@thinkingai/ae-cli 6.1.19 → 6.1.21

package/dist/chunk-DKEXH6Q5.js

@@ -1,72 +0,0 @@
-import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  resolveGatewayDomain
-} from "./chunk-TKHSULJT.js";
-import {
-  withOutputMetadata
-} from "./chunk-KEWVSO64.js";
-import {
-  dryRunCapability,
-  executeCapabilityWithEnvelope,
-  validateCapability
-} from "./chunk-GJXRF7Y6.js";
-
-// src/core/capability-command.ts
-import { randomBytes } from "crypto";
-function createCapabilityCommand(config) {
-  return {
-    service: config.cliService,
-    resource: config.resource,
-    command: config.command,
-    capabilityId: config.capabilityId,
-    description: config.description,
-    flags: config.flags,
-    risk: config.risk,
-    validate: config.validate,
-    preflight: (ctx) => {
-      config.buildInput(ctx);
-    },
-    validateInput: async (ctx) => {
-      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
-      const requestHost = config.requestHost ?? ctx.host();
-      const input = withLifecycleRequestId(config, config.buildInput(ctx));
-      return validateCapability(requestHost, gatewayDomain, config.capabilityId, input);
-    },
-    dryRun: async (ctx) => {
-      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
-      const requestHost = config.requestHost ?? ctx.host();
-      const input = withLifecycleRequestId(config, config.buildInput(ctx));
-      return dryRunCapability(requestHost, gatewayDomain, config.capabilityId, input);
-    },
-    execute: async (ctx) => {
-      const gatewayDomain = resolveGatewayDomain(config.cliService, config.gatewayDomain);
-      const requestHost = config.requestHost ?? ctx.host();
-      const input = withLifecycleRequestId(config, config.buildInput(ctx));
-      announceDispatch(config.capabilityId, input);
-      const result = await executeCapabilityWithEnvelope(requestHost, gatewayDomain, config.capabilityId, input);
-      const data = config.postProcess ? await config.postProcess(result.data, input, ctx) : result.data;
-      return withOutputMetadata(data, result.meta);
-    }
-  };
-}
-function withLifecycleRequestId(config, input) {
-  if (!config.flags.some((flag) => flag.name === "request-id")) {
-    return input;
-  }
-  const supplied = input.request_id;
-  const requestId = typeof supplied === "string" && supplied.length > 0 ? supplied : `cli_${randomBytes(16).toString("hex")}`;
-  return { ...input, request_id: requestId };
-}
-function announceDispatch(capabilityId, input) {
-  if (typeof input.request_id !== "string") {
-    return;
-  }
-  process.stderr.write(
-    `[ae-cli] dispatching capability=${capabilityId} request_id=${input.request_id}
-`
-  );
-}
-
-export {
-  createCapabilityCommand
-};

package/dist/chunk-O6K2ODUE.js

@@ -1,318 +0,0 @@
-import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  getActiveHost,
-  getConfigDir,
-  normalizeUrl,
-  safeJsonParse
-} from "./chunk-KZ6ZHF5J.js";
-import {
-  logger
-} from "./chunk-FR2EDAQM.js";
-
-// src/core/secure-store.ts
-import crypto from "crypto";
-import fs from "fs";
-import os from "os";
-import path from "path";
-import { execFileSync } from "child_process";
-var STORE_DIR_SUFFIX = "secure-tokens";
-var SCRYPT_SALT = Buffer.from("ae-cli-secure-store-v1");
-var SCRYPT_N = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var KEY_LEN = 32;
-var NONCE_LEN = 12;
-var REFRESH_TOKEN_PATH = "/v1/oauth/refreshForToken";
-function getMachineId() {
-  if (process.platform === "darwin") {
-    try {
-      const out = execFileSync(
-        "ioreg",
-        ["-rd1", "-c", "IOPlatformExpertDevice"],
-        { encoding: "utf8", timeout: 3e3 }
-      );
-      const m = out.match(/IOPlatformUUID.*?=.*?"([0-9A-F-]{36})"/i);
-      if (m?.[1]) return `darwin:${m[1]}`;
-    } catch {
-    }
-  }
-  if (process.platform === "linux") {
