@fml-inc/fml 0.7.0 → 0.8.0-rc.2

package/dist/chunk-A6HAEVJX.js

@@ -0,0 +1,1606 @@
+// src/auth/token-store.ts
+import { createHash, randomUUID } from "crypto";
+import { execFileSync } from "child_process";
+import fs3 from "fs";
+import path3 from "path";
+
+// src/config.ts
+import fs2 from "fs";
+import path2 from "path";
+
+// src/dirs.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+function isPresent(value) {
+  return value !== void 0 && value.trim().length > 0;
+}
+function normalizeAbsolutePath(value, variableName, pathApi) {
+  if (!pathApi.isAbsolute(value)) {
+    throw new Error(`${variableName} must be an absolute path: ${value}`);
+  }
+  return pathApi.normalize(value);
+}
+function explicitDirectory(value, variableName, pathApi) {
+  if (!isPresent(value)) return void 0;
+  return normalizeAbsolutePath(value, variableName, pathApi);
+}
+function platformBaseDirectory(value, pathApi) {
+  if (!isPresent(value) || !pathApi.isAbsolute(value)) return void 0;
+  return pathApi.normalize(value);
+}
+function resolveFmlDirectories(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const pathApi = platform === "win32" ? path.win32 : path.posix;
+  const homeDir = normalizeAbsolutePath(
+    options.homeDir ?? os.homedir(),
+    "home directory",
+    pathApi
+  );
+  const explicitDataDir = explicitDirectory(
+    env.FML_DATA_DIR,
+    "FML_DATA_DIR",
+    pathApi
+  );
+  const explicitStateDir = explicitDirectory(
+    env.FML_STATE_DIR,
+    "FML_STATE_DIR",
+    pathApi
+  );
+  const explicitLogDir = explicitDirectory(
+    env.FML_LOG_DIR,
+    "FML_LOG_DIR",
+    pathApi
+  );
+  let defaultDataDir;
+  let defaultStateDir;
+  let nativeLogDir;
+  switch (platform) {
+    case "darwin": {
+      defaultDataDir = pathApi.join(
+        homeDir,
+        "Library",
+        "Application Support",
+        "fml"
+      );
+      defaultStateDir = defaultDataDir;
+      nativeLogDir = pathApi.join(homeDir, "Library", "Logs", "fml");
+      break;
+    }
+    case "win32": {
+      const roamingAppData = platformBaseDirectory(env.APPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Roaming");
+      const localAppData = platformBaseDirectory(env.LOCALAPPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Local");
+      defaultDataDir = pathApi.join(roamingAppData, "fml");
+      defaultStateDir = pathApi.join(localAppData, "fml");
+      break;
+    }
+    default: {
+      const xdgDataHome = platformBaseDirectory(env.XDG_DATA_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "share");
+      const xdgStateHome = platformBaseDirectory(env.XDG_STATE_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "state");
+      defaultDataDir = pathApi.join(xdgDataHome, "fml");
+      defaultStateDir = pathApi.join(xdgStateHome, "fml");
+      break;
+    }
+  }
+  const dataDir = explicitDataDir ?? defaultDataDir;
+  const stateDir = explicitStateDir ?? explicitDataDir ?? defaultStateDir;
+  const defaultLogDir = nativeLogDir ?? (platform === "win32" ? pathApi.join(defaultDataDir, "logs") : pathApi.join(defaultStateDir, "log"));
+  const explicitObserverDir = explicitDirectory(
+    env.FML_OBSERVER_DIR,
+    "FML_OBSERVER_DIR",
+    pathApi
+  );
+  const legacyPanopticonHome = explicitDirectory(
+    env.PANOPTICON_HOME,
+    "PANOPTICON_HOME",
+    pathApi
+  );
+  const fmlHome = explicitDirectory(env.FML_HOME, "FML_HOME", pathApi);
+  return {
+    dataDir,
+    stateDir,
+    logDir: explicitLogDir ?? defaultLogDir,
+    observerDir: explicitObserverDir ?? legacyPanopticonHome ?? (fmlHome ? pathApi.join(fmlHome, "panopticon") : pathApi.join(homeDir, ".fml", "panopticon"))
+  };
+}
+function resolveFmlDefaultDirectories(options = {}) {
+  const env = options.env ?? process.env;
+  return resolveFmlDirectories({
+    ...options,
+    env: {
+      APPDATA: env.APPDATA,
+      LOCALAPPDATA: env.LOCALAPPDATA,
+      XDG_DATA_HOME: env.XDG_DATA_HOME,
+      XDG_STATE_HOME: env.XDG_STATE_HOME
+    }
+  });
+}
+function observerPort() {
+  const configured = process.env.FML_OBSERVER_PORT ?? process.env.PANOPTICON_PORT;
+  if (configured) {
+    const parsed = Number.parseInt(configured, 10);
+    if (Number.isInteger(parsed) && parsed > 0 && parsed <= 65535) {
+      return parsed;
+    }
+  }
+  return 4318 + (process.getuid?.() ?? 0) % 100;
+}
+var DIRECTORIES = resolveFmlDirectories();
+var FML_DATA_DIR = DIRECTORIES.dataDir;
+var FML_STATE_DIR = DIRECTORIES.stateDir;
+var FML_LOG_DIR = DIRECTORIES.logDir;
+var FML_OBSERVER_DIR = DIRECTORIES.observerDir;
+var FML_OBSERVER_HOST = "127.0.0.1";
+var FML_OBSERVER_PORT = observerPort();
+var FML_OBSERVER_STATE_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "observer.pid.json"
+);
+var FML_OBSERVER_LOCK_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "observer.lock"
+);
+var FML_OBSERVER_AUTH_TOKEN_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "auth-token"
+);
+var FML_OBSERVER_ENDPOINT_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "endpoint.json"
+);
+var FML_OBSERVER_LOG_FILE = path.join(FML_LOG_DIR, "observer.log");
+var FML_INSTALLATION_ID_FILE = path.join(
+  FML_STATE_DIR,
+  "installation_id"
+);
+var FML_PANOPTICON_DB_FILE = path.join(FML_STATE_DIR, "panopticon.db");
+var FML_PANOPTICON_DB_OBSERVER_STATE_FILE = `${FML_PANOPTICON_DB_FILE}.observer.pid.json`;
+var FML_PANOPTICON_DB_OBSERVER_LOCK_FILE = `${FML_PANOPTICON_DB_FILE}.observer.lock`;
+var FML_LEGACY_OBSERVER_DB_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "observer.db"
+);
+var FML_HOOK_INBOX_DIR = path.join(FML_OBSERVER_DIR, "hook-inbox");
+var FML_HOOK_CONTEXT_STATE_DIR = path.join(
+  FML_OBSERVER_DIR,
+  "hook-context-state"
+);
+var FML_HOOK_CAPTURE_DISABLED_FILE = path.join(
+  FML_OBSERVER_DIR,
+  "hook-capture.disabled"
+);
+function observerOnlyOverrideWarning(env = process.env, databaseFile = FML_PANOPTICON_DB_FILE) {
+  if (isPresent(env.FML_STATE_DIR) || isPresent(env.FML_DATA_DIR)) {
+    return null;
+  }
