@indigoai-us/hq-cloud 6.6.0 → 6.7.1

package/dist/cognito-auth.d.ts

@@ -69,6 +69,38 @@ export declare function isExpiring(tokens: CognitoTokens, bufferSeconds?: number
  * forcing a re-login is the only safe self-heal.
  */
 export declare function decodeAccessTokenClientId(accessToken: string): string | null;
+export interface MachineCreds {
+    /** Cognito username (live boxes: "agt-<ulid>@agents.getindigo.ai"). */
+    username: string;
+    /** Long-lived machine secret (USER_PASSWORD_AUTH password). */
+    secret: string;
+    /** App client to mint against — provisioned creds carry their own
+     *  (USER_PASSWORD_AUTH must be enabled on it); falls back to config. */
+    clientId?: string;
+    /** Cognito region for the mint endpoint; falls back to config. */
+    region?: string;
+}
+/** Resolve the machine-creds file path (HQ_MACHINE_CREDS_FILE overrides). */
+export declare function machineCredsFilePath(): string;
+/**
+ * Load machine credentials, or null when this process is not running as a
+ * machine identity (no creds file / unreadable / malformed).
+ */
+export declare function loadMachineCreds(): MachineCreds | null;
+/** True when machine credentials are present — the CLI is a machine identity. */
+export declare function isMachineIdentity(): boolean;
+/**
+ * Mint a fresh session for the machine identity via USER_PASSWORD_AUTH
+ * against the Cognito IDP endpoint (plain unsigned HTTP — no AWS SDK
+ * dependency). Caches BOTH tokens with correct field semantics and returns
+ * them.
+ */
+export declare function mintMachineTokens(config: CognitoAuthConfig, creds?: MachineCreds): Promise<CognitoTokens>;
+/**
+ * Return a valid (non-expiring) machine session, re-minting on demand.
+ * Cache-hit path never touches the network.
+ */
+export declare function getValidMachineTokens(config: CognitoAuthConfig): Promise<CognitoTokens>;
 /**
  * Open the Cognito Hosted UI in the user's browser, wait for the redirect
  * back to localhost, and exchange the auth code for tokens.

package/dist/cognito-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-auth.d.ts","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,+KAA+K;IAC/K,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,qFAAqF;AACrF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AASD,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAQvD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAO5D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAiBD,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,SAAK,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAsCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2GxB;AAsDD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CAsCjB"}
+{"version":3,"file":"cognito-auth.d.ts","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,+KAA+K;IAC/K,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,qFAAqF;AACrF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AASD,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAQvD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAO5D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAiBD,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,SAAK,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAmBD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf;4EACwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CA+BtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAcD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,aAAa,CAAC,CAqDxB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CAYxB;AAsCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2GxB;AAsDD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CA8CjB"}

package/dist/cognito-auth.js

@@ -106,6 +106,114 @@ export function decodeAccessTokenClientId(accessToken) {
         return null;
     }
 }
+/** Resolve the machine-creds file path (HQ_MACHINE_CREDS_FILE overrides). */
+export function machineCredsFilePath() {
+    return (process.env.HQ_MACHINE_CREDS_FILE ??
+        path.join(os.homedir(), ".hq-agent", "machine-creds.json"));
+}
+/**
+ * Load machine credentials, or null when this process is not running as a
+ * machine identity (no creds file / unreadable / malformed).
+ */
+export function loadMachineCreds() {
+    const file = machineCredsFilePath();
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
+        // The creds FILE is the machine-identity signal — no username-shape
+        // gate. (6.7.0 required a "machine-" prefix, but live boxes are
+        // provisioned with "agt-<ulid>@agents.getindigo.ai", so detection
+        // never engaged on the first real agent box, 2026-06-12.)
+        if (typeof raw.username === "string" &&
+            raw.username.length > 0 &&
+            typeof raw.secret === "string" &&
+            raw.secret.length > 0) {
+            return {
+                username: raw.username,
+                secret: raw.secret,
+                clientId: typeof raw.clientId === "string" ? raw.clientId : undefined,
+                region: typeof raw.region === "string" ? raw.region : undefined,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when machine credentials are present — the CLI is a machine identity. */
+export function isMachineIdentity() {
+    return loadMachineCreds() !== null;
+}
+/**
+ * Mint a fresh session for the machine identity via USER_PASSWORD_AUTH
+ * against the Cognito IDP endpoint (plain unsigned HTTP — no AWS SDK
+ * dependency). Caches BOTH tokens with correct field semantics and returns
+ * them.
+ */
+export async function mintMachineTokens(config, creds) {
+    const machineCreds = creds ?? loadMachineCreds();
+    if (!machineCreds) {
+        throw new CognitoAuthError(`No machine credentials found at ${machineCredsFilePath()}`);
+    }
+    // Prefer the creds file's own clientId/region: provisioning pairs the
+    // machine user with an app client that has USER_PASSWORD_AUTH enabled,
+    // which the CLI's default (browser) client may not.
+    const region = machineCreds.region ?? config.region;
+    const clientId = machineCreds.clientId ?? config.clientId;
+    const res = await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-amz-json-1.1",
+            "X-Amz-Target": "AWSCognitoIdentityProviderService.InitiateAuth",
+        },
+        body: JSON.stringify({
+            AuthFlow: "USER_PASSWORD_AUTH",
+            ClientId: clientId,
+            AuthParameters: {
+                USERNAME: machineCreds.username,
+                PASSWORD: machineCreds.secret,
+            },
+        }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new CognitoAuthError(`Machine token mint failed (${res.status}): ${data.__type ?? ""} ${data.message ?? ""}`.trim());
+    }
+    const result = data.AuthenticationResult;
+    if (!result?.AccessToken || !result?.IdToken) {
+        throw new CognitoAuthError(`Machine token mint returned no tokens${data.ChallengeName ? ` (challenge: ${data.ChallengeName})` : ""}`);
+    }
+    const tokens = {
+        accessToken: result.AccessToken,
+        idToken: result.IdToken,
+        // Machine creds never expire — expiry is handled by re-minting, so the
+        // refresh token (when Cognito returns one at all) is never exercised.
+        refreshToken: result.RefreshToken ?? "",
+        expiresAt: Date.now() + (result.ExpiresIn ?? 3600) * 1000,
+        tokenType: "Bearer",
+    };
+    saveCachedTokens(tokens);
+    return tokens;
+}
+/**
+ * Return a valid (non-expiring) machine session, re-minting on demand.
+ * Cache-hit path never touches the network.
+ */
+export async function getValidMachineTokens(config) {
+    const cached = loadCachedTokens();
+    if (cached && !isExpiring(cached, 120)) {
+        const cachedClientId = decodeAccessTokenClientId(cached.accessToken);
+        // Compare against the client we'd actually mint with (creds-file
+        // clientId wins over config).
+        const expectedClientId = loadMachineCreds()?.clientId ?? config.clientId;
+        if (cachedClientId === null || cachedClientId === expectedClientId) {
+            return cached;
+        }
+    }
+    return mintMachineTokens(config);
+}
 // ---------------------------------------------------------------------------
 // PKCE
 // ---------------------------------------------------------------------------
@@ -303,6 +411,12 @@ export async function refreshTokens(config, currentRefreshToken) {
  */
 export async function getValidAccessToken(config, options = {}) {
     const interactive = options.interactive ?? true;
+    // Machine identities (company agents) never refresh or open a browser —
+    // they re-mint via USER_PASSWORD_AUTH on demand.
+    if (isMachineIdentity()) {
+        const machine = await getValidMachineTokens(config);
+        return machine.accessToken;
+    }
     let cached = loadCachedTokens();
     // Stale-pool detection: if the cached access token was issued by a
     // different Cognito App Client than the one we're talking to now, drop the

