@iowarp/clio-coder 0.3.1 → 0.3.3

package/dist/{chunk-GB6QRBXN.js → chunk-APJ265NV.js}

@@ -1,18 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  processAlive,
-  processBirthToken
-} from "./chunk-3I7MS7N2.js";
-import {
-  safeResourceWrite
-} from "./chunk-WEPFGWHJ.js";
-import {
-  clioConfigDir
-} from "./chunk-BNAZZHFG.js";
 import {
   __commonJS,
   __require,
-  __toESM,
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
 
@@ -4029,10 +4018,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep2, value } = collItem;
+        const { start, key, sep, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep2?.[0],
+          next: key ?? sep?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -4046,7 +4035,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep2) {
+          if (!keyProps.anchor && !keyProps.tag && !sep) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -4070,7 +4059,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -4086,7 +4075,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep2, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -4179,7 +4168,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep2 = "";
+        let sep = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -4193,13 +4182,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep2 + cb;
-              sep2 = "";
+                comment += sep + cb;
+              sep = "";
               break;
             }
             case "newline":
               if (comment)
-                sep2 += source;
+                sep += source;
               hasSpace = true;
               break;
             default:
@@ -4243,18 +4232,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep2, value } = collItem;
+        const { start, key, sep, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep2?.[0],
+          next: key ?? sep?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep2 && !value) {
+          if (!props.anchor && !props.tag && !sep && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -4308,8 +4297,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep2 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
+        if (!isMap && !sep && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -4321,7 +4310,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -4332,8 +4321,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep2)
-                for (const st of sep2) {
+              if (sep)
+                for (const st of sep) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -4350,7 +4339,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep2, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -4532,7 +4521,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep2 = "";
+      let sep = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -4549,24 +4538,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep2 + indent.slice(trimIndent) + content;
-          sep2 = "\n";
+          value += sep + indent.slice(trimIndent) + content;
+          sep = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep2 === " ")
-            sep2 = "\n";
-          else if (!prevMoreIndented && sep2 === "\n")
-            sep2 = "\n\n";
-          value += sep2 + indent.slice(trimIndent) + content;
-          sep2 = "\n";
+          if (sep === " ")
+            sep = "\n";
+          else if (!prevMoreIndented && sep === "\n")
+            sep = "\n\n";
+          value += sep + indent.slice(trimIndent) + content;
+          sep = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep2 === "\n")
+          if (sep === "\n")
             value += "\n";
           else
-            sep2 = "\n";
+            sep = "\n";
         } else {
-          value += sep2 + content;
-          sep2 = " ";
+          value += sep + content;
+          sep = " ";
           prevMoreIndented = false;
         }
       }
@@ -4749,25 +4738,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep2 = " ";
+      let sep = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep2 === "\n")
-            res += sep2;
+          if (sep === "\n")
+            res += sep;
           else
-            sep2 = "\n";
+            sep = "\n";
         } else {
-          res += sep2 + match[1];
-          sep2 = " ";
+          res += sep + match[1];
+          sep = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep2 + (match?.[1] ?? "");
+      return res + sep + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -5584,14 +5573,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep2, value }) {
+    function stringifyItem({ start, key, sep, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep2)
-        for (const st of sep2)
+      if (sep)
+        for (const st of sep)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -6763,18 +6752,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep2;
+          let sep;
           if (scalar.end) {
-            sep2 = scalar.end;
-            sep2.push(this.sourceToken);
+            sep = scalar.end;
+            sep.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep2 = [this.sourceToken];
+            sep = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep2 }]
+            items: [{ start, key: scalar, sep }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -6927,15 +6916,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep2 = it.sep;
-                  sep2.push(this.sourceToken);
+                  const sep = it.sep;
+                  sep.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep2 }]
