"):b(e).marketplaceUrl}function k(t=process.env){let e=t[S];return e===void 0?L:[X(e)]}function he(t=process.env){return k(t)[0]}function q(t,e,n,r=false){if(t===void 0)return e;try{return D(t,n,r)}catch{return t.trim()}}function le(t){let e=t[S];if(e===void 0)return L;try{return [X(e)]}catch{return [e.trim()]}}function j(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function fe(t,e){return e!==null&&t===y.accountBaseUrl&&e===y.marketplaceUrl?"production":e!==null&&t===R.accountBaseUrl&&e===R.marketplaceUrl?"local":"custom"}function $(t=process.env){let e,n=true;try{e=P(t);}catch{e="production",n=false;}let r=b(e),o=t[x]!==void 0&&n,a=t[v],m=t[N],u=F(t),d=q(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),w=u?null:q(m,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:w,issuers:le(t),profile:fe(d,w),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":m===void 0?o?"profile":"default":"env",issuer:t[S]===void 0?"default":"env"},mixed:w!==null&&j(d)!==j(w),marketplaceDisabled:u}}function de(t=process.env){if($(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function J(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function U(){if(process.env.CREWX_HOME)try{return z__namespace.realpathSync(process.env.CREWX_HOME)}catch{return I__namespace.join(M__namespace.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?I__namespace.join(process.env.XDG_CONFIG_HOME,"crewx"):I__namespace.join(M__namespace.homedir(),".crewx")}function Ae(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();dotenv.config({path:I.join(e,".env"),override:false,quiet:true});let n=t.homeDir??U();dotenv.config({path:I.join(n,".env"),override:false,quiet:true});}var ne="auth.json",H=2,te=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function ye(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Re(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function Se(t){try{return g(t),!0}catch{return  false}}function g(t){if(!Re(t))return h();if(t.version===1)return ye();if(t.version!==H)return h();let e=Object.keys(t);if(e.length!==te.length||e.some(r=>!te.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:H,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function re(t){let e;try{e=JSON.parse(t);}catch{return h()}return g(e)}function oe(t){return t??I.join(U(),ne)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return oe(this.configuredPath)}read(){let e=this.path();if(!z.existsSync(e))return null;try{return re(z.readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=g(e),r=this.path(),o=I.dirname(r);z.mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${crypto.randomUUID()}`;try{z.writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),z.chmodSync(a,384),z.renameSync(a,r),z.chmodSync(r,384);}catch{try{z.existsSync(a)&&z.unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{z.existsSync(e)&&z.unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ke(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ie(t,e){new A({filePath:e}).write(t);}function Ue(t){new A({filePath:t}).clear();}var ie="/auth/v1/oauth/device/code",ce="/auth/v1/oauth/token",ae="/auth/v1/oauth/revoke",O="crewx-cli",E="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function T(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function Oe(t){let e=T(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=T(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function ve(t){let e=T(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function Ne(t){let e=T(t),n=T(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var C=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:xe(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:V()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=J(this.baseUrl(),e),m=this.fetchImpl??globalThis.fetch;if(typeof m!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await m(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw se(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw se(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",O);let n=await this.request(ie,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return ve(n)}async requestToken(e){Le(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",O),e.grant_type===E?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return Ne(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:E,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",O),await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function xe(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function Le(t){if(!t||t.grant_type!==E&&t.grant_type!=="refresh_token"||t.grant_type===E&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function se(t,e,n){let r=Oe(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===E){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var K=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=Pe(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new C,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=g(e);return ue(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw De(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");ue(e.access_token,r.sub);let o=g({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function De(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function Pe(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function ue(t,e){let n=k(),r=be(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function be(t){if(typeof t!="string")throw G();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw G();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw G()}}function G(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