package/dist/cognito-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-auth.js","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AAuCxB,qFAAqF;AACrF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAE5D,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,aAAa,GAAG,EAAE;IAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,eAAe,CAC/B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CACtD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAyB;IAC5C,OAAO,WAAW,MAAM,CAAC,cAAc,SAAS,MAAM,CAAC,MAAM,oBAAoB,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,oBAAoB,IAAI,WAAW,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;IAEd,2EAA2E;IAC3E,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqB;QAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,mDAAmD;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,oCAAoC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrE,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBACjC,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL;;;;yBAIe,CAChB,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAClC,qCAAqC;gBACvC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,UAAU,CAC3B,GAAG,EAAE;gBACH,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,CAAC;YACnE,CAAC,EACD,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC;YAEF,SAAS,OAAO;gBACd,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAcD,KAAK,UAAU,qBAAqB,CAClC,MAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC9C,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,mBAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,mBAAmB;KACnC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CACxB,mBAAmB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACxD,MAAM,MAAM,GAAkB;QAC5B,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,mBAAmB;QACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC9C,SAAS,EAAE,QAAQ;KACpB,CAAC;IACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAyB,EACzB,UAAqC,EAAE;IAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAEhC,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,sBAAsB;IACtB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClE,iBAAiB,EAAE,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAE7D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"cognito-auth.js","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AAuCxB,qFAAqF;AACrF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAE5D,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,aAAa,GAAG,EAAE;IAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AA+BD,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAKpD,CAAC;QACF,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,0DAA0D;QAC1D,IACE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACvB,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACrB,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACrE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB,EACzB,KAAoB;IAEpB,MAAM,YAAY,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;IACjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,oBAAoB,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,uBAAuB,MAAM,iBAAiB,EAC9C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,4BAA4B;YAC5C,cAAc,EAAE,gDAAgD;SACjE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE;gBACd,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,YAAY,CAAC,MAAM;aAC9B;SACF,CAAC;KACH,CACF,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;IAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAkB;QAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,uEAAuE;QACvE,sEAAsE;QACtE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI;QACzD,SAAS,EAAE,QAAQ;KACpB,CAAC;IACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAyB;IAEzB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,iEAAiE;QACjE,8BAA8B;QAC9B,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QACzE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,gBAAgB,EAAE,CAAC;YACnE,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,eAAe,CAC/B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CACtD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAyB;IAC5C,OAAO,WAAW,MAAM,CAAC,cAAc,SAAS,MAAM,CAAC,MAAM,oBAAoB,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,oBAAoB,IAAI,WAAW,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;IAEd,2EAA2E;IAC3E,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqB;QAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,mDAAmD;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,oCAAoC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrE,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBACjC,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL;;;;yBAIe,CAChB,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAClC,qCAAqC;gBACvC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,UAAU,CAC3B,GAAG,EAAE;gBACH,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,CAAC;YACnE,CAAC,EACD,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC;YAEF,SAAS,OAAO;gBACd,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAcD,KAAK,UAAU,qBAAqB,CAClC,MAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC9C,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,mBAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,mBAAmB;KACnC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CACxB,mBAAmB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACxD,MAAM,MAAM,GAAkB;QAC5B,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,mBAAmB;QACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC9C,SAAS,EAAE,QAAQ;KACpB,CAAC;IACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAyB,EACzB,UAAqC,EAAE;IAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAEhD,wEAAwE;IACxE,iDAAiD;IACjD,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAEhC,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,sBAAsB;IACtB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClE,iBAAiB,EAAE,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAE7D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -15,8 +15,8 @@ export type { OrphanClassification, ScopeShrinkPlan, BuildScopeShrinkPlanInput,
 export { resolveCompanyScope, batchPrefixesForVend, listRemoteForScope, pullCompany, decideRemotePulls, VEND_PATH_CAP, POST_FILTER_THRESHOLD, VEND_FANOUT_CONCURRENCY, } from "./remote-pull.js";
 export type { CompanyScope, ResolveCompanyScopeInput, ListRemoteForScopeInput, PullCompanyInput, PullCompanyResult, RemotePullDecision, DecideRemotePullsInput, SkippedKey, } from "./remote-pull.js";
 export { createIgnoreFilter, isWithinSizeLimit, } from "./ignore.js";
-export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, } from "./cognito-auth.js";
-export type { CognitoAuthConfig, CognitoTokens } from "./cognito-auth.js";
+export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, machineCredsFilePath, loadMachineCreds, isMachineIdentity, mintMachineTokens, getValidMachineTokens, } from "./cognito-auth.js";
+export type { CognitoAuthConfig, CognitoTokens, MachineCreds, } from "./cognito-auth.js";
 export { resolvePullScope, readPinnedPrefixes } from "./sync/pull-scope.js";
 export type { PullScope, PullScopeClient } from "./sync/pull-scope.js";
 export { PERSONAL_VAULT_EXCLUDED_TOP_LEVEL, PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS, computePersonalVaultPaths, computePersonalCompanySubdirs, } from "./personal-vault.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAExD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,EAId,WAAW,EACX,YAAY,EAEZ,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EAMvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAO1E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAIhE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAE3B,QAAQ,EACR,oBAAoB,EACpB,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,UAAU,EACV,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,UAAU,EACV,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,2BAA2B,EAC3B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAExD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,EAId,WAAW,EACX,YAAY,EAEZ,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EAMvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAIhE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAE3B,QAAQ,EACR,oBAAoB,EACpB,4BAA4B,EAC5B,aAAa,GACd,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,4BAA4B,EAC5B,2BAA2B,EAC3B,UAAU,EACV,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,UAAU,EACV,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,2BAA2B,EAC3B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -27,7 +27,7 @@ export { buildScopeShrinkPlan, applyScopeShrink, ScopeShrinkBlockedError, ScopeS
 export { resolveCompanyScope, batchPrefixesForVend, listRemoteForScope, pullCompany, decideRemotePulls, VEND_PATH_CAP, POST_FILTER_THRESHOLD, VEND_FANOUT_CONCURRENCY, } from "./remote-pull.js";
 export { createIgnoreFilter, isWithinSizeLimit, } from "./ignore.js";
 // Cognito browser-OAuth (VLT-9)
-export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, } from "./cognito-auth.js";
+export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, machineCredsFilePath, loadMachineCreds, isMachineIdentity, mintMachineTokens, getValidMachineTokens, } from "./cognito-auth.js";
 // Per-company PULL scope resolver (US-005) — shared between hq-sync-runner and
 // `hq sync pull|now` (hq-cli). Exported so hq-cli's foreground pull paths resolve
 // the SAME effective scope the menubar runner does, instead of defaulting every

