@primitive.ai/prim 0.1.0-alpha.8 → 0.1.0-alpha.81

package/dist/chunk-Z7YPFWAZ.js

@@ -0,0 +1,917 @@
+import {
+  CREDENTIAL_FAMILY_PATH,
+  CREDENTIAL_LOCK_PATH,
+  CREDENTIAL_METADATA_PATH,
+  CREDENTIAL_MIGRATION_PATH,
+  CREDENTIAL_MIGRATION_STATE,
+  CREDENTIAL_MIGRATION_VERSION,
+  REFRESH_TOKEN_PATH,
+  TERMINAL_REFRESH_PATH,
+  TOKEN_EXPIRES_PATH,
+  TOKEN_FILE_PATH,
+  WORKOS_CONNECT_RESPONSE_MAX_BYTES,
+  jwtExpiresAt,
+  parseWorkosConnectTokens,
+  readBoundedJson,
+  readCredentialMigrationState,
+  readStoredCredentialMetadata,
+  resolveAuthCredential,
+  workosConnectTokenEndpoint
+} from "./chunk-3EEFL6NJ.js";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+var DEFAULT_FILE_MODE = 438;
+function syncDirectory(path) {
+  const fd = openSync(path, constants.O_RDONLY);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function syncFile(path) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function syncCreatedParentChain(firstCreatedParent, parent) {
+  const createdDirectories = [];
+  let current = parent;
+  while (current !== firstCreatedParent) {
+    createdDirectories.push(current);
+    const next = dirname(current);
+    if (next === current) {
+      throw new Error("recursive mkdir returned a path outside the target parent chain");
+    }
+    current = next;
+  }
+  createdDirectories.push(firstCreatedParent);
+  syncDirectory(dirname(firstCreatedParent));
+  for (const directory of createdDirectories.reverse().slice(0, -1)) {
+    syncDirectory(directory);
+  }
+}
+function ensureDurableDirectory(path, mode) {
+  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
+  if (firstCreatedParent) {
+    syncCreatedParentChain(firstCreatedParent, path);
+  }
+}
+function atomicWriteFile(target, content, options = {}) {
+  const parent = dirname(target);
+  if (options.ensureParent) {
+    ensureDurableDirectory(parent);
+  }
+  const temporaryPath = `${target}.${randomUUID()}.tmp`;
+  let temporaryCreated = false;
+  try {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
+    temporaryCreated = true;
+    try {
+      if (options.mode !== void 0) fchmodSync(fd, options.mode);
+      writeFileSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    options.validate?.(temporaryPath);
+    renameSync(temporaryPath, target);
+    syncDirectory(parent);
+  } catch (error) {
+    if (temporaryCreated) {
+      try {
+        rmSync(temporaryPath, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+
+// src/lib/process-liveness.ts
+function processIsAlive(pid, probe = process.kill) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    probe(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join } from "path";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_POLL_MS = 50;
+var DEFAULT_INIT_GRACE_MS = 2e3;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+function ownerPath(lockDir) {
+  return join(lockDir, "owner.json");
+}
+function readOwner(lockDir) {
+  try {
+    const owner = JSON.parse(readFileSync(ownerPath(lockDir), "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
+      return null;
+    }
+    return owner;
+  } catch {
+    return null;
+  }
+}
+function sameOwner(a, b) {
+  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+}
+function tryTakeLock(lockDir, now) {
+  try {
+    mkdirSync2(lockDir, { mode: DIRECTORY_MODE });
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  const owner = {
+    pid: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    createdAt: now
+  };
+  try {
+    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE,
+      flag: "wx"
+    });
+    return owner;
+  } catch (error) {
+    rmSync2(lockDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function recoverStaleLock(lockDir, now, alive, initGraceMs) {
+  const owner = readOwner(lockDir);
+  if (owner) {
+    if (alive(owner.pid)) return false;
+    if (!sameOwner(readOwner(lockDir), owner)) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  }
+  try {
+    const before = statSync(lockDir).mtimeMs;
+    if (now - before < initGraceMs) return false;
+    if (readOwner(lockDir)) return false;
+    if (statSync(lockDir).mtimeMs !== before) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return true;
+  }
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError(signal);
+}
+async function defaultSleep(ms, signal) {
+  if (!signal) {
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
+    return;
+  }
+  throwIfAborted(signal);
+  await new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function defaultSleepSync(ms) {
+  Atomics.wait(syncSleeper, 0, 0, ms);
+}
+function withFileLockSync(lockDir, operation, options = {}) {
