@pasko70/pibo 1.16.5 → 2.0.0

package/dist/shared/trace-order.js

@@ -1,5 +1,6 @@
 export const TRACE_SOURCE_RANK = {
     transcript: 0,
+    "product-history": 1,
     "event-log": 1,
     live: 2,
 };
@@ -17,15 +18,19 @@ export const TRACE_PHASE_RANK = {
     "assistant.message": 8,
     error: 9,
 };
-export function transcriptTraceOrder(transcriptIndex, contentPartIndex, type) {
+export function historyTraceOrder(historyIndex, contentPartIndex, type, source) {
     return {
-        sourceRank: TRACE_SOURCE_RANK.transcript,
-        turnSeq: transcriptIndex,
-        transcriptIndex,
+        sourceRank: TRACE_SOURCE_RANK[source],
+        turnSeq: historyIndex,
+        transcriptIndex: historyIndex,
         contentPartIndex,
         phaseRank: TRACE_PHASE_RANK[type],
     };
 }
+/** @deprecated Use historyTraceOrder. */
+export function transcriptTraceOrder(transcriptIndex, contentPartIndex, type) {
+    return historyTraceOrder(transcriptIndex, contentPartIndex, type, "transcript");
+}
 export function eventTraceOrder(eventSequence, type) {
     return {
         sourceRank: TRACE_SOURCE_RANK["event-log"],

package/dist/shared/trace-page-merge.js

@@ -85,7 +85,7 @@ function clearRemovedParentIds(nodes, removedIds) {
 function transcriptEventIds(nodes) {
     const eventIds = new Set();
     for (const node of nodes) {
-        if (node.source === "transcript" && node.eventId)
+        if ((node.source === "transcript" || node.source === "product-history") && node.eventId)
             eventIds.add(node.eventId);
     }
     return eventIds;

package/dist/signals/projector.js

@@ -35,7 +35,17 @@ export const sessionLifecycleSignalProducer = {
             const session = data.session;
             const existing = context.getNode(`session:${session.id}`);
             const rootPiboSessionId = session.parentId ? context.getSessionRoot(session.parentId) : session.id;
-            if (existing && existing.parentPiboSessionId === session.parentId && existing.rootPiboSessionId === rootPiboSessionId)
+            const binding = session.runtimeBinding;
+            if (existing
+                && existing.parentPiboSessionId === session.parentId
+                && existing.rootPiboSessionId === rootPiboSessionId
+                && existing.metadata?.kind === session.kind
+                && existing.metadata?.channel === session.channel
+                && existing.metadata?.profile === session.profile
+                && existing.metadata?.runtimeInstanceId === binding?.runtimeInstanceId
+                && existing.metadata?.runtimeAdapterId === binding?.adapterId
+                && existing.metadata?.runtimeBindingState === binding?.state
+                && existing.metadata?.nativeSessionId === binding?.nativeSessionId)
                 return [];
             return [{ type: "upsert_node", node: node({
                         id: `session:${session.id}`,
@@ -44,7 +54,15 @@ export const sessionLifecycleSignalProducer = {
                         rootPiboSessionId,
                         piboSessionId: session.id,
                         parentPiboSessionId: session.parentId,
-                        metadata: { kind: session.kind, channel: session.channel, profile: session.profile },
+                        metadata: {
+                            kind: session.kind,
+                            channel: session.channel,
+                            profile: session.profile,
+                            runtimeInstanceId: session.runtimeBinding?.runtimeInstanceId,
+                            runtimeAdapterId: session.runtimeBinding?.adapterId,
+                            runtimeBindingState: session.runtimeBinding?.state,
+                            nativeSessionId: session.runtimeBinding?.nativeSessionId,
+                        },
                     }, context) }];
         }
         if (data.type === "message_accepted") {