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,SAAS,CAAC;AAIjB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc;AACd,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,WAAW,EACX,YAAY;AACZ,sBAAsB;AACtB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,uBAAuB;AACvB,6EAA6E;AAC7E,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,yEAAyE;AACzE,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAItB,oCAAoC;AACpC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,gDAAgD;AAChD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAW3B,qDAAqD;AACrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,gCAAgC;AAChC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,aAAa;AACb,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,6EAA6E;AAC7E,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,gCAAgC,CAAC;AAGxC,0BAA0B;AAC1B,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAyB3B,8EAA8E;AAC9E,4EAA4E;AAC5E,2DAA2D;AAC3D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOtE,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AA0B9B,eAAe;AACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG3D,kCAAkC;AAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGzC,4EAA4E;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGzC,gFAAgF;AAChF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAmBzD,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,6CAA6C;AAC7C,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAGnC,yDAAyD;AACzD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,uBAAuB;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AASlE,oEAAoE;AACpE,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,uBAAuB;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AASlE,oEAAoE;AACpE,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAazB,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,SAAS,CAAC;AAIjB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc;AACd,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,WAAW,EACX,YAAY;AACZ,sBAAsB;AACtB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,uBAAuB;AACvB,6EAA6E;AAC7E,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,yEAAyE;AACzE,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAItB,oCAAoC;AACpC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,gDAAgD;AAChD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAW3B,qDAAqD;AACrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,gCAAgC;AAChC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAO3B,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,aAAa;AACb,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,6EAA6E;AAC7E,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,gCAAgC,CAAC;AAGxC,0BAA0B;AAC1B,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAyB3B,8EAA8E;AAC9E,4EAA4E;AAC5E,2DAA2D;AAC3D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOtE,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AA0B9B,eAAe;AACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG3D,kCAAkC;AAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGzC,4EAA4E;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGzC,gFAAgF;AAChF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAmBzD,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,6CAA6C;AAC7C,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAGnC,yDAAyD;AACzD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,uBAAuB;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AASlE,oEAAoE;AACpE,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,uBAAuB;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AASlE,oEAAoE;AACpE,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAazB,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/machine-auth.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Unit tests for the machine-identity auth mode in cognito-auth.ts.
+ *
+ * Machine identities (company agents) carry long-lived Cognito creds at
+ * ~/.hq-agent/machine-creds.json (HQ_MACHINE_CREDS_FILE override) and mint
+ * sessions via USER_PASSWORD_AUTH on demand — no browser, no refresh token.
+ * The contract under test:
+ *   - detection: creds file present + well-formed → machine mode
+ *   - minting: BOTH tokens cached with correct field semantics
+ *   - re-mint on expiry; cache hit when valid
+ *   - getValidAccessToken short-circuits into machine mode (never browser)
+ */
+export {};
+//# sourceMappingURL=machine-auth.test.d.ts.map

package/dist/machine-auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-auth.test.d.ts","sourceRoot":"","sources":["../src/machine-auth.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/machine-auth.test.js