+                    items: [{ start: start2, key, sep }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7129,13 +7118,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep2 = fc.end.splice(1, fc.end.length);
-            sep2.push(this.sourceToken);
+            const sep = fc.end.splice(1, fc.end.length);
+            sep.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep2 }]
+              items: [{ start, key: fc, sep }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -7415,1129 +7404,7 @@ var require_dist = __commonJS({
   }
 });
 
-// src/engine/oauth.ts
-init_esm_shims();
-import { findEnvKeys as piFindEnvKeys, getEnvApiKey as piGetEnvApiKey } from "@earendil-works/pi-ai/compat";
-import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
-import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-
-// src/engine/alcf-oauth.ts
-init_esm_shims();
-var AUTH_CLIENT_ID = "58fdd3bc-e1c3-4ce5-80ea-8d6b87cfb944";
-var GATEWAY_CLIENT_ID = "681c10cc-f684-4540-bcd7-0b4df3bc26ef";
-var GATEWAY_SCOPE = `https://auth.globus.org/scopes/${GATEWAY_CLIENT_ID}/action_all`;
-var ALLOWED_DOMAINS = "anl.gov,alcf.anl.gov";
-var AUTHORIZE_URL = "https://auth.globus.org/v2/oauth2/authorize";
-var TOKEN_URL = "https://auth.globus.org/v2/oauth2/token";
-var REDIRECT_URI = "https://auth.globus.org/v2/web/auth-code";
-var EXPIRY_SKEW_MS = 5 * 60 * 1e3;
-function base64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-async function generatePkce() {
-  const verifierBytes = new Uint8Array(32);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = base64Url(verifierBytes);
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return { verifier, challenge: base64Url(new Uint8Array(digest)) };
-}
-function randomState() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return base64Url(bytes);
-}
-function buildAuthorizeUrl(params) {
-  const query = new URLSearchParams({
-    client_id: AUTH_CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: GATEWAY_SCOPE,
-    state: params.state,
-    code_challenge: params.challenge,
-    code_challenge_method: "S256",
-    access_type: "offline",
-    session_required_single_domain: ALLOWED_DOMAINS
-  });
-  return `${AUTHORIZE_URL}?${query.toString()}`;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return "";
-  try {
-    const url = new URL(value);
-    const code = url.searchParams.get("code");
-    if (code) return code;
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value.includes("?") ? value.slice(value.indexOf("?") + 1) : value);
-    const code = params.get("code");
-    if (code) return code;
-  }
-  return value;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function selectGatewayGrant(payload) {
-  const grants = [payload, ...Array.isArray(payload.other_tokens) ? payload.other_tokens : []];
-  const byResourceServer = grants.find((grant) => grant.resource_server === GATEWAY_CLIENT_ID);
-  if (byResourceServer) return byResourceServer;
-  const byScope = grants.find(
-    (grant) => typeof grant.scope === "string" && (grant.scope.includes("action_all") || grant.scope === GATEWAY_SCOPE)
-  );
-  if (byScope) return byScope;
-  if (grants.length === 1 && typeof payload.access_token === "string") return payload;
-  throw new Error(
-    `Globus token response did not include a grant for the ALCF gateway (resource_server=${GATEWAY_CLIENT_ID}).`
-  );
-}
-function grantToCredentials(grant, previousRefresh) {
-  const access = grant.access_token;
-  if (typeof access !== "string" || access.length === 0) {
-    throw new Error("Globus token response is missing an access token for the ALCF gateway.");
-  }
-  const refresh = typeof grant.refresh_token === "string" && grant.refresh_token.length > 0 ? grant.refresh_token : previousRefresh;
-  if (typeof refresh !== "string" || refresh.length === 0) {
-    throw new Error("Globus token response is missing a refresh token; cannot persist a renewable session.");
-  }
-  const expiresInSeconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 0;
-  return {
-    access,
-    refresh,
-    expires: Date.now() + expiresInSeconds * 1e3 - EXPIRY_SKEW_MS
-  };
-}
-async function postForm(body) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(body).toString(),
-    signal: AbortSignal.timeout(3e4)
-  });
-  const text = await response.text();
-  if (!response.ok) {
-    throw new Error(`Globus token endpoint failed (HTTP ${response.status}): ${text.slice(0, 300)}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (err) {
-    throw new Error(`Globus token endpoint returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (!isRecord(parsed)) throw new Error("Globus token endpoint returned a non-object response.");
-  return parsed;
-}
-async function exchangeCode(code, verifier) {
-  const payload = await postForm({
-    grant_type: "authorization_code",
-    client_id: AUTH_CLIENT_ID,
-    code,
-    code_verifier: verifier,
-    redirect_uri: REDIRECT_URI
-  });
-  return grantToCredentials(selectGatewayGrant(payload));
-}
-async function refreshGatewayToken(refreshToken) {
-  const payload = await postForm({
-    grant_type: "refresh_token",
-    client_id: AUTH_CLIENT_ID,
-    refresh_token: refreshToken
-  });
-  return grantToCredentials(selectGatewayGrant(payload), refreshToken);
-}
-async function loginAlcf(callbacks) {
-  const { verifier, challenge } = await generatePkce();
-  const url = buildAuthorizeUrl({ challenge, state: randomState() });
-  callbacks.onAuth({
-    url,
-    instructions: "Log in with your ALCF / anl.gov identity. Globus will show an authorization code; copy it and paste it here."
