@kodycodes/cli 1.26.3 → 1.27.0

package/dist/chunk-5ZBJAP6G.js

@@ -0,0 +1,2005 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  openUrl
+} from "./chunk-ZILB2HWE.js";
+import {
+  redactError
+} from "./chunk-CASGRYOF.js";
+import {
+  OpenApiError,
+  openApiGet,
+  openApiRequest
+} from "./chunk-W2SAFAT4.js";
+import {
+  isScopedApiToken,
+  missingCliAuthMessage
+} from "./chunk-5JIRHJQP.js";
+import {
+  orgSlugFromFlag
+} from "./chunk-CWWHR4FH.js";
+import {
+  loadCredentialStore,
+  loadCredentials,
+  loadPendingCredentials,
+  promotePendingOrg,
+  saveCredentials
+} from "./chunk-3H72XY5R.js";
+import {
+  accessTokenSkewMs,
+  cliClientMetadataUrl,
+  cliRedirectUrl,
+  defaultApiUrl,
+  defaultMcpUrl,
+  defaultScopes,
+  loginTimeoutMs
+} from "./chunk-BTL3PJ2H.js";
+
+// src/auth.ts
+import {
+  createServer
+} from "node:http";
+
+// src/login-callback-assets.ts
+var kodyMarkPngDataUri = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEQAAABECAYAAAA4E5OyAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAOeUlEQVR42u3ba8hmVRnG8T72pYiiMjCJEMGKDlKRGomVSBh0sNLsbComWVqmpmXaaNZgaalj5mFmHJvGw4yNedbMQ2GnD5khlqGgQQaWRRQR5e797Zn/256Z15zJmXGEd8PNfp797L3Wuq913Yd17/U87Wnzx/wxf8wf88f8MX/MH/PHZjlu+v4d25GV373pJc6rVl/3jM3WuMauvvbW3WYaPvD6G390gjO5667ffPzeex/YV4dPNgDGZ2xXXXPL0muuve1HU/n+zT++746f3HmpMbvvCXW0ctX1+1++8oYbLrn02kcuu/z64eYf/OTRq665dVh1xU3Dddf/cKgz4JiNrQmCiaJk4/vOiquHxUuvGJZdfOVw8fKrxs+uGStZfeXN43jXTuqmT+JFy1Z/dsnS1f8497xLhm+df9mw9KLVw4WLV87Iqn/rSKc6ARCps60BBvBnxrHkvPMv+/vZi5YPXzr1m8OJJ31j+PLC84bTz1g6LDpnxWDc519w+QiQ8ZLGiUlrWb9xwFyweOXbTz9jySM6OPmURWNH5JvnrhgWnnbBiD5w6ixwMOj/noFNMI+vnrHkdkBQ/qQFZ41jc56CctrXLhwBMWbnNRO66t9rJ/GvgbJRHQIDEMced9pw1NGnjqIzHQFEZzo2E5dcdt1ISaAwq0wJnTc3GCbqggtX3mccWHH85746jvETR5w0fv78CWeM352NkQDEBGKM52I4UJavuPp0buExnS4qnrrwvOUAOOigIx499GPHDQcfcvQorukIULFGB2YKKDoxE4ABCrbwL0/Yka2NGkzYROmP8sbj/IUTvz4cc+zC4VOfPnm85jPpuok88+xvj4AYc2ZvzED5n4w+5UvnHvjZ47/25w99+JMDCRDnd7/n4PGa7waCombgrLOWDV//xrIRiDWdrRzBQc3bbv/5nGwxIwtOWbQ9sIiZN1Oka1MnbZIwU7+UPPCjnx7HhA2NxfWPH37COkDF8iljCFDzKyLRnAHBxcM/ceIVdQaA973/sBEEn9/2tg+MA3Gt6zo2UMibhajJCQOoaBQ9iajw7eVX/VpkWO+eUZid34h7Oc8vLjjrL5RmGhQ2PowgxgAIQvnY4rpxBQITI37XFv9nvJgiSm5gNtjxscOOf5iyFAfCO/f9yCwwrvV9//0PHcUAoZ/T5VMwBCCECeXQCn8GQGmfnZsp4Liv790DJM9goRnXJ4Wn/s13IAElf8KcTVKBIX+T4wUSQDAZSzYw7SM+teC0kM9kAEBxYOgoE4o1rpMomXeHPiUombBb4Dj7vSgxddQUKDq4D8B+L2RqkzKB4Gxc+Q3jACrGEcqev3jV+FtAYYf+tMvhun+D6MiehbJQ1lE+xGcIs0mNAgQI01kxyGJ+DrbZNTDXdGwAzZz2csyFRv4oagOM+QV0fglzjEf/AKCs+7Wpv1/cec+s3HHHL8ZxAMC9BCCAwQ7y33xqEobZD8el8ZwSpX1GVYMzMI0ZjM41YpAUzQwCYupcs1P3AQBtgTEN31NaA7jBA0L/nYGmX8C71/P6APrPfv6r4de/uX8dufvu346z7758HZOhB50wUFtrfNgaQEZfcuSRC3bnUM24gUVFnz1UgtOgUlZjFC1By2/ozACg7zfPaocSGAb4gDBAAAEqR9mg9T81R5If0o/+KHP//b/bQO797QMjIFiSKWrPuDDR2XW6lMGKciNDAHLU0V+5k1/IYwMHFdG2GZ/aOyVLjw0MWEUb14Himud89hsz5KALmTnkwqNJqG/9BCKQ3KNPYOSfYh/l5wIESwBisow9djsbk7EbK0DWCb98CED22We/ccAlY2YuQDxs8JQwSGD5nvKFNiBQxpmUq3iOk9ZHLMkh5uxy3EI8Z56DLZoBgGlmnthHKDQXSwDClJgZQMpjjJOzNZGcN9YJ8eskaKKMgZRvmCkNUMagzBZki0CUco9rOgNOIKE88b2kiVJ77/2u4Q17vGUEBvCe15bfiiSUBSRW5LCJawApfPtMocyWr3jgwYc2AARDAALcAoH2PNvqeE0AuGXpOgmaPISSZhAoBmygZrsQqSGDLHnzOZvP6bqv754t5XefWQfGm/Z6xywwfjeLKZPdU9CAtcFUCNAylxw69rrPpE3bmTKEnzGuJqaFarmP8wYpfGZTIkZhMs1Gs3PAlQ2W7MQUHeUkS6YCTTuerw+AGPDf/v6P4aE/PDwqk+0Lm1J/vwMJc/IbJXDOhU8MxoQpIEUZvxduc9bGlnOWOc+55mI2zWLZaAs7jVEmx5jptIACRk62Va+ZLrv0O/NzLwbuuuubRxYBg/zxT38ZQZkCQ6Fm3XXUBkI5D6kMUYTTp/uBCgxjaWE3NW3ONYD5jzkXdzMDf/8B7zvs9wBJ8isB0MyaZUAZUMqXEEVTYHq2VSimAEcbe+751nGg/3r00VlQAmT6HSjaBBglW1XnO/TvTCpHxDBgYOy0cFTit6amM5M9zzjXxyxVMBv5iAFThD/hCM0mBQLJdYwJBACMmeEPbh1pjrrAe81r95j1RyTWAVMbTNJsAgXFa2PVorOHq7+zYhacwqjPgC7DBApQRx8yoxjGYQomAc73kjwm4l5gAKfFHXP5nwWtKUtyfrvssvuw886vGoEBEOXMiKgwrlhnFDjnoPeOcugb9xj2e+M+470AAaR2iGcBNGWeQQKUAp4/7tU7DGcf85mxnbfvvNMIEMAAgiUADAzn0VRmwMAUSmNB2W0mUoLp3hahwFAitQJ/3IIMlgTIbq/fexYQ4hqnqdMvnL58OPOLC4fF+75uFIP1fZfnbDe8/GWvGcWzgAEQcDGjlXQMNIOBAQgAAAIghAlgRyzBwrJjE5P/cC4nCoycaIkix95yg+9Qi3lcQGSuWGLAZpgywKCgWdXguGpc+r0RCIq8aPudRh/hXp933PGlo/QcYABSnsOkgPHKV+w2fHL/D47t7LXDC4cXPnOHkWFYCAiAYAyQfI8lrZ8yG2wpX5omkRWEONGyac8wFVW4ja7/5ksChFLYQhHeWwcAAQZGPPvpz5kVgCSBQnGAaJOD5T+wzXUAaAcYRBvOJgRIAMtsgJEvaYE5rcNQ3rlUHQgtM/Ix6rLWLZtUDMeSgw459qeZDtqbUckYQIDBZA548XM3AAQIL3j+9uuAAlDgtkZyBhCwXNdOgEzF9SlDcrT8TkWm/ANQTJTPrpUcYnShF4D/dwE8UNAcKCIERVp3SL7Y/Juf96zZmaU8Js0FiDaYlYFhCpAxRLtMA7Da6TnswBz+hKmINplMBSMsqWzJuWIDYFyrjMhEnIHzmDnHpoDCnwCllWj5BQX5A8oAhUKUdB0ggRIgGMZcAJn/0Bb713btOGMGMESwErXOGEp5zwFFxGAq05ouhpg4AOU/MpUn/D5EKFZvLblqRVoYNsP8AEUozhTWB6QIRXHs8CxHq73WLhRkHiKOM2YwESAQ9+U4y1SZDCCq1QCEVJ0j3vApVm9URNnYg5NtBYoVgGD7zAMI5R0Upygg1gclx+pen91XTdasMoObbvvlOjKtyFcfcZ7mIjGk0BtLMAMg4wupzf3u2ToH1ZthEaCkjQAFGJnHXI41gAINs1oJS++nryFFCJTngCsKVy1vhdvyvXrtdOU7BWazMuO/gJx8VC+DKIIhGFHiNQUlYHKymUzX3Cc5a2k/XWtk7xWXWowBB3DOFG39EiCzjnWt2QSK9cpm8Rtz+ZEKOgDBECCgfoCU0U79ht8SpsKPaKMM0uqX8pSaptx9nhaZKiz3yqJaRibT+6D8CJGeb47XqXMypFpGaXd+I+FPpuzJt7i3VxfVJSo0yyU4TM6TggBI6apu1VwtGZQQKF9UqWbbGgbjpqm8yLJFdiPEkFaqpISt2SfCaOmzwU9fTPcyyXX5g9VtxRwh1TOxxrmolo+p0GTmK2aXgAVSC7zM5nFXs09kx46KGofaytU5IBIsoXx1TvWMCj3jjoC1JYPqHAQYfs88YlGVt97pBmovu1rElZoDwmeAE2OQiG3WPWbrmw0GFHILu1Oz4UfkKC27C6dWqMAgfY4hVcMqM7Yw641hryrbikGm71kwAwABE3skbVvEoU4LSBK0VsHVS6a+BCC+m9GoXP2B0lhSnbTSIOELeltHycIu6dVHjjifUpW/NUt9VVHbouyYskSUAAZQAIIlMaWki3Nlz4EQK6quWahNATGj2FD1Pma0z8O5bVMAqo5b3lJUwhKZqQx2q+x5g7gFH19SeTHfkRRZKIIZ7SiaghJDKi6b1ZSv7Dfd61GS1tapolGvJguzPgvFG7x42pJHq2BMmfqRchKswaByDLPVToCAyZkGSO9NYkeKMz3Rrep+ZtO5MOzci6utCsb6BenyjqkvqUJmds2imZtukSjaVN8ACh/SG8NWxKJLG2TaplHkKT9pWa+PNcDfsvRJ3UXMp1SUztlWZXOtVNyA2z/SNiqgVDz2HeN6VVHe0SvTtmqQnO50Gya/wWdscSe6sWyx+AuYfAnmUKo39r1pK+UGDPPBFOfe/Ux3LE13I8SW9pJgi/1nlvZbeyf1JgPTog5TbPHEENlp70xalE1fclO8HUrTnZDT78I+EGzRJJ6/5577b9ym/41gV5/wx5dY6PX6od0CJVbRvR3J09cH5RdFlzUZ6pJxd2KFISY3FpBm/oSwzf89w44coGBHb+3yB6hfztHmXxGiSNGKtdeWfgdi258AUX0V+E+J/6xImfmLaWg00yJEs19Fq2pXqbfnfJ6GU+Ymf2m3kJD9lAGjQwiUSrcnox2KQixwKgi1Ok1K+ZkFZyuJaxOd84O/e+ifTzkwcrLqERTEDP5gmrm222i6BZMpxYYAIFXdxxff27rPeFxQZmqaoo9ETgmBcxRt+JWq8ZxuuwUqF/AVfJEo0h+Vtkj1a1sASd5gCbDdC3Y4YCoKURjQHwC2iURr/pg/5o/5Y/6YP+aPLXX8By6sZHEPcft9AAAAAElFTkSuQmCC";
