@humain/terminal 0.0.17 → 0.1.0

package/dist/bundle/chunks/chunk-JUUC5AZY.js

@@ -1,2 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-var sessionResourceCleanups=new Set;function registerSessionResourceCleanup(cleanup){return sessionResourceCleanups.add(cleanup),()=>{sessionResourceCleanups.delete(cleanup)}}function cleanupSessionResources(sessionId){let errors=[];for(let cleanup of sessionResourceCleanups)try{cleanup(sessionId)}catch(error){errors.push(error)}if(errors.length>0)throw new AggregateError(errors,"Failed to cleanup session resources")}var lastTimestamp=-1/0,sequence=0;function fillRandomBytes(bytes){if(globalThis.crypto?.getRandomValues){globalThis.crypto.getRandomValues(bytes);return}for(let i=0;i<bytes.length;i++)bytes[i]=Math.floor(Math.random()*256)}function uuidv7(){let random=new Uint8Array(16);fillRandomBytes(random);let timestamp=Date.now();timestamp>lastTimestamp?(sequence=random[6]*16777216+random[7]*65536+random[8]*256+random[9],lastTimestamp=timestamp):(sequence=sequence+1>>>0,sequence===0&&lastTimestamp++);let bytes=new Uint8Array(16);bytes[0]=lastTimestamp/1099511627776&255,bytes[1]=lastTimestamp/4294967296&255,bytes[2]=lastTimestamp/16777216&255,bytes[3]=lastTimestamp/65536&255,bytes[4]=lastTimestamp/256&255,bytes[5]=lastTimestamp&255,bytes[6]=112|sequence>>>28&15,bytes[7]=sequence>>>20&255,bytes[8]=128|sequence>>>14&63,bytes[9]=sequence>>>6&255,bytes[10]=(sequence&63)<<2|random[10]&3,bytes[11]=random[11],bytes[12]=random[12],bytes[13]=random[13],bytes[14]=random[14],bytes[15]=random[15];let hex=Array.from(bytes,byte=>byte.toString(16).padStart(2,"0"));return`${hex.slice(0,4).join("")}-${hex.slice(4,6).join("")}-${hex.slice(6,8).join("")}-${hex.slice(8,10).join("")}-${hex.slice(10,16).join("")}`}export{registerSessionResourceCleanup,cleanupSessionResources,uuidv7};

