@kodycodes/cli 1.12.1 → 1.13.1

package/README.md

@@ -64,6 +64,7 @@ Or run via `npx @kodycodes/cli` without a global install.
 | `kody logout` | Deletes stored CLI OAuth credentials and any stored bootstrap/API token. |
 | `kody status` | Shows CLI login / stored API token state without printing secrets. |
 | `kody auth bootstrap --code` | Redeems a one-shot `kody_bc_…` from MCP `cliCredentialBootstrap` and stores the resulting `kody_at_…` for `execute --local` (never prints the token). |
+| `kody auth bootstrap --scopes` | Opt-in extra scopes: mints the code itself by passing `scopes` to `cliCredentialBootstrap` (with `--token`, else the `kody login` session, else a stored token), then redeems and stores it. See [Opt-in scopes](#opt-in-scopes). |
 | `kody whoami` | Confirms the CLI MCP connection and lists tools. With a scoped API token (and no login), shows token identity via the Open API. |
 | `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). Token-only auth uses Open API `GET /v1/search`. |
 | `kody api <operationId>` | Thin Open API wrapper matching the MCP `api` tool: `operationId` + flat `--params` JSON. Auth: `--token` / `KODY_API_TOKEN` / stored `auth bootstrap` token. |
@@ -114,13 +115,40 @@ npx @kodycodes/cli api usageGet --params '{}'
   until then use bootstrap or a scoped `kody_at_…` token.
 - Wrong/expired token → 401 with a mint-fresh-token message (or the OAuth
   platform-gap message when the bearer is login OAuth).
-- Wrong scopes → the error includes `insufficient_scope` and the required
-  scope when Kody sends one.
+- Wrong scopes → the error names the missing scope and the exact command to
+  mint a token that adds it (see [Opt-in scopes](#opt-in-scopes)). When your
+  org role lacks the permission, it says so instead: a new token cannot add
+  it, and an org Owner has to grant it.
 - Account flag off → the error includes `feature_disabled` and the
   `local-execute` feature flag. Another token does not bypass that flag.
 - Prefer the env var so the token stays out of shell history and `ps`.
 - Never scavenge host MCP OAuth tokens from disk (ADR 0053).
 
+## Opt-in scopes
+
+Bootstrap tokens default to least-privilege local-execute scopes (no
+`package:write`, for example). Opt in to more when a task needs them:
+
+```bash
+# After `kody login` (mints any scope your org role grants):
+npx @kodycodes/cli auth bootstrap --lifetime short \
+  --scopes org:execute,org:read,package:execute,package:read,package:write
+
+# Agents on MCP without `kody login`: pass scopes when minting the code
+# cliCredentialBootstrap({ lifetime: "short", scopes: ["org:execute", "org:read", "package:execute", "package:read", "package:write"] })
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…' --lifetime short
+```
+
+- `--scopes` replaces the default list, so include every scope you need.
+- The CLI passes the list straight to `cliCredentialBootstrap`. It mints with
+  `--token` when given, else the `kody login` session, else `KODY_API_TOKEN` /
+  the stored token. A token can only mint scopes it already holds.
+- A bootstrap code's scopes are fixed when it is minted, so `--code` with
+  `--scopes` is an error that prints the matching `cliCredentialBootstrap`
+  call.
+- `insufficient_scope` errors print both commands with the full scope list
+  (your current scopes plus the missing one), so you can copy one and retry.
+
 ## Local execute
 
 `kody execute --local` runs the same execute module (default export called
@@ -177,9 +205,19 @@ npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.
   imports `kody:@…`, it also calls `POST /v1/local-execute/package-graph` to
   download stamped package modules for local embedding
   ([platform issue](https://github.com/kentcdodds/kody/issues/2808)).
+  CapabilityProxy requests use a dedicated HTTP agent that waits up to 7
+  minutes for headers and between body chunks. Origin's 5-minute deadline for
+  a `fetch` with `{{secret:…}}` placeholders ends that call first, with its own
+  error. Node's default 300-second limit no longer cuts it short. With
+  `NODE_USE_ENV_PROXY=1` or `--use-env-proxy`, these requests still honor
+  `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`, like Node's own fetch.
+  A PR preview's API host is `https://kody-pr-<n>-api.<subdomain>.workers.dev`;
+  the app origin (`kody-pr-<n>`) answers `/v1/*` with an HTML 404.
 - **Errors:** an expired/revoked token or an account without the
   `local-execute` flag fails fast with a clear message before any code runs.
   The token is only sent over https (plain http is allowed for localhost).
+  A non-JSON error body, such as an HTML page from the wrong `--api-url`, is
+  shortened to its title or a 200-character excerpt plus its size.
   Missing package-graph API, unresolved imports, or missing artifacts fail
   clearly — there is **no silent fallback** to cloud `kody.execute`.
 - **Lifetime:** no execution time limit locally; Ctrl-C (or SIGTERM) stops