package/dist/signals/registry.js

@@ -180,6 +180,9 @@ function runSummaryEqual(a, b) {
         && a.startedAt === b.startedAt
         && a.updatedAt === b.updatedAt;
 }
+function isRuntimeBindingState(value) {
+    return value === "unbound" || value === "bound" || value === "missing" || value === "error";
+}
 function childSummaryEqual(a, b) {
     return a.nodeId === b.nodeId
         && a.piboSessionId === b.piboSessionId
@@ -193,6 +196,10 @@ function sessionSnapshotSemanticallyEqual(a, b) {
         return false;
     return a.piboSessionId === b.piboSessionId
         && a.piSessionId === b.piSessionId
+        && a.runtimeInstanceId === b.runtimeInstanceId
+        && a.runtimeAdapterId === b.runtimeAdapterId
+        && a.runtimeBindingState === b.runtimeBindingState
+        && a.nativeSessionId === b.nativeSessionId
         && a.parentPiboSessionId === b.parentPiboSessionId
         && a.rootPiboSessionId === b.rootPiboSessionId
         && a.localStatus === b.localStatus
@@ -535,6 +542,10 @@ export class InMemoryPiboSignalRegistry {
         const hasActiveDescendant = childSnapshots.some((snapshot) => snapshot.isTreeActive);
         return {
             piboSessionId,
+            runtimeInstanceId: typeof sessionNode?.metadata?.runtimeInstanceId === "string" ? sessionNode.metadata.runtimeInstanceId : undefined,
+            runtimeAdapterId: typeof sessionNode?.metadata?.runtimeAdapterId === "string" ? sessionNode.metadata.runtimeAdapterId : undefined,
+            runtimeBindingState: isRuntimeBindingState(sessionNode?.metadata?.runtimeBindingState) ? sessionNode.metadata.runtimeBindingState : undefined,
+            nativeSessionId: typeof sessionNode?.metadata?.nativeSessionId === "string" ? sessionNode.metadata.nativeSessionId : undefined,
             parentPiboSessionId: this.parentSessionIdByChildId.get(piboSessionId),
             rootPiboSessionId,
             version,

package/dist/subagents/tool.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { definePiboTool } from "../tools/contract.js";
 function hashPart(value) {
     return createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
@@ -28,26 +28,28 @@ export function createSubagentToolDefinitions(subagents, runner) {
 }
 function createSubagentToolDefinition(subagent, runner) {
     const name = createSubagentToolName(subagent.name);
-    return defineTool({
+    return definePiboTool({
         name,
-        label: `Pibo Subagent ${subagent.name}`,
+        title: `Pibo Subagent ${subagent.name}`,
         description: subagent.description ??
             `Send a message to the ${subagent.name} subagent. Use threadKey to continue the same subagent session.`,
         promptSnippet: subagent.description ??
             `Send a message to the ${subagent.name} subagent. Pass the same threadKey when you want to continue the same subagent session.`,
         executionMode: "parallel",
-        parameters: Type.Object({
+        inputSchema: Type.Object({
             message: Type.String({ description: "Message to send to the subagent" }),
             threadKey: Type.Optional(Type.String({
                 description: "Stable key for continuing a previous subagent conversation. Omit it to create a new subagent session.",
+                maxLength: 256,
             })),
         }),
-        async execute(toolCallId, params) {
+        async execute(toolCallId, params, signal) {
             const result = await runner.runSubagent({
                 subagent,
                 message: params.message,
                 threadKey: params.threadKey,
                 toolCallId,
+                signal,
             });
             return {
                 content: [