package/dist/bundle/chunks/node-ZHY4LHC7.js

@@ -1,15 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-import{AnthropicError,DEFAULT_MEMORY_SYNC_INTERVAL_MS,MIN_MEMORY_SYNC_INTERVAL_MS,ToolError,__classPrivateFieldGet,__classPrivateFieldSet,checkMemorySyncInterval,decodeUTF8,encodeUTF8,isStatus,loggerFor,promiseWithResolvers}from"./chunk-BOW22LW6.js";import"./chunk-JXWJOIH4.js";import*as fs3 from"node:fs/promises";import*as fssync2 from"node:fs";import*as path5 from"node:path";import*as cp from"node:child_process";import*as crypto from"node:crypto";import*as readline from"node:readline";function betaTool(options){if(options.inputSchema.type!=="object")throw new Error(`JSON schema for tool "${options.name}" must be an object, but got ${options.inputSchema.type}`);return{type:"custom",name:options.name,input_schema:options.inputSchema,description:options.description,run:options.run,parse:content=>content,...options.close?{close:options.close}:{}}}import*as fs from"node:fs/promises";import*as path from"node:path";import{randomUUID}from"node:crypto";var DIR_CREATE_MODE=493,FILE_CREATE_MODE=420;function isWithin(root,p){let rel=path.relative(root,p);return rel===""||!rel.startsWith(".."+path.sep)&&rel!==".."&&!path.isAbsolute(rel)}async function containingRoot(roots,target){for(let root of roots)if(isWithin(await canonicalize(path.resolve(root)),target))return root}var MAX_SYMLINK_HOPS=40;function errnoCode(err){let code=err?.code;return typeof code=="string"?code:void 0}async function canonicalize(abs){let tail=[],prefix=abs,hops=0;for(;;){let real;try{real=await fs.realpath(prefix)}catch(realpathErr){let isLink;try{isLink=(await fs.lstat(prefix)).isSymbolicLink()}catch(lstatErr){let code=errnoCode(lstatErr);if(code!=="ENOENT"&&code!=="ENOTDIR")throw lstatErr;let parent=path.dirname(prefix);if(parent===prefix)throw lstatErr;tail.push(path.basename(prefix)),prefix=parent;continue}if(!isLink)throw realpathErr;if(++hops>MAX_SYMLINK_HOPS)throw Object.assign(new Error("too many levels of symbolic links"),{code:"ELOOP"});prefix=path.resolve(path.dirname(prefix),await fs.readlink(prefix));continue}return tail.length?path.join(real,...tail.reverse()):real}}async function confineToRoot(root,p,opts){let allowedRoots=opts?.allowedRoots??[],realRoot=await canonicalize(path.resolve(root)),real;try{real=await canonicalize(path.resolve(realRoot,p))}catch(err){throw new ToolError(fsErrorMessage(err,`path ${JSON.stringify(p)}`))}if(isWithin(realRoot,real)||await containingRoot(allowedRoots,real)!==void 0)return real;let permitted=allowedRoots.length?"the session's working directory and its other permitted directories":"the session's working directory";throw new ToolError(`path ${JSON.stringify(p)} is outside ${permitted}`)}async function atomicWriteFile(targetPath,content){let dir=path.dirname(targetPath),tempPath=path.join(dir,`.tmp-${process.pid}-${randomUUID()}`),handle;try{handle=await fs.open(tempPath,"wx",FILE_CREATE_MODE),await handle.writeFile(content,"utf-8"),await handle.sync(),await handle.close(),handle=void 0,await fs.rename(tempPath,targetPath)}catch(err){throw handle&&await handle.close().catch(()=>{}),await fs.unlink(tempPath).catch(()=>{}),err}}function fsErrorMessage(err,file){let code=errnoCode(err);switch(code){case"ENOENT":return`${file}: no such file or directory`;case"EACCES":case"EPERM":return`${file}: permission denied`;case"ENOTDIR":return`${file}: not a directory`;case"EISDIR":return`${file}: is a directory`;case"ELOOP":return`${file}: too many levels of symbolic links`;case"ENAMETOOLONG":return`${file}: file name too long`;case"ENOSPC":return`${file}: no space left on device`;case"EMFILE":case"ENFILE":return`${file}: too many open files`;default:return`${file}: ${code!==void 0?`i/o error (${code})`:"i/o error"}`}}import*as fs2 from"node:fs/promises";import*as fssync from"node:fs";import*as path2 from"node:path";import{execFile}from"node:child_process";import{promisify}from"node:util";import{Readable}from"node:stream";import{pipeline}from"node:stream/promises";var execFileAsync=promisify(execFile);async function setupSkills(ctx){let{client,sessionId}=ctx;if(!client)return async()=>{};let log=loggerFor(client),session=ctx.session;if(!session){if(sessionId===void 0)return async()=>{};log.warn("AgentToolContext.sessionId is deprecated and costs an extra session fetch; fetch the session once and set `session` instead",{component:"agent-tool-context"}),session=await client.beta.sessions.retrieve(sessionId)}let skillsRoot=path2.resolve(ctx.workdir,"skills"),created=[];for(let skill of session.agent.skills)try{let versionId=await resolveSkillVersion(client,skill.skill_id,skill.version),version=await client.beta.skills.versions.retrieve(versionId,{skill_id:skill.skill_id}),dirname5=path2.basename(version.name.trim());(dirname5===""||dirname5==="."||dirname5==="..")&&(dirname5=skill.skill_id);let dest=path2.resolve(skillsRoot,dirname5);if(dest!==skillsRoot&&!dest.startsWith(skillsRoot+path2.sep)){log.warn("skill name escapes the skills dir; skipping",{component:"agent-tool-context",name:version.name});continue}let resp=await client.beta.skills.versions.download(versionId,{skill_id:skill.skill_id});await fs2.rm(dest,{recursive:!0,force:!0}),await fs2.mkdir(dest,{recursive:!0,mode:DIR_CREATE_MODE}),created.push(dest),await extractSkillArchive(resp,dest),log.info("downloaded skill",{component:"agent-tool-context",skill_id:skill.skill_id,version:versionId,dest})}catch(e){log.warn("failed to download skill",{component:"agent-tool-context",skill_id:skill.skill_id,error:String(e)})}return async()=>{for(let dest of created)await fs2.rm(dest,{recursive:!0,force:!0}).catch(e=>{log.warn("failed to clean up skill",{component:"agent-tool-context",dest,error:String(e)})})}}async function resolveSkillVersion(client,skillId,version){if(/^\d+$/.test(version))return version;let newest;for await(let v of client.beta.skills.versions.list(skillId))/^\d+$/.test(v.version)&&(newest===void 0||BigInt(v.version)>BigInt(newest))&&(newest=v.version);if(newest===void 0)throw new AnthropicError(`skill ${JSON.stringify(skillId)} has no concrete version to resolve ${JSON.stringify(version)} against`);return newest}function assertSafeMemberNames(names){for(let raw of names){let entry=raw.trim();if(entry&&(path2.isAbsolute(entry)||entry.split(/[\\/]/).includes("..")))throw new AnthropicError(`refusing to extract unsafe archive member: ${entry}`)}}var INCONSISTENT_LISTING="skill archive listing is inconsistent; refusing to extract",PLAIN_TYPE_CHARS={unzip:new Set(["-","d","?"]),tar:new Set(["-","d","C"])};function listingLines(listing){let lines=listing.split(`
-`);return lines[lines.length-1]===""&&lines.pop(),lines}function canExcludeVerbatim(cmd,name){return/^[\x20-\x7E]+$/.test(name)&&!/[\\^#]/.test(name)&&!(cmd==="unzip"&&name.startsWith("-"))}function classifyArchiveListing(cmd,names,typed){let nameLines=listingLines(names),typedLines=listingLines(typed);if(nameLines.length!==typedLines.length)throw new AnthropicError(INCONSISTENT_LISTING);let plain=[],special=[];return nameLines.forEach((name,i)=>{if(PLAIN_TYPE_CHARS[cmd].has(typedLines[i].charAt(0))){plain.push(name);return}if(!canExcludeVerbatim(cmd,name))throw new AnthropicError(`refusing to extract archive: cannot safely exclude member ${JSON.stringify(name)}`);special.push(name)}),{plain,special}}async function assertOnlyPlainEntries(dir){for(let entry of await fs2.readdir(dir,{withFileTypes:!0}))if(entry.isDirectory())await assertOnlyPlainEntries(path2.join(dir,entry.name));else if(!entry.isFile())throw new AnthropicError(INCONSISTENT_LISTING)}async function runArchiveTool(cmd,args){try{let{stdout}=await execFileAsync(cmd,args);return stdout}catch(e){throw errnoCode(e)==="ENOENT"?new AnthropicError(`skill extraction requires the \`${cmd}\` command, but it was not found on PATH`):e}}function archiveTopDir(names){let top,nested=!1;for(let raw of names){let parts=raw.trim().split("/").filter(p=>p!==""&&p!==".");if(parts.length===0)continue;let first=parts[0];if(top===void 0)top=first;else if(first!==top)return"";parts.length>1&&(nested=!0)}return top!==void 0&&nested?top:""}async function extractSkillArchive(resp,dest){let tmp=path2.join(dest,`.skill-archive-${process.pid}-${Date.now()}`);if(!resp.body)throw new AnthropicError("skill download response had no body");await pipeline(Readable.fromWeb(resp.body),fssync.createWriteStream(tmp));let stage=path2.join(path2.dirname(dest),`.skill-stage-${process.pid}-${Date.now()}`),excludeFile=path2.join(path2.dirname(dest),`.skill-exclude-${process.pid}-${Date.now()}`);try{let head=await readHead(tmp,4),isZip=head.length>=4&&head[0]===80&&head[1]===75&&head[2]===3&&head[3]===4,archiveCmd=isZip?"unzip":"tar",names=await runArchiveTool(archiveCmd,isZip?["-Z1",tmp]:["-tf",tmp]),typed=await runArchiveTool(archiveCmd,isZip?["-Z","--h","--t",tmp]:["-tvf",tmp]),{plain,special}=classifyArchiveListing(archiveCmd,names,typed);assertSafeMemberNames([...plain,...special]);let top=archiveTopDir(plain);await fs2.mkdir(stage,{recursive:!0,mode:DIR_CREATE_MODE}),plain.length>0&&await runArchiveTool(archiveCmd,await extractArgs(archiveCmd,tmp,stage,special,excludeFile)),await assertOnlyPlainEntries(stage);let srcRoot=top?path2.join(stage,top):stage,entries=await fs2.readdir(srcRoot).catch(e=>{throw errnoCode(e)==="ENOENT"?new AnthropicError(INCONSISTENT_LISTING):e});for(let entry of entries)await fs2.rename(path2.join(srcRoot,entry),path2.join(dest,entry))}finally{await fs2.rm(tmp,{force:!0}),await fs2.rm(excludeFile,{force:!0}),await fs2.rm(stage,{recursive:!0,force:!0})}}async function extractArgs(cmd,archive,stage,special,excludeFile){let patterns=special.map(name=>name.replace(/[*?[\\]/g,"\\$&"));return cmd==="unzip"?["-oq",archive,"-d",stage,...patterns.length>0?["-x",...patterns]:[]]:patterns.length===0?["-xf",archive,"-C",stage]:(await fs2.writeFile(excludeFile,patterns.join(`
-`)+`
-`,{flag:"wx",mode:384}),["-xf",archive,"-C",stage,"-X",excludeFile])}async function readHead(file,n){let handle=await fs2.open(file,"r");try{let buf=Buffer.alloc(n),{bytesRead}=await handle.read(buf,0,n,0);return buf.subarray(0,bytesRead)}finally{await handle.close()}}import*as path4 from"node:path";import{createHash as createHash2}from"node:crypto";import*as fsp from"node:fs/promises";import*as path3 from"node:path";import{constants as C}from"node:fs";import{createHash,randomBytes}from"node:crypto";var OWNER_ONLY_DIR_MODE=448,OWNER_ONLY_FILE_MODE=384,OWNER_ONLY_EXEC_MODE=448,O_NOFOLLOW=C.O_NOFOLLOW??0,O_NONBLOCK=C.O_NONBLOCK??0,FileStoreError=class extends Error{constructor(reason,relPath){super(`path ${JSON.stringify(relPath)} ${reason}`),this.name="FileStoreError",this.reason=reason,this.relPath=relPath}};FileStoreError.ESCAPES_ROOT="escapes the store root";FileStoreError.IS_A_SYMLINK="is a symlink";FileStoreError.NOT_A_FILE="is not a regular file";FileStoreError.NOT_A_DIRECTORY="is not a directory";FileStoreError.NOT_UTF8="is not valid utf-8";FileStoreError.MOVE_DESTINATION_EXISTS="already exists";function isPathLegal(p){return p.startsWith("/")&&!p.split("/").includes("..")}var FileStore=class _FileStore{constructor(root,removedOnDispose,utf8Only=!1){this.hashes=new Map,this.rootPath=root,this.removedOnDispose=removedOnDispose,this.decoder=utf8Only?new TextDecoder("utf-8",{fatal:!0}):void 0}static async open(root,opts){if(!platformSupported())throw new Error("FileStore requires O_NOFOLLOW support on this platform");let removedOnDispose=!1;try{await fsp.lstat(root)}catch(e){if(e.code!=="ENOENT")throw e;removedOnDispose=!0}return new _FileStore(path3.resolve(root),removedOnDispose,opts?.utf8??!1)}async createRoot(){await makeDirAndAncestors(this.rootPath)}root(){return{path:this.rootPath,removedOnDispose:this.removedOnDispose}}async dispose(){this.removedOnDispose&&await fsp.rm(this.rootPath,{recursive:!0,force:!0})}async put(relPath,data,opts){let tail=relPath.replace(/\\/g,"/");if(tail.endsWith("/")||tail.endsWith("/.")||tail===""||tail===".")throw new FileStoreError(FileStoreError.NOT_A_FILE,relPath);let dest=this.resolveUnderRoot(relPath),payload=typeof data=="string"?encodeUTF8(data):data;this.requireUtf8(relPath,payload),await makeDirsBelowRoot(this.rootPath,path3.dirname(dest)),await replaceViaTemp(dest,payload,opts?.executable??!1)}async get(relPath){let dest=this.resolveUnderRoot(relPath),handle;try{handle=await openRegularFile(relPath,dest)}catch(e){if(e.code==="ENOENT")return null;throw e}let data;try{let buf=await handle.readFile();data=new Uint8Array(buf.buffer,buf.byteOffset,buf.byteLength)}finally{await handle.close()}return this.requireUtf8(relPath,data),data}async ls(under="/"){let base=this.resolveUnderRoot(under);return new Set((await filenamesInDir(this.rootPath,under,base)).map(([rel])=>rel))}async findSymlinks(under="/"){let base=this.resolveUnderRoot(under);return symlinksInDir(this.rootPath,under,base)}async hashtree(under="/"){let base=this.resolveUnderRoot(under),walkStartNs=_internals.nowNs(),out=Object.create(null);for(let[rel,full]of await filenamesInDir(this.rootPath,under,base)){let sha=await this.hashViaCache(rel,full,walkStartNs);sha!==null&&(out[rel]=sha)}return out}async hashFile(relPath){let dest=this.resolveUnderRoot(relPath),st;try{st=await fsp.lstat(dest,{bigint:!0})}catch(e){if(e.code==="ENOENT")return null;throw e}if(st.isSymbolicLink())throw new FileStoreError(FileStoreError.IS_A_SYMLINK,relPath);if(!st.isFile())throw new FileStoreError(FileStoreError.NOT_A_FILE,relPath);let rel=path3.relative(this.rootPath,dest).split(path3.sep).join("/");return this.hashViaCache(rel,dest,_internals.nowNs())}async move(src,dst){let s=this.resolveUnderRoot(src),d=this.resolveUnderRoot(dst);if(s===this.rootPath||d===this.rootPath)return;if(await fsp.stat(d).then(()=>!0,()=>!1))throw new FileStoreError(FileStoreError.MOVE_DESTINATION_EXISTS,dst);await makeDirsBelowRoot(this.rootPath,path3.dirname(d)),await fsp.rename(s,d)}async remove(relPath){let dest=this.resolveUnderRoot(relPath);if(dest===this.rootPath)return;let st;try{st=await fsp.lstat(dest,{bigint:!0})}catch(e){if(e.code==="ENOENT")return;throw e}if(st.isDirectory())await fsp.rm(dest,{recursive:!0,force:!0});else try{await fsp.unlink(dest)}catch(e){if(e.code!=="ENOENT")throw e}}resolveUnderRoot(relPath){let norm=relPath.replace(/\\/g,"/").replace(/^\/+/,""),parts=norm.split("/").filter(p=>p!==""&&p!==".");if(path3.posix.isAbsolute(norm)||parts.includes(".."))throw new FileStoreError(FileStoreError.ESCAPES_ROOT,relPath);return parts.length===0?this.rootPath:path3.join(this.rootPath,...parts)}requireUtf8(relPath,data){if(this.decoder)try{this.decoder.decode(data)}catch{throw new FileStoreError(FileStoreError.NOT_UTF8,relPath)}}async hashViaCache(rel,full,walkStartNs){let st;try{st=await fsp.lstat(full,{bigint:!0})}catch(e){if(e.code==="ENOENT")return null;throw e}if(!st.isFile())return null;let cached=this.hashes.get(rel),sha;if(cached!==void 0&&unchangedSinceHashed(cached,st))sha=cached.sha;else try{sha=await _internals.hashFile(full)}catch(e){let code=e.code;if(code==="ENOENT"||e instanceof FileStoreError||code==="ELOOP"||code==="EMLINK")return null;throw e}return oldEnoughToCache(st,walkStartNs)&&this.hashes.set(rel,{mtimeNs:st.mtimeNs,ctimeNs:st.ctimeNs,size:st.size,sha}),sha}};FileStore.isPathLegal=isPathLegal;function platformSupported(){return O_NOFOLLOW!==0}async function makeDirAndAncestors(dir){let missing=[],current=dir;for(;;){try{await fsp.stat(current);break}catch(e){let code=e.code;if(code!=="ENOENT"&&code!=="ENOTDIR"&&code!=="ELOOP")throw e}missing.push(current);let parent=path3.dirname(current);if(parent===current)break;current=parent}for(let directory of missing.reverse())try{await fsp.mkdir(directory,{mode:OWNER_ONLY_DIR_MODE})}catch(e){if(e.code!=="EEXIST")throw e}}async function makeDirsBelowRoot(root,dir){let below=path3.relative(root,dir);if(below==="")return;let current=root;for(let part of below.split(path3.sep)){current=path3.join(current,part);try{await fsp.mkdir(current,{mode:OWNER_ONLY_DIR_MODE})}catch(e){if(e.code!=="EEXIST")throw e}}}async function replaceViaTemp(dest,data,isExecutable){let mode=isExecutable?OWNER_ONLY_EXEC_MODE:OWNER_ONLY_FILE_MODE,tmp=path3.join(path3.dirname(dest),`.fs-${randomBytes(8).toString("hex")}.tmp`),handle;try{handle=await fsp.open(tmp,C.O_WRONLY|C.O_CREAT|C.O_EXCL|O_NOFOLLOW,mode),await handle.writeFile(data),await handle.close(),handle=void 0,await fsp.rename(tmp,dest)}catch(err){throw handle&&await handle.close().catch(()=>{}),await fsp.unlink(tmp).catch(()=>{}),err}}async function openRegularFile(relPath,dest){let handle;try{handle=await fsp.open(dest,C.O_RDONLY|O_NOFOLLOW|O_NONBLOCK)}catch(e){let code=e.code;throw code==="ELOOP"||code==="EMLINK"?new FileStoreError(FileStoreError.IS_A_SYMLINK,relPath):e}try{if(!(await handle.stat()).isFile())throw new FileStoreError(FileStoreError.NOT_A_FILE,relPath)}catch(e){throw await handle.close().catch(()=>{}),e}return handle}async function hashFile(full){let digest=createHash("sha256"),handle=await openRegularFile(path3.basename(full),full),buf=new Uint8Array(1024*1024);try{for(;;){let{bytesRead}=await handle.read(buf,0,buf.length);if(bytesRead===0)break;digest.update(buf.subarray(0,bytesRead))}}finally{await handle.close()}return digest.digest("hex")}async function filenamesInDir(root,under,base){if(!await requireDir(under,base))return[];let out=[];return await walk(base,(full,entry)=>{entry.isFile()&&out.push([path3.relative(root,full).split(path3.sep).join("/"),full])}),out.sort(),out}async function symlinksInDir(root,under,base){let relOf=full=>path3.relative(root,full).split(path3.sep).join("/"),st;try{st=await fsp.lstat(base,{bigint:!0})}catch(e){let code=e.code;if(code==="ENOENT"||code==="ENOTDIR")return new Set;throw e}if(st.isSymbolicLink())return new Set([relOf(base)]);if(!st.isDirectory())throw new FileStoreError(FileStoreError.NOT_A_DIRECTORY,under);let out=new Set;return await walk(base,(full,entry)=>{entry.isSymbolicLink()&&out.add(relOf(full))}),out}async function requireDir(under,base){let st;try{st=await fsp.lstat(base,{bigint:!0})}catch(e){let code=e.code;if(code==="ENOENT"||code==="ENOTDIR")return!1;throw e}if(!st.isDirectory())throw new FileStoreError(FileStoreError.NOT_A_DIRECTORY,under);return!0}async function walk(base,visit){let stack=[base];for(;stack.length;){let dir=stack.pop(),entries;try{entries=await fsp.readdir(dir,{withFileTypes:!0})}catch(e){if(e.code==="ENOENT")continue;throw e}for(let entry of entries){let full=path3.join(dir,entry.name);visit(full,entry),entry.isDirectory()&&!entry.isSymbolicLink()&&stack.push(full)}}}function unchangedSinceHashed(cached,st){return st.mtimeNs===cached.mtimeNs&&st.ctimeNs===cached.ctimeNs&&st.size===cached.size}function oldEnoughToCache(st,walkStartNs){return(st.mtimeNs>st.ctimeNs?st.mtimeNs:st.ctimeNs)<walkStartNs-_internals.timestampTrustMarginNs}var TIMESTAMP_TRUST_MARGIN_NS=2000000000n,_internals={hashFile,timestampTrustMarginNs:TIMESTAMP_TRUST_MARGIN_NS,nowNs:()=>BigInt(Date.now())*1000000n},LocalFileStore=FileStore,asyncDispose=Symbol.asyncDispose;asyncDispose&&Object.defineProperty(FileStore.prototype,asyncDispose,{value:FileStore.prototype.dispose,configurable:!0,writable:!0});var _SessionMemoryStores_instances,_SessionMemoryStores_client,_SessionMemoryStores_workdir,_SessionMemoryStores_syncIntervalMs,_SessionMemoryStores_syncDeletions,_SessionMemoryStores_log,_SessionMemoryStores_lastSyncAt,_SessionMemoryStores_finished,_SessionMemoryStores_stores,_SessionMemoryStores_storeRoot,_SessionMemoryStores_scanMarker,_SessionMemoryStores_syncStore,_SessionMemoryStores_flushStore,_SessionMemoryStores_recover,_SessionMemoryStores_stampAndPull,_SessionMemoryStores_syncPath,_SessionMemoryStores_removeLocal,_SessionMemoryStores_write,_SessionMemoryStores_pullAll,_SessionMemoryStores_uploadAll,_SessionMemoryStores_listMemories,_SessionMemoryStores_upload,_SessionMemoryStores_corroboratedDelete,_SessionMemoryStores_deleteRemote,MEMORY_FLUSH_TIMEOUT_MS=3e4,MARKER_PATH=".anthropic-memory-store",MARKER_VERSION=1;function markerSha(memoryStoreId){return createHash2("sha256").update(`version ${MARKER_VERSION}
-${memoryStoreId}`,"utf-8").digest("hex")}var DELETE_CORROBORATION_MS=3e4,LIST_PAGE_SIZE=100,FULL_LIST_PAGE_SIZE=20,FETCH_CONCURRENCY=16,UPLOAD_CONCURRENCY=32,DELETE_CAP_FLOOR=8,DELETE_CAP_CEILING=50,SessionMemoryError=class extends AnthropicError{constructor(message,cause){super(message),this.name="SessionMemoryError",cause!==void 0&&(this.cause=cause)}},DeletePass=class{constructor(mode,cap,waiveWindow){this.mode=mode,this.cap=cap,this.waiveWindow=waiveWindow,this.attempted=0,this.capped=0,this.suppressed=0}takeSlot(){return this.attempted>=this.cap?(this.capped++,!1):(this.attempted++,!0)}},SessionMemoryStores=class{constructor(client,opts){_SessionMemoryStores_instances.add(this),_SessionMemoryStores_client.set(this,void 0),_SessionMemoryStores_workdir.set(this,void 0),_SessionMemoryStores_syncIntervalMs.set(this,void 0),_SessionMemoryStores_syncDeletions.set(this,void 0),_SessionMemoryStores_log.set(this,void 0),_SessionMemoryStores_lastSyncAt.set(this,void 0),_SessionMemoryStores_finished.set(this,!1),_SessionMemoryStores_stores.set(this,[]),__classPrivateFieldSet(this,_SessionMemoryStores_client,client,"f"),__classPrivateFieldSet(this,_SessionMemoryStores_workdir,opts.workdir,"f"),__classPrivateFieldSet(this,_SessionMemoryStores_syncIntervalMs,opts.syncIntervalMs??DEFAULT_MEMORY_SYNC_INTERVAL_MS,"f"),checkMemorySyncInterval(__classPrivateFieldGet(this,_SessionMemoryStores_syncIntervalMs,"f"),"syncIntervalMs"),__classPrivateFieldSet(this,_SessionMemoryStores_syncDeletions,opts.syncDeletions??"enabled","f"),__classPrivateFieldSet(this,_SessionMemoryStores_log,loggerFor(client),"f"),__classPrivateFieldSet(this,_SessionMemoryStores_lastSyncAt,Date.now(),"f")}get roots(){return __classPrivateFieldGet(this,_SessionMemoryStores_stores,"f").map(s=>s.files.root().path)}get readOnlyRoots(){return __classPrivateFieldGet(this,_SessionMemoryStores_stores,"f").filter(s=>s.readOnly).map(s=>s.files.root().path)}async download(session){for(let resource of session.resources){if(resource.type!=="memory_store")continue;let root=__classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_storeRoot).call(this,resource),store;try{if(store={memoryStoreId:resource.memory_store_id,files:await LocalFileStore.open(root,{utf8:!0}),readOnly:resource.access==="read_only",baseline:new Map,refusedShas:new Map,pendingDeletes:new Map},!store.files.root().removedOnDispose)throw new SessionMemoryError(`something already exists at the memory store's path: ${root} (memory_store_id=${resource.memory_store_id}); it must not exist when the session starts`);try{await store.files.createRoot()}catch(e){throw isErrno(e)?new SessionMemoryError(`cannot create the memory store's folder: ${root} (memory_store_id=${resource.memory_store_id}): ${e}; the worker host must make this mount path writable`,e):e}await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_stampAndPull).call(this,store),__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").info("downloaded memories",{count:store.baseline.size,memory_store_id:store.memoryStoreId,dest:store.files.root().path}),__classPrivateFieldGet(this,_SessionMemoryStores_stores,"f").push(store)}catch(e){throw store&&await store.files.dispose().catch(()=>{}),e instanceof SessionMemoryError?e:new SessionMemoryError(`failed to download memory store memory_store_id=${resource.memory_store_id}: ${e}`,e)}}__classPrivateFieldSet(this,_SessionMemoryStores_lastSyncAt,Date.now(),"f")}async finish(){if(__classPrivateFieldGet(this,_SessionMemoryStores_finished,"f"))throw new AnthropicError("finish() was already called: it is the session's last sync and runs once");__classPrivateFieldSet(this,_SessionMemoryStores_finished,!0,"f"),await this.syncAll(!0)}async syncAll(final){await Promise.all(__classPrivateFieldGet(this,_SessionMemoryStores_stores,"f").map(store=>__classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_syncStore).call(this,store,final))),__classPrivateFieldSet(this,_SessionMemoryStores_lastSyncAt,Date.now(),"f")}async syncIfDue(){Date.now()-__classPrivateFieldGet(this,_SessionMemoryStores_lastSyncAt,"f")<__classPrivateFieldGet(this,_SessionMemoryStores_syncIntervalMs,"f")||await this.syncAll(!1)}async flushWrites(signal){await Promise.all(__classPrivateFieldGet(this,_SessionMemoryStores_stores,"f").map(store=>__classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_flushStore).call(this,store,signal)))}async dispose(){for(let store of __classPrivateFieldGet(this,_SessionMemoryStores_stores,"f")){let root=store.files.root();try{let scan=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_scanMarker).call(this,store);if(!scan.markerOk&&Object.keys(scan.files).length>0){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`${scan.distrustReason}; leaving the memory store folder on disk`,{root:root.path,memory_store_id:store.memoryStoreId});continue}await store.files.dispose()}catch(e){if(!(e instanceof FileStoreError)&&!isErrno(e))throw e;__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to remove the memory store folder",{root:store.files.root().path,memory_store_id:store.memoryStoreId,error:String(e)});continue}root.removedOnDispose&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").info("removed memory store dir",{dest:root.path,memory_store_id:store.memoryStoreId})}}};_SessionMemoryStores_client=new WeakMap,_SessionMemoryStores_workdir=new WeakMap,_SessionMemoryStores_syncIntervalMs=new WeakMap,_SessionMemoryStores_syncDeletions=new WeakMap,_SessionMemoryStores_log=new WeakMap,_SessionMemoryStores_lastSyncAt=new WeakMap,_SessionMemoryStores_finished=new WeakMap,_SessionMemoryStores_stores=new WeakMap,_SessionMemoryStores_instances=new WeakSet,_SessionMemoryStores_storeRoot=function(resource){if(resource.mount_path){if(!isPathLegal(resource.mount_path))throw new SessionMemoryError(`memory store mount_path is not a clean absolute path: ${JSON.stringify(resource.mount_path)} (memory_store_id=${resource.memory_store_id})`);return resource.mount_path}return path4.join(__classPrivateFieldGet(this,_SessionMemoryStores_workdir,"f"),"memory",resource.name||resource.memory_store_id)},_SessionMemoryStores_scanMarker=async function(store){let local=await store.files.hashtree(),marker=local[MARKER_PATH];return delete local[MARKER_PATH],marker===markerSha(store.memoryStoreId)?{files:local,markerOk:!0,distrustReason:null}:{files:local,markerOk:!1,distrustReason:marker!==void 0?"the marker file does not match this store":"the marker file is gone"}},_SessionMemoryStores_syncStore=async function(store,final){try{let scan=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_scanMarker).call(this,store),local=scan.files;if(!scan.markerOk){if(Object.keys(local).length>0){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`${scan.distrustReason}; leaving the memory store folder as found and not syncing`,{root:store.files.root().path,memory_store_id:store.memoryStoreId});return}await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_recover).call(this,store,"the folder or its marker is gone");return}if(Object.keys(local).length===0&&store.baseline.size>1){await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_recover).call(this,store,"every memory file is gone at once");return}let remote=new Map;for await(let[rel,item]of __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_listMemories).call(this,store.memoryStoreId))remote.set(rel,item);let deletes=new DeletePass(__classPrivateFieldGet(this,_SessionMemoryStores_syncDeletions,"f"),Math.max(DELETE_CAP_FLOOR,Math.min(DELETE_CAP_CEILING,Math.floor(store.baseline.size/4))),final),pulls=[],baseline=new Map,paths=[...new Set([...remote.keys(),...Object.keys(local),...store.baseline.keys()])].sort();for(let rel of paths){let remoteItem=remote.get(rel),localSha=local[rel],baseSha=store.baseline.get(rel),sha;localSha===void 0&&baseSha!==void 0&&remoteItem!==void 0&&remoteItem.content_sha256===baseSha&&!store.readOnly?sha=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_corroboratedDelete).call(this,store,rel,remoteItem,baseSha,deletes):sha=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_syncPath).call(this,store,rel,remoteItem,localSha,pulls),sha!==void 0&&baseline.set(rel,sha)}store.baseline=baseline,await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_pullAll).call(this,store,pulls),deletes.suppressed>0&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").debug("remote deletes are disabled; locally deleted memories stay on the server",{count:deletes.suppressed,memory_store_id:store.memoryStoreId}),deletes.capped>0&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`delete cap reached: ${deletes.mode==="log_only"?"would send":"sent"} ${deletes.attempted} deletes, held ${deletes.capped} for later syncs`,{memory_store_id:store.memoryStoreId})}catch(e){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory sync failed",{memory_store_id:store.memoryStoreId,error:String(e)})}},_SessionMemoryStores_flushStore=async function(store,signal){let dirty=new Map,unsent=new Set,push=async()=>{if(store.readOnly)return;let scan=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_scanMarker).call(this,store);if(!scan.markerOk){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`${scan.distrustReason}; not uploading anything from the memory store folder`,{root:store.files.root().path,memory_store_id:store.memoryStoreId});return}for(let[rel,sha]of Object.entries(scan.files))sha!==store.baseline.get(rel)&&store.refusedShas.get(rel)!==sha&&(dirty.set(rel,sha),unsent.add(rel));if(dirty.size===0||signal?.aborted)return;let remote=new Map;for await(let[rel,item]of __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_listMemories).call(this,store.memoryStoreId)){if(signal?.aborted)return;remote.set(rel,item)}let uploads=[];for(let rel of[...dirty.keys()].sort()){let localSha=dirty.get(rel),baseSha=store.baseline.get(rel),existing=remote.get(rel);if(existing!==void 0&&existing.content_sha256===localSha){store.baseline.set(rel,existing.content_sha256),unsent.delete(rel);continue}if(existing!==void 0&&existing.content_sha256!==baseSha){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory changed both locally and remotely; the flush leaves the remote version",{path:rel,memory_store_id:store.memoryStoreId}),unsent.delete(rel);continue}uploads.push([rel,localSha,existing])}await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_uploadAll).call(this,store,uploads,unsent,signal)};try{await settledOrAborted(push(),signal),signal?.aborted&&unsent.size>0&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`memory flush cut off part-way; ${unsent.size} of ${dirty.size} changed files had not finished uploading`,{memory_store_id:store.memoryStoreId})}catch(e){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory flush failed",{memory_store_id:store.memoryStoreId,error:String(e)})}},_SessionMemoryStores_recover=async function(store,reason){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn(`${reason}; re-downloading the memory store folder instead of syncing`,{root:store.files.root().path,memory_store_id:store.memoryStoreId}),await store.files.createRoot(),await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_stampAndPull).call(this,store)},_SessionMemoryStores_stampAndPull=async function(store){store.baseline=new Map,store.pendingDeletes.clear(),await store.files.put(MARKER_PATH,`version ${MARKER_VERSION}
