@crewx/sdk 0.9.0-rc.93 → 0.9.0-rc.94

package/dist/account/config.d.ts

@@ -1,8 +1,37 @@
 export declare const ACCOUNT_BASE_URL_ENV: "CREWX_ACCOUNT_BASE_URL";
 export declare const ACCOUNT_ISSUER_ENV: "CREWX_ACCOUNT_ISSUER";
 export declare const MARKETPLACE_URL_ENV: "CREWX_MARKETPLACE_URL";
+export declare const ACCOUNT_TARGET_ENV: "CREWX_TARGET";
+export declare const MARKETPLACE_DISABLED_ENV: "CREWX_MARKETPLACE_DISABLED";
+export declare const PRODUCTION_TARGET: Readonly<{
+    readonly accountBaseUrl: "https://app.sowonai.com";
+    readonly marketplaceUrl: "https://market.sowonai.com";
+}>;
+export declare const LOCAL_TARGET: Readonly<{
+    readonly accountBaseUrl: "http://127.0.0.1:3030";
+    readonly marketplaceUrl: "http://127.0.0.1:4000";
+}>;
+export declare const DEFAULT_ACCEPTED_ISSUERS: readonly ["https://app.sowonai.com/auth/v1", "https://auth.sowonai.com/auth/v1"];
 export type Environment = Readonly<Record<string, string | undefined>>;
+export type AccountTargetProfile = 'production' | 'local' | 'custom';
+export type AccountTargetSource = 'env' | 'profile' | 'default' | 'disabled';
+export interface AccountTarget {
+    accountBaseUrl: string;
+    marketplaceUrl: string | null;
+    issuers: readonly string[];
+    profile: AccountTargetProfile;
+    sources: {
+        accountBaseUrl: Exclude<AccountTargetSource, 'disabled'>;
+        marketplaceUrl: AccountTargetSource;
+        issuer: Exclude<AccountTargetSource, 'disabled'>;
+    };
+    mixed: boolean;
+    marketplaceDisabled: boolean;
+}
 export declare function resolveAccountBaseUrl(env?: Environment): string;
 export declare function resolveMarketplaceUrl(env?: Environment): string;
+export declare function resolveAcceptedAccountIssuers(env?: Environment): readonly string[];
 export declare function resolveAccountIssuer(env?: Environment): string;
+export declare function resolveAccountTarget(env?: Environment): AccountTarget;
+export declare function assertAccountTargetNotMixed(env?: Environment): void;
 export declare function appendEndpoint(baseUrl: string, endpoint: string): string;

package/dist/account/env-bootstrap.d.ts

@@ -0,0 +1,5 @@
+export interface CrewxEnvFileOptions {
+    workspaceDir?: string;
+    homeDir?: string;
+}
+export declare function loadCrewxEnvFiles(options?: CrewxEnvFileOptions): void;

package/dist/account/errors.d.ts

@@ -20,5 +20,5 @@ export declare class AuthJsonValidationError extends Error {
     constructor(code: AuthJsonValidationCode, message?: string);
 }
 export declare class AccountConfigurationError extends AccountAuthError {
-    constructor(code: 'ACCOUNT_BASE_URL_MISSING' | 'ACCOUNT_BASE_URL_INVALID' | 'ACCOUNT_ISSUER_MISSING' | 'ACCOUNT_ISSUER_INVALID' | 'MARKETPLACE_URL_MISSING' | 'MARKETPLACE_URL_INVALID');
+    constructor(code: 'ACCOUNT_BASE_URL_MISSING' | 'ACCOUNT_BASE_URL_INVALID' | 'ACCOUNT_ISSUER_MISSING' | 'ACCOUNT_ISSUER_INVALID' | 'MARKETPLACE_URL_MISSING' | 'MARKETPLACE_URL_INVALID' | 'ACCOUNT_TARGET_INVALID' | 'ACCOUNT_TARGET_MIXED' | 'MARKETPLACE_DISABLED');
 }

package/dist/account/index.d.ts

@@ -1,5 +1,7 @@
-export { ACCOUNT_BASE_URL_ENV, ACCOUNT_ISSUER_ENV, MARKETPLACE_URL_ENV, appendEndpoint, resolveAccountBaseUrl, resolveAccountIssuer, resolveMarketplaceUrl, } from './config';
-export type { Environment } from './config';
+export { ACCOUNT_BASE_URL_ENV, ACCOUNT_ISSUER_ENV, ACCOUNT_TARGET_ENV, DEFAULT_ACCEPTED_ISSUERS, LOCAL_TARGET, MARKETPLACE_DISABLED_ENV, MARKETPLACE_URL_ENV, PRODUCTION_TARGET, appendEndpoint, assertAccountTargetNotMixed, resolveAccountBaseUrl, resolveAccountTarget, resolveAcceptedAccountIssuers, resolveAccountIssuer, resolveMarketplaceUrl, } from './config';
+export type { AccountTarget, AccountTargetProfile, AccountTargetSource, Environment, } from './config';
+export { loadCrewxEnvFiles } from './env-bootstrap';
+export type { CrewxEnvFileOptions } from './env-bootstrap';
 export { AccountAuthError, AuthClientError, AuthError, AccountConfigurationError, AuthJsonValidationError, LoginRequiredError, SessionManagerError, } from './errors';
 export type { AccountAuthErrorKind, AuthJsonValidationCode } from './errors';
 export { AUTH_JSON_FILENAME, AUTH_JSON_VERSION, AuthJsonStore, authJsonPath, clearAuthJson, isAuthJsonV2, parseAuthJson, readAuthJson, validateAuthJson, writeAuthJson, } from './auth-json';

package/dist/account/index.js

@@ -1 +1,2 @@