@@ -0,0 +1,249 @@
+/**
+ * Unit tests for the machine-identity auth mode in cognito-auth.ts.
+ *
+ * Machine identities (company agents) carry long-lived Cognito creds at
+ * ~/.hq-agent/machine-creds.json (HQ_MACHINE_CREDS_FILE override) and mint
+ * sessions via USER_PASSWORD_AUTH on demand — no browser, no refresh token.
+ * The contract under test:
+ *   - detection: creds file present + well-formed → machine mode
+ *   - minting: BOTH tokens cached with correct field semantics
+ *   - re-mint on expiry; cache hit when valid
+ *   - getValidAccessToken short-circuits into machine mode (never browser)
+ */
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+let originalHome;
+let originalCredsEnv;
+let tmpHome;
+beforeEach(() => {
+    originalHome = process.env.HOME;
+    originalCredsEnv = process.env.HQ_MACHINE_CREDS_FILE;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "hq-machine-auth-test-"));
+    process.env.HOME = tmpHome;
+    delete process.env.HQ_MACHINE_CREDS_FILE;
+    vi.resetModules();
+});
+afterEach(() => {
+    if (originalHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = originalHome;
+    if (originalCredsEnv === undefined)
+        delete process.env.HQ_MACHINE_CREDS_FILE;
+    else
+        process.env.HQ_MACHINE_CREDS_FILE = originalCredsEnv;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+});
+async function importModule() {
+    return await import("./cognito-auth.js");
+}
+const CONFIG = {
+    region: "us-east-1",
+    userPoolDomain: "vault-indigo-hq-prod",
+    clientId: "test-client-id",
+};
+function writeCreds(creds = { username: "machine-agt_01TEST", secret: "s3cret" }) {
+    const dir = path.join(tmpHome, ".hq-agent");
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, "machine-creds.json");
+    fs.writeFileSync(file, JSON.stringify(creds));
+    return file;
+}
+/** Build a fake JWT whose payload decodes to the given claims. */
+function fakeJwt(claims) {
+    const enc = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");
+    return `${enc({ alg: "RS256", kid: "k" })}.${enc(claims)}.sig`;
+}
+function stubMintFetch(overrides = {}) {
+    const calls = [];
+    const fetchMock = vi.fn(async (url, init) => {
+        calls.push({ url: String(url), init: init ?? {} });
+        return new Response(JSON.stringify({
+            AuthenticationResult: {
+                AccessToken: overrides.AccessToken ??
+                    fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+                IdToken: overrides.IdToken ?? fakeJwt({ token_use: "id" }),
+                RefreshToken: overrides.RefreshToken,
+                ExpiresIn: overrides.ExpiresIn ?? 3600,
+            },
+        }), { status: 200 });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+    return { fetchMock, calls };
+}
+// ---------------------------------------------------------------------------
+// Detection
+// ---------------------------------------------------------------------------
+describe("machine identity detection", () => {
+    it("is off when no creds file exists", async () => {
+        const { isMachineIdentity, loadMachineCreds } = await importModule();
+        expect(loadMachineCreds()).toBeNull();
+        expect(isMachineIdentity()).toBe(false);
+    });
+    it("detects creds at the default ~/.hq-agent path", async () => {
+        writeCreds();
+        const { isMachineIdentity, loadMachineCreds } = await importModule();
+        expect(loadMachineCreds()).toEqual({
+            username: "machine-agt_01TEST",
+            secret: "s3cret",
+            clientId: undefined,
+            region: undefined,
+        });
+        expect(isMachineIdentity()).toBe(true);
+    });
+    it("detects provisioned-shape creds (agt-<ulid>@agents domain + clientId/region)", async () => {
+        writeCreds({
+            username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+            secret: "s3cret",
+            clientId: "agent-client-1",
+            region: "us-east-1",
+            userPoolId: "us-east-1_pool",
+        });
+        const { isMachineIdentity, loadMachineCreds } = await importModule();
+        expect(loadMachineCreds()).toEqual({
+            username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+            secret: "s3cret",
+            clientId: "agent-client-1",
+            region: "us-east-1",
+        });
+        expect(isMachineIdentity()).toBe(true);
+    });
+    it("honors HQ_MACHINE_CREDS_FILE override", async () => {
+        const custom = path.join(tmpHome, "elsewhere.json");
+        fs.writeFileSync(custom, JSON.stringify({ username: "machine-agt_X", secret: "y" }));
+        process.env.HQ_MACHINE_CREDS_FILE = custom;
+        const { loadMachineCreds, machineCredsFilePath } = await importModule();
+        expect(machineCredsFilePath()).toBe(custom);
+        expect(loadMachineCreds()?.username).toBe("machine-agt_X");
+    });
+    it("rejects malformed creds (missing secret, empty username, bad JSON)", async () => {
+        const { loadMachineCreds } = await importModule();
+        writeCreds({ username: "", secret: "x" });
+        expect(loadMachineCreds()).toBeNull();
+        writeCreds({ username: "machine-agt_01TEST" });
+        expect(loadMachineCreds()).toBeNull();
+        fs.writeFileSync(path.join(tmpHome, ".hq-agent", "machine-creds.json"), "{nope");
+        expect(loadMachineCreds()).toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// Minting
+// ---------------------------------------------------------------------------
+describe("mintMachineTokens", () => {
+    it("prefers the creds file's clientId/region over config (agent app client has USER_PASSWORD_AUTH)", async () => {
+        writeCreds({
+            username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+            secret: "s3cret",
+            clientId: "agent-client-1",
+            region: "eu-west-1",
+        });
+        const { calls } = stubMintFetch();
+        const { mintMachineTokens } = await importModule();
+        await mintMachineTokens(CONFIG);
+        expect(calls[0].url).toBe("https://cognito-idp.eu-west-1.amazonaws.com/");
+        const body = JSON.parse(String(calls[0].init.body));
+        expect(body.ClientId).toBe("agent-client-1");
+    });
+    it("mints via USER_PASSWORD_AUTH and caches both tokens with correct fields", async () => {
+        writeCreds();
+        const { calls } = stubMintFetch({ RefreshToken: "rt" });
+        const { mintMachineTokens, loadCachedTokens } = await importModule();
+        const tokens = await mintMachineTokens(CONFIG);
+        // Request shape: Cognito IDP InitiateAuth with the machine creds.
+        expect(calls).toHaveLength(1);
+        expect(calls[0].url).toBe("https://cognito-idp.us-east-1.amazonaws.com/");
+        const body = JSON.parse(String(calls[0].init.body));
+        expect(body).toMatchObject({
+            AuthFlow: "USER_PASSWORD_AUTH",
+            ClientId: CONFIG.clientId,
+            AuthParameters: { USERNAME: "machine-agt_01TEST", PASSWORD: "s3cret" },
+        });
+        // Field semantics: access token in accessToken, id token in idToken.
+        const accessClaims = JSON.parse(Buffer.from(tokens.accessToken.split(".")[1], "base64url").toString());
+        const idClaims = JSON.parse(Buffer.from(tokens.idToken.split(".")[1], "base64url").toString());
+        expect(accessClaims.token_use).toBe("access");
+        expect(idClaims.token_use).toBe("id");
+        expect(tokens.refreshToken).toBe("rt");
+        expect(typeof tokens.expiresAt).toBe("number");
+        // Persisted to the shared cache file.
+        expect(loadCachedTokens()).toEqual(tokens);
+    });
+    it("throws CognitoAuthError on auth failure", async () => {
+        writeCreds();
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ __type: "NotAuthorizedException", message: "nope" }), { status: 400 })));
+        const { mintMachineTokens, CognitoAuthError } = await importModule();
+        await expect(mintMachineTokens(CONFIG)).rejects.toBeInstanceOf(CognitoAuthError);
+    });
+    it("throws when no creds are present", async () => {
+        const { mintMachineTokens, CognitoAuthError } = await importModule();
+        await expect(mintMachineTokens(CONFIG)).rejects.toBeInstanceOf(CognitoAuthError);
+    });
+});
+// ---------------------------------------------------------------------------
+// getValidMachineTokens — cache vs re-mint
+// ---------------------------------------------------------------------------
+describe("getValidMachineTokens", () => {
+    it("returns the cache when valid without touching the network", async () => {
+        writeCreds();
+        const { fetchMock } = stubMintFetch();
+        const { saveCachedTokens, getValidMachineTokens } = await importModule();
+        const cached = {
+            accessToken: fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+            idToken: fakeJwt({ token_use: "id" }),
+            refreshToken: "",
+            expiresAt: Date.now() + 30 * 60 * 1000,
+            tokenType: "Bearer",
+        };
+        saveCachedTokens(cached);
+        const tokens = await getValidMachineTokens(CONFIG);
+        expect(tokens).toEqual(cached);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it("re-mints when the cache is expiring", async () => {
+        writeCreds();
+        const { fetchMock } = stubMintFetch();
+        const { saveCachedTokens, getValidMachineTokens } = await importModule();
+        saveCachedTokens({
+            accessToken: fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+            idToken: fakeJwt({ token_use: "id" }),
+            refreshToken: "",
+            expiresAt: Date.now() + 10 * 1000,
+            tokenType: "Bearer",
+        });
+        await getValidMachineTokens(CONFIG);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it("re-mints when the cached token targets a different app client", async () => {
+        writeCreds();
+        const { fetchMock } = stubMintFetch();
+        const { saveCachedTokens, getValidMachineTokens } = await importModule();
+        saveCachedTokens({
+            accessToken: fakeJwt({ token_use: "access", client_id: "other-client" }),
+            idToken: fakeJwt({ token_use: "id" }),
+            refreshToken: "",
+            expiresAt: Date.now() + 30 * 60 * 1000,
+            tokenType: "Bearer",
+        });
+        await getValidMachineTokens(CONFIG);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+});
+// ---------------------------------------------------------------------------
+// getValidAccessToken — machine-mode short circuit
+// ---------------------------------------------------------------------------
+describe("getValidAccessToken in machine mode", () => {
+    it("mints via machine creds instead of refreshing or opening a browser", async () => {
+        writeCreds();
+        const { calls } = stubMintFetch();
+        const { getValidAccessToken } = await importModule();
+        const token = await getValidAccessToken(CONFIG, { interactive: false });
+        expect(calls).toHaveLength(1);
+        const claims = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
+        expect(claims.token_use).toBe("access");
+    });
+});
+//# sourceMappingURL=machine-auth.test.js.map