+var kodyPatternWebpDataUri = "data:image/webp;base64,UklGRkggAABXRUJQVlA4WAoAAAAQAAAATwAATwAAQUxQSD4XAAABoL9t2zIl3uNN1xSNEoqJSCkwgJSJuKSFHSDNgGIHFrq6KmKSgjSKiIGySHfDMANDDZ0TwNChG/ywGxEToHWsYZOrpWmgmns1LpwB7HslzrbDal7HukcdBr7f55eW/o4WsR1obba3mDDWndkq3nkBP94pFcYjOF8/dGY7zg33eOFUeWVlZcVWFQHcsggEWTnpVXRftYnKj9k1rWJ7FswVmgs7biFmuvGFtYGes+AWCu+IQSLHAlFMeHNkNbums0R2DeV3cQ/jBcfCeuwh/v/xNKKHW3g83sjUD6GQOPGvd7Wa7iBqRE9kZeW21cOOkDYx3ozfP6PG2bSpvLF2P7nLB02fsMpDfN3EHchIwHuWuoxgNvbqYVLSi8eFUy7RwyY6JlSqCVUEzGNi3Y448dcWfO6kSLWdOd4tKVk+xFwytGkllV3Uij+3IqME13OxprvITFyHlQgrf+/nv86i8hvcBIXxiXTW8/UY2y5pbEqlGm+5njb5G9JHHRHep4mkxtphfV1OecUX2R3tCmY8okevFgBRinocP01d+SN/ZO5POM6zGul+MGBWXRCjCAGAlPHelwiZY/N4PD7rUWSvFe7/3IqOSlyr36pMJKpZfY+HTwN0xzURz2lkMCoLeU9VP/UqQ9PUGBrjVwHgwFTQhrkj68tqGU/2lA10NkomPBMjEolEcSByxhZhnURtJ1uuNc4ODZ6FgWC988ype4XxVyW3eQf40wL2EnUkIuuigs2NqRlf4RaX0MCPFUe9g3vToZvl048I1hMaL1Ll3Wh+vkk1e/Bw1lSkIxs6/OsIGz9/fjRKpPEWLo5WSV+bIhjYQIRIFKZNEpwaXuZy+Yyh02CwEh6qQ/bsuJLvRwBxLyDcLqXVn1XLYDAy/5xxQkyv7Pq87LabOD1lATjySYFTe0AQxpf7Uuy+7618fl37fRTSAFlZPHmDCnvgZB6/PwwHFurSN5jOfowof4jv5/C/N+apoH8Dqd8DPgsnxLOPrcsjC70czT+8K3NU2aVUKfYPE5NVb46i0dm5zt5oV0YEav2k3oy8cSCJqcjrOHfEYE/i77unSce/+8YnJSU5IbabuH7Yy71bwmb+FGhLw2xeJhUrno3PZm7GtyR8tsMG47wXKLu6+k1zb9bQFWRNts5shsjxpv6GI7Du89IDPtbh5PS7hKS32fPWqM2GxaLgNzx+D6VOV00jg7TZD5bCmrpE4vZZD9RX1/6qjWxUPN2rgK+BuJYOkoGe58Ur3ZMPN+QW401eLC/7dJ6mylAA/hvST1HvfSftZC7xhFeTUlcCbNLEji/tTSpKbeyRD9Ad8/OwE0KDL1lgvnzaE8GLf/7+UFZj9ru3OiTrtu0YUYNWWgvE8/PhVFdXswellVIre1KgwWixXHn9dv7zT0vTIWSsEJibCXZorRMPrwPs/O1qzhB5VJO5Dbs5TkcKljYc6pAWd/P5mof3j6WKdgNx7SzZraOP9scL1iu1ZyGwBXEsgoy5DnYxcp3300fcbRiKl/Kh19S+eFAo+1dzYu9hEo9K5UqdGxTF43QkpiNl4u3QUXTQUEXfeObrYzlR9mUxCZTGwZpH8q2WrDstXM6bCAYACbFLPyYCUPoS5akWOogYMAVy/Ik8Y1OBnOnPg2hKRHICWq8gOQSv2dpCL8bZwIp7+XjZLblvjOrQLx8bQh42ps4YWPaEhT8v5QVBuNWNOLZrY7cKZB7MGGHLTtZx8ihVY9YH4e2E4GokPMMPX7wdJKMpHlGJEtFs3lChtJHgvFBxd2eBTL0PkU814VIkm2O/TH0MGrgJpi+Rv8lk6UcFZ/wAsha+sX3Eh4Nxb0xp9dKZZV0ro6vtqj5Bi1HgmGe6YdYG/GuWxA+f4TlEBoUC0P2JPKoJn6LQrgFpwHVMLj9Icmi3pIefv7syvPrM4V0AzwVrNMTBfoXClPm26vxQdrkKbi5+w7cPeGQEsrDZ3G7URx6k0fxcek+QeFS9v+0li1/50gLONhbhNEMqsUlHmkiQP3ij5wDkXsza4MWAgu7oW6djBU3ykAKUfwwewDoF52El/Wlcme75eJeufuLfltL8gsy+5WSONa4OVmd/ZTAYzJck+C8ZyGaP8ni8seG8z2XvON+ujx7GjyIYZ9XSY8hrChtTw9fjwkiNCy7X4l2L3vDzV/tQ9BYbhKCIzb2y+pxcdziGy+N/7UtH7xDkxLTNqGamssDVVA/g2Jjesv5AURIAo77Cu9G1YzQovV6i7hpUOriDEwFgJycQ5+O+j+kacRUzXjvzP4nBOSkpMTGhvj9KHw8m87as2aK6Mjj1AKB66q36oyo4T7V1fozLmIoCgOMjJavxZyRKUrHxMeyr26de4dl8WrgXnubjxxmsyGcV939ISEpMuS4LVdfyo3cGO5gtQ+Wptak1QyNdaoaTcn5ZxvYvkxP3YmdVYyCUi3sI9oLla9qLarF9Nv6MHgwFtoDmzakdKG2OM8WrD6r4Xzd6G72SgrjbQukPgNDacyaSMvDIFaPTsIkMSJ2bfh88VCwn3f07cjJF1nfu8Bu/Bynnc73ROMsarN2DhBz9V5wrwNHK4nxGfm6d/3J8+oKUcNR7wXHMBMZBxVVjF1D6iDjCq6f3cvwAFXoePDiEzUvJuH2+4Qn2DQwyvpL3LdxaCdyaXqekumPGZuvUpduZPqG96spP5XePLw8qR1pW0NwbXJqruH0ylEnZOaCl40Pz3y8DlzjVNXMHhTtv45CtCr0VOLZwlwwg7TzM3rPGToEVh/qTXg3wfQiUO+guuUmNWG3ka9qNF+2H1ZwrpIVR/h4RDBVRorS5VyxnKhThLLj8uiyyhv1BzDVq5jR2JSRkTp+w7E+yV4DLr60q3dq+jUjul1ThJeJTLLJC0HIeMpA4Oh6Bk5wurbWjLiIfu+p62I2MKvPdE9qUwdu42pDfHS68hss5hLMzmQnRVzImXHDUwXr4MR534VQDDL5kNeaaw3ZhtX+r8IWKvbRUNv85dPq8Eorhz1OTa3F2uC0BAAVVcJi3AQ68gfm4vAyuLxwAAEKrh3BDNycM+gvH8HrKC8tHjsL47OsmBdNxWavmDGa6LQHb279CZcJFZNCHMLBRr32P3dsPxipdYXg4m3o3p0iSEQa1gvmjeFnf8E7YedxBlHg3CQ9KEFzi2l/06RlOCHIZh2A1LE0blAHB5diDzqvfg/AjAXQacdSYkMMdzaHToc+3gk9yfIyzePuH/I4cXVh2nHHnRMNz6h7WTpUM7ZXiH4fSuXF7acFdeOe7lWZhTe1NuC19bH+MS22ITwKDJtZ+0UiRSASx7SEe8Y4AUDAhaxSwUqEWPPhRCqazl+DIy1deZVrqKN3ZeNcSxUHSXF/48IKTuPdkLf9x8K6FY5MwjYHERDD8UZPNzrE6Q6PozaTi6iibTm+dZK0RkpRw49R7vh++jr3z17CsjqmI3ERQTDOniY9rkFqN8yWAS31bR9d693pQ+SS///Mjd+qL3ZxpGqoiWr8Qg7p3oPdGtbghM+xdPCMKXJl5iQMLqcoy6W0/vnfmaovHlOFgA7b+NDGbfmJMFFljJguPRnmrPpIvA4lJaKQROizJ6fFQ6vfFS1aVD7DOdy1eTZr71uN8iQ0sZm7BvHFERXaYBvnsyaFqeenQma34+hln2rjD2ZeMHZLZzR09HJnzTCSkojEAjfWDjaoQrgpYyfK4Nsx4Ut02ZEIc3K/bIe81NJ0Al7+vQTKPqllOOmQKI0sJ7a6cB0Na+qNGwGrji3ncsTwrCUNTbRREoPqq0sAuiwbDTRJWRe1/bfXqloXc5ekjyEtAxWU0xEHCsMceJxZu6KZn58Qgd9F1pfiOkSRhpHxHxlBCYpC5AogEqFmYUPX3sLWtp9ebjZED2dB8w03ys4FOFTvdBDFhSEhAeZ/ilqnz4ivz+o7iKG8w3ev3ARvpEO5I/18PsWO/HnfD2pik+My+ruxAzzd8Po83yMuEN0dCv5+0MvNHV6EeRM1pG2GWw1E6wqW8qsPpvhBYc3pGQy7NPgOBAoBWJQxJPU9bHFr6E7HX8V/pzU8ZzFxnIoEobcfdLJp54GCHIbZ9Xg/DhN7ZubFwecl+D6VxI23BYRwqoRwq2a0HbJ8I1vKvbHRdU1UW7HdytfjOkeuiqjljjEYGoz7ECgDkTvr7WyCqcnv6AKO8p3jkJe7wP7psULPsiQTdT3ryEC6MrzQdb108DfvkV2TH+ZmWexcaR2OfNjSyeEOLV7GO89bY05/mR3s3UH/TI57TV8ta3IcPfx8Rl4B5gK9WIIcKVaP1CA5Hy1Uk92n59Wi0BW7Ww5W5lI4nWG0oBElNc/xX2/B2lkVFtogURVSMTIJCcP9EwQlJ4Ny0naixwtGAs7YUSUTlIW7+12JpRzDCRtYLvRj4sVxjggyzT1PHoVOz1/C3558m3XExJTEpMUARyf9WSdpwuhnNXX2leyBKBC6nHMClGTNUdebQe0f4ziu7TZ3cLY+63uBsxTv+bwhohteHBzmzX3WwNaOzl9/zNe7Zct+FlLjERBbXAVQpZIatDX+qtf4i/6nLebeMzozp0yjOpHRZA7IG8XV4lQIxWbIEXvK18WhOR23Clmw49lgPqknziXJiJAIAk9kT+O/tucPK17O4Roi/iduaO6cF+VUdK/AxDd/i8TglLOWquPzQzrUzZWweZ+QAMng7UJiErM9ghUM9bKzKEgY0vzd0esnANVxhMiqP4dRwJ+PO8zKJ9xkUQSDUl2FbHxGFkTL9hzRyDl1PGcnE51gEhu001Hso0MSz6ZWOUys3tx6/S9jDr3GBeOh0Bz3a4+StVCj3hnrenT6GJ4GAPpcUWI70z5tPR+mtG91k/mur7iD54JKnEJwnZDx4yyFptGU1yt+CwDZFSSxuT8N4Lhhw62r9DYD+dvwR9r0GEGLTUBnh4BbNgl8HvMdGWrl/IrSDfQ97x62wp7J9m/a4FrltsLx/uFmwZv+/NVkDhojqROSfuNKCw03dTyWEPRNzFsuFir55Zl26Utem4N5zoLnRq914rcARBBIMOJuXVXrjeE8EPV1GlB4HVho0fP09l60TWGOH35Hw3vzus4gN9arwRcygEva2DqX7GKqQKtRh+rP4hRoKAhD7AJH5CJm+702zQ3oDAbjy8xTUK8vw4AfsxwtWisuAnPpdZKenrgiCXizHga7Gj23p0OowIEzEEKFsdPTTmI/Ru4/AtoSpu7jTSzSf1wetktH2j5VCHf12IccFjyw1Zo22/3scqtHcAT6dUyG1fZHV1B8E2Ff3B5yE+sA926VTq3nrCekDvJanF5j8HgOJr/NpDh0B4uzHSMtYQxIDXnyA8JP+EHmYze0n8LcgdD5CeGeG9W+vnxJ0ODdBcK35nD98nwxyvKhB34fDuM3CPcEeohQgRhLGN9YmIDUdOfEIa23l1x6Fy8/cQGkJcZ8CJlODKPhTC1b1nQJ76FCgNhIH46jlUq1R8jhdP9r+Gnn+cBPsRfMN2Gcw6c+8/Ur6lq0KOEk/snzI2rZNXtnyGaeEabd39r5QKdtf9XWppFPu+CsZBAbLPPmr43TBJ+wY61mm369IyO86Y72rj/jmuszcc1ycUTP9lU67lc9kvl+Jps70HhXzUYIXfaOZFjZVeUG2zf7AkIby2hV8GrCrvcuPgEcdtm4CHkVr8gFUWt/jbZuCsoZUrZlPvYw2Ds4eQkQyICkCSBADiqUVRwxNeKT97Rlc/udVUL/eU42IFJQxsX+g6D1F8hT/m/ywLYRXrZKgvwe1LxPGMxboThDt9Vcf/mEXyDuIa6PROue5FfFJzcND76QV+CZUHpH2XYSykRUrVNt2VhGJSfhSDPeqM03vgDhfpTa10GYKYntlNk3GQKktGZcEW8J5BlD2LeQfRhLb8MQ/Y78/So51013bk0tqMzXhEdzHLUgSadd0J7SET4T+jEDOE8mRe1jBpZd2K8tyrfQGelgTJsKsJFgMlElbLOzHkIF6zB960jLiaflq2lL7dAFIbzIWNdpL6jbfxFcWSZgY6ZnVNeTLuP31zEtFd95Fqs8I7q1Ht31JQFI21H38dfC8T9JkMhKoScKd7Siqj2dVG6/7x05i9jnWZzHpLUOz1QrCUVxVrZnPW7DB1HQj/AdFXOOB1ew0aHXfu/HLDcp6w3ayw9fJBBnFxz/t0BQNs8QB5XWLcO0hgZLaIhqaAc+hZl6ql89WmXUJjVUlenhw7+rMnc1UquFhwUW8a4tLHf8Ok/7MVGYI/Ge07JuVvP/l87jjvfagjVJsR6PzlE2WcCGTVGgj3u0oy3WF+svjUhJqp7y1URsK/Xe/DuMk77/jcbjQaPsq5Y6o4WQoAFDHH2P70mnomVDNLEli/j+DUPIcmecNlnAhD4VleFiJcz9fbSPg+UhVxVwMGrxEB+KPdh+GFIlIIhKgWnUKACjtEXBJSkibjsXBocsypjuoJppw6eu/AN05GzG2+6YluIyrqnF/U5lwh8/3EfZ6pzFzPI0Hw4/M1YPr7CuXM/4nvDz+6GIzahiMutYfcJhLjktyh8VPb4RO94yMjuSzbxBhzKoVuTauaLJ0HEWJiCnEuQZtCag0R6LYHS8TwKRJ9Bxd9vrdDS7je29lec9ucbsAPz/PyHIht04AG/XKXuH3dgMRGQXrhmDsY7LjZVH5EJqCIU2qYOP2wWWqLYyWV4iNh+/wLXYIKlIR3lLK2YQiK8RsknqzRpZCJJIg0nlDpDrpWtNEI3el9oTxqkA/fUTHgRmrYSVvyHp7QHNXdiTa/Inj1D9YqicW9a9U2lXnHAsrxl0momIJFKwZo6pPu4qxmwd4PN5YueQh7nLT2sogvWUNRuYc0X2MwW/ITkXNfslh3nhcyL/FqHuBiuPCtet22YBUqqnD6b4EbBwm+zCQ8AfpY33xxBrDpcOU/oObTahGO9khyM0ARIjkFbUmsv1PxKCZl8S2QfUZbDLTBfT0waKsGHxqGblNxyOlbOYmpMVELsW97pSmMZAQok+/ubHQQ7HXSqJqI3RMjWAlMNDsjIws4/C6uMnC+l10MxneB6L4g6GmB6abtz1/aq77UFu7I+Zlf1/nYHWEw77uh05BrOEXvk0yfgzEhwEyuFEkVHF5FYPZvNg7G4WiKLwvj71vTtXayCwhyGc3CK3Gspp2ve3MUS6/u4c73K/cHQyQCCSK0GolWE021ZyTgV4v5SwDwYzQD6MhJoMk34Whl0dou8XPNSI+GVX7oGBqZiajyCyDaPnb4FjOV7LyaiESkSAsQiQRt49LHq/Ye8Zr+4vpGsO0DEDxxKPeeulv4cgKv5X8+yrpMk1s3ggpIkXauxAp8aiNtuoaqOMwZTVGTms3pb5N8cfmgYFjJ2l+/v40L7XlbButzLac8olk66D+irWE19y2GFcKWMFCnT6AskXIWM1t0y3hHB6/Z/A9XjcJb25odlGQUizOxcF53kkAcBu7saeD1chgMCpnw3GHJbqhWJLC1EH0W2i1sJwgYu5F9O4i7h98ntfHSd9+uYY3Wnt4E1Vv/5C+6nA47NqxL4+wQhCI0ADcp78rE9yG+wf877GeTRrTxsZ/W1Km96PdD287iWI3mfWCcGS9wR16sAkBgCiJDCUzM218qYTlr0NyHKd1/Bic+rkTuN/vnhamjLW9jmbRbxPf7lab8JThmZFG/FCTi9hcvLiPdwP7sKHTUP+nLSBlfKuSySy84bC/a7BtZoOmIBjPGbjbKmK4cAEhPbZxf1sg7ST5U9cPPJwveNaZgGp36T5rRLpjeespjf7iwWeKA1uVnsiF5+Je48XPg93FQQH+D6raJ90pInEBODhnpDJ6CKwweMw4I2XyqwNoi2buA9s+n4IMcDEOFe5iTbl/drErTXzqob7j6WHqiLT3krbNmLx4S0OUizr+l1J0BHYF3AB8/IbHraL2P00Q3QufZCBowROXnsN1/vYpz2PVMagEVlA4IOQIAABwGwCdASpQAFAABUB8JaQAUYH2h3g+T35JGDOA6p+8HAkfD9gVqf+V9ALuz35uoF4T5+P+N4A32j/d+wL+pfVY/rfFZ9Q+wN+f3rw+wv95Pa0ONgCMxV5pH3WIJO3Yj7oTb6XaS7QV+sQkyYU+G0TO8KHViYBAwee99jo86nq6XN1tYzmRbfVHej9FqyHjGFrgtEisgWsDd+umBa1zurQAl5ugkDFoDm9j0hp/AZGE7EsoLLFHhci5NwOlu2EbSeGaJf55J8VVKqIHYe0n5GCLayZG7KMPAKse/I3KCOWHk8OcUAAA/o4X3d6i+558Qs6QDmX6DxLy6eSgTV32OvKTiX9a/8XykO8lIgOoJvQTmTgI0Mk2GsJOeIPoC0BBdQ+iaa1aDziouTns9rTQAsFLYexlcDFLy6TWgHTLSJG9MHz0CUHWDW+DTnjLZXUknLDkJk/7Yo4VCELJdLS3uT13UJUg9egROSK8RRP2fIzG3LWJHnkywujKmjpIl+zMq966R5+iTuGL5mSk7IyO7W95/pr2UN5cgXtSNrRqIVBqSPS4xDk2m3kcLICZnpVb5WMdbVuESYYM0uyuHkOwZjOx6/FDPZR0R07x7KITkbYVZyo+RVXvEor9hNXXoW92vKqpKhN81XMorWFMh6w52ylifNvrhG42/X7Ga3bCd/rJOh1gw8coSTEeUJ4i9PQLB9Ri0phR66u5jo2VkP5RH6C3ykZclqm6fQ/avqtB1474WsPSr8B5fsVfeL1XStpkQ2uTDY+On0vOmQYionqGOz4b/VMyXI+8vvsy5hqNht1Zz37VFgUmxhs1W1mJS5ixS7NgC+Lug1vyGuoVBstcImYx144zEPKCfkwaguIW9ExOG2K28TmuY+73jmlkpxAB/lZVKaeyLqdIB4S3sENbh8gLJGoCKLhjxyeKnLMP0sSzQbAT2BcE3V0zj9TF7/hYeybhS6r+LxGz4RxM4C+IszUelv629vcosbZr6WAQYeg/d4as3t1nkMZB0lmq57wcqm6gVeSlyIkMlQHszaNrzAeBO2xhjwynHigYRlbqXuSv0jjMH93DeClj53R6Py1Jp9ufOAaBKRqX04KOSkhVXUrMqrCKmgmmyTvAiUo2smZDgZZFdpXj2PFZARGLo8ICvOi60HNklwhM0pbH4zfy292o60vyrmuCSYzx8rBVUSS0zvkF14TI9bvNIS0LTOhn7h/jx1k0IB6HlHGfryFZe+wHuuqNUz5/a7Xn3DYO8Jh0CWk1Ms2YkRLfmuaQaRiEByK42LxopQno/Pu9+W+bMDvtASHrsZ9LcdFno+UrQ7UnRxaOiFP6jXlS4iozLeeCR8xk84sBLZnW4YPTgmSDtLzqH3f9NbzSxvzMcXPG5kgZJDJSLlwCEbEQ4/eZOSgARWx5wg67Z4tdVdjy/4ExauV1TPuzPvChZ4OZFoAu21Vi7nGGTAWTDfkxGoyOA1plPlkoWyY4AF1ZNyO3TainpSgplaw3WDULHAEZSNe5ZltIl4XCMcq7bH2t5bznG+FxXx73TOOwNZdAb/f6TN+YezsvmRuNMCuRcMUqebDHuwBQH7AcjCwN2b/pU/NjOFDQFjtqKGq33E29TJLR4xWoxn2rBjuHc4ZWiI6XHrTqA0iXmZ3V9JqIIEW1ZHcYOwahwT+o/mxUFGjnNRvmPpoLCLSXVBHOKjOEVrv25+btoqY88rLZZjiZulbNgM6jXYZTWD8dQsPfiI/Cv2DcCjmG8gACivypf0e7A0ibrWvkUb6MQn+aWdQNa9T6Uwh9Yt1yQUnA8kWzaT1BkiOWngRB7qb16oBOvDRDB5+wkGiO8GKSk5r2oGN7wGBGFV3G0ooF4qFYH5jMhYUiDHKk0cTKjrZKMJd8BV8t8AbxkpPEHHIIc+S3MHlYLJK08RL2HnIk5ryIO4xabF9m1WBrGvNcxOpq1oqzkqKKDBqxUuhgKEQzvNYKp4f4jDpzb55uSqimsKFYOzal8iE3B6rTqDne1VMLEgJih2WfE0LkLnkV5HQ0zi3lxqDh12PE4gbRqsOwx6TIEQuWsmhadgcMq1U83kD6CoiPOrigofLfT1LwPVdWaYuD7ozY7KesTjV993rMZsx1Vqkf15R5IunnRFU2e4+l6NGc8+vi8G1FMl9jgliUa7ctRRhZI3SsYSFgrWqMcITngROSJAk4HvElzk7ejNTj3kbapWT6dObHJLXn+x94cGUYAnvDyrQwly7qaeSZoNyxD0+meGUBV/tl9aQNVW7HYiPYZqw1eXTSznXC/FPMswaumhCNF7vZmuS73Ck3CYKDme1PoFsR8S9RbG7wZpowLNtSpmWMKhr+xO2vKio8IqsuhNZKqcJh6k6ODEQobhKKtcqXDYqkL9Iz2dnralHeGHJ1HnEE1eCtbZJWpzjhWmi408vxlrOvvaYqBR6djjlpOoSsSmukDJxiick9zkWzphf4Ieo3tYvGUddf5Tq6ZSN6Mecim3Ukw8KO4ZYR6h6mBMf7IJwakzH8MRr8rqFCxWdK2GUZF1yOtwLNsRBoMLm/KrT3eKb5oB16Nk8snvB2IW9Lgk3th+G/lZCTPKFCFfxtJ7h4+GB4PU1eimeQkc/oQ48xRc42zmPJZX3A67amClY9aNp7dQjwoPvjWGRnAio9RWB2mIA7VBuQEJopAN8/OGAu8lzTZp43e+5Mf1K98NAqU3Bm92/3ka/jzWnt9oLZue9KstpfdVbH+qJr1eeenO2/MiB3zbi2UYPGJdzgHt3N+o4EySyzId8BRqd/w9jt/dhAYWYTmQgXEiKf3LaplOEvR5H8F4WiKHXHalSex68tJ+H+GZyfc631xmn3OMnmDaya9WDP3GdH8nzn3LU39N8C9uf4Q5KP32CWSvKhokeKZVyTfcvavE6fDcxtLBFq499uPphFXuUzhwxMBst0UKqkW6eol3ZFRw7rtKhIE4NNL3lm8c7vN531nR9rVqH2Pk/nOMihjzXdj7PgIJgvJXwllKE/7kfI+Ev5R3WaH/yWn8AQLAntGh8asWBHXWIAAA==";
+
+// src/login-callback-page.ts
+var errorCopy = {
+  denied: {
+    title: "Sign-in cancelled",
+    body: "You denied access in the browser. Nothing was saved."
