@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.67",
+  "version": "0.1.0-alpha.69",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",
@@ -48,13 +48,17 @@
     "SKILL.md"
   ],
   "scripts": {
-    "build": "tsup src/index.ts src/hooks/pre-commit.ts src/hooks/post-commit.ts src/hooks/post-rewrite.ts src/hooks/prim-hook.ts src/hooks/pre-tool-use.ts src/hooks/post-tool-use.ts src/hooks/session-start.ts src/hooks/session-end.ts --format esm --clean && tsup src/statusline-main.ts src/daemon/server.ts --format esm --splitting false",
+    "build": "tsup src/index.ts src/hooks/pre-commit.ts src/hooks/post-commit.ts src/hooks/post-rewrite.ts src/hooks/prim-hook.ts src/hooks/pre-tool-use.ts src/hooks/post-tool-use.ts src/hooks/session-start.ts src/hooks/session-end.ts --format esm --clean && tsup src/statusline-main.ts src/daemon/server.ts --format esm --splitting false && tsup --config tsup.hook-runtime.config.ts",
+    "contracts:generate": "node scripts/generate-cli-contract.mjs --write",
+    "contracts:check": "node scripts/generate-cli-contract.mjs --check",
+    "contracts:provenance": "node scripts/update-cli-contract.mjs --check",
+    "contracts:update": "node scripts/update-cli-contract.mjs",
     "postbuild": "chmod +x ./dist/index.js ./dist/statusline-main.js ./dist/hooks/pre-commit.js ./dist/hooks/post-commit.js ./dist/hooks/post-rewrite.js ./dist/hooks/prim-hook.js ./dist/hooks/pre-tool-use.js ./dist/hooks/post-tool-use.js ./dist/hooks/session-start.js ./dist/hooks/session-end.js ./dist/daemon/server.js",
     "dev": "tsup src/index.ts src/statusline-main.ts src/hooks/pre-commit.ts src/hooks/post-commit.ts src/hooks/post-rewrite.ts src/hooks/prim-hook.ts src/hooks/pre-tool-use.ts src/hooks/post-tool-use.ts src/hooks/session-start.ts src/hooks/session-end.ts src/daemon/server.ts --format esm --watch --clean --splitting false",
     "clean": "rm -rf dist coverage",
-    "lint": "biome check src/",
-    "format": "biome check --fix src/",
-    "format:check": "biome check src/",
+    "lint": "biome check src/ scripts/",
+    "format": "biome check --fix src/ scripts/",
+    "format:check": "biome check src/ scripts/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -73,6 +77,8 @@
     "@types/node": "^25.5.0",
     "@types/update-notifier": "^6.0.8",
     "@vitest/coverage-v8": "^3.1.0",
+    "ajv": "8.20.0",
+    "json-schema-to-typescript": "15.0.4",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^3.1.0"

package/dist/chunk-CZ24W5QU.js

@@ -1,123 +0,0 @@
-// src/lib/bin-path.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, isAbsolute, join } from "path";
-import { fileURLToPath } from "url";
-var PKG_NAME = "@primitive.ai/prim";
-var ROOT_WALK_LIMIT = 6;
-var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
-var resolvedRoot;
-function locateRoot() {
-  if (resolvedRoot !== void 0) {
-    return resolvedRoot;
-  }
-  let dir = dirname(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
-    const manifestPath = join(dir, "package.json");
-    if (existsSync(manifestPath)) {
-      try {
-        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-        if (manifest.name === PKG_NAME && manifest.bin) {
-          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
-          return resolvedRoot;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-  }
-  resolvedRoot = null;
-  return resolvedRoot;
-}
-function binFile(bin) {
-  const root = locateRoot();
-  const rel = root?.bin[bin];
-  if (!root || !rel) {
-    return null;
-  }
-  return isAbsolute(rel) ? rel : join(root.dir, rel);
-}
-function packageVersion() {
-  return locateRoot()?.version ?? null;
-}
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function pinnedHookCommand(bin, args = "") {
-  const version = packageVersion();
-  if (!version) throw new Error("cannot determine Primitive package version");
-  const suffix = args ? ` ${args}` : "";
-  const fallback = `npx --yes -p ${PKG_NAME}@${version} ${bin}${suffix}`;
-  const file = binFile(bin);
-  if (!file) return fallback;
-  return `if [ -x ${shellQuote(process.execPath)} ] && [ -f ${shellQuote(file)} ]; then ${shellQuote(process.execPath)} ${shellQuote(file)}${suffix}; else ${fallback}; fi`;
-}
-function detachedHookShimCommand(bin, args = "") {
-  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${pinnedHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
-}
-function commandMatchesBin(command, bin) {