+  const observerAlias = ["FML_OBSERVER_DIR", "PANOPTICON_HOME", "FML_HOME"].find((variableName) => isPresent(env[variableName]));
+  if (!observerAlias) return null;
+  return `${observerAlias} relocates only observer coordination state; the FML database stays at ${databaseFile}. Set FML_STATE_DIR (or FML_DATA_DIR, including its platform default) to choose the database root explicitly.`;
+}
+function ensureDirs() {
+  fs.mkdirSync(FML_DATA_DIR, { recursive: true, mode: 448 });
+  fs.mkdirSync(FML_STATE_DIR, { recursive: true, mode: 448 });
+  fs.mkdirSync(FML_LOG_DIR, { recursive: true, mode: 448 });
+  fs.mkdirSync(FML_OBSERVER_DIR, { recursive: true, mode: 448 });
+  fs.mkdirSync(FML_HOOK_INBOX_DIR, { recursive: true, mode: 448 });
+  fs.mkdirSync(FML_HOOK_CONTEXT_STATE_DIR, {
+    recursive: true,
+    mode: 448
+  });
+}
+
+// src/config.ts
+var DEFAULT_PROD_URL = "https://trustworthy-chihuahua-382.convex.cloud";
+var DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(
+  ".convex.cloud",
+  ".convex.site"
+);
+var DEFAULT_TARGET_NAME = "fml";
+var ENV_CONFIG_PATH = path2.join(FML_DATA_DIR, "env.json");
+var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
+function isValidEnvName(envName) {
+  return ENV_NAME_RE.test(envName);
+}
+function normalizeConvexUrl(value) {
+  const url = new URL(value);
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") {
+    throw new Error(
+      "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
+    );
+  }
+  return value.replace(/\/$/, "").replace(".convex.site", ".convex.cloud");
+}
+function readEnvConfig() {
+  try {
+    const parsed = JSON.parse(
+      fs2.readFileSync(ENV_CONFIG_PATH, "utf8")
+    );
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("invalid environment config");
+    }
+    const config = parsed;
+    if (typeof config.active !== "string" || !isValidEnvName(config.active)) {
+      throw new Error("invalid active environment");
+    }
+    const environments = {};
+    if (config.environments && typeof config.environments === "object" && !Array.isArray(config.environments)) {
+      for (const [name, environment] of Object.entries(
+        config.environments
+      )) {
+        if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
+          continue;
+        }
+        const convexUrl = environment.convexUrl;
+        if (typeof convexUrl !== "string") continue;
+        try {
+          environments[name] = { convexUrl: normalizeConvexUrl(convexUrl) };
+        } catch {
+        }
+      }
+    }
+    return {
+      schemaVersion: 1,
+      active: config.active,
+      environments
+    };
+  } catch {
+    return {
+      schemaVersion: 1,
+      active: DEFAULT_TARGET_NAME,
+      environments: {
+        [DEFAULT_TARGET_NAME]: { convexUrl: DEFAULT_PROD_URL }
+      }
+    };
+  }
+}
+function writeEnvConfig(config) {
+  const dir = path2.dirname(ENV_CONFIG_PATH);
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.writeFileSync(
+    ENV_CONFIG_PATH,
+    `${JSON.stringify({ ...config, schemaVersion: 1 }, null, 2)}
+`,
+    { mode: 384 }
+  );
+}
+function envConfigExists() {
+  return fs2.existsSync(ENV_CONFIG_PATH);
+}
+function resolveEnvConvexUrl(envName) {
+  const configured = readEnvConfig().environments?.[envName]?.convexUrl;
+  if (configured) return configured;
+  if (envName === DEFAULT_TARGET_NAME) return DEFAULT_PROD_URL;
+  return null;
+}
+function setActiveEnvironment(name, convexUrl) {
+  if (!isValidEnvName(name)) {
+    throw new Error(`Invalid FML environment name: ${name}`);
+  }
+  const current = readEnvConfig();
+  const next = {
+    schemaVersion: 1,
+    active: name,
+    environments: {
+      ...current.environments ?? {},
+      [name]: { convexUrl: normalizeConvexUrl(convexUrl) }
+    }
+  };
+  writeEnvConfig(next);
+  return next;
+}
+function getActiveEnv() {
+  const name = readEnvConfig().active;
+  const override = process.env.FML_CONVEX_URL;
+  return {
+    name,
+    convexUrl: override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name)
+  };
+}
+function authStorePathFor(envName) {
+  return path2.join(FML_DATA_DIR, `auth.${envName}.json`);
+}
+var CONVEX_URL = (process.env.FML_CONVEX_URL ?? getActiveEnv().convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
+var WORKOS_API_URL = "https://api.workos.com";
+var WORKOS_AUTH_URL = "https://auth.fml.inc";
+function getSiteUrl() {
+  return getSiteUrlForConvexUrl(getActiveEnv().convexUrl);
+}
+function getSiteUrlForConvexUrl(convexUrl) {
+  const explicit = process.env.CONVEX_SITE_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  return (convexUrl ?? DEFAULT_PROD_URL).replace(".convex.cloud", ".convex.site").replace(/\/$/, "");
+}
+
+// src/sentry.ts
+var initialized = false;
+var sentry = null;
+var client = null;
+async function loadSentry() {
+  if (sentry) return sentry;
+  try {
+    sentry = await import("./esm-4YKLKFRX.js");
+    return sentry;
+  } catch {
+    return null;
+  }
+}
+async function initSentry() {
+  if (initialized) return;
+  initialized = true;
+  const mod = await loadSentry();
+  if (!mod) return;
+  client = new mod.ServerRuntimeClient({
+    dsn: "https://4c243521c03917c886d0bf33bc0038c8@o4510167429873664.ingest.us.sentry.io/4511078213156864",
+    tracesSampleRate: 0,
+    integrations: [],
+    stackParser: mod.createStackParser(mod.nodeStackLineParser()),
+    transport: (options) => mod.createTransport(options, async (request) => {
+      const res = await fetch(options.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-sentry-envelope" },
+        body: request.body
+      });
+      return { statusCode: res.status };
+    })
+  });
+  mod.setCurrentClient(client);
+  client.init();
+}
+var Sentry = {
+  captureException: (err) => sentry?.captureException(err),
+  captureMessage: (msg) => sentry?.captureMessage(msg),
+  flush: async (timeoutMs) => {
+    try {
+      await client?.flush(timeoutMs);
+    } catch {
+    }
+  }
+};
+