-  });
-  const pasted = callbacks.onManualCodeInput ? await callbacks.onManualCodeInput() : await callbacks.onPrompt({ message: "Paste the authorization code from Globus", placeholder: "code" });
-  const code = parseAuthorizationInput(pasted);
-  if (!code) throw new Error("No authorization code was provided.");
-  callbacks.onProgress?.("Exchanging authorization code for an ALCF access token...");
-  return exchangeCode(code, verifier);
-}
-var alcfOAuthProvider = {
-  id: "alcf",
-  name: "ALCF Inference (Globus)",
-  usesCallbackServer: false,
-  login(callbacks) {
-    return loginAlcf(callbacks);
-  },
-  refreshToken(credentials) {
-    return refreshGatewayToken(credentials.refresh);
-  },
-  async getApiKey(credentials) {
-    return credentials.access;
-  }
-};
-
-// src/engine/oauth.ts
-function interactionFromLoginCallbacks(callbacks) {
-  const interaction = {
-    notify(event) {
-      switch (event.type) {
-        case "auth_url":
-          callbacks.onAuth({
-            url: event.url,
-            ...event.instructions === void 0 ? {} : { instructions: event.instructions }
-          });
-          return;
-        case "device_code":
-          callbacks.onDeviceCode({
-            userCode: event.userCode,
-            verificationUri: event.verificationUri,
-            ...event.intervalSeconds === void 0 ? {} : { intervalSeconds: event.intervalSeconds },
-            ...event.expiresInSeconds === void 0 ? {} : { expiresInSeconds: event.expiresInSeconds }
-          });
-          return;
-        case "progress":
-        case "info":
-          callbacks.onProgress?.(event.message);
-          return;
-      }
-    },
-    async prompt(prompt) {
-      switch (prompt.type) {
-        case "select": {
-          const selection = await callbacks.onSelect({
-            message: prompt.message,
-            options: prompt.options.map((option) => ({ id: option.id, label: option.label }))
-          });
-          if (selection === void 0) throw new Error("login cancelled");
-          return selection;
-        }
-        case "manual_code":
-          if (callbacks.onManualCodeInput) return callbacks.onManualCodeInput();
-          return callbacks.onPrompt({
-            message: prompt.message,
-            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
-          });
-        default:
-          return callbacks.onPrompt({
-            message: prompt.message,
-            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
-          });
-      }
-    }
-  };
-  if (callbacks.signal) interaction.signal = callbacks.signal;
-  return interaction;
-}
-function fromOAuthAuth(id, auth, usesCallbackServer) {
-  if (!auth) throw new Error(`pi-ai provider "${id}" no longer exposes an OAuth flow`);
-  return {
-    id,
-    name: auth.name,
-    usesCallbackServer,
-    async login(callbacks) {
-      return auth.login(interactionFromLoginCallbacks(callbacks));
-    },
-    async refreshToken(credentials) {
-      return auth.refresh({ ...credentials, type: "oauth" });
-    },
-    async getApiKey(credentials) {
-      const resolved = await auth.toAuth({ ...credentials, type: "oauth" });
-      if (!resolved.apiKey) {
-        throw new Error(`OAuth provider "${id}" resolved no API key from the stored credential`);
-      }
-      return resolved.apiKey;
-    }
-  };
-}
-var providers = null;
-function builtinProviders() {
-  return [
-    fromOAuthAuth("anthropic", anthropicProvider().auth.oauth, true),
-    fromOAuthAuth("openai-codex", openaiCodexProvider().auth.oauth, true),
-    fromOAuthAuth("github-copilot", githubCopilotProvider().auth.oauth, false)
-  ];
-}
-function registry() {
-  if (!providers) {
-    providers = new Map(builtinProviders().map((provider) => [provider.id, provider]));
-  }
-  return providers;
-}
-function getEngineEnvApiKey(providerId) {
-  try {
-    return piGetEnvApiKey(providerId);
-  } catch {
-    return void 0;
-  }
-}
-function findEngineEnvKeys(providerId) {
-  try {
-    return piFindEnvKeys(providerId);
-  } catch {
-    return void 0;
-  }
-}
-function getEngineOAuthProvider(providerId) {
-  return registry().get(providerId);
-}
-function listEngineOAuthProviders() {
-  return [...registry().values()];
-}
-function registerEngineOAuthProvider(provider) {
-  registry().set(provider.id, provider);
-}
-var clioOAuthProvidersRegistered = false;
-function registerClioOAuthProviders() {
-  if (clioOAuthProvidersRegistered) return;
-  clioOAuthProvidersRegistered = true;
-  registerEngineOAuthProvider(alcfOAuthProvider);
-}
-async function loginWithEngineOAuthProvider(providerId, callbacks) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.login(callbacks);
-}
-async function refreshEngineOAuthCredentials(providerId, credentials) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.refreshToken(credentials);
-}
-async function getEngineOAuthApiKey(providerId, credentials) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.getApiKey(credentials);
-}
-
-// src/domains/providers/auth/storage.ts
-init_esm_shims();