-${store.memoryStoreId}`);for await(let[rel,item]of __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_listMemories).call(this,store.memoryStoreId,"full"))await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_write).call(this,store,rel,item.content??"")&&store.baseline.set(rel,item.content_sha256)},_SessionMemoryStores_syncPath=async function(store,rel,remote,localSha,pulls){let baseSha=store.baseline.get(rel);if(localSha!==void 0&&store.pendingDeletes.delete(rel),!remote){if(localSha===void 0){store.pendingDeletes.delete(rel);return}if(baseSha!==void 0){if(localSha===baseSha){let fresh=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_removeLocal).call(this,store,rel,baseSha);if(fresh===void 0)return;if(fresh===baseSha)return baseSha;localSha=fresh}store.readOnly?__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory deleted remotely but edited locally; keeping the file, which a read-only store cannot push",{path:rel,memory_store_id:store.memoryStoreId}):store.refusedShas.get(rel)!==localSha&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").info("memory deleted remotely but edited locally; re-creating it from the file",{path:rel,memory_store_id:store.memoryStoreId})}return store.readOnly||store.refusedShas.get(rel)===localSha?void 0:await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_upload).call(this,store,rel,localSha,void 0)}let remoteSha=remote.content_sha256,remoteChanged=remoteSha!==baseSha,locallyEdited=localSha!==void 0&&localSha!==baseSha&&localSha!==remoteSha,localChanged=!store.readOnly&&locallyEdited;return localSha===void 0&&baseSha!==void 0?(remoteChanged&&(__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory deleted locally but changed remotely; restoring the remote version",{path:rel,memory_store_id:store.memoryStoreId}),store.pendingDeletes.delete(rel),pulls.push([rel,remote])),baseSha):remoteChanged?localSha===remoteSha?remoteSha:(locallyEdited&&__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory changed both locally and remotely; keeping the remote version",{path:rel,memory_store_id:store.memoryStoreId}),pulls.push([rel,remote]),baseSha):localChanged?store.refusedShas.get(rel)===localSha?remoteSha:await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_upload).call(this,store,rel,localSha,remote)??remoteSha:remoteSha},_SessionMemoryStores_removeLocal=async function(store,rel,expectSha){let freshSha;try{freshSha=await store.files.hashFile(rel)}catch(e){if(!(e instanceof FileStoreError)&&!isErrno(e))throw e;return expectSha}if(freshSha!==null){if(freshSha!==expectSha)return freshSha;try{await store.files.remove(rel)}catch(e){if(!(e instanceof FileStoreError)&&!isErrno(e))throw e;return __classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to remove memory deleted remotely",{path:rel,memory_store_id:store.memoryStoreId,error:String(e)}),expectSha}}},_SessionMemoryStores_write=async function(store,rel,content){try{await store.files.put(rel,content)}catch(e){if(!(e instanceof FileStoreError)&&!isErrno(e))throw e;return __classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to write memory",{path:rel,memory_store_id:store.memoryStoreId,error:String(e)}),!1}return!0},_SessionMemoryStores_pullAll=async function(store,pulls){if(pulls.length===0)return;let pullOne=async(rel,listed)=>{let item;try{item=await __classPrivateFieldGet(this,_SessionMemoryStores_client,"f").beta.memoryStores.memories.retrieve(listed.id,{memory_store_id:store.memoryStoreId,view:"full"})}catch(e){if(isStatus(e,404))return;__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to fetch memory content",{path:rel,memory_store_id:store.memoryStoreId,error:String(e)});return}await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_write).call(this,store,rel,item.content??"")&&store.baseline.set(rel,item.content_sha256)},queue=pulls[Symbol.iterator](),worker=async()=>{for(let[rel,listed]of queue)await pullOne(rel,listed)};await Promise.all(Array.from({length:Math.min(FETCH_CONCURRENCY,pulls.length)},worker))},_SessionMemoryStores_uploadAll=async function(store,uploads,unsent,signal){let queue=uploads[Symbol.iterator](),worker=async()=>{for(let[rel,localSha,existing]of queue){if(signal?.aborted)return;let sha=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_upload).call(this,store,rel,localSha,existing);unsent.delete(rel),sha!==void 0&&store.baseline.set(rel,sha)}};await Promise.all(Array.from({length:Math.min(UPLOAD_CONCURRENCY,uploads.length)},worker))},_SessionMemoryStores_listMemories=async function*(memoryStoreId,view="basic"){let limit=view==="basic"?LIST_PAGE_SIZE:FULL_LIST_PAGE_SIZE;for await(let item of __classPrivateFieldGet(this,_SessionMemoryStores_client,"f").beta.memoryStores.memories.list(memoryStoreId,{view,limit})){if(item.type!=="memory")continue;let rel=item.path.replace(/^\/+/,"");if(rel===MARKER_PATH){__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("the server listed the reserved marker path; skipping",{path:item.path,memory_store_id:memoryStoreId});continue}yield[rel,item]}},_SessionMemoryStores_upload=async function _SessionMemoryStores_upload2(store,rel,localSha,existing){try{let data=await store.files.get(rel);if(data===null)return;let content=decodeUTF8(data),item=existing?await __classPrivateFieldGet(this,_SessionMemoryStores_client,"f").beta.memoryStores.memories.update(existing.id,{memory_store_id:store.memoryStoreId,content,precondition:{type:"content_sha256",content_sha256:existing.content_sha256}}):await __classPrivateFieldGet(this,_SessionMemoryStores_client,"f").beta.memoryStores.memories.create(store.memoryStoreId,{path:"/"+rel,content});return store.refusedShas.delete(rel),item.content_sha256}catch(e){if(existing&&isStatus(e,404))return await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_upload2).call(this,store,rel,localSha,void 0);let permanent=e instanceof FileStoreError||isStatus(e,400)||isStatus(e,413);existing&&isStatus(e,409)?__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory changed both locally and remotely; the upload was refused and the local edit loses",{path:rel,memory_store_id:store.memoryStoreId}):permanent&&localSha!==void 0?(store.refusedShas.set(rel,localSha),__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("the server rejected this memory file, so it stays un-synced until its content changes",{path:rel,memory_store_id:store.memoryStoreId,rejection:String(e)})):__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to upload memory",{path:rel,memory_store_id:store.memoryStoreId,error:String(e)});return}},_SessionMemoryStores_corroboratedDelete=async function(store,rel,remote,baseSha,deletes){if(deletes.mode==="disabled")return deletes.suppressed++,baseSha;let firstAbsent=store.pendingDeletes.get(rel);if(firstAbsent===void 0&&(firstAbsent=Date.now(),store.pendingDeletes.set(rel,firstAbsent)),!deletes.waiveWindow&&Date.now()-firstAbsent<DELETE_CORROBORATION_MS)return baseSha;let markerOk,stillAbsent;try{markerOk=await store.files.hashFile(MARKER_PATH)===markerSha(store.memoryStoreId),stillAbsent=await store.files.hashFile(rel)===null}catch(e){if(!(e instanceof FileStoreError)&&!isErrno(e))throw e;markerOk=stillAbsent=!1}if(!markerOk)return baseSha;if(!stillAbsent)return store.pendingDeletes.delete(rel),baseSha;if(!deletes.takeSlot())return baseSha;if(deletes.mode==="log_only")return __classPrivateFieldGet(this,_SessionMemoryStores_log,"f").info("log-only: sync would delete this memory on the server",{path:rel,memory_store_id:store.memoryStoreId}),baseSha;let sha=await __classPrivateFieldGet(this,_SessionMemoryStores_instances,"m",_SessionMemoryStores_deleteRemote).call(this,store,rel,remote,baseSha);return sha===void 0&&store.pendingDeletes.delete(rel),sha},_SessionMemoryStores_deleteRemote=async function(store,rel,remote,baseSha){try{await __classPrivateFieldGet(this,_SessionMemoryStores_client,"f").beta.memoryStores.memories.delete(remote.id,{memory_store_id:store.memoryStoreId,expected_content_sha256:baseSha})}catch(e){return isStatus(e,404)?void 0:(isStatus(e,409)||isStatus(e,412)?__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("memory deleted locally but changed remotely; keeping the remote version",{path:rel,memory_store_id:store.memoryStoreId}):__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").warn("failed to delete memory",{path:rel,memory_store_id:store.memoryStoreId,error:String(e)}),baseSha)}__classPrivateFieldGet(this,_SessionMemoryStores_log,"f").info("propagated local deletion",{path:rel,memory_store_id:store.memoryStoreId})};function isErrno(e){return typeof e=="object"&&e!==null&&typeof e.code=="string"}async function settledOrAborted(p,signal){if(!signal){await p;return}let onAbort,aborted=new Promise(resolve5=>{onAbort=resolve5,signal.aborted&&resolve5()});signal.addEventListener("abort",onAbort,{once:!0});try{await Promise.race([p,aborted])}finally{signal.removeEventListener("abort",onAbort)}}var _BashSession_instances,_BashSession_proc,_BashSession_buf,_BashSession_truncated,_BashSession_closed,_BashSession_waiting,_BashSession_append,BASH_OUTPUT_LIMIT=100*1024,BASH_DEFAULT_TIMEOUT_MS=12e4,DEFAULT_MAX_FILE_BYTES=256*1024,GREP_OUTPUT_LIMIT=100*1024,GREP_MAX_LINE_LENGTH=2e3,GLOB_RESULT_LIMIT=200,BashTimeoutError=class extends AnthropicError{constructor(timeoutMs){super(`bash command timed out after ${timeoutMs}ms`),this.name="BashTimeoutError",this.timeoutMs=timeoutMs}},ANSI_RE=/\x1b\[[0-9;?]*[ -/]*[@-~]/g,fsGlob=fs3.glob;function resolveMaxBytes(configured){return configured===void 0?DEFAULT_MAX_FILE_BYTES:configured}function rejectUnrestrictedPaths(value){if(value!==void 0)throw new AnthropicError("The `unrestrictedPaths` option you passed to the agent toolset (AgentToolContext) is no longer supported. The toolset's file tools (read, write, edit, glob, grep) are now always confined to the working directory plus the directories listed in `allowedRoots`. Remove `unrestrictedPaths` from your context; to let the file tools reach any other directory, add it to `allowedRoots`.")}function betaAgentToolset20260401(ctx){return[betaBashTool(ctx),betaReadTool(ctx),betaWriteTool(ctx),betaEditTool(ctx),betaGlobTool(ctx),betaGrepTool(ctx)]}async function resolvePath(ctx,p){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),confineToRoot(ctx.workdir,p,{allowedRoots:ctx.allowedRoots??[]})}function readOnlyRootFor(ctx,target){return containingRoot(ctx.readOnlyRoots??[],target)}function scrubbedShellEnv(){let env={};for(let[key,value]of Object.entries(process.env))key.startsWith("ANTHROPIC_")||(env[key]=value);return env}var BashSession=class{constructor(dir,env=scrubbedShellEnv()){_BashSession_instances.add(this),_BashSession_proc.set(this,void 0),_BashSession_buf.set(this,""),_BashSession_truncated.set(this,!1),_BashSession_closed.set(this,!1),_BashSession_waiting.set(this,null),__classPrivateFieldSet(this,_BashSession_proc,cp.spawn("/bin/bash",["--noprofile","--norc"],{cwd:dir,env:{...env,PS1:"",PS2:"",TERM:"dumb"},stdio:["pipe","pipe","pipe"],detached:!0}),"f"),__classPrivateFieldGet(this,_BashSession_proc,"f").stdout.setEncoding("utf8"),__classPrivateFieldGet(this,_BashSession_proc,"f").stderr.setEncoding("utf8"),__classPrivateFieldGet(this,_BashSession_proc,"f").stdout.on("data",d=>__classPrivateFieldGet(this,_BashSession_instances,"m",_BashSession_append).call(this,d)),__classPrivateFieldGet(this,_BashSession_proc,"f").stderr.on("data",d=>__classPrivateFieldGet(this,_BashSession_instances,"m",_BashSession_append).call(this,d)),__classPrivateFieldGet(this,_BashSession_proc,"f").once("close",()=>{__classPrivateFieldSet(this,_BashSession_closed,!0,"f");let w=__classPrivateFieldGet(this,_BashSession_waiting,"f");__classPrivateFieldSet(this,_BashSession_waiting,null,"f"),w?.resolve()})}get closed(){return __classPrivateFieldGet(this,_BashSession_closed,"f")}async exec(command,opts={}){if(__classPrivateFieldGet(this,_BashSession_closed,"f"))throw new AnthropicError("bash session terminated");let timeoutMs=opts.timeoutMs??BASH_DEFAULT_TIMEOUT_MS,signal=opts.signal;signal?.throwIfAborted(),__classPrivateFieldSet(this,_BashSession_buf,"","f"),__classPrivateFieldSet(this,_BashSession_truncated,!1,"f");let sentinel=`__ANT_CMD_${crypto.randomUUID()}_DONE__`,sentinelSplit=`${sentinel.slice(0,8)}''${sentinel.slice(8)}`,wrapped=`{ ${command}
-} </dev/null 2>&1; printf '\\n${sentinelSplit}%d\\n' $?
-`;if(__classPrivateFieldGet(this,_BashSession_proc,"f").stdin.write(wrapped),__classPrivateFieldGet(this,_BashSession_buf,"f").indexOf(sentinel)<0){let{promise:sentinelSeen,resolve:resolve5}=promiseWithResolvers();__classPrivateFieldSet(this,_BashSession_waiting,{sentinel,resolve:resolve5},"f");let timer,onAbort;try{await Promise.race([sentinelSeen,new Promise((_,reject)=>{timer=setTimeout(()=>reject(new BashTimeoutError(timeoutMs)),timeoutMs)}),new Promise((_,reject)=>{signal&&(onAbort=()=>reject(signal.reason),signal.addEventListener("abort",onAbort,{once:!0}))})])}finally{timer&&clearTimeout(timer),onAbort&&signal&&signal.removeEventListener("abort",onAbort),__classPrivateFieldSet(this,_BashSession_waiting,null,"f")}}let idx=__classPrivateFieldGet(this,_BashSession_buf,"f").indexOf(sentinel);if(idx<0)throw new AnthropicError("bash session terminated");let m=__classPrivateFieldGet(this,_BashSession_buf,"f").slice(idx+sentinel.length).match(/^(-?\d+)/),exitCode=m?parseInt(m[1],10):-1,out=__classPrivateFieldGet(this,_BashSession_buf,"f").slice(0,idx).replace(ANSI_RE,"").replace(/\n+$/,"");return __classPrivateFieldGet(this,_BashSession_truncated,"f")&&(out=`[output truncated]
-${out}`),{output:out,exitCode}}close(){if(__classPrivateFieldGet(this,_BashSession_closed,"f"))return;__classPrivateFieldSet(this,_BashSession_closed,!0,"f");let w=__classPrivateFieldGet(this,_BashSession_waiting,"f");__classPrivateFieldSet(this,_BashSession_waiting,null,"f"),w?.resolve(),__classPrivateFieldGet(this,_BashSession_proc,"f").stdout.destroy(),__classPrivateFieldGet(this,_BashSession_proc,"f").stderr.destroy(),__classPrivateFieldGet(this,_BashSession_proc,"f").stdin.destroy();try{process.kill(-__classPrivateFieldGet(this,_BashSession_proc,"f").pid,"SIGKILL")}catch{__classPrivateFieldGet(this,_BashSession_proc,"f").kill("SIGKILL")}__classPrivateFieldGet(this,_BashSession_proc,"f").unref()}};_BashSession_proc=new WeakMap,_BashSession_buf=new WeakMap,_BashSession_truncated=new WeakMap,_BashSession_closed=new WeakMap,_BashSession_waiting=new WeakMap,_BashSession_instances=new WeakSet,_BashSession_append=function(d){if(__classPrivateFieldSet(this,_BashSession_buf,__classPrivateFieldGet(this,_BashSession_buf,"f")+d,"f"),__classPrivateFieldGet(this,_BashSession_buf,"f").length>BASH_OUTPUT_LIMIT&&(__classPrivateFieldSet(this,_BashSession_buf,__classPrivateFieldGet(this,_BashSession_buf,"f").slice(__classPrivateFieldGet(this,_BashSession_buf,"f").length-BASH_OUTPUT_LIMIT),"f"),__classPrivateFieldSet(this,_BashSession_truncated,!0,"f")),__classPrivateFieldGet(this,_BashSession_waiting,"f")&&__classPrivateFieldGet(this,_BashSession_buf,"f").indexOf(__classPrivateFieldGet(this,_BashSession_waiting,"f").sentinel)>=0){let w=__classPrivateFieldGet(this,_BashSession_waiting,"f");__classPrivateFieldSet(this,_BashSession_waiting,null,"f"),w.resolve()}};function betaBashTool(ctx){rejectUnrestrictedPaths(ctx.unrestrictedPaths);let session,tail=Promise.resolve();return betaTool({name:"bash",description:"Run a bash command in a persistent shell. State (cwd, env vars) persists across calls.",inputSchema:{type:"object",properties:{command:{type:"string",description:"The command to run"},restart:{type:"boolean",description:"Restart the persistent shell before running"},timeout_ms:{type:"integer",description:"Per-call timeout in milliseconds"}}},run:async({command,restart,timeout_ms},context)=>{let prev=tail,gate=promiseWithResolvers();tail=gate.promise;try{await prev}catch{}try{if(restart&&(session?.close(),session=void 0),!command){if(restart)return"bash session restarted";throw new ToolError("bash: command is required")}session??(session=new BashSession(ctx.workdir,ctx.env));try{let{output,exitCode}=await session.exec(command,{timeoutMs:timeout_ms??BASH_DEFAULT_TIMEOUT_MS,signal:context?.signal});if(exitCode!==0)throw new ToolError(output||`exit ${exitCode}`);return output}catch(e){throw e instanceof ToolError?e:(session.close(),session=void 0,new ToolError(`bash: ${e instanceof Error?e.message:String(e)}`))}}finally{gate.resolve()}},close:()=>{session?.close(),session=void 0}})}function betaReadTool(ctx){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),betaTool({name:"read",description:"Read a UTF-8 text file relative to the workdir.",inputSchema:{type:"object",properties:{file_path:{type:"string"},view_range:{type:"array",items:{type:"integer"},description:"[start_line, end_line] 1-indexed inclusive"}},required:["file_path"]},run:async({file_path,view_range})=>{if(!file_path)throw new ToolError("read: file_path is required");let abs=await resolvePath(ctx,file_path),data;try{let st=await fs3.stat(abs);if(!st.isFile())throw new ToolError(`read: ${file_path} is not a regular file`);let limit=resolveMaxBytes(ctx.maxFileBytes);if(limit!==null&&st.size>limit)throw new ToolError(`read: ${file_path} is ${st.size} bytes, exceeds ${limit}-byte limit. Use bash (head/tail/sed) to read a slice.`);data=await fs3.readFile(abs,"utf8")}catch(e){throw e instanceof ToolError?e:new ToolError(`read: ${fsErrorMessage(e,file_path)}`)}if(!view_range?.length)return data;if(view_range.length!==2)throw new ToolError("read: view_range must be [start_line, end_line]");let[startLine,endLine]=view_range,lines=data.split(`
-`),start=Math.max(0,startLine-1),end=endLine>0?endLine:lines.length;return lines.slice(start,end).join(`
-`)}})}function betaWriteTool(ctx){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),betaTool({name:"write",description:"Write a UTF-8 text file relative to the workdir, creating parent directories as needed.",inputSchema:{type:"object",properties:{file_path:{type:"string"},content:{type:"string"}},required:["file_path","content"]},run:async({file_path,content})=>{if(!file_path)throw new ToolError("write: file_path is required");let abs=await resolvePath(ctx,file_path),ro=await readOnlyRootFor(ctx,abs);if(ro!==void 0)throw new ToolError(`write: ${file_path} is inside read-only directory ${ro}`);try{await fs3.mkdir(path5.dirname(abs),{recursive:!0,mode:DIR_CREATE_MODE}),await atomicWriteFile(abs,content??"")}catch(e){throw new ToolError(`write: ${fsErrorMessage(e,file_path)}`)}return`wrote ${Buffer.byteLength(content??"")} bytes to ${file_path}`}})}function betaEditTool(ctx){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),betaTool({name:"edit",description:"Replace old_string with new_string in a file. old_string must be unique unless replace_all.",inputSchema:{type:"object",properties:{file_path:{type:"string"},old_string:{type:"string"},new_string:{type:"string"},replace_all:{type:"boolean"}},required:["file_path","old_string","new_string"]},run:async({file_path,old_string,new_string,replace_all})=>{if(!file_path)throw new ToolError("edit: file_path is required");if(!old_string)throw new ToolError("edit: old_string is required");let abs=await resolvePath(ctx,file_path),ro=await readOnlyRootFor(ctx,abs);if(ro!==void 0)throw new ToolError(`edit: ${file_path} is inside read-only directory ${ro}`);let data;try{let st=await fs3.stat(abs);if(!st.isFile())throw new ToolError(`edit: ${file_path} is not a regular file`);let limit=resolveMaxBytes(ctx.maxFileBytes);if(limit!==null&&st.size>limit)throw new ToolError(`edit: ${file_path} is ${st.size} bytes, exceeds ${limit}-byte limit. Use bash (sed/awk) to edit a large file.`);data=await fs3.readFile(abs,"utf8")}catch(e){throw e instanceof ToolError?e:new ToolError(`edit: ${fsErrorMessage(e,file_path)}`)}let count=data.split(old_string).length-1;if(count===0)throw new ToolError(`edit: old_string not found in ${file_path}`);let updated;if(replace_all)updated=data.split(old_string).join(new_string);else{if(count>1)throw new ToolError(`edit: old_string appears ${count} times in ${file_path} (must be unique)`);updated=data.replace(old_string,()=>new_string)}try{await atomicWriteFile(abs,updated)}catch(e){throw new ToolError(`edit: write: ${fsErrorMessage(e,file_path)}`)}return`edited ${file_path} (${replace_all?count:1} replacement(s))`}})}function patternCanAscend(pattern){return pattern.split(/[\\/{},]/).includes("..")}function betaGlobTool(ctx){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),betaTool({name:"glob",description:"Match files under the workdir against a glob pattern. Results are mtime-sorted, newest first.",inputSchema:{type:"object",properties:{pattern:{type:"string"},path:{type:"string",description:"Directory to search in. Defaults to the workdir."}},required:["pattern"]},run:async({pattern,path:searchPath})=>{if(!pattern)throw new ToolError("glob: pattern is required");if(path5.isAbsolute(pattern))throw new ToolError("glob: absolute pattern not permitted; pass a relative pattern (and optionally path)");if(patternCanAscend(pattern))throw new ToolError('glob: ".." is not permitted in the pattern');let root=searchPath?await resolvePath(ctx,searchPath):path5.resolve(ctx.workdir),realRoot=searchPath?root:await canonicalize(root),matches=[],remaining=WALK_MAX_ENTRIES;try{for await(let entry of fsGlob(pattern,{cwd:root,withFileTypes:!0,exclude:d=>d.name===".git"||d.name==="node_modules"})){if(remaining--<=0)break;if(!entry.isFile())continue;let full=path5.join(entry.parentPath,entry.name),real;try{real=await fs3.realpath(full)}catch{continue}if(!isWithin(realRoot,real))continue;let mtime=0;try{mtime=(await fs3.stat(full)).mtimeMs}catch{}matches.push({path:full,mtime})}}catch(e){throw new ToolError(`glob: ${e instanceof Error?e.message:String(e)}`)}return matches.length===0?"no matches":(matches.sort((a,b)=>b.mtime-a.mtime),matches.slice(0,GLOB_RESULT_LIMIT).map(m=>m.path).join(`
-`))}})}function betaGrepTool(ctx){return rejectUnrestrictedPaths(ctx.unrestrictedPaths),betaTool({name:"grep",description:"Search file contents for a regex. Uses ripgrep if available, otherwise a built-in walker.",inputSchema:{type:"object",properties:{pattern:{type:"string"},path:{type:"string"}},required:["pattern"]},run:async({pattern,path:p},context)=>{if(!pattern)throw new ToolError("grep: pattern is required");let searchPath=path5.resolve(ctx.workdir);p&&(searchPath=await resolvePath(ctx,p));let rg=await findRg();return rg?runRipgrep(rg,pattern,searchPath,context?.signal):runWalkGrep(pattern,searchPath,context?.signal)}})}function runRipgrep(rg,pattern,searchPath,signal){return new Promise((resolve5,reject)=>{let proc=cp.spawn(rg,["-n","--no-heading","-e",pattern,"--",searchPath],{...signal?{signal}:{}}),out="",errOut="",truncated=!1;proc.stdout.on("data",d=>{truncated||(out+=d,out.length>GREP_OUTPUT_LIMIT&&(truncated=!0,out=out.slice(0,GREP_OUTPUT_LIMIT),proc.kill("SIGKILL")))}),proc.stderr.on("data",d=>errOut+=d),proc.on("close",code=>{if(signal?.aborted)return reject(new ToolError("grep: aborted"));if(truncated)return resolve5(out+`
-[output truncated at ${GREP_OUTPUT_LIMIT} bytes]`);if(code===0)return resolve5(out);if(code===1)return resolve5("no matches");reject(new ToolError(`grep: rg failed: ${errOut||`exit ${code}`}`))}),proc.on("error",e=>{if(signal?.aborted)return reject(new ToolError("grep: aborted"));reject(new ToolError(`grep: rg failed: ${e.message}`))})})}async function runWalkGrep(pattern,root,signal){let re;try{re=new RegExp(pattern)}catch(e){throw new ToolError(`grep: invalid regex: ${e instanceof Error?e.message:String(e)}`)}let hits=[],budget=GREP_OUTPUT_LIMIT,push=line=>(budget-=line.length+1,budget<0?(hits.push(`[output truncated at ${GREP_OUTPUT_LIMIT} bytes]`),!1):(hits.push(line),!0));if((await fs3.stat(root).catch(()=>null))?.isFile()?await grepFile(root,re,push):await walk2(root,"",rel=>grepFile(path5.join(root,rel),re,push),signal),signal?.aborted)throw new ToolError("grep: aborted");return hits.length===0?"no matches":hits.join(`
-`)}async function grepFile(file,re,push){let stream=fssync2.createReadStream(file,{encoding:"utf8"}),rl=readline.createInterface({input:stream,crlfDelay:1/0}),i=0;try{for await(let line of rl)if(i++,!(line.length>GREP_MAX_LINE_LENGTH)&&re.test(line)&&!push(`${file}:${i}:${line}`))return!1}catch{}finally{stream.destroy()}return!0}var WALK_MAX_DEPTH=40,WALK_MAX_ENTRIES=5e4;async function walk2(root,rel,fn,signal){let remaining=WALK_MAX_ENTRIES;async function inner(rel2,depth){if(depth>WALK_MAX_DEPTH)return!0;if(signal?.aborted)return!1;let entries;try{entries=await fs3.readdir(path5.join(root,rel2),{withFileTypes:!0})}catch{return!0}for(let e of entries){if(e.name===".git"||e.name==="node_modules")continue;if(remaining--<=0||signal?.aborted)return!1;let childRel=rel2?path5.join(rel2,e.name):e.name;if(e.isDirectory()){if(!await inner(childRel,depth+1))return!1}else if(e.isFile()&&await fn(childRel)===!1)return!1}return!0}await inner(rel,0)}async function findRg(){let dirs=(process.env.PATH??"").split(path5.delimiter);for(let d of dirs){let candidate=path5.join(d,"rg");try{return await fs3.access(candidate,fssync2.constants.X_OK),candidate}catch{}}return null}export{BashSession,BashTimeoutError,DEFAULT_MEMORY_SYNC_INTERVAL_MS,MARKER_PATH,MEMORY_FLUSH_TIMEOUT_MS,MIN_MEMORY_SYNC_INTERVAL_MS,SessionMemoryError,SessionMemoryStores,betaAgentToolset20260401,betaBashTool,betaEditTool,betaGlobTool,betaGrepTool,betaReadTool,betaWriteTool,extractSkillArchive,resolvePath,resolveSkillVersion,setupSkills};