+// src/auth/token-store.ts
+var TOKEN_REFRESH_WINDOW_MS = 6e4;
+var OAUTH_REFRESH_LOCK_POLL_MS = 50;
+var OAUTH_REFRESH_LOCK_STALE_MS = 45e3;
+var OAUTH_REFRESH_RECOVERY_STALE_MS = 45e3;
+var OAUTH_REFRESH_LOCK_WAIT_MS = 6e4;
+var OAUTH_REFRESH_REQUEST_TIMEOUT_MS = 3e4;
+var PROCESS_IDENTITY_STALE_MS = 45e3;
+var PROCESS_IDENTITY_RECHECK_MS = 5e3;
+var PROCESS_INSTANCE_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-instance");
+var PROCESS_IDENTITY_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-identity");
+var processGlobals = globalThis;
+var existingProcessInstanceId = processGlobals[PROCESS_INSTANCE_KEY];
+var CURRENT_PROCESS_INSTANCE_ID = typeof existingProcessInstanceId === "string" ? existingProcessInstanceId : randomUUID();
+processGlobals[PROCESS_INSTANCE_KEY] = CURRENT_PROCESS_INSTANCE_ID;
+function getCurrentProcessIdentity() {
+  let cache = processGlobals[PROCESS_IDENTITY_KEY];
+  if (!cache) {
+    cache = { resolved: false };
+    processGlobals[PROCESS_IDENTITY_KEY] = cache;
+  }
+  if (!cache.resolved) {
+    cache.value = getProcessIdentity(process.pid) ?? void 0;
+    cache.resolved = true;
+  }
+  return cache.value;
+}
+function storePathFor(envName) {
+  return authStorePathFor(envName ?? getActiveEnv().name);
+}
+function resolveEnvName(envName) {
+  return envName ?? getActiveEnv().name;
+}
+function ensureDir(envName) {
+  const dir = path3.dirname(storePathFor(envName));
+  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    fs3.chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writeSecretFile(filePath, data) {
+  const temporaryFile = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  let descriptor = null;
+  try {
+    descriptor = fs3.openSync(temporaryFile, "wx", 384);
+    fs3.writeFileSync(descriptor, data, { encoding: "utf8" });
+    fs3.fsyncSync(descriptor);
+    fs3.closeSync(descriptor);
+    descriptor = null;
+    fs3.renameSync(temporaryFile, filePath);
+    try {
+      fs3.chmodSync(filePath, 384);
+    } catch {
+    }
+  } finally {
+    if (descriptor !== null) {
+      try {
+        fs3.closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      fs3.unlinkSync(temporaryFile);
+    } catch {
+    }
+  }
+}
+function readTokens(envName) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(storePathFor(envName), "utf-8");
+  } catch {
+    return null;
+  }
+  try {
+    return parseStoredAuthShape(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+var CorruptStoredCredentialsError = class extends Error {
+};
+function parseStoredAuthShape(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const auth = parsed;
+  const user = auth.user;
+  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
+    return null;
+  }
+  return auth;
+}
+function readTokensForReconciliation(envName) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(storePathFor(envName), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials are not valid JSON",
+      { cause: error }
+    );
+  }
+  const auth = parseStoredAuthShape(parsed);
+  if (!auth) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials have an invalid shape"
+    );
+  }
+  return auth;
+}
+function writeTokensUnlocked(auth, envName) {
+  ensureDir(envName);
+  writeSecretFile(storePathFor(envName), JSON.stringify(auth, null, 2));
+}
+async function writeTokens(auth, envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  await withRefreshLock(
+    resolvedEnvName,
+    () => writeTokensUnlocked(auth, resolvedEnvName),
+    { unreadableStorePolicy: "discard-staged" }
+  );
+}
+function getSelectedOrg(envName) {
+  return readTokens(envName)?.orgSlug ?? null;
+}
+function getSelectedOrgId(envName) {
+  return readTokens(envName)?.orgId ?? null;
+}
+async function setSelectedOrg(orgSlug, orgId, envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  await withRefreshLock(resolvedEnvName, () => {
+    const stored = readTokens(resolvedEnvName);
+    if (!stored) return;
+    writeTokensUnlocked({ ...stored, orgId, orgSlug }, resolvedEnvName);
+  });
+}
+function credentialHash(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function describeError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function getSyncDestinationAuthBinding(envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  const envToken = process.env.FML_TOKEN;
+  if (envToken?.startsWith("fml_srt_")) {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(envToken)}`
+    };
+  }
+  if (envToken?.startsWith("fml_st_")) {
+    return {
+      destinationIdentity: `service-access:${credentialHash(envToken)}`
+    };
+  }
+  const stored = readTokens(resolvedEnvName);
+  if (!stored) return null;
+  if (stored.tokenType === "service") {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(stored.refreshToken)}`
+    };
+  }
+  const destinationIdentity = `oauth-user:${stored.user.id}`;
+  if (stored.orgId && stored.orgSlug) {
+    return {
+      destinationIdentity,
+      organizationId: stored.orgId,
+      organizationSlug: stored.orgSlug
+    };
+  }
+  return { destinationIdentity, organizationSelectionRequired: true };
+}
+function getSyncDestinationIdentity(envName) {
+  return getSyncDestinationAuthBinding(envName)?.destinationIdentity ?? null;
+}
+var SERVICE_TOKEN_LOGIN_USER_ID = "service-token";
+var serviceTokenCaches = /* @__PURE__ */ new Map();
+var serviceRefreshPromises = /* @__PURE__ */ new Map();
+var oauthRefreshPromises = /* @__PURE__ */ new Map();
+var cacheKey = (envName) => envName;
+function waitForTokenRefresh(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(null);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      resolve(null);
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    void promise.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        cleanup();
+        reject(error);
+      }
+    );
+  });
+}
+function getOrStartTokenRefresh(flights, key, forceRefresh, refresh, signal) {
+  const existing = flights.get(key);
+  if (existing && (!forceRefresh || existing.forceRefresh)) {
+    return waitForTokenRefresh(existing.promise, signal);
+  }
+  const operation = existing ? existing.promise.then(refresh, refresh) : refresh();
+  let flight;
+  const promise = operation.finally(() => {
+    if (flights.get(key) === flight) flights.delete(key);
+  });
+  flight = { forceRefresh, promise };
+  flights.set(key, flight);
+  return waitForTokenRefresh(promise, signal);
+}
+function refreshLockPath(envName) {
+  return `${storePathFor(envName)}.refresh.lock`;
+}
+function pendingOAuthRefreshPrefix(envName) {
+  return `${path3.basename(storePathFor(envName))}.refresh-result.`;
+}
+function parsePendingOAuthRefresh(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const refreshed = parsed.refreshed;
+    if (parsed.version !== 1 || typeof parsed.previousRefreshTokenHash !== "string" || !/^[a-f0-9]{64}$/.test(parsed.previousRefreshTokenHash) || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || !refreshed || typeof refreshed.accessToken !== "string" || typeof refreshed.refreshToken !== "string" || typeof refreshed.expiresAt !== "number" || !Number.isFinite(refreshed.expiresAt) || !refreshed.user || typeof refreshed.user.id !== "string" || typeof refreshed.user.email !== "string" || typeof refreshed.user.name !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function stagePendingOAuthRefresh(previousRefreshToken, refreshed, envName) {
+  ensureDir(envName);
+  const resultPath = `${storePathFor(envName)}.refresh-result.${Date.now()}.${randomUUID()}.json`;
+  const pending = {
+    version: 1,
+    previousRefreshTokenHash: credentialHash(previousRefreshToken),
+    refreshed,
+    createdAtMs: Date.now()
+  };
+  writeSecretFile(resultPath, `${JSON.stringify(pending)}
+`);
+  return resultPath;
+}
+function removePendingOAuthRefresh(resultPath) {
+  try {
+    fs3.unlinkSync(resultPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      console.error(
+        `[fml] Auth: unable to remove a committed refresh result: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+}
+function reconcilePendingOAuthRefreshes(envName, unreadableStorePolicy = "preserve-staged") {
+  const storePath = storePathFor(envName);
+  const directory = path3.dirname(storePath);
+  const prefix = pendingOAuthRefreshPrefix(envName);
+  let resultPaths;
+  try {
+    resultPaths = fs3.readdirSync(directory).filter((entry) => entry.startsWith(prefix) && entry.endsWith(".json")).map((entry) => path3.join(directory, entry));
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  const pendingResults = resultPaths.map((resultPath) => {
+    let pending = null;
+    try {
+      pending = parsePendingOAuthRefresh(fs3.readFileSync(resultPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    return { resultPath, pending };
+  }).sort(
+    (left, right) => (left.pending?.createdAtMs ?? 0) - (right.pending?.createdAtMs ?? 0)
+  );
+  for (const { resultPath, pending } of pendingResults) {
+    if (!pending) {
+      removePendingOAuthRefresh(resultPath);
+      continue;
+    }
+    let current;
+    try {
+      current = readTokensForReconciliation(envName);
+    } catch (error) {
+      if (unreadableStorePolicy === "discard-staged" && error instanceof CorruptStoredCredentialsError) {
+        console.error(
+          `[fml] Auth: discarding a staged refresh result because the credential store is corrupt and is being replaced: ${error.message}`
+        );
+        removePendingOAuthRefresh(resultPath);
+        continue;
+      }
+      throw error;
+    }
+    if (current?.refreshToken === pending.refreshed.refreshToken || current && credentialHash(current.refreshToken) === pending.previousRefreshTokenHash) {
+      if (current.refreshToken !== pending.refreshed.refreshToken) {
+        writeTokensUnlocked(
+          {
+            ...pending.refreshed,
+            orgId: current.orgId,
+            orgSlug: current.orgSlug
+          },
+          envName
+        );
+      }
+    }
+    removePendingOAuthRefresh(resultPath);
+  }
+}
+function parseRefreshLockOwner(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || typeof parsed.ownerId !== "string" || parsed.ownerId.length === 0 || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || parsed.processIdentity !== void 0 && typeof parsed.processIdentity !== "string" || parsed.processInstanceId !== void 0 && typeof parsed.processInstanceId !== "string" || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || parsed.releasedAtMs !== void 0 && (typeof parsed.releasedAtMs !== "number" || !Number.isFinite(parsed.releasedAtMs))) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function getProcessIdentity(pid) {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs3.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const fieldsAfterCommand = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const startTimeTicks = fieldsAfterCommand[19];
+      return startTimeTicks ? `linux:${startTimeTicks}` : null;
+    }
+    if (process.platform === "darwin") {
+      const startedAt = execFileSync(
+        "ps",
+        ["-p", String(pid), "-o", "lstart="],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 2e3
+        }
+      ).trim();
+      return startedAt ? `darwin:${startedAt}` : null;
+    }
+    if (process.platform === "win32") {
+      const startedAt = execFileSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().Ticks`
+        ],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 2e3
+        }
+      ).trim();
+      return startedAt ? `win32:${startedAt}` : null;
+    }
+  } catch {
+  }
+  return null;
+}
+function parseRecoveryMarkerOwner(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || typeof parsed.ownerId !== "string" || parsed.ownerId.length === 0 || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || parsed.processIdentity !== void 0 && typeof parsed.processIdentity !== "string" || parsed.processInstanceId !== void 0 && typeof parsed.processInstanceId !== "string" || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || parsed.releasedAtMs !== void 0 && (typeof parsed.releasedAtMs !== "number" || !Number.isFinite(parsed.releasedAtMs))) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function snapshotLeaseFile(filePath) {
