@pasko70/pibo 1.10.0 → 1.11.0

package/dist/apps/chat-vscode-web/assets/index-Bf2JvJ9z.css

@@ -0,0 +1,2 @@
+/*! tailwindcss v4.2.4 | MIT License | https://tailwindcss.com */
+@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-border-style:solid;--tw-font-weight:initial;--tw-tracking:initial;--tw-shadow:0 0 #0000;--tw-shadow-color:initial;--tw-shadow-alpha:100%;--tw-inset-shadow:0 0 #0000;--tw-inset-shadow-color:initial;--tw-inset-shadow-alpha:100%;--tw-ring-color:initial;--tw-ring-shadow:0 0 #0000;--tw-inset-ring-color:initial;--tw-inset-ring-shadow:0 0 #0000;--tw-ring-inset:initial;--tw-ring-offset-width:0px;--tw-ring-offset-color:#fff;--tw-ring-offset-shadow:0 0 #0000}}}@layer theme{:root,:host{--font-sans:ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";--font-mono:ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;--color-emerald-500:oklch(69.6% .17 162.48);--color-cyan-400:oklch(78.9% .154 211.53);--color-rose-200:oklch(89.2% .058 10.001);--color-rose-300:oklch(81% .117 11.638);--color-rose-500:oklch(64.5% .246 16.439);--color-rose-700:oklch(51.4% .222 16.935);--color-rose-900:oklch(41% .159 10.272);--color-slate-200:oklch(92.9% .013 255.508);--color-slate-300:oklch(86.9% .022 252.894);--color-slate-400:oklch(70.4% .04 256.788);--color-slate-500:oklch(55.4% .046 257.417);--color-slate-700:oklch(37.2% .044 257.287);--color-slate-800:oklch(27.9% .041 260.031);--spacing:.25rem;--text-xs:.75rem;--text-xs--line-height:calc(1 / .75);--text-sm:.875rem;--text-sm--line-height:calc(1.25 / .875);--font-weight-semibold:600;--tracking-wider:.05em;--default-font-family:var(--font-sans);--default-mono-font-family:var(--font-mono)}}@layer base{*,:after,:before,::backdrop{box-sizing:border-box;border:0 solid;margin:0;padding:0}::file-selector-button{box-sizing:border-box;border:0 solid;margin:0;padding:0}html,:host{-webkit-text-size-adjust:100%;tab-size:4;line-height:1.5;font-family:var(--default-font-family,ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji");font-feature-settings:var(--default-font-feature-settings,normal);font-variation-settings:var(--default-font-variation-settings,normal);-webkit-tap-highlight-color:transparent}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:var(--default-mono-font-family,ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace);font-feature-settings:var(--default-mono-font-feature-settings,normal);font-variation-settings:var(--default-mono-font-variation-settings,normal);font-size:1em}small{font-size:80%}sub,sup{vertical-align:baseline;font-size:75%;line-height:0;position:relative}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}:-moz-focusring{outline:auto}progress{vertical-align:baseline}summary{display:list-item}ol,ul,menu{list-style:none}img,svg,video,canvas,audio,iframe,embed,object{vertical-align:middle;display:block}img,video{max-width:100%;height:auto}button,input,select,optgroup,textarea{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}::file-selector-button{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}:where(select:is([multiple],[size])) optgroup{font-weight:bolder}:where(select:is([multiple],[size])) optgroup option{padding-inline-start:20px}::file-selector-button{margin-inline-end:4px}::placeholder{opacity:1}@supports (not ((-webkit-appearance:-apple-pay-button))) or (contain-intrinsic-size:1px){::placeholder{color:currentColor}@supports (color:color-mix(in lab, red, red)){::placeholder{color:color-mix(in oklab, currentcolor 50%, transparent)}}}textarea{resize:vertical}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-date-and-time-value{min-height:1lh;text-align:inherit}::-webkit-datetime-edit{display:inline-flex}::-webkit-datetime-edit-fields-wrapper{padding:0}::-webkit-datetime-edit{padding-block:0}::-webkit-datetime-edit-year-field{padding-block:0}::-webkit-datetime-edit-month-field{padding-block:0}::-webkit-datetime-edit-day-field{padding-block:0}::-webkit-datetime-edit-hour-field{padding-block:0}::-webkit-datetime-edit-minute-field{padding-block:0}::-webkit-datetime-edit-second-field{padding-block:0}::-webkit-datetime-edit-millisecond-field{padding-block:0}::-webkit-datetime-edit-meridiem-field{padding-block:0}::-webkit-calendar-picker-indicator{line-height:1}:-moz-ui-invalid{box-shadow:none}button,input:where([type=button],[type=reset],[type=submit]){appearance:button}::file-selector-button{appearance:button}::-webkit-inner-spin-button{height:auto}::-webkit-outer-spin-button{height:auto}[hidden]:where(:not([hidden=until-found])){display:none!important}}@layer components;@layer utilities{.absolute{position:absolute}.start{inset-inline-start:var(--spacing)}.z-10{z-index:10}.container{width:100%}@media (width>=40rem){.container{max-width:40rem}}@media (width>=48rem){.container{max-width:48rem}}@media (width>=64rem){.container{max-width:64rem}}@media (width>=80rem){.container{max-width:80rem}}@media (width>=96rem){.container{max-width:96rem}}.mt-0\.5{margin-top:calc(var(--spacing) * .5)}.mt-1{margin-top:calc(var(--spacing) * 1)}.mt-12{margin-top:calc(var(--spacing) * 12)}.mb-2{margin-bottom:calc(var(--spacing) * 2)}.-ml-20{margin-left:calc(var(--spacing) * -20)}.ml-3{margin-left:calc(var(--spacing) * 3)}.block{display:block}.flex{display:flex}.inline-block{display:inline-block}.inline-flex{display:inline-flex}.h-1\.5{height:calc(var(--spacing) * 1.5)}.h-7{height:calc(var(--spacing) * 7)}.h-full{height:100%}.min-h-0{min-height:calc(var(--spacing) * 0)}.w-1\.5{width:calc(var(--spacing) * 1.5)}.w-7{width:calc(var(--spacing) * 7)}.w-full{width:100%}.max-w-\[180px\]{max-width:180px}.min-w-0{min-width:calc(var(--spacing) * 0)}.flex-1{flex:1}.shrink-0{flex-shrink:0}.flex-col{flex-direction:column}.items-center{align-items:center}.justify-center{justify-content:center}.gap-1{gap:calc(var(--spacing) * 1)}.gap-2{gap:calc(var(--spacing) * 