package/dist/api-token.d.ts

@@ -48,10 +48,22 @@ export declare function missingLocalExecuteAuthMessage(purpose?: string): string
 export declare function missingCliAuthMessage(): string;
 /** 401 when CapabilityProxy rejected a non-`kody_at_` bearer (typically CLI OAuth). */
 export declare function rejectedOauthBearerMessage(): string;
-export declare function insufficientScopeMessage(input: {
-    requiredScope?: string | null;
-    /** CapabilityProxy / package-graph: prefer bootstrap over tokenCreate. */
-    includeLocalExecute?: boolean;
+/** What an `insufficient_scope` error body says about the missing scope. */
+export type InsufficientScopeDetails = {
+    requiredScope: string | null;
+    /** Full scope list for a replacement token (the caller's scopes plus the missing one). */
+    mintScopes: Array<string> | null;
+    /** Platform denial code, e.g. `credential_scope` or `missing_permission`. */
+    denial: string | null;
+};
+export declare function readInsufficientScopeDetails(body: unknown): InsufficientScopeDetails;
+/** `npx @kodycodes/cli auth bootstrap --lifetime short --scopes a,b` */
+export declare function cliBootstrapScopesCommand(scopes: ReadonlyArray<string>, lifetimeFlags?: string): string;
+/** `cliCredentialBootstrap({ lifetime: "short", scopes: ["a", "b"] })` */
+export declare function cliBootstrapMintCall(scopes: ReadonlyArray<string>, lifetime?: Record<string, string | number>): string;
+export declare function insufficientScopeMessage(input: Partial<InsufficientScopeDetails> & {
+    /** Scopes the CLI already knows the current token holds. */
+    currentScopes?: ReadonlyArray<string> | null;
 }): string;
 export declare function featureDisabledMessage(): string;
 export declare function requireApiToken(values?: {

package/dist/api-token.js

@@ -110,14 +110,66 @@ export function missingCliAuthMessage() {
 export function rejectedOauthBearerMessage() {
     return `Kody rejected the bearer from \`kody login\`: the Open API still accepts only scoped \`kody_at_…\` API tokens on CapabilityProxy / package-graph (not MCP OAuth). See ${localExecuteOauthPlatformIssueUrl}. Until that lands, ${apiTokenMintInstructions()}`;
 }
+export function readInsufficientScopeDetails(body) {
+    const details = isRecord(body) && isRecord(body.error) && isRecord(body.error.details)
+        ? body.error.details
+        : null;
+    if (!details)
+        return { requiredScope: null, mintScopes: null, denial: null };
+    const requiredScope = readNonEmptyString(details.required_scope) ??
+        readNonEmptyString(details.required_permission) ??
+        readStringList(details.required_scopes)?.join(', ') ??
+        null;
+    return {
+        requiredScope,
+        mintScopes: readStringList(details.mint_scopes),
+        denial: readNonEmptyString(details.denial),
+    };
+}
+/** `npx @kodycodes/cli auth bootstrap --lifetime short --scopes a,b` */
+export function cliBootstrapScopesCommand(scopes, lifetimeFlags = '--lifetime short') {
+    return `npx @kodycodes/cli auth bootstrap ${lifetimeFlags} --scopes ${scopes.join(',')}`;
+}
+/** `cliCredentialBootstrap({ lifetime: "short", scopes: ["a", "b"] })` */
+export function cliBootstrapMintCall(scopes, lifetime = { lifetime: 'short' }) {
+    const fields = [
+        ...Object.entries(lifetime).map(([key, value]) => `${key}: ${JSON.stringify(value)}`),
+        `scopes: [${scopes.map((scope) => JSON.stringify(scope)).join(', ')}]`,
+    ];
+    return `cliCredentialBootstrap({ ${fields.join(', ')} })`;
+}
 export function insufficientScopeMessage(input) {
-    const required = input.requiredScope ? ` The server requires "${input.requiredScope}".` : '';
-    const mint = input.includeLocalExecute
-        ? `${cliBootstrapInstructions()} (lifetime short|long). ${apiTokenMintInstructions()}`
-        : `${cliBootstrapInstructions()} (lifetime short|long). Or for CI/headless, mint with tokenCreate${input.requiredScope
-            ? ` that includes "${input.requiredScope}"`
-            : ' that includes the required scope'}, then pass --token or set ${apiTokenEnvVar}.`;
-    return `Kody returned insufficient_scope.${required} ${mint}`;
+    const required = input.requiredScope ?? null;
+    if (input.denial === 'missing_permission') {
+        return `Kody returned insufficient_scope: your org role does not grant ${required ? `"${required}"` : 'the required permission'}. A new token cannot add it; an org Owner can grant it.`;
+    }
+    if (!required) {
+        return `Kody returned insufficient_scope. Mint a token that includes the missing scope: run \`${cliBootstrapScopesCommand(['<scope>', '…'])}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(['<scope>', '…'])}\` and run its cli_command. Scopes replace the defaults, so list every scope you need. For CI/headless, mint with tokenCreate and pass --token or set ${apiTokenEnvVar}.`;
+    }
+    const mintScopes = input.mintScopes && input.mintScopes.length > 0
+        ? input.mintScopes
+        : input.currentScopes && input.currentScopes.length > 0
+            ? [...new Set([...input.currentScopes, ...required.split(/,\s*/)])].sort()
+            : null;
+    if (!mintScopes) {
+        return `Kody returned insufficient_scope: this token is missing "${required}". Mint a token whose scopes include "${required}" plus the ones you already use (scopes replace the defaults): run \`${cliBootstrapScopesCommand(['<current scopes>', required])}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(['<current scopes>', required])}\` and run its cli_command. For CI/headless, mint with tokenCreate including "${required}" and pass --token or set ${apiTokenEnvVar}.`;
+    }
+    return `Kody returned insufficient_scope: this token is missing "${required}". Mint one that includes it: run \`${cliBootstrapScopesCommand(mintScopes)}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(mintScopes)}\` and run its cli_command. For CI/headless, mint with tokenCreate using those scopes and pass --token or set ${apiTokenEnvVar}.`;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function readNonEmptyString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+function readStringList(value) {
+    if (!Array.isArray(value))
+        return null;
+    const list = value
+        .filter((item) => typeof item === 'string')
+        .map((item) => item.trim())
+        .filter(Boolean);
+    return list.length > 0 ? list : null;
 }
 export function featureDisabledMessage() {
     return 'Kody returned feature_disabled: CapabilityProxy is not enabled for this Kody account (feature flag `local-execute`). `execute --local` and token-auth cloud execute both stop here; minting another token does not bypass the flag. Browser `kody login` can still run cloud execute over MCP.';