+  },
+  state_mismatch: {
+    title: "Sign-in session mismatch",
+    body: "This login link did not match the request from your terminal (or it was reused)."
+  },
+  expired: {
+    title: "Sign-in expired",
+    body: "This login session timed out before it finished."
+  },
+  failed: {
+    title: "Sign-in failed",
+    body: "Kody could not finish signing the CLI in."
+  }
+};
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function accountLabel(account) {
+  const display = account.displayName?.trim();
+  const email = account.email?.trim();
+  const username = account.username?.trim();
+  if (display && email && display !== email) return `${display} (${email})`;
+  if (display) return display;
+  if (email) return email;
+  if (username) return username;
+  return void 0;
+}
+function brandMarkSvg() {
+  return `<svg class="mark" xmlns="http://www.w3.org/2000/svg" width="40" height="40" viewBox="0 0 40 40" role="img" aria-label="Kody">
+  <image href="${kodyMarkPngDataUri}" width="40" height="40" preserveAspectRatio="xMidYMid meet"/>
+</svg>`;
+}
+function statusIconSvg(kind) {
+  if (kind === "success") {
+    return `<svg class="status-icon" xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 28 28" aria-hidden="true">
+  <circle cx="14" cy="14" r="14" fill="var(--color-primary)"/>
+  <path d="M8.2 14.2l3.4 3.4 8.2-8.2" fill="none" stroke="var(--color-on-primary)" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>`;
+  }
+  return `<svg class="status-icon" xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 28 28" aria-hidden="true">
+  <circle cx="14" cy="14" r="14" fill="var(--color-danger)"/>
+  <path d="M9.5 9.5l9 9M18.5 9.5l-9 9" fill="none" stroke="var(--color-on-danger)" stroke-width="2.4" stroke-linecap="round"/>
+</svg>`;
+}
+function pageCss() {
+  return `:root {
+  color-scheme: light dark;
+  --color-primary: oklch(0.54 0.18 145);
+  --color-primary-hover: oklch(0.48 0.17 145);
+  --color-on-primary: oklch(1 0 0);
+  --color-primary-text: oklch(0.455 0.17 145);
+  --color-background: oklch(0.93 0.004 250);
+  --color-surface: oklch(0.975 0.002 250);
+  --color-text: oklch(0.22 0.012 260);
+  --color-text-muted: oklch(0.44 0.014 260);
+  --color-border: oklch(0.84 0.008 250);
+  --color-danger: oklch(0.535 0.19 25);
+  --color-on-danger: oklch(0.985 0.005 25);
+  --color-primary-dark: oklch(0.72 0.205 145);
+  --color-primary-hover-dark: oklch(0.78 0.21 145);
+  --color-on-primary-dark: oklch(0.2 0.05 148);
+  --color-primary-text-dark: oklch(0.75 0.2 145);
+  --color-background-dark: oklch(0.19 0.008 255);
+  --color-surface-dark: oklch(0.235 0.01 255);
+  --color-text-dark: oklch(0.945 0.005 250);
+  --color-text-muted-dark: oklch(0.72 0.01 255);
+  --color-border-dark: oklch(0.33 0.01 255);
+  --color-danger-dark: oklch(0.75 0.16 25);
+  --color-on-danger-dark: oklch(0.2 0.05 25);
+  --font-display: 'Bricolage Grotesque', system-ui, sans-serif;
+  --font-body: 'Wix Madefor Text', system-ui, sans-serif;
+  --radius-card: 14px;
+  --ease-out: cubic-bezier(0.22, 1, 0.36, 1);
+  --kody-pattern: url('${kodyPatternWebpDataUri}');
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --color-primary: var(--color-primary-dark);
+    --color-primary-hover: var(--color-primary-hover-dark);
+    --color-on-primary: var(--color-on-primary-dark);
+    --color-primary-text: var(--color-primary-text-dark);
+    --color-background: var(--color-background-dark);
+    --color-surface: var(--color-surface-dark);
+    --color-text: var(--color-text-dark);
+    --color-text-muted: var(--color-text-muted-dark);
+    --color-border: var(--color-border-dark);
+    --color-danger: var(--color-danger-dark);
+    --color-on-danger: var(--color-on-danger-dark);
+  }
+}
+*, *::before, *::after { box-sizing: border-box; }
+html, body { height: 100%; }
+body {
+  margin: 0;
+  min-height: 100%;
+  font-family: var(--font-body);
+  font-size: 1.0625rem;
+  line-height: 1.62;
+  color: var(--color-text);
+  background: var(--color-background);
+  -webkit-font-smoothing: antialiased;
+  text-rendering: optimizeLegibility;
+}
+.page {
+  position: relative;
+  isolation: isolate;
+  min-height: 100%;
+  display: grid;
+  place-items: center;
+  padding: clamp(1.5rem, 4vw, 3rem);
+}
+.page::before {
+  content: '';
+  position: absolute;
+  z-index: -1;
+  inset: 0;
+  background: radial-gradient(
+    ellipse 55% 50% at 50% 42%,
+    oklch(from var(--color-text) l c h / 0.055),
+    transparent 72%
+  );
+  mask-image: var(--kody-pattern);
+  mask-position: center;
+  mask-size: 220px;
+  mask-repeat: repeat;
+  -webkit-mask-image: var(--kody-pattern);
+  -webkit-mask-position: center;
+  -webkit-mask-size: 220px;
+  -webkit-mask-repeat: repeat;
+  pointer-events: none;
+}
+.panel {
+  width: min(100%, 28rem);
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-card);
+  padding: 1.75rem 1.6rem 1.55rem;
+  box-shadow: 0 10px 28px oklch(from var(--color-text) l c h / 0.06);
+}
+.brand {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.6rem;
+  font: 700 1.2rem/1 var(--font-display);
+  letter-spacing: -0.01em;
+  color: var(--color-text);
+  text-decoration: none;
+}
+.mark { display: block; border-radius: 10px; background: #111; }
+.status {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.85rem;
+  margin-top: 1.45rem;
+}
+.status-icon { flex: 0 0 auto; margin-top: 0.15rem; }
+h1 {
+  margin: 0;
+  font: 800 1.55rem/1.15 var(--font-display);
+  letter-spacing: -0.02em;
+  text-wrap: balance;
+}
+.lead {
+  margin: 0.55rem 0 0;
+  color: var(--color-text-muted);
+  text-wrap: pretty;
+}
+.facts {
+  list-style: none;
+  margin: 1.15rem 0 0;
+  padding: 0;
+  display: grid;
+  gap: 0.55rem;
+}
+.facts li {
+  display: flex;
+  flex-direction: column;
+  gap: 0.2rem;
+  padding: 0.55rem 0.75rem;
+  border-radius: 10px;
+  background: color-mix(in oklch, var(--color-primary) 7%, transparent);
+}
+.facts .label {
+  font-size: 0.72rem;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--color-text-muted);
+}
+.facts .value {
+  font-family: var(--font-display);
+  font-weight: 650;
+  color: var(--color-text);
+  overflow-wrap: anywhere;
+}
+.next {
+  margin: 1.2rem 0 0;
+  padding-top: 1rem;
+  border-top: 1px solid var(--color-border);
+  color: var(--color-text-muted);
+  font-size: 0.95rem;
+}
+.next code {
+  font-family: ui-monospace, 'SF Mono', Menlo, monospace;
+  font-size: 0.9em;
+  color: var(--color-primary-text);
+  background: color-mix(in oklch, var(--color-primary) 10%, transparent);
+  padding: 0.12rem 0.35rem;
+  border-radius: 0.35rem;
+}
+@media (prefers-reduced-motion: no-preference) {
+  .panel {
+    animation: rise 420ms var(--ease-out) both;
+  }
+  .status-icon {
+    animation: pop 480ms var(--ease-out) 80ms both;
+  }
+}
+@keyframes rise {
+  from { opacity: 0; translate: 0 12px; }
+  to { opacity: 1; translate: 0 0; }
+}
+@keyframes pop {
+  from { opacity: 0; scale: 0.84; }
+  to { opacity: 1; scale: 1; }
+}`;
+}
+function closeScript() {
+  return `<script>
+(function () {
+  function attempt() {
+    try { window.close(); } catch (_) {}
+  }
+  attempt();
+  setTimeout(attempt, 120);
+})();
+</script>`;
+}
+function renderSuccess(page) {
+  const org = page.org?.trim();
+  const account = page.account ? accountLabel(page.account) : void 0;
+  const facts = [];
+  if (org) {
+    facts.push(
+      `<li><span class="label">Org</span><span class="value">${escapeHtml(org)}</span></li>`
+    );
+  }
+  if (account) {
+    facts.push(
+      `<li><span class="label">Account</span><span class="value">${escapeHtml(account)}</span></li>`
+    );
+  }
+  const factsHtml = facts.length > 0 ? `<ul class="facts">${facts.join("")}</ul>` : "";
+  const lead = org ? `Kody CLI is signed in to <strong>${escapeHtml(org)}</strong>.` : "Kody CLI is signed in.";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<meta name="color-scheme" content="light dark"/>
+<title>Signed in \xB7 Kody CLI</title>
+<style>${pageCss()}</style>
+</head>
+<body>
+<main class="page">
+  <section class="panel" data-state="success">
+    <div class="brand">${brandMarkSvg()}<span>Kody</span></div>
+    <div class="status">
+      ${statusIconSvg("success")}
+      <div>
+        <h1>You're signed in</h1>
+        <p class="lead">${lead}</p>
+      </div>
+    </div>
+    ${factsHtml}
+    <p class="next">You can close this tab and return to your terminal.</p>
+  </section>
+</main>
+${closeScript()}
+</body>
+</html>`;
+}
+function renderError(page) {
+  const copy = errorCopy[page.error];
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<meta name="color-scheme" content="light dark"/>
+<title>${escapeHtml(copy.title)} \xB7 Kody CLI</title>
+<style>${pageCss()}</style>
+</head>
+<body>
+<main class="page">
+  <section class="panel" data-state="error" data-error="${escapeHtml(page.error)}">
+    <div class="brand">${brandMarkSvg()}<span>Kody</span></div>
+    <div class="status">
+      ${statusIconSvg("error")}
+      <div>
+        <h1>${escapeHtml(copy.title)}</h1>
+        <p class="lead">${escapeHtml(copy.body)}</p>
+      </div>
+    </div>
+    <p class="next">Return to your terminal and run <code>kody login</code> to try again.</p>
+  </section>
+</main>
+${closeScript()}
+</body>
+</html>`;
+}
+function renderLoginCallbackPage(page) {
+  if (page.kind === "success") return renderSuccess(page);
+  return renderError(page);
+}
+function loginCallbackErrorFromOAuthError(error) {
+  const normalized = error.trim().toLowerCase();
+  if (normalized === "access_denied" || normalized === "denied" || normalized === "consent_required") {
+    return "denied";
+  }
+  if (normalized === "expired" || normalized === "expired_token" || normalized === "invalid_grant" || normalized.includes("expired")) {
+    return "expired";
+  }
+  if (normalized === "state_mismatch" || normalized === "invalid_request" || normalized === "invalid_state") {
+    return "state_mismatch";
+  }
+  return "failed";
+}
+
+// src/discover-login-identity.ts
+async function discoverLoginIdentity(input) {
+  const payload = await openApiGet({
+    token: input.accessToken,
+    apiUrl: input.apiUrl ?? defaultApiUrl,
+    path: "v1/me",
+    fetchFn: input.fetchFn,
+    ...input.org ? { org: input.org } : {}
+  });
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error(
+      "Could not determine the organization for this login (metaGetCurrentUser returned no result)."
+    );
+  }
+  const record = payload;
+  const orgSlug = typeof record.org?.slug === "string" ? record.org.slug : null;
+  if (!orgSlug) {
+    throw new Error(
+      "Could not determine the organization for this login (metaGetCurrentUser returned no org.slug)."