-exports.ACCOUNT_BASE_URL_ENV=v;exports.ACCOUNT_ISSUER_ENV=S;exports.ACCOUNT_TARGET_ENV=x;exports.AUTH_JSON_FILENAME=ne;exports.AUTH_JSON_VERSION=H;exports.AccountAuthError=s;exports.AccountConfigurationError=i;exports.AuthClient=C;exports.AuthClientError=s;exports.AuthError=s;exports.AuthJsonStore=A;exports.AuthJsonValidationError=p;exports.DEFAULT_ACCEPTED_ISSUERS=L;exports.DEVICE_CODE_GRANT_TYPE=E;exports.DEVICE_CODE_PATH=ie;exports.LOCAL_TARGET=R;exports.LoginRequiredError=l;exports.MARKETPLACE_DISABLED_ENV=W;exports.MARKETPLACE_URL_ENV=N;exports.OAUTH_CLIENT_ID=O;exports.PRODUCTION_TARGET=y;exports.REVOKE_PATH=ae;exports.SessionManager=K;exports.SessionManagerError=f;exports.TOKEN_PATH=ce;exports.appendEndpoint=J;exports.assertAccountTargetNotMixed=de;exports.authJsonPath=oe;exports.clearAuthJson=Ue;exports.isAuthJsonV2=Se;exports.loadCrewxEnvFiles=Ae;exports.parseAuthJson=re;exports.readAuthJson=ke;exports.resolveAcceptedAccountIssuers=k;exports.resolveAccountBaseUrl=V;exports.resolveAccountIssuer=he;exports.resolveAccountTarget=$;exports.resolveMarketplaceUrl=pe;exports.validateAuthJson=g;exports.writeAuthJson=Ie;
+'use strict';var dotenv=require('dotenv'),T=require('path'),$=require('os'),z=require('fs'),crypto=require('crypto');function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var T__namespace=/*#__PURE__*/_interopNamespace(T);var $__namespace=/*#__PURE__*/_interopNamespace($);var z__namespace=/*#__PURE__*/_interopNamespace(z);var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var O="CREWX_ACCOUNT_BASE_URL",k="CREWX_ACCOUNT_ISSUER",v="CREWX_MARKETPLACE_URL",x="CREWX_TARGET",W="CREWX_MARKETPLACE_DISABLED",R=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),S=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),L=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function D(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function j(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function P(t){let e=t[x];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function X(t){let e=t[W]?.trim().toLowerCase();return e==="1"||e==="true"}function b(t){return t==="local"?S:R}function V(t=process.env){let e=P(t),n=t[O];return n!==void 0?D(n,"ACCOUNT_BASE_URL_INVALID",true):b(e).accountBaseUrl}function pe(t=process.env){let e=P(t);if(X(t))throw new i("MARKETPLACE_DISABLED");let n=t[v];return n!==void 0?D(n,"MARKETPLACE_URL_INVALID"):b(e).marketplaceUrl}function I(t=process.env){let e=t[k];return e===void 0?L:[j(e)]}function he(t=process.env){return I(t)[0]}function K(t,e,n,r=false){if(t===void 0)return e;try{return D(t,n,r)}catch{return t.trim()}}function le(t){let e=t[k];if(e===void 0)return L;try{return [j(e)]}catch{return [e.trim()]}}function q(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function fe(t,e){return e!==null&&t===R.accountBaseUrl&&e===R.marketplaceUrl?"production":e!==null&&t===S.accountBaseUrl&&e===S.marketplaceUrl?"local":"custom"}function F(t=process.env){let e,n=true;try{e=P(t);}catch{e="production",n=false;}let r=b(e),o=t[x]!==void 0&&n,a=t[O],m=t[v],u=X(t),d=K(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),y=u?null:K(m,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:y,issuers:le(t),profile:fe(d,y),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":m===void 0?o?"profile":"default":"env",issuer:t[k]===void 0?"default":"env"},mixed:y!==null&&q(d)!==q(y),marketplaceDisabled:u}}function de(t=process.env){if(F(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function J(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function U(){if(process.env.CREWX_HOME){let t=T__namespace.resolve(process.env.CREWX_HOME);try{return z__namespace.realpathSync(t)}catch(e){if(e instanceof Error&&"code"in e&&e.code==="ENOENT")return t;throw e}}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?T__namespace.join(process.env.XDG_CONFIG_HOME,"crewx"):T__namespace.join($__namespace.homedir(),".crewx")}function Ae(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();dotenv.config({path:T.join(e,".env"),override:false,quiet:true});let n=t.homeDir??U();dotenv.config({path:T.join(n,".env"),override:false,quiet:true});}var ne="auth.json",B=2,te=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function ye(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Re(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function Se(t){try{return g(t),!0}catch{return  false}}function g(t){if(!Re(t))return h();if(t.version===1)return ye();if(t.version!==B)return h();let e=Object.keys(t);if(e.length!==te.length||e.some(r=>!te.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:B,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function re(t){let e;try{e=JSON.parse(t);}catch{return h()}return g(e)}function oe(t){return t??T.join(U(),ne)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return oe(this.configuredPath)}read(){let e=this.path();if(!z.existsSync(e))return null;try{return re(z.readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=g(e),r=this.path(),o=T.dirname(r);z.mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${crypto.randomUUID()}`;try{z.writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),z.chmodSync(a,384),z.renameSync(a,r),z.chmodSync(r,384);}catch{try{z.existsSync(a)&&z.unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{z.existsSync(e)&&z.unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ke(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ie(t,e){new A({filePath:e}).write(t);}function Ue(t){new A({filePath:t}).clear();}var ie="/auth/v1/oauth/device/code",ce="/auth/v1/oauth/token",ae="/auth/v1/oauth/revoke",N="crewx-cli",E="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function C(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function Ne(t){let e=C(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=C(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function Oe(t){let e=C(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function ve(t){let e=C(t),n=C(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var w=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:xe(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:V()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=J(this.baseUrl(),e),m=this.fetchImpl??globalThis.fetch;if(typeof m!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await m(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw se(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw se(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",N);let n=await this.request(ie,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return Oe(n)}async requestToken(e){Le(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",N),e.grant_type===E?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return ve(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:E,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",N),await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function xe(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function Le(t){if(!t||t.grant_type!==E&&t.grant_type!=="refresh_token"||t.grant_type===E&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function se(t,e,n){let r=Ne(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===E){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var G=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=Pe(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new w,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=g(e);return ue(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw De(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");ue(e.access_token,r.sub);let o=g({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function De(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function Pe(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function ue(t,e){let n=I(),r=be(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function be(t){if(typeof t!="string")throw H();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw H();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw H()}}function H(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
+exports.ACCOUNT_BASE_URL_ENV=O;exports.ACCOUNT_ISSUER_ENV=k;exports.ACCOUNT_TARGET_ENV=x;exports.AUTH_JSON_FILENAME=ne;exports.AUTH_JSON_VERSION=B;exports.AccountAuthError=s;exports.AccountConfigurationError=i;exports.AuthClient=w;exports.AuthClientError=s;exports.AuthError=s;exports.AuthJsonStore=A;exports.AuthJsonValidationError=p;exports.DEFAULT_ACCEPTED_ISSUERS=L;exports.DEVICE_CODE_GRANT_TYPE=E;exports.DEVICE_CODE_PATH=ie;exports.LOCAL_TARGET=S;exports.LoginRequiredError=l;exports.MARKETPLACE_DISABLED_ENV=W;exports.MARKETPLACE_URL_ENV=v;exports.OAUTH_CLIENT_ID=N;exports.PRODUCTION_TARGET=R;exports.REVOKE_PATH=ae;exports.SessionManager=G;exports.SessionManagerError=f;exports.TOKEN_PATH=ce;exports.appendEndpoint=J;exports.assertAccountTargetNotMixed=de;exports.authJsonPath=oe;exports.clearAuthJson=Ue;exports.isAuthJsonV2=Se;exports.loadCrewxEnvFiles=Ae;exports.parseAuthJson=re;exports.readAuthJson=ke;exports.resolveAcceptedAccountIssuers=I;exports.resolveAccountBaseUrl=V;exports.resolveAccountIssuer=he;exports.resolveAccountTarget=F;exports.resolveMarketplaceUrl=pe;exports.validateAuthJson=g;exports.writeAuthJson=Ie;

package/dist/esm/account/index.js

@@ -1,2 +1,2 @@
-import {config}from'dotenv';import*as U from'path';import {join,dirname}from'path';import*as B from'os';import*as Y from'fs';import {existsSync,readFileSync,mkdirSync,writeFileSync,chmodSync,renameSync,unlinkSync}from'fs';import {randomUUID}from'crypto';var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var N="CREWX_ACCOUNT_BASE_URL",k="CREWX_ACCOUNT_ISSUER",x="CREWX_MARKETPLACE_URL",L="CREWX_TARGET",X="CREWX_MARKETPLACE_DISABLED",R=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),S=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),D=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function P(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function F(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function b(t){let e=t[L];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function $(t){let e=t[X]?.trim().toLowerCase();return e==="1"||e==="true"}function V(t){return t==="local"?S:R}function J(t=process.env){let e=b(t),n=t[N];return n!==void 0?P(n,"ACCOUNT_BASE_URL_INVALID",true):V(e).accountBaseUrl}function he(t=process.env){let e=b(t);if($(t))throw new i("MARKETPLACE_DISABLED");let n=t[x];return n!==void 0?P(n,"MARKETPLACE_URL_INVALID"):V(e).marketplaceUrl}function I(t=process.env){let e=t[k];return e===void 0?D:[F(e)]}function le(t=process.env){return I(t)[0]}function j(t,e,n,r=false){if(t===void 0)return e;try{return P(t,n,r)}catch{return t.trim()}}function fe(t){let e=t[k];if(e===void 0)return D;try{return [F(e)]}catch{return [e.trim()]}}function W(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function de(t,e){return e!==null&&t===R.accountBaseUrl&&e===R.marketplaceUrl?"production":e!==null&&t===S.accountBaseUrl&&e===S.marketplaceUrl?"local":"custom"}function z(t=process.env){let e,n=true;try{e=b(t);}catch{e="production",n=false;}let r=V(e),o=t[L]!==void 0&&n,a=t[N],T=t[x],u=$(t),d=j(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),y=u?null:j(T,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:y,issuers:fe(t),profile:de(d,y),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":T===void 0?o?"profile":"default":"env",issuer:t[k]===void 0?"default":"env"},mixed:y!==null&&W(d)!==W(y),marketplaceDisabled:u}}function Ae(t=process.env){if(z(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function M(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function O(){if(process.env.CREWX_HOME)try{return Y.realpathSync(process.env.CREWX_HOME)}catch{return U.join(B.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?U.join(process.env.XDG_CONFIG_HOME,"crewx"):U.join(B.homedir(),".crewx")}function _e(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();config({path:join(e,".env"),override:false,quiet:true});let n=t.homeDir??O();config({path:join(n,".env"),override:false,quiet:true});}var re="auth.json",G=2,ne=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function Re(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Se(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function ke(t){try{return E(t),!0}catch{return  false}}function E(t){if(!Se(t))return h();if(t.version===1)return Re();if(t.version!==G)return h();let e=Object.keys(t);if(e.length!==ne.length||e.some(r=>!ne.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:G,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function oe(t){let e;try{e=JSON.parse(t);}catch{return h()}return E(e)}function se(t){return t??join(O(),re)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return se(this.configuredPath)}read(){let e=this.path();if(!existsSync(e))return null;try{return oe(readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=E(e),r=this.path(),o=dirname(r);mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${randomUUID()}`;try{writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),chmodSync(a,384),renameSync(a,r),chmodSync(r,384);}catch{try{existsSync(a)&&unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{existsSync(e)&&unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function Ie(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ue(t,e){new A({filePath:e}).write(t);}function Oe(t){new A({filePath:t}).clear();}var ce="/auth/v1/oauth/device/code",ae="/auth/v1/oauth/token",ue="/auth/v1/oauth/revoke",v="crewx-cli",m="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function C(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function ve(t){let e=C(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=C(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function Ne(t){let e=C(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function xe(t){let e=C(t),n=C(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var w=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:Le(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:J()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=M(this.baseUrl(),e),T=this.fetchImpl??globalThis.fetch;if(typeof T!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await T(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw ie(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw ie(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",v);let n=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return Ne(n)}async requestToken(e){De(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",v),e.grant_type===m?