package/dist/api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EACN,cAAc,EACd,aAAa,EACb,aAAa,GACb,MAAM,eAAe,CAAA;AAGtB,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC7C,gDAAgD,CAAA;AAYjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzE,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC7C,OAAO,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC7B,SAAiB,aAAa,EAC9B,SAAiB,aAAa;IAE9B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACnE,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;QACpC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChD,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACxE,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1D,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1D,IAAI,eAAe,IAAI,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAA;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,CACN,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YACrC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7D,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CACtC,CAAA;IACF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAA;IACtC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,uBAAuB,CAAA;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9B,OAAO,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACrC,CAAC;IACD,OAAO,eAAe,QAAQ,EAAE,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAA;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAA;AACvF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,8NAA8N,cAAc,GAAG,CAAA;AACvP,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB;IACvC,OAAO,+KAA+K,CAAA;AACvL,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,QAAQ,wBAAwB,EAAE,EAAE,CAAA;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC7C,UAAkB,iBAAiB;IAEnC,OAAO,GAAG,OAAO,gBAAgB,wBAAwB,EAAE,gDAAgD,wBAAwB,EAAE,EAAE,CAAA;AACxI,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,wIAAwI,wBAAwB,EAAE,EAAE,CAAA;AACjP,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACzC,OAAO,yKAAyK,iCAAiC,uBAAuB,wBAAwB,EAAE,EAAE,CAAA;AACrQ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB;QACrC,CAAC,CAAC,GAAG,wBAAwB,EAAE,2BAA2B,wBAAwB,EAAE,EAAE;QACtF,CAAC,CAAC,GAAG,wBAAwB,EAAE,oEAC7B,KAAK,CAAC,aAAa;YAClB,CAAC,CAAC,mBAAmB,KAAK,CAAC,aAAa,GAAG;YAC3C,CAAC,CAAC,mCACJ,8BAA8B,cAAc,GAAG,CAAA;IACjD,OAAO,oCAAoC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc,EAChC,UAAmE,EAAE;IAErE,MAAM,KAAK,GAAG,qBAAqB,CAAC;QACnC,WAAW,EAAE,MAAM;QACnB,GAAG;QACH,GAAG,OAAO;KACV,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EACN,cAAc,EACd,aAAa,EACb,aAAa,GACb,MAAM,eAAe,CAAA;AAGtB,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC7C,gDAAgD,CAAA;AAYjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzE,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC7C,OAAO,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC7B,SAAiB,aAAa,EAC9B,SAAiB,aAAa;IAE9B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACnE,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;QACpC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChD,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACxE,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1D,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1D,IAAI,eAAe,IAAI,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAA;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,CACN,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YACrC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7D,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CACtC,CAAA;IACF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAA;IACtC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,uBAAuB,CAAA;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9B,OAAO,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACrC,CAAC;IACD,OAAO,eAAe,QAAQ,EAAE,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAA;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAA;AACvF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,8NAA8N,cAAc,GAAG,CAAA;AACvP,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB;IACvC,OAAO,+KAA+K,CAAA;AACvL,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,QAAQ,wBAAwB,EAAE,EAAE,CAAA;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC7C,UAAkB,iBAAiB;IAEnC,OAAO,GAAG,OAAO,gBAAgB,wBAAwB,EAAE,gDAAgD,wBAAwB,EAAE,EAAE,CAAA;AACxI,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,wIAAwI,wBAAwB,EAAE,EAAE,CAAA;AACjP,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACzC,OAAO,yKAAyK,iCAAiC,uBAAuB,wBAAwB,EAAE,EAAE,CAAA;AACrQ,CAAC;AAWD,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACzD,MAAM,OAAO,GACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;QACpB,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC5E,MAAM,aAAa,GAClB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC1C,kBAAkB,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAC/C,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,CAAA;IACL,OAAO;QACN,aAAa;QACb,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;QAC/C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,yBAAyB,CACxC,MAA6B,EAC7B,gBAAwB,kBAAkB;IAE1C,OAAO,qCAAqC,aAAa,aAAa,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACzF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CACnC,MAA6B,EAC7B,WAA4C,EAAE,QAAQ,EAAE,OAAO,EAAE;IAEjE,MAAM,MAAM,GAAG;QACd,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACtE,CAAA;IACD,OAAO,4BAA4B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,KAGC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAA;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,kEACN,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,yBAC9B,yDAAyD,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,yFAAyF,yBAAyB,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,oDAAoD,oBAAoB,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,yJAAyJ,cAAc,GAAG,CAAA;IAChZ,CAAC;IACD,MAAM,UAAU,GACf,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACtD,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAA;IACT,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,4DAA4D,QAAQ,yCAAyC,QAAQ,wEAAwE,yBAAyB,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,oDAAoD,oBAAoB,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,iFAAiF,QAAQ,6BAA6B,cAAc,GAAG,CAAA;IAC7e,CAAC;IACD,OAAO,4DAA4D,QAAQ,uCAAuC,yBAAyB,CAAC,UAAU,CAAC,oDAAoD,oBAAoB,CAAC,UAAU,CAAC,iHAAiH,cAAc,GAAG,CAAA;AAC9W,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,IAAI,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;IACjB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc,EAChC,UAAmE,EAAE;IAErE,MAAM,KAAK,GAAG,qBAAqB,CAAC;QACnC,WAAW,EAAE,MAAM;QACnB,GAAG;QACH,GAAG,OAAO;KACV,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}

