@thinkingai/ae-cli 6.1.19 → 6.1.21

package/dist/chunk-7XGFSUOM.js

@@ -0,0 +1,623 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  getActiveHost,
+  getConfigDir,
+  getFallbackCliToken,
+  normalizeUrl,
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-7FTTULED.js";
+import {
+  PermissionError,
+  logger
+} from "./chunk-MAPZ7VB6.js";
+
+// src/core/secure-store.ts
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+var STORE_DIR_SUFFIX = "secure-tokens";
+var SCRYPT_SALT = Buffer.from("ae-cli-secure-store-v1");
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var NONCE_LEN = 12;
+function getMachineId() {
+  if (process.platform === "darwin") {
+    try {
+      const out = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+        encoding: "utf8",
+        timeout: 3e3
+      });
+      const match = out.match(/IOPlatformUUID.*?=.*?"([0-9A-F-]{36})"/i);
+      if (match?.[1]) return `darwin:${match[1]}`;
+    } catch {
+    }
+  }
+  if (process.platform === "linux") {
+    for (const candidate of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      try {
+        const id = fs.readFileSync(candidate, "utf8").trim();
+        if (id) return `linux:${id}`;
+      } catch {
+      }
+    }
+  }
+  if (process.platform === "win32") {
+    try {
+      const out = execFileSync(
+        "reg",
+        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+        { encoding: "utf8", timeout: 3e3 }
+      );
+      const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
+      if (match?.[1]) return `win32:${match[1]}`;
+    } catch {
+    }
+  }
+  logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
+  return `fallback:${os.homedir()}|${os.hostname()}|${os.platform()}`;
+}
+var cachedMachineId;
+var cachedKey;
+function getKey() {
+  if (!cachedMachineId) cachedMachineId = getMachineId();
+  if (!cachedKey) {
+    cachedKey = crypto.scryptSync(cachedMachineId, SCRYPT_SALT, KEY_LEN, {
+      N: SCRYPT_N,
+      r: SCRYPT_R,
+      p: SCRYPT_P
+    });
+  }
+  return cachedKey;
+}
+function encrypt(plaintext) {
+  const nonce = crypto.randomBytes(NONCE_LEN);
+  const cipher = crypto.createCipheriv("aes-256-gcm", getKey(), nonce);
+  const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return {
+    nonce: nonce.toString("hex"),
+    tag: cipher.getAuthTag().toString("hex"),
+    data: data.toString("hex")
+  };
+}
+function decrypt(blob) {
+  const decipher = crypto.createDecipheriv("aes-256-gcm", getKey(), Buffer.from(blob.nonce, "hex"));
+  decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(blob.data, "hex")),
+    decipher.final()
+  ]).toString("utf8");
+}
+function storeDir() {
+  return path.join(getConfigDir(), STORE_DIR_SUFFIX);
+}
+function safeHost(host) {
+  return normalizeUrl(host).replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function legacyFilePath(host) {
+  return path.join(storeDir(), `${safeHost(host)}.enc.json`);
+}
+function vaultFilePath(host) {
+  return path.join(storeDir(), `${safeHost(host)}.accounts.v1.enc.json`);
+}
+function ensureStoreDir() {
+  const dir = storeDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    fs.chmodSync(dir, 448);
+  } catch {
+  }
+}
+function atomicWriteEncrypted(filePath, value) {
+  ensureStoreDir();
+  const tempPath = `${filePath}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
+  const blob = encrypt(JSON.stringify(value));
+  try {
+    fs.writeFileSync(tempPath, JSON.stringify(blob, null, 2), { encoding: "utf8", mode: 384 });
+    try {
+      fs.chmodSync(tempPath, 384);
+    } catch {
+    }
+    fs.renameSync(tempPath, filePath);
+    try {
+      fs.chmodSync(filePath, 384);
+    } catch {
+    }
+  } finally {
+    try {
+      fs.rmSync(tempPath, { force: true });
+    } catch {
+    }
+  }
+}
+function readEncrypted(filePath, label) {