+  mkdirSync2(dirname2(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    (options.sleep ?? defaultSleepSync)(options.pollMs ?? DEFAULT_POLL_MS);
+  }
+  try {
+    return operation();
+  } finally {
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync2(lockDir, { recursive: true, force: true });
+    }
+  }
+}
+async function withFileLock(lockDir, operation, options = {}) {
+  mkdirSync2(dirname2(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    throwIfAborted(options.signal);
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    if (options.sleep) {
+      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
+      throwIfAborted(options.signal);
+    } else {
+      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
+    }
+  }
+  try {
+    throwIfAborted(options.signal);
+    return await operation();
+  } finally {
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync2(lockDir, { recursive: true, force: true });
+    }
+  }
+}
+
+// src/lib/terminal-safe.ts
+function replaceIsolatedSurrogates(value) {
+  let out = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += value[index] + value[index + 1];
+        index += 1;
+      } else {
+        out += "\uFFFD";
+      }
+    } else if (unit >= 56320 && unit <= 57343) {
+      out += "\uFFFD";
+    } else {
+      out += value[index];
+    }
+  }
+  return out;
+}
+function isUnsafeTerminalCodePoint(point) {
+  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
+  const bidiOrZeroWidth = point === 173 || // soft hyphen
+  point === 1564 || // Arabic letter mark
+  point === 6158 || // Mongolian vowel separator
+  point >= 8203 && point <= 8207 || // zero-width + directional marks
+  point >= 8234 && point <= 8238 || // bidi embeddings/overrides
+  point >= 8288 && point <= 8303 || // word joiner + bidi isolates/controls
+  point >= 65529 && point <= 65531 || // interlinear annotation controls
+  point === 65279 || // zero-width no-break space / BOM
+  point >= 917504 && point <= 917631;
+  return c0OrC1 || bidiOrZeroWidth;
+}
+function terminalSafeText(value) {
+  return Array.from(replaceIsolatedSurrogates(value)).filter((character) => !isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0)).join("");
+}
+function terminalSafeLine(value) {
+  return terminalSafeText(value.replace(/\s+/gu, " ")).replace(/\s+/gu, " ").trim();
+}
+function isTerminalSafeText(value) {
+  return terminalSafeText(value) === value;
+}
+var stripControlChars = terminalSafeText;
+
+// src/client.ts
+import { createHash } from "crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, rmSync as rmSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+var CONFIG_DIR_MODE = 448;
+var CREDENTIAL_FILE_MODE = 384;
+var REFRESH_THRESHOLD_MS = 6e4;
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
+var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync2(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function getSiteUrl() {
+  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
+}
+function getSiteUrlForEnvironment(primApiUrl) {
+  return primApiUrl?.trim() || DEFAULT_API_URL;
+}
+function expiresAtFor(token, expiresIn) {
+  return expiresIn === void 0 ? jwtExpiresAt(token) : Date.now() + expiresIn * 1e3;
+}
+function ensureConfigDirectory() {
+  const directory = dirname3(TOKEN_FILE_PATH);
+  mkdirSync3(directory, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodSync(directory, CONFIG_DIR_MODE);
+}
+function atomicWrite(path, content) {
+  ensureConfigDirectory();
+  atomicWriteFile(path, content, { mode: CREDENTIAL_FILE_MODE });
+}
+function removeCredentialFile(path) {
+  if (!existsSync2(path)) return false;
+  rmSync3(path, { force: true });
+  return true;
+}
+function getTokenExpiresAt() {
+  const stored = readTrimmed(TOKEN_EXPIRES_PATH);
+  if (stored === void 0) return void 0;
+  const value = Number(stored);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function isTokenExpiringSoon(credential) {
+  if (credential.source !== "token_file") return false;
+  const expiresAt = getTokenExpiresAt();
+  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
+}
+function refreshFingerprint(refreshToken2) {
+  return createHash("sha256").update(refreshToken2).digest("hex");
+}
+function legacyBrokerCredentialMetadata(accessToken, refreshToken2) {
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
+  };
+}
+function credentialFamilyMetadata(accessToken, refreshToken2, metadata) {
+  const hashes = {
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
+  };
+  return metadata === void 0 ? legacyBrokerCredentialMetadata(accessToken, refreshToken2) : { ...metadata, ...hashes };
+}
+function writeCredentialMigrationSentinel() {
+  atomicWrite(
+    CREDENTIAL_MIGRATION_PATH,