-'use strict';var crypto=require('crypto'),V=require('fs'),y=require('path'),R=require('os');function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var V__namespace=/*#__PURE__*/_interopNamespace(V);var y__namespace=/*#__PURE__*/_interopNamespace(y);var R__namespace=/*#__PURE__*/_interopNamespace(R);var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var p=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},d=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},u=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},c=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":"CREWX_MARKETPLACE_URL";super(e,"configuration",void 0,`${n} is missing or invalid \u2014 configure it and try again`),this.name="AccountConfigurationError";}};var x="CREWX_ACCOUNT_BASE_URL",b="CREWX_ACCOUNT_ISSUER",L="CREWX_MARKETPLACE_URL";function P(t,e,n,r=false){let o=t?.trim();if(!o)throw new c(e);try{let i=new URL(o);if(i.protocol!=="http:"&&i.protocol!=="https:"||i.username.length>0||i.password.length>0||i.hostname.length===0||i.search.length>0||i.hash.length>0||r&&i.pathname!=="/")throw new Error("invalid URL")}catch{throw new c(n)}return o.replace(/\/+$/,"")}function T(t=process.env){return P(t[x],"ACCOUNT_BASE_URL_MISSING","ACCOUNT_BASE_URL_INVALID",true)}function F(t=process.env){return P(t[L],"MARKETPLACE_URL_MISSING","MARKETPLACE_URL_INVALID")}function k(t=process.env){let e=t[b]?.trim();if(!e)throw new c("ACCOUNT_ISSUER_MISSING");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new c("ACCOUNT_ISSUER_INVALID")}return e}function C(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function D(){if(process.env.CREWX_HOME)try{return V__namespace.realpathSync(process.env.CREWX_HOME)}catch{return y__namespace.join(R__namespace.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?y__namespace.join(process.env.XDG_CONFIG_HOME,"crewx"):y__namespace.join(R__namespace.homedir(),".crewx")}var G="auth.json",N=2,H=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new u("AUTH_JSON_INVALID",t)}function re(){throw new u("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function oe(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function se(t){try{return A(t),!0}catch{return  false}}function A(t){if(!oe(t))return h();if(t.version===1)return re();if(t.version!==N)return h();let e=Object.keys(t);if(e.length!==H.length||e.some(r=>!H.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:N,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function B(t){let e;try{e=JSON.parse(t);}catch{return h()}return A(e)}function K(t){return t??y.join(D(),G)}var f=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return K(this.configuredPath)}read(){let e=this.path();if(!V.existsSync(e))return null;try{return B(V.readFileSync(e,"utf8"))}catch(n){throw n instanceof u?n:new u("AUTH_JSON_INVALID")}}write(e){let n=A(e),r=this.path(),o=y.dirname(r);V.mkdirSync(o,{recursive:true,mode:448});let i=`${r}.tmp.${process.pid}.${crypto.randomUUID()}`;try{V.writeFileSync(i,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),V.chmodSync(i,384),V.renameSync(i,r),V.chmodSync(r,384);}catch{try{V.existsSync(i)&&V.unlinkSync(i);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{V.existsSync(e)&&V.unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ie(t){let e=new f({filePath:t}).read();if(!e)throw new p;return e}function ce(t,e){new f({filePath:e}).write(t);}function ae(t){new f({filePath:t}).clear();}var j="/auth/v1/oauth/device/code",W="/auth/v1/oauth/token",X="/auth/v1/oauth/revoke",w="crewx-cli",g="urn:ietf:params:oauth:grant-type:device_code";function a(t){return typeof t=="string"&&t.trim().length>0}function m(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function ue(t){let e=m(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=m(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function he(t){let e=m(t);if(!e||!a(e.device_code)||!a(e.user_code)||!a(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!a(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function pe(t){let e=m(t),n=m(e?.account),r=e?.expires_in;if(!e||!a(e.access_token)||!a(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!a(n.sub)||!a(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var S=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:de(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:T()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let i=C(this.baseUrl(),e),U=this.fetchImpl??globalThis.fetch;if(typeof U!="function")throw new s("AUTH_NETWORK_ERROR","network");let l;try{l=await U(i,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!l.ok)throw q(l.status,null,r);return}let E=null;try{E=await l.json();}catch{E=null;}if(!l.ok)throw q(l.status,E,r);return E}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",w);let n=await this.request(j,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return he(n)}async requestToken(e){fe(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",w),e.grant_type===g?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(W,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return pe(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:g,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!a(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",w),await this.request(X,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function de(t){if(typeof t!