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    const blob = safeJsonParse(fs.readFileSync(filePath, "utf8"));
+    if (!blob?.nonce || !blob?.tag || !blob?.data) {
+      logger.warn(`secure-store: malformed ${label}`);
+      return null;
+    }
+    return safeJsonParse(decrypt(blob));
+  } catch (error) {
+    logger.error(`secure-store: decrypt failed for ${label}: ${error.message}`);
+    return null;
+  }
+}
+function tokenFingerprint(token) {
+  return crypto.createHash("sha256").update(token).digest("hex").slice(0, 24);
+}
+function credentialId(token) {
+  return `cred_${tokenFingerprint(token).slice(0, 12)}`;
+}
+function legacyProjectionPayload(cliToken) {
+  return {
+    accessToken: "",
+    refreshToken: "",
+    accessExpiresAt: "1970-01-01T00:00:00.000Z",
+    cliToken
+  };
+}
+function writeLegacyProjection(host, credential) {
+  atomicWriteEncrypted(legacyFilePath(host), legacyProjectionPayload(credential.cliToken));
+  return {
+    credentialId: credential.id,
+    tokenFingerprint: tokenFingerprint(credential.cliToken)
+  };
+}
+function readVaultRaw(host) {
+  const normalizedHost = normalizeUrl(host);
+  const vault = readEncrypted(vaultFilePath(normalizedHost), `${normalizedHost} account vault`);
+  if (!vault || vault.version !== 1 || !Array.isArray(vault.credentials)) return null;
+  const credentials = vault.credentials.filter((entry) => entry?.id && entry?.cliToken);
+  if (credentials.length === 0 || !credentials.some((entry) => entry.id === vault.activeCredentialId)) return null;
+  return { ...vault, host: normalizedHost, credentials };
+}
+function writeVault(host, vault) {
+  atomicWriteEncrypted(vaultFilePath(host), vault);
+}
+function removeFile(filePath) {
+  try {
+    fs.rmSync(filePath, { force: true });
+  } catch {
+  }
+}
+function load(host) {
+  return readEncrypted(legacyFilePath(host), normalizeUrl(host));
+}
+function loadCredentialVault(host) {
+  const normalizedHost = normalizeUrl(host);
+  let vault = readVaultRaw(normalizedHost);
+  const legacyToken = load(normalizedHost)?.cliToken?.trim();
+  if (!vault) {
+    if (!legacyToken) return null;
+    const imported = { id: credentialId(legacyToken), cliToken: legacyToken };
+    vault = {
+      version: 1,
+      host: normalizedHost,
+      activeCredentialId: imported.id,
+      credentials: [imported],
+      legacyProjection: {
+        credentialId: imported.id,
+        tokenFingerprint: tokenFingerprint(legacyToken)
+      }
+    };
+    writeVault(normalizedHost, vault);
+    logger.info(`secure-store: migrated legacy CLI token for ${normalizedHost}`);
+    return vault;
+  }
+  if (legacyToken) {
+    let credential = vault.credentials.find((entry) => entry.cliToken === legacyToken);
+    let changed = false;
+    if (!credential) {
+      credential = { id: credentialId(legacyToken), cliToken: legacyToken };
+      vault.credentials.push(credential);
+      changed = true;
+      logger.info(`secure-store: imported CLI token changed by an older CLI for ${normalizedHost}`);
+    }
+    const fingerprint = tokenFingerprint(legacyToken);
+    if (vault.activeCredentialId !== credential.id || vault.legacyProjection?.credentialId !== credential.id || vault.legacyProjection?.tokenFingerprint !== fingerprint) {
+      vault.activeCredentialId = credential.id;
+      vault.legacyProjection = { credentialId: credential.id, tokenFingerprint: fingerprint };
+      changed = true;
+    }
+    if (changed) writeVault(normalizedHost, vault);
+    return vault;
+  }
+  if (vault.legacyProjection) {
+    const projection = vault.legacyProjection;
+    const projected = vault.credentials.find((entry) => entry.id === projection.credentialId && tokenFingerprint(entry.cliToken) === projection.tokenFingerprint);
+    if (projected) {