+    `${JSON.stringify({
+      version: CREDENTIAL_MIGRATION_VERSION,
+      state: CREDENTIAL_MIGRATION_STATE
+    })}
+`
+  );
+}
+function bindLegacyBrokerGeneration(accessToken, refreshToken2, metadata) {
+  if (metadata.state !== "legacy_broker" || !accessToken || !refreshToken2) {
+    return { state: "invalid" };
+  }
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  if (metadata.metadata !== void 0 && (metadata.metadata.accessTokenHash !== familyMetadata.accessTokenHash || metadata.metadata.refreshTokenHash !== familyMetadata.refreshTokenHash)) {
+    return { state: "invalid" };
+  }
+  if (metadata.metadata === void 0) {
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+  }
+  const migrationState = readCredentialMigrationState();
+  if (migrationState === "invalid") return { state: "invalid" };
+  if (migrationState === "absent") writeCredentialMigrationSentinel();
+  return { state: "legacy_broker", metadata: familyMetadata };
+}
+function preserveMarkerlessLegacyGeneration() {
+  const metadata = readStoredCredentialMetadata();
+  if (metadata.state !== "legacy_broker" || metadata.metadata !== void 0) return;
+  const accessToken = readTrimmed(TOKEN_FILE_PATH);
+  const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
+  if (!(accessToken && refreshToken2)) return;
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+}
+function terminalFingerprint() {
+  return readTrimmed(TERMINAL_REFRESH_PATH);
+}
+function writeTerminalFingerprint(refreshToken2) {
+  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
+`);
+}
+function clearTerminalFingerprint() {
+  removeCredentialFile(TERMINAL_REFRESH_PATH);
+}
+function isSessionEnded() {
+  if (resolveAuthCredential()?.source !== "token_file") return false;
+  const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
+  const ended = terminalFingerprint();
+  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
+}
+function withCredentialLock(operation, options = {}) {
+  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
+}
+function commitCredentialsUnlocked(credentials) {
+  const accessToken = credentials.accessToken.trim();
+  const refreshToken2 = credentials.refreshToken.trim();
+  if (!accessToken || !refreshToken2) {
+    throw new Error("OAuth credentials require both access and refresh tokens");
+  }
+  const familyMetadata = credentialFamilyMetadata(accessToken, refreshToken2, credentials.metadata);
+  if (credentials.metadata !== void 0) {
+    preserveMarkerlessLegacyGeneration();
+    writeCredentialMigrationSentinel();
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(CREDENTIAL_METADATA_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+  } else {
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    removeCredentialFile(CREDENTIAL_METADATA_PATH);
+  }
+  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
+  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
+  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
+`);
+  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
+`);
+  clearTerminalFingerprint();
+  _cachedCredential = { token: accessToken, source: "token_file" };
+}
+async function commitCredentials(credentials, options = {}) {
+  await withCredentialLock(() => commitCredentialsUnlocked(credentials), options);
+}
+async function setStoredToken(token, options = {}) {
+  const value = token.trim();
+  if (!value) throw new Error("Token cannot be empty");
+  await withCredentialLock(() => {
+    removeCredentialFile(REFRESH_TOKEN_PATH);
+    removeCredentialFile(TOKEN_EXPIRES_PATH);
+    removeCredentialFile(CREDENTIAL_FAMILY_PATH);
+    removeCredentialFile(CREDENTIAL_METADATA_PATH);
+    clearTerminalFingerprint();
+    removeCredentialFile(CREDENTIAL_MIGRATION_PATH);
+    atomicWrite(TOKEN_FILE_PATH, `${value}
+`);
+    _cachedCredential = { token: value, source: "token_file" };
+  }, options);
+}
+async function clearStoredCredentials(options = {}) {
+  const { beforeClear, ...lockOptions } = options;
+  return withCredentialLock(async () => {
+    const accessToken = readTrimmed(TOKEN_FILE_PATH);
+    const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
+    const metadata = readStoredCredentialMetadata();
+    let protectedMetadata = metadata;
+    if (metadata.state === "legacy_broker") {
+      try {
+        protectedMetadata = bindLegacyBrokerGeneration(accessToken, refreshToken2, metadata);
+      } catch {
+        protectedMetadata = { state: "invalid" };
+      }
+    }
+    let callbackError;
+    try {
+      await beforeClear?.(refreshToken2, protectedMetadata);
+    } catch (error) {
+      callbackError = error;
+    }
+    let removed = false;