+    );
+  }
+  const account = {};
+  if (typeof record.display_name === "string" && record.display_name.trim()) {
+    account.displayName = record.display_name.trim();
+  }
+  if (typeof record.email === "string" && record.email.trim()) {
+    account.email = record.email.trim();
+  }
+  if (typeof record.username === "string" && record.username.trim()) {
+    account.username = record.username.trim();
+  }
+  return {
+    org: orgSlugFromFlag(orgSlug),
+    account
+  };
+}
+
+// src/discover-org.ts
+async function discoverOrgSlugFromAccessToken(input) {
+  try {
+    const identity = await discoverLoginIdentity(input);
+    return orgSlugFromFlag(identity.org);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "metaGetCurrentUser failed";
+    if (message.startsWith("Could not determine the organization")) throw error;
+    throw new Error(
+      `Could not determine the organization for this login (${message}).`
+    );
+  }
+}
+
+// ../../node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.8";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+function looseInstanceOf(input, expected) {
+  if (input == null) {
+    return false;
+  }
+  try {
+    return input instanceof expected || Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag];
+  } catch {
+    return false;
+  }
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = /* @__PURE__ */ Symbol();
+var clockSkew = /* @__PURE__ */ Symbol();
+var clockTolerance = /* @__PURE__ */ Symbol();
+var customFetch = /* @__PURE__ */ Symbol();
+var jweDecrypt = /* @__PURE__ */ Symbol();
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+var UnsupportedOperationError = class extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = UNSUPPORTED_OPERATION;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var OperationProcessingError = class extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+function isJsonObject(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return false;
+  }
+  return true;
+}
+function prepareHeaders(input) {
+  if (looseInstanceOf(input, Headers)) {
+    input = Object.fromEntries(input.entries());
+  }
+  const headers = new Headers(input ?? {});
+  if (USER_AGENT && !headers.has("user-agent")) {
+    headers.set("user-agent", USER_AGENT);
+  }
+  if (headers.has("authorization")) {
+    throw CodedTypeError('"options.headers" must not include the "authorization" header name', ERR_INVALID_ARG_VALUE);
+  }
+  return headers;
+}
+function signal(url, value) {
+  if (value !== void 0) {
+    if (typeof value === "function") {
+      value = value(url.href);
+    }
+    if (!(value instanceof AbortSignal)) {
+      throw CodedTypeError('"options.signal" must return or be an instance of AbortSignal', ERR_INVALID_ARG_TYPE);
+    }
+    return value;
+  }
+  return void 0;
+}
+function replaceDoubleSlash(pathname) {
+  if (pathname.includes("//")) {
+    return pathname.replace("//", "/");
+  }
+  return pathname;
+}
+function prependWellKnown(url, wellKnown, allowTerminatingSlash = false) {
+  if (url.pathname === "/") {
+    url.pathname = wellKnown;
+  } else {
+    url.pathname = replaceDoubleSlash(`${wellKnown}/${allowTerminatingSlash ? url.pathname : url.pathname.replace(/(\/)$/, "")}`);
+  }
+  return url;
+}
+function appendWellKnown(url, wellKnown) {
+  url.pathname = replaceDoubleSlash(`${url.pathname}/${wellKnown}`);
+  return url;
+}
+async function performDiscovery(input, urlName, transform, options) {
+  if (!(input instanceof URL)) {
+    throw CodedTypeError(`"${urlName}" must be an instance of URL`, ERR_INVALID_ARG_TYPE);
+  }
+  checkProtocol(input, options?.[allowInsecureRequests] !== true);
+  const url = transform(new URL(input.href));
+  const headers = prepareHeaders(options?.headers);
+  headers.set("accept", "application/json");
+  return (options?.[customFetch] || fetch)(url.href, {
+    body: void 0,
+    headers: Object.fromEntries(headers.entries()),
+    method: "GET",
+    redirect: "manual",
+    signal: signal(url, options?.signal)
+  });
+}
+async function discoveryRequest(issuerIdentifier, options) {
+  return performDiscovery(issuerIdentifier, "issuerIdentifier", (url) => {
+    switch (options?.algorithm) {
+      case void 0:
+      case "oidc":
+        appendWellKnown(url, ".well-known/openid-configuration");
+        break;
+      case "oauth2":
+        prependWellKnown(url, ".well-known/oauth-authorization-server");
+        break;
+      default:
+        throw CodedTypeError('"options.algorithm" must be "oidc" (default), or "oauth2"', ERR_INVALID_ARG_VALUE);
+    }
+    return url;
+  }, options);
+}
+function assertNumber(input, allow0, it, code, cause) {
+  try {
+    if (typeof input !== "number" || !Number.isFinite(input)) {
+      throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input > 0)
+      return;
+    if (allow0) {
+      if (input !== 0) {
+        throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);
+      }
+      return;
+    }
+    throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+async function processDiscoveryResponse(expectedIssuerIdentifier, response) {
+  const expected = expectedIssuerIdentifier;
+  if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {
+    throw CodedTypeError('"expectedIssuerIdentifier" must be an instance of URL', ERR_INVALID_ARG_TYPE);
+  }
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  if (response.status !== 200) {
+    throw OPE('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);
+  }
+  assertReadableResponse(response);
+  const json = await getResponseJsonBody(response);
+  assertString(json.issuer, '"response" body "issuer" property', INVALID_RESPONSE, { body: json });
+  if (expected !== _nodiscoverycheck && new URL(json.issuer).href !== expected.href) {
+    throw OPE('"response" body "issuer" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: "issuer" });
+  }
+  return json;
+}
+function assertApplicationJson(response) {
+  assertContentType(response, "application/json");
+}
+function notJson(response, ...types) {
+  let msg = '"response" content-type must be ';
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `${types.join(", ")}, or ${last}`;
+  } else if (types.length === 2) {
+    msg += `${types[0]} or ${types[1]}`;
+  } else {
+    msg += types[0];
+  }
+  return OPE(msg, RESPONSE_IS_NOT_JSON, response);
+}
+function assertContentType(response, contentType) {
+  if (getContentType(response) !== contentType) {
+    throw notJson(response, contentType);
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+function getClockSkew(client) {
+  const skew = client?.[clockSkew];
+  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
+}
+function getClockTolerance(client) {
+  const tolerance = client?.[clockTolerance];
+  return typeof tolerance === "number" && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1 ? tolerance : 30;
+}
+function epochTime() {
+  return Math.floor(Date.now() / 1e3);
+}
+function assertAs(as) {
+  if (typeof as !== "object" || as === null) {
+    throw CodedTypeError('"as" must be an object', ERR_INVALID_ARG_TYPE);
+  }
+  assertString(as.issuer, '"as.issuer"');
+}
+function assertClient(client) {
+  if (typeof client !== "object" || client === null) {
+    throw CodedTypeError('"client" must be an object', ERR_INVALID_ARG_TYPE);
+  }
+  assertString(client.client_id, '"client.client_id"');
+}
+function None() {
+  return (_as, client, body, _headers) => {
+    body.set("client_id", client.client_id);
+  };
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+function checkProtocol(url, enforceHttps) {
+  if (enforceHttps && url.protocol !== "https:") {
+    throw OPE("only requests to HTTPS are allowed", HTTP_REQUEST_FORBIDDEN, url);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw OPE("only HTTP and HTTPS requests are allowed", REQUEST_PROTOCOL_FORBIDDEN, url);
+  }
+}
+function validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {
+  let url;
+  if (typeof value !== "string" || !(url = URLParse(value))) {
+    throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `"as.mtls_endpoint_aliases.${endpoint}"` : `"as.${endpoint}"`}`, value === void 0 ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });
+  }
+  checkProtocol(url, enforceHttps);
+  return url;
+}
+function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {
+  if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {
+    return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);
+  }
+  return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);
+}
+var ResponseBodyError = class extends Error {
+  cause;
+  code;
+  error;
+  status;
+  error_description;
+  response;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = RESPONSE_BODY_ERROR;
+    this.cause = options.cause;
+    this.error = options.cause.error;
+    this.status = options.response.status;
+    this.error_description = options.cause.error_description;
+    Object.defineProperty(this, "response", { enumerable: false, value: options.response });
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var AuthorizationResponseError = class extends Error {
+  cause;
+  code;
+  error;
+  error_description;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = AUTHORIZATION_RESPONSE_ERROR;
+    this.cause = options.cause;
+    this.error = options.cause.get("error");
+    this.error_description = options.cause.get("error_description") ?? void 0;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var WWWAuthenticateChallengeError = class extends Error {
+  cause;
+  code;
+  response;
+  status;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = WWW_AUTHENTICATE_CHALLENGE;
+    this.cause = options.cause;
+    this.status = options.response.status;
+    this.response = options.response;
+    Object.defineProperty(this, "response", { enumerable: false });
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+function parseWwwAuthenticateChallenges(response) {
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  const header = response.headers.get("www-authenticate");
+  if (header === null) {
+    return void 0;
+  }
+  const challenges = [];
+  let rest = header;
+  while (rest) {
+    let match = rest.match(schemeRE);
+    const scheme = match?.["1"].toLowerCase();
+    if (!scheme) {
+      return void 0;
+    }
+    const afterScheme = rest.substring(match[0].length);
+    if (afterScheme && !afterScheme.match(/^[\s,]/)) {
+      return void 0;
+    }
+    const spaceMatch = afterScheme.match(/^\s+(.*)$/);
+    const hasParameters = !!spaceMatch;
+    rest = spaceMatch ? spaceMatch[1] : void 0;
+    const parameters = {};
+    let token68;
+    if (hasParameters) {
+      while (rest) {
+        let key;
+        let value;
+        if (match = rest.match(quotedParamRE)) {
+          ;
+          [, key, value, rest] = match;
+          if (value.includes("\\")) {
+            value = value.replace(/\\([\s\S])/g, "$1");
+          }
+          parameters[key.toLowerCase()] = value;
+          continue;
+        }
+        if (match = rest.match(unquotedParamRE)) {
+          ;
+          [, key, value, rest] = match;
+          parameters[key.toLowerCase()] = value;
+          continue;
+        }
+        if (match = rest.match(token68ParamRE)) {
+          if (Object.keys(parameters).length) {
+            break;
+          }
+          ;
+          [, token68, rest] = match;
+          break;
+        }
+        return void 0;
+      }
+    } else {
+      rest = afterScheme || void 0;
+    }
+    const challenge = { scheme, parameters };
+    if (token68) {
+      challenge.token68 = token68;
+    }
+    challenges.push(challenge);
+  }
+  if (!challenges.length) {
+    return void 0;
+  }
+  return challenges;
+}
+async function parseOAuthResponseErrorBody(response) {
+  if (response.status > 399 && response.status < 500) {
+    assertReadableResponse(response);
+    assertApplicationJson(response);
+    try {
+      const json = await response.clone().json();
+      if (isJsonObject(json) && typeof json.error === "string" && json.error.length) {
+        return json;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function checkOAuthBodyError(response, expected, label) {
+  if (response.status !== expected) {
+    checkAuthenticationChallenges(response);
+    let err;
+    if (err = await parseOAuthResponseErrorBody(response)) {
+      await response.body?.cancel();
+      throw new ResponseBodyError("server responded with an error in the response body", {
+        cause: err,
+        response
+      });
+    }
+    throw OPE(`"response" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);
+  }
+}
+function assertDPoP(option) {
+  if (!branded.has(option)) {
+    throw CodedTypeError('"options.DPoP" is not a valid DPoPHandle', ERR_INVALID_ARG_VALUE);