-var import_yaml = __toESM(require_dist(), 1);
-
-// src/domains/providers/auth/api-key.ts
-init_esm_shims();
-
-// src/core/resolve-config-value.ts
-init_esm_shims();
-import { spawnSync } from "node:child_process";
-import { homedir } from "node:os";
-import { join, resolve, sep } from "node:path";
-var commandResultCache = /* @__PURE__ */ new Map();
-function env(options) {
-  return options?.env ?? process.env;
-}
-function shellCommand(command) {
-  const isWindows = process.platform === "win32";
-  const shell = isWindows ? process.env.ComSpec || "cmd.exe" : process.env.SHELL || "/bin/sh";
-  const args = isWindows ? ["/d", "/s", "/c", command] : ["-lc", command];
-  const result = spawnSync(shell, args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 1e4,
-    windowsHide: true
-  });
-  if (result.error || result.status !== 0) return void 0;
-  const value = result.stdout.trim();
-  return value.length > 0 ? value : void 0;
-}
-function executeCommand(commandConfig) {
-  if (commandResultCache.has(commandConfig)) return commandResultCache.get(commandConfig);
-  const value = shellCommand(commandConfig.slice(1));
-  commandResultCache.set(commandConfig, value);
-  return value;
-}
-function warnStaticCommand(config, options) {
-  options?.onWarning?.({
-    code: "dynamic-command-in-static-resolution",
-    message: "bang-prefixed config command left literal by static config value resolver",
-    command: config.slice(1)
-  });
-}
-function expandConfigValue(value, options) {
-  const sourceEnv = env(options);
-  return value.replace(/\$(\w+)|\$\{([^}]+)\}/g, (match, bare, braced) => {
-    const key = bare ?? braced;
-    if (!key) return match;
-    return sourceEnv[key] ?? "";
-  });
-}
-function expandConfigPath(value, options) {
-  const cwd = options?.cwd ?? process.cwd();
-  const expandedEnv = expandConfigValue(value.trim(), options);
-  let expanded = expandedEnv;
-  if (expanded === "~") {
-    expanded = homedir();
-  } else if (expanded.startsWith(`~${sep}`) || expanded.startsWith("~/")) {
-    expanded = `${homedir()}${expanded.slice(1)}`;
-  } else if (expanded.startsWith("~")) {
-    expanded = join(homedir(), expanded.slice(1));
-  }
-  return resolve(cwd, expanded);
-}
-function resolveStaticConfigValue(config, options) {
-  if (config.startsWith("!")) warnStaticCommand(config, options);
-  const sourceEnv = env(options);
-  const envValue = sourceEnv[config];
-  if (envValue !== void 0 && envValue.length > 0) return envValue;
-  const expanded = expandConfigValue(config, options);
-  return expanded.length > 0 ? expanded : void 0;
-}
-function resolveDynamicConfigValue(config, options) {
-  if (config.startsWith("!")) return executeCommand(config);
-  return resolveStaticConfigValue(config, options);
-}
-
-// src/domains/providers/auth/api-key.ts
-function resolveStoredApiKey(key, providerId = "stored-api-key") {
-  const trimmed = key.trim();
-  if (trimmed.length === 0) return void 0;
-  return resolveProviderDynamicSecret(trimmed, { providerId, field: "apiKey" });
-}
-function normalizeStoredApiKeyRef(key) {
-  const trimmed = key.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function resolveProviderDynamicSecret(value, context, options) {
-  void context;
-  return resolveDynamicConfigValue(value, options);
-}
-function resolveEnvironmentApiKey(providerId, explicitEnvVar) {
-  if (explicitEnvVar) {
-    const fromExplicit = process.env[explicitEnvVar]?.trim();
-    if (fromExplicit && fromExplicit.length > 0) {
-      return { apiKey: fromExplicit, source: explicitEnvVar };
-    }
-  }
-  for (const envVar of findEngineEnvKeys(providerId) ?? []) {
-    const fromKnownEnv = process.env[envVar]?.trim();
-    if (fromKnownEnv && fromKnownEnv.length > 0) {
-      return { apiKey: fromKnownEnv, source: envVar };
-    }
-  }
-  const fromKnownProvider = getEngineEnvApiKey(providerId)?.trim();
-  if (fromKnownProvider && fromKnownProvider.length > 0) {
-    return { apiKey: fromKnownProvider, source: null };
-  }
-  return { apiKey: void 0, source: explicitEnvVar ?? null };
-}
-
-// src/domains/providers/auth/oauth.ts
-init_esm_shims();
-function getOAuthProvider(providerId) {
-  return getEngineOAuthProvider(providerId);
-}
-function listOAuthProviders() {
-  return listEngineOAuthProviders();
-}
-async function loginWithOAuthProvider(providerId, callbacks) {
-  return loginWithEngineOAuthProvider(providerId, callbacks);
-}
-async function refreshOAuthCredentials(providerId, credentials) {
-  return refreshEngineOAuthCredentials(providerId, credentials);
-}
-function getOAuthApiKey(providerId, credentials) {
-  return getEngineOAuthApiKey(providerId, credentials);
-}
-
-// src/domains/providers/auth/storage.ts
-var AuthStorageDamagedError = class extends Error {
-  constructor(damage, path) {
-    super(
-      [
-        `refusing to write credentials: ${damage}.`,
-        path ? `File: ${path}` : null,
-        "Writing would replace the whole file and lose whatever is stored there.",
-        "Move the file aside once you have recovered anything you need, then log in again."