2)}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.overflow-x-auto{overflow-x:auto}.rounded{border-radius:.25rem}.rounded-full{border-radius:3.40282e38px}.border{border-style:var(--tw-border-style);border-width:1px}.border-b{border-bottom-style:var(--tw-border-style);border-bottom-width:1px}.border-\[\#11a4d4\]{border-color:#11a4d4}.border-rose-700{border-color:var(--color-rose-700)}.border-slate-700{border-color:var(--color-slate-700)}.border-slate-800{border-color:var(--color-slate-800)}.bg-\[\#0a1418\]{background-color:#0a1418}.bg-\[\#0c1820\]{background-color:#0c1820}.bg-\[\#102834\]{background-color:#102834}.bg-cyan-400{background-color:var(--color-cyan-400)}.bg-emerald-500{background-color:var(--color-emerald-500)}.bg-rose-500{background-color:var(--color-rose-500)}.bg-rose-900\/40{background-color:#8b083666}@supports (color:color-mix(in lab, red, red)){.bg-rose-900\/40{background-color:color-mix(in oklab, var(--color-rose-900) 40%, transparent)}}.bg-slate-500{background-color:var(--color-slate-500)}.px-1{padding-inline:calc(var(--spacing) * 1)}.px-2{padding-inline:calc(var(--spacing) * 2)}.px-3{padding-inline:calc(var(--spacing) * 3)}.py-1{padding-block:calc(var(--spacing) * 1)}.py-1\.5{padding-block:calc(var(--spacing) * 1.5)}.py-2{padding-block:calc(var(--spacing) * 2)}.py-3{padding-block:calc(var(--spacing) * 3)}.text-left{text-align:left}.font-mono{font-family:var(--font-mono)}.text-sm{font-size:var(--text-sm);line-height:var(--tw-leading,var(--text-sm--line-height))}.text-xs{font-size:var(--text-xs);line-height:var(--tw-leading,var(--text-xs--line-height))}.text-\[10px\]{font-size:10px}.font-semibold{--tw-font-weight:var(--font-weight-semibold);font-weight:var(--font-weight-semibold)}.tracking-wider{--tw-tracking:var(--tracking-wider);letter-spacing:var(--tracking-wider)}.text-rose-200{color:var(--color-rose-200)}.text-rose-300{color:var(--color-rose-300)}.text-slate-200{color:var(--color-slate-200)}.text-slate-300{color:var(--color-slate-300)}.text-slate-400{color:var(--color-slate-400)}.text-slate-500{color:var(--color-slate-500)}.uppercase{text-transform:uppercase}.underline{text-decoration-line:underline}.shadow-lg{--tw-shadow:0 10px 15px -3px var(--tw-shadow-color,#0000001a), 0 4px 6px -4px var(--tw-shadow-color,#0000001a);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}@media (hover:hover){.hover\:border-\[\#11a4d4\]:hover{border-color:#11a4d4}.hover\:border-slate-500:hover{border-color:var(--color-slate-500)}.hover\:bg-\[\#102834\]:hover{background-color:#102834}.hover\:bg-rose-900\/30:hover{background-color:#8b08364d}@supports (color:color-mix(in lab, red, red)){.hover\:bg-rose-900\/30:hover{background-color:color-mix(in oklab, var(--color-rose-900) 30%, transparent)}}.hover\:text-\[\#11a4d4\]:hover{color:#11a4d4}.hover\:text-slate-200:hover{color:var(--color-slate-200)}}}:root{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark;scrollbar-color:#334155 #101d22}html,body,#root{height:100%}body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background:#101d22;margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Helvetica Neue,sans-serif}code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.session-signal{display:inline-block;box-shadow:0 0 #64748b00}.session-signal-idle{background:#475569}.session-signal-running{background:#0bda57;animation:1.9s ease-in-out infinite session-signal-slow-pulse}.session-signal-unread{background:#38bdf8;animation:.85s ease-in-out infinite session-signal-fast-pulse}.session-signal-error{background:#ef4444;animation:.55s ease-in-out infinite session-signal-error-blink}@keyframes session-signal-slow-pulse{0%,to{transform:scale(.95);box-shadow:0 0 #0bda5738}50%{transform:scale(1.15);box-shadow:0 0 0 5px #0bda5700}}@keyframes session-signal-fast-pulse{0%,to{transform:scale(.9);box-shadow:0 0 #38bdf861}50%{transform:scale(1.25);box-shadow:0 0 0 6px #38bdf800}}@keyframes session-signal-error-blink{0%,to{opacity:1;transform:scale(1.15);box-shadow:0 0 #ef444473}50%{opacity:.45;transform:scale(.9);box-shadow:0 0 0 6px #ef444400}}.compact-terminal-working-label{color:#737373;vertical-align:baseline;width:10ch;font-size:.92em;display:inline-block}.model-response-markdown{color:#dbe7e8;overflow-wrap:anywhere}.model-response-markdown>:first-child{margin-top:0}.model-response-markdown>:last-child{margin-bottom:0}.model-response-markdown p{margin:0 0 .85rem}.model-response-markdown h1,.model-response-markdown h2,.model-response-markdown h3,.model-response-markdown h4{color:#f8fafc;letter-spacing:0;margin:1.1rem 0 .45rem;font-weight:700;line-height:1.25}.model-response-markdown h1{font-size:1.15rem}.model-response-markdown h2{font-size:1.05rem}.model-response-markdown h3,.model-response-markdown h4{font-size:.95rem}.model-response-markdown a{color:#42c7ec;text-underline-offset:3px;-webkit-text-decoration:underline #42c7ec73;text-decoration:underline #42c7ec73}.model-response-markdown a:hover{color:#7dd3fc;text-decoration-color:currentColor}.model-response-markdown strong{color:#f8fafc;font-weight:700}.model-response-markdown del{color:#94a3b8}.model-response-markdown ul,.model-response-markdown ol{margin:0 0 .95rem;padding-left:1.25rem;list-style-position:outside}.model-response-markdown ul{list-style-type:disc}.model-response-markdown ol{list-style-type:decimal}.model-response-markdown ul ul,.model-response-markdown ol ul{margin:.25rem 0;list-style-type:circle}.model-response-markdown ul ol,.model-response-markdown ol ol{margin:.25rem 0;list-style-type:lower-alpha}.model-response-markdown li{margin:.25rem 0;padding-left:.15rem}.model-response-markdown li::marker{color:#11a4d4}.model-response-markdown blockquote{color:#cbd5e1;background:#0bda5712;border-left:2px solid #0bda57;margin:.95rem 0;padding:.55rem .85rem}.model-response-markdown hr{border:0;border-top:1px solid #334155cc;margin:1rem 0}.model-response-markdown table{border-collapse:collapse;border:1px solid #334155e6;border-radius:3px;width:max-content;max-width:100%;margin:1rem 0;font-size:.82rem;display:block;overflow-x:auto}.model-response-markdown th,.model-response-markdown td{text-align:left;vertical-align:top;border:1px solid #334155cc;padding:.45rem .6rem}.model-response-markdown th{color:#e2f6fb;background:#11a4d41f;font-weight:700}.model-response-markdown