+  }
+}
+function getContentType(input) {
+  return input.headers.get("content-type")?.split(";")[0];
+}
+async function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {
+  await clientAuthentication(as, client, body, headers);
+  headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+  return (options?.[customFetch] || fetch)(url.href, {
+    body,
+    headers: Object.fromEntries(headers.entries()),
+    method: "POST",
+    redirect: "manual",
+    signal: signal(url, options?.signal)
+  });
+}
+async function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {
+  const url = resolveEndpoint(as, "token_endpoint", client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);
+  parameters.set("grant_type", grantType);
+  const headers = prepareHeaders(options?.headers);
+  headers.set("accept", "application/json");
+  if (options?.DPoP !== void 0) {
+    assertDPoP(options.DPoP);
+    await options.DPoP.addProof(url, headers, "POST");
+  }
+  const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);
+  options?.DPoP?.cacheNonce(response, url);
+  return response;
+}
+async function refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken, options) {
+  assertAs(as);
+  assertClient(client);
+  assertString(refreshToken, '"refreshToken"');
+  const parameters = new URLSearchParams(options?.additionalParameters);
+  parameters.set("refresh_token", refreshToken);
+  return tokenEndpointRequest(as, client, clientAuthentication, "refresh_token", parameters, options);
+}
+var idTokenClaims = /* @__PURE__ */ new WeakMap();
+var jwtRefs = /* @__PURE__ */ new WeakMap();
+function getValidatedIdTokenClaims(ref) {
+  if (!ref.id_token) {
+    return void 0;
+  }
+  const claims = idTokenClaims.get(ref);
+  if (!claims) {
+    throw CodedTypeError('"ref" was already garbage collected or did not resolve from the proper sources', ERR_INVALID_ARG_VALUE);
+  }
+  return claims;
+}
+async function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {
+  assertAs(as);
+  assertClient(client);
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  await checkOAuthBodyError(response, 200, "Token Endpoint");
+  assertReadableResponse(response);
+  const json = await getResponseJsonBody(response);
+  assertString(json.access_token, '"response" body "access_token" property', INVALID_RESPONSE, {
+    body: json
+  });
+  assertString(json.token_type, '"response" body "token_type" property', INVALID_RESPONSE, {
+    body: json
+  });
+  json.token_type = json.token_type.toLowerCase();
+  if (json.expires_in !== void 0) {
+    let expiresIn = typeof json.expires_in !== "number" ? parseFloat(json.expires_in) : json.expires_in;
+    assertNumber(expiresIn, true, '"response" body "expires_in" property', INVALID_RESPONSE, {
+      body: json
+    });
+    json.expires_in = expiresIn;
+  }
+  if (json.refresh_token !== void 0) {
+    assertString(json.refresh_token, '"response" body "refresh_token" property', INVALID_RESPONSE, {
+      body: json
+    });
+  }
+  if (json.scope !== void 0 && typeof json.scope !== "string") {
+    throw OPE('"response" body "scope" property must be a string', INVALID_RESPONSE, { body: json });
+  }
+  if (json.id_token !== void 0) {
+    assertString(json.id_token, '"response" body "id_token" property', INVALID_RESPONSE, {
+      body: json
+    });
+    const requiredClaims = [];
+    if (client.require_auth_time === true) {
+      requiredClaims.push("auth_time");
+    }
+    if (client.default_max_age !== void 0) {
+      assertNumber(client.default_max_age, true, '"client.default_max_age"');
+      requiredClaims.push("auth_time");
+    }
+    if (additionalRequiredIdTokenClaims?.length) {
+      requiredClaims.push(...additionalRequiredIdTokenClaims);
+    }
+    const { claims, jwt } = await validateIdTokenClaims(as, client, json.id_token, requiredClaims, decryptFn);
+    validateIdTokenAuthorizedParty(client, claims);
+    validateIdTokenAuthTimeClaim(claims);
+    jwtRefs.set(response, jwt);
+    idTokenClaims.set(json, claims);
+  }
+  if (recognizedTokenTypes?.[json.token_type] !== void 0) {
+    recognizedTokenTypes[json.token_type](response, json);
+  } else if (json.token_type !== "dpop" && json.token_type !== "bearer") {
+    throw new UnsupportedOperationError("unsupported `token_type` value", { cause: { body: json } });
+  }
+  return json;
+}
+function checkAuthenticationChallenges(response) {
+  let challenges;
+  if (challenges = parseWwwAuthenticateChallenges(response)) {
+    throw new WWWAuthenticateChallengeError("server responded with a challenge in the WWW-Authenticate HTTP Header", { cause: challenges, response });
+  }
+}
+async function processRefreshTokenResponse(as, client, response, options) {
+  return processGenericAccessTokenResponse(as, client, response, void 0, options?.[jweDecrypt], options?.recognizedTokenTypes);
+}
+function validateAudience(expected, result) {
+  if (Array.isArray(result.claims.aud)) {
+    if (!result.claims.aud.includes(expected)) {
+      throw OPE('unexpected JWT "aud" (audience) claim value', JWT_CLAIM_COMPARISON, {
+        expected,
+        claims: result.claims,
+        claim: "aud"
+      });
+    }
+  } else if (result.claims.aud !== expected) {
+    throw OPE('unexpected JWT "aud" (audience) claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims: result.claims,
+      claim: "aud"
+    });
+  }
+  return result;
+}
+function validateIssuer(as, result) {
+  const expected = as[_expectedIssuer]?.(result) ?? as.issuer;
+  if (result.claims.iss !== expected) {
+    throw OPE('unexpected JWT "iss" (issuer) claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims: result.claims,
+      claim: "iss"
+    });
+  }
+  return result;
+}
+var branded = /* @__PURE__ */ new WeakSet();
+function brand(searchParams) {
+  branded.add(searchParams);
+  return searchParams;
+}
+var nopkce = /* @__PURE__ */ Symbol();
+async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {
+  assertAs(as);
+  assertClient(client);
+  if (!branded.has(callbackParameters)) {
+    throw CodedTypeError('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()', ERR_INVALID_ARG_VALUE);
+  }
+  assertString(redirectUri, '"redirectUri"');
+  const code = getURLSearchParameter(callbackParameters, "code");
+  if (!code) {
+    throw OPE('no authorization code in "callbackParameters"', INVALID_RESPONSE);
+  }
+  const parameters = new URLSearchParams(options?.additionalParameters);
+  parameters.set("redirect_uri", redirectUri);
+  parameters.set("code", code);
+  if (codeVerifier !== nopkce) {
+    assertString(codeVerifier, '"codeVerifier"');
+    parameters.set("code_verifier", codeVerifier);
+  }
+  return tokenEndpointRequest(as, client, clientAuthentication, "authorization_code", parameters, options);
+}
+var jwtClaimNames = {
+  aud: "audience",
+  c_hash: "code hash",
+  client_id: "client id",
+  exp: "expiration time",
+  iat: "issued at",
+  iss: "issuer",
+  jti: "jwt id",
+  nonce: "nonce",
+  s_hash: "state hash",
+  sub: "subject",
+  ath: "access token hash",
+  htm: "http method",
+  htu: "http uri",
+  cnf: "confirmation",
+  auth_time: "authentication time"
+};
+function validatePresence(required, result) {
+  for (const claim of required) {
+    if (result.claims[claim] === void 0) {
+      throw OPE(`JWT "${claim}" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, {
+        claims: result.claims
+      });
+    }
+  }
+  return result;
+}
+function validateStringClaim(claim, result) {
+  if (typeof result.claims[claim] !== "string") {
+    throw OPE(`unexpected JWT "${claim}" (${jwtClaimNames[claim]}) claim type`, INVALID_RESPONSE, {
+      claims: result.claims
+    });
+  }
+  return result;
+}
+function validateIdTokenClaims(as, client, idToken, requiredClaims, decryptFn) {
+  return validateJwt(idToken, checkSigningAlgorithm.bind(void 0, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, "RS256"), getClockSkew(client), getClockTolerance(client), decryptFn).then(validatePresence.bind(void 0, ["aud", "exp", "iat", "iss", "sub", ...requiredClaims])).then(validateIssuer.bind(void 0, as)).then(validateAudience.bind(void 0, client.client_id)).then(validateStringClaim.bind(void 0, "sub"));
+}
+function resolveIdTokenMaxAge(client, maxAge) {
+  if (maxAge === skipAuthTimeCheck) {
+    return maxAge;
+  }
+  const fromClient = maxAge === void 0;
+  if (fromClient) {
+    maxAge = client.default_max_age;
+  }
+  if (maxAge === void 0) {
+    return skipAuthTimeCheck;
+  }
+  assertNumber(maxAge, true, fromClient ? '"client.default_max_age"' : '"maxAge" argument');
+  return maxAge;
+}
+function validateIdTokenAuthTimeClaim(claims) {
+  if (claims.auth_time !== void 0) {
+    assertNumber(claims.auth_time, true, 'ID Token "auth_time" (authentication time)', INVALID_RESPONSE, { claims });
+  }
+}
+function validateIdTokenAuthTime(client, claims, maxAge) {
+  if (maxAge === skipAuthTimeCheck) {
+    return;
+  }
+  const now = epochTime() + getClockSkew(client);
+  const tolerance = getClockTolerance(client);
+  if (claims.auth_time + maxAge < now - tolerance) {
+    throw OPE("too much time has elapsed since the last End-User authentication", JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: "auth_time" });
+  }
+}
+function validateIdTokenNonce(claims, expectedNonce) {
+  const expected = expectedNonce === expectNoNonce ? void 0 : expectedNonce;
+  if (claims.nonce !== expected) {
+    throw OPE('unexpected ID Token "nonce" claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims,
+      claim: "nonce"
+    });
+  }
+}
+function validateIdTokenAuthorizedParty(client, claims) {
+  if (Array.isArray(claims.aud) && claims.aud.length !== 1) {
+    if (claims.azp === void 0) {
+      throw OPE('ID Token "aud" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: "aud" });
+    }
+    if (claims.azp !== client.client_id) {
+      throw OPE('unexpected ID Token "azp" (authorized party) claim value', JWT_CLAIM_COMPARISON, {
+        expected: client.client_id,
+        claims,
+        claim: "azp"
+      });
+    }
+  }
+}
+var expectNoNonce = /* @__PURE__ */ Symbol();
+var skipAuthTimeCheck = /* @__PURE__ */ Symbol();
+async function processAuthorizationCodeResponse(as, client, response, options) {
+  if (typeof options?.expectedNonce === "string" || typeof options?.maxAge === "number" || options?.requireIdToken) {
+    return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);
+  }
+  return processAuthorizationCodeOAuth2Response(as, client, response, options?.maxAge, options?.[jweDecrypt], options?.recognizedTokenTypes);
+}
+async function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {
+  const additionalRequiredClaims = [];
+  switch (expectedNonce) {
+    case void 0:
+      expectedNonce = expectNoNonce;
+      break;
+    case expectNoNonce:
+      break;
+    default:
+      assertString(expectedNonce, '"expectedNonce" argument');
+      additionalRequiredClaims.push("nonce");
+  }
+  maxAge = resolveIdTokenMaxAge(client, maxAge);
+  if (maxAge !== skipAuthTimeCheck) {
+    additionalRequiredClaims.push("auth_time");
+  }
+  const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);
+  assertString(result.id_token, '"response" body "id_token" property', INVALID_RESPONSE, {
+    body: result
+  });
+  const claims = getValidatedIdTokenClaims(result);
+  validateIdTokenAuthTime(client, claims, maxAge);
+  validateIdTokenNonce(claims, expectedNonce);
+  return result;
+}
+async function processAuthorizationCodeOAuth2Response(as, client, response, maxAge, decryptFn, recognizedTokenTypes) {
+  const result = await processGenericAccessTokenResponse(as, client, response, void 0, decryptFn, recognizedTokenTypes);
+  const claims = getValidatedIdTokenClaims(result);
+  if (claims) {
+    validateIdTokenAuthTime(client, claims, resolveIdTokenMaxAge(client, maxAge));
+    validateIdTokenNonce(claims, expectNoNonce);
+  }
+  return result;
+}
+var WWW_AUTHENTICATE_CHALLENGE = "OAUTH_WWW_AUTHENTICATE_CHALLENGE";
+var RESPONSE_BODY_ERROR = "OAUTH_RESPONSE_BODY_ERROR";
+var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
+var AUTHORIZATION_RESPONSE_ERROR = "OAUTH_AUTHORIZATION_RESPONSE_ERROR";
+var PARSE_ERROR = "OAUTH_PARSE_ERROR";
+var INVALID_RESPONSE = "OAUTH_INVALID_RESPONSE";
+var RESPONSE_IS_NOT_JSON = "OAUTH_RESPONSE_IS_NOT_JSON";
+var RESPONSE_IS_NOT_CONFORM = "OAUTH_RESPONSE_IS_NOT_CONFORM";
+var HTTP_REQUEST_FORBIDDEN = "OAUTH_HTTP_REQUEST_FORBIDDEN";
+var REQUEST_PROTOCOL_FORBIDDEN = "OAUTH_REQUEST_PROTOCOL_FORBIDDEN";
+var JWT_TIMESTAMP_CHECK = "OAUTH_JWT_TIMESTAMP_CHECK_FAILED";
+var JWT_CLAIM_COMPARISON = "OAUTH_JWT_CLAIM_COMPARISON_FAILED";
+var JSON_ATTRIBUTE_COMPARISON = "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED";
+var MISSING_SERVER_METADATA = "OAUTH_MISSING_SERVER_METADATA";