+  let stat;
+  try {
+    stat = fs3.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (stat.isDirectory()) {
+    try {
+      return {
+        stat,
+        raw: fs3.readFileSync(path3.join(filePath, "owner.json"), "utf8")
+      };
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return { stat, raw: "" };
+      }
+      throw error;
+    }
+  }
+  try {
+    return { stat, raw: fs3.readFileSync(filePath, "utf8") };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function snapshotsMatch(observed, current) {
+  return current.stat.dev === observed.stat.dev && current.stat.ino === observed.stat.ino && current.stat.mtimeMs === observed.stat.mtimeMs && current.raw === observed.raw;
+}
+function restoreMovedLease(movedPath, originalPath) {
+  let movedStat;
+  try {
+    movedStat = fs3.lstatSync(movedPath);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  if (!movedStat.isFile()) return;
+  try {
+    fs3.linkSync(movedPath, originalPath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EEXIST" || code === "ENOENT") return;
+    throw error;
+  }
+  try {
+    fs3.unlinkSync(movedPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function pathMatchesClaim(filePath, claimedStat, ownerId, parseOwner) {
+  const current = snapshotLeaseFile(filePath);
+  return Boolean(
+    current && current.stat.dev === claimedStat.dev && current.stat.ino === claimedStat.ino && parseOwner(current.raw)?.ownerId === ownerId
+  );
+}
+function markClaimReleased(filePath, claimedStat, owner, parseOwner) {
+  let descriptor;
+  try {
+    descriptor = fs3.openSync(filePath, "r+");
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  try {
+    const currentStat = fs3.fstatSync(descriptor);
+    if (currentStat.dev !== claimedStat.dev || currentStat.ino !== claimedStat.ino) {
+      return false;
+    }
+    const currentOwner = parseOwner(fs3.readFileSync(descriptor, "utf8"));
+    if (currentOwner?.ownerId !== owner.ownerId) return false;
+    const serialized = Buffer.from(
+      `${JSON.stringify({ ...owner, releasedAtMs: Date.now() })}
+`,
+      "utf8"
+    );
+    fs3.ftruncateSync(descriptor, 0);
+    let offset = 0;
+    while (offset < serialized.length) {
+      offset += fs3.writeSync(
+        descriptor,
+        serialized,
+        offset,
+        serialized.length - offset,
+        offset
+      );
+    }
+    fs3.fsyncSync(descriptor);
+    return true;
+  } finally {
+    fs3.closeSync(descriptor);
+  }
+}
+function releaseOwnedLease(filePath, claimedStat, owner, parseOwner, description) {
+  const releasedPath = `${filePath}.released.${randomUUID()}`;
+  let moved = false;
+  try {
+    if (!markClaimReleased(filePath, claimedStat, owner, parseOwner)) return;
+    try {
+      fs3.renameSync(filePath, releasedPath);
+      moved = true;
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    const released = snapshotLeaseFile(releasedPath);
+    const releasedOwner = released ? parseOwner(released.raw) : null;
+    if (!released || released.stat.dev !== claimedStat.dev || released.stat.ino !== claimedStat.ino || releasedOwner?.ownerId !== owner.ownerId || releasedOwner.releasedAtMs === void 0) {
+      restoreMovedLease(releasedPath, filePath);
+      moved = false;
+      return;
+    }
+    fs3.rmSync(releasedPath, {
+      recursive: released.stat.isDirectory(),
+      force: true
+    });
+    moved = false;
+  } catch (error) {
+    let restorationError;
+    if (moved) {
+      try {
+        restoreMovedLease(releasedPath, filePath);
+      } catch (restoreError) {
+        restorationError = restoreError;
+      }
+    }
+    console.error(
+      `[fml] Auth: unable to remove released ${description}: ${error instanceof Error ? error.message : String(error)}${restorationError ? `; unable to restore it: ${restorationError instanceof Error ? restorationError.message : String(restorationError)}` : ""}`
+    );
+  }
+}
+function sleep(milliseconds, signal) {
+  if (!signal) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+  }
+  if (signal.aborted) {
+    return Promise.reject(
+      signal.reason ?? new DOMException("The operation was aborted", "AbortError")
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, milliseconds);
+    const onAbort = () => {
+      clearTimeout(timeout);
+      cleanup();
+      reject(
+        signal.reason ?? new DOMException("The operation was aborted", "AbortError")
+      );
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var processIdentityChecks = /* @__PURE__ */ new Map();
+function ownerPidWasReused(owner, lockMtimeMs) {
+  const now = Date.now();
+  if (now - Math.max(owner.createdAtMs, lockMtimeMs) < PROCESS_IDENTITY_STALE_MS)
+    return false;
+  if (owner.pid === process.pid && owner.processInstanceId !== void 0) {
+    return owner.processInstanceId !== CURRENT_PROCESS_INSTANCE_ID;
+  }
+  if (!owner.processIdentity) return false;
+  const cached = processIdentityChecks.get(owner.ownerId);
+  let currentIdentity;
+  if (cached && now - cached.checkedAtMs < PROCESS_IDENTITY_RECHECK_MS) {
+    currentIdentity = cached.identity;
+  } else {
+    currentIdentity = getProcessIdentity(owner.pid);
+    processIdentityChecks.set(owner.ownerId, {
+      checkedAtMs: now,
+      identity: currentIdentity
+    });
+  }
+  return currentIdentity !== null && currentIdentity !== owner.processIdentity;
+}
+function writeClaimToDescriptor(descriptor, serializedOwner) {
+  const claimedStat = fs3.fstatSync(descriptor);
+  fs3.writeFileSync(descriptor, serializedOwner, { encoding: "utf8" });
+  fs3.fsyncSync(descriptor);
+  return claimedStat;
+}
+function recoverAbandonedRecoveryMarker(recoveryPath) {
+  const observed = snapshotLeaseFile(recoveryPath);
+  if (!observed) return;
+  const owner = parseRecoveryMarkerOwner(observed.raw);
+  const ownerAlive = owner ? isProcessAlive(owner.pid) : false;
+  const reclaimable = owner ? owner.releasedAtMs !== void 0 || !ownerAlive || ownerAlive && ownerPidWasReused(owner, observed.stat.mtimeMs) : Date.now() - observed.stat.mtimeMs > OAUTH_REFRESH_RECOVERY_STALE_MS;
+  if (!reclaimable) return;
+  const abandonedPath = `${recoveryPath}.stale.${randomUUID()}`;
+  try {
+    fs3.renameSync(recoveryPath, abandonedPath);
+    const moved = snapshotLeaseFile(abandonedPath);
+    if (!moved || !snapshotsMatch(observed, moved)) {
+      restoreMovedLease(abandonedPath, recoveryPath);
+      return;
+    }
+    fs3.rmSync(abandonedPath, {
+      recursive: moved.stat.isDirectory(),
+      force: true
+    });
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function acquireRecoveryMarker(recoveryPath) {
+  const ownerId = randomUUID();
+  const owner = {
+    version: 1,
+    ownerId,
+    pid: process.pid,
+    processIdentity: getCurrentProcessIdentity(),
+    processInstanceId: CURRENT_PROCESS_INSTANCE_ID,
+    createdAtMs: Date.now()
+  };
+  let descriptor;
+  try {
+    descriptor = fs3.openSync(recoveryPath, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  let claimedStat;
+  try {
+    claimedStat = writeClaimToDescriptor(
+      descriptor,
+      `${JSON.stringify(owner)}
+`
+    );
+  } finally {
+    fs3.closeSync(descriptor);
+  }
+  const isOwned = () => pathMatchesClaim(
+    recoveryPath,
+    claimedStat,
+    ownerId,
+    parseRecoveryMarkerOwner
+  );
+  if (!isOwned()) return null;
+  let released = false;
+  return {
+    isOwned,
+    release: () => {
+      if (released) return;
+      released = true;
+      if (isOwned()) {
+        releaseOwnedLease(
+          recoveryPath,
+          claimedStat,
+          owner,
+          parseRecoveryMarkerOwner,
+          "credential-lock recovery marker"
+        );
+      }
+    }
+  };
+}
+function recoverStaleRefreshLock(lockPath) {
+  const recoveryPath = `${lockPath}.recovery`;
+  const recovery = acquireRecoveryMarker(recoveryPath);
+  if (!recovery) return;
+  try {
+    const observed = snapshotLeaseFile(lockPath);
+    if (!observed) return;
+    let reclaimable;
+    const owner = parseRefreshLockOwner(observed.raw);
+    if (owner) {
+      const alive = isProcessAlive(owner.pid);
+      reclaimable = owner.releasedAtMs !== void 0 || !alive || alive && ownerPidWasReused(owner, observed.stat.mtimeMs);
+    } else {
+      reclaimable = Date.now() - observed.stat.mtimeMs > OAUTH_REFRESH_LOCK_STALE_MS;
+    }
+    if (!reclaimable) return;
+    if (!recovery.isOwned()) return;
+    const abandonedPath = `${lockPath}.stale.${randomUUID()}`;
+    try {
+      fs3.renameSync(lockPath, abandonedPath);
+      const moved = snapshotLeaseFile(abandonedPath);
+      if (!moved || !snapshotsMatch(observed, moved)) {
+        restoreMovedLease(abandonedPath, lockPath);
+        return;
+      }
+      fs3.rmSync(abandonedPath, {
+        recursive: moved.stat.isDirectory(),
+        force: true
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  } finally {
+    recovery.release();
+  }
+}
+async function acquireRefreshLock(envName, signal) {
+  try {
+    ensureDir(envName);
+  } catch (error) {
+    console.error(
+      `[fml] Auth: unable to prepare refresh lock: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return null;
+  }
+  const lockPath = refreshLockPath(envName);
+  const recoveryPath = `${lockPath}.recovery`;
+  const deadline = Date.now() + OAUTH_REFRESH_LOCK_WAIT_MS;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) {
+      throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+    }
+    if (fs3.existsSync(recoveryPath)) {
+      try {
+        recoverAbandonedRecoveryMarker(recoveryPath);
+      } catch (recoveryError) {
+        console.error(
+          `[fml] Auth: unable to recover refresh recovery marker: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`
+        );
+        return null;
+      }
+      await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      continue;
+    }
+    let descriptor;
+    try {
+      descriptor = fs3.openSync(lockPath, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        console.error(
+          `[fml] Auth: unable to acquire refresh lock: ${error instanceof Error ? error.message : String(error)}`
+        );
+        return null;
+      }
+      try {
+        recoverStaleRefreshLock(lockPath);
+      } catch (recoveryError) {
+        console.error(
+          `[fml] Auth: unable to recover refresh lock: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`
+        );
+        return null;
+      }
+      await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      continue;
+    }
+    const ownerId = randomUUID();
+    const owner = {
+      version: 1,
+      ownerId,
+      pid: process.pid,
+      processIdentity: getCurrentProcessIdentity(),
+      processInstanceId: CURRENT_PROCESS_INSTANCE_ID,
+      createdAtMs: Date.now()
+    };
+    let claimedStat;
+    try {
+      claimedStat = writeClaimToDescriptor(
+        descriptor,
+        `${JSON.stringify(owner)}
+`
+      );
+    } catch (error) {
+      fs3.closeSync(descriptor);
+      console.error(
+        `[fml] Auth: unable to initialize refresh lock: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return null;
+    }
+    fs3.closeSync(descriptor);
+    const isOwned = () => pathMatchesClaim(lockPath, claimedStat, ownerId, parseRefreshLockOwner);
+    const releaseClaim = () => releaseOwnedLease(
+      lockPath,
+      claimedStat,
+      owner,
+      parseRefreshLockOwner,
+      "credential lock"
+    );
+    if (signal?.aborted) {
+      releaseClaim();
+      throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+    }
+    let entryBlocked;
+    try {
+      entryBlocked = fs3.existsSync(recoveryPath) || !isOwned();
+    } catch (error) {
+      console.error(
+        `[fml] Auth: unable to verify refresh lock ownership: ${describeError(error)}`
+      );
+      try {
+        if (isOwned()) releaseClaim();
+      } catch {
+      }
+      return null;
+    }
+    if (entryBlocked) {
+      try {
+        await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      } finally {
+        try {
+          if (isOwned()) releaseClaim();
+        } catch (error) {
+          console.error(
+            `[fml] Auth: unable to release a blocked refresh lock claim: ${describeError(error)}`
+          );
+        }
+      }
+      continue;
+    }
+    let released = false;
+    return {
+      isOwned,
+      release: () => {
+        if (released) return;
+        released = true;
+        let owned = false;
+        try {
+          owned = isOwned();
+        } catch (error) {
+          console.error(
+            `[fml] Auth: unable to verify credential lock ownership during release: ${describeError(error)}`
+          );
+        }
+        if (owned) releaseClaim();
+      }
+    };
+  }
+  console.error(
+    (() => {
+      try {
+        const owner = snapshotLeaseFile(lockPath);
+        const parsedOwner = owner ? parseRefreshLockOwner(owner.raw) : null;
+        return parsedOwner && isProcessAlive(parsedOwner.pid) ? `[fml] Auth: credential lock is still owned by live process ${parsedOwner.pid}; refusing an unsafe takeover` : "[fml] Auth: timed out waiting for another process to refresh credentials";
+      } catch {
+        return "[fml] Auth: timed out waiting for another process to refresh credentials";
+      }
+    })()
+  );
+  return null;
+}
+function isLockOwnedSafely(lock) {
+  try {
+    return lock.isOwned();
+  } catch (error) {
+    console.error(
+      `[fml] Auth: unable to verify credential lock ownership: ${describeError(error)}`
+    );
+    return false;
+  }
+}
+async function withRefreshLock(envName, mutation, options) {
+  const lock = await acquireRefreshLock(envName, options?.signal);
+  if (!lock) {
+    throw new Error("Unable to acquire the credential mutation lock");
+  }
+  try {
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    reconcilePendingOAuthRefreshes(envName, options?.unreadableStorePolicy);
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    const result = await mutation(lock);
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    return result;
+  } finally {
+    lock.release();
+  }
+}
+async function clearStoredCredentials(envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  await withRefreshLock(
+    resolvedEnvName,
+    () => {
+      try {
+        fs3.unlinkSync(storePathFor(resolvedEnvName));
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    },
+    { unreadableStorePolicy: "discard-staged" }
+  );
+  const key = cacheKey(resolvedEnvName);
+  serviceTokenCaches.delete(key);
+  serviceRefreshPromises.delete(key);
+  oauthRefreshPromises.delete(key);
+}
+async function refreshServiceToken(refreshToken2, envName, siteUrl, signal) {
+  try {
+    if (signal?.aborted) return null;
+    const convexUrl = (envName ? resolveEnvConvexUrl(envName) : null) ?? CONVEX_URL;
+    const requestTimeout = AbortSignal.timeout(
+      OAUTH_REFRESH_REQUEST_TIMEOUT_MS
+    );
+    const response = await fetch(
+      `${siteUrl ?? getSiteUrlForConvexUrl(convexUrl)}/api/tokens/refresh`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${refreshToken2}`
+        },
+        signal: signal ? AbortSignal.any([signal, requestTimeout]) : requestTimeout
+      }
+    );
+    if (!response.ok) {
+      console.error(
+        `[fml] Service token refresh failed: HTTP ${response.status}`
+      );
+      return null;
+    }
+    const data = await response.json();
+    if (!data.ok || !data.accessToken) {
+      console.error(`[fml] Service token refresh error: ${data.error}`);
+      return null;
+    }
+    serviceTokenCaches.set(cacheKey(envName), {
+      accessToken: data.accessToken,
+      expiresAt: data.expiresAt
+    });
+    return data.accessToken;
+  } catch (err) {
+    if (signal?.aborted) return null;
+    Sentry.captureException(err);
+    console.error(`[fml] Service token refresh error: ${err}`);
+    return null;
+  }
+}
+async function storeServiceRefreshToken(refreshToken2, opts) {
+  const envName = resolveEnvName(opts?.env);
+  const token = refreshToken2.trim();
+  if (!token.startsWith("fml_srt_")) {
+    console.error(
+      "[fml] Auth: service-token login expects a refresh token that starts with fml_srt_."
+    );
+    return false;
+  }
+  const accessToken = await refreshServiceToken(token, envName, opts?.siteUrl);
+  const cached = serviceTokenCaches.get(cacheKey(envName));
+  if (!accessToken || !cached) {
+    return false;
+  }
+  await writeTokens(
+    {
+      accessToken,
+      refreshToken: token,
+      expiresAt: cached.expiresAt,
+      user: {
+        id: SERVICE_TOKEN_LOGIN_USER_ID,
+        email: "service-token",
+        name: "FML service token"
+      },
+      tokenType: "service"
+    },
+    envName
+  );
+  return true;
+}
+async function getValidToken(opts) {
+  if (opts?.signal?.aborted) return null;
+  const envName = resolveEnvName(opts?.env);
+  const forceRefresh = opts?.forceRefresh === true;
+  const key = cacheKey(envName);
+  const envToken = process.env.FML_TOKEN;
+  if (envToken?.startsWith("fml_srt_")) {
+    const cached = serviceTokenCaches.get(key);
+    if (!forceRefresh && cached && cached.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+      return cached.accessToken;
+    }
+    return await getOrStartTokenRefresh(
+      serviceRefreshPromises,
+      key,
+      forceRefresh,
+      () => refreshServiceToken(envToken, envName, void 0, opts?.signal),
+      opts?.signal
+    );
+  }
+  if (envToken?.startsWith("fml_st_")) return envToken;
+  if (envToken) {
+    console.error(
+      "[fml] Auth: unsupported FML_TOKEN format. Expected fml_srt_* or fml_st_*."