-    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      try {
-        const id = fs.readFileSync(p, "utf8").trim();
-        if (id) return `linux:${id}`;
-      } catch {
-      }
-    }
-  }
-  if (process.platform === "win32") {
-    try {
-      const out = execFileSync(
-        "reg",
-        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
-        { encoding: "utf8", timeout: 3e3 }
-      );
-      const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
-      if (m?.[1]) return `win32:${m[1]}`;
-    } catch {
-    }
-  }
-  const fallback = `${os.homedir()}|${os.hostname()}|${os.platform()}`;
-  logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
-  return `fallback:${fallback}`;
-}
-var _cachedMachineId;
-function getCachedMachineId() {
-  if (!_cachedMachineId) _cachedMachineId = getMachineId();
-  return _cachedMachineId;
-}
-function deriveKey(machineId) {
-  return crypto.scryptSync(machineId, SCRYPT_SALT, KEY_LEN, {
-    N: SCRYPT_N,
-    r: SCRYPT_R,
-    p: SCRYPT_P
-  });
-}
-var _cachedKey;
-function getKey() {
-  if (!_cachedKey) _cachedKey = deriveKey(getCachedMachineId());
-  return _cachedKey;
-}
-function encrypt(plaintext) {
-  const key = getKey();
-  const nonce = crypto.randomBytes(NONCE_LEN);
-  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    nonce: nonce.toString("hex"),
-    tag: tag.toString("hex"),
-    data: encrypted.toString("hex")
-  };
-}
-function decrypt(blob) {
-  const key = getKey();
-  const nonce = Buffer.from(blob.nonce, "hex");
-  const tag = Buffer.from(blob.tag, "hex");
-  const data = Buffer.from(blob.data, "hex");
-  const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
-  decipher.setAuthTag(tag);
-  const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-  return decrypted.toString("utf8");
-}
-function storeDir() {
-  return path.join(getConfigDir(), STORE_DIR_SUFFIX);
-}
-function tokenFilePath(host) {
-  const safe = host.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_");
-  return path.join(storeDir(), `${safe}.enc.json`);
-}
-function ensureStoreDir() {
-  const dir = storeDir();
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-    try {
-      fs.chmodSync(dir, 448);
-    } catch {
-    }
-  }
-}
-function save(host, payload) {
-  ensureStoreDir();
-  const plaintext = JSON.stringify(payload);
-  const blob = encrypt(plaintext);
-  const filePath = tokenFilePath(host);
-  fs.writeFileSync(filePath, JSON.stringify(blob, null, 2), { encoding: "utf8" });
-  try {
-    fs.chmodSync(filePath, 384);
-  } catch {
-  }
-  logger.info(`secure-store: token saved for ${host}`);
-}
-function load(host) {
-  const filePath = tokenFilePath(host);
-  if (!fs.existsSync(filePath)) return null;
-  try {
-    const raw = fs.readFileSync(filePath, "utf8");
-    const blob = safeJsonParse(raw);
-    if (!blob?.nonce || !blob?.tag || !blob?.data) {
-      logger.warn(`secure-store: malformed blob for ${host}`);
-      return null;
-    }
-    const plaintext = decrypt(blob);
-    return JSON.parse(plaintext);
-  } catch (e) {
-    logger.error(`secure-store: decrypt failed for ${host}: ${e.message}`);
-    return null;
-  }
-}
-function clear(host) {
-  const filePath = tokenFilePath(host);
-  if (fs.existsSync(filePath)) {
-    fs.rmSync(filePath);
-    logger.info(`secure-store: token cleared for ${host}`);
-  }
-}
-async function getValidAccessToken(host) {
-  const payload = load(host);
-  if (!payload) {
-    throw new SecureStoreAuthError(
-      `No stored token for ${host}. Please run: ae-cli auth login`
-    );
-  }
-  const expiresAt = new Date(payload.accessExpiresAt).getTime();
-  const now = Date.now();
-  const needsRefresh = expiresAt - now < 6e4;
-  if (!needsRefresh) {
-    return payload.accessToken;
-  }
-  if (payload.refreshToken) {