-  if (!command) {
-    return false;
-  }
-  const c = command.trim();
-  if (c === bin || c.startsWith(`${bin} `)) {
-    return true;
-  }
-  const exactBin = new RegExp(`(?:^|\\s)${bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|;|$)`);
-  return c.includes(`command -v ${bin} `) || c.includes(`-p ${PKG_NAME}@`) && exactBin.test(c);
-}
-
-// src/lib/bin-cache.ts
-import { chmodSync, mkdirSync, renameSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
-var CACHED_BINS = [
-  "prim",
-  "prim-hook",
-  "prim-pre-tool-use",
-  "prim-post-tool-use",
-  "prim-post-commit",
-  "prim-post-rewrite"
-];
-function binCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || join2(homedir(), ".cache");
-  return join2(base, "prim", "bin");
-}
-function writeAtomic(path, content) {
-  const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, content, { mode: 384 });
-  renameSync(tmp, path);
-}
-function warmBinCache() {
-  try {
-    if (process.env.PRIM_BIN_CACHE_HIT) {
-      return;
-    }
-    if (process.env.PRIM_BIN_CACHE === "0") {
-      return;
-    }
-    const dir = binCacheDir();
-    mkdirSync(dir, { recursive: true, mode: 448 });
-    chmodSync(dir, 448);
-    writeAtomic(join2(dir, "node"), process.execPath);
-    for (const bin of CACHED_BINS) {
-      const file = binFile(bin);
-      if (file) {
-        writeAtomic(join2(dir, bin), file);
-      }
-    }
-  } catch {
-  }
-}
-
-export {
-  binFile,
-  packageVersion,
-  pinnedHookCommand,
-  detachedHookShimCommand,
-  commandMatchesBin,
-  warmBinCache
-};

package/dist/chunk-RTLFE6EZ.js

@@ -1,518 +0,0 @@
-// src/lib/file-lock.ts
-import { randomBytes } from "crypto";
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-var DEFAULT_TIMEOUT_MS = 3e4;
-var DEFAULT_POLL_MS = 50;
-var DEFAULT_INIT_GRACE_MS = 2e3;
-var DIRECTORY_MODE = 448;
-var FILE_MODE = 384;
-function ownerPath(lockDir) {
-  return join(lockDir, "owner.json");
-}
-function readOwner(lockDir) {
-  try {
-    const owner = JSON.parse(readFileSync(ownerPath(lockDir), "utf8"));
-    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
-      return null;
-    }
-    return owner;
-  } catch {
-    return null;
-  }
-}
-function sameOwner(a, b) {
-  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
-}
-function tryTakeLock(lockDir, now) {
-  try {
-    mkdirSync(lockDir, { mode: DIRECTORY_MODE });
-  } catch (error) {
-    if (error.code === "EEXIST") return null;
-    throw error;
-  }
-  const owner = {
-    pid: process.pid,
-    nonce: randomBytes(16).toString("hex"),
-    createdAt: now
-  };
-  try {
-    writeFileSync(ownerPath(lockDir), `${JSON.stringify(owner)}
-`, {
-      encoding: "utf8",
-      mode: FILE_MODE,
-      flag: "wx"
-    });
-    return owner;
-  } catch (error) {
-    rmSync(lockDir, { recursive: true, force: true });
-    throw error;
-  }
-}
-function processIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-function recoverStaleLock(lockDir, now, alive, initGraceMs) {
-  const owner = readOwner(lockDir);
-  if (owner) {
-    if (alive(owner.pid)) return false;
-    if (!sameOwner(readOwner(lockDir), owner)) return false;
-    rmSync(lockDir, { recursive: true, force: true });
-    return true;
-  }
-  try {
-    const before = statSync(lockDir).mtimeMs;
-    if (now - before < initGraceMs) return false;
-    if (readOwner(lockDir)) return false;
-    if (statSync(lockDir).mtimeMs !== before) return false;
-    rmSync(lockDir, { recursive: true, force: true });
-    return true;
-  } catch {
-    return true;
-  }
-}
-function abortError(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-function throwIfAborted(signal) {
-  if (signal?.aborted) throw abortError(signal);
-}
-async function defaultSleep(ms, signal) {
-  if (!signal) {
-    await new Promise((resolve2) => setTimeout(resolve2, ms));
-    return;
-  }
-  throwIfAborted(signal);
-  await new Promise((resolve2, reject) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve2();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(abortError(signal));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function withFileLock(lockDir, operation, options = {}) {
-  mkdirSync(dirname(lockDir), { recursive: true, mode: DIRECTORY_MODE });
-  const nowMs = options.nowMs ?? Date.now;
-  const alive = options.processAlive ?? processIsAlive;
-  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  let owner = null;
-  while (!owner) {
-    throwIfAborted(options.signal);
-    const now = nowMs();
-    owner = tryTakeLock(lockDir, now);
-    if (owner) break;
-    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
-    if (now >= deadline) {
-      throw new Error(`timed out waiting for file lock ${lockDir}`);
-    }
-    if (options.sleep) {
-      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
-      throwIfAborted(options.signal);
-    } else {
-      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
-    }
-  }
-  try {
-    throwIfAborted(options.signal);
-    return await operation();
-  } finally {
-    if (sameOwner(readOwner(lockDir), owner)) {
-      rmSync(lockDir, { recursive: true, force: true });
-    }
-  }
-}
-
-// src/client.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, join as join2, resolve } from "path";
-var CONFIG_DIR_MODE = 448;
-var CREDENTIAL_FILE_MODE = 384;
-var REFRESH_THRESHOLD_MS = 6e4;
-var DEFAULT_API_URL = "https://api.getprimitive.ai";
-var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
-function loadEnvFile(cwd = process.cwd()) {
-  const envVars = {};
-  for (const file of [".env.local", ".env"]) {
-    const filePath = resolve(cwd, file);
-    if (!existsSync2(filePath)) continue;
-    const content = readFileSync2(filePath, "utf-8");
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx === -1) continue;
-      envVars[trimmed.slice(0, eqIdx).trim()] = trimmed.slice(eqIdx + 1).trim();
-    }
-  }
-  return envVars;
-}
-var TOKEN_FILE_PATH = join2(homedir(), ".config", "prim", "token");
-var REFRESH_TOKEN_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_token");
-var TOKEN_EXPIRES_PATH = join2(dirname2(TOKEN_FILE_PATH), "token_expires_at");
-var TERMINAL_REFRESH_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_terminal");
-var CREDENTIAL_LOCK_PATH = join2(dirname2(TOKEN_FILE_PATH), "credentials.lock");
-function readTrimmed(path) {
-  try {
-    const value = readFileSync2(path, "utf8").trim();
-    return value || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function resolveAuthCredential() {
-  if (process.env.PRIM_TOKEN) {
-    return { token: process.env.PRIM_TOKEN, source: "environment" };
-  }
-  const stored = readTrimmed(TOKEN_FILE_PATH);
-  if (stored) {
-    return { token: stored, source: "token_file" };
-  }
-  const envToken = loadEnvFile().PRIM_TOKEN;
-  return envToken ? { token: envToken, source: "env_file" } : void 0;
-}
-function getSiteUrl() {
-  return getSiteUrlForCwd(process.cwd(), process.env.PRIM_API_URL);
-}
-function getSiteUrlForCwd(cwd, primApiUrl) {
-  if (primApiUrl) return primApiUrl;
-  return loadEnvFile(cwd).PRIM_API_URL ?? DEFAULT_API_URL;
-}
-function getJwtExpiry(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return void 0;
-  try {
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    return payload.exp ? payload.exp * 1e3 : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function expiresAtFor(token, expiresIn) {
-  return expiresIn === void 0 ? getJwtExpiry(token) : Date.now() + expiresIn * 1e3;
-}
-function ensureConfigDirectory() {
-  const directory = dirname2(TOKEN_FILE_PATH);
-  mkdirSync2(directory, { recursive: true, mode: CONFIG_DIR_MODE });
-  chmodSync(directory, CONFIG_DIR_MODE);
-}
-function atomicWrite(path, content) {
-  ensureConfigDirectory();
-  const temp = join2(
-    dirname2(path),
-    `.${path.slice(dirname2(path).length + 1)}.tmp-${process.pid}-${randomBytes2(8).toString("hex")}`
-  );
-  try {
-    writeFileSync2(temp, content, {
-      encoding: "utf8",
-      mode: CREDENTIAL_FILE_MODE,
-      flag: "wx"
-    });
-    renameSync(temp, path);
-  } catch (error) {
-    rmSync2(temp, { force: true });
-    throw error;
-  }
-}
-function removeCredentialFile(path) {
-  if (!existsSync2(path)) return false;
-  rmSync2(path, { force: true });
-  return true;
-}
-function getTokenExpiresAt() {
-  const stored = readTrimmed(TOKEN_EXPIRES_PATH);
-  if (stored === void 0) return void 0;
-  const value = Number(stored);
-  return Number.isNaN(value) ? void 0 : value;
-}
-function isTokenExpiringSoon(credential) {
-  if (credential.source !== "token_file") return false;
-  const expiresAt = getTokenExpiresAt();
-  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
-}
-function refreshFingerprint(refreshToken2) {
-  return createHash("sha256").update(refreshToken2).digest("hex");
-}
-function terminalFingerprint() {
-  return readTrimmed(TERMINAL_REFRESH_PATH);
-}
-function writeTerminalFingerprint(refreshToken2) {
-  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
-`);
-}
-function clearTerminalFingerprint() {
-  removeCredentialFile(TERMINAL_REFRESH_PATH);
-}
-function isSessionEnded() {
-  if (resolveAuthCredential()?.source !== "token_file") return false;
-  const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
-  const ended = terminalFingerprint();
-  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
-}
-function withCredentialLock(operation, options = {}) {
-  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
-}
-function commitCredentialsUnlocked(credentials) {
-  const accessToken = credentials.accessToken.trim();
-  const refreshToken2 = credentials.refreshToken.trim();
-  if (!accessToken || !refreshToken2) {
-    throw new Error("OAuth credentials require both access and refresh tokens");
-  }
-  atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
-`);
-  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
-  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
-  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
-`);
-  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
-`);
-  clearTerminalFingerprint();
-  _cachedCredential = { token: accessToken, source: "token_file" };
-}
-async function commitCredentials(credentials, options = {}) {
-  await withCredentialLock(() => commitCredentialsUnlocked(credentials), options);
-}
-async function setStoredToken(token, options = {}) {
-  const value = token.trim();
-  if (!value) throw new Error("Token cannot be empty");
-  await withCredentialLock(() => {
-    removeCredentialFile(REFRESH_TOKEN_PATH);
-    removeCredentialFile(TOKEN_EXPIRES_PATH);
-    clearTerminalFingerprint();
-    atomicWrite(TOKEN_FILE_PATH, `${value}
-`);
-    _cachedCredential = { token: value, source: "token_file" };
-  }, options);
-}
-async function clearStoredCredentials(options = {}) {
-  const { beforeClear, ...lockOptions } = options;
-  return withCredentialLock(async () => {
-    const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
-    let callbackError;
-    try {
-      await beforeClear?.(refreshToken2);
-    } catch (error) {
-      callbackError = error;
-    }
-    let removed = false;
-    for (const path of [
-      TOKEN_FILE_PATH,
-      REFRESH_TOKEN_PATH,
-      TOKEN_EXPIRES_PATH,
-      TERMINAL_REFRESH_PATH
-    ]) {
-      removed = removeCredentialFile(path) || removed;
-    }
-    _cachedCredential = void 0;
-    if (callbackError) throw callbackError;
-    return removed;
-  }, lockOptions);
-}
-function isTerminalRefreshResponse(response, detail) {
-  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
-  try {
-    const error = JSON.parse(detail).error;
-    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
-  } catch {
-    return response.status === 401 && detail.includes("Invalid or expired refresh token");
-  }
-}
-function refreshDiagnostic(response, detail, quiet) {
-  if (quiet) return;
-  process.stderr.write(
-    `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
-`
-  );
-}
-async function performTokenRefresh(options = {}) {
-  const selected = resolveAuthCredential();
-  if (selected?.source !== "token_file") return void 0;
-  const startingGeneration = readTrimmed(REFRESH_TOKEN_PATH);
-  if (!startingGeneration || isSessionEnded()) return void 0;
-  const startingAccessToken = selected.token;
-  return withCredentialLock(
-    async () => {
-      const currentCredential = resolveAuthCredential();
-      if (currentCredential?.source !== "token_file") return void 0;
-      const currentGeneration = readTrimmed(REFRESH_TOKEN_PATH);
-      if (!currentGeneration) return void 0;
-      if (currentGeneration !== startingGeneration) {
-        return currentCredential.token;
-      }
-      if (currentCredential.token !== startingAccessToken) {
-        return currentCredential.token;
-      }
-      if (isSessionEnded()) return void 0;
-      const response = await fetch(`${getSiteUrl()}/mcp/broker/refresh`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refresh_token: currentGeneration }),
-        signal: options.signal
-      });
-      if (!response.ok) {
-        const detail = (await response.text().catch(() => "")).slice(0, 200);
-        if (isTerminalRefreshResponse(response, detail) && readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
-          writeTerminalFingerprint(currentGeneration);