+    for (const path of [
+      REFRESH_TOKEN_PATH,
+      TOKEN_EXPIRES_PATH,
+      CREDENTIAL_FAMILY_PATH,
+      CREDENTIAL_METADATA_PATH,
+      TERMINAL_REFRESH_PATH,
+      TOKEN_FILE_PATH,
+      CREDENTIAL_MIGRATION_PATH
+    ]) {
+      removed = removeCredentialFile(path) || removed;
+    }
+    _cachedCredential = void 0;
+    if (callbackError) throw callbackError;
+    return removed;
+  }, lockOptions);
+}
+function isTerminalRefreshResponse(response, detail) {
+  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
+  try {
+    const error = JSON.parse(detail).error;
+    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
+  } catch {
+    return response.status === 401 && detail.includes("Invalid or expired refresh token");
+  }
+}
+function workosConnectRefreshErrorCode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
+  return value.error === "invalid_grant" ? "invalid_grant" : "";
+}
+function refreshDiagnostic(response, detail, quiet, provider) {
+  if (quiet) return;
+  const statusText = terminalSafeLine(response.statusText).slice(0, 120);
+  const safeDetail = terminalSafeLine(detail).slice(0, 200);
+  process.stderr.write(
+    `[prim] token refresh rejected by ${provider}: ${response.status}${statusText ? ` ${statusText}` : ""}${safeDetail ? ` \u2014 ${safeDetail}` : ""}
+`
+  );
+}
+function metadataMatchesCredentialGeneration(expected, accessToken, refreshToken2) {
+  const current = readStoredCredentialMetadata();
+  if (expected.state === "legacy_broker") {
+    if (current.state !== "legacy_broker") return false;
+    if (!expected.metadata) return current.metadata === void 0;
+    return current.metadata !== void 0 && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
+  }
+  if (expected.state !== "workos_connect" || current.state !== "workos_connect") return false;
+  return current.metadata.issuer === expected.metadata.issuer && current.metadata.clientId === expected.metadata.clientId && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
+}
+function uncoordinatedLegacyWinnerAccessToken(expected, currentGeneration) {
+  if (!expected || readCredentialMigrationState() !== "valid") return void 0;
+  const stored = readStoredCredentialMetadata();
+  if (stored.state !== "legacy_broker" || stored.metadata === void 0 || stored.metadata.accessTokenHash !== expected.accessTokenHash || stored.metadata.refreshTokenHash !== expected.refreshTokenHash) {
+    return void 0;
+  }
+  const replacementRefreshToken = readTrimmed(REFRESH_TOKEN_PATH);
+  if (!replacementRefreshToken || replacementRefreshToken === currentGeneration) return void 0;
+  return readTrimmed(TOKEN_FILE_PATH);
+}
+function winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration) {
+  if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) return void 0;
+  const winner = resolveAuthCredential();
+  return (winner?.source === "token_file" ? winner.token : void 0) ?? uncoordinatedLegacyWinnerAccessToken(expectedLegacyGeneration, currentGeneration);
+}
+async function performTokenRefresh(options = {}) {
+  const selected = resolveAuthCredential();
+  if (selected?.source !== "token_file") return void 0;
+  const startingGeneration = readTrimmed(REFRESH_TOKEN_PATH);
+  if (!startingGeneration || isSessionEnded()) return void 0;
+  const startingAccessToken = selected.token;
+  return withCredentialLock(
+    async () => {
+      const currentCredential = resolveAuthCredential();
+      if (currentCredential?.source !== "token_file") return void 0;
+      const currentGeneration = readTrimmed(REFRESH_TOKEN_PATH);
+      if (!currentGeneration) return void 0;
+      if (currentGeneration !== startingGeneration) {
+        return currentCredential.token;
+      }
+      if (currentCredential.token !== startingAccessToken) {
+        return currentCredential.token;
+      }
+      if (isSessionEnded()) return void 0;
+      let metadata = readStoredCredentialMetadata();
+      const markerlessLegacyAtStart = metadata.state === "legacy_broker" && metadata.metadata === void 0;
+      if (metadata.state === "invalid" || metadata.state === "workos_connect" && (metadata.metadata.accessTokenHash !== refreshFingerprint(currentCredential.token) || metadata.metadata.refreshTokenHash !== refreshFingerprint(currentGeneration))) {
+        return void 0;
+      }
+      if (metadata.state === "legacy_broker") {
+        try {
+          metadata = bindLegacyBrokerGeneration(
+            currentCredential.token,
+            currentGeneration,
+            metadata
+          );
+        } catch {
+          return void 0;
+        }
+        if (metadata.state !== "legacy_broker") return void 0;
+      }