td{color:#dbe7e8;background:#0e11166b}.model-response-markdown :not(pre)>code{color:#11a4d4;background:#111a1f;border:1px solid #e2e8f02e;border-radius:3px;padding:.1rem .3rem;font-size:.86em}.model-response-markdown pre{color:#d1d5db;background:#0e1116;border:1px solid #334155e6;border-left:2px solid #0bda57;border-radius:2px;margin:.95rem 0;padding:.85rem;font-size:.78rem;line-height:1.55;overflow-x:auto}.model-response-markdown pre code{color:inherit;font-size:inherit;background:0 0}.compact-terminal-markdown{color:#d4d4d4;overflow-wrap:anywhere;word-break:break-word;font-size:12px;line-height:1.45}.compact-terminal-markdown>:first-child{margin-top:0}.compact-terminal-markdown>:last-child{margin-bottom:0}.compact-terminal-markdown p{margin:0 0 .55rem}.compact-terminal-reasoning{color:#c7b27a}.compact-terminal-reasoning p{margin-bottom:.35rem}.compact-terminal-reasoning li::marker{color:#f59e0b}.compact-terminal-markdown h1,.compact-terminal-markdown h2,.compact-terminal-markdown h3,.compact-terminal-markdown h4{color:#f3f4f6;margin:.8rem 0 .35rem;font-size:.95rem;line-height:1.3}.compact-terminal-markdown a{color:#38bdf8}.compact-terminal-markdown ul,.compact-terminal-markdown ol{margin:0 0 .55rem;padding-left:1.35rem;list-style-position:outside}.compact-terminal-markdown ul{list-style-type:disc}.compact-terminal-markdown ol{list-style-type:decimal}.compact-terminal-markdown ul ul,.compact-terminal-markdown ol ul{margin:.2rem 0;list-style-type:circle}.compact-terminal-markdown ul ol,.compact-terminal-markdown ol ol{margin:.2rem 0;list-style-type:lower-alpha}.compact-terminal-markdown li{margin:.15rem 0;padding-left:.1rem}.compact-terminal-markdown li::marker{color:#38bdf8}.compact-terminal-markdown li>p{margin:.15rem 0}.compact-terminal-markdown input[type=checkbox]{vertical-align:-.12em;accent-color:#38bdf8;margin:0 .45rem 0 -1.15rem}.compact-terminal-markdown blockquote{color:#d4d4d4;background:#38bdf814;border-left:1px solid #38bdf8;margin:.6rem 0;padding:.45rem .7rem}.compact-terminal-markdown :not(pre)>code{color:#38bdf8;background:#161616;border:1px solid #5a5a5a99;border-radius:2px;padding:.05rem .25rem}.compact-terminal-markdown pre{color:#d4d4d4;background:#111;border:1px solid #2a2a2a;max-width:100%;margin:.65rem 0;padding:.65rem .8rem;font-size:.78rem;line-height:1.5;overflow-x:auto}.compact-terminal-markdown table{border-collapse:collapse;max-width:100%;display:block;overflow-x:auto}.compact-terminal-markdown th,.compact-terminal-markdown td{vertical-align:top;border:1px solid #2a2a2a;padding:.25rem .4rem}.compact-terminal-markdown th{color:#f3f4f6;background:#161616}.compact-terminal-markdown .token.comment,.model-response-markdown .token.comment,.compact-terminal-markdown .token.prolog,.model-response-markdown .token.prolog,.compact-terminal-markdown .token.doctype,.model-response-markdown .token.doctype,.compact-terminal-markdown .token.cdata,.model-response-markdown .token.cdata{color:#737373}.compact-terminal-markdown .token.punctuation,.model-response-markdown .token.punctuation{color:#94a3b8}.compact-terminal-markdown .token.property,.model-response-markdown .token.property,.compact-terminal-markdown .token.tag,.model-response-markdown .token.tag,.compact-terminal-markdown .token.boolean,.model-response-markdown .token.boolean,.compact-terminal-markdown .token.number,.model-response-markdown .token.number,.compact-terminal-markdown .token.constant,.model-response-markdown .token.constant,.compact-terminal-markdown .token.symbol,.model-response-markdown .token.symbol{color:#60a5fa}.compact-terminal-markdown .token.selector,.model-response-markdown .token.selector,.compact-terminal-markdown .token.attr-name,.model-response-markdown .token.attr-name,.compact-terminal-markdown .token.string,.model-response-markdown .token.string,.compact-terminal-markdown .token.char,.model-response-markdown .token.char,.compact-terminal-markdown .token.builtin,.model-response-markdown .token.builtin{color:#22c55e}.compact-terminal-markdown .token.operator,.model-response-markdown .token.operator,.compact-terminal-markdown .token.entity,.model-response-markdown .token.entity,.compact-terminal-markdown .token.url,.model-response-markdown .token.url,.compact-terminal-markdown .token.variable,.model-response-markdown .token.variable{color:#facc15}.compact-terminal-markdown .token.atrule,.model-response-markdown .token.atrule,.compact-terminal-markdown .token.attr-value,.model-response-markdown .token.attr-value,.compact-terminal-markdown .token.function,.model-response-markdown .token.function,.compact-terminal-markdown .token.class-name,.model-response-markdown .token.class-name{color:#38bdf8}.compact-terminal-markdown .token.keyword,.model-response-markdown .token.keyword{color:#d946ef}.compact-terminal-markdown .token.regex,.model-response-markdown .token.regex,.compact-terminal-markdown .token.important,.model-response-markdown .token.important{color:#fb923c}.compact-terminal-markdown .token.deleted,.model-response-markdown .token.deleted{color:#ef4444}.compact-terminal-markdown .token.inserted,.model-response-markdown .token.inserted{color:#22c55e}.compact-terminal-json{--w-rjv-background-color:transparent;--w-rjv-border-left:#2a2a2a;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.compact-terminal-function-call{overflow-wrap:anywhere;word-break:break-word}.compact-terminal-json-toggle{font:inherit;cursor:pointer;background:0 0;border:0;margin:0;padding:0}.compact-terminal-json-toggle:hover{text-underline-offset:2px;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}.compact-terminal-json-caret{color:#a3a3a3;width:.75em;text-decoration:none;display:inline-block}.context-files-view .mdxeditor{--baseBg:#151f24;--baseBorderColor:#334155;--baseTextColor:#dbe7e8;--accentBg:#11a4d42e;--accentTextColor:#f8fafc;--accentBaseColor:#11a4d4;--basePageBg:transparent;color:#dbe7e8;flex-direction:column;min-height:100%;display:flex}.context-files-view .mdxeditor-toolbar{z-index:2;background:#151f24;border-bottom:1px solid #1e293b;position:sticky;top:0;overflow-x:auto}.context-files-view .mdxeditor-toolbar [role=toolbar]{gap:.3rem;padding:.45rem .55rem}.context-files-view .mdxeditor-root-contenteditable,.context-files-mdx-content{color:#dbe7e8;overflow-wrap:anywhere;word-break:break-word;width:100%;min-width:0;min-height:calc(100vh - 14rem);padding:1.15rem 1.25rem 5rem}.context-files-mdx-content h1,.context-files-mdx-content h2,.context-files-mdx-content h3,.context-files-mdx-content h4,.context-files-mdx-content h5,.context-files-mdx-content h6{color:#f8fafc;margin:1.2rem 0 .55rem;line-height:1.2}.context-files-mdx-content h1{margin-top:0;font-size:1.6rem}.context-files-mdx-content h2{font-size:1.25rem}.context-files-mdx-content h3{font-size:1.05rem}.context-files-mdx-content ul,.context-files-mdx-content ol{margin:0 0 1rem;padding-left:1.4rem}.context-files-mdx-content blockquote{color:#cbd5e1;border-left:4px solid #11a4d473;margin-left:0;padding-left:.9rem}.context-files-mdx-content table{border-collapse:collapse;width:100%;display:block;overflow-x:auto}.context-files-mdx-content th,.context-files-mdx-content td{border:1px solid #334155;padding:.5rem .6rem}.context-files-view .cm-editor,.context-files-view .cm-gutters{color:#dbe7e8;background:#0e1116}.context-files-view .cm-scroller,.context-files-view pre{max-width:100%;overflow-x:auto}.context-files-view .cm-cursor,.context-files-view .cm-dropCursor{border-left-color:#11a4d4}.context-files-view [class*=_iconButton_],.context-files-view [class*=_toolbarButton_],.context-files-view [class*=_toolbarToggleItem_],.context-files-view [class*=_selectTrigger_],.context-files-view [class*=_toolbarNodeKindSelectTrigger_],.context-files-view [class*=_toolbarButtonSelectTrigger_]{color:#94a3b8!important;box-shadow:none!important;background:0 0!important;border-color:#2a3943!important;font-weight:400!important}.context-files-view [class*=_iconButton_] svg,.context-files-view [class*=_toolbarButton_] svg,.context-files-view [class*=_toolbarToggleItem_] svg,.context-files-view [class*=_selectTrigger_] svg,.context-files-view [class*=_toolbarNodeKindSelectTrigger_] svg,.context-files-view [class*=_toolbarButtonSelectTrigger_] svg{opacity:.88;color:#94a3b8!important;stroke:currentColor!important;width:18px!important;height:18px!important}.context-files-view [class*=_iconButton_]:hover,.context-files-view [class*=_toolbarButton_]:hover,.context-files-view [class*=_toolbarToggleItem_]:hover,.context-files-view [class*=_selectTrigger_]:hover,.context-files-view [class*=_toolbarNodeKindSelectTrigger_]:hover,.context-files-view [class*=_toolbarButtonSelectTrigger_]:hover{color:#cbd5e1!important;background:#ffffff08!important;border-color:#334155!important}.context-files-view [class*=_iconButton_]:hover svg,.context-files-view [class*=_toolbarButton_]:hover svg,.context-files-view [class*=_toolbarToggleItem_]:hover svg,.context-files-view [class*=_selectTrigger_]:hover svg,.context-files-view [class*=_toolbarNodeKindSelectTrigger_]:hover svg,.context-files-view [class*=_toolbarButtonSelectTrigger_]:hover svg{opacity:.94;color:#cbd5e1!important}.context-files-view [data-state=on],.context-files-view [aria-checked=true]{color:#dbe7e8!important;background:#11a4d41f!important;border-color:#11a4d473!important}.context-files-view [data-state=on] svg,.context-files-view [aria-checked=true] svg{opacity:.94;color:#cbd5e1!important}.context-files-view [class*=_selectContent_],.context-files-view [class*=_dropdownMenuContent_],.context-files-view [class*=_dialogContent_]{color:#dbe7e8!important;background:#111a1f!important;border:1px solid #334155!important}.context-files-view [class*=_toolbarToggleSingleGroup_]{gap:.3rem}.context-files-plain-fallback{flex-direction:column;height:100%;min-height:0;display:flex}.context-files-plain-fallback__notice{color:#fde68a;background:#f59e0b1a;border-bottom:1px solid #1e293b;margin:0;padding:.75rem 1rem;font-size:.84rem}.context-files-plain-fallback__textarea{color:#dbe7e8;min-height:0;font:inherit;resize:none;background:#151f24;border:0;outline:none;flex:1;padding:1rem 1.15rem 4rem;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;line-height:1.55;overflow:auto}@property --tw-border-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-font-weight{syntax:"*";inherits:false}@property --tw-tracking{syntax:"*";inherits:false}@property --tw-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-shadow-color{syntax:"*";inherits:false}@property --tw-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-inset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-shadow-color{syntax:"*";inherits:false}@property --tw-inset-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-ring-color{syntax:"*";inherits:false}@property --tw-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-ring-color{syntax:"*";inherits:false}@property --tw-inset-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-ring-inset{syntax:"*";inherits:false}@property --tw-ring-offset-width{syntax:"<length>";inherits:false;initial-value:0}@property --tw-ring-offset-color{syntax:"*";inherits:false;initial-value:#fff}@property --tw-ring-offset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}

package/dist/apps/chat-vscode-web/index.html

@@ -5,8 +5,8 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="theme-color" content="#101d22" />
 		<title>Pibo</title>
-		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-BAMxIaI_.js"></script>
-		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-B5QK07zO.css">
+		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-BLZRi4Ka.js"></script>
+		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-Bf2JvJ9z.css">
 	</head>
 	<body>
 		<div id="root"></div>

package/dist/auth/better-auth.js

@@ -6,6 +6,8 @@ import { getMigrations } from "better-auth/db/migration";
 import { bearer } from "better-auth/plugins";
 import { loadPiboConfig } from "../config/config.js";
 import { piboHomePath } from "../core/pibo-home.js";
+import { createMachineKeyAuthenticator } from "./machine-keys.js";
+import { createMachineSessionManager } from "./machine-session.js";