package/dist/auth-bootstrap.d.ts

@@ -81,16 +81,35 @@ export declare function resolveCliTokenLifetime(input: {
 export declare function bootstrapRedeemRequestBody(code: string, lifetime: ResolvedCliTokenLifetime): BootstrapRedeemRequestBody;
 /** Parse a CLI `--idle-ttl-seconds` / `--max-lifetime-seconds` string flag. */
 export declare function parseCliLifetimeSecondsFlag(raw: string | undefined, flag: '--idle-ttl-seconds' | '--max-lifetime-seconds'): number | undefined;
+/**
+ * Lifetime for redeem after a successful mint. Trusts the server's clamped
+ * idle/max seconds (may be below CLI flag mins, or max below the requested
+ * idle). Only coerces idle down when max < idle so the pair stays consistent.
+ */
+export declare function resolveMintedRedeemLifetime(minted: {
+    idle_ttl_seconds: number;
+    max_lifetime_seconds: number;
+}): Extract<ResolvedCliTokenLifetime, {
+    kind: 'explicit';
+}>;
 /**
  * POST /v1/tokens/bootstrap/redeem with JSON `{ code, lifetime }` or
  * `{ code, idle_ttl_seconds, max_lifetime_seconds }` and **no** Authorization
  * header (ADR 0056). Returns the minted `kody_at_…` once.
+ *
+ * Pass `trustedMintLifetime` after cliCredentialBootstrap so server-clamped
+ * seconds are redeemed without re-applying CLI flag mins (max may be below
+ * the requested idle or below `--idle-ttl-seconds` minimum).
  */
 export declare function redeemBootstrapCode(input: {
     code: string;
     lifetime?: string | null;
     idleTtlSeconds?: number;
     maxLifetimeSeconds?: number;
+    trustedMintLifetime?: {
+        idle_ttl_seconds: number;
+        max_lifetime_seconds: number;
+    };
     apiUrl?: string;
     fetchFn?: typeof fetch;
 }): Promise<BootstrapRedeemResponse>;
@@ -117,3 +136,35 @@ export declare function authBootstrap(input: {
     backendKind: SecretBackend['kind'];
     backendPath?: string;
 }>;
+export declare const cliCredentialBootstrapOperationId = "cliCredentialBootstrap";
+export type BootstrapMintResponse = {
+    bootstrap_code: string;
+    scopes: Array<string>;
+    idle_ttl_seconds: number;
+    max_lifetime_seconds: number;
+};
+/**
+ * Parse `--scopes`. Comma- or space-separated, deduped, order kept. The list
+ * replaces cliCredentialBootstrap's default scopes; the server validates names.
+ */
+export declare function parseCliScopesFlag(raw: string | undefined): Array<string> | undefined;
+/** cliCredentialBootstrap params for an explicit scope list and lifetime. */
+export declare function bootstrapMintParams(scopes: ReadonlyArray<string>, lifetime: ResolvedCliTokenLifetime): Record<string, unknown>;
+export declare function bootstrapMintLifetimeFields(lifetime: ResolvedCliTokenLifetime): Record<string, string | number>;
+export declare function parseBootstrapMintResponse(body: unknown): BootstrapMintResponse;
+/**
+ * Mint a bootstrap code with explicit `scopes` through the caller's current
+ * Kody credential, then redeem and store it like `authBootstrap`. Redeems with
+ * the minted idle/max seconds because the server may clamp the max lifetime to
+ * a parent API token's remaining lifetime — those values must not be
+ * re-validated as CLI lifetime flags (which would burn the one-shot code).
+ */
+export declare function authBootstrapWithScopes(input: {
+    scopes: ReadonlyArray<string>;
+    lifetime: ResolvedCliTokenLifetime;
+    mint: (params: Record<string, unknown>) => Promise<unknown>;
+    apiUrl?: string;
+    fetchFn?: typeof fetch;
+    backend?: SecretBackend;
+    resolution?: StoreResolution;
+}): Promise<Awaited<ReturnType<typeof authBootstrap>>>;