-      ].filter((line) => line !== null).join(" ")
-    );
-    this.damage = damage;
-    this.path = path;
-    this.name = "AuthStorageDamagedError";
-  }
-  damage;
-  path;
-};
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function emptyData() {
-  return {};
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-function toApiKeyCredential(raw) {
-  if (!isRecord2(raw)) return null;
-  if (raw.type === "api_key" && typeof raw.key === "string" && raw.key.trim().length > 0) {
-    return {
-      type: "api_key",
-      key: raw.key,
-      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
-    };
-  }
-  return null;
-}
-function toOAuthCredential(raw) {
-  if (!isRecord2(raw)) return null;
-  if (raw.type === "oauth" && typeof raw.access === "string" && typeof raw.refresh === "string" && typeof raw.expires === "number") {
-    return {
-      ...raw,
-      type: "oauth",
-      access: raw.access,
-      refresh: raw.refresh,
-      expires: raw.expires,
-      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
-    };
-  }
-  return null;
-}
-function readStorageData(content) {
-  if (!content || content.trim().length === 0) return { data: emptyData(), damage: null };
-  let parsed;
-  try {
-    parsed = (0, import_yaml.parse)(content);
-  } catch (error) {
-    const raw = error instanceof Error ? error.message : String(error);
-    const detail = (raw.split("\n")[0] ?? raw).trim().replace(/:$/u, "");
-    return { data: emptyData(), damage: `it is not valid YAML: ${detail}` };
-  }
-  if (parsed === null || parsed === void 0) return { data: emptyData(), damage: null };
-  if (!isRecord2(parsed)) return { data: emptyData(), damage: "its top level is not a mapping" };
-  if (Object.keys(parsed).length === 0) return { data: emptyData(), damage: null };
-  if (!("entries" in parsed) && !("version" in parsed)) {
-    return { data: emptyData(), damage: "it has neither a version nor an entries mapping" };
-  }
-  const entries = isRecord2(parsed.entries) ? parsed.entries : null;
-  if (!entries) return { data: emptyData(), damage: null };
-  const data = {};
-  const unread = [];
-  const version = parsed.version;
-  if (version === 1 || version === void 0 && Object.values(entries).every((value) => isRecord2(value) && "key" in value)) {
-    for (const [providerId, value] of Object.entries(entries ?? {})) {
-      if (!value || typeof value.key !== "string" || value.key.trim().length === 0) {
-        unread.push(providerId);
-        continue;
-      }
-      data[providerId] = {
-        type: "api_key",
-        key: value.key,
-        updatedAt: typeof value.updatedAt === "string" && value.updatedAt.length > 0 ? value.updatedAt : nowIso()
-      };
-    }
-    return { data, damage: unreadDamage(unread) };
-  }
-  for (const [providerId, value] of Object.entries(entries ?? {})) {
-    const apiKey = toApiKeyCredential(value);
-    if (apiKey) {
-      data[providerId] = apiKey;
-      continue;
-    }
-    const oauth = toOAuthCredential(value);
-    if (oauth) {
-      data[providerId] = oauth;
-      continue;
-    }
-    unread.push(providerId);
-  }
-  return { data, damage: unreadDamage(unread) };
-}
-function unreadDamage(unread) {
-  if (unread.length === 0) return null;
-  return `these entries are stored in a shape this version cannot read: ${[...unread].sort().join(", ")}`;
-}
-function serializeStorageData(data) {
-  return (0, import_yaml.stringify)({
-    version: 2,
-    entries: data
-  });
-}
-function resolveAuthTarget(target, runtime) {
-  const providerId = target.auth?.oauthProfile?.trim() || target.auth?.apiKeyRef?.trim() || runtime.oauthProviderId || runtime.id;
-  const authTarget = {
-    providerId,
-    targetId: target.id,
-    runtimeAuth: runtime.auth
-  };
-  const explicitEnvVar = target.auth?.apiKeyEnvVar ?? runtime.credentialsEnvVar;
-  if (explicitEnvVar) authTarget.explicitEnvVar = explicitEnvVar;
-  return authTarget;
-}
-function resolveRuntimeAuthTarget(runtime) {
-  const target = {
-    providerId: runtime.oauthProviderId ?? runtime.id,
-    runtimeAuth: runtime.auth
-  };
-  if (runtime.credentialsEnvVar) target.explicitEnvVar = runtime.credentialsEnvVar;
-  return target;
-}
-function targetRequiresAuth(target, runtime) {
-  if (runtime.auth === "oauth") return true;
-  if (runtime.auth !== "api-key") return false;
-  if (target.auth?.apiKeyEnvVar || target.auth?.apiKeyRef || target.auth?.oauthProfile) return true;
-  return runtime.tier === "cloud" || Boolean(runtime.credentialsEnvVar);
-}
-function authNotRequiredStatus(providerId) {
-  return {
-    providerId,
-    available: true,
-    credentialType: null,
-    source: "not-required",
-    detail: null
-  };
-}
-var AuthStorage = class {
-  constructor(backend) {
-    this.backend = backend;
-    this.reload();
-  }
-  backend;
-  data = {};
-  damage = null;
-  runtimeOverrides = /* @__PURE__ */ new Map();
-  fallbackResolver;
-  reload() {
-    try {
-      let content;
-      this.backend.withLock((current) => {
-        content = current;
-        return { result: void 0 };
-      });
-      const read = readStorageData(content);
-      this.data = read.data;
-      this.damage = read.damage;
-    } catch (error) {
-      this.data = emptyData();
-      this.damage = error instanceof Error ? `it could not be read: ${error.message}` : "it could not be read";
-    }
-  }
-  /**
-   * Why the store on disk could not be fully read, or why the last write to it
-   * did not land, or null when it is clean. Callers that report connection
-   * state must consult this, because a damaged store reads as zero credentials
-   * and is otherwise indistinguishable from having never logged in, and a
-   * refused write leaves memory claiming a credential that disk does not hold.