-        }
-        refreshDiagnostic(response, detail, options.quiet);
-        const winner = resolveAuthCredential();
-        return readTrimmed(REFRESH_TOKEN_PATH) !== currentGeneration && winner?.source === "token_file" ? winner.token : void 0;
-      }
-      let data;
-      try {
-        data = await response.json();
-      } catch {
-        if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
-          writeTerminalFingerprint(currentGeneration);
-        }
-        return void 0;
-      }
-      const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
-      const accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
-      const replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
-      if (!(accessToken && replacementRefreshToken)) {
-        if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
-          writeTerminalFingerprint(currentGeneration);
-        }
-        return void 0;
-      }
-      commitCredentialsUnlocked({
-        accessToken,
-        refreshToken: replacementRefreshToken,
-        expiresIn: typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0
-      });
-      return accessToken;
-    },
-    { signal: options.signal }
-  );
-}
-var _refreshInFlight;
-function refreshToken(options = {}) {
-  if (_refreshInFlight) return _refreshInFlight;
-  const attempt = performTokenRefresh(options).then((token) => {
-    if (token) _cachedCredential = { token, source: "token_file" };
-    return token;
-  }).finally(() => {
-    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
-  });
-  _refreshInFlight = attempt;
-  return attempt;
-}
-var HttpError = class extends Error {
-  status;
-  body;
-  constructor(status, message, body) {
-    super(message);
-    this.name = "HttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-var _cachedCredential;
-function selectedCredential() {
-  const resolved = resolveAuthCredential();
-  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
-    _cachedCredential = resolved;
-  }
-  return _cachedCredential;
-}
-async function request(method, path, body, options) {
-  const url = `${getSiteUrl()}${path}`;
-  let credential = selectedCredential();
-  let refreshAttempted = false;
-  if (credential && isTokenExpiringSoon(credential)) {
-    refreshAttempted = true;
-    const token = await refreshToken({
-      signal: options?.signal,
-      quiet: options?.quietRefresh
-    });
-    if (token) credential = { token, source: "token_file" };
-  }
-  if (!credential) {
-    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
-  }
-  if (isTokenExpiringSoon(credential) && isSessionEnded()) {
-    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
-  }
-  const doFetch = (token) => {
-    const headers = { "Content-Type": "application/json" };
-    if (token) headers.Authorization = `Bearer ${token}`;
-    return fetch(url, {
-      method,
-      headers,
-      body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: options?.signal
-    });
-  };
-  const tokenUsed = credential?.token;
-  let response = await doFetch(tokenUsed);
-  if (response.status === 401) {
-    const latest = resolveAuthCredential();
-    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
-    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
-      refreshAttempted = true;
-      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
-    }
-    if (retryToken) {
-      _cachedCredential = {
-        token: retryToken,
-        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
-      };
-      response = await doFetch(retryToken);
-    }
-  }
-  if (!response.ok) {
-    if (response.status === 401) {
-      throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
-    }
-    const errorBody = await response.json().catch(() => null);
-    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
-    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
-    throw new HttpError(response.status, message, errorBody);
-  }
-  return response.json();
-}
-function getClient() {
-  return {
-    get: (path, options) => request("GET", path, void 0, options),
-    post: (path, body, options) => request("POST", path, body, options)
-  };
-}
-
-export {
-  withFileLock,
-  TOKEN_FILE_PATH,
-  REFRESH_TOKEN_PATH,
-  resolveAuthCredential,
-  getSiteUrl,
-  getTokenExpiresAt,
-  isSessionEnded,
-  commitCredentials,
-  setStoredToken,
-  clearStoredCredentials,
-  refreshToken,
-  HttpError,
-  getClient
-};