package/dist/auth-bootstrap.js

@@ -1,5 +1,6 @@
 import { assertTokenSafeApiUrl, capabilityProxyUrl } from './capability-proxy.js';
 import { cliName, defaultApiUrl } from './defaults.js';
+import { summarizeNonJsonErrorBody } from './http-error-body.js';
 import { describeNetworkError } from './network-error.js';
 import { readPackageVersion } from './package-info.js';
 import { saveStoredApiToken, } from './api-token-store.js';
@@ -124,18 +125,38 @@ export function parseCliLifetimeSecondsFlag(raw, flag) {
     }
     return Number(trimmed);
 }
+/**
+ * Lifetime for redeem after a successful mint. Trusts the server's clamped
+ * idle/max seconds (may be below CLI flag mins, or max below the requested
+ * idle). Only coerces idle down when max < idle so the pair stays consistent.
+ */
+export function resolveMintedRedeemLifetime(minted) {
+    const maxLifetimeSeconds = minted.max_lifetime_seconds;
+    const idleTtlSeconds = Math.min(minted.idle_ttl_seconds, maxLifetimeSeconds);
+    return {
+        kind: 'explicit',
+        idleTtlSeconds,
+        maxLifetimeSeconds,
+    };
+}
 /**
  * POST /v1/tokens/bootstrap/redeem with JSON `{ code, lifetime }` or
  * `{ code, idle_ttl_seconds, max_lifetime_seconds }` and **no** Authorization
  * header (ADR 0056). Returns the minted `kody_at_…` once.
+ *
+ * Pass `trustedMintLifetime` after cliCredentialBootstrap so server-clamped
+ * seconds are redeemed without re-applying CLI flag mins (max may be below
+ * the requested idle or below `--idle-ttl-seconds` minimum).
  */
 export async function redeemBootstrapCode(input) {
     const code = assertCliBootstrapCode(input.code);
-    const lifetime = resolveCliTokenLifetime({
-        lifetime: input.lifetime,
-        idleTtlSeconds: input.idleTtlSeconds,
-        maxLifetimeSeconds: input.maxLifetimeSeconds,
-    });
+    const lifetime = input.trustedMintLifetime
+        ? resolveMintedRedeemLifetime(input.trustedMintLifetime)
+        : resolveCliTokenLifetime({
+            lifetime: input.lifetime,
+            idleTtlSeconds: input.idleTtlSeconds,
+            maxLifetimeSeconds: input.maxLifetimeSeconds,
+        });
     const apiUrl = input.apiUrl || defaultApiUrl;
     assertTokenSafeApiUrl(apiUrl);
     const url = capabilityProxyUrl(apiUrl, bootstrapRedeemPath);
@@ -202,6 +223,83 @@ export async function authBootstrap(input) {
         ...(saved.backend.path ? { backendPath: saved.backend.path } : {}),
     };
 }
+export const cliCredentialBootstrapOperationId = 'cliCredentialBootstrap';
+/**
+ * Parse `--scopes`. Comma- or space-separated, deduped, order kept. The list
+ * replaces cliCredentialBootstrap's default scopes; the server validates names.
+ */
+export function parseCliScopesFlag(raw) {
+    if (raw === undefined)
+        return undefined;
+    const scopes = [
+        ...new Set(raw
+            .split(/[\s,]+/)
+            .map((scope) => scope.trim())
+            .filter(Boolean)),
+    ];
+    if (scopes.length === 0) {
+        throw new Error('--scopes needs at least one scope (e.g. --scopes org:execute,package:write).');
+    }
+    return scopes;
+}
+/** cliCredentialBootstrap params for an explicit scope list and lifetime. */
+export function bootstrapMintParams(scopes, lifetime) {
+    return {
+        scopes: [...scopes],
+        ...bootstrapMintLifetimeFields(lifetime),
+    };
+}
+export function bootstrapMintLifetimeFields(lifetime) {
+    return lifetime.kind === 'alias'
+        ? { lifetime: lifetime.lifetime }
+        : {
+            idle_ttl_seconds: lifetime.idleTtlSeconds,
+            max_lifetime_seconds: lifetime.maxLifetimeSeconds,
+        };
+}
+export function parseBootstrapMintResponse(body) {
+    if (!isRecord(body) ||
+        typeof body.bootstrap_code !== 'string' ||
+        typeof body.idle_ttl_seconds !== 'number' ||
+        typeof body.max_lifetime_seconds !== 'number') {
+        throw new Error('cliCredentialBootstrap returned an unexpected response.');
+    }
+    return {
+        bootstrap_code: body.bootstrap_code,
+        scopes: Array.isArray(body.scopes)
+            ? body.scopes.filter((scope) => typeof scope === 'string')
+            : [],
+        idle_ttl_seconds: body.idle_ttl_seconds,
+        max_lifetime_seconds: body.max_lifetime_seconds,
+    };
+}
+/**
+ * Mint a bootstrap code with explicit `scopes` through the caller's current
+ * Kody credential, then redeem and store it like `authBootstrap`. Redeems with
+ * the minted idle/max seconds because the server may clamp the max lifetime to
+ * a parent API token's remaining lifetime — those values must not be
+ * re-validated as CLI lifetime flags (which would burn the one-shot code).
+ */
+export async function authBootstrapWithScopes(input) {
+    const minted = parseBootstrapMintResponse(await input.mint(bootstrapMintParams(input.scopes, input.lifetime)));
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    const redeemed = await redeemBootstrapCode({
+        code: minted.bootstrap_code,
+        trustedMintLifetime: {
+            idle_ttl_seconds: minted.idle_ttl_seconds,
+            max_lifetime_seconds: minted.max_lifetime_seconds,
+        },
+        apiUrl,
+        fetchFn: input.fetchFn,
+    });
+    const stored = storedApiTokenFromRedeem({ apiUrl, redeemed });
+    const saved = saveStoredApiToken(stored, input.backend, input.resolution);
+    return {
+        stored,
+        backendKind: saved.backend.kind,
+        ...(saved.backend.path ? { backendPath: saved.backend.path } : {}),
+    };
+}
 function readRequiredInteger(input) {
     if (!Number.isInteger(input.value) ||
         input.value < input.min ||
@@ -251,8 +349,9 @@ async function readJson(response) {
 }
 function readErrorBody(body) {
     if (!isRecord(body) || body.error == null) {
-        if (typeof body === 'string' && body.trim())
-            return { code: null, message: body };
+        if (typeof body === 'string' && body.trim()) {
+            return { code: null, message: summarizeNonJsonErrorBody(body) };
+        }
         if (isRecord(body) && typeof body.message === 'string') {
             return { code: null, message: body.message };
         }