package/dist/tools/codex-browser.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import { join } from "node:path";
-import { StringEnum, Type } from "@earendil-works/pi-ai";
-import { defineTool } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { piboStringEnum } from "./schema.js";
+import { definePiboTool } from "./contract.js";
 import { connectCdpTarget, listCdpTargets } from "./cdp-client.js";
 import { browserPoolPaths, releaseBrowserPoolLease } from "./browser-pool.js";
 import { browserUseLeaseEnvironment, findActiveBrowserUseLeaseForHolder } from "./browser-use-leases.js";
@@ -203,24 +204,24 @@ export function createCodexBrowserToolProfiles() {
 export function createCodexBrowserToolDefinitions(controller, enabledNames = CODEX_BROWSER_TOOL_NAMES) {
     const enabled = new Set(enabledNames);
     const tools = [
-        [BROWSER_USE_OPEN_TABS_TOOL_NAME, defineTool({
+        [BROWSER_USE_OPEN_TABS_TOOL_NAME, definePiboTool({
                 name: BROWSER_USE_OPEN_TABS_TOOL_NAME,
-                label: "browser_use.open_tabs",
+                title: "browser_use.open_tabs",
                 description: "List open tabs in the persistent Browser Use session. Returns stable target IDs, short tab IDs, titles, URLs, and tab indices.",
                 promptSnippet: "Use browser_use_open_tabs (browser_use.open_tabs) to discover tabs before targeting a screenshot or tab-specific action.",
                 executionMode: "parallel",
-                parameters: Type.Object({}),
+                inputSchema: Type.Object({}),
                 async execute() {
                     return toolResult(await controller.openTabs());
                 },
             })],
-        [BROWSER_USE_TAKE_SCREENSHOT_TOOL_NAME, defineTool({
+        [BROWSER_USE_TAKE_SCREENSHOT_TOOL_NAME, definePiboTool({
                 name: BROWSER_USE_TAKE_SCREENSHOT_TOOL_NAME,
-                label: "browser_use.take_screenshot",
+                title: "browser_use.take_screenshot",
                 description: "Take a PNG screenshot from the persistent Browser Use session. Omit tabId to capture the first attachable page tab.",
                 promptSnippet: "Use browser_use_take_screenshot (browser_use.take_screenshot) when visual page state matters.",
                 executionMode: "parallel",
-                parameters: Type.Object({
+                inputSchema: Type.Object({
                     tabId: Type.Optional(Type.String({ description: "Full target ID or short tab ID returned by browser_use_open_tabs." })),
                     fullPage: Type.Optional(Type.Boolean({ description: "Capture the full scrollable page instead of only the viewport." })),
                     timeoutMs: Type.Optional(Type.Number({ description: "Screenshot timeout in milliseconds." })),
@@ -237,20 +238,20 @@ export function createCodexBrowserToolDefinitions(controller, enabledNames = COD
                     };
                 },
             })],
-        [BROWSER_USE_TOOL_NAME, defineTool({
+        [BROWSER_USE_TOOL_NAME, definePiboTool({
                 name: BROWSER_USE_TOOL_NAME,
-                label: "browser_use.browser_use",
+                title: "browser_use.browser_use",
                 description: "Control one persistent Browser Use session with a structured action. State and element indices persist through the same Pibo session and managed browser-pool lease.",
                 promptSnippet: "Use browser_use_browser_use (browser_use.browser_use) for structured navigation and interaction; call state before index-based clicks or input.",
                 executionMode: "sequential",
-                parameters: Type.Object({
-                    action: StringEnum(["navigate", "state", "click", "input", "type", "scroll", "back", "switch_tab", "close_tab", "keys", "evaluate", "wait_selector", "wait_text"], { description: "Browser action." }),
+                inputSchema: Type.Object({
+                    action: piboStringEnum(["navigate", "state", "click", "input", "type", "scroll", "back", "switch_tab", "close_tab", "keys", "evaluate", "wait_selector", "wait_text"], { description: "Browser action." }),
                     url: Type.Optional(Type.String({ description: "URL for navigate." })),
                     index: Type.Optional(Type.Number({ description: "Interactive element index for click or input." })),
                     coordinateX: Type.Optional(Type.Number({ description: "Viewport X coordinate for click; use with coordinateY." })),
                     coordinateY: Type.Optional(Type.Number({ description: "Viewport Y coordinate for click; use with coordinateX." })),
                     text: Type.Optional(Type.String({ description: "Text for input, type, or wait_text." })),
-                    direction: Type.Optional(StringEnum(["up", "down"], { description: "Scroll direction." })),
+                    direction: Type.Optional(piboStringEnum(["up", "down"], { description: "Scroll direction." })),
                     amount: Type.Optional(Type.Number({ description: "Scroll amount in pixels." })),
                     tab: Type.Optional(Type.Number({ description: "Browser Use tab index for switch_tab or close_tab." })),
                     keys: Type.Optional(Type.String({ description: "Keys to send, such as Enter or Control+a." })),
@@ -262,13 +263,13 @@ export function createCodexBrowserToolDefinitions(controller, enabledNames = COD
                     return toolResult(await controller.use(params, signal));
                 },
             })],
-        [NODE_REPL_JS_TOOL_NAME, defineTool({
+        [NODE_REPL_JS_TOOL_NAME, definePiboTool({
                 name: NODE_REPL_JS_TOOL_NAME,
-                label: "node_repl.js",
+                title: "node_repl.js",
                 description: "Execute JavaScript in a persistent, session-scoped Node REPL with top-level await. Top-level bindings persist. The sandbox omits require and process, and exposes browser.openTabs() plus browser.use(action, params) for the same Browser Use session.",
                 promptSnippet: "Use node_repl_js (node_repl.js) for persistent JavaScript state and browser-bound analysis. Top-level await and reusable top-level bindings are supported.",
                 executionMode: "sequential",
-                parameters: Type.Object({
+                inputSchema: Type.Object({
                     code: Type.String({ description: "JavaScript to execute. Top-level declarations persist across calls." }),
                     timeoutMs: Type.Optional(Type.Number({ description: "Execution timeout in milliseconds." })),
                 }),
@@ -276,13 +277,13 @@ export function createCodexBrowserToolDefinitions(controller, enabledNames = COD
                     return nodeReplToolResult(await controller.js(params.code, params.timeoutMs));
                 },
             })],
-        [NODE_REPL_JS_RESET_TOOL_NAME, defineTool({
+        [NODE_REPL_JS_RESET_TOOL_NAME, definePiboTool({
                 name: NODE_REPL_JS_RESET_TOOL_NAME,
-                label: "node_repl.js_reset",
+                title: "node_repl.js_reset",
                 description: "Reset the persistent node_repl.js namespace for the current Pibo session.",
                 promptSnippet: "Use node_repl_js_reset (node_repl.js_reset) only when persistent JavaScript state should be discarded.",
                 executionMode: "sequential",
-                parameters: Type.Object({}),
+                inputSchema: Type.Object({}),
                 async execute() {
                     return nodeReplToolResult(await controller.jsReset());
                 },