package/dist/bundle/chunks/openai-codex-responses-HRVCDY54.js

@@ -1,8 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-import{convertResponsesMessages,convertResponsesTools,processResponsesStream}from"./chunk-H2O6VOXT.js";import{registerSessionResourceCleanup,uuidv7}from"./chunk-JUUC5AZY.js";import{clampOpenAIPromptCacheKey}from"./chunk-PRRNXB7S.js";import{formatProviderError,normalizeProviderError}from"./chunk-TEPMHNKQ.js";import"./chunk-PJACZCIR.js";import{splitDeferredTools}from"./chunk-GMWCTUPB.js";import{buildBaseOptions,createGrammarToolInputProperties,getPiUserAgent}from"./chunk-TXBQIIIO.js";import"./chunk-L2ZPNLYD.js";import{headersToRecord}from"./chunk-6R7UI4IY.js";import{getProviderEnvValue}from"./chunk-7DDKXS2Q.js";import"./chunk-D7XAASZM.js";import{clampThinkingLevel}from"./chunk-WJZ4KLGL.js";import{AssistantMessageEventStream,appendAssistantMessageDiagnostic,createAssistantMessageDiagnostic,formatThrownValue}from"./chunk-72KO4OMP.js";import"./chunk-JXWJOIH4.js";function combineAbortSignals(signals){let activeSignals=signals.filter(signal=>signal!==void 0);if(activeSignals.length===0)return{cleanup:()=>{}};if(activeSignals.length===1)return{signal:activeSignals[0],cleanup:()=>{}};let controller=new AbortController,listeners=[],abort=signal=>{controller.signal.aborted||controller.abort(signal.reason)};for(let signal of activeSignals){if(signal.aborted){abort(signal);break}let listener=()=>abort(signal);signal.addEventListener("abort",listener,{once:!0}),listeners.push({signal,listener})}return{signal:controller.signal,cleanup:()=>{for(let{signal,listener}of listeners)signal.removeEventListener("abort",listener)}}}var DEFAULT_PROXY_PORTS={ftp:21,gopher:70,http:80,https:443,ws:80,wss:443};function getProxyEnv(key,env){let lowercaseKey=key.toLowerCase(),uppercaseKey=key.toUpperCase();return env?.[lowercaseKey]||env?.[uppercaseKey]||getProviderEnvValue(lowercaseKey)||getProviderEnvValue(uppercaseKey)||""}function parseProxyTargetUrl(targetUrl){if(targetUrl instanceof URL)return targetUrl;try{return new URL(targetUrl)}catch{return}}function shouldProxyHostname(hostname,port,env){let noProxy=getProxyEnv("no_proxy",env).toLowerCase();return noProxy?noProxy==="*"?!1:noProxy.split(/[,\s]/).every(proxy=>{if(!proxy)return!0;let parsedProxy=proxy.match(/^(.+):(\d+)$/),proxyHostname=parsedProxy?parsedProxy[1]:proxy,proxyPort=parsedProxy?Number.parseInt(parsedProxy[2],10):0;return proxyPort&&proxyPort!==port?!0:/^[.*]/.test(proxyHostname)?(proxyHostname.startsWith("*")&&(proxyHostname=proxyHostname.slice(1)),!hostname.endsWith(proxyHostname)):hostname!==proxyHostname}):!0}function getProxyForUrl(targetUrl,env){let parsedUrl=parseProxyTargetUrl(targetUrl);if(!parsedUrl?.protocol||!parsedUrl.host)return"";let protocol=parsedUrl.protocol.split(":",1)[0],hostname=parsedUrl.host.replace(/:\d*$/,""),port=Number.parseInt(parsedUrl.port,10)||DEFAULT_PROXY_PORTS[protocol]||0;if(!shouldProxyHostname(hostname,port,env))return"";let proxy=getProxyEnv(`${protocol}_proxy`,env)||getProxyEnv("all_proxy",env);return proxy&&!proxy.includes("://")&&(proxy=`${protocol}://${proxy}`),proxy}var UNSUPPORTED_PROXY_PROTOCOL_MESSAGE="Unsupported proxy protocol. SOCKS and PAC proxy URLs are not supported; use an HTTP or HTTPS proxy URL.";function resolveHttpProxyUrlForTarget(targetUrl,env){let proxy=getProxyForUrl(targetUrl,env);if(!proxy)return;let proxyUrl;try{proxyUrl=new URL(proxy)}catch(error){throw new Error(`Invalid proxy URL ${JSON.stringify(proxy)}: ${error instanceof Error?error.message:String(error)}`)}if(proxyUrl.protocol!=="http:"&&proxyUrl.protocol!=="https:")throw new Error(`${UNSUPPORTED_PROXY_PROTOCOL_MESSAGE} Got ${proxyUrl.protocol}`);return proxyUrl}var DEFAULT_CODEX_BASE_URL="https://chatgpt.com/backend-api",JWT_CLAIM_PATH="https://api.openai.com/auth",DEFAULT_MAX_RETRIES=0,BASE_DELAY_MS=1e3,DEFAULT_MAX_RETRY_DELAY_MS=6e4,DEFAULT_WEBSOCKET_CONNECT_TIMEOUT_MS=15e3,REQUEST_COMPRESSION_ZSTD_LEVEL=3,CODEX_TOOL_CALL_PROVIDERS=new Set(["openai","openai-codex","opencode"]),WEBSOCKET_MESSAGE_TOO_BIG_CLOSE_CODE=1009,WEBSOCKET_CONNECTION_LIMIT_REACHED_CODE="websocket_connection_limit_reached",PREVIOUS_RESPONSE_NOT_FOUND_CODE="previous_response_not_found",CODEX_RESPONSE_STATUSES=new Set(["completed","incomplete","failed","cancelled","queued","in_progress"]);function assertSuccessfulOutput(output){if(output.stopReason==="pending")throw new Error("Codex stream ended without a stop reason");if(output.stopReason==="error"||output.stopReason==="aborted")throw new Error(output.errorMessage||"An unknown error occurred")}function isTerminalRateLimitError(errorText){return/GoUsageLimitError|FreeUsageLimitError|Monthly usage limit reached|available balance|insufficient_quota|out of budget|quota exceeded|billing/i.test(errorText)}function isRetryableError(status,errorText){return status===429&&isTerminalRateLimitError(errorText)?!1:status===429||status===500||status===502||status===503||status===504?!0:/rate.?limit|overloaded|service.?unavailable|upstream.?connect|connection.?refused/i.test(errorText)}function getRetryAfterDelayMs(headers){let retryAfterMs=headers.get("retry-after-ms");if(retryAfterMs!==null){let millis=Number(retryAfterMs);if(Number.isFinite(millis))return Math.max(0,millis)}let retryAfter=headers.get("retry-after");if(!retryAfter)return;let seconds=Number(retryAfter);if(Number.isFinite(seconds))return Math.max(0,seconds*1e3);let date=Date.parse(retryAfter);if(!Number.isNaN(date))return Math.max(0,date-Date.now())}var RetryDelayExceededError=class extends Error{};function validateRetryDelayMs(delayMs,options){let maxRetryDelayMs=options?.maxRetryDelayMs??DEFAULT_MAX_RETRY_DELAY_MS;if(maxRetryDelayMs>0&&delayMs>maxRetryDelayMs)throw new RetryDelayExceededError(`Server requested ${Math.ceil(delayMs/1e3)}s retry delay (max: ${Math.ceil(maxRetryDelayMs/1e3)}s)`);return delayMs}function sleep(ms,signal){return new Promise((resolve,reject)=>{if(signal?.aborted){reject(new Error("Request was aborted"));return}let timeout=setTimeout(resolve,ms);signal?.addEventListener("abort",()=>{clearTimeout(timeout),reject(new Error("Request was aborted"))})})}function normalizeTimeoutMs(value){if(value!==void 0){if(!Number.isFinite(value)||value<0)throw new Error(`Invalid timeoutMs: ${String(value)}`);return Math.floor(value)}}function loadNodeZlib(){return typeof process>"u"||!(process.versions?.node||process.versions?.bun)?null:process.getBuiltinModule?.("node:zlib")??null}function compressRequestBodyZstd(bodyJson){let zlib=loadNodeZlib();if(!zlib||typeof zlib.zstdCompressSync!="function")return null;try{let compressed=zlib.zstdCompressSync(bodyJson,{params:{[zlib.constants.ZSTD_c_compressionLevel]:REQUEST_COMPRESSION_ZSTD_LEVEL}});return Uint8Array.from(compressed)}catch{return null}}var stream=(model,context,options)=>{let stream2=new AssistantMessageEventStream;return(async()=>{let output={role:"assistant",content:[],api:"openai-codex-responses",provider:model.provider,model:model.id,usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:"pending",timestamp:Date.now()};try{let apiKey=options?.apiKey;if(!apiKey)throw new Error(`No API key for provider: ${model.provider}`);let accountId=extractAccountId(apiKey),grammarToolInputProperties=createGrammarToolInputProperties(context.tools,model.compat?.supportsOpenAIGrammarTools??!1),cacheSessionId=options?.cacheRetention==="none"?void 0:options?.sessionId,codexSessionId=clampOpenAIPromptCacheKey(cacheSessionId),body=buildRequestBody(model,context,options,codexSessionId,grammarToolInputProperties),nextBody=await options?.onPayload?.(body,model);nextBody!==void 0&&(body=nextBody);let websocketRequestId=codexSessionId||uuidv7(),sseHeaders=buildSSEHeaders(model.headers,options?.headers,accountId,apiKey,codexSessionId),websocketHeaders=buildWebSocketHeaders(model.headers,options?.headers,accountId,apiKey,websocketRequestId),bodyJson=JSON.stringify(body),httpTimeoutMs=normalizeTimeoutMs(options?.timeoutMs),websocketConnectTimeoutMs=normalizeTimeoutMs(options?.websocketConnectTimeoutMs),transport=options?.transport||"auto",startEmitted=!1,websocketDisabledForSession=transport!=="sse"&&isWebSocketSseFallbackActive(cacheSessionId);if(websocketDisabledForSession&&recordWebSocketSseFallback(cacheSessionId),transport!=="sse"&&!websocketDisabledForSession){let websocketStarted=!1,retriedWebSocketConnectionLimit=!1,retriedMissingWebSocketContinuation=!1;for(;;){websocketStarted=!1;try{if(await processWebSocketStream(resolveCodexWebSocketUrl(model.baseUrl),body,websocketHeaders,output,stream2,model,()=>{websocketStarted=!0,startEmitted||(startEmitted=!0,stream2.push({type:"start",partial:output}))},httpTimeoutMs,websocketConnectTimeoutMs,cacheSessionId,accountId,grammarToolInputProperties,options),options?.signal?.aborted)throw new Error("Request was aborted");assertSuccessfulOutput(output),stream2.push({type:"done",reason:output.stopReason,message:output}),stream2.end();return}catch(error){let aborted=options?.signal?.aborted,connectionLimitBeforeStart=!websocketStarted&&isWebSocketConnectionLimitReachedError(error),previousResponseNotFound=isPreviousResponseNotFoundError(error);if(!aborted&&previousResponseNotFound&&!retriedMissingWebSocketContinuation){retriedMissingWebSocketContinuation=!0;continue}if(!aborted&&connectionLimitBeforeStart&&!retriedWebSocketConnectionLimit){retriedWebSocketConnectionLimit=!0;continue}if(aborted||isCodexNonTransportError(error)&&!connectionLimitBeforeStart||(appendAssistantMessageDiagnostic(output,createAssistantMessageDiagnostic("provider_transport_failure",error,{configuredTransport:transport,fallbackTransport:websocketStarted?void 0:"sse",eventsEmitted:websocketStarted,phase:websocketStarted?"after_message_stream_start":"before_message_stream_start",requestBytes:new TextEncoder().encode(bodyJson).byteLength})),recordWebSocketFailure(cacheSessionId,error),websocketStarted))throw error;recordWebSocketSseFallback(cacheSessionId);break}}}let compressedBody=compressRequestBodyZstd(bodyJson);compressedBody&&sseHeaders.set("content-encoding","zstd");let sseBody=compressedBody??bodyJson,response,lastError,maxRetries=options?.maxRetries??DEFAULT_MAX_RETRIES;for(let attempt=0;attempt<=maxRetries;attempt++){if(options?.signal?.aborted)throw new Error("Request was aborted");try{let headerTimeoutSignal=httpTimeoutMs!==void 0&&httpTimeoutMs>0?AbortSignal.timeout(httpTimeoutMs):void 0,combinedSignal=combineAbortSignals([options?.signal,headerTimeoutSignal]);try{response=await(options?.fetch??globalThis.fetch)(resolveCodexUrl(model.baseUrl),{method:"POST",headers:sseHeaders,body:sseBody,signal:combinedSignal.signal})}catch(error){throw headerTimeoutSignal?.aborted&&!options?.signal?.aborted?new Error(`Codex SSE response headers timed out after ${httpTimeoutMs}ms`):error}finally{combinedSignal.cleanup()}if(await options?.onResponse?.({status:response.status,headers:headersToRecord(response.headers)},model),response.ok)break;let errorText=await response.text();if(attempt<maxRetries&&isRetryableError(response.status,errorText)){let retryAfterDelayMs=getRetryAfterDelayMs(response.headers),delayMs=retryAfterDelayMs===void 0?BASE_DELAY_MS*2**attempt:validateRetryDelayMs(retryAfterDelayMs,options);await sleep(delayMs,options?.signal);continue}let fakeResponse=new Response(errorText,{status:response.status,statusText:response.statusText}),info=await parseErrorResponse(fakeResponse);throw new Error(info.friendlyMessage||info.message)}catch(error){if(error instanceof Error&&(error.name==="AbortError"||error.message==="Request was aborted"))throw new Error("Request was aborted");if(lastError=error instanceof Error?error:new Error(String(error)),attempt<maxRetries&&!(lastError instanceof RetryDelayExceededError)&&!lastError.message.includes("usage limit")){let delayMs=BASE_DELAY_MS*2**attempt;await sleep(delayMs,options?.signal);continue}throw lastError}}if(!response?.ok)throw lastError??new Error("Failed after retries");if(!response.body)throw new Error("No response body");if(startEmitted||(startEmitted=!0,stream2.push({type:"start",partial:output})),await processStream(response,output,stream2,model,grammarToolInputProperties,options),options?.signal?.aborted)throw new Error("Request was aborted");assertSuccessfulOutput(output),stream2.push({type:"done",reason:output.stopReason,message:output}),stream2.end()}catch(error){for(let block of output.content)delete block.partialJson,delete block.customInput;output.stopReason=options?.signal?.aborted?"aborted":"error",output.errorMessage=formatProviderError(normalizeProviderError(error)),stream2.push({type:"error",reason:output.stopReason,error:output}),stream2.end()}})(),stream2},streamSimple=(model,context,options)=>{let apiKey=options?.apiKey;if(!apiKey)throw new Error(`No API key for provider: ${model.provider}`);let base={...buildBaseOptions(model,context,options,apiKey),toolChoice:options?.toolChoice},clampedReasoning=options?.reasoning?clampThinkingLevel(model,options.reasoning):void 0;return stream(model,context,{...base,reasoningEffort:clampedReasoning==="off"?void 0:clampedReasoning})};function buildRequestBody(model,context,options,cacheSessionId,grammarToolInputProperties=createGrammarToolInputProperties(context.tools,model.compat?.supportsOpenAIGrammarTools??!1)){let supportsStrictMode=model.compat?.supportsStrictMode??!0,supportsOpenAIGrammarTools=model.compat?.supportsOpenAIGrammarTools??!1,deferredToolsMode=model.compat?.supportsAdditionalTools?"additional-tools":model.compat?.supportsToolSearch?"tool-search":void 0,toolPlacement=splitDeferredTools(context,deferredToolsMode!==void 0),messages=convertResponsesMessages(model,context,CODEX_TOOL_CALL_PROVIDERS,{includeSystemPrompt:!1,grammarToolInputProperties,deferredTools:toolPlacement.deferred,deferredToolsMode,toolOptions:{strict:null,supportsStrictMode,supportsOpenAIGrammarTools}}),body={model:model.id,store:!1,stream:!0,instructions:context.systemPrompt||"You are a helpful assistant.",input:messages,text:{verbosity:options?.textVerbosity||"low"},include:["reasoning.encrypted_content"],prompt_cache_key:cacheSessionId,tool_choice:options?.toolChoice??"auto",parallel_tool_calls:!0};if(options?.temperature!==void 0&&(body.temperature=options.temperature),options?.serviceTier!==void 0&&(body.service_tier=options.serviceTier),toolPlacement.immediate.length>0&&(body.tools=convertResponsesTools(toolPlacement.immediate,{strict:null,supportsStrictMode,supportsOpenAIGrammarTools})),options?.reasoningEffort!==void 0){let effort=options.reasoningEffort==="none"?model.thinkingLevelMap?.off??"none":model.thinkingLevelMap?.[options.reasoningEffort]??options.reasoningEffort;effort!==null&&(body.reasoning={effort,summary:options.reasoningSummary??"auto"})}return body}function getServiceTierCostMultiplier(model,serviceTier){switch(serviceTier){case"flex":return .5;case"priority":return model.id==="gpt-5.5"?2.5:2;default:return 1}}function applyServiceTierPricing(usage,serviceTier,model){let multiplier=getServiceTierCostMultiplier(model,serviceTier);multiplier!==1&&(usage.cost.input*=multiplier,usage.cost.output*=multiplier,usage.cost.cacheRead*=multiplier,usage.cost.cacheWrite*=multiplier,usage.cost.total=usage.cost.input+usage.cost.output+usage.cost.cacheRead+usage.cost.cacheWrite)}function resolveCodexServiceTier(responseServiceTier,requestServiceTier){return responseServiceTier==="default"&&(requestServiceTier==="flex"||requestServiceTier==="priority")?requestServiceTier:responseServiceTier??requestServiceTier}function resolveCodexUrl(baseUrl){let normalized=(baseUrl&&baseUrl.trim().length>0?baseUrl:DEFAULT_CODEX_BASE_URL).replace(/\/+$/,"");return normalized.endsWith("/codex/responses")?normalized:normalized.endsWith("/codex")?`${normalized}/responses`:`${normalized}/codex/responses`}function resolveCodexWebSocketUrl(baseUrl){let url=new URL(resolveCodexUrl(baseUrl));return url.protocol==="https:"&&(url.protocol="wss:"),url.protocol==="http:"&&(url.protocol="ws:"),url.toString()}async function processStream(response,output,stream2,model,grammarToolInputProperties,options){await processResponsesStream(mapCodexEvents(parseSSE(response,options?.signal),output),output,stream2,model,{serviceTier:options?.serviceTier,grammarToolInputProperties,resolveServiceTier:resolveCodexServiceTier,applyServiceTierPricing:(usage,serviceTier)=>applyServiceTierPricing(usage,serviceTier,model)})}var CodexApiError=class extends Error{constructor(message,options){super(message),this.name="CodexApiError",this.code=options?.code,this.payload=options?.payload,this.cause=options?.cause}},CodexProtocolError=class extends Error{constructor(message,options){super(message),this.name="CodexProtocolError",this.payload=options?.payload,this.cause=options?.cause}};function isCodexNonTransportError(error){return error instanceof CodexApiError||error instanceof CodexProtocolError}function isWebSocketConnectionLimitReachedError(error){return error instanceof CodexApiError&&error.code===WEBSOCKET_CONNECTION_LIMIT_REACHED_CODE}function isPreviousResponseNotFoundError(error){return error instanceof CodexApiError&&error.code===PREVIOUS_RESPONSE_NOT_FOUND_CODE}function extractCodexEventError(event){let nested=event.error&&typeof event.error=="object"?event.error:void 0;return{code:typeof event.code=="string"?event.code:typeof nested?.code=="string"?nested.code:void 0,message:typeof event.message=="string"?event.message:typeof nested?.message=="string"?nested.message:void 0}}async function*mapCodexEvents(events,output){for await(let event of events){let type=typeof event.type=="string"?event.type:void 0;if(type){if(type==="error"){let{code,message}=extractCodexEventError(event);throw new CodexApiError(`Codex error: ${message||code||JSON.stringify(event)}`,{code,payload:event})}if(type==="response.failed"){let response=event.response,code=response?.error?.code,message=response?.error?.message;throw new CodexApiError(message||"Codex response failed",{code,payload:event})}if(type==="response.done"||type==="response.completed"||type==="response.incomplete"){let response=event.response;typeof response?.end_turn=="boolean"&&(output.endTurn=response.end_turn);let normalizedResponse=response&&{...response,status:normalizeCodexStatus(response.status)};yield{...event,type:"response.completed",response:normalizedResponse};return}yield event}}}function normalizeCodexStatus(status){if(typeof status=="string")return CODEX_RESPONSE_STATUSES.has(status)?status:void 0}async function*parseSSE(response,signal){if(!response.body)return;let reader=response.body.getReader(),decoder=new TextDecoder,buffer="",onAbort=()=>{reader.cancel().catch(()=>{})};signal?.addEventListener("abort",onAbort,{once:!0});try{for(;;){if(signal?.aborted)throw new Error("Request was aborted");let{done,value}=await reader.read();if(signal?.aborted)throw new Error("Request was aborted");if(done)break;buffer+=decoder.decode(value,{stream:!0});let idx=buffer.indexOf(`
-
-`);for(;idx!==-1;){let chunk=buffer.slice(0,idx);buffer=buffer.slice(idx+2);let dataLines=chunk.split(`
-`).filter(l=>l.startsWith("data:")).map(l=>l.slice(5).trim());if(dataLines.length>0){let data=dataLines.join(`
-`).trim();if(data&&data!=="[DONE]")try{yield JSON.parse(data)}catch(cause){throw new CodexProtocolError(`Invalid Codex SSE JSON: ${formatThrownValue(cause)}`,{cause,payload:data})}}idx=buffer.indexOf(`
-
-`)}}}finally{signal?.removeEventListener("abort",onAbort);try{await reader.cancel()}catch{}try{reader.releaseLock()}catch{}}}var OPENAI_BETA_RESPONSES_WEBSOCKETS="responses_websockets=2026-02-06",SESSION_WEBSOCKET_CACHE_TTL_MS=300*1e3,SESSION_WEBSOCKET_MAX_AGE_MS=3300*1e3,websocketSessionCache=new Map,websocketDebugStats=new Map,websocketSseFallbackSessions=new Set;function getOrCreateWebSocketDebugStats(sessionId){let stats=websocketDebugStats.get(sessionId);return stats||(stats={requests:0,connectionsCreated:0,connectionsReused:0,cachedContextRequests:0,storeTrueRequests:0,fullContextRequests:0,deltaRequests:0,lastInputItems:0,websocketFailures:0,sseFallbacks:0},websocketDebugStats.set(sessionId,stats)),stats}function getOpenAICodexWebSocketDebugStats(sessionId){let stats=websocketDebugStats.get(sessionId);return stats?{...stats}:void 0}function resetOpenAICodexWebSocketDebugStats(sessionId){if(sessionId){websocketDebugStats.delete(sessionId),websocketSseFallbackSessions.delete(sessionId);return}websocketDebugStats.clear(),websocketSseFallbackSessions.clear()}function closeOpenAICodexWebSocketSessions(sessionId){let closeEntry=entry=>{entry.idleTimer&&clearTimeout(entry.idleTimer),closeWebSocketSilently(entry.socket,1e3,"debug_close")};if(sessionId){for(let entry of websocketSessionCache.get(sessionId)?.values()??[])closeEntry(entry);websocketSessionCache.delete(sessionId);return}for(let accountEntries of websocketSessionCache.values())for(let entry of accountEntries.values())closeEntry(entry);websocketSessionCache.clear()}registerSessionResourceCleanup(closeOpenAICodexWebSocketSessions);function isWebSocketSseFallbackActive(sessionId){return sessionId?websocketSseFallbackSessions.has(sessionId):!1}function recordWebSocketSseFallback(sessionId){if(!sessionId)return;let stats=getOrCreateWebSocketDebugStats(sessionId);stats.sseFallbacks++,stats.websocketFallbackActive=isWebSocketSseFallbackActive(sessionId)}function recordWebSocketFailure(sessionId,error){if(!sessionId)return;websocketSseFallbackSessions.add(sessionId);let stats=getOrCreateWebSocketDebugStats(sessionId);stats.websocketFailures++,stats.lastWebSocketError=formatThrownValue(error),stats.websocketFallbackActive=!0}var _cachedWebsocket=null;async function getWebSocketConstructor(env){if(!env&&_cachedWebsocket)return _cachedWebsocket;if(typeof process<"u"&&process.versions?.bun){let WebSocketWithProxy=class extends WebSocket{constructor(url,options){let _opts={};Array.isArray(options)||typeof options=="string"?_opts={protocols:options}:_opts={...options};let proxyUrl=resolveHttpProxyUrlForTarget(url.toString().replace(/^wss:/,"https:").replace(/^ws:/,"http:"),env);super(url,{..._opts,...proxyUrl?{proxy:proxyUrl.toString()}:{}})}};return env||(_cachedWebsocket=WebSocketWithProxy),WebSocketWithProxy}let ctor=globalThis.WebSocket;return typeof ctor!="function"?null:ctor}var WebSocketCloseError=class extends Error{constructor(message,options){super(message),this.name="WebSocketCloseError",this.code=options?.code,this.reason=options?.reason,this.wasClean=options?.wasClean}};function getWebSocketReadyState(socket){let readyState=socket.readyState;return typeof readyState=="number"?readyState:void 0}function isWebSocketReusable(socket){let readyState=getWebSocketReadyState(socket);return readyState===void 0||readyState===1}function isWebSocketSessionExpired(entry){return Date.now()-entry.createdAt>=SESSION_WEBSOCKET_MAX_AGE_MS}function closeWebSocketSilently(socket,code=1e3,reason="done"){try{socket.close(code,reason)}catch{}}function scheduleSessionWebSocketExpiry(sessionId,accountId,entry){entry.idleTimer&&clearTimeout(entry.idleTimer),entry.idleTimer=setTimeout(()=>{if(entry.busy)return;closeWebSocketSilently(entry.socket,1e3,"idle_timeout");let accountEntries=websocketSessionCache.get(sessionId);accountEntries?.get(accountId)===entry&&accountEntries.delete(accountId),accountEntries?.size===0&&websocketSessionCache.delete(sessionId)},SESSION_WEBSOCKET_CACHE_TTL_MS)}async function connectWebSocket(url,headers,signal,connectTimeoutMs=DEFAULT_WEBSOCKET_CONNECT_TIMEOUT_MS,env){let WebSocketCtor=await getWebSocketConstructor(env);if(!WebSocketCtor)throw new Error("WebSocket transport is not available in this runtime");let wsHeaders=headersToRecord(headers);return delete wsHeaders["OpenAI-Beta"],new Promise((resolve,reject)=>{let settled=!1,timeout,socket;try{socket=new WebSocketCtor(url,{headers:wsHeaders})}catch(error){reject(error instanceof Error?error:new Error(String(error)));return}let cleanup=()=>{timeout&&(clearTimeout(timeout),timeout=void 0),socket.removeEventListener("open",onOpen),socket.removeEventListener("error",onError),socket.removeEventListener("close",onClose),signal?.removeEventListener("abort",onAbort)},fail=(error,closeReason)=>{settled||(settled=!0,cleanup(),closeReason&&closeWebSocketSilently(socket,1e3,closeReason),reject(error))},onOpen=()=>{settled||(settled=!0,cleanup(),resolve(socket))},onError=event=>{fail(extractWebSocketError(event))},onClose=event=>{fail(extractWebSocketCloseError(event))},onAbort=()=>{fail(new Error("Request was aborted"),"aborted")};socket.addEventListener("open",onOpen),socket.addEventListener("error",onError),socket.addEventListener("close",onClose),signal?.addEventListener("abort",onAbort),connectTimeoutMs>0&&(timeout=setTimeout(()=>{fail(new Error(`WebSocket connect timeout after ${connectTimeoutMs}ms`),"connect_timeout")},connectTimeoutMs)),signal?.aborted&&onAbort()})}async function acquireWebSocket(url,headers,sessionId,accountId,signal,connectTimeoutMs,env){if(!sessionId){let socket2=await connectWebSocket(url,headers,signal,connectTimeoutMs,env);return{socket:socket2,reused:!1,release:()=>closeWebSocketSilently(socket2)}}let accountEntries=websocketSessionCache.get(sessionId),cached=accountEntries?.get(accountId);if(cached){if(cached.idleTimer&&(clearTimeout(cached.idleTimer),cached.idleTimer=void 0),!cached.busy&&isWebSocketSessionExpired(cached))closeWebSocketSilently(cached.socket,1e3,"connection_age_limit"),accountEntries?.delete(accountId),accountEntries?.size===0&&websocketSessionCache.delete(sessionId);else if(!cached.busy&&isWebSocketReusable(cached.socket))return cached.busy=!0,{socket:cached.socket,entry:cached,reused:!0,release:({keep}={})=>{if(!keep||!isWebSocketReusable(cached.socket)){closeWebSocketSilently(cached.socket);let currentEntries=websocketSessionCache.get(sessionId);currentEntries?.get(accountId)===cached&&currentEntries.delete(accountId),currentEntries?.size===0&&websocketSessionCache.delete(sessionId);return}cached.busy=!1,scheduleSessionWebSocketExpiry(sessionId,accountId,cached)}};if(cached.busy){let socket2=await connectWebSocket(url,headers,signal,connectTimeoutMs,env);return{socket:socket2,reused:!1,release:()=>{closeWebSocketSilently(socket2)}}}isWebSocketReusable(cached.socket)||(closeWebSocketSilently(cached.socket),accountEntries?.delete(accountId),accountEntries?.size===0&&websocketSessionCache.delete(sessionId))}let socket=await connectWebSocket(url,headers,signal,connectTimeoutMs,env),entry={socket,busy:!0,createdAt:Date.now()};return accountEntries=websocketSessionCache.get(sessionId),accountEntries||(accountEntries=new Map,websocketSessionCache.set(sessionId,accountEntries)),accountEntries.set(accountId,entry),{socket,entry,reused:!1,release:({keep}={})=>{if(!keep||!isWebSocketReusable(entry.socket)){closeWebSocketSilently(entry.socket),entry.idleTimer&&clearTimeout(entry.idleTimer);let currentEntries=websocketSessionCache.get(sessionId);currentEntries?.get(accountId)===entry&&currentEntries.delete(accountId),currentEntries?.size===0&&websocketSessionCache.delete(sessionId);return}entry.busy=!1,scheduleSessionWebSocketExpiry(sessionId,accountId,entry)}}}function extractWebSocketError(event){if(event&&typeof event=="object"){let message="message"in event?event.message:void 0;if(typeof message=="string"&&message.length>0)return new Error(message);let nestedError="error"in event?event.error:void 0;if(nestedError instanceof Error&&nestedError.message.length>0)return nestedError;if(nestedError&&typeof nestedError=="object"&&"message"in nestedError){let nestedMessage=nestedError.message;if(typeof nestedMessage=="string"&&nestedMessage.length>0)return new Error(nestedMessage)}}return new Error("WebSocket error")}function extractWebSocketCloseError(event){if(event&&typeof event=="object"){let code="code"in event?event.code:void 0,reason="reason"in event?event.reason:void 0,wasClean="wasClean"in event?event.wasClean:void 0,codeText=typeof code=="number"?` ${code}`:"",reasonText=typeof reason=="string"&&reason.length>0?` ${reason}`:"";return!reasonText&&code===WEBSOCKET_MESSAGE_TOO_BIG_CLOSE_CODE&&(reasonText=" message too big"),new WebSocketCloseError(`WebSocket closed${codeText}${reasonText}`.trim(),{code:typeof code=="number"?code:void 0,reason:typeof reason=="string"&&reason.length>0?reason:void 0,wasClean:typeof wasClean=="boolean"?wasClean:void 0})}return new Error("WebSocket closed")}async function decodeWebSocketData(data){if(typeof data=="string")return data;if(data instanceof ArrayBuffer)return new TextDecoder().decode(new Uint8Array(data));if(ArrayBuffer.isView(data)){let view=data;return new TextDecoder().decode(new Uint8Array(view.buffer,view.byteOffset,view.byteLength))}if(data&&typeof data=="object"&&"arrayBuffer"in data){let arrayBuffer=await data.arrayBuffer();return new TextDecoder().decode(new Uint8Array(arrayBuffer))}return null}async function*parseWebSocket(socket,signal,idleTimeoutMs){let queue=[],pending=null,done=!1,failed=null,sawCompletion=!1,wake=()=>{if(!pending)return;let resolve=pending;pending=null,resolve()},onMessage=event=>{(async()=>{let text=null;try{if(!event||typeof event!="object"||!("data"in event)||(text=await decodeWebSocketData(event.data),!text))return;let parsed=JSON.parse(text),type=typeof parsed.type=="string"?parsed.type:"";(type==="response.completed"||type==="response.done"||type==="response.incomplete")&&(sawCompletion=!0,done=!0),queue.push(parsed),wake()}catch(cause){failed=new CodexProtocolError(`Invalid Codex WebSocket JSON: ${formatThrownValue(cause)}`,{cause,payload:text}),done=!0,wake()}})()},onError=event=>{failed=extractWebSocketError(event),done=!0,wake()},onClose=event=>{if(sawCompletion){done=!0,wake();return}failed||(failed=extractWebSocketCloseError(event)),done=!0,wake()},onAbort=()=>{failed=new Error("Request was aborted"),done=!0,wake()};socket.addEventListener("message",onMessage),socket.addEventListener("error",onError),socket.addEventListener("close",onClose),signal?.addEventListener("abort",onAbort);try{for(;;){if(signal?.aborted)throw new Error("Request was aborted");if(queue.length>0){yield queue.shift();continue}if(done)break;let timeout;await new Promise((resolve,reject)=>{pending=resolve,idleTimeoutMs!==void 0&&idleTimeoutMs>0&&(timeout=setTimeout(()=>{let error=new Error(`WebSocket idle timeout after ${idleTimeoutMs}ms`);failed=error,done=!0,pending=null,closeWebSocketSilently(socket,1e3,"idle_timeout"),reject(error)},idleTimeoutMs))}).finally(()=>{timeout&&clearTimeout(timeout)})}if(failed)throw failed;if(!sawCompletion)throw new Error("WebSocket stream closed before response.completed")}finally{socket.removeEventListener("message",onMessage),socket.removeEventListener("error",onError),socket.removeEventListener("close",onClose),signal?.removeEventListener("abort",onAbort)}}function requestBodyWithoutInput(body){let{input:_input,previous_response_id:_previousResponseId,...rest}=body;return rest}function responseInputsEqual(a,b){return JSON.stringify(a??[])===JSON.stringify(b??[])}function requestBodiesMatchExceptInput(a,b){return JSON.stringify(requestBodyWithoutInput(a))===JSON.stringify(requestBodyWithoutInput(b))}function getCachedWebSocketInputDelta(body,continuation){if(!requestBodiesMatchExceptInput(body,continuation.lastRequestBody))return;let currentInput=body.input??[],baseline=[...continuation.lastRequestBody.input??[],...continuation.lastResponseItems];if(currentInput.length<baseline.length)return;let prefix=currentInput.slice(0,baseline.length);if(responseInputsEqual(prefix,baseline))return currentInput.slice(baseline.length)}function buildCachedWebSocketRequestBody(entry,body){let continuation=entry.continuation;if(!continuation)return body;let delta=getCachedWebSocketInputDelta(body,continuation);return!delta||!continuation.lastResponseId?(entry.continuation=void 0,body):{...body,previous_response_id:continuation.lastResponseId,input:delta}}async function*startWebSocketOutputOnFirstEvent(events,onStart){let started=!1;for await(let event of events)started||(started=!0,onStart()),yield event}async function processWebSocketStream(url,body,headers,output,stream2,model,onStart,idleTimeoutMs,websocketConnectTimeoutMs,cacheSessionId,accountId,grammarToolInputProperties,options){let{socket,entry,reused,release}=await acquireWebSocket(url,headers,cacheSessionId,accountId,options?.signal,websocketConnectTimeoutMs,options?.env),keepConnection=!0,useCachedContext=options?.transport==="websocket-cached"||options?.transport==="auto",fullBody=body,requestBody=useCachedContext&&entry?buildCachedWebSocketRequestBody(entry,fullBody):fullBody,stats=cacheSessionId?getOrCreateWebSocketDebugStats(cacheSessionId):void 0;stats&&(stats.requests++,reused?stats.connectionsReused++:stats.connectionsCreated++,useCachedContext&&stats.cachedContextRequests++,requestBody.store===!0&&stats.storeTrueRequests++,stats.lastInputItems=requestBody.input?.length??0,requestBody.previous_response_id?(stats.deltaRequests++,stats.lastDeltaInputItems=requestBody.input?.length??0,stats.lastPreviousResponseId=requestBody.previous_response_id):(stats.fullContextRequests++,stats.lastDeltaInputItems=void 0,stats.lastPreviousResponseId=void 0));try{if(socket.send(JSON.stringify({type:"response.create",...requestBody})),await processResponsesStream(startWebSocketOutputOnFirstEvent(mapCodexEvents(parseWebSocket(socket,options?.signal,idleTimeoutMs),output),onStart),output,stream2,model,{serviceTier:options?.serviceTier,grammarToolInputProperties,resolveServiceTier:resolveCodexServiceTier,applyServiceTierPricing:(usage,serviceTier)=>applyServiceTierPricing(usage,serviceTier,model)}),options?.signal?.aborted)keepConnection=!1;else if(useCachedContext&&entry&&output.responseId){let responseItems=convertResponsesMessages(model,{messages:[output]},CODEX_TOOL_CALL_PROVIDERS,{includeSystemPrompt:!1,grammarToolInputProperties}).filter(item=>item.type!=="function_call_output"&&item.type!=="custom_tool_call_output");entry.continuation={lastRequestBody:fullBody,lastResponseId:output.responseId,lastResponseItems:responseItems}}}catch(error){throw entry&&(entry.continuation=void 0),keepConnection=!1,error}finally{release({keep:keepConnection})}}async function parseErrorResponse(response){let raw=await response.text(),message=raw||response.statusText||"Request failed",friendlyMessage;try{let err=JSON.parse(raw)?.error;if(err){let code=err.code||err.type||"";if(/usage_limit_reached|usage_not_included|rate_limit_exceeded/i.test(code)||response.status===429){let plan=err.plan_type?` (${err.plan_type.toLowerCase()} plan)`:"",mins=err.resets_at?Math.max(0,Math.round((err.resets_at*1e3-Date.now())/6e4)):void 0,when=mins!==void 0?` Try again in ~${mins} min.`:"";friendlyMessage=`You have hit your ChatGPT usage limit${plan}.${when}`.trim()}message=err.message||friendlyMessage||message}}catch{}return{message,friendlyMessage}}function extractAccountId(token){try{let parts=token.split(".");if(parts.length!==3)throw new Error("Invalid token");let accountId=JSON.parse(atob(parts[1]))?.[JWT_CLAIM_PATH]?.chatgpt_account_id;if(!accountId)throw new Error("No account ID in token");return accountId}catch{throw new Error("Failed to extract accountId from token")}}function buildBaseCodexHeaders(initHeaders,additionalHeaders,accountId,token){let headers=new Headers(initHeaders);for(let[key,value]of Object.entries(additionalHeaders||{}))value===null?headers.delete(key):headers.set(key,value);return headers.set("Authorization",`Bearer ${token}`),headers.set("chatgpt-account-id",accountId),headers.set("originator","pi"),headers.set("User-Agent",getPiUserAgent()),headers}function buildSSEHeaders(initHeaders,additionalHeaders,accountId,token,sessionId){let headers=buildBaseCodexHeaders(initHeaders,additionalHeaders,accountId,token);return headers.set("OpenAI-Beta","responses=experimental"),headers.set("accept","text/event-stream"),headers.set("content-type","application/json"),sessionId&&(headers.set("session-id",sessionId),headers.set("x-client-request-id",sessionId)),headers}function buildWebSocketHeaders(initHeaders,additionalHeaders,accountId,token,requestId){let headers=buildBaseCodexHeaders(initHeaders,additionalHeaders,accountId,token);return headers.delete("accept"),headers.delete("content-type"),headers.delete("OpenAI-Beta"),headers.delete("openai-beta"),headers.set("OpenAI-Beta",OPENAI_BETA_RESPONSES_WEBSOCKETS),headers.set("x-client-request-id",requestId),headers.set("session-id",requestId),headers}export{closeOpenAICodexWebSocketSessions,getOpenAICodexWebSocketDebugStats,resetOpenAICodexWebSocketDebugStats,stream,streamSimple};