package/dist/auth-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-bootstrap.js","sourceRoot":"","sources":["../src/auth-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EACN,kBAAkB,GAElB,MAAM,sBAAsB,CAAA;AAG7B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAA;AAEhD,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,iBAAiB,EAAE,EAAE;IACrB,oCAAoC;IACpC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACpC,0CAA0C;IAC1C,qBAAqB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;CAC/B,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,KAAK,EAAE;QACN,cAAc,EAAE,EAAE,GAAG,EAAE;QACvB,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;KAChC;IACD,IAAI,EAAE;QACL,cAAc,EAAE,sBAAsB,CAAC,iBAAiB;QACxD,kBAAkB,EAAE,sBAAsB,CAAC,qBAAqB;KAChE;CACQ,CAAA;AA2CV,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,+CAA+C,sBAAsB,wEAAwE,CAC7I,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,4BAA4B;IAC3C,OAAO,CACN,kEAAkE;QAClE,wDAAwD;QACxD,SAAS,sBAAsB,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,iBAAiB,KAAK;QAClG,iBAAiB,sBAAsB,CAAC,qBAAqB,MAAM;QACnE,iDAAiD,CACjD,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACA,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAA;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAA;IAErD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,oGAAoG,CACpG,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,QAAQ,IAAI,uBAAuB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACd,yCAAyC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CACrE,CAAA;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,QAAiC,CAAA;QAClD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QAClD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,QAAQ;YACR,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAC/C,CAAA;IACF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,MAAM,cAAc,GAAG,mBAAmB,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,cAAe;QAC5B,GAAG,EAAE,sBAAsB,CAAC,iBAAiB;QAC7C,GAAG,EAAE,sBAAsB,CAAC,iBAAiB;QAC7C,KAAK,EAAE,oBAAoB;KAC3B,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;QAC9C,KAAK,EAAE,KAAK,CAAC,kBAAmB;QAChC,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,sBAAsB,CAAC,qBAAqB;QACjD,KAAK,EAAE,wBAAwB;KAC/B,CAAC,CAAA;IACF,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,cAAc;QACd,kBAAkB;KAClB,CAAA;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACzC,IAAY,EACZ,QAAkC;IAElC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAA;IAC7C,CAAC;IACD,OAAO;QACN,IAAI;QACJ,gBAAgB,EAAE,QAAQ,CAAC,cAAc;QACzC,oBAAoB,EAAE,QAAQ,CAAC,kBAAkB;KACjD,CAAA;AACF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,GAAuB,EACvB,IAAqD;IAErD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACA,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC5C,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;SAChE,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,KAAK,CACd,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IACjF,CAAC;IACD,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC5C,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI;QACnD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;KACzD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KASnC;IAKA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACzE,OAAO;QACN,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAK5B;IACA,IACC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG;QACvB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,EACtB,CAAC;QACF,MAAM,IAAI,KAAK,CACd,GAAG,KAAK,CAAC,KAAK,+BAA+B,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,GAAG,CAC1E,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACN,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC3E,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACjE,gBAAgB,EACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC9E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACxE,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACpF,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAa,EAAE,GAAQ;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1E,OAAO,IAAI,KAAK,CACf,iCAAiC,MAAM,4GAA4G,MAAM,EAAE,CAC3J,CAAA;IACF,CAAC;IACD,OAAO,IAAI,KAAK,CACf,OAAO,EAAE,OAAO;QACf,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAC1E,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"auth-bootstrap.js","sourceRoot":"","sources":["../src/auth-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EACN,kBAAkB,GAElB,MAAM,sBAAsB,CAAA;AAG7B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAA;AAEhD,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,iBAAiB,EAAE,EAAE;IACrB,oCAAoC;IACpC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACpC,0CAA0C;IAC1C,qBAAqB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;CAC/B,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,KAAK,EAAE;QACN,cAAc,EAAE,EAAE,GAAG,EAAE;QACvB,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;KAChC;IACD,IAAI,EAAE;QACL,cAAc,EAAE,sBAAsB,CAAC,iBAAiB;QACxD,kBAAkB,EAAE,sBAAsB,CAAC,qBAAqB;KAChE;CACQ,CAAA;AA2CV,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,+CAA+C,sBAAsB,wEAAwE,CAC7I,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,4BAA4B;IAC3C,OAAO,CACN,kEAAkE;QAClE,wDAAwD;QACxD,SAAS,sBAAsB,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,iBAAiB,KAAK;QAClG,iBAAiB,sBAAsB,CAAC,qBAAqB,MAAM;QACnE,iDAAiD,CACjD,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACA,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAA;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAA;IAErD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,oGAAoG,CACpG,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,QAAQ,IAAI,uBAAuB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACd,yCAAyC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CACrE,CAAA;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,QAAiC,CAAA;QAClD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QAClD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,QAAQ;YACR,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAC/C,CAAA;IACF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,MAAM,cAAc,GAAG,mBAAmB,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,cAAe;QAC5B,GAAG,EAAE,sBAAsB,CAAC,iBAAiB;QAC7C,GAAG,EAAE,sBAAsB,CAAC,iBAAiB;QAC7C,KAAK,EAAE,oBAAoB;KAC3B,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;QAC9C,KAAK,EAAE,KAAK,CAAC,kBAAmB;QAChC,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,sBAAsB,CAAC,qBAAqB;QACjD,KAAK,EAAE,wBAAwB;KAC/B,CAAC,CAAA;IACF,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,cAAc;QACd,kBAAkB;KAClB,CAAA;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACzC,IAAY,EACZ,QAAkC;IAElC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAA;IAC7C,CAAC;IACD,OAAO;QACN,IAAI;QACJ,gBAAgB,EAAE,QAAQ,CAAC,cAAc;QACzC,oBAAoB,EAAE,QAAQ,CAAC,kBAAkB;KACjD,CAAA;AACF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,GAAuB,EACvB,IAAqD;IAErD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAG3C;IACA,MAAM,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAA;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAC5E,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,cAAc;QACd,kBAAkB;KAClB,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAWzC;IACA,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,mBAAmB;QACzC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACxD,CAAC,CAAC,uBAAuB,CAAC;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC5C,CAAC,CAAA;IACJ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;SAChE,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,KAAK,CACd,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IACjF,CAAC;IACD,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC5C,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI;QACnD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;KACzD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KASnC;IAKA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACzE,OAAO;QACN,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAA;AASzE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,MAAM,GAAG;QACd,GAAG,IAAI,GAAG,CACT,GAAG;aACD,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CACjB;KACD,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAClC,MAA6B,EAC7B,QAAkC;IAElC,OAAO;QACN,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;QACnB,GAAG,2BAA2B,CAAC,QAAQ,CAAC;KACxC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,QAAkC;IAElC,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,CAAC,CAAC;YACA,gBAAgB,EAAE,QAAQ,CAAC,cAAc;YACzC,oBAAoB,EAAE,QAAQ,CAAC,kBAAkB;SACjD,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACvD,IACC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;QACvC,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QACzC,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ,EAC5C,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO;QACN,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC3E,CAAC,CAAC,EAAE;QACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAC/C,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAQ7C;IACA,MAAM,MAAM,GAAG,0BAA0B,CACxC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CACnE,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QAC1C,IAAI,EAAE,MAAM,CAAC,cAAc;QAC3B,mBAAmB,EAAE;YACpB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;SACjD;QACD,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACzE,OAAO;QACN,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAK5B;IACA,IACC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG;QACvB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,EACtB,CAAC;QACF,MAAM,IAAI,KAAK,CACd,GAAG,KAAK,CAAC,KAAK,+BAA+B,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,GAAG,CAC1E,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACN,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC3E,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACjE,gBAAgB,EACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC9E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACxE,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACpF,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAa,EAAE,GAAQ;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1E,OAAO,IAAI,KAAK,CACf,iCAAiC,MAAM,4GAA4G,MAAM,EAAE,CAC3J,CAAA;IACF,CAAC;IACD,OAAO,IAAI,KAAK,CACf,OAAO,EAAE,OAAO;QACf,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAC1E,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAA;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/capability-proxy.d.ts