package/dist/tools/codex-compat.js

@@ -1,8 +1,9 @@
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { extname, isAbsolute, resolve } from "node:path";
-import { StringEnum, Type } from "@earendil-works/pi-ai";
-import { defineTool } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { piboStringEnum } from "./schema.js";
+import { definePiboTool } from "./contract.js";
 function resolveCwd(baseCwd, workdir) {
     if (!workdir || workdir.trim().length === 0)
         return baseCwd;
@@ -22,13 +23,13 @@ function mimeTypeForPath(path) {
     }
 }
 export function createCodexCompatToolDefinitions() {
-    const applyPatch = defineTool({
+    const applyPatch = definePiboTool({
         name: "apply_patch",
-        label: "Apply Patch",
+        title: "Apply Patch",
         description: "Applies a Codex-style patch to files in the workspace.",
         promptSnippet: "Use apply_patch for manual file edits by passing the complete patch text.",
         executionMode: "sequential",
-        parameters: Type.Object({
+        inputSchema: Type.Object({
             patch: Type.String({ description: "Patch text starting with *** Begin Patch and ending with *** End Patch." }),
             workdir: Type.Optional(Type.String({ description: "Working directory. Defaults to the runtime cwd." })),
         }),
@@ -59,15 +60,15 @@ export function createCodexCompatToolDefinitions() {
             };
         },
     });
-    const viewImage = defineTool({
+    const viewImage = definePiboTool({
         name: "view_image",
-        label: "View Image",
+        title: "View Image",
         description: "Reads a local image file and returns it as an inline image result.",
         promptSnippet: "Use view_image to inspect a local image path when visual details matter.",
         executionMode: "parallel",
-        parameters: Type.Object({
+        inputSchema: Type.Object({
             path: Type.String({ description: "Local filesystem path to an image file." }),
-            detail: Type.Optional(StringEnum(["original"], { description: "Use original resolution when set." })),
+            detail: Type.Optional(piboStringEnum(["original"], { description: "Use original resolution when set." })),
         }),
         async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
             const path = resolveCwd(ctx.cwd, params.path);