+var INVALID_SERVER_METADATA = "OAUTH_INVALID_SERVER_METADATA";
+function assertReadableResponse(response) {
+  if (response.bodyUsed) {
+    throw CodedTypeError('"response" body has been used already', ERR_INVALID_ARG_VALUE);
+  }
+}
+async function validateJwt(jws, checkAlg, clockSkew2, clockTolerance2, decryptJwt) {
+  let { 0: protectedHeader, 1: payload, length } = jws.split(".");
+  if (length === 5) {
+    if (decryptJwt !== void 0) {
+      jws = await decryptJwt(jws);
+      ({ 0: protectedHeader, 1: payload, length } = jws.split("."));
+    } else {
+      throw new UnsupportedOperationError("JWE decryption is not configured", { cause: jws });
+    }
+  }
+  if (length !== 3) {
+    throw OPE("Invalid JWT", INVALID_RESPONSE, jws);
+  }
+  let header;
+  try {
+    header = JSON.parse(buf(b64u(protectedHeader)));
+  } catch (cause) {
+    throw OPE("failed to parse JWT Header body as base64url encoded JSON", PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(header)) {
+    throw OPE("JWT Header must be a top level object", INVALID_RESPONSE, jws);
+  }
+  checkAlg(header);
+  if (header.crit !== void 0) {
+    throw new UnsupportedOperationError('no JWT "crit" header parameter extensions are supported', {
+      cause: { header }
+    });
+  }
+  let claims;
+  try {
+    claims = JSON.parse(buf(b64u(payload)));
+  } catch (cause) {
+    throw OPE("failed to parse JWT Payload body as base64url encoded JSON", PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(claims)) {
+    throw OPE("JWT Payload must be a top level object", INVALID_RESPONSE, jws);
+  }
+  const now = epochTime() + clockSkew2;
+  if (claims.exp !== void 0) {
+    if (typeof claims.exp !== "number") {
+      throw OPE('unexpected JWT "exp" (expiration time) claim type', INVALID_RESPONSE, { claims });
+    }
+    if (claims.exp <= now - clockTolerance2) {
+      throw OPE('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp', JWT_TIMESTAMP_CHECK, { claims, now, tolerance: clockTolerance2, claim: "exp" });
+    }
+  }
+  if (claims.iat !== void 0) {
+    if (typeof claims.iat !== "number") {
+      throw OPE('unexpected JWT "iat" (issued at) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  if (claims.iss !== void 0) {
+    if (typeof claims.iss !== "string") {
+      throw OPE('unexpected JWT "iss" (issuer) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  if (claims.nbf !== void 0) {
+    if (typeof claims.nbf !== "number") {
+      throw OPE('unexpected JWT "nbf" (not before) claim type', INVALID_RESPONSE, { claims });
+    }
+    if (claims.nbf > now + clockTolerance2) {
+      throw OPE('unexpected JWT "nbf" (not before) claim value', JWT_TIMESTAMP_CHECK, {
+        claims,
+        now,
+        tolerance: clockTolerance2,
+        claim: "nbf"
+      });
+    }
+  }
+  if (claims.aud !== void 0) {
+    if (typeof claims.aud !== "string" && !Array.isArray(claims.aud)) {
+      throw OPE('unexpected JWT "aud" (audience) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  return { header, claims, jwt: jws };
+}
+function checkSigningAlgorithm(client, issuer, fallback, header) {
+  if (client !== void 0) {
+    if (typeof client === "string" ? header.alg !== client : !client.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: client,
+        reason: "client configuration"
+      });
+    }
+    return;
+  }
+  if (Array.isArray(issuer)) {
+    if (!issuer.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: issuer,
+        reason: "authorization server metadata"
+      });
+    }
+    return;
+  }
+  if (fallback !== void 0) {
+    if (typeof fallback === "string" ? header.alg !== fallback : typeof fallback === "function" ? !fallback(header.alg) : !fallback.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: fallback,
+        reason: "default value"
+      });
+    }
+    return;
+  }
+  throw OPE('missing client or server configuration to verify used JWT "alg" header parameter', void 0, { client, issuer, fallback });
+}
+function getURLSearchParameter(parameters, name) {
+  const { 0: value, length } = parameters.getAll(name);
+  if (length > 1) {
+    throw OPE(`"${name}" parameter must be provided only once`, INVALID_RESPONSE);
+  }
+  return value;
+}
+var skipStateCheck = /* @__PURE__ */ Symbol();
+var expectNoState = /* @__PURE__ */ Symbol();
+function validateAuthResponse(as, client, parameters, expectedState) {
+  assertAs(as);
+  assertClient(client);
+  if (parameters instanceof URL) {
+    parameters = parameters.searchParams;
+  }
+  if (!(parameters instanceof URLSearchParams)) {
+    throw CodedTypeError('"parameters" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);
+  }
+  if (getURLSearchParameter(parameters, "response")) {
+    throw OPE('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()', INVALID_RESPONSE, { parameters });
+  }
+  const iss = getURLSearchParameter(parameters, "iss");
+  const state = getURLSearchParameter(parameters, "state");
+  if (!iss && as.authorization_response_iss_parameter_supported) {
+    throw OPE('response parameter "iss" (issuer) missing', INVALID_RESPONSE, { parameters });
+  }
+  if (iss && iss !== as.issuer) {
+    throw OPE('unexpected "iss" (issuer) response parameter value', INVALID_RESPONSE, {
+      expected: as.issuer,
+      parameters
+    });
+  }
+  switch (expectedState) {
+    case void 0:
+    case expectNoState:
+      if (state !== void 0) {
+        throw OPE('unexpected "state" response parameter encountered', INVALID_RESPONSE, {
+          expected: void 0,
+          parameters
+        });
+      }
+      break;
+    case skipStateCheck:
+      break;
+    default:
+      assertString(expectedState, '"expectedState" argument');
+      if (state !== expectedState) {
+        throw OPE(state === void 0 ? 'response parameter "state" missing' : 'unexpected "state" response parameter value', INVALID_RESPONSE, { expected: expectedState, parameters });
+      }
+  }
+  const error = getURLSearchParameter(parameters, "error");
+  if (error) {
+    throw new AuthorizationResponseError("authorization response from the server is an error", {
+      cause: parameters
+    });
+  }
+  const id_token = getURLSearchParameter(parameters, "id_token");
+  const token = getURLSearchParameter(parameters, "token");
+  if (id_token !== void 0 || token !== void 0) {
+    throw new UnsupportedOperationError("implicit and hybrid flows are not supported");
+  }
+  return brand(new URLSearchParams(parameters));
+}
+async function getResponseJsonBody(response, check = assertApplicationJson) {
+  let json;
+  try {
+    json = await response.json();
+  } catch (cause) {
+    check(response);
+    throw OPE('failed to parse "response" body as JSON', PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(json)) {
+    throw OPE('"response" body must be a top level object', INVALID_RESPONSE, { body: json });
+  }
+  return json;
+}
+var _nodiscoverycheck = /* @__PURE__ */ Symbol();
+var _expectedIssuer = /* @__PURE__ */ Symbol();
+
+// src/oauth-browser.ts
+function fetchFrom(fetchFn) {
+  return fetchFn ?? fetch;
+}
+function discoveryOptions(issuer, fetchFn) {
+  return {
+    algorithm: "oauth2",
+    [customFetch]: fetchFrom(fetchFn),
+    ...issuer.protocol === "http:" ? { [allowInsecureRequests]: true } : {}
+  };
+}
+async function discoverCliAuthorizationServer(input) {
+  const options = discoveryOptions(input.issuer, input.fetchFn);
+  const response = await discoveryRequest(input.issuer, options);
+  return processDiscoveryResponse(input.issuer, response);
+}
+function cliOAuthClient(mcpUrl) {
+  return {
+    client_id: cliClientMetadataUrl(mcpUrl),
+    token_endpoint_auth_method: "none"
+  };
+}
+async function buildCliAuthorizationUrl(input) {
+  if (!input.authorizationServer.authorization_endpoint) {
+    throw new Error("OAuth authorization server has no authorization_endpoint.");
+  }
+  const url = new URL(input.authorizationServer.authorization_endpoint);
+  url.searchParams.set("client_id", cliOAuthClient(input.mcpUrl).client_id);
+  url.searchParams.set(
+    "redirect_uri",
+    (input.redirectUri ?? cliRedirectUrl()).href
+  );
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", input.scope ?? defaultScopes.join(" "));
+  url.searchParams.set("code_challenge", input.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("resource", input.mcpUrl);
+  if (input.org !== void 0) {
+    url.searchParams.set("org", orgSlugFromFlag(input.org));
+  }
+  return url;
+}
+function insecure(issuer) {
+  return new URL(issuer).protocol === "http:" ? { [allowInsecureRequests]: true } : {};
+}
+async function exchangeAuthorizationCode(input) {
+  const client = cliOAuthClient(input.mcpUrl);
+  const params = validateAuthResponse(
+    input.authorizationServer,
+    client,
+    input.callback,
+    input.state
+  );
+  const resource = new URLSearchParams();
+  resource.set("resource", input.mcpUrl);
+  const response = await authorizationCodeGrantRequest(
+    input.authorizationServer,
+    client,
+    None(),
+    params,
+    input.redirectUri.href,
+    input.codeVerifier,
+    {
+      ...insecure(input.authorizationServer.issuer),
+      [customFetch]: fetchFrom(input.fetchFn),
+      additionalParameters: resource
+    }
+  );
+  const tokens = await processAuthorizationCodeResponse(
+    input.authorizationServer,
+    client,
+    response
+  );
+  return tokenSetFromResult(input.authorizationServer.issuer, tokens);
+}
+async function refreshOAuthTokens(input) {
+  const issuer = new URL(input.issuer);
+  const authorizationServer = await discoverCliAuthorizationServer({
+    issuer,
+    fetchFn: input.fetchFn
+  });
+  const client = cliOAuthClient(input.mcpUrl);
+  const response = await refreshTokenGrantRequest(
+    authorizationServer,
+    client,
+    None(),
+    input.refreshToken,
+    {
+      ...insecure(authorizationServer.issuer),
+      [customFetch]: fetchFrom(input.fetchFn)
+    }
+  );
+  const tokens = await processRefreshTokenResponse(
+    authorizationServer,
+    client,
+    response
+  );
+  return tokenSetFromResult(authorizationServer.issuer, tokens);
+}
+function tokenSetFromResult(issuer, tokens) {
+  return {
+    accessToken: tokens.access_token,
+    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+    tokenType: tokens.token_type ?? "bearer",
+    ...typeof tokens.expires_in === "number" ? { expiresIn: tokens.expires_in } : {},
+    ...tokens.scope ? { scope: tokens.scope } : {},
+    issuer
+  };
+}
+async function createPkcePair() {
+  const verifier = generateRandomCodeVerifier();
+  const challenge = await calculatePKCECodeChallenge(verifier);
+  return { verifier, challenge };
+}
+
+// src/auth.ts
+function isAccessTokenExpired(credentials, now = Date.now()) {
+  if (!credentials.expiresAt) return false;
+  return now + accessTokenSkewMs >= credentials.expiresAt;
+}
+function credentialsFromTokens(input) {
+  const now = input.now ?? Date.now();
+  const expiresAt = typeof input.tokens.expires_in === "number" ? now + input.tokens.expires_in * 1e3 : input.previous?.expiresAt;
+  const org = input.org ?? input.previous?.org;
+  return {
+    version: 1,
+    mcpUrl: input.mcpUrl,
+    ...org ? { org } : {},
+    resource: input.resource,
+    authorizationServerUrl: input.authorizationServerUrl,
+    clientId: input.client.client_id,
+    clientSecret: "client_secret" in input.client ? input.client.client_secret : input.previous?.clientSecret,
+    accessToken: input.tokens.access_token,
+    refreshToken: input.tokens.refresh_token ?? input.previous?.refreshToken,
+    tokenType: input.tokens.token_type ?? "bearer",
+    expiresAt,
+    scope: input.tokens.scope ?? input.previous?.scope
+  };
+}
+function deviceCredentials(input) {
+  const org = input.org ?? input.previous?.org;
+  return {
+    version: 1,
+    mcpUrl: input.mcpUrl,
+    ...org ? { org } : {},
+    resource: input.mcpUrl,
+    authorizationServerUrl: input.authorizationServerUrl,
+    clientId: new URL(
+      "/oauth/cli-client-metadata.json",
+      input.authorizationServerUrl
+    ).href,
+    accessToken: input.token,
+    tokenType: "bearer",
+    expiresAt: input.expiresAt,
+    scope: input.scopes.join(" ")
+  };
+}
+async function mintDeviceToken(input) {
+  const minted = await openApiRequest({
+    token: input.oauthAccessToken,
+    apiUrl: input.apiUrl,
+    fetchFn: input.fetchFn,
+    method: "POST",
+    path: "v1/tokens/device",
+    body: { lifetime: input.lifetime, name: "kody-cli" }
+  });
+  if (!minted || typeof minted !== "object" || Array.isArray(minted)) {
+    throw new Error("Device token mint returned no token.");
+  }
+  const record = minted;
+  if (typeof record.token !== "string" || !record.token.startsWith("kody_at_")) {