="string"||!t.trim())throw new c("ACCOUNT_BASE_URL_MISSING");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new c("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function fe(t){if(!t||t.grant_type!==g&&t.grant_type!=="refresh_token"||t.grant_type===g&&!a(t.device_code)||t.grant_type==="refresh_token"&&!a(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function q(t,e,n){let r=ue(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===g){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var O=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=le(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new S,this.store=o.store??o.storage??n??new f,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=A(e);return $(n.access_token,n.sub),n}catch(e){throw e instanceof u?new p:e}}requireSession(){let e=this.readSession();if(!e)throw new p;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw Ae(n)?(this.store.clear(),new p):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new d("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new d("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");$(e.access_token,r.sub);let o=A({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function Ae(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function le(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function $(t,e){let n=k(),r=_e(t);if(r.iss!==n)throw new d("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new d("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function _e(t){if(typeof t!="string")throw v();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw v();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw v()}}function v(){return new d("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}exports.ACCOUNT_BASE_URL_ENV=x;exports.ACCOUNT_ISSUER_ENV=b;exports.AUTH_JSON_FILENAME=G;exports.AUTH_JSON_VERSION=N;exports.AccountAuthError=s;exports.AccountConfigurationError=c;exports.AuthClient=S;exports.AuthClientError=s;exports.AuthError=s;exports.AuthJsonStore=f;exports.AuthJsonValidationError=u;exports.DEVICE_CODE_GRANT_TYPE=g;exports.DEVICE_CODE_PATH=j;exports.LoginRequiredError=p;exports.MARKETPLACE_URL_ENV=L;exports.OAUTH_CLIENT_ID=w;exports.REVOKE_PATH=X;exports.SessionManager=O;exports.SessionManagerError=d;exports.TOKEN_PATH=W;exports.appendEndpoint=C;exports.authJsonPath=K;exports.clearAuthJson=ae;exports.isAuthJsonV2=se;exports.parseAuthJson=B;exports.readAuthJson=ie;exports.resolveAccountBaseUrl=T;exports.resolveAccountIssuer=k;exports.resolveMarketplaceUrl=F;exports.validateAuthJson=A;exports.writeAuthJson=ce;
+'use strict';var dotenv=require('dotenv'),I=require('path'),M=require('os'),z=require('fs'),crypto=require('crypto');function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var I__namespace=/*#__PURE__*/_interopNamespace(I);var M__namespace=/*#__PURE__*/_interopNamespace(M);var z__namespace=/*#__PURE__*/_interopNamespace(z);var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var v="CREWX_ACCOUNT_BASE_URL",S="CREWX_ACCOUNT_ISSUER",N="CREWX_MARKETPLACE_URL",x="CREWX_TARGET",W="CREWX_MARKETPLACE_DISABLED",y=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),R=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),L=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function D(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function X(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function P(t){let e=t[x];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function F(t){let e=t[W]?.trim().toLowerCase();return e==="1"||e==="true"}function b(t){return t==="local"?R:y}function V(t=process.env){let e=P(t),n=t[v];return n!==void 0?D(n,"ACCOUNT_BASE_URL_INVALID",true):b(e).accountBaseUrl}function pe(t=process.env){let e=P(t);if(F(t))throw new i("MARKETPLACE_DISABLED");let n=t[N];return n!==void 0?D(n,"MARKETPLACE_URL_INVALID"):b(e).marketplaceUrl}function k(t=process.env){let e=t[S];return e===void 0?L:[X(e)]}function he(t=process.env){return k(t)[0]}function q(t,e,n,r=false){if(t===void 0)return e;try{return D(t,n,r)}catch{return t.trim()}}function le(t){let e=t[S];if(e===void 0)return L;try{return [X(e)]}catch{return [e.trim()]}}function j(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function fe(t,e){return e!==null&&t===y.accountBaseUrl&&e===y.marketplaceUrl?"production":e!==null&&t===R.accountBaseUrl&&e===R.marketplaceUrl?"local":"custom"}function $(t=process.env){let e,n=true;try{e=P(t);}catch{e="production",n=false;}let r=b(e),o=t[x]!==void 0&&n,a=t[v],m=t[N],u=F(t),d=q(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),w=u?null:q(m,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:w,issuers:le(t),profile:fe(d,w),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":m===void 0?o?"profile":"default":"env",issuer:t[S]===void 0?"default":"env"},mixed:w!