package/dist/tools/codex-image-generation.js

@@ -2,8 +2,8 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { platform, release, arch } from "node:os";
 import { dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { AuthStorage } from "@earendil-works/pi-coding-agent";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { definePiboTool } from "./contract.js";
 import { getPiboHome } from "../core/pibo-home.js";
 const OPENAI_CODEX_PROVIDER = "openai-codex";
 const DEFAULT_CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api";
@@ -215,9 +215,9 @@ async function collectEditImages(params, cwd, sessionEntries) {
     return [];
 }
 export function createCodexImageGenerationToolDefinition(context = {}, options = {}) {
-    return defineTool({
+    return definePiboTool({
         name: "codex_image_generation",
-        label: "Codex Image Generation",
+        title: "Codex Image Generation",
         description: "Generates or edits images through the ChatGPT/Codex backend API using openai-codex OAuth entitlement. Does not use the public OpenAI Images API.",
         promptSnippet: "Use codex_image_generation to create an image from a prompt, or to edit referenced/recent images with the Codex/ChatGPT image backend.",
         promptGuidelines: [
@@ -225,14 +225,16 @@ export function createCodexImageGenerationToolDefinition(context = {}, options =
             "For edits, pass either referenced_image_paths for local image files or num_last_images_to_include for recent conversation images, but not both.",
         ],
         executionMode: "sequential",
-        parameters: Type.Object({
+        inputSchema: Type.Object({
             prompt: Type.String({ description: "Image generation/editing prompt. Be specific about the desired final image." }),
             referenced_image_paths: Type.Optional(Type.Array(Type.String({ description: "Local filesystem image path to edit." }), { description: `Optional local image paths to edit. At most ${MAX_EDIT_IMAGES}.` })),
             num_last_images_to_include: Type.Optional(Type.Number({ description: `Use the last N conversation images as edit references. Must be between 1 and ${MAX_EDIT_IMAGES}.` })),
         }),
         async execute(toolCallId, params, signal, _onUpdate, ctx) {
             validateImageArgs(params);
-            const images = await collectEditImages(params, ctx.cwd, ctx.sessionManager.getBranch());
+            const legacySessionManager = ctx.sessionManager;
+            const sessionEntries = [...(ctx.getConversationEntries?.() ?? context.getConversationEntries?.() ?? legacySessionManager?.getBranch?.() ?? [])];
+            const images = await collectEditImages(params, ctx.cwd, sessionEntries);
             const operation = images.length > 0 ? "edit" : "generate";
             const endpoint = operation === "edit" ? "edits" : "generations";
             const auth = await getCodexImageAuth();

package/dist/tools/contract.js

@@ -0,0 +1,45 @@
+/** Identity helper that preserves schema-derived input types. */
+export function definePiboTool(definition) {
+    definition.label ??= definition.title;
+    definition.parameters ??= definition.inputSchema;
+    return definition;
+}
+export function isPiboToolDefinition(value) {
+    return Boolean(value
+        && typeof value === "object"
+        && "inputSchema" in value
+        && "execute" in value
+        && typeof value.execute === "function");
+}
+export function normalizePiboToolResult(result) {
+    return {
+        content: result.content.map((content) => ({ ...content })),
+        ...(result.details !== undefined ? { details: result.details } : {}),
+        ...(result.isError !== undefined ? { isError: result.isError } : {}),
+    };
+}
+/** Convert a legacy Pi-shaped definition without leaking Pi types into generic code. */
+export function normalizePiboToolDefinition(definition) {
+    if (isPiboToolDefinition(definition))
+        return definition;
+    return definePiboTool({
+        name: definition.name,
+        title: definition.label,
+        description: definition.description,
+        ...(definition.promptSnippet ? { promptSnippet: definition.promptSnippet } : {}),
+        ...(definition.promptGuidelines ? { promptGuidelines: [...definition.promptGuidelines] } : {}),
+        inputSchema: definition.parameters,
+        ...(definition.executionMode ? { executionMode: definition.executionMode } : {}),
+        portable: false,
+        ...(definition.prepareArguments ? { prepareInput: definition.prepareArguments } : {}),
+        async execute(toolCallId, input, signal, onUpdate, context) {
+            if (context.nativeContext === undefined) {
+                throw new Error(`Tool "${definition.name}" uses the deprecated Pi-native definition contract and cannot be delivered through portable MCP.`);
+            }
+            const result = await definition.execute(toolCallId, input, signal, onUpdate
+                ? (update) => onUpdate(normalizePiboToolResult(update))
+                : undefined, context.nativeContext);
+            return normalizePiboToolResult(result);
+        },
+    });
+}