package/dist/machine-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-auth.test.js","sourceRoot":"","sources":["../src/machine-auth.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,IAAI,YAAgC,CAAC;AACrC,IAAI,gBAAoC,CAAC;AACzC,IAAI,OAAe,CAAC;AAEpB,UAAU,CAAC,GAAG,EAAE;IACd,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACrD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACzC,EAAE,CAAC,YAAY,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;IACrC,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;;QACxE,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;IAC1D,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACtB,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY;IACzB,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,MAAM,GAAG;IACb,MAAM,EAAE,WAAW;IACnB,cAAc,EAAE,sBAAsB;IACtC,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,SAAS,UAAU,CACjB,QAAiB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAErE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CAAC,MAA+B;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CACpB,YAKK,EAAE;IAEP,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAiB,EAAE,IAAkB,EAAE,EAAE;QACtE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,oBAAoB,EAAE;gBACpB,WAAW,EACT,SAAS,CAAC,WAAW;oBACrB,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC9D,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1D,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI;aACvC;SACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,oBAAoB;YAC9B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,UAAU,CAAC;YACT,QAAQ,EAAE,oDAAoD;YAC9D,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,oDAAoD;YAC9D,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACpD,EAAE,CAAC,aAAa,CACd,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC3D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC;QAC3C,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACxE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAClD,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,UAAU,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,UAAU,CAAC;YACT,QAAQ,EAAE,oDAAoD;YAC9D,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACnD,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAErE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE/C,kEAAkE;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACvE,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CACtE,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAClE,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE/C,sCAAsC;QACtC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,UAAU,EAAE,CAAC;QACb,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CACf,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CACF,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrE,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC5D,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrE,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC5D,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YACtC,SAAS,EAAE,QAAiB;SAC7B,CAAC;QACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACzE,gBAAgB,CAAC;YACf,WAAW,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YACjC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACzE,gBAAgB,CAAC;YACf,WAAW,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YACtC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAErD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CACzD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.6.0",
-  "description": "HQ by Indigo cloud sync engine \u2014 bidirectional S3 sync for mobile access",
+  "version": "6.7.1",
+  "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {

package/src/cognito-auth.ts

@@ -147,6 +147,181 @@ export function decodeAccessTokenClientId(accessToken: string): string | null {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Machine identity (company agents)
+// ---------------------------------------------------------------------------
+//
+// HQ company agents run headless on their own boxes with long-lived Cognito
+// MACHINE credentials ({username: "machine-agt_<ulid>", secret}) provisioned
+// by hq-pro's agent bootstrap and stored at ~/.hq-agent/machine-creds.json.
+// There is no browser, no Hosted UI, and no refresh-token dance: the creds
+// never expire, so the CLI simply re-mints a session via USER_PASSWORD_AUTH
+// whenever the cached tokens are missing or expiring.
+//
+// Token semantics matter here. The agent's identity claims
+// (custom:entityType=agent, custom:entityUid=agt_*) ride the ID token only;
+// APIs that verify token_use=access (e.g. hq-deploy) need the real access
+// token. Both are cached with correct field semantics — callers pick the
+// token type each API actually validates.
+
+export interface MachineCreds {
+  /** Cognito username (live boxes: "agt-<ulid>@agents.getindigo.ai"). */
+  username: string;
+  /** Long-lived machine secret (USER_PASSWORD_AUTH password). */
+  secret: string;
+  /** App client to mint against — provisioned creds carry their own
+   *  (USER_PASSWORD_AUTH must be enabled on it); falls back to config. */
+  clientId?: string;
+  /** Cognito region for the mint endpoint; falls back to config. */
+  region?: string;
+}
+
+/** Resolve the machine-creds file path (HQ_MACHINE_CREDS_FILE overrides). */
+export function machineCredsFilePath(): string {
+  return (
+    process.env.HQ_MACHINE_CREDS_FILE ??
+    path.join(os.homedir(), ".hq-agent", "machine-creds.json")
+  );
+}
+
+/**
+ * Load machine credentials, or null when this process is not running as a
+ * machine identity (no creds file / unreadable / malformed).
+ */
+export function loadMachineCreds(): MachineCreds | null {
+  const file = machineCredsFilePath();
+  try {
+    if (!fs.existsSync(file)) return null;
+    const raw = JSON.parse(fs.readFileSync(file, "utf-8")) as {
+      username?: unknown;
+      secret?: unknown;
+      clientId?: unknown;
+      region?: unknown;
+    };
+    // The creds FILE is the machine-identity signal — no username-shape
+    // gate. (6.7.0 required a "machine-" prefix, but live boxes are
+    // provisioned with "agt-<ulid>@agents.getindigo.ai", so detection
+    // never engaged on the first real agent box, 2026-06-12.)
+    if (
+      typeof raw.username === "string" &&
+      raw.username.length > 0 &&
+      typeof raw.secret === "string" &&
+      raw.secret.length > 0
+    ) {
+      return {
+        username: raw.username,
+        secret: raw.secret,
+        clientId: typeof raw.clientId === "string" ? raw.clientId : undefined,
+        region: typeof raw.region === "string" ? raw.region : undefined,
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** True when machine credentials are present — the CLI is a machine identity. */
+export function isMachineIdentity(): boolean {
+  return loadMachineCreds() !== null;
+}
+
+interface InitiateAuthResponse {
+  AuthenticationResult?: {
+    AccessToken?: string;
+    IdToken?: string;
+    RefreshToken?: string;
+    ExpiresIn?: number;
+  };
+  ChallengeName?: string;
+  __type?: string;
+  message?: string;
+}
+
+/**
+ * Mint a fresh session for the machine identity via USER_PASSWORD_AUTH
+ * against the Cognito IDP endpoint (plain unsigned HTTP — no AWS SDK
+ * dependency). Caches BOTH tokens with correct field semantics and returns
+ * them.
+ */
+export async function mintMachineTokens(
+  config: CognitoAuthConfig,
+  creds?: MachineCreds,
+): Promise<CognitoTokens> {
+  const machineCreds = creds ?? loadMachineCreds();
+  if (!machineCreds) {
+    throw new CognitoAuthError(
+      `No machine credentials found at ${machineCredsFilePath()}`,
+    );
+  }
+  // Prefer the creds file's own clientId/region: provisioning pairs the
+  // machine user with an app client that has USER_PASSWORD_AUTH enabled,
+  // which the CLI's default (browser) client may not.
+  const region = machineCreds.region ?? config.region;
+  const clientId = machineCreds.clientId ?? config.clientId;
+  const res = await fetch(
+    `https://cognito-idp.${region}.amazonaws.com/`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-amz-json-1.1",
+        "X-Amz-Target": "AWSCognitoIdentityProviderService.InitiateAuth",
+      },
+      body: JSON.stringify({
+        AuthFlow: "USER_PASSWORD_AUTH",
+        ClientId: clientId,
+        AuthParameters: {
+          USERNAME: machineCreds.username,
+          PASSWORD: machineCreds.secret,
+        },
+      }),
+    },
+  );
+  const data = (await res.json().catch(() => ({}))) as InitiateAuthResponse;
+  if (!res.ok) {
+    throw new CognitoAuthError(
+      `Machine token mint failed (${res.status}): ${data.__type ?? ""} ${data.message ?? ""}`.trim(),
+    );
+  }
+  const result = data.AuthenticationResult;
+  if (!result?.AccessToken || !result?.IdToken) {
+    throw new CognitoAuthError(
+      `Machine token mint returned no tokens${data.ChallengeName ? ` (challenge: ${data.ChallengeName})` : ""}`,
+    );
+  }
+  const tokens: CognitoTokens = {
+    accessToken: result.AccessToken,
+    idToken: result.IdToken,
+    // Machine creds never expire — expiry is handled by re-minting, so the
+    // refresh token (when Cognito returns one at all) is never exercised.
+    refreshToken: result.RefreshToken ?? "",
+    expiresAt: Date.now() + (result.ExpiresIn ?? 3600) * 1000,
+    tokenType: "Bearer",
+  };
+  saveCachedTokens(tokens);
+  return tokens;
+}
+
+/**
+ * Return a valid (non-expiring) machine session, re-minting on demand.
+ * Cache-hit path never touches the network.
+ */
+export async function getValidMachineTokens(
+  config: CognitoAuthConfig,
+): Promise<CognitoTokens> {
+  const cached = loadCachedTokens();
+  if (cached && !isExpiring(cached, 120)) {
+    const cachedClientId = decodeAccessTokenClientId(cached.accessToken);
+    // Compare against the client we'd actually mint with (creds-file
+    // clientId wins over config).
+    const expectedClientId = loadMachineCreds()?.clientId ?? config.clientId;
+    if (cachedClientId === null || cachedClientId === expectedClientId) {
+      return cached;
+    }
+  }
+  return mintMachineTokens(config);
+}
+
 // ---------------------------------------------------------------------------
 // PKCE
 // ---------------------------------------------------------------------------
@@ -402,6 +577,14 @@ export async function getValidAccessToken(
   options: { interactive?: boolean } = {},
 ): Promise<string> {
   const interactive = options.interactive ?? true;
+
+  // Machine identities (company agents) never refresh or open a browser —
+  // they re-mint via USER_PASSWORD_AUTH on demand.
+  if (isMachineIdentity()) {
+    const machine = await getValidMachineTokens(config);
+    return machine.accessToken;
+  }
+
   let cached = loadCachedTokens();
 