package/dist/bundle/chunks/openai-responses-4MWLJHIK.js

@@ -1,2 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-import{convertResponsesMessages,convertResponsesTools,processResponsesStream}from"./chunk-H2O6VOXT.js";import{clampOpenAIPromptCacheKey}from"./chunk-PRRNXB7S.js";import{OpenAI}from"./chunk-3VI4HD7D.js";import{formatProviderError,normalizeProviderError}from"./chunk-TEPMHNKQ.js";import"./chunk-PJACZCIR.js";import{splitDeferredTools}from"./chunk-GMWCTUPB.js";import{buildCopilotDynamicHeaders,hasCopilotVisionInput}from"./chunk-PGXDEOVV.js";import{retryProviderRequest}from"./chunk-XNGRGP62.js";import{buildBaseOptions,createGrammarToolInputProperties,getPiUserAgent}from"./chunk-TXBQIIIO.js";import"./chunk-L2ZPNLYD.js";import{headersToRecord}from"./chunk-6R7UI4IY.js";import{getProviderEnvValue}from"./chunk-7DDKXS2Q.js";import"./chunk-D7XAASZM.js";import{clampThinkingLevel}from"./chunk-WJZ4KLGL.js";import{AssistantMessageEventStream}from"./chunk-72KO4OMP.js";import"./chunk-JXWJOIH4.js";var OPENAI_TOOL_CALL_PROVIDERS=new Set(["openai","openai-codex","opencode"]),OPENAI_RESPONSES_MIN_OUTPUT_TOKENS=16;function hasHeader(headers,name){if(!headers)return!1;let expected=name.toLowerCase();for(let[key,value]of Object.entries(headers))if(key.toLowerCase()===expected&&value!==null&&value.trim().length>0)return!0;return!1}function getClientApiKey(provider,apiKey,headers){if(apiKey)return apiKey;if(hasHeader(headers,"authorization")||hasHeader(headers,"cf-aig-authorization"))return"unused";throw new Error(`No API key for provider: ${provider}`)}function detectSessionAffinityFormat(model){return model.provider==="openrouter"||model.baseUrl.includes("openrouter.ai")?"openrouter":"openai"}function resolveCacheRetention(cacheRetention,env){return cacheRetention||(getProviderEnvValue("HUMAIN_TERMINAL_CACHE_RETENTION",env)==="long"||getProviderEnvValue("PI_CACHE_RETENTION",env)==="long"?"long":"short")}function getCompat(model){return{supportsDeveloperRole:model.compat?.supportsDeveloperRole??!0,sessionAffinityFormat:model.compat?.sessionAffinityFormat??detectSessionAffinityFormat(model),supportsLongCacheRetention:model.compat?.supportsLongCacheRetention??!0,supportsStrictMode:model.compat?.supportsStrictMode??!1,supportsOpenAIGrammarTools:model.compat?.supportsOpenAIGrammarTools??!1,supportsAdditionalTools:model.compat?.supportsAdditionalTools??!1,supportsToolSearch:model.compat?.supportsToolSearch??!1,supportsExplicitPromptCacheMode:model.compat?.supportsExplicitPromptCacheMode??!1}}function getPromptCacheRetention(compat,cacheRetention){return cacheRetention==="long"&&compat.supportsLongCacheRetention?"24h":void 0}function formatOpenAIResponsesError(error){return formatProviderError(normalizeProviderError(error),"OpenAI API error")}var stream=(model,context,options)=>{let stream2=new AssistantMessageEventStream;return(async()=>{let output={role:"assistant",content:[],api:model.api,provider:model.provider,model:model.id,usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:"pending",timestamp:Date.now()};try{let apiKey=getClientApiKey(model.provider,options?.apiKey,options?.headers),cacheSessionId=resolveCacheRetention(options?.cacheRetention,options?.env)==="none"?void 0:options?.sessionId,compat=getCompat(model),grammarToolInputProperties=createGrammarToolInputProperties(context.tools,compat.supportsOpenAIGrammarTools),client=createClient(model,context,apiKey,options?.headers,options?.fetch,cacheSessionId),params=buildParams(model,context,options,compat,grammarToolInputProperties),nextParams=await options?.onPayload?.(params,model);nextParams!==void 0&&(params=nextParams);let requestOptions={...options?.signal?{signal:options.signal}:{},...options?.timeoutMs!==void 0?{timeout:options.timeoutMs}:{},maxRetries:0},{data:openaiStream,response}=await retryProviderRequest(()=>client.responses.create(params,requestOptions).withResponse(),{maxRetries:options?.maxRetries,maxRetryDelayMs:options?.maxRetryDelayMs,signal:options?.signal});if(await options?.onResponse?.({status:response.status,headers:headersToRecord(response.headers)},model),stream2.push({type:"start",partial:output}),await processResponsesStream(openaiStream,output,stream2,model,{serviceTier:options?.serviceTier,grammarToolInputProperties,applyServiceTierPricing:(usage,serviceTier)=>applyServiceTierPricing(usage,serviceTier,model)}),options?.signal?.aborted)throw new Error("Request was aborted");if(output.stopReason==="pending")throw new Error("OpenAI Responses stream ended without a stop reason");if(output.stopReason==="aborted"||output.stopReason==="error")throw new Error(output.errorMessage||"An unknown error occurred");stream2.push({type:"done",reason:output.stopReason,message:output}),stream2.end()}catch(error){for(let block of output.content)delete block.index,delete block.partialJson,delete block.customInput;output.stopReason=options?.signal?.aborted?"aborted":"error",output.errorMessage=formatOpenAIResponsesError(error),stream2.push({type:"error",reason:output.stopReason,error:output}),stream2.end()}})(),stream2},streamSimple=(model,context,options)=>{getClientApiKey(model.provider,options?.apiKey,options?.headers);let base={...buildBaseOptions(model,context,options,options?.apiKey),toolChoice:options?.toolChoice},clampedReasoning=options?.reasoning?clampThinkingLevel(model,options.reasoning):void 0;return stream(model,context,{...base,reasoningEffort:clampedReasoning==="off"?void 0:clampedReasoning})};function createClient(model,context,apiKey,optionsHeaders,fetch,sessionId){let compat=getCompat(model),headers={"User-Agent":getPiUserAgent(),...model.headers};if(model.provider==="github-copilot"){let hasImages=hasCopilotVisionInput(context.messages),copilotHeaders=buildCopilotDynamicHeaders({messages:context.messages,hasImages});Object.assign(headers,copilotHeaders)}return sessionId&&(compat.sessionAffinityFormat==="openrouter"?headers["x-session-id"]=sessionId:(compat.sessionAffinityFormat==="openai"&&(headers.session_id=sessionId),headers["x-client-request-id"]=sessionId)),optionsHeaders&&Object.assign(headers,optionsHeaders),new OpenAI({apiKey,baseURL:model.baseUrl,dangerouslyAllowBrowser:!0,fetch,defaultHeaders:headers})}function buildParams(model,context,options,compat=getCompat(model),grammarToolInputProperties=createGrammarToolInputProperties(context.tools,compat.supportsOpenAIGrammarTools)){let deferredToolsMode=compat.supportsAdditionalTools?"additional-tools":compat.supportsToolSearch?"tool-search":void 0,toolPlacement=splitDeferredTools(context,deferredToolsMode!==void 0),messages=convertResponsesMessages(model,context,OPENAI_TOOL_CALL_PROVIDERS,{grammarToolInputProperties,deferredTools:toolPlacement.deferred,deferredToolsMode,toolOptions:{supportsStrictMode:compat.supportsStrictMode,supportsOpenAIGrammarTools:compat.supportsOpenAIGrammarTools}}),cacheRetention=resolveCacheRetention(options?.cacheRetention,options?.env),disableImplicitPromptCache=cacheRetention==="none"&&compat.supportsExplicitPromptCacheMode,params={model:model.id,input:messages,stream:!0,prompt_cache_key:cacheRetention==="none"?void 0:clampOpenAIPromptCacheKey(options?.sessionId),prompt_cache_retention:getPromptCacheRetention(compat,cacheRetention),prompt_cache_options:disableImplicitPromptCache?{mode:"explicit"}:void 0,store:!1};if(options?.maxTokens&&(params.max_output_tokens=Math.max(options.maxTokens,OPENAI_RESPONSES_MIN_OUTPUT_TOKENS)),options?.temperature!==void 0&&(params.temperature=options?.temperature),options?.serviceTier!==void 0&&(params.service_tier=options.serviceTier),toolPlacement.immediate.length>0&&(params.tools=convertResponsesTools(toolPlacement.immediate,{supportsStrictMode:compat.supportsStrictMode,supportsOpenAIGrammarTools:compat.supportsOpenAIGrammarTools})),options?.toolChoice!==void 0&&(params.tool_choice=options.toolChoice),model.reasoning){if(options?.reasoningEffort||options?.reasoningSummary){let effort=options?.reasoningEffort?model.thinkingLevelMap?.[options.reasoningEffort]??options.reasoningEffort:"medium";params.reasoning={effort,summary:options?.reasoningSummary||"auto"},params.include=["reasoning.encrypted_content"]}else model.provider!=="github-copilot"&&model.thinkingLevelMap?.off!==null&&(params.reasoning={effort:model.thinkingLevelMap?.off??"none"});model.provider==="xai"&&(params.include=["reasoning.encrypted_content"])}return options?.samplingParams&&Object.assign(params,options.samplingParams),params}function getServiceTierCostMultiplier(model,serviceTier){switch(serviceTier){case"flex":return .5;case"priority":return model.id==="gpt-5.5"?2.5:2;default:return 1}}function applyServiceTierPricing(usage,serviceTier,model){let multiplier=getServiceTierCostMultiplier(model,serviceTier);multiplier!==1&&(usage.cost.input*=multiplier,usage.cost.output*=multiplier,usage.cost.cacheRead*=multiplier,usage.cost.cacheWrite*=multiplier,usage.cost.total=usage.cost.input+usage.cost.output+usage.cost.cacheRead+usage.cost.cacheWrite)}export{stream,streamSimple};