-   */
-  damageReason() {
-    return this.damage;
-  }
-  persist(providerId, credential) {
-    try {
-      this.backend.withLock((current) => {
-        const read = readStorageData(current);
-        if (read.damage !== null) {
-          this.damage = read.damage;
-          throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
-        }
-        const merged = read.data;
-        if (credential) merged[providerId] = credential;
-        else delete merged[providerId];
-        this.data = merged;
-        this.damage = null;
-        return { result: void 0, next: serializeStorageData(merged) };
-      });
-    } catch (error) {
-      if (error instanceof AuthStorageDamagedError) throw error;
-      this.damage = error instanceof Error ? `it could not be written: ${error.message}` : "it could not be written";
-    }
-  }
-  get(providerId) {
-    return this.data[providerId];
-  }
-  // persist() adopts the merged view on success, so it runs first: assigning
-  // in-memory ahead of it would leave a credential that reads back as stored
-  // while the disk write was refused.
-  set(providerId, credential) {
-    this.persist(providerId, credential);
-    this.data[providerId] = credential;
-  }
-  setApiKey(providerId, key) {
-    const resolved = normalizeStoredApiKeyRef(key);
-    if (!resolved) throw new Error(`auth.setApiKey: empty key for provider=${providerId}`);
-    this.set(providerId, { type: "api_key", key: resolved, updatedAt: nowIso() });
-  }
-  remove(providerId) {
-    this.persist(providerId, void 0);
-    delete this.data[providerId];
-  }
-  listStored() {
-    return Object.entries(this.data).map(([providerId, credential]) => ({
-      providerId,
-      type: credential.type,
-      updatedAt: credential.updatedAt
-    })).sort((a, b) => a.providerId.localeCompare(b.providerId));
-  }
-  hasStored(providerId) {
-    return providerId in this.data;
-  }
-  /**
-   * Install a process-lifetime API key override scoped to a specific target.
-   * Overrides are keyed by `targetId` (not providerId) so two targets
-   * sharing a runtime do not share the override. `clio-coder --api-key <key>`
-   * applies only to the active target, not every target on that provider.
-   */
-  setRuntimeOverride(targetId, apiKey) {
-    if (targetId.length === 0) {
-      throw new Error("auth.setRuntimeOverride: empty targetId");
-    }
-    const resolved = normalizeStoredApiKeyRef(apiKey);
-    if (!resolved) throw new Error(`auth.setRuntimeOverride: empty key for target=${targetId}`);
-    this.runtimeOverrides.set(targetId, resolved);
-  }
-  clearRuntimeOverride(targetId) {
-    if (targetId.length === 0) return;
-    this.runtimeOverrides.delete(targetId);
-  }
-  setFallbackResolver(resolver) {
-    this.fallbackResolver = resolver;
-  }
-  status(providerId, opts) {
-    if (opts?.targetId && this.runtimeOverrides.has(opts.targetId)) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "runtime-override",
-        detail: providerId
-      };
-    }
-    const stored = this.data[providerId];
-    if (stored?.type === "api_key") {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "stored-api-key",
-        detail: providerId
-      };
-    }
-    if (stored?.type === "oauth") {
-      return {
-        providerId,
-        available: true,
-        credentialType: "oauth",
-        source: "stored-oauth",
-        detail: providerId
-      };
-    }
-    const env2 = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
-    if (env2.apiKey) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "environment",
-        detail: env2.source ?? providerId
-      };
-    }
-    if (opts?.includeFallback !== false) {
-      const fallback = this.fallbackResolver?.(providerId)?.trim();
-      if (fallback && fallback.length > 0) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "fallback",
-          detail: providerId
-        };
-      }
-    }
-    return {
-      providerId,
-      available: false,
-      credentialType: null,
-      source: "none",
-      detail: null
-    };
-  }
-  statusForTarget(target, opts) {
-    const args = {};
-    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
-    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
-    if (target.targetId) args.targetId = target.targetId;
-    return this.status(target.providerId, args);
-  }
-  async refreshOAuthCredentialWithLock(providerId) {
-    return this.backend.withLockAsync(async (current) => {
-      const read = readStorageData(current);
-      if (read.damage !== null) {
-        this.damage = read.damage;
-        throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
-      }
-      const currentData = read.data;
-      this.data = currentData;
-      this.damage = null;
-      const stored = currentData[providerId];
-      if (stored?.type !== "oauth") {
-        return { result: null };
-      }
-      if (Date.now() < stored.expires) {
-        return { result: { apiKey: await getOAuthApiKey(providerId, stored), credential: stored } };
-      }
-      const refreshed = await refreshOAuthCredentials(providerId, stored);
-      const next = {
-        type: "oauth",
-        ...refreshed,
-        updatedAt: nowIso()
-      };
-      const merged = { ...currentData, [providerId]: next };
