@route_33/opencode 0.4.6 → 0.4.7-rc.2

package/dist/cli/production-smoke/production-smoke.js

@@ -0,0 +1,1649 @@
+// src/cli/production-smoke/production-smoke.ts
+import { fileURLToPath } from "node:url";
+
+// src/requested-client-id/requested-client-id.ts
+var DEFAULT_ROUTE33_CLIENT_ID = false ? "" : "oa_platform_203623de";
+
+// src/shared/logger/logger.ts
+var logger = {
+  info: (...args) => {
+    console.log("[route_33]", ...args);
+  },
+  warn: (...args) => {
+    console.warn("[route_33]", ...args);
+  },
+  error: (...args) => {
+    console.error("[route_33]", ...args);
+  }
+};
+
+// src/auth/auth-error/auth-error.ts
+var AuthError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 authorization failed",
+      options?.cause === void 0 ? void 0 : { cause: options.cause }
+    );
+    this.code = code;
+    this.name = "AuthError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
+};
+
+// src/auth/build-authorize-url/build-authorize-url.ts
+var buildAuthorizeUrl = (issuerUrl, request) => {
+  const url = new URL("/authorize", issuerUrl);
+  url.search = new URLSearchParams({
+    client_id: request.clientId,
+    code_challenge: request.codeChallenge,
+    code_challenge_method: "S256",
+    redirect_uri: request.redirectUri,
+    response_type: "code",
+    scope: request.scope,
+    state: request.state
+  }).toString();
+  return url;
+};
+
+// src/contract/adapters/contract-parse-error/contract-parse-error.ts
+var ContractParseError = class extends Error {
+};
+
+// src/contract/adapters/gateway-api-key/gateway-api-key.ts
+var GatewayApiKey = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/management-jwt/management-jwt.ts
+var ManagementJwt = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/parse-management-jwt/parse-management-jwt.ts
+var parseManagementJwt = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("management token must be non-empty");
+  }
+  return new ManagementJwt(value);
+};
+
+// src/contract/predicates/has-string-fields/has-string-fields.ts
+var hasStringFields = (record, fields) => fields.every((field) => typeof record[field] === "string");
+
+// src/contract/predicates/is-nullable-string/is-nullable-string.ts
+var isNullableString = (value) => typeof value === "string" || value === null;
+
+// src/contract/predicates/is-owner-type/is-owner-type.ts
+var isOwnerType = (value) => value === "project" || value === "user_personal" || value === "user_project";
+
+// src/contract/predicates/is-record/is-record.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+
+// src/contract/adapters/parse-management-subject/parse-management-subject.ts
+var parseManagementSubject = (credential) => {
+  const encodedPayload = credential.value.split(".")[1];
+  if (encodedPayload === void 0 || encodedPayload.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(
+      Buffer.from(encodedPayload, "base64url").toString("utf8")
+    );
+  } catch {
+    throw new ContractParseError("management token payload is not JSON");
+  }
+  if (!isRecord(payload)) {
+    throw new ContractParseError("management token payload is not an object");
+  }
+  const subject = payload["sub"];
+  if (typeof subject !== "string" || subject.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  return subject;
+};
+
+// src/contract/auth-session/parse-token-set/parse-token-set.ts
+var parseTokenSet = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid token response");
+  }
+  if (typeof value["access_token"] !== "string" || typeof value["expires_in"] !== "number" || value["token_type"] !== "Bearer") {
+    throw new ContractParseError("invalid token response");
+  }
+  return {
+    access_token: value["access_token"],
+    expires_in: value["expires_in"],
+    token_type: "Bearer",
+    ...typeof value["id_token"] === "string" ? { id_token: value["id_token"] } : {},
+    ...typeof value["refresh_token"] === "string" ? { refresh_token: value["refresh_token"] } : {},
+    ...typeof value["scope"] === "string" ? { scope: value["scope"] } : {}
+  };
+};
+
+// src/auth/exchange-code-and-parse/exchange-code-and-parse.ts
+var exchangeCodeAndParse = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    code: options.input.code,
+    code_verifier: options.input.codeVerifier,
+    grant_type: "authorization_code",
+    redirect_uri: options.input.redirectUri
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/refresh-session/refresh-session.ts
+var refreshSession = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    grant_type: "refresh_token",
+    refresh_token: options.refreshToken
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/create-auth-session/create-auth-session.ts
+var createAuthSession = (options) => {
+  const tokenUrl = new URL("/oauth/token", options.issuerUrl);
+  return {
+    authorizationUrl: (request) => buildAuthorizeUrl(options.issuerUrl, request),
+    exchangeCode: (input) => exchangeCodeAndParse({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      input,
+      tokenUrl
+    }),
+    refresh: (refreshToken) => refreshSession({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      refreshToken,
+      tokenUrl
+    })
+  };
+};
+
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+import { spawn } from "node:child_process";
+import { timingSafeEqual } from "node:crypto";
+
+// src/auth/loopback-callback/loopback-callback.ts
+import { createServer } from "node:http";
+
+// src/auth/loopback-callback/callback-page/callback-page.ts
+var MARK_PATHS = [
+  "M310.6,175.8c0-6.1-2.7-11.8-7.2-15.9l-127.6-114.4V7h-43.5v48.3c0,6.2,2.6,12.1,7.2,16.2l92.5,82.9H0v43.5h234.7l-95.6,91.4c-4.3,4.1-6.7,9.8-6.7,15.7v48.3h43.5v-39l128.1-122.4c4.4-4.2,6.8-10,6.7-16.1h0Z",
+  "M457.2,175.9v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4-13.3,14.8-23.2,19.5-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,9,19.4,9,31.2s-3,21.2-9.1,29.8-14.4,15.3-25.1,20.1c-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2c18.6-8.8,33.3-20.8,44-36,10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6c-12.8-14.9-30.8-24.2-54-27.8h0Z",
+  "M763,203.7c-12.8-14.9-30.8-24.2-54-27.8v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-8.9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4c-5.6,8.3-13.3,14.8-23.2,19.5s-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,8.9,19.4,8.9,31.2s-3,21.2-9.1,29.8c-6.1,8.6-14.4,15.3-25.1,20.1-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2,33.3-20.8,44-36c10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6h0Z"