   // Stale-pool detection: if the cached access token was issued by a

package/src/index.ts

@@ -118,8 +118,17 @@ export {
   isExpiring,
   getValidAccessToken,
   CognitoAuthError,
+  machineCredsFilePath,
+  loadMachineCreds,
+  isMachineIdentity,
+  mintMachineTokens,
+  getValidMachineTokens,
+} from "./cognito-auth.js";
+export type {
+  CognitoAuthConfig,
+  CognitoTokens,
+  MachineCreds,
 } from "./cognito-auth.js";
-export type { CognitoAuthConfig, CognitoTokens } from "./cognito-auth.js";
 
 // Per-company PULL scope resolver (US-005) — shared between hq-sync-runner and
 // `hq sync pull|now` (hq-cli). Exported so hq-cli's foreground pull paths resolve

package/src/machine-auth.test.ts

@@ -0,0 +1,314 @@
+/**
+ * Unit tests for the machine-identity auth mode in cognito-auth.ts.
+ *
+ * Machine identities (company agents) carry long-lived Cognito creds at
+ * ~/.hq-agent/machine-creds.json (HQ_MACHINE_CREDS_FILE override) and mint
+ * sessions via USER_PASSWORD_AUTH on demand — no browser, no refresh token.
+ * The contract under test:
+ *   - detection: creds file present + well-formed → machine mode
+ *   - minting: BOTH tokens cached with correct field semantics
+ *   - re-mint on expiry; cache hit when valid
+ *   - getValidAccessToken short-circuits into machine mode (never browser)
+ */
+
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let originalHome: string | undefined;
+let originalCredsEnv: string | undefined;
+let tmpHome: string;
+
+beforeEach(() => {
+  originalHome = process.env.HOME;
+  originalCredsEnv = process.env.HQ_MACHINE_CREDS_FILE;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "hq-machine-auth-test-"));
+  process.env.HOME = tmpHome;
+  delete process.env.HQ_MACHINE_CREDS_FILE;
+  vi.resetModules();
+});
+
+afterEach(() => {
+  if (originalHome === undefined) delete process.env.HOME;
+  else process.env.HOME = originalHome;
+  if (originalCredsEnv === undefined) delete process.env.HQ_MACHINE_CREDS_FILE;
+  else process.env.HQ_MACHINE_CREDS_FILE = originalCredsEnv;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+async function importModule() {
+  return await import("./cognito-auth.js");
+}
+
+const CONFIG = {
+  region: "us-east-1",
+  userPoolDomain: "vault-indigo-hq-prod",
+  clientId: "test-client-id",
+};
+
+function writeCreds(
+  creds: unknown = { username: "machine-agt_01TEST", secret: "s3cret" },
+): string {
+  const dir = path.join(tmpHome, ".hq-agent");
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, "machine-creds.json");
+  fs.writeFileSync(file, JSON.stringify(creds));
+  return file;
+}
+
+/** Build a fake JWT whose payload decodes to the given claims. */
+function fakeJwt(claims: Record<string, unknown>): string {
+  const enc = (o: unknown) =>
+    Buffer.from(JSON.stringify(o)).toString("base64url");
+  return `${enc({ alg: "RS256", kid: "k" })}.${enc(claims)}.sig`;
+}
+
+function stubMintFetch(
+  overrides: Partial<{
+    AccessToken: string;
+    IdToken: string;
+    RefreshToken: string;
+    ExpiresIn: number;
+  }> = {},
+) {
+  const calls: Array<{ url: string; init: RequestInit }> = [];
+  const fetchMock = vi.fn(async (url: string | URL, init?: RequestInit) => {
+    calls.push({ url: String(url), init: init ?? {} });
+    return new Response(
+      JSON.stringify({
+        AuthenticationResult: {
+          AccessToken:
+            overrides.AccessToken ??
+            fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+          IdToken: overrides.IdToken ?? fakeJwt({ token_use: "id" }),
+          RefreshToken: overrides.RefreshToken,
+          ExpiresIn: overrides.ExpiresIn ?? 3600,
+        },
+      }),
+      { status: 200 },
+    );
+  });
+  vi.stubGlobal("fetch", fetchMock);
+  return { fetchMock, calls };
+}
+
+// ---------------------------------------------------------------------------
+// Detection
+// ---------------------------------------------------------------------------
+
+describe("machine identity detection", () => {
+  it("is off when no creds file exists", async () => {
+    const { isMachineIdentity, loadMachineCreds } = await importModule();
+    expect(loadMachineCreds()).toBeNull();
+    expect(isMachineIdentity()).toBe(false);
+  });
+
+  it("detects creds at the default ~/.hq-agent path", async () => {
+    writeCreds();
+    const { isMachineIdentity, loadMachineCreds } = await importModule();
+    expect(loadMachineCreds()).toEqual({
+      username: "machine-agt_01TEST",
+      secret: "s3cret",
+      clientId: undefined,
+      region: undefined,
+    });
+    expect(isMachineIdentity()).toBe(true);
+  });
+
+  it("detects provisioned-shape creds (agt-<ulid>@agents domain + clientId/region)", async () => {
+    writeCreds({
+      username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+      secret: "s3cret",
+      clientId: "agent-client-1",
+      region: "us-east-1",
+      userPoolId: "us-east-1_pool",
+    });
+    const { isMachineIdentity, loadMachineCreds } = await importModule();
+    expect(loadMachineCreds()).toEqual({
+      username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+      secret: "s3cret",
+      clientId: "agent-client-1",
+      region: "us-east-1",
+    });
+    expect(isMachineIdentity()).toBe(true);
+  });
+
+  it("honors HQ_MACHINE_CREDS_FILE override", async () => {
+    const custom = path.join(tmpHome, "elsewhere.json");
+    fs.writeFileSync(
+      custom,
+      JSON.stringify({ username: "machine-agt_X", secret: "y" }),
+    );
+    process.env.HQ_MACHINE_CREDS_FILE = custom;
+    const { loadMachineCreds, machineCredsFilePath } = await importModule();
+    expect(machineCredsFilePath()).toBe(custom);
+    expect(loadMachineCreds()?.username).toBe("machine-agt_X");
+  });
+
+  it("rejects malformed creds (missing secret, empty username, bad JSON)", async () => {
+    const { loadMachineCreds } = await importModule();