package/dist/bundle/chunks/webapi-AFS5FDJJ.js

@@ -1,5 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-import{__export}from"./chunk-JXWJOIH4.js";var encoder=new TextEncoder,decoder=new TextDecoder,strictDecoder=new TextDecoder("utf-8",{fatal:!0}),MAX_INT32=2**32;function concat(...buffers){let size=buffers.reduce((acc,{length})=>acc+length,0),buf=new Uint8Array(size),i=0;for(let buffer of buffers)buf.set(buffer,i),i+=buffer.length;return buf}function writeUInt32BE(buf,value,offset){if(value<0||value>=MAX_INT32)throw new RangeError(`value must be >= 0 and <= ${MAX_INT32-1}. Received ${value}`);buf.set([value>>>24,value>>>16,value>>>8,value&255],offset)}function uint64be(value){let high=Math.floor(value/MAX_INT32),low=value%MAX_INT32,buf=new Uint8Array(8);return writeUInt32BE(buf,high,0),writeUInt32BE(buf,low,4),buf}function uint32be(value){let buf=new Uint8Array(4);return writeUInt32BE(buf,value),buf}function encode(string){let bytes=new Uint8Array(string.length);for(let i=0;i<string.length;i++){let code=string.charCodeAt(i);if(code>127)throw new TypeError("non-ASCII string encountered in encode()");bytes[i]=code}return bytes}var unusable=(name,prop="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);function checkUsage(key,usage){if(usage&&!key.usages.includes(usage))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`)}function checkModulusLength(alg,key){let{modulusLength}=key.algorithm;if(typeof modulusLength!="number"||modulusLength<2048)throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}function checkCryptoKey(key,expected,usage){let algorithm=key.algorithm;if(algorithm.name!==expected.name)throw unusable(expected.name);if(expected.hash&&algorithm.hash?.name!==expected.hash)throw unusable(expected.hash,"algorithm.hash");if(expected.namedCurve&&algorithm.namedCurve!==expected.namedCurve)throw unusable(expected.namedCurve,"algorithm.namedCurve");if(expected.length!==void 0&&algorithm.length!==expected.length)throw unusable(expected.length,"algorithm.length");checkUsage(key,usage)}function message(msg,actual,...types){if(types.length>2){let last=types.pop();msg+=`one of type ${types.join(", ")}, or ${last}.`}else types.length===2?msg+=`one of type ${types[0]} or ${types[1]}.`:msg+=`of type ${types[0]}.`;return actual==null?msg+=` Received ${actual}`:typeof actual=="function"&&actual.name?msg+=` Received function ${actual.name}`:typeof actual=="object"&&actual!=null&&actual.constructor?.name&&(msg+=` Received an instance of ${actual.constructor.name}`),msg}var invalidKeyInput=(actual,...types)=>message("Key must be ",actual,...types),withAlg=(alg,actual,...types)=>message(`Key for the ${alg} algorithm must be `,actual,...types);var errors_exports={};__export(errors_exports,{JOSEAlgNotAllowed:()=>JOSEAlgNotAllowed,JOSEError:()=>JOSEError,JOSENotSupported:()=>JOSENotSupported,JWEDecryptionFailed:()=>JWEDecryptionFailed,JWEInvalid:()=>JWEInvalid,JWKInvalid:()=>JWKInvalid,JWKSInvalid:()=>JWKSInvalid,JWKSMultipleMatchingKeys:()=>JWKSMultipleMatchingKeys,JWKSNoMatchingKey:()=>JWKSNoMatchingKey,JWKSTimeout:()=>JWKSTimeout,JWSInvalid:()=>JWSInvalid,JWSSignatureVerificationFailed:()=>JWSSignatureVerificationFailed,JWTClaimValidationFailed:()=>JWTClaimValidationFailed,JWTExpired:()=>JWTExpired,JWTInvalid:()=>JWTInvalid});var JOSEError=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message2,options){super(message2,options),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},JWTClaimValidationFailed=class extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message2,payload,claim="unspecified",reason="unspecified"){super(message2,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JWTExpired=class extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message2,payload,claim="unspecified",reason="unspecified"){super(message2,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JOSEAlgNotAllowed=class extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},JOSENotSupported=class extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},JWEDecryptionFailed=class extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message2="decryption operation failed",options){super(message2,options)}},JWEInvalid=class extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},JWSInvalid=class extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},JWTInvalid=class extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},JWKInvalid=class extends JOSEError{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},JWKSInvalid=class extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},JWKSNoMatchingKey=class extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message2="no applicable key found in the JSON Web Key Set",options){super(message2,options)}},JWKSMultipleMatchingKeys=class extends JOSEError{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message2="multiple matching keys found in the JSON Web Key Set",options){super(message2,options)}},JWKSTimeout=class extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message2="request timed out",options){super(message2,options)}},JWSSignatureVerificationFailed=class extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message2="signature verification failed",options){super(message2,options)}};function assertCryptoKey(key){if(!isCryptoKey(key))throw new Error("CryptoKey instance expected")}var isCryptoKey=key=>{if(key?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return key instanceof CryptoKey}catch{return!1}},isKeyObject=key=>key?.[Symbol.toStringTag]==="KeyObject",isKeyLike=key=>isCryptoKey(key)||isKeyObject(key);var generateCek=enc=>crypto.getRandomValues(new Uint8Array(enc.cekBits>>3));function checkCekLength(cek,expected){let actual=cek.byteLength<<3;if(actual!==expected)throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`)}var generateIv=enc=>crypto.getRandomValues(new Uint8Array(enc.ivBits>>3));function checkIvLength(enc,iv){if(iv.length<<3!==enc.ivBits)throw new JWEInvalid("Invalid Initialization Vector length")}async function cbcKeySetup(enc,cek,usage){if(!(cek instanceof Uint8Array))throw new TypeError(invalidKeyInput(cek,"Uint8Array"));let keySize=enc.cekBits>>1,encKey=await crypto.subtle.importKey("raw",cek.subarray(keySize>>3),"AES-CBC",!1,[usage]),macKey=await crypto.subtle.importKey("raw",cek.subarray(0,keySize>>3),{hash:`SHA-${keySize<<1}`,name:"HMAC"},!1,["sign"]);return[encKey,macKey,keySize]}async function cbcHmacTag(macKey,macData,keySize){return new Uint8Array((await crypto.subtle.sign("HMAC",macKey,macData)).slice(0,keySize>>3))}async function cbcEncrypt(enc,plaintext,cek,iv,aad){let[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"encrypt"),ciphertext=new Uint8Array(await crypto.subtle.encrypt({iv,name:"AES-CBC"},encKey,plaintext)),macData=concat(aad,iv,ciphertext,uint64be(aad.length*8)),tag2=await cbcHmacTag(macKey,macData,keySize);return{ciphertext,tag:tag2,iv}}async function timingSafeEqual(a,b){let algorithm={name:"HMAC",hash:"SHA-256"},key=await crypto.subtle.generateKey(algorithm,!1,["sign","verify"]),aHmac=await crypto.subtle.sign(algorithm,key,a);return crypto.subtle.verify(algorithm,key,aHmac,b)}async function cbcDecrypt(enc,cek,ciphertext,iv,tag2,aad){let[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"decrypt"),macData=concat(aad,iv,ciphertext,uint64be(aad.length*8)),expectedTag=await cbcHmacTag(macKey,macData,keySize),macCheckPassed;try{macCheckPassed=await timingSafeEqual(tag2,expectedTag)}catch{}if(!macCheckPassed)throw new JWEDecryptionFailed;let plaintext;try{plaintext=new Uint8Array(await crypto.subtle.decrypt({iv,name:"AES-CBC"},encKey,ciphertext))}catch{}if(!plaintext)throw new JWEDecryptionFailed;return plaintext}async function gcmEncrypt(enc,plaintext,cek,iv,aad){let encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",!1,["encrypt"]):(checkCryptoKey(cek,enc.subtle,"encrypt"),cek),encrypted=new Uint8Array(await crypto.subtle.encrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,plaintext)),tag2=encrypted.slice(-16);return{ciphertext:encrypted.slice(0,-16),tag:tag2,iv}}async function gcmDecrypt(enc,cek,ciphertext,iv,tag2,aad){let encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",!1,["decrypt"]):(checkCryptoKey(cek,enc.subtle,"decrypt"),cek);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,concat(ciphertext,tag2)))}catch{throw new JWEDecryptionFailed}}async function encrypt(enc,plaintext,cek,iv,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array))throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));return iv?checkIvLength(enc,iv):iv=generateIv(enc),cek instanceof Uint8Array&&checkCekLength(cek,enc.cekBits),enc.cbc?cbcEncrypt(enc,plaintext,cek,iv,aad):gcmEncrypt(enc,plaintext,cek,iv,aad)}async function decrypt(enc,cek,ciphertext,iv,tag2,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array))throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!iv)throw new JWEInvalid("JWE Initialization Vector missing");if(!tag2)throw new JWEInvalid("JWE Authentication Tag missing");return checkIvLength(enc,iv),cek instanceof Uint8Array&&checkCekLength(cek,enc.cekBits),enc.cbc?cbcDecrypt(enc,cek,ciphertext,iv,tag2,aad):gcmDecrypt(enc,cek,ciphertext,iv,tag2,aad)}var base64url_exports={};__export(base64url_exports,{decode:()=>decode,encode:()=>encode2});function encodeBase64(input){if(Uint8Array.prototype.toBase64)return input.toBase64();let CHUNK_SIZE=32768,arr=[];for(let i=0;i<input.length;i+=CHUNK_SIZE)arr.push(String.fromCharCode.apply(null,input.subarray(i,i+CHUNK_SIZE)));return btoa(arr.join(""))}function decodeBase64(encoded){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(encoded);let binary=atob(encoded),bytes=new Uint8Array(binary.length);for(let i=0;i<binary.length;i++)bytes[i]=binary.charCodeAt(i);return bytes}var invalid="The input to be decoded is not correctly encoded.";function decode(input){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof input=="string"?input:decoder.decode(input),{alphabet:"base64url"})}catch(cause){throw new TypeError(invalid,{cause})}let encoded=input;if(encoded instanceof Uint8Array&&(encoded=decoder.decode(encoded)),encoded.includes("+")||encoded.includes("/"))throw new TypeError(invalid);encoded=encoded.replace(/-/g,"+").replace(/_/g,"/");try{return decodeBase64(encoded)}catch{throw new TypeError(invalid)}}function encode2(input){let unencoded=input;return typeof unencoded=="string"&&(unencoded=encoder.encode(unencoded)),Uint8Array.prototype.toBase64?unencoded.toBase64({alphabet:"base64url",omitPadding:!0}):encodeBase64(unencoded).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function isObject(input){if(typeof input!="object"||input===null||Object.prototype.toString.call(input)!=="[object Object]")return!1;let prototype=Object.getPrototypeOf(input);if(prototype===null)return!0;let proto=prototype;for(;Object.getPrototypeOf(proto)!==null;)proto=Object.getPrototypeOf(proto);return prototype===proto}function isDisjoint(...headers){let parameters=new Set;for(let header of headers)if(header)for(let parameter of Object.keys(header)){if(parameters.has(parameter))return!1;parameters.add(parameter)}return!0}var isJWK=key=>isObject(key)&&typeof key.kty=="string",isPrivateJWK=key=>key.kty!=="oct"&&(key.kty==="AKP"&&typeof key.priv=="string"||typeof key.d=="string"),isPublicJWK=key=>key.kty!=="oct"&&key.d===void 0&&key.priv===void 0,isSecretJWK=key=>key.kty==="oct"&&typeof key.k=="string";var unprotected=Symbol();function assertNotSet(value,name){if(value)throw new TypeError(`${name} can only be called once`)}function decodeBase64url(value,label,ErrorClass){try{return decode(value)}catch{throw new ErrorClass(`Failed to base64url decode the ${label}`)}}function encodeBase64url(value,label,ErrorClass){try{return encode(value)}catch{throw new ErrorClass(`The ${label} is not a valid base64url string`)}}async function digest(algorithm,data){let subtleDigest=`SHA-${algorithm.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(subtleDigest,data))}function parseJoseHeader(b64,ErrorClass,message2){let parsed;try{parsed=JSON.parse(strictDecoder.decode(decode(b64)))}catch{throw new ErrorClass(message2)}if(!isObject(parsed))throw new ErrorClass(message2);return parsed}async function jwkToKey(entry,jwk){if(jwk.kty==="RSA"&&"oth"in jwk&&jwk.oth!==void 0)throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!entry.kty.includes(jwk.kty))throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let algorithm=entry.resolve?.({kty:jwk.kty,crv:jwk.crv})??entry.subtle,isPrivate=!!(jwk.d||jwk.priv),keyData={...jwk};return keyData.kty!=="AKP"&&delete keyData.alg,delete keyData.use,crypto.subtle.importKey("jwk",keyData,algorithm,jwk.ext??!isPrivate,jwk.key_ops??entry.usages[isPrivate?1:0])}var tag=key=>key[Symbol.toStringTag],jwkMatchesOp=(entry,key,usage)=>{let{alg}=entry;if(key.use!==void 0){let expected=usage==="sign"||usage==="verify"?"sig":"enc";if(key.use!==expected)throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`)}if(key.alg!==void 0&&key.alg!==alg)throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);if(Array.isArray(key.key_ops)){let expectedKeyOp=usage==="encrypt"||usage==="decrypt"?entry.ops?.[usage==="encrypt"?0:1]:usage;if(expectedKeyOp&&!key.key_ops.includes(expectedKeyOp))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`)}};function checkKeyType(entry,key,usage){let{alg,secret}=entry,privateKey=usage==="decrypt"||usage==="sign";if(secret&&key instanceof Uint8Array)return[BYTES,key];if(isJWK(key)){if(secret?!isSecretJWK(key):!(privateKey?isPrivateJWK(key):isPublicJWK(key)))throw new TypeError(secret?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${privateKey?"private":"public"} JWK`);return jwkMatchesOp(entry,key,usage),[JWK,key]}if(!isKeyLike(key))throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"));if(secret){if(key.type!=="secret")throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}else{if(key.type==="secret")throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);let expectedType=privateKey?"private":"public";if((key.type==="public"||key.type==="private")&&key.type!==expectedType){let operation=usage==="sign"?"signing":usage==="verify"?"verifying":`${usage.slice(0,-1)}tion`;throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`)}}return isCryptoKey(key)?[CRYPTO,key]:[KEYOBJECT,key]}var BYTES=0,CRYPTO=1,KEYOBJECT=2,JWK=3,cache,nist={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function cached(key,alg,value){cache||=new WeakMap;let entry=cache.get(key);return value&&(entry?entry[alg]=value:cache.set(key,{__proto__:null,[alg]:value})),value??entry?.[alg]}var handleJWK=async(key,jwk,entry)=>cached(key,entry.alg)??cached(key,entry.alg,await jwkToKey(entry,{...jwk,alg:entry.alg})),handleKeyObject=(keyObject,entry)=>{let hit=cached(keyObject,entry.alg);if(hit)return hit;let isPublic=keyObject.type==="public",usages=entry.usages[isPublic?0:1],{asymmetricKeyType}=keyObject,crv=nist[keyObject.asymmetricKeyDetails?.namedCurve],params=entry.resolve?.({crv,asymmetricKeyType})??entry.subtle;return cached(keyObject,entry.alg,keyObject.toCryptoKey(params,isPublic,usages))};async function prepareKey(entry,key,usage){let tagged=checkKeyType(entry,key,usage);switch(tagged[0]){case BYTES:case CRYPTO:return tagged[1];case JWK:{let key2=tagged[1];if(key2.k)return decode(key2.k);if(!Object.isFrozen(key2)){let{key_ops}=key2;Array.isArray(key_ops)&&Object.freeze(key_ops),Object.freeze(key2)}return handleJWK(key2,key2,entry)}case KEYOBJECT:{let keyObject=tagged[1];return keyObject.type==="secret"?keyObject.export():"toCryptoKey"in keyObject&&typeof keyObject.toCryptoKey=="function"?handleKeyObject(keyObject,entry):handleJWK(keyObject,keyObject.export({format:"jwk"}),entry)}}}function table(entries){let out={__proto__:null};for(let alg in entries)out[alg]={...entries[alg],alg};return out}var wrap=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],derive=[[],["deriveBits"]],none=[[],[]];function rsaes(bits){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${bits}`},usages:wrap,ops:["wrapKey","unwrapKey"]}}function ecdh(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty,crv,asymmetricKeyType})=>{if(crv==="X25519"||asymmetricKeyType==="x25519")return{name:"X25519"};if(kty==="OKP")throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:crv}},usages:derive,ops:[void 0,"deriveBits"]}}function aeskw(bits,gcm=!1){return{kty:["oct"],secret:!0,subtle:{name:gcm?"AES-GCM":"AES-KW",length:bits},usages:none,ops:gcm?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function pbes2(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:none,ops:["deriveBits","deriveBits"]}}var JWE=table({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:none,ops:["encrypt","decrypt"]},"RSA-OAEP":rsaes(1),"RSA-OAEP-256":rsaes(256),"RSA-OAEP-384":rsaes(384),"RSA-OAEP-512":rsaes(512),"ECDH-ES":ecdh(),"ECDH-ES+A128KW":ecdh(),"ECDH-ES+A192KW":ecdh(),"ECDH-ES+A256KW":ecdh(),A128KW:aeskw(128),A192KW:aeskw(192),A256KW:aeskw(256),A128GCMKW:aeskw(128,!0),A192GCMKW:aeskw(192,!0),A256GCMKW:aeskw(256,!0),"PBES2-HS256+A128KW":pbes2(),"PBES2-HS384+A192KW":pbes2(),"PBES2-HS512+A256KW":pbes2()}),contentOps=["encrypt","decrypt"];function contentEncryption(bits,cbc=!1){return{kty:["oct"],secret:!0,subtle:{name:cbc?"AES-CBC":"AES-GCM",length:bits},usages:none,ops:contentOps,cekBits:bits,ivBits:cbc?128:96,cbc}}var ENC=table({A128GCM:contentEncryption(128),A192GCM:contentEncryption(192),A256GCM:contentEncryption(256),"A128CBC-HS256":contentEncryption(256,!0),"A192CBC-HS384":contentEncryption(384,!0),"A256CBC-HS512":contentEncryption(512,!0)});function unsupported(parameter,name){throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`)}function jweAlgorithm(alg){return(typeof alg=="string"?JWE[alg]:void 0)??unsupported("alg","Algorithm")}function jweEncryption(enc){return(typeof enc=="string"?ENC[enc]:void 0)??unsupported("enc","Encryption Algorithm")}function checkEcdhCryptoKey(key,usage){if(key.algorithm.name!=="ECDH"&&key.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");checkUsage(key,usage)}async function aeskwCryptoKey(key,alg,usage){let expected=jweAlgorithm(alg).subtle,cryptoKey=key instanceof Uint8Array?await crypto.subtle.importKey("raw",key,"AES-KW",!0,[usage]):key;return checkCryptoKey(cryptoKey,expected,usage),cryptoKey}async function aeskwWrap(alg,key,cek){let cryptoKey=await aeskwCryptoKey(key,alg,"wrapKey"),cryptoKeyCek=await crypto.subtle.importKey("raw",cek,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",cryptoKeyCek,cryptoKey,"AES-KW"))}async function aeskwUnwrap(alg,key,encryptedKey){let cryptoKey=await aeskwCryptoKey(key,alg,"unwrapKey"),cryptoKeyCek=await crypto.subtle.unwrapKey("raw",encryptedKey,cryptoKey,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",cryptoKeyCek))}function checkRsaKey(alg,key,usage){checkCryptoKey(key,jweAlgorithm(alg).subtle,usage),checkModulusLength(alg,key)}function pbes2CryptoKey(key,alg){return key instanceof Uint8Array?crypto.subtle.importKey("raw",key,"PBKDF2",!1,["deriveBits"]):(checkCryptoKey(key,jweAlgorithm(alg).subtle,"deriveBits"),key)}async function deriveKey(p2s,alg,p2c,key){if(!(p2s instanceof Uint8Array)||p2s.length<8)throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(p2c)||Math.sign(p2c)!==1)throw new JWEInvalid("PBES2 Count Input must be a positive integer");let salt=concat(encode(alg),Uint8Array.of(0),p2s),keylen=parseInt(alg.slice(13,16),10),subtleAlg={hash:`SHA-${alg.slice(8,11)}`,iterations:p2c,name:"PBKDF2",salt},cryptoKey=await pbes2CryptoKey(key,alg);return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg,cryptoKey,keylen))}function lengthAndInput(input){return concat(uint32be(input.length),input)}async function concatKdf(Z,L,OtherInfo){let dkLen=L>>3,hashLen=32,reps=Math.ceil(dkLen/hashLen),dk=new Uint8Array(reps*hashLen);for(let i=1;i<=reps;i++){let hashResult=await digest("sha256",concat(uint32be(i),Z,OtherInfo));dk.set(hashResult,(i-1)*hashLen)}return dk.slice(0,dkLen)}async function ecdhesDeriveKey(publicKey,privateKey,algorithm,keyLength,apu=new Uint8Array,apv=new Uint8Array){checkEcdhCryptoKey(publicKey),checkEcdhCryptoKey(privateKey,"deriveBits");let otherInfo=concat(lengthAndInput(encode(algorithm)),lengthAndInput(apu),lengthAndInput(apv),uint32be(keyLength)),Z=new Uint8Array(await crypto.subtle.deriveBits({name:publicKey.algorithm.name,public:publicKey},privateKey,publicKey.algorithm.name==="X25519"?256:Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3),10)/8)<<3));return concatKdf(Z,keyLength,otherInfo)}function assertEcdhKey(key){assertCryptoKey(key);let curve=key.algorithm.namedCurve;if(curve!=="P-256"&&curve!=="P-384"&&curve!=="P-521"&&key.algorithm.name!=="X25519")throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function assertEncryptedKey(encryptedKey){if(encryptedKey===void 0)throw new JWEInvalid("JWE Encrypted Key missing")}function assertNoEncryptedKey(encryptedKey){if(encryptedKey!==void 0)throw new JWEInvalid("Encountered unexpected JWE Encrypted Key")}async function decryptKeyManagement(alg,enc,key,encryptedKey,joseHeader,options){let entry=jweAlgorithm(alg);if(alg==="dir")return assertNoEncryptedKey(encryptedKey),key;switch(entry.subtle.name){case"ECDH":{if(alg==="ECDH-ES"&&assertNoEncryptedKey(encryptedKey),!isObject(joseHeader.epk))throw new JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');assertEcdhKey(key);let epk=await jwkToKey(entry,joseHeader.epk),partyUInfo,partyVInfo;if(joseHeader.apu!==void 0){if(typeof joseHeader.apu!="string")throw new JWEInvalid('JOSE Header "apu" (Agreement PartyUInfo) invalid');partyUInfo=decodeBase64url(joseHeader.apu,"apu",JWEInvalid)}if(joseHeader.apv!==void 0){if(typeof joseHeader.apv!="string")throw new JWEInvalid('JOSE Header "apv" (Agreement PartyVInfo) invalid');partyVInfo=decodeBase64url(joseHeader.apv,"apv",JWEInvalid)}let sharedSecret=await ecdhesDeriveKey(epk,key,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),partyUInfo,partyVInfo);return alg==="ECDH-ES"?sharedSecret:(assertEncryptedKey(encryptedKey),aeskwUnwrap(alg.slice(-6),sharedSecret,encryptedKey))}case"RSA-OAEP":return assertEncryptedKey(encryptedKey),assertCryptoKey(key),checkRsaKey(alg,key,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",key,encryptedKey));case"PBKDF2":{if(assertEncryptedKey(encryptedKey),typeof joseHeader.p2c!="number")throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');let p2cLimit=options?.maxPBES2Count||1e4;if(joseHeader.p2c>p2cLimit)throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof joseHeader.p2s!="string")throw new JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let p2s=decodeBase64url(joseHeader.p2s,"p2s",JWEInvalid),derived=await deriveKey(p2s,alg,joseHeader.p2c,key);return aeskwUnwrap(alg.slice(-6),derived,encryptedKey)}case"AES-KW":return assertEncryptedKey(encryptedKey),aeskwUnwrap(alg,key,encryptedKey);case"AES-GCM":{if(assertEncryptedKey(encryptedKey),typeof joseHeader.iv!="string")throw new JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof joseHeader.tag!="string")throw new JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');let iv;iv=decodeBase64url(joseHeader.iv,"iv",JWEInvalid);let tag2;return tag2=decodeBase64url(joseHeader.tag,"tag",JWEInvalid),decrypt(jweEncryption(alg.slice(0,-2)),key,encryptedKey,iv,tag2,new Uint8Array)}}}async function encryptKeyManagement(alg,enc,key,providedCek,providedParameters={}){let encryptedKey,parameters,cek,entry=jweAlgorithm(alg);if(alg==="dir")return[key,void 0,void 0];switch(entry.subtle.name){case"ECDH":{assertEcdhKey(key);let{apu,apv}=providedParameters,ephemeralKey;providedParameters.epk?ephemeralKey=await prepareKey(entry,providedParameters.epk,"decrypt"):ephemeralKey=(await crypto.subtle.generateKey(key.algorithm,!0,["deriveBits"])).privateKey;let subtle=crypto.subtle,exportableEpk=ephemeralKey;if(!exportableEpk.extractable){if(typeof subtle.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');exportableEpk=await subtle.getPublicKey(ephemeralKey,[])}let{x,y,crv,kty}=await subtle.exportKey("jwk",exportableEpk),sharedSecret=await ecdhesDeriveKey(key,ephemeralKey,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),apu,apv);if(parameters={epk:{x,crv,kty}},kty==="EC"&&(parameters.epk.y=y),apu&&(parameters.apu=encode2(apu)),apv&&(parameters.apv=encode2(apv)),alg==="ECDH-ES"){cek=sharedSecret;break}cek=providedCek||generateCek(enc);let kwAlg=alg.slice(-6);encryptedKey=await aeskwWrap(kwAlg,sharedSecret,cek);break}case"RSA-OAEP":{cek=providedCek||generateCek(enc),assertCryptoKey(key),checkRsaKey(alg,key,"encrypt"),encryptedKey=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",key,cek));break}case"PBKDF2":{cek=providedCek||generateCek(enc);let{p2c=2048,p2s=crypto.getRandomValues(new Uint8Array(16))}=providedParameters,derived=await deriveKey(p2s,alg,p2c,key);encryptedKey=await aeskwWrap(alg.slice(-6),derived,cek),parameters={p2c,p2s:encode2(p2s)};break}case"AES-KW":{cek=providedCek||generateCek(enc),encryptedKey=await aeskwWrap(alg,key,cek);break}case"AES-GCM":{cek=providedCek||generateCek(enc);let{iv}=providedParameters,wrapped=await encrypt(jweEncryption(alg.slice(0,-2)),cek,key,iv,new Uint8Array);encryptedKey=wrapped.ciphertext,parameters={iv:encode2(wrapped.iv),tag:encode2(wrapped.tag)};break}}return[cek,encryptedKey,parameters]}var JWS_RECOGNIZED={__proto__:null,b64:!0},JWE_RECOGNIZED={__proto__:null};function validateAlgorithms(option,algorithms){if(algorithms!==void 0&&(!Array.isArray(algorithms)||algorithms.some(s=>typeof s!="string")))throw new TypeError(`"${option}" option must be an array of strings`);if(algorithms)return new Set(algorithms)}function validateCritDuplicates(Err,protectedHeader){let{crit}=protectedHeader??{};if(Array.isArray(crit)&&new Set(crit).size!==crit.length)throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==void 0&&protectedHeader?.crit===void 0)throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');if(!protectedHeader||protectedHeader.crit===void 0)return[];if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some(input=>typeof input!="string"||input.length===0))throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let recognized=recognizedOption===void 0?recognizedDefault:{__proto__:null,...recognizedOption,...recognizedDefault};for(let parameter of protectedHeader.crit){if(!(parameter in recognized))throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);if(!Object.hasOwn(joseHeader,parameter)||joseHeader[parameter]===void 0)throw new Err(`Extension Header Parameter "${parameter}" is missing`);if(recognized[parameter]&&(!Object.hasOwn(protectedHeader,parameter)||protectedHeader[parameter]===void 0))throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}return protectedHeader.crit}function supported(name){if(typeof globalThis[name]>"u")throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`)}async function compress(input){supported("CompressionStream");let cs=new CompressionStream("deflate-raw"),writer=cs.writable.getWriter();writer.write(input).catch(()=>{}),writer.close().catch(()=>{});let chunks=[],reader=cs.readable.getReader();for(;;){let{value,done}=await reader.read();if(done)break;chunks.push(value)}return concat(...chunks)}async function decompress(input,maxLength){supported("DecompressionStream");let ds=new DecompressionStream("deflate-raw"),writer=ds.writable.getWriter();writer.write(input).catch(()=>{}),writer.close().catch(()=>{});let chunks=[],length=0,reader=ds.readable.getReader();for(;;){let{value,done}=await reader.read();if(done)break;if(chunks.push(value),length+=value.byteLength,maxLength!==1/0&&length>maxLength)throw new JWEInvalid("Decompressed plaintext exceeded the configured limit")}return concat(...chunks)}function checkShared(jwe){let{ciphertext,protected:encodedProtected,unprotected:unprotected2}=jwe;if(jwe.iv!==void 0&&typeof jwe.iv!="string")throw new JWEInvalid("JWE Initialization Vector incorrect type");if(typeof ciphertext!="string")throw new JWEInvalid("JWE Ciphertext missing or incorrect type");if(jwe.tag!==void 0&&typeof jwe.tag!="string")throw new JWEInvalid("JWE Authentication Tag incorrect type");if(encodedProtected!==void 0&&typeof encodedProtected!="string")throw new JWEInvalid("JWE Protected Header incorrect type");if(jwe.aad!==void 0&&typeof jwe.aad!="string")throw new JWEInvalid("JWE AAD incorrect type");if(unprotected2!==void 0&&!isObject(unprotected2))throw new JWEInvalid("JWE Shared Unprotected Header incorrect type")}function checkRecipient(jwe){let{encrypted_key:encryptedKey,header}=jwe;if(encryptedKey!==void 0&&typeof encryptedKey!="string")throw new JWEInvalid("JWE Encrypted Key incorrect type");if(header!==void 0&&!isObject(header))throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");if(jwe.protected===void 0&&header===void 0&&jwe.unprotected===void 0)throw new JWEInvalid("JOSE Header missing")}function shareJWE(jwe){let{protected:encodedProtected,ciphertext,iv,tag:tag2,aad}=jwe,parsedProt;encodedProtected&&(parsedProt=parseJoseHeader(encodedProtected,JWEInvalid,"JWE Protected Header is invalid"));let protectedHeader=encodedProtected!==void 0?encode(encodedProtected):new Uint8Array;return[parsedProt,decodeBase64url(ciphertext,"ciphertext",JWEInvalid),iv!==void 0?decodeBase64url(iv,"iv",JWEInvalid):void 0,tag2!==void 0?decodeBase64url(tag2,"tag",JWEInvalid):void 0,aad!==void 0?concat(protectedHeader,encode("."),encodeBase64url(aad,"aad",JWEInvalid)):protectedHeader]}function decryptResult(jwe,decrypted){let[plaintext,parsedProt,key,resolvedKey]=decrypted,{protected:encodedProtected,aad,unprotected:unprotected2,header}=jwe,result={plaintext};return encodedProtected!==void 0&&(result.protectedHeader=parsedProt),aad!==void 0&&(result.additionalAuthenticatedData=decodeBase64url(aad,"aad",JWEInvalid)),unprotected2!==void 0&&(result.sharedUnprotectedHeader=unprotected2),header!==void 0&&(result.unprotectedHeader=header),resolvedKey?{...result,key}:result}function prepareDecrypt(options){return[options&&validateAlgorithms("keyManagementAlgorithms",options.keyManagementAlgorithms),options&&validateAlgorithms("contentEncryptionAlgorithms",options.contentEncryptionAlgorithms),options]}async function decryptRecipient(jwe,token,shared,key){let[keyManagementAlgorithms,contentEncryptionAlgorithms,options]=shared,[parsedProt,ciphertext,iv,tag2,additionalData]=token,{encrypted_key:encodedKey,header,unprotected:unprotected2}=jwe,joseHeader;if(header!==void 0||unprotected2!==void 0){if(!isDisjoint(parsedProt,header,unprotected2))throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");joseHeader={...parsedProt,...header,...unprotected2}}else joseHeader=parsedProt??{};if(validateCrit(JWEInvalid,JWE_RECOGNIZED,options?.crit,parsedProt,joseHeader),joseHeader.zip!==void 0&&joseHeader.zip!=="DEF")throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(joseHeader.zip!==void 0&&!parsedProt?.zip)throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg,enc}=joseHeader;if(typeof alg!="string"||!alg)throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");if(typeof enc!="string"||!enc)throw new JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header");if(keyManagementAlgorithms&&!keyManagementAlgorithms.has(alg)||!keyManagementAlgorithms&&alg.startsWith("PBES2"))throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(contentEncryptionAlgorithms&&!contentEncryptionAlgorithms.has(enc))throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');let encEntry=jweEncryption(enc),encryptedKey;encodedKey!==void 0&&(encryptedKey=decodeBase64url(encodedKey,"encrypted_key",JWEInvalid));let resolvedKey=!1;typeof key=="function"&&(key=await key(parsedProt,jwe),resolvedKey=!0);let algEntry=jweAlgorithm(alg),k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"decrypt"),cek;try{cek=await decryptKeyManagement(alg,encEntry,k,encryptedKey,joseHeader,options)}catch(err){if(err instanceof TypeError||err instanceof JWEInvalid||err instanceof JOSENotSupported)throw err;cek=generateCek(encEntry)}let plaintext=await decrypt(encEntry,cek,ciphertext,iv,tag2,additionalData);if(joseHeader.zip==="DEF"){let maxDecompressedLength=options?.maxDecompressedLength??25e4;if(maxDecompressedLength===0)throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(maxDecompressedLength!==1/0&&(!Number.isSafeInteger(maxDecompressedLength)||maxDecompressedLength<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");plaintext=await decompress(plaintext,maxDecompressedLength).catch(cause=>{throw cause instanceof JWEInvalid?cause:new JWEInvalid("Failed to decompress plaintext",{cause})})}return[plaintext,parsedProt,k,resolvedKey]}async function decryptJWE(jwe,shared,key){return decryptRecipient(jwe,shareJWE(jwe),shared,key)}async function decryptCompact(jwe,shared,key){if(jwe instanceof Uint8Array&&(jwe=decoder.decode(jwe)),typeof jwe!="string")throw new JWEInvalid("Compact JWE must be a string or Uint8Array");let{0:protectedHeader,1:encryptedKey,2:iv,3:ciphertext,4:tag2,length}=jwe.split(".");if(length!==5)throw new JWEInvalid("Invalid Compact JWE");return decryptJWE({ciphertext,iv:iv||void 0,protected:protectedHeader,tag:tag2||void 0,encrypted_key:encryptedKey||void 0},shared,key)}async function compactDecrypt(jwe,key,options){let decrypted=await decryptCompact(jwe,prepareDecrypt(options),key),result={plaintext:decrypted[0],protectedHeader:decrypted[1]};return typeof key=="function"?{...result,key:decrypted[2]}:result}async function flattenedDecrypt(jwe,key,options){if(!isObject(jwe))throw new JWEInvalid("Flattened JWE must be an object");return checkShared(jwe),checkRecipient(jwe),decryptResult(jwe,await decryptJWE(jwe,prepareDecrypt(options),key))}async function generalDecrypt(jwe,key,options){if(!isObject(jwe))throw new JWEInvalid("General JWE must be an object");if(!Array.isArray(jwe.recipients)||!jwe.recipients.every(isObject))throw new JWEInvalid("JWE Recipients missing or incorrect type");if(!jwe.recipients.length)throw new JWEInvalid("JWE Recipients has no members");let shared,token;try{checkShared(jwe),shared=prepareDecrypt(options),token=shareJWE(jwe)}catch{throw new JWEDecryptionFailed}if(jwe.recipients.length>1)for(let{header}of jwe.recipients){let alg=token[0]?.alg??header?.alg??jwe.unprotected?.alg;if(alg==="dir"||alg==="ECDH-ES")throw new JWEInvalid(`"${alg}" alg may only have a single recipient`)}for(let recipient of jwe.recipients)try{let flattened={aad:jwe.aad,ciphertext:jwe.ciphertext,encrypted_key:recipient.encrypted_key,header:recipient.header,iv:jwe.iv,protected:jwe.protected,tag:jwe.tag,unprotected:jwe.unprotected};return checkRecipient(flattened),decryptResult(flattened,await decryptRecipient(flattened,token,shared,key))}catch{}throw new JWEDecryptionFailed}function checkEncryptHeaders(input){let[,protectedHeader,unprotectedHeader,sharedUnprotectedHeader,,,,,crit]=input;if(!isDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader))throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let joseHeader={...protectedHeader,...unprotectedHeader,...sharedUnprotectedHeader};if(validateCrit(JWEInvalid,JWE_RECOGNIZED,crit,protectedHeader,joseHeader),joseHeader.zip!==void 0&&joseHeader.zip!=="DEF")throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(joseHeader.zip!==void 0&&!protectedHeader?.zip)throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg,enc}=joseHeader;if(typeof alg!="string"||!alg)throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof enc!="string"||!enc)throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[joseHeader,alg,enc,jweEncryption(enc)]}async function encryptJWE(input,checked,key){let[joseHeader,alg,,encEntry]=checked,[inputPlaintext,inputProtectedHeader,inputUnprotectedHeader,sharedUnprotectedHeader,aad,providedCek,inputIv,keyManagementParameters,,unprotectedParameters]=input,protectedHeader=inputProtectedHeader,unprotectedHeader=inputUnprotectedHeader;if(providedCek&&(alg==="dir"||alg==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);let algEntry=jweAlgorithm(alg),k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"encrypt"),[cek,encryptedKey,parameters]=await encryptKeyManagement(alg,encEntry,k,providedCek,keyManagementParameters);parameters&&(unprotectedParameters?unprotectedHeader=unprotectedHeader?{...unprotectedHeader,...parameters}:parameters:protectedHeader=protectedHeader?{...protectedHeader,...parameters}:parameters);let protectedHeaderS,protectedHeaderB;protectedHeader?(protectedHeaderS=encode2(JSON.stringify(protectedHeader)),protectedHeaderB=encode(protectedHeaderS)):(protectedHeaderS="",protectedHeaderB=new Uint8Array);let additionalData,aadMember;aad?.byteLength?(aadMember=encode2(aad),additionalData=concat(protectedHeaderB,encode("."),encode(aadMember))):additionalData=protectedHeaderB;let plaintext=inputPlaintext;joseHeader.zip==="DEF"&&(plaintext=await compress(plaintext).catch(cause=>{throw new JWEInvalid("Failed to compress plaintext",{cause})}));let{ciphertext,tag:tag2,iv}=await encrypt(encEntry,plaintext,cek,inputIv,additionalData),jwe={ciphertext:encode2(ciphertext)};return iv&&(jwe.iv=encode2(iv)),tag2&&(jwe.tag=encode2(tag2)),encryptedKey&&(jwe.encrypted_key=encode2(encryptedKey)),aadMember&&(jwe.aad=aadMember),protectedHeader&&(jwe.protected=protectedHeaderS),sharedUnprotectedHeader&&(jwe.unprotected=sharedUnprotectedHeader),unprotectedHeader&&(jwe.header=unprotectedHeader),jwe}async function createJWE(input,key){return encryptJWE(input,checkEncryptHeaders(input),key)}var FlattenedEncrypt=class{#plaintext;#protectedHeader;#sharedUnprotectedHeader;#unprotectedHeader;#aad;#cek;#iv;#keyManagementParameters;constructor(plaintext){if(!(plaintext instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#plaintext=plaintext}setKeyManagementParameters(parameters){return assertNotSet(this.#keyManagementParameters,"setKeyManagementParameters"),this.#keyManagementParameters=parameters,this}setProtectedHeader(protectedHeader){return assertNotSet(this.#protectedHeader,"setProtectedHeader"),this.#protectedHeader=protectedHeader,this}setSharedUnprotectedHeader(sharedUnprotectedHeader){return assertNotSet(this.#sharedUnprotectedHeader,"setSharedUnprotectedHeader"),this.#sharedUnprotectedHeader=sharedUnprotectedHeader,this}setUnprotectedHeader(unprotectedHeader){return assertNotSet(this.#unprotectedHeader,"setUnprotectedHeader"),this.#unprotectedHeader=unprotectedHeader,this}setAdditionalAuthenticatedData(aad){return this.#aad=aad,this}setContentEncryptionKey(cek){return assertNotSet(this.#cek,"setContentEncryptionKey"),this.#cek=cek,this}setInitializationVector(iv){return assertNotSet(this.#iv,"setInitializationVector"),this.#iv=iv,this}async encrypt(key,options){if(!this.#protectedHeader&&!this.#unprotectedHeader&&!this.#sharedUnprotectedHeader)throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");return validateCritDuplicates(JWEInvalid,this.#protectedHeader),createJWE([this.#plaintext,this.#protectedHeader,this.#unprotectedHeader,this.#sharedUnprotectedHeader,this.#aad,this.#cek,this.#iv,this.#keyManagementParameters,options?.crit,options?unprotected in options:!1],key)}};var IndividualRecipient=class{#parent;state;constructor(enc,key,crit){this.#parent=enc,this.state=[void 0,void 0,key,crit]}setUnprotectedHeader(unprotectedHeader){return assertNotSet(this.state[0],"setUnprotectedHeader"),this.state[0]=unprotectedHeader,this}setKeyManagementParameters(parameters){return assertNotSet(this.state[1],"setKeyManagementParameters"),this.state[1]=parameters,this}addRecipient(...args){return this.#parent.addRecipient(...args)}encrypt(...args){return this.#parent.encrypt(...args)}done(){return this.#parent}};function copyOptionalMembers(flattened,jwe,recipient){let{aad,protected:protectedHeader,unprotected:unprotected2,header}=flattened;aad&&(jwe.aad=aad),protectedHeader&&(jwe.protected=protectedHeader),unprotected2&&(jwe.unprotected=unprotected2),header&&(recipient.header=header)}var GeneralEncrypt=class{#plaintext;#recipients=[];#protectedHeader;#unprotectedHeader;#aad;constructor(plaintext){this.#plaintext=plaintext}addRecipient(key,options){let recipient=new IndividualRecipient(this,key,options?.crit);return this.#recipients.push(recipient),recipient}setProtectedHeader(protectedHeader){return assertNotSet(this.#protectedHeader,"setProtectedHeader"),this.#protectedHeader=protectedHeader,this}setSharedUnprotectedHeader(sharedUnprotectedHeader){return assertNotSet(this.#unprotectedHeader,"setSharedUnprotectedHeader"),this.#unprotectedHeader=sharedUnprotectedHeader,this}setAdditionalAuthenticatedData(aad){return this.