-      this.data = merged;
-      return {
-        result: { apiKey: await getOAuthApiKey(providerId, next), credential: next },
-        next: serializeStorageData(merged)
-      };
-    });
-  }
-  async resolveApiKey(providerId, opts) {
-    if (opts?.targetId) {
-      const override = this.runtimeOverrides.get(opts.targetId);
-      if (override) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "runtime-override",
-          detail: providerId,
-          apiKey: override
-        };
-      }
-    }
-    const stored = this.data[providerId];
-    if (stored?.type === "api_key") {
-      const apiKey = resolveStoredApiKey(stored.key, providerId);
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "stored-api-key",
-        detail: providerId,
-        ...apiKey ? { apiKey } : {}
-      };
-    }
-    if (stored?.type === "oauth") {
-      const provider = getOAuthProvider(providerId);
-      if (!provider) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "oauth",
-          source: "stored-oauth",
-          detail: providerId
-        };
-      }
-      if (Date.now() < stored.expires) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "oauth",
-          source: "stored-oauth",
-          detail: providerId,
-          apiKey: await getOAuthApiKey(providerId, stored)
-        };
-      }
-      try {
-        const refreshed = await this.refreshOAuthCredentialWithLock(providerId);
-        if (refreshed) {
-          return {
-            providerId,
-            available: true,
-            credentialType: "oauth",
-            source: "stored-oauth",
-            detail: providerId,
-            apiKey: refreshed.apiKey
-          };
-        }
-      } catch {
-        this.reload();
-        const updated = this.data[providerId];
-        if (updated?.type === "oauth" && Date.now() < updated.expires) {
-          return {
-            providerId,
-            available: true,
-            credentialType: "oauth",
-            source: "stored-oauth",
-            detail: providerId,
-            apiKey: await getOAuthApiKey(providerId, updated)
-          };
-        }
-      }
-      return {
-        providerId,
-        available: true,
-        credentialType: "oauth",
-        source: "stored-oauth",
-        detail: providerId
-      };
-    }
-    const env2 = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
-    if (env2.apiKey) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "environment",
-        detail: env2.source ?? providerId,
-        apiKey: env2.apiKey
-      };
-    }
-    if (opts?.includeFallback !== false) {
-      const fallback = this.fallbackResolver?.(providerId)?.trim();
-      if (fallback && fallback.length > 0) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "fallback",
-          detail: providerId,
-          apiKey: fallback
-        };
-      }
-    }
-    return {
-      providerId,
-      available: false,
-      credentialType: null,
-      source: "none",
-      detail: null
-    };
-  }
-  resolveForTarget(target, opts) {
-    const args = {};
-    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
-    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
-    if (target.targetId) args.targetId = target.targetId;
-    return this.resolveApiKey(target.providerId, args);
-  }
-  async login(providerId, callbacks) {
-    const credentials = await loginWithOAuthProvider(providerId, callbacks);
-    this.set(providerId, { type: "oauth", ...credentials, updatedAt: nowIso() });
-  }
-  logout(providerId) {
-    this.remove(providerId);
-  }
-  getOAuthProviders() {
-    return listOAuthProviders().map((provider) => ({ id: provider.id, name: provider.name })).sort((a, b) => a.id.localeCompare(b.id));
-  }
-};
-
-// src/domains/providers/auth/index.ts
-init_esm_shims();
-
-// src/domains/providers/auth/backend-file.ts
-init_esm_shims();
-import { chmodSync, closeSync as closeSync2, existsSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2 } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { dirname as dirname2, join as join2 } from "node:path";
-
-// src/core/state-file-lock.ts
-init_esm_shims();
-import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, utimesSync, writeSync } from "node:fs";
-import { hostname } from "node:os";
-import { dirname } from "node:path";
-var STALE_LOCK_MS = 3e4;
-var REFRESH_LOCK_MS = 5e3;
-var FILE_LOCK_ACQUIRE_TIMEOUT_MS = 2e4;
-function readLockOwner(lockPath) {
-  try {
-    const raw = readFileSync(lockPath, "utf8").trim();
-    const record = raw.startsWith("{") ? JSON.parse(raw) : { pid: Number.parseInt(raw, 10) };
-    const { host, pid, birthToken } = record;
-    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
-    return {
-      host: typeof host === "string" ? host : null,
-      pid,
-      birthToken: typeof birthToken === "string" ? birthToken : null
-    };
-  } catch {
-    return null;
-  }
-}
-function ownerIsAlive(owner) {
-  if (owner.host !== null && owner.host !== hostname()) return true;
-  if (!processAlive(owner.pid)) return false;
-  if (owner.birthToken === null) return true;
-  const current = processBirthToken(owner.pid);
-  return current === null || current === owner.birthToken;
-}
-function lockfileAgeMs(lockPath) {