+      vault.credentials = vault.credentials.filter((entry) => entry.id !== projected.id);
+      logger.info(`secure-store: honored legacy logout for ${normalizedHost}`);
+    }
+    vault.legacyProjection = void 0;
+    if (vault.credentials.length === 0) {
+      removeFile(vaultFilePath(normalizedHost));
+      return null;
+    }
+    if (!vault.credentials.some((entry) => entry.id === vault.activeCredentialId)) {
+      vault.activeCredentialId = vault.credentials[0].id;
+    }
+  }
+  const active = vault.credentials.find((entry) => entry.id === vault.activeCredentialId);
+  vault.legacyProjection = writeLegacyProjection(normalizedHost, active);
+  writeVault(normalizedHost, vault);
+  return vault;
+}
+function getActiveCredential(host) {
+  const vault = loadCredentialVault(host);
+  return vault?.credentials.find((entry) => entry.id === vault.activeCredentialId) ?? null;
+}
+function listCredentials(host) {
+  return loadCredentialVault(host)?.credentials ?? [];
+}
+function saveCredential(host, credential, options = {}) {
+  const normalizedHost = normalizeUrl(host);
+  const existingVault = loadCredentialVault(normalizedHost);
+  if (options.add && !credential.account) {
+    throw new SecureStoreAuthError(
+      `This host does not return account identity from CLI token validation. Upgrade the server before using auth login --add for ${normalizedHost}.`
+    );
+  }
+  const sameAccount = credential.account ? existingVault?.credentials.find((entry) => entry.account?.openId === credential.account.openId || entry.account?.loginName === credential.account.loginName) : void 0;
+  const sameToken = existingVault?.credentials.find((entry) => entry.cliToken === credential.cliToken);
+  const saved = {
+    ...sameAccount ?? sameToken ?? { id: credentialId(credential.cliToken) },
+    ...credential
+  };
+  let credentials;
+  if (options.add) {
+    credentials = (existingVault?.credentials ?? []).filter((entry) => entry.id !== saved.id);
+    credentials.push(saved);
+  } else {
+    credentials = [saved];
+  }
+  const legacyProjection = writeLegacyProjection(normalizedHost, saved);
+  writeVault(normalizedHost, {
+    version: 1,
+    host: normalizedHost,
+    activeCredentialId: saved.id,
+    credentials,
+    legacyProjection
+  });
+  logger.info(`secure-store: saved CLI credential for ${normalizedHost}`);
+  return saved;
+}
+function updateCredentialMetadata(host, cliToken, metadata) {
+  const normalizedHost = normalizeUrl(host);
+  const vault = loadCredentialVault(normalizedHost);
+  if (!vault) return;
+  const index = vault.credentials.findIndex((entry) => entry.cliToken === cliToken);
+  if (index < 0) return;
+  vault.credentials[index] = {
+    ...vault.credentials[index],
+    ...metadata.account ? { account: metadata.account } : {},
+    ...metadata.cliTokenExpiresAt ? { cliTokenExpiresAt: metadata.cliTokenExpiresAt } : {}
+  };
+  writeVault(normalizedHost, vault);
+}
+function markCredentialRenewed(host, cliToken, date) {
+  const normalizedHost = normalizeUrl(host);
+  const vault = loadCredentialVault(normalizedHost);
+  const credential = vault?.credentials.find((entry) => entry.cliToken === cliToken);
+  if (!vault || !credential) return;
+  credential.lastRenewedOn = date;
+  writeVault(normalizedHost, vault);
+}
+function activateCredential(host, account) {
+  const normalizedHost = normalizeUrl(host);
+  const vault = loadCredentialVault(normalizedHost);
+  if (!vault) throw new SecureStoreAuthError(`No stored CLI credentials for ${normalizedHost}.`);
+  const matches = vault.credentials.filter((entry) => entry.account?.loginName === account || entry.account?.openId === account);
+  if (matches.length === 0) {
+    throw new SecureStoreAuthError(`No stored account '${account}' for ${normalizedHost}. Run: ae-cli auth list --host ${normalizedHost}`);
+  }