-    logger.info(`secure-store: access token past local expiry for ${host}, refreshing\u2026`);
-    const refreshed = await doRefresh(host, payload.refreshToken);
-    save(host, { ...refreshed, cliToken: payload.cliToken });
-    logger.info(`secure-store: token refreshed for ${host}`);
-    return refreshed.accessToken;
-  }
-  logger.info(`secure-store: ${host} past static local expiry, no refresh token \u2014 returning stored token, server validates (lazy)`);
-  return payload.accessToken;
-}
-function loadCliToken(host) {
-  return load(host)?.cliToken ?? null;
-}
-async function doRefresh(host, refreshToken) {
-  const base = host.replace(/\/+$/, "");
-  const url = `${base}${REFRESH_TOKEN_PATH}`;
-  let resp;
-  try {
-    resp = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refreshToken })
-    });
-  } catch (e) {
-    throw new SecureStoreAuthError(
-      `Token refresh network error for ${host}: ${e.message}. Please run: ae-cli auth login`
-    );
-  }
-  if (!resp.ok) {
-    throw new SecureStoreAuthError(
-      `Token refresh failed (HTTP ${resp.status}) for ${host}. Please run: ae-cli auth login`
-    );
-  }
-  let body;
-  try {
-    body = safeJsonParse(await resp.text());
-  } catch {
-    throw new SecureStoreAuthError(
-      `Token refresh returned invalid JSON for ${host}. Please run: ae-cli auth login`
-    );
-  }
-  if (body.return_code !== 0) {
-    throw new SecureStoreAuthError(
-      `Token refresh error (${body.return_code}: ${body.return_message ?? "unknown"}) for ${host}. Please run: ae-cli auth login`
-    );
-  }
-  const d = body.data;
-  const newAccess = d?.accessToken ?? d?.access_token ?? "";
-  const newRefresh = d?.refreshToken ?? d?.refresh_token ?? refreshToken;
-  const expiresIn = d?.expiresIn ?? d?.expires_in ?? 72e3;
-  if (!newAccess) {
-    throw new SecureStoreAuthError(
-      `Token refresh returned empty accessToken for ${host}. Please run: ae-cli auth login`
-    );
-  }
-  return {
-    accessToken: newAccess,
-    refreshToken: newRefresh,
-    accessExpiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-  };
-}
-var SecureStoreAuthError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SecureStoreAuthError";
-  }
-};
-
-// src/core/host-guidance.ts
-var AE_TRIAL_URL = "https://thinkingai.cn/request-demo";
-var AE_HOST_SETUP_COMMAND = "ae-cli config set-host <url>";
-function missingAeHostHint(additionalAction) {
-  const actions = [
-    `If your organization already uses AgenticEngine, ask your administrator for its AE URL, then run: ${AE_HOST_SETUP_COMMAND}.`,
-    `If you do not have an AgenticEngine environment, request a trial: ${AE_TRIAL_URL}`
-  ];
-  if (additionalAction) actions.push(additionalAction);
-  return actions.join(" ");
-}
-function missingAeHostGuidance() {
-  return {
-    configure_host: AE_HOST_SETUP_COMMAND,
-    existing_customer: "Ask your AgenticEngine administrator for the AE environment URL.",
-    request_trial_url: AE_TRIAL_URL
-  };
-}
-
-// src/core/auth.ts
-function resolveHost(hostOverride) {
-  if (hostOverride) return normalizeUrl(hostOverride);
-  return getActiveHost();
-}
-async function validateToken(token, hostUrl) {
-  const url = `${hostUrl}/v1/oauth/checkToken`;
-  try {
-    const resp = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({ accessToken: token }).toString()
-    });
-    const respJson = safeJsonParse(await resp.text());
-    return respJson?.return_code === 0;
-  } catch {
-    return false;
-  }
-}
-function invalidateAccessTokenForRetry(hostUrl) {
-  const payload = load(hostUrl);
-  if (!payload) return;
-  save(hostUrl, { ...payload, accessExpiresAt: (/* @__PURE__ */ new Date(0)).toISOString() });
-  logger.info(`auth: marked access token stale for retry on ${hostUrl}`);
-}
-async function getToken(hostUrl) {
-  if (!hostUrl) {
-    throw new Error(
-      `No AE host configured.