+];
+var BRAND_MARK = `<svg class="r33-mark" viewBox="0 0 782.2 360.3" fill="currentColor" role="img" aria-label="route33.ai" xmlns="http://www.w3.org/2000/svg"><path d="${MARK_PATHS[0]}"/><path d="${MARK_PATHS[1]}"/><path d="${MARK_PATHS[2]}"/></svg>`;
+var PAGE_STYLE = `:root{color-scheme:dark;--r33-euro-blue:#0000FF;--r33-off-white:#F1F1F1;--r33-off-black:#121212;--r33-grey-300:#C9CBCF;--r33-radius-fillet:4px;--r33-space-2:8px;--r33-space-3:16px;--r33-space-4:24px;--r33-space-6:64px;--r33-font-body:"Geist","Helvetica Neue",Arial,sans-serif;--r33-font-mono:"Geist Mono","SFMono-Regular",Menlo,monospace;--r33-surface:var(--r33-off-black);--r33-text-primary:var(--r33-off-white);--r33-text-secondary:var(--r33-grey-300);--r33-fill-accent:var(--r33-euro-blue);--r33-on-fill-accent:var(--r33-off-white)}
+*{box-sizing:border-box}
+html,body{margin:0}
+.r33-page{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:var(--r33-space-6);background:var(--r33-surface);color:var(--r33-text-primary);font-family:var(--r33-font-body);-webkit-font-smoothing:antialiased}
+.r33-panel{display:grid;gap:var(--r33-space-4);max-width:460px;width:100%}
+.r33-mark{height:40px;width:auto;color:var(--r33-text-primary)}
+.r33-status{display:inline-flex;align-items:center;gap:var(--r33-space-2);font-size:11px;letter-spacing:0.08em;text-transform:uppercase;color:var(--r33-text-secondary)}
+.r33-status__dot{width:8px;height:8px;background:var(--r33-fill-accent)}
+.r33-status__dot--error{background:transparent;border:1px solid var(--r33-text-primary);border-radius:50%}
+.r33-headline{margin:0;font-size:48px;line-height:0.85;letter-spacing:-0.02em;font-weight:600;color:var(--r33-text-primary);text-wrap:balance}
+.r33-subline{margin:0;font-size:16px;line-height:1.45;color:var(--r33-text-secondary);max-width:40ch;text-wrap:pretty}
+.r33-code{margin:0;font-size:13px;letter-spacing:0.04em;color:var(--r33-text-secondary)}
+.r33-code__value{font-family:var(--r33-font-mono);text-transform:uppercase;color:var(--r33-text-primary)}
+@media (prefers-reduced-motion:reduce){*{animation-duration:1ms!important;transition-duration:1ms!important}}`;
+var buildCallbackPage = (state, errorCode) => {
+  const isError = state === "error";
+  const safeCode = (errorCode ?? "").replace(/[^a-z0-9_-]/gi, "");
+  const title = isError ? "Sign-in failed" : "Signed in";
+  const headline = isError ? "Sign-in failed" : "Signed in to route33";
+  const subline = isError ? "Return to OpenCode and retry." : "Return to OpenCode \u2014 one more step may wait there: if it asks who pays for usage, pick a project. Then this window can be closed.";
+  const statusLabel = isError ? "Authentication error" : "Authenticated";
+  const dotClass = isError ? "r33-status__dot r33-status__dot--error" : "r33-status__dot";
+  const codeLine = isError && safeCode.length > 0 ? `<p class="r33-code">Error code: <span class="r33-code__value">${safeCode}</span></p>` : "";
+  return `<!doctype html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} \xB7 route33.ai</title>
+<style>${PAGE_STYLE}</style>
+</head>
+<body>
+<main class="r33-page">
+<div class="r33-panel">
+${BRAND_MARK}
+<span class="r33-status"><span class="${dotClass}"></span>${statusLabel}</span>
+<h1 class="r33-headline">${headline}</h1>
+<p class="r33-subline">${subline}</p>
+${codeLine}
+</div>
+</main>
+</body>
+</html>`;
+};
+
+// src/auth/loopback-callback/loopback-callback.ts
+var createAuthLoopbackCallback = async () => {
+  let redirectUri = "http://127.0.0.1/callback";
+  let resolveCapture;
+  const captured = new Promise((resolve) => {
+    resolveCapture = resolve;
+  });
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", redirectUri);
+    if (request.method !== "GET" || url.pathname !== "/callback") {
+      response.writeHead(404).end();
+      return;
+    }
+    const resolve = resolveCapture;
+    resolveCapture = void 0;
+    resolve?.(url);
+    const error = url.searchParams.get("error");
+    const page = error === null || error.length === 0 ? buildCallbackPage("success") : buildCallbackPage("error", error);
+    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    response.end(page);
+  });
+  await new Promise((resolve, reject) => {
+    const onError = (cause) => {
+      reject(new AuthError("AUTH_CALLBACK_LISTEN_FAILED", { cause }));
+    };
+    server.once("error", onError);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new AuthError("AUTH_CALLBACK_LISTEN_FAILED");
+  }
+  redirectUri = `http://127.0.0.1:${String(address.port)}/callback`;
+  return {
+    redirectUri,
+    close: () => {
+      if (!server.listening) {
+        return Promise.resolve();
+      }
+      return new Promise((resolve, reject) => {
+        server.close((cause) => {
+          if (cause === void 0) {
+            resolve();
+            return;
+          }
+          reject(new AuthError("AUTH_CALLBACK_CLEANUP_FAILED", { cause }));
+        });
+      });
+    },
+    wait: () => captured
+  };
+};
+
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+var openBrowserAndCapture = async (options) => {
+  const callback = await createAuthLoopbackCallback();
+  const authorizationUrl = options.authorizationUrl(callback.redirectUri);
+  const browserRunner = options.browserRunner ?? ((url) => new Promise((resolve, reject) => {
+    let command = "xdg-open";
+    let args = [url.href];
+    if (process.platform === "darwin") {
+      command = "open";
+    } else if (process.platform === "win32") {
+      command = "cmd";
+      args = ["/c", "start", "", url.href];
+    }
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  }));
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new AuthError("AUTH_CALLBACK_TIMEOUT"));
+    }, options.timeoutMs ?? 12e4);
+  });
+  const launch = browserRunner(authorizationUrl).catch((cause) => {
+    throw new AuthError("AUTH_BROWSER_LAUNCH_FAILED", { cause });
+  });
+  try {
+    const completed = await Promise.race([
+      Promise.all([launch, callback.wait()]),
+      timeout
+    ]);
+    const callbackUrl = completed[1];
+    const actualState = callbackUrl.searchParams.get("state");
+    if (actualState === null) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
+    }