+    throw new Error("Device token mint did not return a kody_at_ token.");
+  }
+  const expiresAt = typeof record.expires_at === "string" ? Date.parse(record.expires_at) : void 0;
+  const scopes = Array.isArray(record.scopes) ? record.scopes.filter(
+    (scope) => typeof scope === "string"
+  ) : [];
+  const loginOrg = typeof record.login_org?.slug === "string" && record.login_org.slug.trim() ? record.login_org.slug.trim() : void 0;
+  return {
+    token: record.token,
+    ...Number.isFinite(expiresAt) ? { expiresAt } : {},
+    scopes,
+    ...loginOrg ? { loginOrg } : {}
+  };
+}
+async function refreshStoredCredentials(input) {
+  const { credentials } = input;
+  if (isScopedApiToken(credentials.accessToken)) {
+    if (!isAccessTokenExpired(credentials, input.now)) return credentials;
+    const slid = await adoptSlidingDeviceExpiry(input);
+    if (slid) return slid;
+    throw new Error("Stored API token expired. Run `kody login`.");
+  }
+  if (!credentials.refreshToken) {
+    throw new Error("No refresh token is stored. Run `kody login`.");
+  }
+  const refreshed = await refreshOAuthTokens({
+    issuer: credentials.authorizationServerUrl,
+    mcpUrl: credentials.mcpUrl,
+    refreshToken: credentials.refreshToken,
+    fetchFn: input.fetchFn
+  });
+  const apiUrl = input.apiUrl ?? defaultApiUrl;
+  const device = await mintDeviceToken({
+    apiUrl,
+    oauthAccessToken: refreshed.accessToken,
+    lifetime: "long",
+    fetchFn: input.fetchFn
+  });
+  const next = deviceCredentials({
+    mcpUrl: credentials.mcpUrl,
+    apiUrl,
+    authorizationServerUrl: refreshed.issuer,
+    token: device.token,
+    expiresAt: device.expiresAt,
+    scopes: device.scopes,
+    previous: credentials,
+    org: credentials.org ?? device.loginOrg
+  });
+  saveCredentials(next, input.backend, input.resolution, { activate: false });
+  return next;
+}
+async function resolvePendingOrgSlug(input) {
+  const mcpUrl = input.mcpUrl ?? defaultMcpUrl;
+  const snapshot = loadCredentialStore(mcpUrl, input.backend, input.resolution);
+  if (!snapshot?.pending) return snapshot?.activeOrg ?? null;
+  let pending = loadPendingCredentials(mcpUrl, input.backend, input.resolution);
+  if (!pending) return snapshot.activeOrg ?? null;
+  if (isAccessTokenExpired(pending, input.now)) {
+    if (!pending.refreshToken) return null;
+    try {
+      pending = await refreshStoredCredentials({
+        credentials: pending,
+        backend: input.backend,
+        resolution: input.resolution,
+        now: input.now,
+        fetchFn: input.fetchFn,
+        apiUrl: input.apiUrl
+      });
+    } catch {
+      return null;
+    }
+  }
+  const discover = input.discoverOrg ?? discoverOrgSlugFromAccessToken;
+  try {
+    const slug = await discover({
+      mcpUrl,
+      accessToken: pending.accessToken,
+      fetchFn: input.fetchFn
+    });
+    promotePendingOrg(mcpUrl, slug, input.backend, input.resolution);
+    return slug;
+  } catch {
+    return null;
+  }
+}
+async function ensureFreshCredentials(input) {
+  const mcpUrl = input.mcpUrl ?? defaultMcpUrl;
+  await resolvePendingOrgSlug({
+    mcpUrl,
+    apiUrl: input.apiUrl,
+    backend: input.backend,
+    resolution: input.resolution,
+    now: input.now,
+    fetchFn: input.fetchFn,
+    discoverOrg: input.discoverOrg
+  });
+  const credentials = loadCredentials(mcpUrl, input.backend, input.resolution, {
+    org: input.org
+  });
+  if (!credentials) {
+    if (input.org) {
+      throw new Error(
+        `No login stored for org "${input.org}". Run \`kody login --org ${input.org}\` (or \`kody org use ${input.org}\` after logging in).`
+      );
+    }
+    throw new Error(missingCliAuthMessage());
+  }
+  if (!isAccessTokenExpired(credentials, input.now)) {
+    return credentials;
+  }
+  return await refreshStoredCredentials({
+    credentials,
+    backend: input.backend,
+    resolution: input.resolution,
+    now: input.now,
+    fetchFn: input.fetchFn,
+    apiUrl: input.apiUrl
+  });
+}
+async function ensureOpenApiCredentials(input) {
+  const credentials = await ensureFreshCredentials(input);
+  if (isScopedApiToken(credentials.accessToken)) return credentials;
+  return refreshStoredCredentials({
+    credentials,
+    backend: input.backend,
+    resolution: input.resolution,
+    now: input.now,
+    fetchFn: input.fetchFn,
+    apiUrl: input.apiUrl
+  });
+}
+async function adoptSlidingDeviceExpiry(input) {
+  const { credentials } = input;
+  try {
+    const current = await openApiGet({
+      token: credentials.accessToken,
+      apiUrl: input.apiUrl ?? defaultApiUrl,
+      path: "v1/tokens/current",
+      fetchFn: input.fetchFn,
+      ...credentials.org ? { org: credentials.org } : {}
+    });
+    if (!current || typeof current !== "object" || Array.isArray(current)) {
+      return null;
+    }
+    const expiresAt = Date.parse(
+      typeof current.expires_at === "string" ? current.expires_at : ""
+    );
+    const now = input.now ?? Date.now();
+    if (!Number.isFinite(expiresAt) || expiresAt <= now) return null;
+    const next = { ...credentials, expiresAt };
+    saveCredentials(next, input.backend, input.resolution, { activate: false });
+    return next;
+  } catch (error) {
+    if (error instanceof OpenApiError && (error.status === 401 || error.status === 403)) {
+      return null;
+    }
+    throw error;
+  }
+}
+function startCallbackServer(redirectUri) {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    const port = Number(redirectUri.port);
+    server.listen(port, redirectUri.hostname, () => resolve(server));
+    server.on("error", (error) => {
+      if ("code" in error && error.code === "EADDRINUSE") {
+        reject(
+          new Error(
+            `Login callback port ${port} is in use. Stop the other listener and retry.`
+          )
+        );
+        return;
+      }
+      reject(error);
+    });
+  });
+}
+function sendCallbackHtml(response, status, page) {
+  if (response.headersSent) return;
+  response.writeHead(status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  response.end(renderLoginCallbackPage(page));
+}
+function waitForCallback(input) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let pendingResponse;
+    const closeServer = () => {
+      input.server.close();
+    };
+    const rejectOnce = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      closeServer();
+      reject(error);
+    };
+    const resolveOnce = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      if (pendingResponse && !pendingResponse.headersSent) {
+        sendCallbackHtml(pendingResponse, 408, {
+          kind: "error",
+          error: "expired"
+        });
+      }
+      rejectOnce(new Error("Timed out waiting for the browser login."));
+    }, input.timeoutMs);
+    input.server.on(
+      "request",
+      (request, response) => {
+        try {
+          const url = new URL(request.url ?? "/", input.redirectUri);
+          if (url.pathname !== input.redirectUri.pathname) {
+            response.writeHead(404).end("Not found");
+            return;
+          }
+          const error = url.searchParams.get("error");
+          if (error) {
+            const description = url.searchParams.get("error_description") ?? "";
+            const kind = loginCallbackErrorFromOAuthError(error);
+            sendCallbackHtml(response, 400, { kind: "error", error: kind });
+            rejectOnce(new Error(description || error));
+            return;
+          }
+          const state = url.searchParams.get("state");
+          const code = url.searchParams.get("code");
+          const iss = url.searchParams.get("iss") ?? void 0;
+          if (state !== input.expectedState || !code) {
+            const kind = state && state !== input.expectedState ? "state_mismatch" : "failed";
+            sendCallbackHtml(response, 400, { kind: "error", error: kind });
+            rejectOnce(new Error("OAuth callback missing code or state."));
+            return;
+          }
+          pendingResponse = response;
+          resolveOnce({
+            code,
+            ...iss ? { iss } : {},
+            complete(page) {
+              sendCallbackHtml(
+                response,
+                page.kind === "success" ? 200 : 400,
+                page
+              );
+              closeServer();
+            }
+          });
+        } catch (error) {
+          rejectOnce(redactError(error));
+        }
+      }
+    );
+  });
+}
+async function login(options = {}) {
+  const mcpUrl = options.mcpUrl ?? defaultMcpUrl;
+  const apiUrl = options.apiUrl ?? defaultApiUrl;
+  const orgHint = options.org === void 0 ? void 0 : orgSlugFromFlag(options.org);
+  const redirectUri = cliRedirectUrl();
+  const expectedState = crypto.randomUUID();
+  const issuer = new URL(mcpUrl).origin;
+  const authorizationServer = await discoverCliAuthorizationServer({
+    issuer: new URL(issuer),
+    fetchFn: options.fetchFn
+  });
+  const pkce = await createPkcePair();
+  const authorizationUrl = await buildCliAuthorizationUrl({
+    authorizationServer,
+    mcpUrl,
+    redirectUri,
+    state: expectedState,
+    codeChallenge: pkce.challenge,
+    ...orgHint ? { org: orgHint } : {}
+  });
+  const server = await startCallbackServer(redirectUri);
+  options.onAuthorizationUrl?.(authorizationUrl);
+  if (options.openBrowser !== false) {
+    await openUrl(authorizationUrl.href);
+  }
+  let completeCallback;
+  try {
+    const callback = await waitForCallback({
+      server,
+      redirectUri,
+      expectedState,
+      timeoutMs: options.timeoutMs ?? loginTimeoutMs
+    });
+    completeCallback = callback.complete;
+    const callbackUrl = new URL(redirectUri.href);
+    callbackUrl.searchParams.set("code", callback.code);
+    callbackUrl.searchParams.set("state", expectedState);
+    if (callback.iss) callbackUrl.searchParams.set("iss", callback.iss);
+    const tokens = await exchangeAuthorizationCode({
+      authorizationServer,
+      mcpUrl,
+      redirectUri,
+      callback: callbackUrl,
+      state: expectedState,
+      codeVerifier: pkce.verifier,
+      fetchFn: options.fetchFn
+    });
+    const device = await mintDeviceToken({
+      apiUrl,
+      oauthAccessToken: tokens.accessToken,
+      lifetime: options.lifetime ?? "long",
+      fetchFn: options.fetchFn
+    });
+    let org = device.loginOrg ?? orgHint;
+    let account;
+    const discover = options.discoverIdentity ?? discoverLoginIdentity;
+    try {
+      const boundOrg = org;
+      const identity = await discover({
+        mcpUrl,
+        apiUrl,
+        accessToken: device.token,
+        fetchFn: options.fetchFn,
+        ...boundOrg ? { org: boundOrg } : {}
+      });
+      if (orgHint && identity.org !== orgHint) {
+        completeCallback?.({ kind: "error", error: "failed" });
+        completeCallback = void 0;
+        throw new Error(
+          `Login was bound to org "${identity.org}" but \`--org ${orgHint}\` was requested.`
+        );
+      }
+      org = identity.org;
+      account = identity.account;
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("Login was bound to org ")) {
+        throw error;
+      }
+      if (!org) {
+        const existing = loadCredentialStore(
+          mcpUrl,
+          options.backend,
+          options.resolution
+        );
+        if (existing && Object.keys(existing.orgs).length > 0) {
+          completeCallback?.({ kind: "error", error: "failed" });
+          completeCallback = void 0;
+          throw new Error(
+            "Could not determine the organization for this login. Re-run with `kody login --org <slug>`."
+          );
+        }
+      }
+    }
+    const credentials = deviceCredentials({
+      mcpUrl,
+      apiUrl,
+      authorizationServerUrl: tokens.issuer,
+      token: device.token,
+      expiresAt: device.expiresAt,
+      scopes: device.scopes,
+      org
+    });
+    const saved = saveCredentials(
+      credentials,
+      options.backend,
+      options.resolution
+    );
+    completeCallback?.({
+      kind: "success",
+      ...org ? { org } : {},
+      ...account ? { account } : {}
+    });
+    completeCallback = void 0;
+    return {
+      credentials,
+      authorizationUrl,
+      backendKind: saved.backend.kind,
+      backendPath: saved.backend.path,
+      ...org ? { org } : {},
+      ...account ? { account } : {}
+    };
+  } catch (error) {
+    completeCallback?.({ kind: "error", error: "failed" });
+    server.close();
+    throw redactError(error);
+  }
+}
+
+export {
+  isAccessTokenExpired,
+  credentialsFromTokens,
+  refreshStoredCredentials,
+  resolvePendingOrgSlug,
+  ensureFreshCredentials,
+  ensureOpenApiCredentials,
+  login
+};
+//# sourceMappingURL=chunk-5ZBJAP6G.js.map