 import { createForbiddenAuthError, createUnauthenticatedError } from "./types.js";
 const SESSION_EXPIRES_IN_SECONDS = 60 * 60 * 24 * 90;
 const SESSION_UPDATE_AGE_SECONDS = 60 * 60;
@@ -64,6 +66,8 @@ export function createBetterAuthService(options = {}) {
     const googleClientSecret = requiredOption(options.googleClientSecret ?? authConfig?.googleClientSecret, "auth.googleClientSecret");
     const secret = requiredSecret(options.secret ?? authConfig?.secret);
     const allowedEmails = requiredAllowedEmails(options, authConfig?.allowedEmails);
+    const machineKeys = createMachineKeyAuthenticator(options.machineKeyStorePath ?? authConfig?.machineKeyStorePath);
+    const machineSessions = createMachineSessionManager({ secret, machineKeys });
     const database = createDatabase(options.databasePath ?? authConfig?.databasePath ?? piboHomePath("auth.sqlite"));
     const trustedOrigins = options.trustedOrigins ?? authConfig?.trustedOrigins;
     const authOptions = {
@@ -86,6 +90,12 @@ export function createBetterAuthService(options = {}) {
         plugins: [bearer()],
     };
     const auth = betterAuth(authOptions);
+    const requireAllowedMachineSession = (session) => {
+        const email = session.identity.email?.toLowerCase();
+        if (!email || !allowedEmails.has(email))
+            throw createForbiddenAuthError();
+        return session;
+    };
     return {
         name: "better-auth",
         async start() {
@@ -96,6 +106,9 @@ export function createBetterAuthService(options = {}) {
             database.close();
         },
         async getSession(headers) {
+            const machineSession = machineKeys.getSession(headers) ?? machineSessions.getSession(headers);
+            if (machineSession)
+                return requireAllowedMachineSession(machineSession);
             const session = await auth.api.getSession({ headers });
             if (!session)
                 return undefined;
@@ -123,7 +136,42 @@ export function createBetterAuthService(options = {}) {
                 throw createUnauthenticatedError();
             return session;
         },
-        handleRequest(request) {
+        async handleRequest(request) {
+            const url = new URL(request.url);
+            if (url.pathname === "/api/auth/machine-session") {
+                if (request.method === "DELETE") {
+                    return new Response(null, {
+                        status: 204,
+                        headers: { "set-cookie": machineSessions.clearHeader(), "cache-control": "no-store" },
+                    });
+                }
+                if (request.method !== "POST") {
+                    return new Response(JSON.stringify({ error: "Method not allowed" }), {
+                        status: 405,
+                        headers: { "content-type": "application/json", allow: "POST, DELETE", "cache-control": "no-store" },
+                    });
+                }
+                const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+                if (url.protocol !== "https:" && !loopbackHosts.has(url.hostname)) {
+                    return new Response(JSON.stringify({ error: "Machine session exchange requires HTTPS outside loopback" }), {
+                        status: 400,
+                        headers: { "content-type": "application/json", "cache-control": "no-store" },
+                    });
+                }
+                const authentication = machineKeys.authenticate(request.headers);
+                if (!authentication)
+                    throw createUnauthenticatedError();
+                const session = requireAllowedMachineSession(authentication.session);
+                const created = machineSessions.create({ ...authentication, session });
+                return new Response(JSON.stringify({ identity: created.session.identity, expiresAt: created.expiresAt.toISOString() }), {
+                    status: 200,
+                    headers: {
+                        "content-type": "application/json",
+                        "cache-control": "no-store",
+                        "set-cookie": created.header,
+                    },
+                });
+            }
             return auth.handler(request);
         },
     };

package/dist/auth/cli.js

@@ -0,0 +1,220 @@
+import { DatabaseSync } from "node:sqlite";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { Command } from "commander";
+import { loadPiboConfig } from "../config/config.js";
+import { piboHomePath } from "../core/pibo-home.js";
+import { generateMachineKey, getDefaultMachineKeyStorePath, importMachineKeyRecord, listMachineKeys, parseMachineKeyRecord, revokeMachineKey, } from "./machine-keys.js";
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function printAuthDiscovery() {
+    console.log(`pibo auth - manage Web authentication
+
+Commands:
+  machine-key  Manage revocable machine identities
+
+Next:
+  pibo auth machine-key
+`);
+}
+function printMachineKeyDiscovery() {
+    console.log(`pibo auth machine-key - manage machine identities
+
+Commands:
+  identity  Resolve one existing user from the allowed email set
+  generate  Generate local secret and hash-only record files
+  import    Import one hash-only record into the server store
+  list      List keys without hashes or secrets
+  revoke    Revoke one key by id
+
+Next:
+  pibo auth machine-key <command> --help
+`);
+}
+function readJsonInput(path) {
+    const text = path === "-" ? readFileSync(0, "utf8") : readFileSync(resolve(path), "utf8");
+    return JSON.parse(text);
+}
+function parseIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Identity input must be a JSON object");
+    }
+    const input = value;
+    if (typeof input.userId !== "string" || input.userId.length === 0) {
+        throw new Error("Identity input requires userId");
+    }
+    if (typeof input.email !== "string" || input.email.length === 0) {
+        throw new Error("Identity input requires email");
+    }
+    for (const field of ["name", "image"]) {