@@ -1,3 +1,4 @@
+import { type Dispatcher } from 'undici';
 /**
  * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
  * runs user code in workerd and forwards every `kody:runtime` call here with
@@ -17,6 +18,26 @@
  */
 export declare const capabilityProxySessionPath = "v1/capability-proxy/session";
 export declare const capabilityProxyCallPath = "v1/capability-proxy/call";
+/**
+ * Origin runs a placeholder `fetch` under a 5-minute deadline that starts only
+ * after quota checks and placeholder fill, buffers the whole upstream body,
+ * and sends headers once that body has ended. Node's global fetch gives up
+ * after 300s without headers (undici `headersTimeout`), which would cut the
+ * call before the gateway's own deadline fires, so CapabilityProxy requests
+ * use a dedicated undici Agent that waits longer than the deadline plus
+ * origin overhead.
+ */
+export declare const capabilityProxyGatewayDeadlineMs: number;
+export declare const capabilityProxyHttpTimeoutMs: number;
+/**
+ * Node routes global fetch through `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`
+ * only when `NODE_USE_ENV_PROXY=1` or `--use-env-proxy` is set. A dispatcher
+ * passed to fetch replaces that global proxy agent, so mirror the same opt-in.
+ */
+export declare function nodeUsesEnvProxy(env?: NodeJS.ProcessEnv, execArgv?: ReadonlyArray<string>): boolean;
+export declare function createCapabilityProxyAgent(timeoutMs?: number, options?: {
+    useEnvProxy?: boolean;
+}): Dispatcher;
 export type CapabilityProxySession = {
     scopes: Array<string>;
     expiresAt: string | null;
@@ -31,6 +52,8 @@ export type CapabilityProxyClientInput = {
     token: string;
     fetchFn?: typeof fetch;
     signal?: AbortSignal;
+    /** Defaults to the shared Agent from `createCapabilityProxyAgent()`. */
+    dispatcher?: Dispatcher;
 };
 export declare class CapabilityProxyError extends Error {
     readonly status: number | null;