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return xe(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:m,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",v),await this.request(ue,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function Le(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function De(t){if(!t||t.grant_type!==m&&t.grant_type!=="refresh_token"||t.grant_type===m&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function ie(t,e,n){let r=ve(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===m){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var q=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=be(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new w,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=E(e);return pe(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw Pe(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");pe(e.access_token,r.sub);let o=E({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function Pe(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function be(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function pe(t,e){let n=I(),r=Ve(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function Ve(t){if(typeof t!="string")throw K();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw K();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw K()}}function K(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
-export{N as ACCOUNT_BASE_URL_ENV,k as ACCOUNT_ISSUER_ENV,L as ACCOUNT_TARGET_ENV,re as AUTH_JSON_FILENAME,G as AUTH_JSON_VERSION,s as AccountAuthError,i as AccountConfigurationError,w as AuthClient,s as AuthClientError,s as AuthError,A as AuthJsonStore,p as AuthJsonValidationError,D as DEFAULT_ACCEPTED_ISSUERS,m as DEVICE_CODE_GRANT_TYPE,ce as DEVICE_CODE_PATH,S as LOCAL_TARGET,l as LoginRequiredError,X as MARKETPLACE_DISABLED_ENV,x as MARKETPLACE_URL_ENV,v as OAUTH_CLIENT_ID,R as PRODUCTION_TARGET,ue as REVOKE_PATH,q as SessionManager,f as SessionManagerError,ae as TOKEN_PATH,M as appendEndpoint,Ae as assertAccountTargetNotMixed,se as authJsonPath,Oe as clearAuthJson,ke as isAuthJsonV2,_e as loadCrewxEnvFiles,oe as parseAuthJson,Ie as readAuthJson,I as resolveAcceptedAccountIssuers,J as resolveAccountBaseUrl,le as resolveAccountIssuer,z as resolveAccountTarget,he as resolveMarketplaceUrl,E as validateAuthJson,Ue as writeAuthJson};
+import {config}from'dotenv';import*as C from'path';import {join,dirname}from'path';import*as z from'os';import*as Y from'fs';import {existsSync,readFileSync,mkdirSync,writeFileSync,chmodSync,renameSync,unlinkSync}from'fs';import {randomUUID}from'crypto';var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var v="CREWX_ACCOUNT_BASE_URL",I="CREWX_ACCOUNT_ISSUER",x="CREWX_MARKETPLACE_URL",L="CREWX_TARGET",j="CREWX_MARKETPLACE_DISABLED",S=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),k=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),D=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function P(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function X(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function b(t){let e=t[L];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function F(t){let e=t[j]?.trim().toLowerCase();return e==="1"||e==="true"}function V(t){return t==="local"?k:S}function J(t=process.env){let e=b(t),n=t[v];return n!==void 0?P(n,"ACCOUNT_BASE_URL_INVALID",true):V(e).accountBaseUrl}function he(t=process.env){let e=b(t);if(F(t))throw new i("MARKETPLACE_DISABLED");let n=t[x];return n!==void 0?P(n,"MARKETPLACE_URL_INVALID"):V(e).marketplaceUrl}function U(t=process.env){let e=t[I];return e===void 0?D:[X(e)]}function le(t=process.env){return U(t)[0]}function q(t,e,n,r=false){if(t===void 0)return e;try{return P(t,n,r)}catch{return t.trim()}}function fe(t){let e=t[I];if(e===void 0)return D;try{return [X(e)]}catch{return [e.trim()]}}function W(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function de(t,e){return e!==null&&t===S.accountBaseUrl&&e===S.marketplaceUrl?"production":e!==null&&t===k.accountBaseUrl&&e===k.marketplaceUrl?"local":"custom"}function $(t=process.env){let e,n=true;try{e=b(t);}catch{e="production",n=false;}let r=V(e),o=t[L]!==void 0&&n,a=t[v],T=t[x],u=F(t),d=q(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),R=u?null:q(T,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:R,issuers:fe(t),profile:de(d,R),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":T===void 0?o?"profile":"default":"env",issuer:t[I]===void 0?"default":"env"},mixed:R!==null&&W(d)!==W(R),marketplaceDisabled:u}}function Ae(t=process.env){if($(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function M(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function N(){if(process.env.CREWX_HOME){let t=C.resolve(process.env.CREWX_HOME);try{return Y.realpathSync(t)}catch(e){if(e instanceof Error&&"code"in e&&e.code==="ENOENT")return t;throw e}}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?C.join(process.env.XDG_CONFIG_HOME,"crewx"):C.join(z.homedir(),".crewx")}function _e(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();config({path:join(e,".env"),override:false,quiet:true});let n=t.homeDir??N();config({path:join(n,".env"),override:false,quiet:true});}var re="auth.json",H=2,ne=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function Re(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Se(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function ke(t){try{return E(t),!0}catch{return  false}}function E(t){if(!Se(t))return h();if(t.version===1)return Re();if(t.version!