+        if (input[field] !== undefined && input[field] !== null && typeof input[field] !== "string") {
+            throw new Error(`Identity input ${field} must be a string when present`);
+        }
+    }
+    return {
+        userId: input.userId,
+        email: input.email,
+        ...(typeof input.name === "string" && input.name.length > 0 ? { name: input.name } : {}),
+        ...(typeof input.image === "string" && input.image.length > 0 ? { image: input.image } : {}),
+    };
+}
+function configuredAuthDatabasePath() {
+    return resolve(loadPiboConfig().auth?.databasePath ?? piboHomePath("auth.sqlite"));
+}
+function resolveAllowedIdentity(email) {
+    const allowedEmails = new Set((loadPiboConfig().auth?.allowedEmails ?? []).map((candidate) => candidate.trim().toLowerCase()).filter(Boolean));
+    const normalizedEmail = email?.trim().toLowerCase();
+    if (normalizedEmail && !allowedEmails.has(normalizedEmail)) {
+        throw new Error(`Email "${email}" is not present in auth.allowedEmails`);
+    }
+    const database = new DatabaseSync(configuredAuthDatabasePath(), { readOnly: true });
+    try {
+        const rows = database.prepare('SELECT id, email, name, image FROM "user"').all();
+        const matches = rows.filter((row) => typeof row.id === "string" &&
+            typeof row.email === "string" &&
+            allowedEmails.has(row.email.toLowerCase()) &&
+            (normalizedEmail === undefined || row.email.toLowerCase() === normalizedEmail));
+        if (matches.length === 0) {
+            throw new Error(normalizedEmail
+                ? `No Better Auth user exists for allowed email "${email}"`
+                : "No Better Auth user matches auth.allowedEmails");
+        }
+        if (matches.length > 1) {
+            throw new Error("Multiple Better Auth users match auth.allowedEmails; pass --email to select one");
+        }
+        const row = matches[0];
+        return {
+            userId: row.id,
+            email: row.email,
+            ...(typeof row.name === "string" && row.name.length > 0 ? { name: row.name } : {}),
+            ...(typeof row.image === "string" && row.image.length > 0 ? { image: row.image } : {}),
+        };
+    }
+    finally {
+        database.close();
+    }
+}
+function requireNewOutputPath(path, label) {
+    const resolvedPath = resolve(path);
+    if (existsSync(resolvedPath))
+        throw new Error(`${label} already exists: ${resolvedPath}`);
+    return resolvedPath;
+}
+function writePrivateNewFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+}
+function parseExpiresAt(value) {
+    if (value === undefined)
+        return undefined;
+    const timestamp = Date.parse(value);
+    if (Number.isNaN(timestamp))
+        throw new Error("--expires-at must be an ISO timestamp");
+    if (timestamp <= Date.now())
+        throw new Error("--expires-at must be in the future");
+    return new Date(timestamp).toISOString();
+}
+export async function runAuthCli(argv = process.argv) {
+    if (argv.length <= 2 || argv[2] === "--help" || argv[2] === "-h") {
+        printAuthDiscovery();
+        return;
+    }
+    if (argv[2] === "machine-key" && (argv.length <= 3 || argv[3] === "--help" || argv[3] === "-h")) {
+        printMachineKeyDiscovery();
+        return;
+    }
+    const program = new Command();
+    program.name("pibo auth").description("Manage Pibo Web authentication");
+    const machineKey = program.command("machine-key").description("Manage revocable machine identities");
+    machineKey
+        .command("identity")
+        .description("Resolve an existing allowed Better Auth user")
+        .option("--email <email>", "Select one allowed Google account email when multiple users match")
+        .option("--json", "Print JSON")
+        .action((options) => {
+        const identity = resolveAllowedIdentity(options.email);
+        if (options.json)
+            printJson(identity);
+        else
+            console.log(`${identity.userId}\t${identity.email}\t${identity.name ?? ""}`);
+    });
+    machineKey
+        .command("generate")
+        .description("Generate a local raw secret and hash-only import record")
+        .requiredOption("--identity-file <path>", "Identity JSON from the identity command")
+        .requiredOption("--label <label>", "Operator label for this machine")
+        .requiredOption("--secret-output <path>", "New root-only raw-secret file")
+        .requiredOption("--record-output <path>", "New root-only hash-record file")
+        .option("--expires-at <timestamp>", "Optional future ISO expiration timestamp")
+        .action((options) => {
+        const secretOutput = requireNewOutputPath(options.secretOutput, "Secret output");
+        const recordOutput = requireNewOutputPath(options.recordOutput, "Record output");
+        if (secretOutput === recordOutput)
+            throw new Error("Secret and record output paths must differ");
+        const identity = parseIdentity(readJsonInput(options.identityFile));
+        const generated = generateMachineKey({
+            label: options.label,
+            identity,
+            expiresAt: parseExpiresAt(options.expiresAt),
+        });
+        try {
+            writePrivateNewFile(secretOutput, `${generated.token}\n`);
+            writePrivateNewFile(recordOutput, `${JSON.stringify(generated.record, null, 2)}\n`);
+        }
+        catch (error) {
+            if (existsSync(secretOutput))
+                unlinkSync(secretOutput);
+            if (existsSync(recordOutput))
+                unlinkSync(recordOutput);
+            throw error;
+        }
+        printJson({
+            id: generated.record.id,
+            label: generated.record.label,
+            email: generated.record.identity.email,
+            expiresAt: generated.record.expiresAt,
+            secretOutput,
+            recordOutput,
+        });
+    });
+    machineKey
+        .command("import")
+        .description("Import one hash-only machine-key record")
+        .requiredOption("--file <path>", "Record JSON path, or - for stdin")