==null&&j(d)!==j(w),marketplaceDisabled:u}}function de(t=process.env){if($(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function J(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function U(){if(process.env.CREWX_HOME)try{return z__namespace.realpathSync(process.env.CREWX_HOME)}catch{return I__namespace.join(M__namespace.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?I__namespace.join(process.env.XDG_CONFIG_HOME,"crewx"):I__namespace.join(M__namespace.homedir(),".crewx")}function Ae(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();dotenv.config({path:I.join(e,".env"),override:false,quiet:true});let n=t.homeDir??U();dotenv.config({path:I.join(n,".env"),override:false,quiet:true});}var ne="auth.json",H=2,te=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function ye(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Re(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function Se(t){try{return g(t),!0}catch{return  false}}function g(t){if(!Re(t))return h();if(t.version===1)return ye();if(t.version!==H)return h();let e=Object.keys(t);if(e.length!==te.length||e.some(r=>!te.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:H,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function re(t){let e;try{e=JSON.parse(t);}catch{return h()}return g(e)}function oe(t){return t??I.join(U(),ne)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return oe(this.configuredPath)}read(){let e=this.path();if(!z.existsSync(e))return null;try{return re(z.readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=g(e),r=this.path(),o=I.dirname(r);z.mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${crypto.randomUUID()}`;try{z.writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),z.chmodSync(a,384),z.renameSync(a,r),z.chmodSync(r,384);}catch{try{z.existsSync(a)&&z.unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{z.existsSync(e)&&z.unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ke(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ie(t,e){new A({filePath:e}).write(t);}function Ue(t){new A({filePath:t}).clear();}var ie="/auth/v1/oauth/device/code",ce="/auth/v1/oauth/token",ae="/auth/v1/oauth/revoke",O="crewx-cli",E="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function T(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function Oe(t){let e=T(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=T(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function ve(t){let e=T(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function Ne(t){let e=T(t),n=T(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var C=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:xe(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:V()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=J(this.baseUrl(),e),m=this.fetchImpl??globalThis.fetch;if(typeof m!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await m(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw se(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw se(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",O);let n=await this.request(ie,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return ve(n)}async requestToken(e){Le(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",O),e.grant_type===E?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return Ne(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:E,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",O),await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function xe(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function Le(t){if(!t||t.grant_type!==E&&t.grant_type!=="refresh_token"||t.grant_type===E&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function se(t,e,n){let r=Oe(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===E){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var K=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=Pe(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new C,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=g(e);return ue(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw De(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");ue(e.access_token,r.sub);let o=g({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function De(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function Pe(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function ue(t,e){let n=k(),r=be(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function be(t){if(typeof t!="string")throw G();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw G();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw G()}}function G(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