+    writeCreds({ username: "", secret: "x" });
+    expect(loadMachineCreds()).toBeNull();
+    writeCreds({ username: "machine-agt_01TEST" });
+    expect(loadMachineCreds()).toBeNull();
+    fs.writeFileSync(path.join(tmpHome, ".hq-agent", "machine-creds.json"), "{nope");
+    expect(loadMachineCreds()).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Minting
+// ---------------------------------------------------------------------------
+
+describe("mintMachineTokens", () => {
+  it("prefers the creds file's clientId/region over config (agent app client has USER_PASSWORD_AUTH)", async () => {
+    writeCreds({
+      username: "agt-01ktt1rjj6kqrhnhhst0k4vrgt@agents.getindigo.ai",
+      secret: "s3cret",
+      clientId: "agent-client-1",
+      region: "eu-west-1",
+    });
+    const { calls } = stubMintFetch();
+    const { mintMachineTokens } = await importModule();
+    await mintMachineTokens(CONFIG);
+    expect(calls[0].url).toBe("https://cognito-idp.eu-west-1.amazonaws.com/");
+    const body = JSON.parse(String(calls[0].init.body));
+    expect(body.ClientId).toBe("agent-client-1");
+  });
+
+  it("mints via USER_PASSWORD_AUTH and caches both tokens with correct fields", async () => {
+    writeCreds();
+    const { calls } = stubMintFetch({ RefreshToken: "rt" });
+    const { mintMachineTokens, loadCachedTokens } = await importModule();
+
+    const tokens = await mintMachineTokens(CONFIG);
+
+    // Request shape: Cognito IDP InitiateAuth with the machine creds.
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe("https://cognito-idp.us-east-1.amazonaws.com/");
+    const body = JSON.parse(String(calls[0].init.body));
+    expect(body).toMatchObject({
+      AuthFlow: "USER_PASSWORD_AUTH",
+      ClientId: CONFIG.clientId,
+      AuthParameters: { USERNAME: "machine-agt_01TEST", PASSWORD: "s3cret" },
+    });
+
+    // Field semantics: access token in accessToken, id token in idToken.
+    const accessClaims = JSON.parse(
+      Buffer.from(tokens.accessToken.split(".")[1], "base64url").toString(),
+    );
+    const idClaims = JSON.parse(
+      Buffer.from(tokens.idToken.split(".")[1], "base64url").toString(),
+    );
+    expect(accessClaims.token_use).toBe("access");
+    expect(idClaims.token_use).toBe("id");
+    expect(tokens.refreshToken).toBe("rt");
+    expect(typeof tokens.expiresAt).toBe("number");
+
+    // Persisted to the shared cache file.
+    expect(loadCachedTokens()).toEqual(tokens);
+  });
+
+  it("throws CognitoAuthError on auth failure", async () => {
+    writeCreds();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () =>
+        new Response(
+          JSON.stringify({ __type: "NotAuthorizedException", message: "nope" }),
+          { status: 400 },
+        ),
+      ),
+    );
+    const { mintMachineTokens, CognitoAuthError } = await importModule();
+    await expect(mintMachineTokens(CONFIG)).rejects.toBeInstanceOf(
+      CognitoAuthError,
+    );
+  });
+
+  it("throws when no creds are present", async () => {
+    const { mintMachineTokens, CognitoAuthError } = await importModule();
+    await expect(mintMachineTokens(CONFIG)).rejects.toBeInstanceOf(
+      CognitoAuthError,
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getValidMachineTokens — cache vs re-mint
+// ---------------------------------------------------------------------------
+
+describe("getValidMachineTokens", () => {
+  it("returns the cache when valid without touching the network", async () => {
+    writeCreds();
+    const { fetchMock } = stubMintFetch();
+    const { saveCachedTokens, getValidMachineTokens } = await importModule();
+    const cached = {
+      accessToken: fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+      idToken: fakeJwt({ token_use: "id" }),
+      refreshToken: "",
+      expiresAt: Date.now() + 30 * 60 * 1000,
+      tokenType: "Bearer" as const,
+    };
+    saveCachedTokens(cached);
+
+    const tokens = await getValidMachineTokens(CONFIG);
+    expect(tokens).toEqual(cached);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("re-mints when the cache is expiring", async () => {
+    writeCreds();
+    const { fetchMock } = stubMintFetch();
+    const { saveCachedTokens, getValidMachineTokens } = await importModule();
+    saveCachedTokens({
+      accessToken: fakeJwt({ token_use: "access", client_id: CONFIG.clientId }),
+      idToken: fakeJwt({ token_use: "id" }),
+      refreshToken: "",
+      expiresAt: Date.now() + 10 * 1000,
+      tokenType: "Bearer",
+    });
+
+    await getValidMachineTokens(CONFIG);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("re-mints when the cached token targets a different app client", async () => {
+    writeCreds();
+    const { fetchMock } = stubMintFetch();
+    const { saveCachedTokens, getValidMachineTokens } = await importModule();
+    saveCachedTokens({
+      accessToken: fakeJwt({ token_use: "access", client_id: "other-client" }),
+      idToken: fakeJwt({ token_use: "id" }),
+      refreshToken: "",
+      expiresAt: Date.now() + 30 * 60 * 1000,
+      tokenType: "Bearer",
+    });
+
+    await getValidMachineTokens(CONFIG);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getValidAccessToken — machine-mode short circuit
+// ---------------------------------------------------------------------------
+
+describe("getValidAccessToken in machine mode", () => {
+  it("mints via machine creds instead of refreshing or opening a browser", async () => {
+    writeCreds();
+    const { calls } = stubMintFetch();
+    const { getValidAccessToken } = await importModule();
+
+    const token = await getValidAccessToken(CONFIG, { interactive: false });
+
+    expect(calls).toHaveLength(1);
+    const claims = JSON.parse(
+      Buffer.from(token.split(".")[1], "base64url").toString(),
+    );
+    expect(claims.token_use).toBe("access");
+  });
+});