#aad=aad,this}async encrypt(){if(!this.#recipients.length)throw new JWEInvalid("at least one recipient must be added");if(!(this.#plaintext instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");if(this.#recipients.length===1){let[recipient]=this.#recipients,[unprotectedHeader,keyManagementParameters,key,crit]=recipient.state,flattened=await new FlattenedEncrypt(this.#plaintext).setAdditionalAuthenticatedData(this.#aad).setProtectedHeader(this.#protectedHeader).setSharedUnprotectedHeader(this.#unprotectedHeader).setUnprotectedHeader(unprotectedHeader).setKeyManagementParameters(keyManagementParameters).encrypt(key,{crit}),jwe2={ciphertext:flattened.ciphertext,iv:flattened.iv,recipients:[{}],tag:flattened.tag};return flattened.encrypted_key&&(jwe2.recipients[0].encrypted_key=flattened.encrypted_key),copyOptionalMembers(flattened,jwe2,jwe2.recipients[0]),jwe2}validateCritDuplicates(JWEInvalid,this.#protectedHeader);let enc,inputs=[],checked=[];for(let i=0;i<this.#recipients.length;i++){let recipient=this.#recipients[i],[unprotectedHeader,keyManagementParameters,,crit]=recipient.state,input=[this.#plaintext,this.#protectedHeader,unprotectedHeader,this.#unprotectedHeader,this.#aad,void 0,void 0,keyManagementParameters,crit,!0],headers=checkEncryptHeaders(input);if(inputs.push(input),checked.push(headers),headers[1]==="dir"||headers[1]==="ECDH-ES")throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);if(!enc)enc=headers[2];else if(enc!==headers[2])throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}let cek=generateCek(checked[0][3]),jwe={ciphertext:"",recipients:[]};for(let i=0;i<this.#recipients.length;i++){let recipient=this.#recipients[i],[unprotectedHeader,keyManagementParameters,key]=recipient.state,target={};if(jwe.recipients.push(target),i===0){inputs[0][5]=cek;let flattened=await encryptJWE(inputs[0],checked[0],key);jwe.ciphertext=flattened.ciphertext,jwe.iv=flattened.iv,jwe.tag=flattened.tag,target.encrypted_key=flattened.encrypted_key,copyOptionalMembers(flattened,jwe,target);continue}let[,alg,,encEntry]=checked[i],k=await prepareKey(jweAlgorithm(alg),key,"encrypt"),[,encryptedKey,parameters]=await encryptKeyManagement(alg,encEntry,k,cek,keyManagementParameters);target.encrypted_key=encode2(encryptedKey),(unprotectedHeader||parameters)&&(target.header={...unprotectedHeader,...parameters})}return jwe}};async function getSigKey(entry,key,usage){return key instanceof Uint8Array?crypto.subtle.importKey("raw",key,entry.subtle,!1,[usage]):(checkCryptoKey(key,entry.subtle,usage),entry.minRsaBits&&checkModulusLength(entry.alg,key),key)}async function sign(entry,key,data){let cryptoKey=await getSigKey(entry,key,"sign"),signature=await crypto.subtle.sign(entry.signing,cryptoKey,data);return new Uint8Array(signature)}async function verify(entry,key,signature,data){let cryptoKey=await getSigKey(entry,key,"verify");try{return await crypto.subtle.verify(entry.signing,cryptoKey,signature,data)}catch{return!1}}var sig=[["verify"],["sign"]];function hmac(bits){let subtle={name:"HMAC",hash:`SHA-${bits}`};return{kty:["oct"],secret:!0,subtle,signing:subtle,usages:sig}}function rsa(bits,saltLength){let subtle={name:saltLength?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${bits}`};return{kty:["RSA"],subtle,signing:saltLength?{...subtle,saltLength}:subtle,usages:sig,minRsaBits:2048}}function ecdsa(crv,bits){return{kty:["EC"],crv,subtle:{name:"ECDSA",namedCurve:crv},signing:{name:"ECDSA",hash:`SHA-${bits}`},usages:sig}}function eddsa(){let subtle={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle,signing:subtle,usages:sig}}function mldsa(bits){let subtle={name:`ML-DSA-${bits}`};return{kty:["AKP"],subtle,signing:subtle,usages:sig}}var JWS=table({HS256:hmac(256),HS384:hmac(384),HS512:hmac(512),RS256:rsa(256),RS384:rsa(384),RS512:rsa(512),PS256:rsa(256,32),PS384:rsa(384,48),PS512:rsa(512,64),ES256:ecdsa("P-256",256),ES384:ecdsa("P-384",384),ES512:ecdsa("P-521",512),EdDSA:eddsa(),Ed25519:eddsa(),"ML-DSA-44":mldsa(44),"ML-DSA-65":mldsa(65),"ML-DSA-87":mldsa(87)});function jwsAlgorithm(alg){let entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry)throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);return entry}function verifyResult(jws,verified){let[payload,parsedProt,,key,resolvedKey]=verified,result={payload};return jws.protected!==void 0&&(result.protectedHeader=parsedProt),jws.header!==void 0&&(result.unprotectedHeader=jws.header),resolvedKey?{...result,key}:result}function prepareVerify(options){return[options&&validateAlgorithms("algorithms",options.algorithms),options?.crit]}async function verifySignature(jws,shared,key){let{protected:encodedProtected,header,payload:inputPayload}=jws,parsedProt={};encodedProtected&&(parsedProt=parseJoseHeader(encodedProtected,JWSInvalid,"JWS Protected Header is invalid"));let joseHeader;if(header!==void 0){if(!isDisjoint(parsedProt,header))throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");joseHeader={...parsedProt,...header}}else joseHeader=parsedProt;let extensions=validateCrit(JWSInvalid,JWS_RECOGNIZED,shared[1],parsedProt,joseHeader),b64=!0;if(extensions.includes("b64")&&(b64=parsedProt.b64,typeof b64!="boolean"))throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg}=joseHeader;if(typeof alg!="string"||!alg)throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(shared[0]&&!shared[0].has(alg))throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(b64){if(typeof inputPayload!="string")throw new JWSInvalid("JWS Payload must be a string")}else if(typeof inputPayload!="string"&&!(inputPayload instanceof Uint8Array))throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");let resolvedKey=!1;typeof key=="function"&&(key=await key(parsedProt,jws),resolvedKey=!0);let entry=jwsAlgorithm(alg),data=concat(encodedProtected!==void 0?encode(encodedProtected):new Uint8Array,encode("."),typeof inputPayload=="string"?b64?shared[2]??=encodeBase64url(inputPayload,"payload",JWSInvalid):encoder.encode(inputPayload):inputPayload),signature=decodeBase64url(jws.signature,"signature",JWSInvalid),k=await prepareKey(entry,key,"verify");if(!await verify(entry,k,signature,data))throw new JWSSignatureVerificationFailed;let payload;return b64?payload=decodeBase64url(inputPayload,"payload",JWSInvalid):typeof inputPayload=="string"?payload=encoder.encode(inputPayload):payload=inputPayload,[payload,parsedProt,b64,k,resolvedKey]}async function verifyCompact(jws,shared,key){if(jws instanceof Uint8Array&&(jws=decoder.decode(jws)),typeof jws!="string")throw new JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3)throw new JWSInvalid("Invalid Compact JWS");return verifySignature({payload,protected:protectedHeader,signature},shared,key)}async function compactVerify(jws,key,options){let verified=await verifyCompact(jws,prepareVerify(options),key),result={payload:verified[0],protectedHeader:verified[1]};return typeof key=="function"?{...result,key:verified[3]}:result}async function flattenedVerify(jws,key,options){if(!isObject(jws))throw new JWSInvalid("Flattened JWS must be an object");if(jws.protected===void 0&&jws.header===void 0)throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');if(jws.protected!==void 0&&typeof jws.protected!="string")throw new JWSInvalid("JWS Protected Header incorrect type");if(jws.payload===void 0)throw new JWSInvalid("JWS Payload missing");if(typeof jws.signature!="string")throw new JWSInvalid("JWS Signature missing or incorrect type");if(jws.header!==void 0&&!isObject(jws.header))throw new JWSInvalid("JWS Unprotected Header incorrect type");return verifyResult(jws,await verifySignature(jws,prepareVerify(options),key))}async function generalVerify(jws,key,options){if(!isObject(jws))throw new JWSInvalid("General JWS must be an object");let{signatures,payload}=jws;if(!Array.isArray(signatures)||!signatures.every(isObject))throw new JWSInvalid("JWS Signatures missing or incorrect type");let shared;try{if(payload===void 0)throw new Error;shared=prepareVerify(options)}catch{throw new JWSSignatureVerificationFailed}for(let signature of signatures)try{let{protected:encodedProtected,header,signature:encodedSignature}=signature;if(encodedProtected===void 0&&header===void 0)throw new Error;if(encodedProtected!==void 0&&typeof encodedProtected!="string")throw new Error;if(typeof encodedSignature!="string")throw new Error;if(header!==void 0&&!isObject(header))throw new Error;return verifyResult(signature,await verifySignature({header,payload,protected:encodedProtected,signature:encodedSignature},shared,key))}catch{}throw new JWSSignatureVerificationFailed}var epoch=date=>Math.floor(date.getTime()/1e3),multipliers={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,checkFailed="check_failed";function secs(str){let matched=REGEX.exec(str);if(!matched||matched[4]&&matched[1])throw new TypeError("Invalid time period format");let value=parseFloat(matched[2]),numericDate2=Math.round(value*multipliers[matched[3][0].toLowerCase()]);return matched[1]==="-"||matched[4]==="ago"?-numericDate2:numericDate2}function validateInput(label,input){if(!Number.isFinite(input))throw new TypeError(`Invalid ${label} input`);return input}function numericDate(value,label){return typeof value=="number"?validateInput(label,value):value instanceof Date?validateInput(label,epoch(value)):epoch(new Date)+secs(value)}var normalizeTyp=value=>value.includes("/")?value.toLowerCase():`application/${value.toLowerCase()}`,checkAudiencePresence=(audPayload,audOption)=>typeof audPayload=="string"?audOption.includes(audPayload):Array.isArray(audPayload)?audOption.some(aud=>audPayload.includes(aud)):!1;function validateNumericDate(payload,claim,required=!1){let value=payload[claim];if(!(value===void 0&&!required)){if(typeof value!="number")throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`,payload,claim,"invalid");return value}}function unexpectedClaim(payload,claim){throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`,payload,claim,checkFailed)}function validateClaimsSet(protectedHeader,encodedPayload,options={}){let payload;try{payload=JSON.parse(strictDecoder.decode(encodedPayload))}catch{}if(!isObject(payload))throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");let{typ}=options;if(typ&&(typeof protectedHeader.typ!="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ)))throw new JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ",checkFailed);let{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options,presenceCheck=[...requiredClaims];maxTokenAge!==void 0&&presenceCheck.push("iat"),audience!==void 0&&presenceCheck.push("aud"),subject!==void 0&&presenceCheck.push("sub"),issuer!==void 0&&presenceCheck.push("iss");for(let claim of new Set(presenceCheck.reverse()))if(!Object.hasOwn(payload,claim))throw new JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing");issuer!==void 0&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss)&&unexpectedClaim(payload,"iss"),subject!==void 0&&payload.sub!==subject&&unexpectedClaim(payload,"sub"),audience!==void 0&&!checkAudiencePresence(payload.aud,typeof audience=="string"?[audience]:audience)&&unexpectedClaim(payload,"aud");let{clockTolerance}=options,tolerance=0;if(typeof clockTolerance=="string")tolerance=secs(clockTolerance);else if(clockTolerance!==void 0){if(typeof clockTolerance!="number")throw new TypeError("Invalid clockTolerance option type");tolerance=clockTolerance}validateInput("clockTolerance option",tolerance);let{currentDate}=options,now=validateInput("currentDate option",epoch(currentDate||new Date)),iat=validateNumericDate(payload,"iat",maxTokenAge!==void 0),nbf=validateNumericDate(payload,"nbf");if(nbf!==void 0&&nbf>now+tolerance)throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf",checkFailed);let exp=validateNumericDate(payload,"exp");if(exp!==void 0&&exp<=now-tolerance)throw new JWTExpired('"exp" claim timestamp check failed',payload,"exp",checkFailed);if(maxTokenAge!==void 0){let age=now-iat,max=typeof maxTokenAge=="number"?maxTokenAge:secs(maxTokenAge);if(age-tolerance>max)throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat",checkFailed);if(age<0-tolerance)throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat",checkFailed)}return payload}var JWTClaimsBuilder=class{#payload;constructor(payload){if(!isObject(payload))throw new TypeError("JWT Claims Set MUST be an object");this.#payload=structuredClone(payload)}data(){return encoder.encode(JSON.stringify(this.#payload))}get iss(){return this.#payload.iss}set iss(value){this.#payload.iss=value}get sub(){return this.#payload.sub}set sub(value){this.#payload.sub=value}get aud(){return this.#payload.aud}set aud(value){this.#payload.aud=value}set jti(value){this.#payload.jti=value}set nbf(value){this.#payload.nbf=numericDate(value,"setNotBefore")}set exp(value){this.#payload.exp=numericDate(value,"setExpirationTime")}set iat(value){value===void 0?this.#payload.iat=epoch(new Date):typeof value=="string"?this.#payload.iat=validateInput("setIssuedAt",epoch(new Date)+secs(value)):this.#payload.iat=numericDate(value,"setIssuedAt")}};async function jwtVerify(jwt,key,options){let verified=await verifyCompact(jwt,prepareVerify(options),key);if(!verified[2])throw new JWTInvalid("JWTs MUST NOT use unencoded payload");let result={payload:validateClaimsSet(verified[1],verified[0],options),protectedHeader:verified[1]};return typeof key=="function"?{...result,key:verified[3]}:result}async function jwtDecrypt(jwt,key,options){let decrypted=await decryptCompact(jwt,prepareDecrypt(options),key),protectedHeader=decrypted[1],payload=validateClaimsSet(protectedHeader,decrypted[0],options);if(protectedHeader.iss!==void 0&&protectedHeader.iss!==payload.iss)throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch',payload,"iss","mismatch");if(protectedHeader.sub!==void 0&&protectedHeader.sub!==payload.sub)throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch',payload,"sub","mismatch");if(protectedHeader.aud!==void 0&&JSON.stringify(protectedHeader.aud)!==JSON.stringify(payload.aud))throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch',payload,"aud","mismatch");let result={payload,protectedHeader};return typeof key=="function"?{...result,key:decrypted[2]}:result}var CompactEncrypt=class{#flattened;constructor(plaintext){this.#flattened=new FlattenedEncrypt(plaintext)}setContentEncryptionKey(cek){return this.#flattened.setContentEncryptionKey(cek),this}setInitializationVector(iv){return this.#flattened.setInitializationVector(iv),this}setProtectedHeader(protectedHeader){return this.#flattened.setProtectedHeader(protectedHeader),this}setKeyManagementParameters(parameters){return this.#flattened.setKeyManagementParameters(parameters),this}async encrypt(key,options){let jwe=await this.#flattened.encrypt(key,options);return[jwe.protected,jwe.encrypted_key,jwe.iv,jwe.ciphertext,jwe.tag].join(".")}};function unencodedPayload(protectedHeader){return protectedHeader?.b64===!1&&Array.isArray(protectedHeader.crit)&&protectedHeader.crit.includes("b64")}async function createSignature(input,key){let{protectedHeader,unprotectedHeader}=input;if(!protectedHeader&&!unprotectedHeader)throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!isDisjoint(protectedHeader,unprotectedHeader))throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let joseHeader={...protectedHeader,...unprotectedHeader};validateCritDuplicates(JWSInvalid,protectedHeader);let extensions=validateCrit(JWSInvalid,JWS_RECOGNIZED,input.crit,protectedHeader,joseHeader),b64=!0;if(extensions.includes("b64")&&(b64=protectedHeader.b64,typeof b64!="boolean"))throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg}=joseHeader;if(typeof alg!="string"||!alg)throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');let entry=jwsAlgorithm(alg),payloadS,payloadB;if(b64){let encoded=input.encoded??=[];encoded[0]??=encode2(input.payload),encoded[1]??=encode(encoded[0]),payloadS=encoded[0],payloadB=encoded[1]}else payloadB=input.payload,payloadS="";let protectedHeaderString,protectedHeaderBytes;protectedHeader?(protectedHeaderString=encode2(JSON.stringify(protectedHeader)),protectedHeaderBytes=encode(protectedHeaderString)):(protectedHeaderString="",protectedHeaderBytes=new Uint8Array);let data=concat(protectedHeaderBytes,encode("."),payloadB),k=await prepareKey(entry,key,"sign"),signature=await sign(entry,k,data),jws={signature:encode2(signature),payload:payloadS};return protectedHeader&&(jws.protected=protectedHeaderString),unprotectedHeader&&(jws.header=unprotectedHeader),jws}var FlattenedSign=class{#payload;#protectedHeader;#unprotectedHeader;constructor(payload){if(!(payload instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#payload=payload}setProtectedHeader(protectedHeader){return assertNotSet(this.#protectedHeader,"setProtectedHeader"),this.#protectedHeader=protectedHeader,this}setUnprotectedHeader(unprotectedHeader){return assertNotSet(this.#unprotectedHeader,"setUnprotectedHeader"),this.#unprotectedHeader=unprotectedHeader,this}async sign(key,options){return createSignature({payload:this.#payload,protectedHeader:this.#protectedHeader,unprotectedHeader:this.#unprotectedHeader,crit:options?.crit},key)}};var CompactSign=class{#flattened;#protectedHeader;constructor(payload){this.#flattened=new FlattenedSign(payload)}setProtectedHeader(protectedHeader){return this.#flattened.setProtectedHeader(protectedHeader),this.#protectedHeader=protectedHeader,this}async sign(key,options){if(unencodedPayload(this.#protectedHeader))throw new TypeError("use the flattened module for creating JWS with b64: false");let jws=await this.#flattened.sign(key,options);return`${jws.protected}.${jws.payload}.${jws.signature}`}};var IndividualSignature=class{#parent;state;constructor(sig2,key,options){this.#parent=sig2,this.state=[void 0,void 0,key,options?.crit]}setProtectedHeader(protectedHeader){return assertNotSet(this.state[0],"setProtectedHeader"),this.state[0]=protectedHeader,this}setUnprotectedHeader(unprotectedHeader){return assertNotSet(this.state[1],"setUnprotectedHeader"),this.state[1]=unprotectedHeader,this}addSignature(...args){return this.#parent.addSignature(...args)}sign(...args){return this.#parent.sign(...args)}done(){return this.#parent}},GeneralSign=class{#payload;#signatures=[];constructor(payload){this.#payload=payload}addSignature(key,options){let signature=new IndividualSignature(this,key,options);return this.#signatures.push(signature),signature}async sign(){if(!this.#signatures.length)throw new JWSInvalid("at least one signature must be added");if(!(this.#payload instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");let jws={signatures:[],payload:""},encoded=[];for(let i=0;i<this.#signatures.length;i++){let signature=this.#signatures[i],[protectedHeader,unprotectedHeader,key,crit]=signature.state,{payload,...rest}=await createSignature({payload:this.#payload,protectedHeader,unprotectedHeader,crit,encoded},key);if(i===0)jws.payload=payload;else if(jws.payload!==payload)throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");jws.signatures.push(rest)}return jws}};var SignJWT=class{#protectedHeader;#jwt;constructor(payload={}){this.#jwt=new JWTClaimsBuilder(payload)}setIssuer(issuer){return this.#jwt.iss=issuer,this}setSubject(subject){return this.#jwt.sub=subject,this}setAudience(audience){return this.#jwt.aud=audience,this}setJti(jwtId){return this.#jwt.jti=jwtId,this}setNotBefore(input){return this.#jwt.nbf=input,this}setExpirationTime(input){return this.#jwt.exp=input,this}setIssuedAt(input){return this.#jwt.iat=input,this}setProtectedHeader(protectedHeader){return this.#protectedHeader=protectedHeader,this}async sign(key,options){let sig2=new CompactSign(this.#jwt.data());if(sig2.setProtectedHeader(this.#protectedHeader),unencodedPayload(this.#protectedHeader))throw new JWTInvalid("JWTs MUST NOT use unencoded payload");return sig2.sign(key,options)}};var EncryptJWT=class{#cek;#iv;#keyManagementParameters;#protectedHeader;#replicateIssuerAsHeader;#replicateSubjectAsHeader;#replicateAudienceAsHeader;#jwt;constructor(payload={}){this.#jwt=new JWTClaimsBuilder(payload)}setIssuer(issuer){return this.#jwt.iss=issuer,this}setSubject(subject){return this.#jwt.sub=subject,this}setAudience(audience){return this.#jwt.aud=audience,this}setJti(jwtId){return this.#jwt.jti=jwtId,this}setNotBefore(input){return this.#jwt.nbf=input,this}setExpirationTime(input){return this.#jwt.exp=input,this}setIssuedAt(input){return this.#jwt.iat=input,this}setProtectedHeader(protectedHeader){return assertNotSet(this.#protectedHeader,"setProtectedHeader"),this.#protectedHeader=protectedHeader,this}setKeyManagementParameters(parameters){return assertNotSet(this.#keyManagementParameters,"setKeyManagementParameters"),this.#keyManagementParameters=parameters,this}setContentEncryptionKey(cek){return assertNotSet(this.#cek,"setContentEncryptionKey"),this.#cek=cek,this}setInitializationVector(iv){return assertNotSet(this.#iv,"setInitializationVector"),this.#iv=iv,this}replicateIssuerAsHeader(){return this.#replicateIssuerAsHeader=!0,this}replicateSubjectAsHeader(){return this.#replicateSubjectAsHeader=!0,this}replicateAudienceAsHeader(){return this.#replicateAudienceAsHeader=!0,this}async encrypt(key,options){let enc=new CompactEncrypt(this.#jwt.data());return this.#protectedHeader&&(this.#replicateIssuerAsHeader||this.#replicateSubjectAsHeader||this.#replicateAudienceAsHeader)&&(this.#protectedHeader={...this.#protectedHeader,iss:this.#replicateIssuerAsHeader?this.#jwt.iss:void 0,sub:this.#replicateSubjectAsHeader?this.#jwt.sub:void 0,aud:this.#replicateAudienceAsHeader?this.#jwt.aud:void 0}),enc.setProtectedHeader(this.#protectedHeader),this.#iv&&enc.setInitializationVector(this.#iv),this.#cek&&enc.setContentEncryptionKey(this.#cek),this.#keyManagementParameters&&enc.setKeyManagementParameters(this.#keyManagementParameters),enc.encrypt(key,options)}};var algArgument='"alg" (Algorithm)';function unsupportedAlg(source='JWK "alg" (Algorithm) Parameter'){throw new JOSENotSupported(`Invalid or unsupported ${source} value`)}function keyAlgorithm(alg,source){return(typeof alg=="string"?JWS[alg]??JWE[alg]:void 0)??unsupportedAlg(source)}var formatPEM=(b64,descriptor)=>{let newlined=(b64.match(/.{1,64}/g)||[]).join(`
-`);return`-----BEGIN ${descriptor}-----
-${newlined}
------END ${descriptor}-----`},genericExport=async(keyType,keyFormat,key)=>{if(isKeyObject(key)){if(key.type!==keyType)throw new TypeError(`key is not a ${keyType} key`);return key.export({format:"pem",type:keyFormat})}if(!isCryptoKey(key))throw new TypeError(invalidKeyInput(key,"CryptoKey","KeyObject"));if(!key.extractable)throw new TypeError("CryptoKey is not extractable");if(key.type!==keyType)throw new TypeError(`key is not a ${keyType} key`);return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat,key))),`${keyType.toUpperCase()} KEY`)},toSPKI=key=>genericExport("public","spki",key),toPKCS8=key=>genericExport("private","pkcs8",key),bytesEqual=(a,b)=>{if(a.byteLength!==b.length)return!1;for(let i=0;i<a.byteLength;i++)if(a[i]!==b[i])return!1;return!0},createASN1State=data=>({data,pos:0}),readByte=state=>{let byte=state.data[state.pos++];if(byte===void 0)throw new Error("Unexpected end of ASN.1 input");return byte},parseLength=state=>{let first=readByte(state);if(first&128){let lengthOfLen=first&127,length=0;for(let i=0;i<lengthOfLen;i++)length=length<<8|readByte(state);return length}return first},skipElement=(state,count=1)=>{for(;count-- >0;){state.pos++;let length=parseLength(state);state.pos+=length}},expectTag=(state,expectedTag,errorMessage)=>{if(readByte(state)!==expectedTag)throw new Error(errorMessage)},getSubarray=(state,length)=>{if(length<0||state.pos+length>state.data.length)throw new Error("Unexpected end of ASN.1 input");let result=state.data.subarray(state.pos,state.pos+length);return state.pos+=length,result},parseAlgorithmOID=state=>{expectTag(state,6,"Expected algorithm OID");let oidLen=parseLength(state);return getSubarray(state,oidLen)};function parseKeyHeader(state,keyFormat){if(expectTag(state,48,`Invalid ${keyFormat==="spki"?"SPKI":"PKCS#8"} structure`),parseLength(state),keyFormat==="pkcs8"){expectTag(state,2,"Expected version field");let length=parseLength(state);state.pos+=length}expectTag(state,48,"Expected algorithm identifier"),parseLength(state)}var parseECAlgorithmIdentifier=state=>{let algOid=parseAlgorithmOID(state);if(bytesEqual(algOid,[43,101,110]))return"X25519";if(!bytesEqual(algOid,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");expectTag(state,6,"Expected curve OID");let curveOidLen=parseLength(state),curveOid=getSubarray(state,curveOidLen);if(bytesEqual(curveOid,[42,134,72,206,61,3,1,7]))return"P-256";if(bytesEqual(curveOid,[43,129,4,0,34]))return"P-384";if(bytesEqual(curveOid,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},genericImport=async(keyFormat,keyData,alg,options)=>{let entry=keyAlgorithm(alg,algArgument);entry.secret&&unsupportedAlg(algArgument);let isPublic=keyFormat==="spki",algorithm;if(entry.resolve)try{let state=createASN1State(keyData);parseKeyHeader(state,keyFormat),algorithm=entry.resolve({crv:parseECAlgorithmIdentifier(state)})}catch{throw new JOSENotSupported("Invalid or unsupported key format")}else algorithm=entry.subtle;return crypto.subtle.importKey(keyFormat,keyData,algorithm,options?.extractable??isPublic,entry.usages[isPublic?0:1])},processPEMData=(pem,pattern)=>decodeBase64(pem.replace(pattern,"")),fromPKCS8=(pem,alg,options)=>{let keyData=processPEMData(pem,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return genericImport("pkcs8",keyData,alg,options)},fromSPKI=(pem,alg,options)=>{let keyData=processPEMData(pem,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return genericImport("spki",keyData,alg,options)};function spkiFromX509(buf){let state=createASN1State(buf);expectTag(state,48,"Invalid certificate structure"),parseLength(state),expectTag(state,48,"Invalid tbsCertificate structure"),parseLength(state),buf[state.pos]===160?skipElement(state,6):skipElement(state,5);let spkiStart=state.pos;expectTag(state,48,"Invalid SPKI structure");let spkiContentLen=parseLength(state);return buf.subarray(spkiStart,spkiStart+spkiContentLen+(state.pos-spkiStart))}var fromX509=(pem,alg,options)=>{let spki;try{let certificate=processPEMData(pem,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);spki=spkiFromX509(certificate)}catch(cause){throw new TypeError("Failed to parse the X.509 certificate",{cause})}return genericImport("spki",spki,alg,options)};function omitUndefinedProperties(jwk){return Object.fromEntries(Object.entries(jwk).filter(([,value])=>value!==void 0))}async function keyToJWK(key){if(isKeyObject(key))if(key.type==="secret")key=key.export();else return key.export({format:"jwk"});if(key instanceof Uint8Array)return{kty:"oct",k:encode2(key)};if(!isCryptoKey(key))throw new TypeError(invalidKeyInput(key,"CryptoKey","KeyObject","Uint8Array"));if(!key.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext,key_ops,alg,use,...jwk}=omitUndefinedProperties(await crypto.subtle.exportKey("jwk",key));return jwk.kty==="AKP"&&(jwk.alg=alg),jwk}function exportSPKI(key){return toSPKI(key)}function exportPKCS8(key){return toPKCS8(key)}function exportJWK(key){return keyToJWK(key)}var check=(value,description)=>{if(typeof value!="string"||!value)throw new JWKInvalid(`${description} missing or invalid`)};async function calculateJwkThumbprint(key,digestAlgorithm){let jwk;if(isJWK(key))jwk=key;else if(isKeyLike(key))jwk=await exportJWK(key);else throw new TypeError(invalidKeyInput(key,"CryptoKey","KeyObject","JSON Web Key"));if(digestAlgorithm??="sha256",digestAlgorithm!=="sha256"&&digestAlgorithm!=="sha384"&&digestAlgorithm!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let components;switch(jwk.kty){case"AKP":check(jwk.alg,'"alg" (Algorithm) Parameter'),check(jwk.pub,'"pub" (Public key) Parameter'),components={alg:jwk.alg,kty:jwk.kty,pub:jwk.pub};break;case"EC":check(jwk.crv,'"crv" (Curve) Parameter'),check(jwk.x,'"x" (X Coordinate) Parameter'),check(jwk.y,'"y" (Y Coordinate) Parameter'),components={crv:jwk.crv,kty:jwk.kty,x:jwk.x,y:jwk.y};break;case"OKP":check(jwk.crv,'"crv" (Subtype of Key Pair) Parameter'),check(jwk.x,'"x" (Public Key) Parameter'),components={crv:jwk.crv,kty:jwk.kty,x:jwk.x};break;case"RSA":check(jwk.e,'"e" (Exponent) Parameter'),check(jwk.n,'"n" (Modulus) Parameter'),components={e:jwk.e,kty:jwk.kty,n:jwk.n};break;case"oct":check(jwk.k,'"k" (Key Value) Parameter'),components={k:jwk.k,kty:jwk.kty};break;default:throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported')}let data=encode(JSON.stringify(components));return encode2(await digest(digestAlgorithm,data))}async function calculateJwkThumbprintUri(key,digestAlgorithm){digestAlgorithm??="sha256";let thumbprint=await calculateJwkThumbprint(key,digestAlgorithm);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`}async function EmbeddedJWK(protectedHeader,token){let joseHeader={...protectedHeader,...token?.header};if(!isObject(joseHeader.jwk))throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let entry=jwsAlgorithm(joseHeader.alg),key=await jwkToKey(entry,{...joseHeader.jwk,ext:!0});if(key.type!=="public")throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');return key}function signatureAlgorithm(alg){let entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry||entry.secret)throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');return entry}function isJWKSLike(jwks){if(!jwks||typeof jwks!="object")return!1;let{keys}=jwks;return Array.isArray(keys)&&keys.every(isObject)}var LocalJWKSetImpl=class{#jwks;#cached=new WeakMap;constructor(jwks){if(!isJWKSLike(jwks))throw new JWKSInvalid("JSON Web Key Set malformed");this.#jwks=structuredClone(jwks)}jwks(){return this.#jwks}async getKey(protectedHeader,token){let{alg,kid}={...protectedHeader,...token?.header},entry=signatureAlgorithm(alg),candidates=this.#jwks.keys.filter(jwk2=>entry.kty.includes(jwk2.kty)&&(typeof kid!="string"||kid===jwk2.kid)&&(!(typeof jwk2.alg=="string"||jwk2.kty==="AKP")||alg===jwk2.alg)&&(typeof jwk2.use!="string"||jwk2.use==="sig")&&(!Array.isArray(jwk2.key_ops)||jwk2.key_ops.includes("verify"))&&(!entry.crv||jwk2.crv===entry.crv)),{0:jwk,length}=candidates;if(length===0)throw new JWKSNoMatchingKey;if(length!==1){let error=new JWKSMultipleMatchingKeys,_cached=this.#cached;throw error[Symbol.asyncIterator]=async function*(){for(let jwk2 of candidates)try{yield await importWithAlgCache(_cached,jwk2,entry)}catch{}},error}return importWithAlgCache(this.#cached,jwk,entry)}};async function importWithAlgCache(cache2,jwk,entry){let cached2=cache2.get(jwk)||cache2.set(jwk,{__proto__:null}).get(jwk);if(cached2[entry.alg]===void 0){let key=await jwkToKey(entry,{...jwk,alg:entry.alg,ext:!0});if(key.type!=="public")throw new JWKSInvalid("JSON Web Key Set members must be public keys");cached2[entry.alg]=key}return cached2[entry.alg]}function createLocalJWKSet(jwks){let set=new LocalJWKSetImpl(jwks),localJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);return Object.defineProperty(localJWKSet,"jwks",{value:()=>structuredClone(set.jwks())}),localJWKSet}function isCloudflareWorkers(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var USER_AGENT;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(USER_AGENT="jose/v6.2.8");var customFetch=Symbol();async function fetchJwks(url,headers,signal,fetchImpl=fetch){let response=await fetchImpl(url,{method:"GET",signal,redirect:"manual",headers}).catch(err=>{throw err.name==="TimeoutError"?new JWKSTimeout:err});if(response.status!==200)throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await response.json()}catch{throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var jwksCache=Symbol();function isFreshJwksCache(input,cacheMaxAge){return!(typeof input!="object"||input===null||!("uat"in input)||typeof input.uat!="number"||Date.now()-input.uat>=cacheMaxAge||!("jwks"in input)||!isObject(input.jwks)||!Array.isArray(input.jwks.keys)||!Array.prototype.every.call(input.jwks.keys,isObject))}var RemoteJWKSetImpl=class{#url;#timeoutDuration;#cooldownDuration;#cacheMaxAge;#jwksTimestamp;#pendingFetch;#headers;#customFetch;#local;#cache;constructor(url,options){if(!(url instanceof URL))throw new TypeError("url must be an instance of URL");this.#url=new URL(url.href);let opts=options??{};this.#timeoutDuration=typeof opts.timeoutDuration=="number"?opts.timeoutDuration:5e3,this.#cooldownDuration=typeof opts.cooldownDuration=="number"?opts.cooldownDuration:3e4,this.#cacheMaxAge=typeof opts.cacheMaxAge=="number"?opts.cacheMaxAge:6e5,this.#headers=new Headers(opts.headers),USER_AGENT&&!this.#headers.has("User-Agent")&&this.#headers.set("User-Agent",USER_AGENT),this.#headers.has("accept")||(this.#headers.set("accept","application/json"),this.#headers.append("accept","application/jwk-set+json")),this.#customFetch=opts[customFetch];let cache2=opts[jwksCache];cache2!==void 0&&(this.#cache=cache2,isFreshJwksCache(cache2,this.#cacheMaxAge)&&(this.#jwksTimestamp=this.#cache.uat,this.#local=createLocalJWKSet(this.#cache.jwks)))}pendingFetch(){return!!this.#pendingFetch}#validFor(duration){return typeof this.#jwksTimestamp=="number"&&Date.now()<this.#jwksTimestamp+duration}coolingDown(){return this.#validFor(this.#cooldownDuration)}fresh(){return this.#validFor(this.#cacheMaxAge)}jwks(){return this.#local?.jwks()}async getKey(protectedHeader,token){(!this.#local||!this.fresh())&&await this.reload();try{return await this.#local(protectedHeader,token)}catch(err){if(err instanceof JWKSNoMatchingKey&&this.coolingDown()===!1)return await this.reload(),this.#local(protectedHeader,token);throw err}}async reload(){this.#pendingFetch&&isCloudflareWorkers()&&(this.#pendingFetch=void 0),this.#pendingFetch||=fetchJwks(this.#url.href,this.#headers,AbortSignal.timeout(this.#timeoutDuration),this.#customFetch).then(json=>{this.#local=createLocalJWKSet(json),this.#cache&&(this.#cache.uat=Date.now(),this.#cache.jwks=json),this.#jwksTimestamp=Date.now()}).finally(()=>{this.#pendingFetch=void 0}),await this.#pendingFetch}};function createRemoteJWKSet(url,options){let set=new RemoteJWKSetImpl(url,options),remoteJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);return Object.defineProperties(remoteJWKSet,{coolingDown:{get:()=>set.coolingDown(),enumerable:!0},fresh:{get:()=>set.fresh(),enumerable:!0},reload:{value:()=>set.reload(),enumerable:!0},reloading:{get:()=>set.pendingFetch(),enumerable:!0},jwks:{value:()=>set.jwks(),enumerable:!0}}),remoteJWKSet}var UnsecuredJWT=class{#jwt;constructor(payload={}){this.#jwt=new JWTClaimsBuilder(payload)}encode(){let header=encode2(JSON.stringify({alg:"none"})),payload=encode2(this.#jwt.data());return`${header}.${payload}.`}setIssuer(issuer){return this.#jwt.iss=issuer,this}setSubject(subject){return this.#jwt.sub=subject,this}setAudience(audience){return this.#jwt.aud=audience,this}setJti(jwtId){return this.#jwt.jti=jwtId,this}setNotBefore(input){return this.#jwt.nbf=input,this}setExpirationTime(input){return this.#jwt.exp=input,this}setIssuedAt(input){return this.#jwt.iat=input,this}static decode(jwt,options){if(typeof jwt!="string")throw new JWTInvalid("Unsecured JWT must be a string");let{0:encodedHeader,1:encodedPayload,2:signature,length}=jwt.split(".");if(length!==3||signature!=="")throw new JWTInvalid("Invalid Unsecured JWT");let header;try{if(header=JSON.parse(strictDecoder.decode(decode(encodedHeader))),header.alg!=="none")throw new Error}catch{throw new JWTInvalid("Invalid Unsecured JWT")}return{payload:validateClaimsSet(header,decodeBase64url(encodedPayload,"payload",JWTInvalid),options),header}}};async function importSPKI(spki,alg,options){if(typeof spki!="string"||spki.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return fromSPKI(spki,alg,options)}async function importX509(x509,alg,options){if(typeof x509!="string"||x509.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return fromX509(x509,alg,options)}async function importPKCS8(pkcs8,alg,options){if(typeof pkcs8!="string"||pkcs8.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return fromPKCS8(pkcs8,alg,options)}async function importJWK(jwk,alg,options){if(!isObject(jwk))throw new TypeError("JWK must be an object");alg??=jwk.alg;let ext=options?.extractable??jwk.ext;if(jwk.kty!=="oct"&&!alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(jwk.kty){case"oct":if(typeof jwk.k!="string"||!jwk.k)throw new TypeError('missing "k" (Key Value) Parameter value');return decode(jwk.k);case"RSA":return jwkToKey(keyAlgorithm(alg),{...jwk,alg,ext});case"AKP":{if(typeof jwk.alg!="string"||!jwk.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(alg!==void 0&&alg!==jwk.alg)throw new TypeError("JWK alg and alg option value mismatch");return jwkToKey(keyAlgorithm(jwk.alg),{...jwk,ext})}case"EC":case"OKP":return jwkToKey(keyAlgorithm(alg),{...jwk,alg,ext});default:throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value')}}function decodeProtectedHeader(token){let protectedB64u;if(typeof token=="string"){let parts=token.split(".");(parts.length===3||parts.length===5)&&([protectedB64u]=parts)}else if(typeof token=="object"&&token)if("protected"in token)protectedB64u=token.protected;else throw new TypeError("Token does not contain a Protected Header");let invalid2="Invalid Token or Protected Header formatting";if(typeof protectedB64u!="string"||!protectedB64u)throw new TypeError(invalid2);return parseJoseHeader(protectedB64u,TypeError,invalid2)}function decodeJwt(jwt){if(typeof jwt!="string")throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");let{1:payload,length}=jwt.split(".");if(length===5)throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");if(length!==3)throw new JWTInvalid("Invalid JWT");if(!payload)throw new JWTInvalid("JWTs must contain a payload");let decoded;try{decoded=decode(payload)}catch{throw new JWTInvalid("Failed to base64url decode the payload")}let result;try{result=JSON.parse(strictDecoder.decode(decoded))}catch{throw new JWTInvalid("Failed to parse the decoded payload as JSON")}if(!isObject(result))throw new JWTInvalid("Invalid JWT Claims Set");return result}function getModulusLengthOption(options){let modulusLength=options?.modulusLength??2048;if(typeof modulusLength!="number"||modulusLength<2048)throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return modulusLength}async function generateKeyPair(alg,options){let entry=keyAlgorithm(alg,algArgument);entry.secret&&unsupportedAlg(algArgument);let algorithm;if(entry.resolve){let crv=options?.crv??"P-256";switch(crv){case"P-256":case"P-384":case"P-521":algorithm={name:"ECDH",namedCurve:crv};break;case"X25519":algorithm={name:"X25519"};break;default:throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}}else{if(entry.crv!==void 0&&options?.crv!==void 0&&options.crv!==entry.crv)throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);algorithm=entry.kty[0]==="RSA"?{...entry.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:getModulusLengthOption(options)}:entry.subtle}return crypto.subtle.generateKey(algorithm,options?.extractable??!1,[...entry.usages[1],...entry.usages[0]])}async function generateSecret(alg,options){let length,algorithm,keyUsages;switch(alg){case"HS256":case"HS384":case"HS512":length=parseInt(alg.slice(-3),10),algorithm={name:"HMAC",hash:`SHA-${length}`,length},keyUsages=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return length=parseInt(alg.slice(-3),10),crypto.getRandomValues(new Uint8Array(length>>3));case"A128KW":case"A192KW":case"A256KW":length=parseInt(alg.slice(1,4),10),algorithm={name:"AES-KW",length},keyUsages=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":length=parseInt(alg.slice(1,4),10),algorithm={name:"AES-GCM",length},keyUsages=["encrypt","decrypt"];break;default:unsupportedAlg(algArgument)}return crypto.subtle.generateKey(algorithm,options?.extractable??!1,keyUsages)}var cryptoRuntime="WebCryptoAPI";export{CompactEncrypt,CompactSign,EmbeddedJWK,EncryptJWT,FlattenedEncrypt,FlattenedSign,GeneralEncrypt,GeneralSign,SignJWT,UnsecuredJWT,base64url_exports as base64url,calculateJwkThumbprint,calculateJwkThumbprintUri,compactDecrypt,compactVerify,createLocalJWKSet,createRemoteJWKSet,cryptoRuntime,customFetch,decodeJwt,decodeProtectedHeader,errors_exports as errors,exportJWK,exportPKCS8,exportSPKI,flattenedDecrypt,flattenedVerify,generalDecrypt,generalVerify,generateKeyPair,generateSecret,importJWK,importPKCS8,importSPKI,importX509,jwksCache,jwtDecrypt,jwtVerify};