+exports.ACCOUNT_BASE_URL_ENV=v;exports.ACCOUNT_ISSUER_ENV=S;exports.ACCOUNT_TARGET_ENV=x;exports.AUTH_JSON_FILENAME=ne;exports.AUTH_JSON_VERSION=H;exports.AccountAuthError=s;exports.AccountConfigurationError=i;exports.AuthClient=C;exports.AuthClientError=s;exports.AuthError=s;exports.AuthJsonStore=A;exports.AuthJsonValidationError=p;exports.DEFAULT_ACCEPTED_ISSUERS=L;exports.DEVICE_CODE_GRANT_TYPE=E;exports.DEVICE_CODE_PATH=ie;exports.LOCAL_TARGET=R;exports.LoginRequiredError=l;exports.MARKETPLACE_DISABLED_ENV=W;exports.MARKETPLACE_URL_ENV=N;exports.OAUTH_CLIENT_ID=O;exports.PRODUCTION_TARGET=y;exports.REVOKE_PATH=ae;exports.SessionManager=K;exports.SessionManagerError=f;exports.TOKEN_PATH=ce;exports.appendEndpoint=J;exports.assertAccountTargetNotMixed=de;exports.authJsonPath=oe;exports.clearAuthJson=Ue;exports.isAuthJsonV2=Se;exports.loadCrewxEnvFiles=Ae;exports.parseAuthJson=re;exports.readAuthJson=ke;exports.resolveAcceptedAccountIssuers=k;exports.resolveAccountBaseUrl=V;exports.resolveAccountIssuer=he;exports.resolveAccountTarget=$;exports.resolveMarketplaceUrl=pe;exports.validateAuthJson=g;exports.writeAuthJson=Ie;

package/dist/conversation/types.d.ts

@@ -30,6 +30,7 @@ export interface SemanticContinuityContext {
         taskIds: string[];
     };
     rendered?: string;
+    omittedRendered: string;
 }
 export type ConversationSemanticContinuityContext = SemanticContinuityContext;
 export interface ConversationThreadStateValue {

package/dist/esm/account/index.js

@@ -1 +1,2 @@
-import {randomUUID}from'crypto';import*as D from'fs';import {existsSync,readFileSync,mkdirSync,writeFileSync,chmodSync,renameSync,unlinkSync}from'fs';import*as w from'path';import {join,dirname}from'path';import*as I from'os';var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var p=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},d=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},u=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},c=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":"CREWX_MARKETPLACE_URL";super(e,"configuration",void 0,`${n} is missing or invalid \u2014 configure it and try again`),this.name="AccountConfigurationError";}};var b="CREWX_ACCOUNT_BASE_URL",L="CREWX_ACCOUNT_ISSUER",P="CREWX_MARKETPLACE_URL";function V(t,e,n,r=false){let o=t?.trim();if(!o)throw new c(e);try{let i=new URL(o);if(i.protocol!=="http:"&&i.protocol!=="https:"||i.username.length>0||i.password.length>0||i.hostname.length===0||i.search.length>0||i.hash.length>0||r&&i.pathname!=="/")throw new Error("invalid URL")}catch{throw new c(n)}return o.replace(/\/+$/,"")}function k(t=process.env){return V(t[b],"ACCOUNT_BASE_URL_MISSING","ACCOUNT_BASE_URL_INVALID",true)}function Y(t=process.env){return V(t[P],"MARKETPLACE_URL_MISSING","MARKETPLACE_URL_INVALID")}function C(t=process.env){let e=t[L]?.trim();if(!e)throw new c("ACCOUNT_ISSUER_MISSING");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new c("ACCOUNT_ISSUER_INVALID")}return e}function R(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function J(){if(process.env.CREWX_HOME)try{return D.realpathSync(process.env.CREWX_HOME)}catch{return w.join(I.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?w.join(process.env.XDG_CONFIG_HOME,"crewx"):w.join(I.homedir(),".crewx")}var B="auth.json",v=2,G=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new u("AUTH_JSON_INVALID",t)}function oe(){throw new u("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function se(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function ie(t){try{return A(t),!0}catch{return  false}}function A(t){if(!se(t))return h();if(t.version===1)return oe();if(t.version!==v)return h();let e=Object.keys(t);if(e.length!==G.length||e.some(r=>!G.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:v,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function K(t){let e;try{e=JSON.parse(t);}catch{return h()}return A(e)}function q(t){return t??join(J(),B)}var f=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return q(this.configuredPath)}read(){let e=this.path();if(!existsSync(e))return null;try{return K(readFileSync(e,"utf8"))}catch(n){throw n instanceof u?n:new u("AUTH_JSON_INVALID")}}write(e){let n=A(e),r=this.path(),o=dirname(r);mkdirSync(o,{recursive:true,mode:448});let i=`${r}.tmp.${process.pid}.