==H)return h();let e=Object.keys(t);if(e.length!==ne.length||e.some(r=>!ne.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:H,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function oe(t){let e;try{e=JSON.parse(t);}catch{return h()}return E(e)}function se(t){return t??join(N(),re)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return se(this.configuredPath)}read(){let e=this.path();if(!existsSync(e))return null;try{return oe(readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=E(e),r=this.path(),o=dirname(r);mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${randomUUID()}`;try{writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),chmodSync(a,384),renameSync(a,r),chmodSync(r,384);}catch{try{existsSync(a)&&unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{existsSync(e)&&unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function Ie(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ue(t,e){new A({filePath:e}).write(t);}function Ne(t){new A({filePath:t}).clear();}var ce="/auth/v1/oauth/device/code",ae="/auth/v1/oauth/token",ue="/auth/v1/oauth/revoke",O="crewx-cli",m="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function w(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function Oe(t){let e=w(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=w(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function ve(t){let e=w(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function xe(t){let e=w(t),n=w(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var y=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:Le(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:J()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=M(this.baseUrl(),e),T=this.fetchImpl??globalThis.fetch;if(typeof T!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await T(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw ie(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw ie(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",O);let n=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return ve(n)}async requestToken(e){De(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",O),e.grant_type===m?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return xe(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:m,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",O),await this.request(ue,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function Le(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function De(t){if(!t||t.grant_type!==m&&t.grant_type!=="refresh_token"||t.grant_type===m&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function ie(t,e,n){let r=Oe(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===m){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var K=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=be(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new y,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=E(e);return pe(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw Pe(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");pe(e.access_token,r.sub);let o=E({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function Pe(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function be(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function pe(t,e){let n=U(),r=Ve(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function Ve(t){if(typeof t!="string")throw G();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw G();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw G()}}function G(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
+export{v as ACCOUNT_BASE_URL_ENV,I as ACCOUNT_ISSUER_ENV,L as ACCOUNT_TARGET_ENV,re as AUTH_JSON_FILENAME,H as AUTH_JSON_VERSION,s as AccountAuthError,i as AccountConfigurationError,y as AuthClient,s as AuthClientError,s as AuthError,A as AuthJsonStore,p as AuthJsonValidationError,D as DEFAULT_ACCEPTED_ISSUERS,m as DEVICE_CODE_GRANT_TYPE,ce as DEVICE_CODE_PATH,k as LOCAL_TARGET,l as LoginRequiredError,j as MARKETPLACE_DISABLED_ENV,x as MARKETPLACE_URL_ENV,O as OAUTH_CLIENT_ID,S as PRODUCTION_TARGET,ue as REVOKE_PATH,K as SessionManager,f as SessionManagerError,ae as TOKEN_PATH,M as appendEndpoint,Ae as assertAccountTargetNotMixed,se as authJsonPath,Ne as clearAuthJson,ke as isAuthJsonV2,_e as loadCrewxEnvFiles,oe as parseAuthJson,Ie as readAuthJson,U as resolveAcceptedAccountIssuers,J as resolveAccountBaseUrl,le as resolveAccountIssuer,$ as resolveAccountTarget,he as resolveMarketplaceUrl,E as validateAuthJson,Ue as writeAuthJson};