+        .option("--store <path>", "Alternate machine-key store path")
+        .action((options) => {
+        const parsed = parseMachineKeyRecord(readJsonInput(options.file));
+        const existingIdentity = resolveAllowedIdentity(parsed.identity.email);
+        if (existingIdentity.userId !== parsed.identity.userId) {
+            throw new Error(`Machine identity userId does not match the Better Auth user for "${parsed.identity.email}"`);
+        }
+        const imported = importMachineKeyRecord(parsed, options.store ?? getDefaultMachineKeyStorePath());
+        printJson({ id: imported.id, label: imported.label, email: imported.identity.email, createdAt: imported.createdAt });
+    });
+    machineKey
+        .command("list")
+        .description("List machine keys without hashes or secrets")
+        .option("--store <path>", "Alternate machine-key store path")
+        .option("--json", "Print JSON")
+        .action((options) => {
+        const keys = listMachineKeys(options.store ?? getDefaultMachineKeyStorePath());
+        if (options.json) {
+            printJson(keys);
+            return;
+        }
+        for (const key of keys) {
+            console.log(`${key.id}\t${key.status}\t${key.identity.email ?? ""}\t${key.label}`);
+        }
+    });
+    machineKey
+        .command("revoke")
+        .description("Revoke one machine key")
+        .argument("<id>", "Machine-key id")
+        .option("--store <path>", "Alternate machine-key store path")
+        .action((id, options) => {
+        const record = revokeMachineKey(id, options.store ?? getDefaultMachineKeyStorePath());
+        printJson({ id: record.id, label: record.label, revokedAt: record.revokedAt });
+    });
+    await program.parseAsync(argv);
+}

package/dist/auth/machine-keys.js

@@ -0,0 +1,258 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { piboHomePath } from "../core/pibo-home.js";
+export const PIBO_MACHINE_KEY_HEADER = "x-pibo-machine-key";
+export const MACHINE_KEY_STORE_VERSION = 1;
+const MACHINE_KEY_ID_PATTERN = /^[a-f0-9]{16}$/;
+const MACHINE_KEY_HASH_PATTERN = /^[a-f0-9]{64}$/;
+const MACHINE_KEY_TOKEN_PATTERN = /^pibo_mk_([a-f0-9]{16})_([A-Za-z0-9_-]{43})$/;
+const MACHINE_KEY_LABEL_MAX_LENGTH = 120;
+export function getDefaultMachineKeyStorePath() {
+    return piboHomePath("machine-keys.json");
+}
+function hashMachineKeyToken(token) {
+    return createHash("sha256").update(token, "utf8").digest();
+}
+function parseIsoTimestamp(value, field) {
+    if (typeof value !== "string" || value.length === 0 || Number.isNaN(Date.parse(value))) {
+        throw new Error(`${field} must be an ISO timestamp`);
+    }
+    return new Date(value).toISOString();
+}
+function optionalString(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${field} must be a non-empty string`);
+    return value;
+}
+function parseIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("identity must be an object");
+    }
+    const input = value;
+    const allowedKeys = new Set(["userId", "email", "name", "image", "provider"]);
+    for (const key of Object.keys(input)) {
+        if (!allowedKeys.has(key))
+            throw new Error(`identity contains unsupported field "${key}"`);
+    }
+    if (typeof input.userId !== "string" || input.userId.length === 0) {
+        throw new Error("identity.userId must be a non-empty string");
+    }
+    if (input.provider !== "machine-key") {
+        throw new Error('identity.provider must be "machine-key"');
+    }
+    const email = optionalString(input.email, "identity.email");
+    if (!email)
+        throw new Error("identity.email must be a non-empty string");
+    return {
+        userId: input.userId,
+        email,
+        name: optionalString(input.name, "identity.name"),
+        image: optionalString(input.image, "identity.image"),
+        provider: "machine-key",
+    };
+}
+export function parseMachineKeyRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Machine-key record must be an object");
+    }
+    const input = value;
+    const allowedKeys = new Set(["id", "label", "hash", "identity", "createdAt", "expiresAt", "revokedAt"]);
+    for (const key of Object.keys(input)) {
+        if (!allowedKeys.has(key))
+            throw new Error(`Machine-key record contains unsupported field "${key}"`);
+    }
+    if (typeof input.id !== "string" || !MACHINE_KEY_ID_PATTERN.test(input.id)) {
+        throw new Error("Machine-key record id must be 16 lowercase hexadecimal characters");
+    }
+    if (typeof input.label !== "string" ||
+        input.label.trim().length === 0 ||
+        input.label.trim().length > MACHINE_KEY_LABEL_MAX_LENGTH) {
+        throw new Error(`Machine-key record label must contain 1-${MACHINE_KEY_LABEL_MAX_LENGTH} characters`);
+    }
+    if (typeof input.hash !== "string" || !MACHINE_KEY_HASH_PATTERN.test(input.hash)) {
+        throw new Error("Machine-key record hash must be 64 lowercase hexadecimal characters");
+    }
+    const createdAt = parseIsoTimestamp(input.createdAt, "createdAt");
+    const expiresAt = input.expiresAt === undefined ? undefined : parseIsoTimestamp(input.expiresAt, "expiresAt");
+    const revokedAt = input.revokedAt === undefined ? undefined : parseIsoTimestamp(input.revokedAt, "revokedAt");
+    return {
+        id: input.id,
+        label: input.label.trim(),
+        hash: input.hash,
+        identity: parseIdentity(input.identity),
+        createdAt,
+        ...(expiresAt ? { expiresAt } : {}),
+        ...(revokedAt ? { revokedAt } : {}),
+    };
+}
+function parseMachineKeyStore(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Machine-key store must be an object");
+    }
+    const input = value;
+    if (input.version !== MACHINE_KEY_STORE_VERSION) {
+        throw new Error(`Machine-key store version must be ${MACHINE_KEY_STORE_VERSION}`);
+    }
+    if (!Array.isArray(input.keys))
+        throw new Error("Machine-key store keys must be an array");
+    const keys = input.keys.map(parseMachineKeyRecord);
+    const ids = new Set();