+    );
+    return null;
+  }
+  const stored = readTokens(envName);
+  if (!stored) {
+    console.error(
+      envName ? `[fml] Auth: no stored tokens for env "${envName}"` : "[fml] Auth: no stored tokens"
+    );
+    return null;
+  }
+  if (!forceRefresh && stored.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+    return stored.accessToken;
+  }
+  if (stored.tokenType === "service") {
+    return await getOrStartTokenRefresh(
+      serviceRefreshPromises,
+      key,
+      forceRefresh,
+      () => withRefreshLock(
+        envName,
+        async (lock) => {
+          const current = readTokens(envName);
+          if (!current) return null;
+          if (!forceRefresh && current.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+            return current.accessToken;
+          }
+          if (current.tokenType !== "service") {
+            return current.accessToken;
+          }
+          if (!lock.isOwned()) return null;
+          const newAccessToken = await refreshServiceToken(
+            current.refreshToken,
+            envName,
+            void 0,
+            opts?.signal
+          );
+          if (!lock.isOwned()) return null;
+          const cached = serviceTokenCaches.get(key);
+          if (newAccessToken && cached) {
+            writeTokensUnlocked(
+              {
+                ...current,
+                accessToken: newAccessToken,
+                expiresAt: cached.expiresAt
+              },
+              envName
+            );
+          }
+          return newAccessToken;
+        },
+        { signal: opts?.signal }
+      ).catch((error) => {
+        if (opts?.signal?.aborted) return null;
+        console.error(
+          `[fml] Auth: unable to refresh stored service credentials: ${error instanceof Error ? error.message : String(error)}`
+        );
+        return null;
+      }),
+      opts?.signal
+    );
+  }
+  if (stored.refreshInvalidAt) {
+    console.error(
+      "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+    );
+    return null;
+  }
+  return await getOrStartTokenRefresh(
+    oauthRefreshPromises,
+    key,
+    forceRefresh,
+    () => refreshTokenWithLock(envName, forceRefresh, opts?.signal),
+    opts?.signal
+  );
+}
+async function refreshTokenWithLock(envName, forceRefresh = false, signal) {
+  const lock = await acquireRefreshLock(envName, signal);
+  if (!lock) return null;
+  try {
+    if (!isLockOwnedSafely(lock)) return null;
+    try {
+      reconcilePendingOAuthRefreshes(envName);
+    } catch (error) {
+      console.error(
+        `[fml] Auth: unable to reconcile staged refresh results: ${describeError(error)}`
+      );
+      return null;
+    }
+    if (!isLockOwnedSafely(lock)) return null;
+    const current = readTokens(envName);
+    if (!current) {
+      console.error("[fml] Auth: credentials disappeared during refresh");
+      return null;
+    }
+    if (!forceRefresh && current.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+      return current.accessToken;
+    }
+    if (current.refreshInvalidAt) {
+      console.error(
+        "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+      );
+      return null;
+    }
+    if (current.tokenType === "service") {
+      return null;
+    }
+    if (!isLockOwnedSafely(lock)) return null;
+    return await refreshToken(current, lock, envName, signal);
+  } finally {
+    lock.release();
+  }
+}
+async function refreshToken(stored, lock, envName, signal) {
+  if (!stored.workosClientId) {
+    console.error(
+      "[fml] Auth: token expired, missing workosClientId \u2014 run `fml login`"
+    );
+    return null;
+  }
+  try {
+    if (signal?.aborted) return null;
+    if (!lock.isOwned()) return null;
+    const requestTimeout = AbortSignal.timeout(
+      OAUTH_REFRESH_REQUEST_TIMEOUT_MS
+    );
+    const response = await fetch(
+      `${WORKOS_API_URL}/user_management/authenticate`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          client_id: stored.workosClientId,
+          refresh_token: stored.refreshToken
+        }),
+        signal: signal ? AbortSignal.any([signal, requestTimeout]) : requestTimeout
+      }
+    );
+    if (!response.ok) {
+      if (!lock.isOwned()) return null;
+      let oauthError = null;
+      try {
+        const errorBody = await response.json();
+        if (errorBody && typeof errorBody === "object" && "error" in errorBody && typeof errorBody.error === "string") {
+          oauthError = errorBody.error;
+        }
+      } catch {
+      }
+      if (oauthError === "invalid_grant") {
+        const current2 = readTokens(envName);
+        if (lock.isOwned() && current2?.refreshToken === stored.refreshToken) {
+          writeTokensUnlocked(
+            { ...current2, refreshInvalidAt: Date.now() },
+            envName
+          );
+        }
+        console.error(
+          "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+        );
+        return null;
+      }
+      console.error(
+        `[fml] Auth: refresh failed (HTTP ${response.status}) \u2014 token preserved`
+      );
+      return null;
+    }
+    const data = await response.json();
+    const userName = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
+    const refreshed = {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresAt: Date.now() + (data.expires_in ?? 300) * 1e3,
+      user: {
+        id: data.user.id,
+        email: data.user.email,
+        name: userName || stored.user.name
+      },
+      orgId: stored.orgId,
+      orgSlug: stored.orgSlug,
+      workosClientId: stored.workosClientId
+    };
+    const pendingPath = stagePendingOAuthRefresh(
+      stored.refreshToken,
+      refreshed,
+      envName
+    );
+    const current = readTokens(envName);
+    if (current?.refreshToken === stored.refreshToken && lock.isOwned()) {
+      writeTokensUnlocked(
+        {
+          ...refreshed,
+          orgId: current.orgId,
+          orgSlug: current.orgSlug
+        },
+        envName
+      );
+      removePendingOAuthRefresh(pendingPath);
+      return refreshed.accessToken;
+    }
+    if (!current) return null;
+    if (current.refreshToken !== stored.refreshToken) {
+      return current.accessToken;
+    }
+    return refreshed.accessToken;
+  } catch (err) {
+    if (signal?.aborted) return null;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[fml] Auth: refresh failed (network error: ${msg}) \u2014 token preserved`
+    );
+    Sentry.captureException(err);
+    return null;
+  }
+}
+
+export {
+  initSentry,
+  Sentry,
+  resolveFmlDefaultDirectories,
+  FML_DATA_DIR,
+  FML_STATE_DIR,
+  FML_LOG_DIR,
+  FML_OBSERVER_DIR,
+  FML_OBSERVER_HOST,
+  FML_OBSERVER_PORT,
+  FML_OBSERVER_STATE_FILE,
+  FML_OBSERVER_LOCK_FILE,
+  FML_OBSERVER_AUTH_TOKEN_FILE,
+  FML_OBSERVER_ENDPOINT_FILE,
+  FML_OBSERVER_LOG_FILE,
+  FML_INSTALLATION_ID_FILE,
+  FML_PANOPTICON_DB_FILE,
+  FML_PANOPTICON_DB_OBSERVER_STATE_FILE,
+  FML_PANOPTICON_DB_OBSERVER_LOCK_FILE,
+  FML_LEGACY_OBSERVER_DB_FILE,
+  FML_HOOK_INBOX_DIR,
+  FML_HOOK_CONTEXT_STATE_DIR,
+  FML_HOOK_CAPTURE_DISABLED_FILE,
+  observerOnlyOverrideWarning,
+  ensureDirs,
+  DEFAULT_PROD_URL,
+  DEFAULT_TARGET_NAME,
+  isValidEnvName,
+  normalizeConvexUrl,
+  writeEnvConfig,
+  envConfigExists,
+  resolveEnvConvexUrl,
+  setActiveEnvironment,
+  getActiveEnv,
+  authStorePathFor,
+  CONVEX_URL,
+  WORKOS_API_URL,
+  WORKOS_AUTH_URL,
+  getSiteUrl,
+  getSiteUrlForConvexUrl,
+  readTokens,
+  writeTokens,
+  getSelectedOrg,
+  getSelectedOrgId,
+  setSelectedOrg,
+  getSyncDestinationAuthBinding,
+  getSyncDestinationIdentity,
+  SERVICE_TOKEN_LOGIN_USER_ID,
+  clearStoredCredentials,
+  storeServiceRefreshToken,
+  getValidToken
+};