+      const expectedLegacyGeneration = markerlessLegacyAtStart && metadata.state === "legacy_broker" ? metadata.metadata : void 0;
+      const connectContext = metadata.state === "workos_connect" ? {
+        version: 1,
+        family: "workos_connect",
+        issuer: metadata.metadata.issuer,
+        clientId: metadata.metadata.clientId
+      } : void 0;
+      const response = await fetch(
+        connectContext ? workosConnectTokenEndpoint(connectContext.issuer) : `${getSiteUrl()}/mcp/broker/refresh`,
+        connectContext ? {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: currentGeneration,
+            client_id: connectContext.clientId
+          }),
+          signal: options.signal
+        } : {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ refresh_token: currentGeneration }),
+          signal: options.signal
+        }
+      );
+      let directResponse;
+      if (connectContext) {
+        try {
+          directResponse = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+        } catch {
+          if (response.ok && readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      }
+      if (!response.ok) {
+        let detail = "";
+        if (connectContext) {
+          detail = workosConnectRefreshErrorCode(directResponse);
+        } else {
+          detail = (await response.text().catch(() => "")).slice(0, 200);
+        }
+        if (isTerminalRefreshResponse(response, detail) && readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        refreshDiagnostic(
+          response,
+          detail,
+          options.quiet,
+          connectContext ? "WorkOS Connect" : "broker"
+        );
+        return winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      let accessToken;
+      let replacementRefreshToken;
+      let expiresIn;
+      if (connectContext) {
+        try {
+          const tokens = parseWorkosConnectTokens(directResponse, {
+            fallbackRefreshToken: currentGeneration
+          });
+          accessToken = tokens.accessToken;
+          replacementRefreshToken = tokens.refreshToken;
+          expiresIn = tokens.expiresIn;
+        } catch {
+          if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      } else {
+        let data;
+        try {
+          data = await response.json();
+        } catch {
+          if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+        const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
+        accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
+        replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
+        expiresIn = typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0;
+        if (!(accessToken && replacementRefreshToken)) {
+          if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      }
+      const latestCredential = resolveAuthCredential();
+      if (readTrimmed(REFRESH_TOKEN_PATH) !== currentGeneration || latestCredential?.source !== "token_file" || latestCredential.token !== currentCredential.token || !metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+        return latestCredential?.source === "token_file" ? latestCredential.token : winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      commitCredentialsUnlocked({
+        accessToken,
+        refreshToken: replacementRefreshToken,
+        expiresIn,
+        metadata: connectContext
+      });
+      return accessToken;
+    },
+    { signal: options.signal }
+  );
+}
+var _refreshInFlight;
+function refreshToken(options = {}) {
+  if (_refreshInFlight) return _refreshInFlight;
+  const attempt = performTokenRefresh(options).then((token) => {
+    if (token) _cachedCredential = { token, source: "token_file" };
+    return token;
+  }).finally(() => {
+    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
+  });
+  _refreshInFlight = attempt;
+  return attempt;
+}
+var HttpError = class extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+var CliManagementResponseError = class extends Error {
+  constructor() {
+    super("Invalid API-key management response");
+    this.name = "CliManagementResponseError";
+  }
+};
+var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+async function managementResponseValue(response) {
+  if (response.status === 401) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  let value;
+  try {
+    value = await readBoundedJson(response, CLI_MANAGEMENT_RESPONSE_MAX_BYTES);
+  } catch {
+    if (response.ok) throw new CliManagementResponseError();
+    throw new HttpError(response.status, `HTTP ${response.status}`, null);
+  }
+  if (!response.ok) {
+    throw new HttpError(response.status, `HTTP ${response.status}`, value);
+  }
+  return value;