+    const expectedState = Buffer.from(options.expectedState);
+    const receivedState = Buffer.from(actualState);
+    if (expectedState.length !== receivedState.length || !timingSafeEqual(expectedState, receivedState)) {
+      throw new AuthError("AUTH_CALLBACK_STATE_MISMATCH");
+    }
+    const code = callbackUrl.searchParams.get("code");
+    if (code === null || code.length === 0) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
+    }
+    return { code, redirectUri: callback.redirectUri };
+  } finally {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    await callback.close();
+  }
+};
+
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+import { randomBytes } from "node:crypto";
+
+// src/auth/pkce-challenge/pkce-challenge.ts
+import { createHash } from "node:crypto";
+var pkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+var createPkceVerifierAndChallenge = () => {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  return {
+    codeChallenge: pkceChallenge(codeVerifier),
+    codeVerifier,
+    state: randomBytes(32).toString("base64url")
+  };
+};
+
+// src/auth/requested-scopes/requested-scopes.ts
+var REQUESTED_OAUTH_SCOPES = "openid offline_access projects:read api-keys:read api-keys:create api-keys:rotate api-keys:delete";
+
+// src/auth/login-flow/login-flow.ts
+var loginFlow = async (options) => {
+  const log = options.logger ?? logger;
+  log.info("auth.login.started");
+  const pkce = createPkceVerifierAndChallenge();
+  const captured = await openBrowserAndCapture({
+    authorizationUrl: (redirectUri) => options.session.authorizationUrl({
+      clientId: options.clientId,
+      codeChallenge: pkce.codeChallenge,
+      redirectUri,
+      scope: REQUESTED_OAUTH_SCOPES,
+      state: pkce.state
+    }),
+    ...options.browserRunner === void 0 ? {} : { browserRunner: options.browserRunner },
+    expectedState: pkce.state,
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+  });
+  const tokenSet = await options.session.exchangeCode({
+    code: captured.code,
+    codeVerifier: pkce.codeVerifier,
+    redirectUri: captured.redirectUri
+  });
+  let credential;
+  try {
+    credential = parseManagementJwt(tokenSet.access_token);
+  } catch (cause) {
+    throw new AuthError("AUTH_TOKEN_RESPONSE_INVALID", { cause });
+  }
+  log.info("auth.login.completed");
+  return { credential, tokenSet };
+};
+
+// src/key-lease/default-gateway-key-renewal-ratio/default-gateway-key-renewal-ratio.ts
+var DEFAULT_GATEWAY_KEY_RENEWAL_RATIO = 0.8;
+
+// src/key-lease/default-gateway-key-ttl-ms/default-gateway-key-ttl-ms.ts
+var DEFAULT_GATEWAY_KEY_TTL_MS = 15 * 60 * 1e3;
+
+// src/key-lease/key-lease-error/key-lease-error.ts
+var REDACTED_CAUSE = "Route 33 gateway key lease dependency failed";
+var KeyLeaseError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 gateway key lease failed",
+      options?.cause === void 0 ? void 0 : { cause: REDACTED_CAUSE }
+    );
+    this.code = code;
+    this.name = "KeyLeaseError";
+  }
+  code;
+};
+
+// src/key-lease/map-renewal-failure/map-renewal-failure.ts
+var mapRenewalFailure = (options) => {
+  if (options.current === void 0) {
+    throw options.cause;
+  }
+  if (options.now < Date.parse(options.current.expiresAt)) {
+    throw options.cause;
+  }
+  if (!(options.cause instanceof KeyLeaseError)) {
+    throw options.cause;
+  }
+  if (options.cause.code !== "KEY_LEASE_MINT_FAILED") {
+    throw options.cause;
+  }
+  throw new KeyLeaseError("KEY_LEASE_EXPIRED", { cause: options.cause });
+};
+
+// src/key-lease/orphan-control/orphan-control.ts
+var controlOrphans = async (options) => {
+  const now = options.clock();
+  if (!Number.isFinite(now) || !Number.isInteger(options.retentionCycles) || options.retentionCycles <= 0 || !Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {
+    return { kind: "unavailable" };
+  }
+  let keys;
+  try {
+    keys = await options.managementClient.list(options.managementCredential);
+  } catch {
+    return { kind: "unavailable" };
+  }
+  const staleKeys = keys.data.filter(
+    (key) => key.name === options.keyName && key.id !== options.currentKeyId && Date.parse(key.expires_at) <= now
+  );
+  const deletions = await Promise.allSettled(
+    staleKeys.map(
+      (key) => Promise.resolve().then(
+        () => options.managementClient.delete(options.managementCredential, key.id)
+      )
+    )
+  );
+  return {
+    attempted: deletions.length,
+    deleted: deletions.filter(({ status }) => status === "fulfilled").length,
+    kind: "completed"
+  };
+};
+
+// src/key-lease/is-management-unauthorized/is-management-unauthorized.ts
+var isManagementUnauthorized = (cause) => {
+  if (cause instanceof Response) {
+    return cause.status === 401;
+  }
+  if (typeof cause !== "object") {
+    return false;
+  }
+  if (cause === null) {
+    return false;
+  }
+  if ("status" in cause && cause.status === 401) {
+    return true;
+  }
+  if ("statusCode" in cause && cause.statusCode === 401) {
+    return true;
+  }
+  return "response" in cause && cause.response instanceof Response && cause.response.status === 401;
+};
+
+// src/key-lease/recover-lease-state/recover-lease-state.ts
+var recoverLeaseState = async (options) => {
+  let keys;
+  try {
+    keys = (await options.managementClient.list(options.managementCredential)).data;
+  } catch (cause) {
+    throw new KeyLeaseError(
+      isManagementUnauthorized(cause) ? "KEY_LEASE_UNAUTHORIZED" : "KEY_LEASE_MINT_FAILED",
+      { cause }
+    );
+  }
+  const matches = keys.filter((key2) => {
+    if (key2.name !== options.keyName || key2.revoked || key2.status !== "active" || !Number.isFinite(Date.parse(key2.expires_at))) {
+      return false;
+    }
+    switch (options.attribution.kind) {
+      case "personal":
+        return key2.ownership_type === "user_personal" && key2.project_id === null;
+      case "project":
+        return key2.ownership_type === "project" && key2.project_id === options.attribution.projectId;
+      default: {
+        const unexpected = options.attribution;
+        throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+      }
+    }
+  });
+  const key = matches.length === 1 ? matches[0] : void 0;
+  if (key === void 0) {
+    return void 0;
+  }
+  const recovered = {
+    attribution: options.attribution,
+    expiresAt: key.expires_at,
+    keyId: key.id
+  };