${randomUUID()}`;try{writeFileSync(i,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),chmodSync(i,384),renameSync(i,r),chmodSync(r,384);}catch{try{existsSync(i)&&unlinkSync(i);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{existsSync(e)&&unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ce(t){let e=new f({filePath:t}).read();if(!e)throw new p;return e}function ae(t,e){new f({filePath:e}).write(t);}function ue(t){new f({filePath:t}).clear();}var W="/auth/v1/oauth/device/code",X="/auth/v1/oauth/token",$="/auth/v1/oauth/revoke",T="crewx-cli",m="urn:ietf:params:oauth:grant-type:device_code";function a(t){return typeof t=="string"&&t.trim().length>0}function S(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function he(t){let e=S(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=S(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function pe(t){let e=S(t);if(!e||!a(e.device_code)||!a(e.user_code)||!a(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!a(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function de(t){let e=S(t),n=S(e?.account),r=e?.expires_in;if(!e||!a(e.access_token)||!a(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!a(n.sub)||!a(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var E=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:fe(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:k()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let i=R(this.baseUrl(),e),x=this.fetchImpl??globalThis.fetch;if(typeof x!="function")throw new s("AUTH_NETWORK_ERROR","network");let l;try{l=await x(i,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!l.ok)throw j(l.status,null,r);return}let y=null;try{y=await l.json();}catch{y=null;}if(!l.ok)throw j(l.status,y,r);return y}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",T);let n=await this.request(W,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return pe(n)}async requestToken(e){Ae(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",T),e.grant_type===m?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(X,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return de(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:m,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!a(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",T),await this.request($,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function fe(t){if(typeof t!="string"||!t.trim())throw new c("ACCOUNT_BASE_URL_MISSING");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new c("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function Ae(t){if(!t||t.grant_type!==m&&t.grant_type!=="refresh_token"||t.grant_type===m&&!a(t.device_code)||t.grant_type==="refresh_token"&&!a(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function j(t,e,n){let r=he(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===m){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var U=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=_e(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new E,this.store=o.store??o.storage??n??new f,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=A(e);return F(n.access_token,n.sub),n}catch(e){throw e instanceof u?new p:e}}requireSession(){let e=this.readSession();if(!e)throw new p;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw le(n)?(this.store.clear(),new p):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new d("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new d("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");F(e.access_token,r.sub);let o=A({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function le(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function _e(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function F(t,e){let n=C(),r=ge(t);if(r.iss!==n)throw new d("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new d("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function ge(t){if(typeof t!="string")throw O();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw O();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw O()}}function O(){return new d("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}export{b as ACCOUNT_BASE_URL_ENV,L as ACCOUNT_ISSUER_ENV,B as AUTH_JSON_FILENAME,v as AUTH_JSON_VERSION,s as AccountAuthError,c as AccountConfigurationError,E as AuthClient,s as AuthClientError,s as AuthError,f as AuthJsonStore,u as AuthJsonValidationError,m as DEVICE_CODE_GRANT_TYPE,W as DEVICE_CODE_PATH,p as LoginRequiredError,P as MARKETPLACE_URL_ENV,T as OAUTH_CLIENT_ID,$ as REVOKE_PATH,U as SessionManager,d as SessionManagerError,X as TOKEN_PATH,R as appendEndpoint,q as authJsonPath,ue as clearAuthJson,ie as isAuthJsonV2,K as parseAuthJson,ce as readAuthJson,k as resolveAccountBaseUrl,C as resolveAccountIssuer,Y as resolveMarketplaceUrl,A as validateAuthJson,ae as writeAuthJson};