-` + missingAeHostHint()
-    );
-  }
-  try {
-    const secureToken = await getValidAccessToken(hostUrl);
-    logger.info(`Using secure-store token for ${hostUrl}`);
-    return secureToken;
-  } catch (e) {
-    if (e instanceof SecureStoreAuthError) {
-      logger.info(`secure-store: ${e.message}`);
-    } else {
-      logger.warn(`secure-store unexpected error: ${e.message}`);
-    }
-  }
-  throw new Error(
-    `Cannot obtain token for ${hostUrl}.
-Run: ae-cli auth login   (device code flow, cross-platform)`
-  );
-}
-
-export {
-  save,
-  load,
-  clear,
-  loadCliToken,
-  SecureStoreAuthError,
-  AE_TRIAL_URL,
-  missingAeHostHint,
-  missingAeHostGuidance,
-  resolveHost,
-  validateToken,
-  invalidateAccessTokenForRetry,
-  getToken
-};

package/dist/chunk-RWXIXOZG.js

@@ -1,326 +0,0 @@
-import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
-import {
-  SecureStoreAuthError,
-  getToken,
-  load,
-  loadCliToken,
-  save
-} from "./chunk-O6K2ODUE.js";
-import {
-  getActiveHost,
-  getConfigDir,
-  getFallbackCliToken,
-  listHosts,
-  normalizeUrl,
-  safeJsonParse,
-  safeReadJsonFile
-} from "./chunk-KZ6ZHF5J.js";
-import {
-  PermissionError
-} from "./chunk-533JK3YX.js";
-import {
-  logger
-} from "./chunk-FR2EDAQM.js";
-
-// src/core/cli-token.ts
-import fs from "fs";
-import path from "path";
-var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
-var CLI_TOKEN_RENEW_PATH = "/v1/ta/cli/token/renew";
-var CLI_TOKEN_VALIDATE_PATH = "/v1/ta/cli/token/validate";
-var CliTokenValidationUnavailableError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CliTokenValidationUnavailableError";
-  }
-};
-function isExplicitCliTokenRejection(data, responseText) {
-  const code = String(data?.code ?? data?.error?.code ?? "");
-  const message = String(data?.return_message ?? data?.message ?? data?.error?.message ?? responseText);
-  return /cli[_-]?token[_-]?(invalid|expired)/i.test(code) || /cli[-_\s]?token.*\b(invalid|expired)\b/i.test(message) || /\b(invalid|expired)\b.*cli[-_\s]?token/i.test(message);
-}
-var _cliTokenCache = /* @__PURE__ */ new Map();
-var _renewedLocalDateByHost = /* @__PURE__ */ new Map();
-var _renewInFlightByHost = /* @__PURE__ */ new Map();
-function renewHostKey(hostUrl) {
-  return normalizeUrl(hostUrl);
-}
-function renewStateFilePath() {
-  return path.join(getConfigDir(), "cli-token-renew.json");
-}
-function localRenewDate(now = /* @__PURE__ */ new Date()) {
-  const y = now.getFullYear();
-  const m = String(now.getMonth() + 1).padStart(2, "0");
-  const d = String(now.getDate()).padStart(2, "0");
-  return `${y}-${m}-${d}`;
-}
-function loadRenewStore() {
-  try {
-    const file = renewStateFilePath();
-    if (!fs.existsSync(file)) return {};
-    const data = safeReadJsonFile(file);
-    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
-    return data;
-  } catch {
-    return {};
-  }
-}
-function saveRenewStore(store) {
-  const dir = getConfigDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  const file = renewStateFilePath();
-  if (Object.keys(store).length === 0) {
-    try {
-      fs.unlinkSync(file);
-    } catch {
-    }
-    return;
-  }
-  fs.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8" });
-  try {
-    fs.chmodSync(file, 384);
-  } catch {
-  }
-}
-function getPersistedRenewDate(hostUrl) {
-  const key = renewHostKey(hostUrl);
-  const store = loadRenewStore();
-  return store[key]?.date ?? (key !== hostUrl ? store[hostUrl]?.date : void 0) ?? null;
-}
-function markRenewSucceeded(hostUrl, date) {
-  const key = renewHostKey(hostUrl);
-  _renewedLocalDateByHost.set(key, date);
-  const store = loadRenewStore();
-  if (key !== hostUrl && store[hostUrl]) {
-    delete store[hostUrl];
-  }