package/dist/tools/credential-registry.js

@@ -0,0 +1,182 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+const TOKEN_PREFIX = "pibo_tool_";
+const DEFAULT_TTL_MS = 5 * 60_000;
+const DEFAULT_MAX_LIFETIME_MS = 30 * 60_000;
+export class PiboToolCredentialError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "PiboToolCredentialError";
+        this.code = code;
+    }
+}
+function positiveDuration(value, fallback, label) {
+    const resolved = value ?? fallback;
+    if (!Number.isFinite(resolved) || resolved <= 0)
+        throw new Error(`${label} must be a positive finite duration`);
+    return Math.floor(resolved);
+}
+function normalizeScope(scope) {
+    const piboSessionId = scope.piboSessionId.trim();
+    const runtimeInstanceId = scope.runtimeInstanceId.trim();
+    const adapterId = scope.adapterId.trim();
+    const sessionGeneration = scope.sessionGeneration.trim();
+    const cwd = scope.cwd.trim();
+    if (!piboSessionId || !runtimeInstanceId || !adapterId || !sessionGeneration || !cwd) {
+        throw new PiboToolCredentialError("credential_scope_invalid", "Tool credentials require a Pibo Session, runtime instance, adapter, session generation, and working directory.");
+    }
+    const allowedToolNames = [...new Set(scope.allowedToolNames.map((name) => name.trim()).filter(Boolean))].sort();
+    if (allowedToolNames.length === 0) {
+        throw new PiboToolCredentialError("credential_scope_invalid", "Tool credentials require at least one allowed tool.");
+    }
+    return {
+        piboSessionId,
+        ...(scope.piboRoomId?.trim() ? { piboRoomId: scope.piboRoomId.trim() } : {}),
+        ...(scope.profileName?.trim() ? { profileName: scope.profileName.trim() } : {}),
+        runtimeInstanceId,
+        adapterId,
+        sessionGeneration,
+        cwd,
+        allowedToolNames,
+    };
+}
+function tokenHash(secret) {
+    return createHash("sha256").update(secret, "utf8").digest();
+}
+function parseToken(token) {
+    if (!token.startsWith(TOKEN_PREFIX))
+        return undefined;
+    const separator = token.indexOf(".", TOKEN_PREFIX.length);
+    if (separator < 0)
+        return undefined;
+    const credentialId = token.slice(TOKEN_PREFIX.length, separator);
+    const secret = token.slice(separator + 1);
+    if (!credentialId || !secret)
+        return undefined;
+    return { credentialId, secret };
+}
+function iso(value) {
+    return value === undefined ? undefined : new Date(value).toISOString();
+}
+function infoFor(record) {
+    return {
+        credentialId: record.credentialId,
+        ...record.scope,
+        allowedToolNames: [...record.scope.allowedToolNames],
+        issuedAt: new Date(record.issuedAtMs).toISOString(),
+        expiresAt: new Date(record.expiresAtMs).toISOString(),
+        ...(iso(record.lastAliveAtMs) ? { lastAliveAt: iso(record.lastAliveAtMs) } : {}),
+        ...(iso(record.revokedAtMs) ? { revokedAt: iso(record.revokedAtMs) } : {}),
+    };
+}
+export class PiboToolCredentialRegistry {
+    records = new Map();
+    defaultTtlMs;
+    maxLifetimeMs;
+    now;
+    constructor(options = {}) {
+        this.defaultTtlMs = positiveDuration(options.defaultTtlMs, DEFAULT_TTL_MS, "defaultTtlMs");
+        this.maxLifetimeMs = positiveDuration(options.maxLifetimeMs, DEFAULT_MAX_LIFETIME_MS, "maxLifetimeMs");
+        if (this.defaultTtlMs > this.maxLifetimeMs) {
+            throw new Error("defaultTtlMs must not exceed maxLifetimeMs");
+        }
+        this.now = options.now ?? Date.now;
+    }
+    issue(scope, ttlMs = this.defaultTtlMs) {
+        const normalizedScope = normalizeScope(scope);
+        const lifetime = Math.min(positiveDuration(ttlMs, this.defaultTtlMs, "ttlMs"), this.maxLifetimeMs);
+        const now = this.now();
+        const credentialId = randomBytes(16).toString("base64url");