+import {config}from'dotenv';import*as U from'path';import {join,dirname}from'path';import*as B from'os';import*as Y from'fs';import {existsSync,readFileSync,mkdirSync,writeFileSync,chmodSync,renameSync,unlinkSync}from'fs';import {randomUUID}from'crypto';var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var l=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},f=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},p=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},i=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":e==="ACCOUNT_TARGET_INVALID"?"CREWX_TARGET":e==="ACCOUNT_TARGET_MIXED"?"CREWX_ACCOUNT_BASE_URL/CREWX_MARKETPLACE_URL":e==="MARKETPLACE_DISABLED"?"CREWX_MARKETPLACE_DISABLED":"CREWX_MARKETPLACE_URL",r=e==="ACCOUNT_TARGET_MIXED"?`${n} must not mix loopback and public hosts \u2014 choose one account target`:e==="MARKETPLACE_DISABLED"?`${n} disables Marketplace access`:`${n} is missing or invalid \u2014 configure it and try again`;super(e,"configuration",void 0,r),this.name="AccountConfigurationError";}};var N="CREWX_ACCOUNT_BASE_URL",k="CREWX_ACCOUNT_ISSUER",x="CREWX_MARKETPLACE_URL",L="CREWX_TARGET",X="CREWX_MARKETPLACE_DISABLED",R=Object.freeze({accountBaseUrl:"https://app.sowonai.com",marketplaceUrl:"https://market.sowonai.com"}),S=Object.freeze({accountBaseUrl:"http://127.0.0.1:3030",marketplaceUrl:"http://127.0.0.1:4000"}),D=Object.freeze(["https://app.sowonai.com/auth/v1","https://auth.sowonai.com/auth/v1"]);function P(t,e,n=false){let r=t?.trim();if(!r)throw new i(e);try{let o=new URL(r);if(o.protocol!=="http:"&&o.protocol!=="https:"||o.username.length>0||o.password.length>0||o.hostname.length===0||o.search.length>0||o.hash.length>0||n&&o.pathname!=="/")throw new Error("invalid URL")}catch{throw new i(e)}return r.replace(/\/+$/,"")}function F(t){let e=t?.trim();if(!e)throw new i("ACCOUNT_ISSUER_INVALID");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new i("ACCOUNT_ISSUER_INVALID")}return e}function b(t){let e=t[L];if(e===void 0)return "production";let n=e.trim();if(n==="local"||n==="production")return n;throw new i("ACCOUNT_TARGET_INVALID")}function $(t){let e=t[X]?.trim().toLowerCase();return e==="1"||e==="true"}function V(t){return t==="local"?S:R}function J(t=process.env){let e=b(t),n=t[N];return n!==void 0?P(n,"ACCOUNT_BASE_URL_INVALID",true):V(e).accountBaseUrl}function he(t=process.env){let e=b(t);if($(t))throw new i("MARKETPLACE_DISABLED");let n=t[x];return n!==void 0?P(n,"MARKETPLACE_URL_INVALID"):V(e).marketplaceUrl}function I(t=process.env){let e=t[k];return e===void 0?D:[F(e)]}function le(t=process.env){return I(t)[0]}function j(t,e,n,r=false){if(t===void 0)return e;try{return P(t,n,r)}catch{return t.trim()}}function fe(t){let e=t[k];if(e===void 0)return D;try{return [F(e)]}catch{return [e.trim()]}}function W(t){if(t===null)return  false;try{let e=new URL(t).hostname.toLowerCase();return e==="127.0.0.1"||e==="localhost"||e==="[::1]"||e==="::1"}catch{return  false}}function de(t,e){return e!==null&&t===R.accountBaseUrl&&e===R.marketplaceUrl?"production":e!==null&&t===S.accountBaseUrl&&e===S.marketplaceUrl?"local":"custom"}function z(t=process.env){let e,n=true;try{e=b(t);}catch{e="production",n=false;}let r=V(e),o=t[L]!==void 0&&n,a=t[N],T=t[x],u=$(t),d=j(a,r.accountBaseUrl,"ACCOUNT_BASE_URL_INVALID",true),y=u?null:j(T,r.marketplaceUrl,"MARKETPLACE_URL_INVALID");return {accountBaseUrl:d,marketplaceUrl:y,issuers:fe(t),profile:de(d,y),sources:{accountBaseUrl:a===void 0?o?"profile":"default":"env",marketplaceUrl:u?"disabled":T===void 0?o?"profile":"default":"env",issuer:t[k]===void 0?"default":"env"},mixed:y!==null&&W(d)!==W(y),marketplaceDisabled:u}}function Ae(t=process.env){if(z(t).mixed)throw new i("ACCOUNT_TARGET_MIXED")}function M(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function O(){if(process.env.CREWX_HOME)try{return Y.realpathSync(process.env.CREWX_HOME)}catch{return U.join(B.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?U.join(process.env.XDG_CONFIG_HOME,"crewx"):U.join(B.homedir(),".crewx")}function _e(t={}){let e=t.workspaceDir??process.env.CREWX_WORKSPACE??process.cwd();config({path:join(e,".env"),override:false,quiet:true});let n=t.homeDir??O();config({path:join(n,".env"),override:false,quiet:true});}var re="auth.json",G=2,ne=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new p("AUTH_JSON_INVALID",t)}function Re(){throw new p("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function Se(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function ke(t){try{return E(t),!0}catch{return  false}}function E(t){if(!Se(t))return h();if(t.version===1)return Re();if(t.version!==G)return h();let e=Object.keys(t);if(e.length!==ne.length||e.some(r=>!ne.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:G,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function oe(t){let e;try{e=JSON.parse(t);}catch{return h()}return E(e)}function se(t){return t??join(O(),re)}var A=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return se(this.configuredPath)}read(){let e=this.path();if(!existsSync(e))return null;try{return oe(readFileSync(e,"utf8"))}catch(n){throw n instanceof p?n:new p("AUTH_JSON_INVALID")}}write(e){let n=E(e),r=this.path(),o=dirname(r);mkdirSync(o,{recursive:true,mode:448});let a=`${r}.tmp.${process.pid}.