+  return options.state.compareAndSwap(void 0, recovered) ? recovered : options.state.snapshot();
+};
+
+// src/key-lease/reject-lease/reject-lease.ts
+var rejectLease = async (options) => {
+  const shouldClear = options.storedKey === void 0 || options.storedKey.value === options.rejection.key.value;
+  if (shouldClear) {
+    try {
+      await options.secretStore.set(void 0);
+    } catch (cause) {
+      throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+    }
+    if (!options.state.clear(options.current)) {
+      throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE");
+    }
+  }
+  switch (options.rejection.kind) {
+    case "expired":
+      throw new KeyLeaseError("KEY_LEASE_EXPIRED");
+    case "unauthorized":
+      throw new KeyLeaseError("KEY_LEASE_UNAUTHORIZED");
+    default: {
+      const unexpected = options.rejection;
+      throw new TypeError(`Unexpected lease rejection: ${String(unexpected)}`);
+    }
+  }
+};
+
+// src/key-lease/resolve-key-ownership/resolve-key-ownership.ts
+var resolveKeyOwnership = (options) => {
+  switch (options.attribution.kind) {
+    case "personal":
+      if (options.managementSubject.length === 0) {
+        throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+      }
+      return {
+        ownerId: options.managementSubject,
+        ownerType: "user_personal",
+        projectId: null
+      };
+    case "project":
+      return {
+        ownerId: null,
+        ownerType: "project",
+        projectId: options.attribution.projectId
+      };
+    default: {
+      const unexpected = options.attribution;
+      throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+    }
+  }
+};
+
+// src/key-lease/mint-key/mint-key.ts
+var mintKey = async (options) => {
+  const now = options.clock();
+  if (!Number.isFinite(now)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (!Number.isFinite(options.installation.ttlMs)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (options.installation.ttlMs <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (options.installation.keyName.length === 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  const ownership = resolveKeyOwnership({
+    attribution: options.attribution,
+    managementSubject: options.identity.subject
+  });
+  let material;
+  try {
+    material = await options.managementClient.create(
+      options.identity.credential,
+      {
+        expiresAt: new Date(now + options.installation.ttlMs).toISOString(),
+        name: options.installation.keyName,
+        ...ownership
+      }
+    );
+  } catch (cause) {
+    if (isManagementUnauthorized(cause)) {
+      throw new KeyLeaseError("KEY_LEASE_UNAUTHORIZED", { cause });
+    }
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED", { cause });
+  }
+  return {
+    key: material.key,
+    lease: {
+      attribution: options.attribution,
+      expiresAt: material.expires_at,
+      keyId: material.id
+    }
+  };
+};
+
+// src/key-lease/renew-key/renew-key.ts
+var renewals = /* @__PURE__ */ new WeakMap();
+var renewKey = async (options) => {
+  const inFlight = renewals.get(options.leaseState);
+  if (inFlight !== void 0) {
+    return inFlight;
+  }
+  const expected = options.leaseState.snapshot();
+  const renewal = (async () => {
+    const discard = async (keyId) => {
+      const cleared = options.leaseState.clear(expected);
+      await Promise.allSettled([
+        Promise.resolve().then(() => options.secretStore.set(void 0)),
+        Promise.resolve().then(
+          () => options.mint.managementClient.delete(
+            options.mint.identity.credential,
+            keyId
+          )
+        )
+      ]);
+      return cleared;
+    };
+    let renewed;
+    if (expected === void 0) {
+      renewed = await mintKey(options.mint);
+    } else {
+      try {
+        const material = await options.mint.managementClient.regenerate(
+          options.mint.identity.credential,
+          expected.keyId,
+          new Date(
+            options.mint.clock() + options.mint.installation.ttlMs
+          ).toISOString()
+        );
+        renewed = {
+          key: material.key,
+          lease: {
+            attribution: options.mint.attribution,
+            expiresAt: material.expires_at,
+            keyId: expected.keyId
+          }
+        };
+      } catch (cause) {
+        const cleared = await discard(expected.keyId);
+        if (!cleared) {
+          throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE", { cause });
+        }
+        throw new KeyLeaseError(
+          isManagementUnauthorized(cause) ? "KEY_LEASE_UNAUTHORIZED" : "KEY_LEASE_MINT_FAILED",
+          { cause }
+        );
+      }
+    }
+    try {
+      await options.secretStore.set(renewed.key);
+    } catch (cause) {
+      const cleared = await discard(renewed.lease.keyId);
+      if (!cleared) {
+        throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE", { cause });
+      }
+      throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+    }
+    if (!options.leaseState.compareAndSwap(expected, renewed.lease)) {
+      await discard(renewed.lease.keyId);
+      throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE");
+    }
+    return renewed;
+  })();
+  renewals.set(options.leaseState, renewal);
+  try {
+    return await renewal;
+  } finally {
+    if (renewals.get(options.leaseState) === renewal) {
+      renewals.delete(options.leaseState);
+    }
+  }
+};
+
+// src/key-lease/resolve-lease-policy/resolve-lease-policy.ts
+var resolveLeasePolicy = (policy) => {
+  const resolved = {
+    deletePreviousKey: false,
+    renewalRatio: DEFAULT_GATEWAY_KEY_RENEWAL_RATIO,
+    ttlMs: DEFAULT_GATEWAY_KEY_TTL_MS,
+    ...policy
+  };
+  if (!Number.isFinite(resolved.ttlMs)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.ttlMs <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (!Number.isFinite(resolved.renewalRatio)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.renewalRatio <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.renewalRatio >= 1) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.orphanRetentionCycles === void 0) {
+    return resolved;
+  }
+  if (!Number.isInteger(resolved.orphanRetentionCycles)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.orphanRetentionCycles <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  return resolved;