-  try {
-    return Date.now() - statSync(lockPath).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function tryAcquire(lockPath) {
-  try {
-    const fd = openSync(lockPath, "wx", 384);
-    try {
-      writeSync(
-        fd,
-        `${JSON.stringify({ host: hostname(), pid: process.pid, birthToken: processBirthToken(), at: (/* @__PURE__ */ new Date()).toISOString() })}
-`
-      );
-    } finally {
-      closeSync(fd);
-    }
-    return true;
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
-  }
-  const owner = readLockOwner(lockPath);
-  const ageMs = lockfileAgeMs(lockPath);
-  const abandoned = owner !== null ? !ownerIsAlive(owner) : ageMs !== null && ageMs > STALE_LOCK_MS;
-  if (abandoned) {
-    try {
-      unlinkSync(lockPath);
-    } catch {
-    }
-  }
-  return false;
-}
-function timeoutError(lockPath, timeoutMs) {
-  return new Error(
-    `timed out after ${timeoutMs}ms waiting for ${lockPath} (owner pid=${readLockOwner(lockPath)?.pid ?? "?"}); delete it if no other clio process is running`
-  );
-}
-function backoffMs(attempt) {
-  return Math.min(100, 5 * 2 ** Math.min(attempt, 5));
-}
-function release(lockPath) {
-  const owner = readLockOwner(lockPath);
-  if (owner?.pid !== process.pid || owner.host !== null && owner.host !== hostname()) return;
-  try {
-    unlinkSync(lockPath);
-  } catch {
-  }
-}
-function startRefresh(lockPath) {
-  const timer = setInterval(() => {
-    const at = /* @__PURE__ */ new Date();
-    try {
-      utimesSync(lockPath, at, at);
-    } catch {
-    }
-  }, REFRESH_LOCK_MS);
-  timer.unref();
-  return () => clearInterval(timer);
-}
-function withStateFileLockSync(targetPath, fn, options = {}) {
-  const lockPath = `${targetPath}.lock`;
-  const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
-  let held = false;
-  try {
-    mkdirSync(dirname(lockPath), { recursive: true });
-    const deadlineMs = Date.now() + timeoutMs;
-    for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
-      if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, backoffMs(attempt));
-    }
-    held = true;
-  } catch (err) {
-    if (options.onAcquireFailure !== "run-unlocked") throw err;
-  }
-  try {
-    return fn();
-  } finally {
-    if (held) release(lockPath);
-  }
-}
-async function withStateFileLock(targetPath, fn, options = {}) {
-  const lockPath = `${targetPath}.lock`;
-  const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
-  let held = false;
-  try {
-    mkdirSync(dirname(lockPath), { recursive: true });
-    const deadlineMs = Date.now() + timeoutMs;
-    for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
-      if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
-      const base = backoffMs(attempt);
-      await new Promise((resolve2) => setTimeout(resolve2, base + Math.floor(Math.random() * base)));
-    }
-    held = true;
-  } catch (err) {
-    if (options.onAcquireFailure !== "run-unlocked") throw err;
-  }
-  const stopRefresh = held ? startRefresh(lockPath) : null;
-  try {
-    return await fn();
-  } finally {
-    stopRefresh?.();
-    if (held) release(lockPath);
-  }
-}
-
-// src/domains/providers/auth/backend-file.ts
-function atomicWriteSecret(absPath, contents) {
-  safeResourceWrite(absPath, contents, { encoding: "utf8", mode: 384 });
-  chmodSync(absPath, 384);
-}
-function authStoragePath() {
-  return join2(clioConfigDir(), "credentials.yaml");
-}
-var FileAuthStorageBackend = class {
-  constructor(path = authStoragePath()) {
-    this.path = path;
-  }
-  path;
-  describe() {
-    return this.path;
-  }
-  ensureParentDir() {
-    mkdirSync2(dirname2(this.path), { recursive: true, mode: 448 });
-  }
-  ensureFileExists() {
-    if (existsSync(this.path)) return;
-    const fd = openSync2(this.path, "a", 384);
-    closeSync2(fd);
-    chmodSync(this.path, 384);
-  }
-  withLock(fn) {
-    this.ensureParentDir();
-    this.ensureFileExists();
-    return withStateFileLockSync(this.path, () => {
-      const current = existsSync(this.path) ? readFileSync2(this.path, "utf8") : void 0;
-      const { result, next } = fn(current);
-      if (next !== void 0) {
-        atomicWriteSecret(this.path, next);
-      }
-      return result;
-    });
-  }
-  async withLockAsync(fn) {
-    this.ensureParentDir();
-    this.ensureFileExists();
-    return withStateFileLock(this.path, async () => {
-      const current = existsSync(this.path) ? await readFile(this.path, "utf8") : void 0;
-      const { result, next } = await fn(current);
-      if (next !== void 0) {
-        atomicWriteSecret(this.path, next);
-      }
-      return result;
-    });
-  }
-};
-
-// src/domains/providers/auth/backend-memory.ts
-init_esm_shims();
-
-// src/domains/providers/auth/index.ts
-function openAuthStorage(path) {
-  return new AuthStorage(new FileAuthStorageBackend(path));
-}
-
 export {
-  require_dist,
-  FILE_LOCK_ACQUIRE_TIMEOUT_MS,
-  withStateFileLockSync,
-  withStateFileLock,
-  expandConfigPath,
-  registerClioOAuthProviders,
-  authStoragePath,
-  resolveAuthTarget,
-  resolveRuntimeAuthTarget,
-  targetRequiresAuth,
-  authNotRequiredStatus,
-  openAuthStorage
+  require_dist
 };
-//# sourceMappingURL=chunk-GB6QRBXN.js.map
+//# sourceMappingURL=chunk-APJ265NV.js.map