+  if (matches.length > 1) {
+    throw new SecureStoreAuthError(`Account '${account}' is ambiguous for ${normalizedHost}; use its open_id.`);
+  }
+  const selected = matches[0];
+  vault.activeCredentialId = selected.id;
+  vault.legacyProjection = writeLegacyProjection(normalizedHost, selected);
+  writeVault(normalizedHost, vault);
+  return selected;
+}
+function removeActiveCredential(host) {
+  const normalizedHost = normalizeUrl(host);
+  const vault = loadCredentialVault(normalizedHost);
+  if (!vault) return { removed: null, active: null };
+  const removed = vault.credentials.find((entry) => entry.id === vault.activeCredentialId) ?? null;
+  vault.credentials = vault.credentials.filter((entry) => entry.id !== vault.activeCredentialId);
+  if (vault.credentials.length === 0) {
+    removeFile(legacyFilePath(normalizedHost));
+    removeFile(vaultFilePath(normalizedHost));
+    return { removed, active: null };
+  }
+  const active = vault.credentials[0];
+  vault.activeCredentialId = active.id;
+  vault.legacyProjection = writeLegacyProjection(normalizedHost, active);
+  writeVault(normalizedHost, vault);
+  return { removed, active };
+}
+function clearAllCredentials(host) {
+  const normalizedHost = normalizeUrl(host);
+  removeFile(legacyFilePath(normalizedHost));
+  removeFile(vaultFilePath(normalizedHost));
+  logger.info(`secure-store: all CLI credentials cleared for ${normalizedHost}`);
+}
+function loadCliToken(host) {
+  return getActiveCredential(host)?.cliToken ?? null;
+}
+var SecureStoreAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecureStoreAuthError";
+  }
+};
+
+// src/core/cli-token.ts
+import crypto2 from "crypto";
+import fs2 from "fs";
+import path2 from "path";
+var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
+var CLI_TOKEN_RENEW_PATH = "/v1/ta/cli/token/renew";
+var CLI_TOKEN_VALIDATE_PATH = "/v1/ta/cli/token/validate";
+var CliTokenValidationUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CliTokenValidationUnavailableError";
+  }
+};
+function isExplicitCliTokenRejection(data, responseText) {
+  const code = String(data?.code ?? data?.error?.code ?? "");
+  const message = String(data?.return_message ?? data?.message ?? data?.error?.message ?? responseText);
+  return /cli[_-]?token[_-]?(invalid|expired)/i.test(code) || /cli[-_\s]?token.*\b(invalid|expired)\b/i.test(message) || /\b(invalid|expired)\b.*cli[-_\s]?token/i.test(message);
+}
+function optionalNonEmptyString(...values) {
+  return values.find((value) => typeof value === "string" && value.trim());
+}
+function optionalIsoDate(...values) {
+  const value = values.find((candidate) => typeof candidate === "string" && candidate.trim() || typeof candidate === "number");
+  if (value === void 0) return void 0;
+  const date = new Date(value);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : void 0;
+}
+var cliTokenCache = /* @__PURE__ */ new Map();
+var renewedLocalDate = /* @__PURE__ */ new Map();
+var renewInFlight = /* @__PURE__ */ new Map();
+function tokenFingerprint2(cliToken) {
+  return crypto2.createHash("sha256").update(cliToken).digest("hex").slice(0, 16);
+}
+function renewKey(hostUrl, cliToken) {
+  return `${normalizeUrl(hostUrl)}#${tokenFingerprint2(cliToken)}`;
+}
+function renewStateFilePath() {
+  return path2.join(getConfigDir(), "cli-token-renew.json");
+}
+function localRenewDate(now = /* @__PURE__ */ new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function loadRenewStore() {
+  try {
+    const file = renewStateFilePath();
+    if (!fs2.existsSync(file)) return {};
+    const data = safeReadJsonFile(file);
+    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+function saveRenewStore(store) {
+  const file = renewStateFilePath();
+  if (Object.keys(store).length === 0) {
+    try {
+      fs2.rmSync(file, { force: true });