-  store[key] = { date };
-  saveRenewStore(store);
-}
-function clearRenewState(hostUrl) {
-  if (hostUrl) {
-    const key = renewHostKey(hostUrl);
-    _renewedLocalDateByHost.delete(key);
-    _renewInFlightByHost.delete(key);
-    if (key !== hostUrl) {
-      _renewedLocalDateByHost.delete(hostUrl);
-      _renewInFlightByHost.delete(hostUrl);
-    }
-    const store = loadRenewStore();
-    let changed = false;
-    for (const k of /* @__PURE__ */ new Set([key, hostUrl])) {
-      if (store[k]) {
-        delete store[k];
-        changed = true;
-      }
-    }
-    if (changed) {
-      saveRenewStore(store);
-    }
-    return;
-  }
-  _renewedLocalDateByHost.clear();
-  _renewInFlightByHost.clear();
-  saveRenewStore({});
-}
-async function generateCliToken(hostUrl, accessTokenOverride) {
-  const accessToken = accessTokenOverride ?? await getToken(hostUrl);
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
-  const resp = await fetch(url, {
-    method: "GET",
-    headers: {
-      "Authorization": `bearer ${accessToken}`
-    }
-  });
-  if (!resp.ok) {
-    if (resp.status === 403) {
-      const text = await resp.text();
-      let body = {};
-      try {
-        body = text ? safeJsonParse(text) : {};
-      } catch {
-      }
-      const message = body.message ?? body.return_message ?? "CLI access is disabled for this account.";
-      const code = body.code ?? (String(message).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0);
-      throw new PermissionError(message, code, body.hint);
-    }
-    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
-  }
-  const data = safeJsonParse(await resp.text());
-  if (data.return_code !== 0) {
-    const message = data.return_message || data.message || "unknown";
-    if (data.code === "CLI_ACCESS_DISABLED" || String(message).includes("CLI_ACCESS_DISABLED")) {
-      throw new PermissionError(message, "CLI_ACCESS_DISABLED", data.hint);
-    }
-    throw new Error(`CLI token generate error: ${message} (code: ${data.return_code})`);
-  }
-  const cliToken = data.data?.userSecret;
-  if (!cliToken) {
-    throw new Error("CLI token generate error: empty userSecret in response");
-  }
-  return cliToken;
-}
-async function validateCliTokenOnServer(hostUrl, cliToken) {
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = `${base}${CLI_TOKEN_VALIDATE_PATH}`;
-  let resp;
-  try {
-    resp = await fetch(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        "cli-token": cliToken
-      }
-    });
-  } catch (e) {
-    throw new CliTokenValidationUnavailableError(`Unable to validate CLI token for ${hostUrl}: ${e.message}`);
-  }
-  const responseText = await resp.text();
-  let data;
-  try {
-    data = safeJsonParse(responseText);
-  } catch {
-    data = void 0;
-  }
-  if (isExplicitCliTokenRejection(data, responseText)) {
-    throw new SecureStoreAuthError(
-      `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth logout --host ${hostUrl}, then ae-cli auth login --host ${hostUrl}`
-    );
-  }
-  if (!resp.ok) {
-    throw new CliTokenValidationUnavailableError(
-      `CLI token validation is unavailable for ${hostUrl} (HTTP ${resp.status} ${resp.statusText})`
-    );
-  }
-  if (data?.return_code !== 0) {
-    throw new CliTokenValidationUnavailableError(`CLI token validation returned an unsupported response for ${hostUrl}`);
-  }
-}
-async function renewCliTokenOnServer(hostUrl, cliToken) {
-  const base = hostUrl.replace(/\/+$/, "");
-  const url = new URL(`${base}${CLI_TOKEN_RENEW_PATH}`);
-  url.searchParams.set("cli-token", cliToken);
-  const headers = {
-    Accept: "application/json"
-  };
-  try {
-    const accessToken = await getToken(hostUrl);
-    if (accessToken) {