${randomUUID()}`;try{writeFileSync(a,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),chmodSync(a,384),renameSync(a,r),chmodSync(r,384);}catch{try{existsSync(a)&&unlinkSync(a);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{existsSync(e)&&unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function Ie(t){let e=new A({filePath:t}).read();if(!e)throw new l;return e}function Ue(t,e){new A({filePath:e}).write(t);}function Oe(t){new A({filePath:t}).clear();}var ce="/auth/v1/oauth/device/code",ae="/auth/v1/oauth/token",ue="/auth/v1/oauth/revoke",v="crewx-cli",m="urn:ietf:params:oauth:grant-type:device_code";function c(t){return typeof t=="string"&&t.trim().length>0}function C(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function ve(t){let e=C(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=C(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function Ne(t){let e=C(t);if(!e||!c(e.device_code)||!c(e.user_code)||!c(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!c(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function xe(t){let e=C(t),n=C(e?.account),r=e?.expires_in;if(!e||!c(e.access_token)||!c(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!c(n.sub)||!c(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var w=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:Le(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:J()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let a=M(this.baseUrl(),e),T=this.fetchImpl??globalThis.fetch;if(typeof T!="function")throw new s("AUTH_NETWORK_ERROR","network");let u;try{u=await T(a,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!u.ok)throw ie(u.status,null,r);return}let d=null;try{d=await u.json();}catch{d=null;}if(!u.ok)throw ie(u.status,d,r);return d}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",v);let n=await this.request(ce,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return Ne(n)}async requestToken(e){De(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",v),e.grant_type===m?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(ae,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return xe(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:m,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!c(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",v),await this.request(ue,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function Le(t){if(typeof t!="string"||!t.trim())throw new i("ACCOUNT_BASE_URL_INVALID");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new i("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function De(t){if(!t||t.grant_type!==m&&t.grant_type!=="refresh_token"||t.grant_type===m&&!c(t.device_code)||t.grant_type==="refresh_token"&&!c(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function ie(t,e,n){let r=ve(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===m){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var q=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=be(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new w,this.store=o.store??o.storage??n??new A,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=E(e);return pe(n.access_token,n.sub),n}catch(e){throw e instanceof p?new l:e}}requireSession(){let e=this.readSession();if(!e)throw new l;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw Pe(n)?(this.store.clear(),new l):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new f("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new f("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");pe(e.access_token,r.sub);let o=E({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function Pe(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function be(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function pe(t,e){let n=I(),r=Ve(t);if(!n.includes(r.iss))throw new f("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new f("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function Ve(t){if(typeof t!="string")throw K();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw K();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw K()}}function K(){return new f("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}
+export{N as ACCOUNT_BASE_URL_ENV,k as ACCOUNT_ISSUER_ENV,L as ACCOUNT_TARGET_ENV,re as AUTH_JSON_FILENAME,G as AUTH_JSON_VERSION,s as AccountAuthError,i as AccountConfigurationError,w as AuthClient,s as AuthClientError,s as AuthError,A as AuthJsonStore,p as AuthJsonValidationError,D as DEFAULT_ACCEPTED_ISSUERS,m as DEVICE_CODE_GRANT_TYPE,ce as DEVICE_CODE_PATH,S as LOCAL_TARGET,l as LoginRequiredError,X as MARKETPLACE_DISABLED_ENV,x as MARKETPLACE_URL_ENV,v as OAUTH_CLIENT_ID,R as PRODUCTION_TARGET,ue as REVOKE_PATH,q as SessionManager,f as SessionManagerError,ae as TOKEN_PATH,M as appendEndpoint,Ae as assertAccountTargetNotMixed,se as authJsonPath,Oe as clearAuthJson,ke as isAuthJsonV2,_e as loadCrewxEnvFiles,oe as parseAuthJson,Ie as readAuthJson,I as resolveAcceptedAccountIssuers,J as resolveAccountBaseUrl,le as resolveAccountIssuer,z as resolveAccountTarget,he as resolveMarketplaceUrl,E as validateAuthJson,Ue as writeAuthJson};