+    for (const key of keys) {
+        if (ids.has(key.id))
+            throw new Error(`Duplicate machine-key id "${key.id}"`);
+        ids.add(key.id);
+    }
+    return { version: MACHINE_KEY_STORE_VERSION, keys };
+}
+function assertPrivateStoreFile(path) {
+    if (process.platform === "win32")
+        return;
+    const stat = statSync(path);
+    if ((stat.mode & 0o077) !== 0) {
+        throw new Error(`Machine-key store must not be accessible by group or other users: ${path}`);
+    }
+    const currentUid = process.getuid?.();
+    if (currentUid !== undefined && stat.uid !== currentUid) {
+        throw new Error(`Machine-key store must be owned by the current user: ${path}`);
+    }
+}
+export function readMachineKeyStore(path = getDefaultMachineKeyStorePath()) {
+    const resolvedPath = resolve(path);
+    if (!existsSync(resolvedPath))
+        return { version: MACHINE_KEY_STORE_VERSION, keys: [] };
+    assertPrivateStoreFile(resolvedPath);
+    return parseMachineKeyStore(JSON.parse(readFileSync(resolvedPath, "utf8")));
+}
+function writeMachineKeyStore(store, path) {
+    const resolvedPath = resolve(path);
+    mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${resolvedPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temporaryPath, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        renameSync(temporaryPath, resolvedPath);
+        chmodSync(resolvedPath, 0o600);
+    }
+    finally {
+        if (existsSync(temporaryPath))
+            unlinkSync(temporaryPath);
+    }
+}
+export function generateMachineKey(options) {
+    const id = randomBytes(8).toString("hex");
+    const secret = randomBytes(32).toString("base64url");
+    const token = `pibo_mk_${id}_${secret}`;
+    const now = options.now ?? new Date();
+    const expiresAt = options.expiresAt === undefined
+        ? undefined
+        : typeof options.expiresAt === "string"
+            ? parseIsoTimestamp(options.expiresAt, "expiresAt")
+            : options.expiresAt.toISOString();
+    const record = parseMachineKeyRecord({
+        id,
+        label: options.label,
+        hash: hashMachineKeyToken(token).toString("hex"),
+        identity: { ...options.identity, provider: "machine-key" },
+        createdAt: now.toISOString(),
+        ...(expiresAt ? { expiresAt } : {}),
+    });
+    return { token, record };
+}
+export function importMachineKeyRecord(recordValue, path = getDefaultMachineKeyStorePath()) {
+    const record = parseMachineKeyRecord(recordValue);
+    const store = readMachineKeyStore(path);
+    if (store.keys.some((candidate) => candidate.id === record.id)) {
+        throw new Error(`Machine-key id "${record.id}" already exists`);
+    }
+    store.keys.push(record);
+    writeMachineKeyStore(store, path);
+    return record;
+}
+function machineKeyStatus(record, now) {
+    if (record.revokedAt)
+        return "revoked";
+    if (record.expiresAt && Date.parse(record.expiresAt) <= now.getTime())
+        return "expired";
+    return "active";
+}
+export function listMachineKeys(path = getDefaultMachineKeyStorePath(), now = new Date()) {
+    return readMachineKeyStore(path).keys.map((record) => {
+        const { hash: _hash, ...listed } = record;
+        return { ...listed, status: machineKeyStatus(record, now) };
+    });
+}
+export function revokeMachineKey(id, path = getDefaultMachineKeyStorePath(), now = new Date()) {
+    if (!MACHINE_KEY_ID_PATTERN.test(id))
+        throw new Error("Machine-key id must be 16 lowercase hexadecimal characters");
+    const store = readMachineKeyStore(path);
+    const index = store.keys.findIndex((candidate) => candidate.id === id);
+    if (index < 0)
+        throw new Error(`Unknown machine-key id "${id}"`);
+    const current = store.keys[index];
+    const revoked = { ...current, revokedAt: current.revokedAt ?? now.toISOString() };
+    store.keys[index] = revoked;
+    writeMachineKeyStore(store, path);
+    return revoked;
+}
+function storeSignature(path) {
+    try {
+        const stat = statSync(path);
+        return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "missing";
+        throw error;
+    }
+}
+export function createMachineKeyAuthenticator(path = getDefaultMachineKeyStorePath()) {
+    const resolvedPath = resolve(path);
+    let cachedSignature;
+    let keysById = new Map();
+    const refresh = () => {
+        const signature = storeSignature(resolvedPath);
+        if (signature === cachedSignature)
+            return;
+        const store = readMachineKeyStore(resolvedPath);
+        keysById = new Map(store.keys.map((record) => [record.id, record]));
+        cachedSignature = signature;
+    };
+    const sessionForRecord = (record) => ({
+        identity: { ...record.identity },
+        sessionId: `machine-key:${record.id}`,
+        ...(record.expiresAt ? { expiresAt: new Date(record.expiresAt) } : {}),
+    });
+    const getSessionById = (id) => {
+        refresh();
+        const record = keysById.get(id);
+        if (!record || machineKeyStatus(record, new Date()) !== "active")
+            return undefined;
+        return sessionForRecord(record);
+    };
+    const authenticate = (headers) => {
+        const token = headers.get(PIBO_MACHINE_KEY_HEADER)?.trim();
+        if (!token)
+            return undefined;
+        const match = MACHINE_KEY_TOKEN_PATTERN.exec(token);
+        if (!match)
+            return undefined;
+        refresh();
+        const record = keysById.get(match[1]);
+        if (!record || machineKeyStatus(record, new Date()) !== "active")
+            return undefined;
+        const expected = Buffer.from(record.hash, "hex");
+        const actual = hashMachineKeyToken(token);
+        if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+            return undefined;
+        return { id: record.id, session: sessionForRecord(record) };
+    };
+    return {
+        authenticate,
+        getSession(headers) {
+            return authenticate(headers)?.session;
+        },
+        getSessionById,
+    };
+}