+        const secret = randomBytes(32).toString("base64url");
+        const record = {
+            credentialId,
+            tokenHash: tokenHash(secret),
+            scope: normalizedScope,
+            issuedAtMs: now,
+            expiresAtMs: now + lifetime,
+        };
+        this.records.set(credentialId, record);
+        return {
+            token: `${TOKEN_PREFIX}${credentialId}.${secret}`,
+            info: infoFor(record),
+        };
+    }
+    authenticate(token, options = {}) {
+        const parsed = parseToken(token);
+        const record = parsed ? this.records.get(parsed.credentialId) : undefined;
+        if (!parsed || !record) {
+            throw new PiboToolCredentialError("credential_invalid", "Invalid Pibo tool credential.");
+        }
+        const presentedHash = tokenHash(parsed.secret);
+        if (presentedHash.length !== record.tokenHash.length || !timingSafeEqual(presentedHash, record.tokenHash)) {
+            throw new PiboToolCredentialError("credential_invalid", "Invalid Pibo tool credential.");
+        }
+        if (record.revokedAtMs !== undefined) {
+            throw new PiboToolCredentialError("credential_revoked", "Pibo tool credential has been revoked.");
+        }
+        const now = this.now();
+        if (record.expiresAtMs <= now) {
+            throw new PiboToolCredentialError("credential_expired", "Pibo tool credential has expired.");
+        }
+        if (options.touch !== false)
+            record.lastAliveAtMs = now;
+        return infoFor(record);
+    }
+    renew(token, ttlMs = this.defaultTtlMs) {
+        const parsed = parseToken(token);
+        this.authenticate(token, { touch: false });
+        const record = parsed ? this.records.get(parsed.credentialId) : undefined;
+        if (!record)
+            throw new PiboToolCredentialError("credential_invalid", "Invalid Pibo tool credential.");
+        const now = this.now();
+        const requested = positiveDuration(ttlMs, this.defaultTtlMs, "ttlMs");
+        const maximumExpiry = record.issuedAtMs + this.maxLifetimeMs;
+        record.expiresAtMs = Math.min(now + requested, maximumExpiry);
+        if (record.expiresAtMs <= now) {
+            record.revokedAtMs = now;
+            throw new PiboToolCredentialError("credential_expired", "Pibo tool credential reached its maximum lifetime.");
+        }
+        record.lastAliveAtMs = now;
+        return infoFor(record);
+    }
+    revoke(token) {
+        const parsed = parseToken(token);
+        if (!parsed)
+            return false;
+        return this.revokeCredentialId(parsed.credentialId);
+    }
+    revokeCredentialId(credentialId) {
+        const record = this.records.get(credentialId);
+        if (!record || record.revokedAtMs !== undefined)
+            return false;
+        record.revokedAtMs = this.now();
+        return true;
+    }
+    revokeSessionGeneration(piboSessionId, sessionGeneration) {
+        let revoked = 0;
+        for (const record of this.records.values()) {
+            if (record.scope.piboSessionId === piboSessionId
+                && record.scope.sessionGeneration === sessionGeneration
+                && record.revokedAtMs === undefined) {
+                record.revokedAtMs = this.now();
+                revoked += 1;
+            }
+        }
+        return revoked;
+    }
+    getInfo(credentialId) {
+        const record = this.records.get(credentialId);
+        return record ? infoFor(record) : undefined;
+    }
+    cleanupExpired() {
+        const now = this.now();
+        let removed = 0;
+        for (const [credentialId, record] of this.records.entries()) {
+            if (record.expiresAtMs <= now || record.revokedAtMs !== undefined) {
+                this.records.delete(credentialId);
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+}