+};
+
+// src/key-lease/resolve-seam-value/resolve-seam-value.ts
+var resolveSeamValue = async (value) => typeof value === "function" ? value() : value;
+
+// src/key-lease/reusable-lease/reusable-lease.ts
+var reusableLease = (options) => {
+  if (options.current === void 0) {
+    return void 0;
+  }
+  if (options.storedKey === void 0) {
+    return void 0;
+  }
+  if (!options.state.matchesAttribution(options.attribution)) {
+    return void 0;
+  }
+  const renewalAt = Date.parse(options.current.expiresAt) - options.policy.ttlMs * (1 - options.policy.renewalRatio);
+  if (options.now >= renewalAt) {
+    return void 0;
+  }
+  return { key: options.storedKey, lease: options.current };
+};
+
+// src/key-lease/lease-for-attribution/lease-for-attribution.ts
+var leaseForAttribution = async (options) => {
+  const policy = resolveLeasePolicy(options.policy);
+  const clock = options.clock ?? Date.now;
+  const now = clock();
+  if (!Number.isFinite(now)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  let current = options.installation.state.snapshot();
+  let storedKey;
+  try {
+    storedKey = await options.installation.secretStore.get();
+  } catch (cause) {
+    throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+  }
+  if (current === void 0 && storedKey !== void 0) {
+    current = await recoverLeaseState({
+      attribution: options.attribution,
+      keyName: options.installation.keyName,
+      managementClient: options.management.client,
+      managementCredential: await resolveSeamValue(
+        options.management.credential
+      ),
+      state: options.installation.state
+    });
+  }
+  if (options.rejection !== void 0) {
+    return rejectLease({
+      current,
+      rejection: options.rejection,
+      secretStore: options.installation.secretStore,
+      state: options.installation.state,
+      storedKey
+    });
+  }
+  const reusable = reusableLease({
+    attribution: options.attribution,
+    current,
+    now,
+    policy,
+    state: options.installation.state,
+    storedKey
+  });
+  if (reusable !== void 0) {
+    return reusable;
+  }
+  try {
+    const renewed = await renewKey({
+      leaseState: options.installation.state,
+      mint: {
+        attribution: options.attribution,
+        clock,
+        identity: {
+          credential: await resolveSeamValue(options.management.credential),
+          subject: await resolveSeamValue(options.management.subject)
+        },
+        installation: {
+          keyName: options.installation.keyName,
+          ttlMs: policy.ttlMs
+        },
+        managementClient: options.management.client
+      },
+      secretStore: options.installation.secretStore
+    });
+    if (policy.orphanRetentionCycles !== void 0) {
+      await controlOrphans({
+        clock,
+        currentKeyId: renewed.lease.keyId,
+        keyName: options.installation.keyName,
+        managementClient: options.management.client,
+        managementCredential: await resolveSeamValue(
+          options.management.credential
+        ),
+        retentionCycles: policy.orphanRetentionCycles,
+        ttlMs: policy.ttlMs
+      });
+    }
+    return renewed;
+  } catch (cause) {
+    return mapRenewalFailure({ cause, current, now });
+  }
+};
+
+// src/attribution/parse-attribution/parse-attribution.ts
+var parseAttribution = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid attribution");
+  }
+  if (value["kind"] === "personal") {
+    return { kind: "personal" };
+  }
+  if (value["kind"] === "project" && typeof value["projectId"] === "string") {
+    return { kind: "project", projectId: value["projectId"] };
+  }
+  throw new ContractParseError("invalid attribution");
+};
+
+// src/key-lease/lease-state/lease-state.ts
+var LeaseState = class _LeaseState {
+  /** Current committed snapshot; mutation is limited to compare-and-swap transitions. */
+  #current;
+  constructor(current) {
+    this.#current = current;
+  }
+  /** Restores untrusted persisted metadata or an empty lease.
+   * @param value - Persisted metadata, or undefined for a new installation.
+   * @returns A lease-state coordinator.
+   */
+  static restore(value) {
+    if (value === void 0) {
+      return new _LeaseState(void 0);
+    }
+    if (!isRecord(value)) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    const fields = Object.keys(value);
+    if (fields.length !== 3 || fields.some(
+      (field) => field !== "attribution" && field !== "expiresAt" && field !== "keyId"
+    )) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    const expiresAt = value["expiresAt"];
+    const keyId = value["keyId"];
+    if (typeof expiresAt !== "string" || !Number.isFinite(Date.parse(expiresAt)) || typeof keyId !== "string" || keyId.length === 0) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    return new _LeaseState({
+      attribution: parseAttribution(value["attribution"]),
+      expiresAt,
+      keyId
+    });
+  }
+  /** Reads the current non-secret metadata.
+   * @returns The current lease metadata, if one is committed.
+   */
+  snapshot() {
+    return this.#current;
+  }
+  /** Checks whether current metadata belongs to an attribution.
+   * @param attribution - The requested ownership choice.
+   * @returns Whether the current lease has the same attribution.
+   */
+  matchesAttribution(attribution) {
+    if (this.#current === void 0) {
+      return false;
+    }
+    switch (this.#current.attribution.kind) {
+      case "personal":
+        return attribution.kind === "personal";
+      case "project":
+        return attribution.kind === "project" && attribution.projectId === this.#current.attribution.projectId;
+      default:
+        return _LeaseState.#unexpectedAttribution(this.#current.attribution);
+    }
+  }
+  /** Atomically swaps metadata when the expected snapshot is still current.
+   * @param expected - Snapshot observed before asynchronous renewal.
+   * @param next - Fresh metadata to commit.
+   * @returns Whether the swap committed.
+   */
+  compareAndSwap(expected, next) {
+    if (this.#current !== expected) {
+      return false;
+    }
+    this.#current = next;
+    return true;
+  }
+  /** Clears metadata only while the expected snapshot remains current.
+   * @param expected - Snapshot whose lease is being invalidated.
+   * @returns Whether the state was cleared.