-      headers.Authorization = `bearer ${accessToken}`;
-    }
-  } catch {
-  }
-  const resp = await fetch(url.toString(), { method: "GET", headers });
-  const text = await resp.text();
-  const data = safeJsonParse(text);
-  if (!resp.ok) {
-    throw new Error(`CLI token renew HTTP error: ${resp.status} ${resp.statusText}`);
-  }
-  if (data?.return_code !== void 0 && data.return_code !== 0) {
-    throw new Error(`CLI token renew error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
-  }
-}
-async function maybeRenewCliTokenDaily(hostUrl, cliToken) {
-  const hostKey = renewHostKey(hostUrl);
-  const today = localRenewDate();
-  if (_renewedLocalDateByHost.get(hostKey) === today) {
-    return;
-  }
-  if (getPersistedRenewDate(hostUrl) === today) {
-    _renewedLocalDateByHost.set(hostKey, today);
-    return;
-  }
-  const existing = _renewInFlightByHost.get(hostKey);
-  if (existing) {
-    await existing;
-    return;
-  }
-  const attempt = (async () => {
-    try {
-      await renewCliTokenOnServer(hostUrl, cliToken);
-      markRenewSucceeded(hostUrl, today);
-      logger.info(`cli-token: renewed for ${hostKey} (local day ${today})`);
-    } catch (e) {
-      logger.warn(`cli-token: renew failed for ${hostKey}: ${e?.message || e}; business call proceeds with cached token`);
-    } finally {
-      _renewInFlightByHost.delete(hostKey);
-    }
-  })();
-  _renewInFlightByHost.set(hostKey, attempt);
-  await attempt;
-}
-function persistCliTokenIfPossible(hostUrl, cliToken) {
-  const existing = load(hostUrl);
-  if (!existing) {
-    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
-    return;
-  }
-  save(hostUrl, { ...existing, cliToken });
-}
-function clearPersistedCliToken(hostUrl) {
-  const existing = load(hostUrl);
-  if (existing?.cliToken) {
-    save(hostUrl, { ...existing, cliToken: void 0 });
-  }
-}
-function peekCliToken(hostOverride) {
-  const hostUrl = hostOverride || getActiveHost();
-  if (!hostUrl) return void 0;
-  return _cliTokenCache.get(hostUrl) || loadCliToken(hostUrl) || getFallbackCliToken(hostUrl) || void 0;
-}
-async function getCliToken(hostOverride) {
-  const hostUrl = hostOverride || getActiveHost();
-  let token = _cliTokenCache.get(hostUrl);
-  if (!token) {
-    const storedToken = loadCliToken(hostUrl);
-    if (storedToken) {
-      _cliTokenCache.set(hostUrl, storedToken);
-      logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
-      token = storedToken;
-    }
-  }
-  if (!token) {
-    const fallbackToken = getFallbackCliToken(hostUrl);
-    if (fallbackToken) {
-      _cliTokenCache.set(hostUrl, fallbackToken);
-      logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
-      token = fallbackToken;
-    }
-  }
-  if (!token) {
-    token = await mintCliToken(hostUrl);
-  }
-  await maybeRenewCliTokenDaily(hostUrl, token);
-  return token;
-}
-async function mintCliToken(hostUrl, accessTokenOverride, persist = true) {
-  logger.info(`Generating CLI token for ${hostUrl}`);
-  const cliToken = await generateCliToken(hostUrl, accessTokenOverride);
-  _cliTokenCache.set(hostUrl, cliToken);
-  if (persist) persistCliTokenIfPossible(hostUrl, cliToken);
-  logger.info(`CLI token generated and cached${persist ? " and persisted" : ""} for ${hostUrl}`);
-  return cliToken;
-}
-function clearCliToken(hostUrl) {
-  if (hostUrl) {
-    _cliTokenCache.delete(hostUrl);
-    clearPersistedCliToken(hostUrl);
-    clearRenewState(hostUrl);
-    return;
-  }
-  _cliTokenCache.clear();
-  clearRenewState();
-  for (const { url } of listHosts()) {
-    clearPersistedCliToken(url);
-  }
-}
-
-export {
-  CliTokenValidationUnavailableError,
-  validateCliTokenOnServer,
-  peekCliToken,
-  getCliToken,
-  mintCliToken,
-  clearCliToken
-};