+    } catch {
+    }
+    return;
+  }
+  const dir = getConfigDir();
+  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
+  fs2.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8", mode: 384 });
+  try {
+    fs2.chmodSync(file, 384);
+  } catch {
+  }
+}
+function persistedRenewDate(hostUrl, cliToken) {
+  const credential = getActiveCredential(hostUrl);
+  if (credential?.cliToken === cliToken && credential.lastRenewedOn) return credential.lastRenewedOn;
+  return loadRenewStore()[renewKey(hostUrl, cliToken)]?.date;
+}
+function markRenewSucceeded(hostUrl, cliToken, date) {
+  const key = renewKey(hostUrl, cliToken);
+  renewedLocalDate.set(key, date);
+  markCredentialRenewed(hostUrl, cliToken, date);
+  const store = loadRenewStore();
+  store[key] = { date };
+  saveRenewStore(store);
+}
+function clearCliTokenCache(hostUrl) {
+  if (!hostUrl) {
+    cliTokenCache.clear();
+    renewedLocalDate.clear();
+    renewInFlight.clear();
+    return;
+  }
+  const normalizedHost = normalizeUrl(hostUrl);
+  cliTokenCache.delete(normalizedHost);
+  for (const key of [...renewedLocalDate.keys()]) {
+    if (key.startsWith(`${normalizedHost}#`)) renewedLocalDate.delete(key);
+  }
+  for (const key of [...renewInFlight.keys()]) {
+    if (key.startsWith(`${normalizedHost}#`)) renewInFlight.delete(key);
+  }
+}
+async function generateCliToken(hostUrl, accessToken) {
+  if (!accessToken) throw new Error("CLI token generation requires the access token returned by auth login.");
+  const url = `${hostUrl.replace(/\/+$/, "")}${CLI_TOKEN_GENERATE_PATH}`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: { Authorization: `bearer ${accessToken}` }
+  });
+  if (!resp.ok) {
+    if (resp.status === 403) {
+      const text = await resp.text();
+      let body = {};
+      try {
+        body = text ? safeJsonParse(text) : {};
+      } catch {
+      }
+      const message = body.message ?? body.return_message ?? "CLI access is disabled for this account.";
+      const code = body.code ?? (String(message).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0);
+      throw new PermissionError(message, code, body.hint);
+    }
+    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.return_code !== 0) {
+    const message = data.return_message || data.message || "unknown";
+    if (data.code === "CLI_ACCESS_DISABLED" || String(message).includes("CLI_ACCESS_DISABLED")) {
+      throw new PermissionError(message, "CLI_ACCESS_DISABLED", data.hint);
+    }
+    throw new Error(`CLI token generate error: ${message} (code: ${data.return_code})`);
+  }
+  const cliToken = data.data?.userSecret ?? data.data?.user_secret;
+  if (!cliToken) throw new Error("CLI token generate error: empty userSecret in response");
+  return cliToken;
+}
+async function validateCliTokenOnServer(hostUrl, cliToken) {
+  const url = `${hostUrl.replace(/\/+$/, "")}${CLI_TOKEN_VALIDATE_PATH}`;
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: "GET",
+      headers: { Accept: "application/json", "cli-token": cliToken }
+    });
+  } catch (error) {
+    throw new CliTokenValidationUnavailableError(`Unable to validate CLI token for ${hostUrl}: ${error.message}`);
+  }
+  const responseText = await resp.text();
+  let body;
+  try {
+    body = safeJsonParse(responseText);
+  } catch {
+    body = void 0;
+  }
+  if (isExplicitCliTokenRejection(body, responseText)) {
+    throw new SecureStoreAuthError(
+      `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth logout --host ${hostUrl}, then ae-cli auth login --host ${hostUrl}`
+    );
+  }
+  if (!resp.ok) {
+    throw new CliTokenValidationUnavailableError(
+      `CLI token validation is unavailable for ${hostUrl} (HTTP ${resp.status} ${resp.statusText})`
+    );
+  }
+  if (body?.return_code !== 0) {