package/dist/bundle/client.js

@@ -1,2 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);
-import"./chunks/chunk-JXWJOIH4.js";function isJsonValue(value){return value===null||typeof value=="boolean"||typeof value=="string"?!0:typeof value=="number"?Number.isFinite(value):Array.isArray(value)?value.every(isJsonValue):typeof value!="object"||Object.getPrototypeOf(value)!==Object.prototype?!1:Object.values(value).every(isJsonValue)}function parsePartialToolInput(value){try{let parsed=JSON.parse(value);if(isJsonValue(parsed))return parsed}catch{}return value}function createTranscriptState(snapshot){return{snapshot:structuredClone(snapshot),progressItems:new Map,progressOrder:[],toolCallBuffers:new Map}}function applyTranscriptSnapshot(state,snapshot){return state.snapshot.id===snapshot.id&&snapshot.revision<state.snapshot.revision?state:createTranscriptState(snapshot)}function applyTranscriptProgress(state,progress){if(progress.type==="item_started"||progress.type==="item_updated")return setProgressItem(state,progress.item);if(progress.type==="item_finished"){let toolCallBuffers2=new Map(state.toolCallBuffers);for(let key of toolCallBuffers2.keys())key.startsWith(`${progress.item.id}:`)&&toolCallBuffers2.delete(key);return setProgressItem({...state,toolCallBuffers:toolCallBuffers2},progress.item)}let item=state.progressItems.get(progress.messageId)??state.snapshot.transcript.find(({id})=>id===progress.messageId);if(item?.role!=="assistant")return state;let toolCallBuffers=state.toolCallBuffers,content=item.content.map((part,index)=>{if(index!==progress.contentIndex)return structuredClone(part);if(progress.kind==="text"&&part.type==="text")return{...part,text:part.text+progress.delta};if(progress.kind==="thinking"&&part.type==="thinking")return{...part,thinking:part.thinking+progress.delta};if(progress.kind==="toolCall"&&part.type==="toolCall"){let key=`${progress.messageId}:${progress.contentIndex}`,buffer=(state.toolCallBuffers.get(key)??(typeof part.input=="string"?part.input:""))+progress.delta;return toolCallBuffers=new Map(state.toolCallBuffers).set(key,buffer),{...part,input:parsePartialToolInput(buffer)}}return structuredClone(part)});return setProgressItem({...state,toolCallBuffers},{...item,content})}function selectTranscript(state){let transcript=state.snapshot.transcript.map(item=>state.progressItems.get(item.id)??item),ids=new Set(transcript.map(item=>item.id));for(let id of state.progressOrder){if(ids.has(id))continue;let item=state.progressItems.get(id);item&&(transcript.push(item),ids.add(id))}for(let item of state.snapshot.queuedSteer)ids.has(item.id)||(transcript.push(item),ids.add(item.id));return transcript}function setProgressItem(state,item){let progressItems=new Map(state.progressItems),progressOrder=progressItems.has(item.id)?state.progressOrder:[...state.progressOrder,item.id];return progressItems.set(item.id,structuredClone(item)),{...state,progressItems,progressOrder}}var RemoteSessionDisposedError=class extends Error{constructor(){super("Remote session is disposed"),this.name="RemoteSessionDisposedError"}};async function settleRemoteSessionDisposal(cleanup){let errors=(await Promise.allSettled(cleanup)).flatMap(result=>result.status==="rejected"&&!(result.reason instanceof RemoteSessionDisposedError)?[result.reason]:[]);if(errors.length===1)throw errors[0];if(errors.length>1)throw new AggregateError(errors,"Failed to dispose remote session")}var RemoteSession=class _RemoteSession{#client;#onListenerError;#lifecycle={status:"unbound"};#handle;#transcript;#unsubscribeSnapshot;#unsubscribeEvents;#listeners=new Set;#pendingAttachmentOperations=new Set;#activeOperationStates=new Set;#disposePromise;#resolveDisposeSignal=()=>{};#disposeSignal=new Promise(resolve=>{this.#resolveDisposeSignal=resolve});constructor(client,options={}){this.#client=client,this.#onListenerError=options.onListenerError}get id(){return this.#handle?.id}get state(){return{lifecycle:this.#lifecycle,snapshot:this.#transcript?.snapshot,transcript:this.#transcript?selectTranscript(this.#transcript):[]}}get snapshot(){return this.#transcript?.snapshot}get phase(){return this.snapshot?.phase}get operation(){return this.#lifecycle.status==="busy"?this.#lifecycle.operation:void 0}get models(){return this.#client.snapshot?.models??[]}get sessions(){return this.#client.snapshot?.sessions??[]}get connectionState(){return this.#client.connectionState}get disposed(){return this.#lifecycle.status==="disposed"}subscribe(listener){return this.#assertNotDisposed(),this.#listeners.add(listener),this.#callListener(listener,this.state),()=>this.#listeners.delete(listener)}onConnectionStateChange(listener){return this.#assertNotDisposed(),this.#client.onConnectionStateChange(listener)}static async open(client,sessionId,options={}){let session=new _RemoteSession(client,options);try{return await session.open(sessionId),session}catch(error){throw await session.dispose(),error}}async open(sessionId){this.#handle?.id===sessionId&&this.#lifecycle.status==="ready"||await this.#replace("open",()=>this.#client.acquireSession(sessionId,{mode:"exclusive"}))}static async create(client,createOptions,options={}){let session=new _RemoteSession(client,options);try{return await session.create(createOptions),session}catch(error){throw await session.dispose(),error}}async create(options){await this.#replace("create",()=>this.#client.createSession(options))}async submit(text){let normalized=text.trim();if(!normalized)return;this.#assertAvailable();let handle=this.#requireHandle();if(this.phase!=="idle"&&this.phase!=="turn")throw new Error(`Session cannot accept input during ${this.phase??"unknown"} phase`);await this.#runOperation("submit",()=>(this.phase==="idle"?handle.prompt(normalized):handle.steer(normalized)).then(()=>{}))}async abort(){let preemptingSubmit=this.#lifecycle.status==="busy"&&this.#lifecycle.operation==="submit";preemptingSubmit?this.#assertNotDisposed():this.#assertAvailable();let handle=this.#requireHandle();this.phase==="idle"&&!preemptingSubmit||await this.#runOperation("abort",()=>handle.abort().then(()=>{}),preemptingSubmit)}async setModel(model){await this.#runIdleOperation("setModel","change model",()=>this.#requireHandle().setModel(model).then(()=>{}))}async setThinking(thinkingLevel){await this.#runIdleOperation("setThinking","change thinking level",()=>this.#requireHandle().setThinking(thinkingLevel).then(()=>{}))}async reconnect(){this.#assertAvailable();let sessionId=this.#requireHandle().id;await this.#runOperation("reconnect",()=>this.#trackAttachmentOperation(async()=>{await this.#client.reconnect();let handle=await this.#client.acquireSession(sessionId,{mode:"exclusive"});await this.#assertNotDisposedAfterAwait(handle),this.#bind(handle)}))}dispose(){if(this.#disposePromise)return this.#disposePromise;let handle=this.#handle;this.#lifecycle={status:"disposed"},this.#resolveDisposeSignal(),this.#clearSubscriptions(),this.#handle=void 0,this.#transcript=void 0;let cleanup=[...this.#pendingAttachmentOperations];return handle&&cleanup.push(handle.dispose()),this.#disposePromise=settleRemoteSessionDisposal(cleanup),this.#notify(),this.#listeners.clear(),this.#disposePromise}[Symbol.asyncDispose](){return this.dispose()}async#replace(operation,prepare){if(this.#assertAvailable(),this.#handle&&this.phase!=="idle")throw new Error(`Cannot ${operation} a session while session is ${this.phase??"unavailable"}`);await this.#runOperation(operation,()=>this.#trackAttachmentOperation(()=>this.#prepareReplacement(operation,prepare)))}async#trackAttachmentOperation(run){let pending=run();this.#pendingAttachmentOperations.add(pending);try{await pending}finally{this.#pendingAttachmentOperations.delete(pending)}}async#prepareReplacement(operation,prepare){let previous=this.#handle,next=await prepare();await this.#assertNotDisposedAfterAwait(next);let snapshot=next.snapshot;if(!snapshot)throw await this.#detach(next),new Error(`Session ${next.id} did not provide a snapshot`);if(previous&&previous.id!==next.id&&previous.attached&&this.phase!=="idle")throw await this.#detach(next),new Error(`Cannot ${operation} a session while session is ${this.phase??"unavailable"}`);if(previous&&previous.id!==next.id&&previous.attached)try{await previous.detach()}catch(error){try{await this.#detach(next)}catch(cleanupError){throw new AggregateError([error,cleanupError],"Failed to replace remote session attachment")}throw error}await this.#assertNotDisposedAfterAwait(next),this.#bind(next,snapshot)}async#runIdleOperation(operation,description,run){if(this.#assertAvailable(),this.#requireHandle(),this.phase!=="idle")throw new Error(`Cannot ${description} while session is ${this.phase??"unavailable"}`);await this.#runOperation(operation,run)}async#runOperation(operation,run,preempt=!1){preempt?this.#assertNotDisposed():this.#assertAvailable();let previous=this.#lifecycle,busy={status:"busy",operation};this.#lifecycle=busy,this.#activeOperationStates.add(busy),this.#notify();let running=run();try{await Promise.race([running,this.#disposeSignal.then(()=>{throw new Error("Remote session is disposed")})])}finally{this.#activeOperationStates.delete(busy),!this.disposed&&this.#lifecycle===busy&&(this.#lifecycle=preempt&&this.#activeOperationStates.has(previous)?previous:this.#handle?{status:"ready"}:{status:"unbound"},this.#notify())}}#bind(handle,knownSnapshot){let snapshot=knownSnapshot??handle.snapshot;if(!snapshot)throw new Error(`Session ${handle.id} did not provide a snapshot`);this.#clearSubscriptions(),this.#handle=handle,this.#transcript=createTranscriptState(snapshot),this.#unsubscribeSnapshot=handle.subscribe(next=>{this.#transcript&&(this.#transcript=applyTranscriptSnapshot(this.#transcript,next),this.#notify())}),this.#unsubscribeEvents=handle.onEvent(event=>this.#handleEvent(event))}#handleEvent(event){if(event.type==="session_removed"){this.#clearSubscriptions(),this.#handle=void 0,this.#transcript=void 0,this.#lifecycle.status!=="busy"&&(this.#lifecycle={status:"unbound"}),this.#notify();return}event.type!=="session_progress"||!this.#transcript||(this.#transcript=applyTranscriptProgress(this.#transcript,event.progress),this.#notify())}#notify(){let state=this.state;for(let listener of this.#listeners)this.#callListener(listener,state)}#callListener(listener,state){try{listener(state)}catch(error){this.#reportListenerError(error)}}#reportListenerError(error){if(this.#onListenerError)try{this.#onListenerError(error instanceof Error?error:new Error(String(error)))}catch{}}#clearSubscriptions(){this.#unsubscribeSnapshot?.(),this.#unsubscribeEvents?.(),this.#unsubscribeSnapshot=void 0,this.#unsubscribeEvents=void 0}#requireHandle(){if(!this.#handle)throw new Error("No remote session is attached");return this.#handle}#assertAvailable(){if(this.#assertNotDisposed(),this.#lifecycle.status==="busy")throw new Error(`Remote session is busy with ${this.#lifecycle.operation}`)}#assertNotDisposed(){if(this.disposed)throw new Error("Remote session is disposed")}async#assertNotDisposedAfterAwait(handle){if(this.disposed)throw await this.#detach(handle),new RemoteSessionDisposedError}async#detach(handle){await handle.dispose()}};export{RemoteSession,applyTranscriptProgress,applyTranscriptSnapshot,createTranscriptState,selectTranscript};

package/dist/cli/experimental/auth.d.ts

@@ -1,16 +0,0 @@
-export type AuthInput = {
-    readonly type: "token";
-    readonly token: string;
-} | {
-    readonly type: "file";
-    readonly path: string;
-};
-export interface RawAuthOptions {
-    readonly authToken?: string;
-    readonly authTokenFile?: string;
-}
-export declare function parseAuthInput(options: RawAuthOptions): {
-    auth?: AuthInput;
-    errors: string[];
-};
-//# sourceMappingURL=auth.d.ts.map

package/dist/cli/experimental/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/experimental/auth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAW9F"}

package/dist/cli/experimental/auth.js

@@ -1,13 +0,0 @@
-export function parseAuthInput(options) {
-    if (options.authToken !== undefined && options.authTokenFile !== undefined) {
-        return { errors: ["--auth-token and --auth-token-file are mutually exclusive"] };
-    }
-    if (options.authToken !== undefined) {
-        return { auth: { type: "token", token: options.authToken }, errors: [] };
-    }
-    if (options.authTokenFile !== undefined) {
-        return { auth: { type: "file", path: options.authTokenFile }, errors: [] };
-    }
-    return { errors: [] };
-}
-//# sourceMappingURL=auth.js.map

package/dist/cli/experimental/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/experimental/auth.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,cAAc,CAAC,OAAuB;IACrD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,CAAC,2DAA2D,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvB,CAAC","sourcesContent":["export type AuthInput =\n\t| { readonly type: \"token\"; readonly token: string }\n\t| { readonly type: \"file\"; readonly path: string };\n\nexport interface RawAuthOptions {\n\treadonly authToken?: string;\n\treadonly authTokenFile?: string;\n}\n\nexport function parseAuthInput(options: RawAuthOptions): { auth?: AuthInput; errors: string[] } {\n\tif (options.authToken !== undefined && options.authTokenFile !== undefined) {\n\t\treturn { errors: [\"--auth-token and --auth-token-file are mutually exclusive\"] };\n\t}\n\tif (options.authToken !== undefined) {\n\t\treturn { auth: { type: \"token\", token: options.authToken }, errors: [] };\n\t}\n\tif (options.authTokenFile !== undefined) {\n\t\treturn { auth: { type: \"file\", path: options.authTokenFile }, errors: [] };\n\t}\n\treturn { errors: [] };\n}\n"]}