+   */
+  clear(expected) {
+    if (this.#current !== expected) {
+      return false;
+    }
+    this.#current = void 0;
+    return true;
+  }
+  static #unexpectedAttribution(value) {
+    throw new TypeError(`Unexpected attribution: ${String(value)}`);
+  }
+};
+
+// src/contract/management-keys/parse-api-key/parse-api-key.ts
+var parseApiKey = (value) => {
+  if (!isRecord(value) || !isOwnerType(value["ownership_type"]) || !isNullableString(value["project_id"])) {
+    throw new ContractParseError("invalid API key");
+  }
+  const field = (name) => {
+    const text = value[name];
+    if (typeof text !== "string") {
+      throw new ContractParseError("invalid API key");
+    }
+    return text;
+  };
+  const status = value["status"];
+  if (status !== "active" && status !== "revoked") {
+    throw new ContractParseError("invalid API key");
+  }
+  return {
+    expires_at: field("expires_at"),
+    id: field("id"),
+    name: field("name"),
+    org_id: field("org_id"),
+    ownership_type: value["ownership_type"],
+    project_id: value["project_id"],
+    revoked: value["revoked"] === true,
+    status
+  };
+};
+
+// src/contract/management-keys/parse-collection/parse-collection.ts
+var parseCollection = (value, parseItem) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const data = value["data"];
+  if (!Array.isArray(data)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const page = value["page"];
+  if (!isRecord(page)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const limit = page["limit"];
+  if (typeof limit !== "number") {
+    throw new ContractParseError("invalid management collection");
+  }
+  if (![Number.isInteger(limit), limit >= 1, limit <= 500].every(Boolean)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const nextCursor = page["next_cursor"];
+  if (!isNullableString(nextCursor)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const hasMore = page["has_more"];
+  if (typeof hasMore !== "boolean") {
+    throw new ContractParseError("invalid management collection");
+  }
+  const collection = {
+    data: data.map(parseItem),
+    page: {
+      has_more: hasMore,
+      limit,
+      next_cursor: nextCursor
+    }
+  };
+  const meta = value["meta"];
+  if (meta === void 0) {
+    return collection;
+  }
+  if (!isRecord(meta)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  return { ...collection, meta };
+};
+
+// src/contract/management-keys/parse-key-material/parse-key-material.ts
+var parseKeyMaterial = (value) => {
+  if (!isRecord(value) || typeof value["key"] !== "string") {
+    throw new ContractParseError("invalid key material");
+  }
+  return { ...parseApiKey(value), key: new GatewayApiKey(value["key"]) };
+};
+
+// src/contract/management-keys/parse-organization/parse-organization.ts
+var parseOrganization = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid organization");
+  }
+  const stringField = (name) => {
+    const field = value[name];
+    if (typeof field !== "string") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const nullableStringField = (name) => {
+    const field = value[name];
+    if (!isNullableString(field)) {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const numberField = (name) => {
+    const field = value[name];
+    if (typeof field !== "number") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const nullableNumberField = (name) => {
+    const field = value[name];
+    if (typeof field !== "number" && field !== null) {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const booleanField = (name) => {
+    const field = value[name];
+    if (typeof field !== "boolean") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const budgetField = (name) => {
+    const field = value[name];
+    if (field === null) {
+      return null;
+    }
+    if (!isRecord(field) || typeof field["amount"] !== "string" || typeof field["currency"] !== "string") {
+      throw new ContractParseError("invalid organization");
+    }
+    return { amount: field["amount"], currency: field["currency"] };
+  };
+  const setupStatus = value["setup_status"];
+  if (setupStatus !== "broken" && setupStatus !== "ok" && setupStatus !== "partial" && setupStatus !== "unvalidated") {
+    throw new ContractParseError("invalid organization");
+  }
+  return {
+    alert_active: booleanField("alert_active"),
+    alert_percentage: numberField("alert_percentage"),
+    azure_group_id: nullableStringField("azure_group_id"),
+    azure_owners_group_id: nullableStringField("azure_owners_group_id"),
+    created_at: nullableStringField("created_at"),
+    deactivated_at: nullableStringField("deactivated_at"),
+    default_project_budget: budgetField("default_project_budget"),
+    default_user_budget: budgetField("default_user_budget"),
+    domain: nullableStringField("domain"),
+    id: stringField("id"),
+    idp_connection: nullableStringField("idp_connection"),
+    member_count: nullableNumberField("member_count"),
+    name: stringField("name"),
+    scim_sync: nullableStringField("scim_sync"),
+    setup_status: setupStatus,
+    slug: nullableStringField("slug"),
+    tenant_id: nullableStringField("tenant_id"),
+    updated_at: nullableStringField("updated_at")
+  };
+};
+
+// src/contract/management-keys/parse-project/parse-project.ts
+var parseProject = (value) => {
+  if (!isRecord(value) || !hasStringFields(value, ["id", "name"]) || !hasStringFields(value, ["id", "name", "org_id"])) {
+    throw new ContractParseError("invalid project");
+  }
+  return {
+    id: value["id"] ?? "",
+    name: value["name"] ?? "",
+    org_id: value["org_id"] ?? ""
+  };
+};
+
+// src/management/management-error/management-error.ts
+var ManagementError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 management request failed",
+      options?.cause === void 0 ? void 0 : { cause: "Route 33 management dependency failed" }
+    );
+    this.code = code;
+    this.name = "ManagementError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
+};
+
+// src/management/management-http-transport/management-http-transport.ts
+var ManagementHttpTransport = class {
+  #baseUrl;
+  #credential;
+  #fetchImpl;
+  #onUnauthorized;
+  #timeoutMs;
+  constructor(options) {
+    const baseUrl = options.baseUrl ?? "https://api.route33.ai/v1";
+    this.#baseUrl = new URL(baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+    this.#credential = options.credential;
+    this.#fetchImpl = options.fetchImpl ?? fetch;
+    this.#onUnauthorized = options.onUnauthorized;
+    this.#timeoutMs = options.timeoutMs ?? 1e4;
+  }
+  /** Sends a request and reads one JSON value under the request timeout.
+   * @param request - Management path, method, and optional JSON body.
+   * @returns The untrusted response value.
+   */
+  json(request) {
+    return this.#perform(request, async (response) => {
+      try {
+        return await response.json();
+      } catch (cause) {
+        throw new ContractParseError("invalid management response", { cause });
+      }
+    });
+  }
+  /** Sends a request whose successful response has no body.
+   * @param request - Management path and method.
+   */
+  empty(request) {
+    return this.#perform(request, () => Promise.resolve());
+  }
+  async #perform(request, consume) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+      controller.abort();
+    }, this.#timeoutMs);
+    const headers = new Headers({
+      accept: "application/json",
+      authorization: `Bearer ${this.#credential.value}`
+    });
+    if (request.body !== void 0) {
+      headers.set("content-type", "application/json");
+    }
+    try {
+      const send = () => this.#fetchImpl(new URL(request.path, this.#baseUrl), {
+        ...request.body === void 0 ? {} : { body: JSON.stringify(request.body) },
+        headers,
+        method: request.method,
+        signal: controller.signal
+      });
+      let response = await send();
+      if (response.status === 401 && this.#onUnauthorized !== void 0) {
+        await this.#onUnauthorized();
+        response = await send();
+      }
+      if (!response.ok) {
+        throw new ManagementError(
+          response.status === 401 ? "MANAGEMENT_UNAUTHORIZED" : "MANAGEMENT_HTTP_ERROR",
+          { statusCode: response.status }
+        );
+      }
+      return await consume(response);
+    } catch (cause) {
+      if (cause instanceof ManagementError) {
+        throw cause;
+      }
+      if (controller.signal.aborted) {
+        throw new ManagementError("MANAGEMENT_TIMEOUT", { cause });
+      }
+      if (cause instanceof ContractParseError) {
+        throw cause;
+      }
+      throw new ManagementError("MANAGEMENT_NETWORK_ERROR", { cause });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/management/http-management-keys/http-management-keys.ts
+var HttpManagementKeys = class {
+  #credential;
+  #transport;
+  constructor(options) {
+    this.#credential = options.credential;
+    this.#transport = new ManagementHttpTransport(options);
+  }
+  /** Creates a future-expiring ownership-scoped key.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param input - Key name, expiry, and ownership.
+   * @returns One-time key material.
+   */
+  async create(accessToken, input) {
+    this.#authorize(accessToken);
+    return parseKeyMaterial(
+      await this.#transport.json({
+        body: {
+          expires_at: input.expiresAt,
+          name: input.name,
+          ...input.ownerId === null ? {} : { owner_user_id: input.ownerId },
+          owner_type: input.ownerType,
+          ...input.projectId === null ? {} : { project_id: input.projectId }
+        },
+        method: "POST",
+        path: "api-keys"
+      })
+    );
+  }
+  /** Treats a successful empty response as confirmation of permanent removal.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   */
+  async delete(accessToken, id) {
+    this.#authorize(accessToken);
+    await this.#transport.empty({
+      method: "DELETE",
+      path: `api-keys/${encodeURIComponent(id)}`
+    });
+  }
+  /** Gets a safe key DTO.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @returns The secret-free key DTO.
+   */
+  async get(accessToken, id) {
+    this.#authorize(accessToken);
+    return parseApiKey(
+      await this.#transport.json({
+        method: "GET",
+        path: `api-keys/${encodeURIComponent(id)}`
+      })
+    );
+  }
+  /** Lists safe key DTOs.
+   * @param accessToken - Credential required by the frozen contract.
+   * @returns The parsed key collection.
+   */
+  async list(accessToken) {
+    this.#authorize(accessToken);
+    return parseCollection(
+      await this.#transport.json({ method: "GET", path: "api-keys" }),
+      parseApiKey
+    );
+  }
+  /** Lists organizations visible to the authenticated management subject.
+   * @param accessToken - Credential required by the frozen contract.
+   * @returns The parsed organization collection.
+   */
+  async listOrganizations(accessToken) {
+    this.#authorize(accessToken);
+    return parseCollection(
+      await this.#transport.json({ method: "GET", path: "orgs" }),
+      parseOrganization
+    );
+  }
+  /** Lists projects visible within an organisation filter.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param organisationId - Required backend organisation filter.
+   * @returns The parsed project collection.
+   */
+  async listProjects(accessToken, organisationId) {
+    this.#authorize(accessToken);
+    if (organisationId.trim().length === 0) {
+      throw new ManagementError("MANAGEMENT_ORGANISATION_ID_REQUIRED", {
+        statusCode: 400
+      });
+    }
+    const query = new URLSearchParams({ org_id: organisationId });
+    return parseCollection(
+      await this.#transport.json({
+        method: "GET",
+        path: `projects?${query.toString()}`
+      }),
+      parseProject
+    );
+  }
+  /** Regenerates one-time key material while preserving expiry when omitted.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @param expiresAt - Optional replacement expiry.
+   * @returns Regenerated one-time key material.
+   */
+  async regenerate(accessToken, id, expiresAt) {
+    this.#authorize(accessToken);
+    return parseKeyMaterial(
+      await this.#transport.json({
+        body: expiresAt === void 0 ? {} : { expires_at: expiresAt },
+        method: "POST",
+        path: `api-keys/${encodeURIComponent(id)}/secrets`
+      })
+    );
+  }
+  /** Updates mutable key metadata.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @param input - Optional name and expiry replacements.
+   * @returns The updated safe key DTO.
+   */
+  async update(accessToken, id, input) {
+    this.#authorize(accessToken);
+    return parseApiKey(
+      await this.#transport.json({
+        body: {
+          ...input.expiresAt === void 0 ? {} : { expires_at: input.expiresAt },
+          ...input.name === void 0 ? {} : { name: input.name }
+        },
+        method: "PATCH",
+        path: `api-keys/${encodeURIComponent(id)}`
+      })
+    );
+  }
+  #authorize(accessToken) {
+    if (accessToken.value !== this.#credential.value) {
+      throw new ManagementError("MANAGEMENT_UNAUTHORIZED", {
+        statusCode: 401
+      });
+    }
+  }
+};
+
+// src/cli/production-smoke-error/production-smoke-error.ts
+var ProductionSmokeError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 production smoke failed",
+      options?.cause === void 0 ? void 0 : { cause: "Route 33 production smoke dependency failed" }
+    );
+    this.code = code;
+    this.name = "ProductionSmokeError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
+};
+
+// src/cli/parse-management-subject/parse-management-subject.ts
+var parseManagementSubjectForSmoke = (credential) => {
+  try {
+    return parseManagementSubject(credential);
+  } catch (cause) {
+    throw new ProductionSmokeError("SMOKE_TOKEN_INVALID", { cause });
+  }
+};
+
+// src/cli/precheck-route33-auth/precheck-route33-auth.ts
+var precheckRoute33Auth = async (options) => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, options.timeoutMs ?? 15e3);
+  const authorizeUrl = new URL("/authorize", options.issuerUrl);
+  const { codeChallenge } = createPkceVerifierAndChallenge();
+  authorizeUrl.search = new URLSearchParams({