package/dist/capability-proxy.js

@@ -1,4 +1,5 @@
-import { apiTokenMintInstructions, cliBootstrapInstructions, featureDisabledMessage, insufficientScopeMessage, isScopedApiToken, rejectedOauthBearerMessage, } from './api-token.js';
+import { Agent, EnvHttpProxyAgent } from 'undici';
+import { apiTokenMintInstructions, cliBootstrapInstructions, featureDisabledMessage, insufficientScopeMessage, readInsufficientScopeDetails, isScopedApiToken, rejectedOauthBearerMessage, } from './api-token.js';
 import { apiTokenEnvVar, cliName } from './defaults.js';
 import { describeNetworkError } from './network-error.js';
 import { readPackageVersion } from './package-info.js';
@@ -21,6 +22,39 @@ import { readPackageVersion } from './package-info.js';
  */
 export const capabilityProxySessionPath = 'v1/capability-proxy/session';
 export const capabilityProxyCallPath = 'v1/capability-proxy/call';
+/**
+ * Origin runs a placeholder `fetch` under a 5-minute deadline that starts only
+ * after quota checks and placeholder fill, buffers the whole upstream body,
+ * and sends headers once that body has ended. Node's global fetch gives up
+ * after 300s without headers (undici `headersTimeout`), which would cut the
+ * call before the gateway's own deadline fires, so CapabilityProxy requests
+ * use a dedicated undici Agent that waits longer than the deadline plus
+ * origin overhead.
+ */
+export const capabilityProxyGatewayDeadlineMs = 5 * 60_000;
+export const capabilityProxyHttpTimeoutMs = 7 * 60_000;
+/**
+ * Node routes global fetch through `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`
+ * only when `NODE_USE_ENV_PROXY=1` or `--use-env-proxy` is set. A dispatcher
+ * passed to fetch replaces that global proxy agent, so mirror the same opt-in.
+ */
+export function nodeUsesEnvProxy(env = process.env, execArgv = process.execArgv) {
+    if (env.NODE_USE_ENV_PROXY === '1')
+        return true;
+    const flags = [...execArgv, ...(env.NODE_OPTIONS ?? '').split(/\s+/)];
+    return flags.includes('--use-env-proxy');
+}
+export function createCapabilityProxyAgent(timeoutMs = capabilityProxyHttpTimeoutMs, options = {}) {
+    const timeouts = { headersTimeout: timeoutMs, bodyTimeout: timeoutMs };
+    return (options.useEnvProxy ?? nodeUsesEnvProxy())
+        ? new EnvHttpProxyAgent(timeouts)
+        : new Agent(timeouts);
+}
+let defaultCapabilityProxyAgent = null;
+function capabilityProxyAgent() {
+    defaultCapabilityProxyAgent ??= createCapabilityProxyAgent();
+    return defaultCapabilityProxyAgent;
+}
 export class CapabilityProxyError extends Error {
     status;
     code;
@@ -88,9 +122,12 @@ export async function callCapabilityProxy(input) {
 }
 async function send(input, url, init) {
     const fetchFn = input.fetchFn ?? fetch;
+    // Global fetch on Node 22+ (bundled undici 6–8) accepts undici 7 dispatchers.
+    const dispatcherInit = { dispatcher: input.dispatcher ?? capabilityProxyAgent() };
     try {
         return await fetchFn(url, {
             ...init,
+            ...dispatcherInit,
             signal: input.signal,
             headers: {
                 ...init.headers,
@@ -143,10 +180,7 @@ function describeFailure(status, body, url, stage, token) {
         return new CapabilityProxyError(`${featureDisabledMessage()}${detail}`, { status, code });
     }
     if (code === 'insufficient_scope') {
-        return new CapabilityProxyError(`${insufficientScopeMessage({
-            requiredScope: requiredScopeFrom(body),
-            includeLocalExecute: true,
-        })}${detail}`, { status, code });
+        return new CapabilityProxyError(`${insufficientScopeMessage(readInsufficientScopeDetails(body))}${detail}`, { status, code });
     }
     if (status === 403 && stage === 'session') {
         return new CapabilityProxyError(`The API token is not allowed to use CapabilityProxy${code ? ` (${code})` : ''}. ${cliBootstrapInstructions()} (lifetime short|long). ${apiTokenMintInstructions()}${detail}`, { status, code });
@@ -156,18 +190,6 @@ function describeFailure(status, body, url, stage, token) {
     }
     return new CapabilityProxyError(failure?.message ?? `Kody API request failed with HTTP ${status} (${url.pathname}).`, { status, code });
 }
-function requiredScopeFrom(body) {
-    if (!isRecord(body) || !isRecord(body.error) || !isRecord(body.error.details))
-        return null;
-    const required = body.error.details.required_scope;
-    if (typeof required === 'string' && required.trim())
-        return required.trim();
-    const requiredList = body.error.details.required_scopes;
-    if (!Array.isArray(requiredList))
-        return null;
-    const scopes = requiredList.filter((scope) => typeof scope === 'string' && scope.trim().length > 0);
-    return scopes.length > 0 ? scopes.join(', ') : null;
-}
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }