@inf-monkeys-tech/monkeys-cli 0.10.0

package/dist/contracts/version.js

@@ -0,0 +1,21 @@
+export const COMMAND_SCHEMA_MAJOR = 1;
+export const BUNDLED_SKILL_NAME = 'monkeys';
+export const BUNDLED_SKILL_MINIMUM_CLI_VERSION = '0.10.0';
+function semverTuple(value) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(value.trim());
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : undefined;
+}
+export function isCliSkillCompatible(cliVersion, minimumCliVersion, skillSchemaMajor) {
+    const cli = semverTuple(cliVersion);
+    const minimum = semverTuple(minimumCliVersion);
+    if (!cli || !minimum || skillSchemaMajor !== COMMAND_SCHEMA_MAJOR || cli[0] !== minimum[0])
+        return false;
+    for (let index = 0; index < cli.length; index += 1) {
+        if (cli[index] > minimum[index])
+            return true;
+        if (cli[index] < minimum[index])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=version.js.map

package/dist/contracts/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/contracts/version.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAU,CAAC;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,iCAAiC,GAAG,QAAiB,CAAC;AAEnE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,iBAAyB,EAAE,gBAAwB;IAC1G,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,KAAK,oBAAoB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,KAAK,CAAE,GAAG,OAAO,CAAC,KAAK,CAAE;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,GAAG,CAAC,KAAK,CAAE,GAAG,OAAO,CAAC,KAAK,CAAE;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/credential/auth-service.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import type { ResolvedContext } from '../context/resolver.js';
+import { HttpClient } from '../transport/http-client.js';
+import { type SecretProviderMetadata } from './secret-reference.js';
+import type { SecretStore } from './secret-store.js';
+declare const deviceAuthorizationSchema: z.ZodObject<{
+    device_code: z.ZodString;
+    expires_in: z.ZodNumber;
+    verification_url: z.ZodURL;
+}, z.core.$loose>;
+declare const sessionSchema: z.ZodObject<{
+    authenticated: z.ZodBoolean;
+    currentTeamId: z.ZodOptional<z.ZodString>;
+    flags: z.ZodObject<{
+        isKernelEnabled: z.ZodBoolean;
+        isKernelSuperAdmin: z.ZodBoolean;
+    }, z.core.$loose>;
+    permissions: z.ZodObject<{
+        all: z.ZodArray<z.ZodString>;
+        kernel: z.ZodArray<z.ZodString>;
+        studio: z.ZodArray<z.ZodString>;
+        workspace: z.ZodArray<z.ZodString>;
+    }, z.core.$loose>;
+    principal: z.ZodObject<{
+        kind: z.ZodEnum<{
+            agent: "agent";
+            human: "human";
+            public: "public";
+            tenant: "tenant";
+        }>;
+        userId: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+    profile: z.ZodObject<{
+        departmentName: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+        email: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+        id: z.ZodOptional<z.ZodString>;
+        name: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    }, z.core.$loose>;
+    surfaces: z.ZodObject<{
+        internal: z.ZodBoolean;
+        kernel: z.ZodBoolean;
+        public: z.ZodBoolean;
+        workspace: z.ZodBoolean;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+export type SessionSnapshot = z.infer<typeof sessionSchema>;
+export type DeviceAuthorization = z.infer<typeof deviceAuthorizationSchema>;
+export type AuthClientFactory = (context: ResolvedContext, token?: string) => Promise<HttpClient>;
+export type AuthSleep = (milliseconds: number) => Promise<void>;
+export declare class AuthService {
+    #private;
+    private readonly secrets;
+    private readonly sleep;
+    constructor(secrets: SecretStore, createClient?: AuthClientFactory, sleep?: AuthSleep);
+    importApiKey(context: ResolvedContext, secret: Uint8Array): Promise<{
+        fingerprint: string;
+        session: SessionSnapshot;
+    }>;
+    startDeviceAuthorization(context: ResolvedContext): Promise<DeviceAuthorization>;
+    completeDeviceAuthorization(context: ResolvedContext, deviceCode: string, options?: {
+        expiresInSeconds?: number;
+        intervalSeconds?: number;
+    }): Promise<{
+        fingerprint: string;
+        provider: SecretProviderMetadata;
+        session: SessionSnapshot;
+    }>;
+    logout(context: ResolvedContext): Promise<void>;
+    whoAmI(context: ResolvedContext): Promise<SessionSnapshot>;
+    subscriptionName(context: ResolvedContext): Promise<string>;
+    private authenticatedClient;
+    private requireWritableAccountSession;
+    private persistBrowserSession;
+    private fetchKernelUser;
+    private fetchSession;
+    private validateSession;
+}
+export {};
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/credential/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/credential/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAY,MAAM,KAAK,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAgD,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAGlH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,QAAA,MAAM,yBAAyB;;;;iBAMf,CAAC;AAsCjB,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmBH,CAAC;AAEjB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAClG,MAAM,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AA4ChE,qBAAa,WAAW;;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHxB,YACmB,OAAO,EAAE,WAAW,EACrC,YAAY,CAAC,EAAE,iBAAiB,EACf,KAAK,GAAE,SAAwB,EAGjD;IAEK,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC,CAkB3H;IAEK,wBAAwB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAYrF;IAEK,2BAA2B,CAC/B,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACpE,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,sBAAsB,CAAC;QAAC,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC,CAkC9F;IAEK,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBpD;IAEK,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAa/D;IAEK,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBhE;YAEa,mBAAmB;IAUjC,OAAO,CAAC,6BAA6B;YAmBvB,qBAAqB;YAiCrB,eAAe;YAKf,YAAY;IAM1B,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/credential/auth-service.js

@@ -0,0 +1,312 @@
+import { createHash } from 'node:crypto';
+import { z, ZodError } from 'zod';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { parseSecretReference, secretProviderMetadata } from './secret-reference.js';
+import { createContextClient } from './runtime.js';
+import { validateBrowserUrl } from './open-browser.js';
+const envelopeSchema = z.object({ data: z.unknown() }).passthrough();
+const deviceAuthorizationSchema = z
+    .object({
+    device_code: z.string().min(40),
+    expires_in: z.number().int().positive(),
+    verification_url: z.url(),
+})
+    .passthrough();
+const devicePollSchema = z.discriminatedUnion('status', [
+    z.object({ status: z.literal('authorization_pending') }),
+    z.object({ status: z.literal('expired_token') }),
+    z.object({ status: z.literal('slow_down') }),
+    z.object({ status: z.literal('authorized'), token: z.string().min(1) }),
+]);
+const subscriptionConfigSchema = z
+    .object({
+    appId: z.string().trim().min(1).optional(),
+    applicationConfig: z
+        .object({
+        theme: z
+            .object({
+            id: z.string().trim().min(1).optional(),
+        })
+            .passthrough()
+            .optional(),
+    })
+        .passthrough()
+        .optional(),
+    tenantId: z.string().trim().min(1).optional(),
+})
+    .passthrough();
+const nullableProfileTextSchema = z.preprocess((value) => (value === null ? undefined : value), z.string().optional());
+const kernelUserSchema = z
+    .object({
+    email: z.string().optional(),
+    groups: z.array(z.string()).default([]),
+    id: z.string().min(1),
+    isKernel: z.boolean().optional(),
+    isKernelSuperAdmin: z.boolean().default(false),
+    name: z.string().optional(),
+    permissions: z.array(z.string()).default([]),
+    teamIds: z.array(z.string()).default([]),
+    username: z.string().optional(),
+})
+    .passthrough();
+const sessionSchema = z
+    .object({
+    authenticated: z.boolean(),
+    currentTeamId: z.string().optional(),
+    flags: z.object({ isKernelEnabled: z.boolean(), isKernelSuperAdmin: z.boolean() }).passthrough(),
+    permissions: z
+        .object({ all: z.array(z.string()), kernel: z.array(z.string()), studio: z.array(z.string()), workspace: z.array(z.string()) })
+        .passthrough(),
+    principal: z.object({ kind: z.enum(['public', 'human', 'agent', 'tenant']), userId: z.string().optional() }).passthrough(),
+    profile: z
+        .object({
+        departmentName: nullableProfileTextSchema,
+        email: nullableProfileTextSchema,
+        id: z.string().optional(),
+        name: nullableProfileTextSchema,
+    })
+        .passthrough(),
+    surfaces: z.object({ internal: z.boolean(), kernel: z.boolean(), public: z.boolean(), workspace: z.boolean() }).passthrough(),
+})
+    .passthrough();
+const defaultSleep = async (milliseconds) => {
+    await new Promise((resolve) => setTimeout(resolve, milliseconds));
+};
+function parseContract(schema, value, code, message) {
+    try {
+        return schema.parse(value);
+    }
+    catch (error) {
+        if (!(error instanceof ZodError))
+            throw error;
+        throw new CliError(message, {
+            cause: error,
+            code,
+            exitCode: EXIT_CODES.compatibility,
+            safeDetails: { issues: error.issues.map((issue) => ({ code: issue.code, path: issue.path })) },
+        });
+    }
+}
+function unwrap(value) {
+    const parsed = envelopeSchema.safeParse(value);
+    return parsed.success ? parsed.data.data : value;
+}
+function credentialFingerprint(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+function isKernelOnly(context) {
+    return context.expectedSurfaces.length === 1 && context.expectedSurfaces[0] === 'kernel';
+}
+function kernelSession(user) {
+    return sessionSchema.parse({
+        authenticated: true,
+        flags: { isKernelEnabled: true, isKernelSuperAdmin: user.isKernelSuperAdmin },
+        permissions: { all: user.permissions, kernel: user.permissions, studio: [], workspace: [] },
+        principal: { kind: 'human', userId: user.id },
+        profile: { email: user.email, id: user.id, name: user.name ?? user.username },
+        surfaces: { internal: false, kernel: true, public: true, workspace: false },
+    });
+}
+export class AuthService {
+    secrets;
+    sleep;
+    #createClient;
+    constructor(secrets, createClient, sleep = defaultSleep) {
+        this.secrets = secrets;
+        this.sleep = sleep;
+        this.#createClient = createClient ?? ((context, token) => createContextClient(context, this.secrets, token));
+    }
+    async importApiKey(context, secret) {
+        if (context.credential.kind !== 'api_key') {
+            throw new CliError('当前 Profile 不是 API Key Credential。', {
+                code: 'CREDENTIAL_KIND_MISMATCH',
+                exitCode: EXIT_CODES.configuration,
+            });
+        }
+        const token = Buffer.from(secret).toString('utf8').trim();
+        if (!token.startsWith('sk-')) {
+            throw new CliError('API Key 格式无效。', { code: 'API_KEY_INVALID', exitCode: EXIT_CODES.validation });
+        }
+        const client = await this.#createClient(context, token);
+        const session = await this.fetchSession(client, context);
+        const fingerprint = credentialFingerprint(secret);
+        if (parseSecretReference(context.credential.secretRef).kind === 'keyring') {
+            await this.secrets.put(context.credential.secretRef, secret);
+        }
+        return { fingerprint, session };
+    }
+    async startDeviceAuthorization(context) {
+        this.requireWritableAccountSession(context);
+        const anonymous = await this.#createClient(context);
+        const response = await anonymous.request({ method: 'POST', path: '/api/auth/device/authorization' });
+        const authorization = parseContract(deviceAuthorizationSchema, unwrap(response.data), 'DEVICE_AUTH_RESPONSE_INCOMPATIBLE', '浏览器登录响应与 CLI 合同不兼容。');
+        validateBrowserUrl(authorization.verification_url, context);
+        return authorization;
+    }
+    async completeDeviceAuthorization(context, deviceCode, options = {}) {
+        const provider = this.requireWritableAccountSession(context);
+        const anonymous = await this.#createClient(context);
+        const deadline = Date.now() + Math.max(1, options.expiresInSeconds ?? 600) * 1000;
+        let intervalSeconds = Math.max(1, options.intervalSeconds ?? 5);
+        while (Date.now() < deadline) {
+            const response = await anonymous.request({
+                body: { device_code: deviceCode.trim() },
+                idempotencyKey: `device-auth-${credentialFingerprint(Uint8Array.from(Buffer.from(deviceCode)))}`,
+                method: 'POST',
+                path: '/api/auth/device/token',
+            });
+            const result = parseContract(devicePollSchema, unwrap(response.data), 'DEVICE_AUTH_POLL_RESPONSE_INCOMPATIBLE', '浏览器登录轮询响应与 CLI 合同不兼容。');
+            if (result.status === 'authorized')
+                return this.persistBrowserSession(context, result.token, provider);
+            if (result.status === 'expired_token') {
+                throw new CliError('浏览器登录请求已过期，请重新运行 auth login。', {
+                    code: 'DEVICE_AUTH_EXPIRED',
+                    exitCode: EXIT_CODES.authentication,
+                });
+            }
+            if (result.status === 'slow_down')
+                intervalSeconds = Math.min(intervalSeconds + 5, 60);
+            await this.sleep(intervalSeconds * 1000);
+        }
+        throw new CliError('浏览器登录等待超时，请重新运行 auth login。', {
+            code: 'DEVICE_AUTH_EXPIRED',
+            exitCode: EXIT_CODES.authentication,
+        });
+    }
+    async logout(context) {
+        if (context.credential.kind !== 'account_session') {
+            throw new CliError('API Key 不通过 logout 吊销；请删除本地引用或使用专门的 Key 治理命令。', {
+                code: 'API_KEY_LOGOUT_UNSUPPORTED',
+                exitCode: EXIT_CODES.validation,
+            });
+        }
+        const client = await this.authenticatedClient(context);
+        await client.request({ method: 'POST', path: isKernelOnly(context) ? '/api/kernel/auth/logout' : '/api/auth/logout' });
+        try {
+            await this.secrets.delete(context.credential.secretRef);
+        }
+        catch (error) {
+            throw new CliError('服务端会话已注销，但本地 Session 未能确认删除。', {
+                cause: error,
+                code: 'SESSION_DELETE_FAILED',
+                exitCode: EXIT_CODES.partial,
+                recovery: ['修复当前 Session Store 后重试本地清理；不要假设服务端 Session 仍有效。'],
+                safeDetails: {
+                    ...(error instanceof CliError ? { originalCode: error.code } : {}),
+                    ...secretProviderMetadata(context.credential.secretRef),
+                    requestState: 'server_logout_succeeded',
+                },
+            });
+        }
+    }
+    async whoAmI(context) {
+        const client = await this.authenticatedClient(context);
+        if (isKernelOnly(context)) {
+            const response = await client.request({ method: 'GET', path: '/api/kernel/auth/me' });
+            const user = parseContract(kernelUserSchema, unwrap(response.data), 'SESSION_RESPONSE_INCOMPATIBLE', 'Kernel 身份响应与 CLI 合同不兼容。');
+            return this.validateSession(kernelSession(user), context);
+        }
+        return this.fetchSession(client, context);
+    }
+    async subscriptionName(context) {
+        const client = await this.authenticatedClient(context);
+        const response = await client.request({ method: 'GET', path: '/api/configs' });
+        const subscription = parseContract(subscriptionConfigSchema, unwrap(response.data), 'SUBSCRIPTION_CONFIG_INCOMPATIBLE', '租户配置响应与 CLI 合同不兼容。');
+        const name = subscription.tenantId ?? subscription.applicationConfig?.theme?.id ?? subscription.appId;
+        if (!name) {
+            throw new CliError('租户配置没有可用的订阅名称。', {
+                code: 'SUBSCRIPTION_NAME_MISSING',
+                exitCode: EXIT_CODES.compatibility,
+            });
+        }
+        return name;
+    }
+    async authenticatedClient(context) {
+        const bytes = await this.secrets.get(context.credential.secretRef);
+        const token = Buffer.from(bytes).toString('utf8').trim();
+        bytes.fill(0);
+        if (!token) {
+            throw new CliError('Credential Secret 为空。', { code: 'CREDENTIAL_EMPTY', exitCode: EXIT_CODES.authentication });
+        }
+        return this.#createClient(context, token);
+    }
+    requireWritableAccountSession(context) {
+        if (context.credential.kind !== 'account_session') {
+            throw new CliError('当前 Profile 不是浏览器会话 Credential。', {
+                code: 'CREDENTIAL_KIND_MISMATCH',
+                exitCode: EXIT_CODES.configuration,
+            });
+        }
+        const provider = secretProviderMetadata(context.credential.secretRef);
+        if (!provider.writable) {
+            throw new CliError('浏览器登录需要可写的 Session 存储。', {
+                code: 'ACCOUNT_SESSION_STORE_READ_ONLY',
+                exitCode: EXIT_CODES.configuration,
+                recovery: ['桌面环境使用 keyring:monkeys/<account>；受支持的 POSIX 无头环境可显式使用 session-file:monkeys/<account>。'],
+                safeDetails: provider,
+            });
+        }
+        return provider;
+    }
+    async persistBrowserSession(context, token, provider) {
+        const tokenBytes = Uint8Array.from(Buffer.from(token, 'utf8'));
+        try {
+            const client = await this.#createClient(context, token);
+            const session = isKernelOnly(context)
+                ? this.validateSession(kernelSession(await this.fetchKernelUser(client)), context)
+                : await this.fetchSession(client, context);
+            const fingerprint = credentialFingerprint(tokenBytes);
+            try {
+                await this.secrets.put(context.credential.secretRef, tokenBytes);
+            }
+            catch (error) {
+                throw new CliError('浏览器授权成功，但本地 Session 持久化失败。', {
+                    cause: error,
+                    code: 'SESSION_PERSIST_FAILED',
+                    exitCode: EXIT_CODES.partial,
+                    recovery: ['运行 auth doctor 修复 Session 存储；授权码未过期时可用 --device-code 恢复，不要重新发起授权。'],
+                    safeDetails: {
+                        ...provider,
+                        ...(error instanceof CliError ? { originalCode: error.code } : {}),
+                        requestState: 'browser_login_succeeded',
+                    },
+                });
+            }
+            return { fingerprint, provider, session };
+        }
+        finally {
+            tokenBytes.fill(0);
+        }
+    }
+    async fetchKernelUser(client) {
+        const response = await client.request({ method: 'GET', path: '/api/kernel/auth/me' });
+        return parseContract(kernelUserSchema, unwrap(response.data), 'SESSION_RESPONSE_INCOMPATIBLE', 'Kernel 身份响应与 CLI 合同不兼容。');
+    }
+    async fetchSession(client, context) {
+        const response = await client.request({ method: 'GET', path: '/api/auth/session' });
+        const session = parseContract(sessionSchema, unwrap(response.data), 'SESSION_RESPONSE_INCOMPATIBLE', 'Session 响应与 CLI 合同不兼容。');
+        return this.validateSession(session, context);
+    }
+    validateSession(session, context) {
+        if (!session.authenticated) {
+            throw new CliError('Credential 未通过服务端认证。', { code: 'NOT_AUTHENTICATED', exitCode: EXIT_CODES.authentication });
+        }
+        if (context?.expectedPrincipal && session.principal.userId !== context.expectedPrincipal) {
+            throw new CliError('认证主体与 Profile 预期不一致。', {
+                code: 'PRINCIPAL_MISMATCH',
+                exitCode: EXIT_CODES.authorization,
+                safeDetails: { actual: session.principal.userId, expected: context.expectedPrincipal },
+            });
+        }
+        const missingSurfaces = context?.expectedSurfaces.filter((surface) => !(surface in session.surfaces) || !session.surfaces[surface]);
+        if (missingSurfaces?.length) {
+            throw new CliError('Credential 缺少 Profile 预期的认证 Surface。', {
+                code: 'SURFACE_MISMATCH',
+                exitCode: EXIT_CODES.authorization,
+                safeDetails: { missingSurfaces },
+            });
+        }
+        return session;
+    }
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/credential/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/credential/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAA+B,MAAM,uBAAuB,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACrE,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACxD,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,KAAK,EAAE,CAAC;aACL,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SACxC,CAAC;aACD,WAAW,EAAE;aACb,QAAQ,EAAE;KACd,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,yBAAyB,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;IAChG,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;SAC9H,WAAW,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;IAC1H,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,cAAc,EAAE,yBAAyB;QACzC,KAAK,EAAE,yBAAyB;QAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,yBAAyB;KAChC,CAAC;SACD,WAAW,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;CAC9H,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,MAAM,YAAY,GAAc,KAAK,EAAE,YAAY,EAAE,EAAE;IACrD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,SAAS,aAAa,CAAI,MAAoB,EAAE,KAAc,EAAE,IAAY,EAAE,OAAe;IAC3F,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC1B,KAAK,EAAE,KAAK;YACZ,IAAI;YACJ,QAAQ,EAAE,UAAU,CAAC,aAAa;YAClC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;SAC/F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAkB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,OAAO,aAAa,CAAC,KAAK,CAAC;QACzB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QAC7E,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3F,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE;QAC7E,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IAIH,OAAO;IAEP,KAAK;IALf,aAAa,CAAoB;IAE1C,YACmB,OAAoB,EACrC,YAAgC,EACf,KAAK,GAAc,YAAY;uBAF/B,OAAO;qBAEP,KAAK;QAEtB,IAAI,CAAC,aAAa,GAAG,YAAY,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAwB,EAAE,MAAkB;QAC7D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE;gBACtD,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,UAAU,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAwB;QACrD,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACrG,MAAM,aAAa,GAAG,aAAa,CACjC,yBAAyB,EACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACF,kBAAkB,CAAC,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,OAAwB,EACxB,UAAkB,EAClB,OAAO,GAA4D,EAAE;QAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QAClF,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACvC,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE;gBACxC,cAAc,EAAE,eAAe,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;gBAChG,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;aAC/B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,aAAa,CAC1B,gBAAgB,EAChB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrB,wCAAwC,EACxC,uBAAuB,CACxB,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACtC,MAAM,IAAI,QAAQ,CAAC,8BAA8B,EAAE;oBACjD,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,UAAU,CAAC,cAAc;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE;YAChD,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,UAAU,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE;gBAClE,IAAI,EAAE,4BAA4B;gBAClC,QAAQ,EAAE,UAAU,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACvH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,8BAA8B,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,QAAQ,EAAE,CAAC,iDAAiD,CAAC;gBAC7D,WAAW,EAAE;oBACX,GAAG,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;oBACvD,YAAY,EAAE,yBAAyB;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,aAAa,CACxB,gBAAgB,EAChB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrB,+BAA+B,EAC/B,yBAAyB,CAC1B,CAAC;YACF,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAwB;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/E,MAAM,YAAY,GAAG,aAAa,CAChC,wBAAwB,EACxB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrB,kCAAkC,EAClC,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC;QACtG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE;gBACnC,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,UAAU,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAwB;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEO,6BAA6B,CAAC,OAAwB;QAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE;gBACnD,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,UAAU,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE;gBAC3C,IAAI,EAAE,iCAAiC;gBACvC,QAAQ,EAAE,UAAU,CAAC,aAAa;gBAClC,QAAQ,EAAE,CAAC,uFAAuF,CAAC;gBACnG,WAAW,EAAE,QAAQ;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,OAAwB,EACxB,KAAa,EACb,QAAgC;QAEhC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;gBACnC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;gBAClF,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE;oBAC/C,KAAK,EAAE,KAAK;oBACZ,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,UAAU,CAAC,OAAO;oBAC5B,QAAQ,EAAE,CAAC,mEAAmE,CAAC;oBAC/E,WAAW,EAAE;wBACX,GAAG,QAAQ;wBACX,GAAG,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClE,YAAY,EAAE,yBAAyB;qBACxC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAkB;QAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,OAAO,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAC5H,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAkB,EAAE,OAAyB;QACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,+BAA+B,EAAE,wBAAwB,CAAC,CAAC;QAC/H,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEO,eAAe,CAAC,OAAwB,EAAE,OAAyB;QACzE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACzF,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,UAAU,CAAC,aAAa;gBAClC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,EAAE,gBAAgB,CAAC,MAAM,CACtD,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAwC,CAAC,CAC3G,CAAC;QACF,IAAI,eAAe,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,sCAAsC,EAAE;gBACzD,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,UAAU,CAAC,aAAa;gBAClC,WAAW,EAAE,EAAE,eAAe,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/credential/command-runtime.d.ts

@@ -0,0 +1,17 @@
+import { ConfigRegistry, type EndpointProfileResult } from '../config/registry.js';
+import { type ResolvedContext } from '../context/resolver.js';
+import { RoutedSecretStore } from './secret-store.js';
+export interface CommandRuntime {
+    context: Readonly<ResolvedContext>;
+    registry: ConfigRegistry;
+    secrets: RoutedSecretStore;
+}
+export interface ResolveCommandRuntimeOptions {
+    inheritDefaultTeam?: boolean;
+}
+export interface EndpointCommandRuntime extends CommandRuntime {
+    endpointProfile: EndpointProfileResult;
+}
+export declare function resolveCommandRuntime(profile?: string, team?: string, options?: ResolveCommandRuntimeOptions): Promise<CommandRuntime>;
+export declare function resolveEndpointCommandRuntime(url: string, credentialKind: 'account_session' | 'api_key'): Promise<EndpointCommandRuntime>;
+//# sourceMappingURL=command-runtime.d.ts.map

package/dist/credential/command-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-runtime.d.ts","sourceRoot":"","sources":["../../src/credential/command-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,eAAe,EAAE,qBAAqB,CAAC;CACxC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,iBAAiB,GAAG,SAAS,GAC5C,OAAO,CAAC,sBAAsB,CAAC,CAMjC"}

package/dist/credential/command-runtime.js

@@ -0,0 +1,22 @@
+import { ConfigRegistry } from '../config/registry.js';
+import { ConfigStore } from '../config/store.js';
+import { resolveContext } from '../context/resolver.js';
+import { RoutedSecretStore } from './secret-store.js';
+export async function resolveCommandRuntime(profile, team, options = {}) {
+    const store = new ConfigStore();
+    const registry = new ConfigRegistry(store);
+    const context = resolveContext(await store.read(), {
+        ...(options.inheritDefaultTeam === undefined ? {} : { inheritDefaultTeam: options.inheritDefaultTeam }),
+        ...(profile ? { profile } : {}),
+        ...(team ? { team } : {}),
+    });
+    return { context, registry, secrets: new RoutedSecretStore() };
+}
+export async function resolveEndpointCommandRuntime(url, credentialKind) {
+    const store = new ConfigStore();
+    const registry = new ConfigRegistry(store);
+    const endpointProfile = await registry.ensureEndpointProfile(url, credentialKind);
+    const context = resolveContext(await store.read(), { inheritDefaultTeam: false, profile: endpointProfile.profileName });
+    return { context, endpointProfile, registry, secrets: new RoutedSecretStore() };
+}
+//# sourceMappingURL=command-runtime.js.map

package/dist/credential/command-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-runtime.js","sourceRoot":"","sources":["../../src/credential/command-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA8B,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAwB,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAgBtD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,IAAa,EACb,OAAO,GAAiC,EAAE;IAE1C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE;QACjD,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACvG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,iBAAiB,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAW,EACX,cAA6C;IAE7C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,iBAAiB,EAAE,EAAE,CAAC;AAClF,CAAC"}

package/dist/credential/index.d.ts

@@ -0,0 +1,9 @@
+export * from './auth-service.js';
+export * from './command-runtime.js';
+export * from './input.js';
+export * from './runtime.js';
+export * from './secret-reference.js';
+export * from './secret-store.js';
+export * from './session-file-store.js';
+export * from './storage-doctor.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credential/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/credential/index.js

@@ -0,0 +1,9 @@
+export * from './auth-service.js';
+export * from './command-runtime.js';
+export * from './input.js';
+export * from './runtime.js';
+export * from './secret-reference.js';
+export * from './secret-store.js';
+export * from './session-file-store.js';
+export * from './storage-doctor.js';
+//# sourceMappingURL=index.js.map

package/dist/credential/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credential/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/credential/input.d.ts

@@ -0,0 +1,3 @@
+export declare function readSecretFromStdin(input?: NodeJS.ReadableStream): Promise<Uint8Array>;
+export declare function readSecretFromEnvironment(variable: string, env?: NodeJS.ProcessEnv): Uint8Array;
+//# sourceMappingURL=input.d.ts.map

package/dist/credential/input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/credential/input.ts"],"names":[],"mappings":"AAIA,wBAAsB,mBAAmB,CAAC,KAAK,GAAE,MAAM,CAAC,cAA8B,GAAG,OAAO,CAAC,UAAU,CAAC,CAqB3G;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAU5G"}

package/dist/credential/input.js

@@ -0,0 +1,37 @@
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+const MAX_SECRET_BYTES = 64 * 1024;
+export async function readSecretFromStdin(input = process.stdin) {
+    if ('isTTY' in input && input.isTTY) {
+        throw new CliError('当前终端没有通过 stdin 提供 Secret。', {
+            code: 'SECRET_STDIN_REQUIRED',
+            exitCode: EXIT_CODES.validation,
+            recovery: ['使用管道传入 Secret，或使用对应的 --*-env 参数。'],
+        });
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'utf8');
+        size += buffer.length;
+        if (size > MAX_SECRET_BYTES) {
+            throw new CliError('stdin 中的 Secret 超过允许上限。', { code: 'SECRET_TOO_LARGE', exitCode: EXIT_CODES.validation });
+        }
+        chunks.push(buffer);
+    }
+    const value = Buffer.concat(chunks).toString('utf8').trim();
+    if (!value)
+        throw new CliError('Secret 不能为空。', { code: 'SECRET_EMPTY', exitCode: EXIT_CODES.validation });
+    return Uint8Array.from(Buffer.from(value, 'utf8'));
+}
+export function readSecretFromEnvironment(variable, env = process.env) {
+    const name = variable.trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new CliError('环境变量名称无效。', { code: 'SECRET_ENV_INVALID', exitCode: EXIT_CODES.validation });
+    }
+    const value = env[name];
+    if (!value) {
+        throw new CliError(`环境变量未设置：${name}`, { code: 'SECRET_NOT_FOUND', exitCode: EXIT_CODES.configuration });
+    }
+    return Uint8Array.from(Buffer.from(value, 'utf8'));
+}
+//# sourceMappingURL=input.js.map

package/dist/credential/input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.js","sourceRoot":"","sources":["../../src/credential/input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAK,GAA0B,OAAO,CAAC,KAAK;IACpF,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAAC,2BAA2B,EAAE;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;YAC/B,QAAQ,EAAE,CAAC,kCAAkC,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACnF,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1G,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC9F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/credential/open-browser.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedContext } from '../context/resolver.js';
+export declare function validateBrowserUrl(value: string, context: ResolvedContext): URL;
+export declare function openBrowser(value: string, context: ResolvedContext): Promise<boolean>;
+//# sourceMappingURL=open-browser.d.ts.map

package/dist/credential/open-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/credential/open-browser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,GAAG,CA4B/E;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB3F"}