+    throw new CliTokenValidationUnavailableError(`CLI token validation returned an unsupported response for ${hostUrl}`);
+  }
+  const data = body?.data;
+  const openId = optionalNonEmptyString(data?.openId, data?.open_id);
+  const loginName = optionalNonEmptyString(data?.loginName, data?.login_name);
+  const userName = optionalNonEmptyString(data?.userName, data?.user_name);
+  const account = openId && loginName && userName ? { openId, loginName, userName } : void 0;
+  const cliTokenExpiresAt = optionalIsoDate(data?.expiresAt, data?.expires_at);
+  return {
+    ...account ? { account } : {},
+    ...cliTokenExpiresAt ? { cliTokenExpiresAt } : {}
+  };
+}
+async function renewCliTokenOnServer(hostUrl, cliToken) {
+  const url = new URL(`${hostUrl.replace(/\/+$/, "")}${CLI_TOKEN_RENEW_PATH}`);
+  url.searchParams.set("cli-token", cliToken);
+  const resp = await fetch(url.toString(), { method: "GET", headers: { Accept: "application/json" } });
+  const text = await resp.text();
+  let data;
+  try {
+    data = text ? safeJsonParse(text) : {};
+  } catch {
+    data = {};
+  }
+  if (!resp.ok) throw new Error(`CLI token renew HTTP error: ${resp.status} ${resp.statusText}`);
+  if (data?.return_code !== void 0 && data.return_code !== 0) {
+    throw new Error(`CLI token renew error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
+  }
+}
+async function maybeRenewCliTokenDaily(hostUrl, cliToken) {
+  const key = renewKey(hostUrl, cliToken);
+  const today = localRenewDate();
+  if (renewedLocalDate.get(key) === today || persistedRenewDate(hostUrl, cliToken) === today) {
+    renewedLocalDate.set(key, today);
+    return;
+  }
+  const existing = renewInFlight.get(key);
+  if (existing) return existing;
+  const attempt = (async () => {
+    try {
+      await renewCliTokenOnServer(hostUrl, cliToken);
+      markRenewSucceeded(hostUrl, cliToken, today);
+      logger.info(`cli-token: renewed for ${normalizeUrl(hostUrl)} (local day ${today})`);
+    } catch (error) {
+      logger.warn(`cli-token: renew failed for ${normalizeUrl(hostUrl)}: ${error?.message || error}; business call proceeds`);
+    } finally {
+      renewInFlight.delete(key);
+    }
+  })();
+  renewInFlight.set(key, attempt);
+  await attempt;
+}
+function peekCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  if (!hostUrl) return void 0;
+  const normalizedHost = normalizeUrl(hostUrl);
+  const stored = loadCliToken(normalizedHost);
+  if (stored) {
+    cliTokenCache.set(normalizedHost, stored);
+    return stored;
+  }
+  return cliTokenCache.get(normalizedHost) || getFallbackCliToken(normalizedHost) || void 0;
+}
+async function getCliToken(hostOverride) {
+  const resolvedHost = hostOverride || getActiveHost();
+  if (!resolvedHost) throw new SecureStoreAuthError("No AE host configured. Run: ae-cli auth login --host <url>");
+  const hostUrl = normalizeUrl(resolvedHost);
+  const stored = loadCliToken(hostUrl);
+  let token = stored || getFallbackCliToken(hostUrl) || cliTokenCache.get(hostUrl);
+  if (!token) {
+    throw new SecureStoreAuthError(`No stored CLI token for ${hostUrl}. Run: ae-cli auth login --host ${hostUrl}`);
+  }
+  cliTokenCache.set(hostUrl, token);
+  await maybeRenewCliTokenDaily(hostUrl, token);
+  return token;
+}
+async function mintCliToken(hostUrl, accessToken) {
+  logger.info(`Generating CLI token for ${hostUrl}`);
+  const cliToken = await generateCliToken(hostUrl, accessToken);
+  cliTokenCache.set(normalizeUrl(hostUrl), cliToken);
+  return cliToken;
+}
+
+export {
+  getActiveCredential,
+  listCredentials,
+  saveCredential,
+  updateCredentialMetadata,
+  activateCredential,
+  removeActiveCredential,
+  clearAllCredentials,
+  SecureStoreAuthError,
+  CliTokenValidationUnavailableError,
+  clearCliTokenCache,
+  validateCliTokenOnServer,
+  peekCliToken,
+  getCliToken,
+  mintCliToken
+};