+}
+var _cachedCredential;
+function selectedCredential() {
+  const resolved = resolveAuthCredential();
+  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
+    _cachedCredential = resolved;
+  }
+  return _cachedCredential;
+}
+function fetchWithToken(method, path, body, options, token, siteUrl) {
+  return fetch(`${siteUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    signal: options?.signal
+  });
+}
+async function responseValue(response) {
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+    }
+    const errorBody = await response.json().catch(() => null);
+    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
+    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
+    throw new HttpError(response.status, message, errorBody);
+  }
+  return response.json();
+}
+async function request(method, path, body, options) {
+  const siteUrl = getSiteUrl();
+  let credential = selectedCredential();
+  let refreshAttempted = false;
+  if (credential && isTokenExpiringSoon(credential)) {
+    refreshAttempted = true;
+    const token = await refreshToken({
+      signal: options?.signal,
+      quiet: options?.quietRefresh
+    });
+    if (token) credential = { token, source: "token_file" };
+  }
+  if (!credential) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  if (isTokenExpiringSoon(credential) && isSessionEnded()) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  const tokenUsed = credential.token;
+  let response = await fetchWithToken(method, path, body, options, tokenUsed, siteUrl);
+  if (response.status === 401) {
+    const latest = resolveAuthCredential();
+    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
+    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
+      refreshAttempted = true;
+      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
+    }
+    if (retryToken) {
+      _cachedCredential = {
+        token: retryToken,
+        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
+      };
+      response = await fetchWithToken(method, path, body, options, retryToken, siteUrl);
+    }
+  }
+  return responseValue(response);
+}
+function getClient() {
+  return {
+    get: (path, options) => request("GET", path, void 0, options),
+    post: (path, body, options) => request("POST", path, body, options)
+  };
+}
+async function getPinnedClient(options = {}) {
+  const siteUrl = getSiteUrl();
+  let credential = selectedCredential();
+  if (credential && isTokenExpiringSoon(credential)) {
+    const token2 = await refreshToken({
+      signal: options.signal,
+      quiet: options.quietRefresh
+    });
+    if (token2) credential = { token: token2, source: "token_file" };
+  }
+  if (!credential || isTokenExpiringSoon(credential) && isSessionEnded()) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  const token = credential.token;
+  const pinnedRequest = async (method, path, body, requestOptions) => responseValue(await fetchWithToken(method, path, body, requestOptions, token, siteUrl));
+  return {
+    get: (path, requestOptions) => pinnedRequest("GET", path, void 0, requestOptions),
+    post: (path, body, requestOptions) => pinnedRequest("POST", path, body, requestOptions)
+  };
+}
+async function getPinnedManagementClient(options = {}) {
+  const siteUrl = getSiteUrl();
+  let credential = selectedCredential();
+  if (credential && isTokenExpiringSoon(credential)) {
+    const token2 = await refreshToken({
+      signal: options.signal,
+      quiet: options.quietRefresh
+    });
+    if (token2) credential = { token: token2, source: "token_file" };
+  }
+  if (!credential || isTokenExpiringSoon(credential) && isSessionEnded()) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  const token = credential.token;
+  const pinnedRequest = async (method, path, body, requestOptions) => managementResponseValue(
+    await fetchWithToken(method, path, body, requestOptions, token, siteUrl)
+  );
+  return {
+    delete: (path, body, requestOptions) => pinnedRequest("DELETE", path, body, requestOptions),
+    get: (path, requestOptions) => pinnedRequest("GET", path, void 0, requestOptions),
+    post: (path, body, requestOptions) => pinnedRequest("POST", path, body, requestOptions)
+  };
+}
+
+export {
+  syncDirectory,
+  syncFile,
+  atomicWriteFile,
+  processIsAlive,
+  withFileLockSync,
+  withFileLock,
+  terminalSafeText,
+  terminalSafeLine,
+  isTerminalSafeText,
+  stripControlChars,
+  getSiteUrl,
+  getTokenExpiresAt,
+  isSessionEnded,
+  commitCredentials,
+  setStoredToken,
+  clearStoredCredentials,
+  refreshToken,
+  HttpError,
+  CliManagementResponseError,
+  getClient,
+  getPinnedClient,
+  getPinnedManagementClient
+};