+    client_id: options.clientId,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    redirect_uri: "http://127.0.0.1:9/callback",
+    response_type: "code",
+    scope: "openid",
+    state: "smoke"
+  }).toString();
+  try {
+    const response = await (options.fetchImpl ?? fetch)(authorizeUrl, {
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (response.status < 200 || response.status >= 400) {
+      throw new ProductionSmokeError("SMOKE_AUTH_PRECHECK_FAILED", {
+        statusCode: response.status
+      });
+    }
+  } catch (cause) {
+    if (cause instanceof ProductionSmokeError) {
+      throw cause;
+    }
+    throw new ProductionSmokeError("SMOKE_AUTH_PRECHECK_FAILED", { cause });
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+// src/cli/create-live-production-smoke-plan/create-live-production-smoke-plan.ts
+var createLiveProductionSmokePlan = (options) => {
+  const state = LeaseState.restore(void 0);
+  const keyIds = /* @__PURE__ */ new Set();
+  let session;
+  let secret;
+  let mintedReceipt;
+  const secretStore = {
+    get: () => Promise.resolve(secret),
+    set: (next) => {
+      secret = next;
+      return Promise.resolve();
+    }
+  };
+  const requireSession = () => {
+    if (session === void 0) {
+      throw new ProductionSmokeError("SMOKE_SESSION_UNAVAILABLE");
+    }
+    return session;
+  };
+  return {
+    precheck: () => options.precheck?.() ?? precheckRoute33Auth({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      issuerUrl: options.authIssuerUrl
+    }),
+    login: async () => {
+      const result = options.login === void 0 ? await loginFlow({
+        clientId: options.clientId,
+        logger,
+        session: createAuthSession({
+          clientId: options.clientId,
+          ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+          issuerUrl: options.authIssuerUrl
+        }),
+        timeoutMs: 12e4
+      }) : await options.login();
+      session = {
+        client: new HttpManagementKeys({
+          baseUrl: options.apiBaseUrl,
+          credential: result.credential,
+          ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+        }),
+        credential: result.credential,
+        subject: parseManagementSubjectForSmoke(result.credential)
+      };
+    },
+    projects: async () => {
+      const active = requireSession();
+      const organizations = await active.client.listOrganizations(
+        active.credential
+      );
+      const projects = await Promise.all(
+        organizations.data.map(async (organization) => {
+          const collection = await active.client.listProjects(
+            active.credential,
+            organization.id
+          );
+          return collection.data.map((project) => ({
+            ...project,
+            organisation: { id: organization.id, name: organization.name }
+          }));
+        })
+      );
+      return projects.flat();
+    },
+    mint: async () => {
+      const active = requireSession();
+      const minted = await leaseForAttribution({
+        attribution: { kind: "personal" },
+        ...options.clock === void 0 ? {} : { clock: options.clock },
+        installation: {
+          keyName: "route33-production-smoke",
+          secretStore,
+          state
+        },
+        management: active,
+        policy: { ttlMs: 36e5 }
+      });
+      mintedReceipt = {
+        expiresAt: minted.lease.expiresAt,
+        keyId: minted.lease.keyId
+      };
+      keyIds.add(minted.lease.keyId);
+      return mintedReceipt;
+    },
+    rotate: async () => {
+      const active = requireSession();
+      if (mintedReceipt === void 0) {
+        throw new ProductionSmokeError("SMOKE_SESSION_UNAVAILABLE");
+      }
+      const regenerated = await active.client.regenerate(
+        active.credential,
+        mintedReceipt.keyId
+      );
+      await secretStore.set(regenerated.key);
+      keyIds.add(regenerated.id);
+      const oldKey = (await active.client.list(active.credential)).data.find(
+        ({ id }) => id === mintedReceipt?.keyId
+      );
+      if (oldKey === void 0 || oldKey.expires_at !== mintedReceipt.expiresAt || !Number.isFinite(Date.parse(oldKey.expires_at))) {
+        throw new ProductionSmokeError("SMOKE_ROTATION_INVALID");
+      }
+      return { expiresAt: regenerated.expires_at, keyId: regenerated.id };
+    },
+    cleanup: async () => {
+      const active = session;
+      const results = active === void 0 ? [] : await Promise.allSettled(
+        [...keyIds].map(
+          (id) => active.client.delete(active.credential, id)
+        )
+      );
+      await secretStore.set(void 0);
+      if (results.some(({ status }) => status === "rejected")) {
+        throw new ProductionSmokeError("SMOKE_CLEANUP_FAILED");
+      }
+    }
+  };
+};
+
+// src/cli/read-env-client-id/read-env-client-id.ts
+var readEnvClientId = (env = process.env) => {
+  const value = env["ROUTE33_CLIENT_ID"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/production-smoke/production-smoke.ts
+var productionSmokeClientId = readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
+var ProductionSmoke = class {
+  #plan;
+  #write;
+  constructor(options = {}) {
+    const apiBaseUrl = process.env["ROUTE33_SMOKE_API_BASE"]?.trim();
+    const authIssuerUrl = process.env["ROUTE33_SMOKE_AUTH_ISSUER"]?.trim();
+    this.#plan = options.plan ?? createLiveProductionSmokePlan({
+      apiBaseUrl: apiBaseUrl === void 0 || apiBaseUrl.length === 0 ? "https://mapi.route33.ai/api/v1" : apiBaseUrl,
+      authIssuerUrl: authIssuerUrl === void 0 || authIssuerUrl.length === 0 ? "https://auth.route33.ai" : authIssuerUrl,
+      clientId: productionSmokeClientId
+    });
+    this.#write = options.write ?? ((line) => {
+      logger.info(line);
+    });
+  }
+  /** Runs each smoke step in its declared order. */
+  async run() {
+    await this.#step("PRECHECK", () => this.#plan.precheck());
+    await this.#step("LOGIN", () => this.#plan.login());
+    const projects = await this.#step("PROJECTS", () => this.#plan.projects());
+    for (const project of projects) {
+      this.#write(`${project.name} (${project.organisation.name})`);
+    }
+    try {
+      await this.#step(
+        "MINT",
+        () => this.#plan.mint(),
+        ({ expiresAt, keyId }) => `key_id=${keyId} expires_at=${expiresAt}`
+      );
+      await this.#step(
+        "ROTATE",
+        () => this.#plan.rotate(),
+        ({ expiresAt, keyId }) => `key_id=${keyId} expires_at=${expiresAt}`
+      );
+    } finally {
+      await this.#step("CLEANUP", () => this.#plan.cleanup());
+    }
+  }
+  async #step(name, run, details) {
+    try {
+      const value = await run();
+      const suffix = details === void 0 ? "" : ` ${details(value)}`;
+      this.#write(`${name} PASS${suffix}`);
+      return value;
+    } catch (cause) {
+      this.#write(`${name} FAIL`);
+      throw cause;
+    }
+  }
+};
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  void new ProductionSmoke().run().catch(() => {
+    logger.error("production-smoke.failed");
+    process.exitCode = 1;
+  });
+}
+export {
+  ProductionSmoke
+};