@tiangong-lca/cli 0.0.1

package/dist/src/lib/supabase-rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-rest.js","sourceRoot":"","sources":["../../../src/lib/supabase-rest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAqB9B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CACtB,WAAmB,EACnB,OAIC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACrE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;IACzE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,GAAW;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,mDAAmD,GAAG,EAAE,EAAE;YAC3E,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,8BAA8B,GAAG,EAAE,EAAE;gBAChF,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAC9C,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YAC3E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;SACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAgB,EAAE,SAAiB;IAC1E,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAAC,mDAAmD,SAAS,GAAG,EAAE;oBAClF,IAAI,EAAE,+BAA+B;oBACrC,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,QAAQ,CAAC,gDAAgD,SAAS,GAAG,EAAE;gBAC/E,IAAI,EAAE,oCAAoC;gBAC1C,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,8CAA8C,SAAS,GAAG,EAAE;YAC7E,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,OAO3C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,wBAAwB,CACtD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,EAAE;YAC7C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,SAAS,CAC1B,MAAM,qBAAqB,CACzB,MAAM;aACH,IAAI,CAAC,WAAW,CAAC;aACjB,MAAM,CAAC,wCAAwC,CAAC;aAChD,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;aACpB,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACtC,KAAK,CAAC,CAAC,CAAC,EACX,SAAS,CACV,EACD,SAAS,CACV,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,GAAG,EAAE,UAAU,CAAC,CAAC,CAAuB;YACxC,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,wBAAwB;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE;QAC5C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,SAAS,CACzB,MAAM,qBAAqB,CACzB,MAAM;SACH,IAAI,CAAC,WAAW,CAAC;SACjB,MAAM,CAAC,wCAAwC,CAAC;SAChD,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;SACpB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EACjC,QAAQ,CACT,EACD,QAAQ,CACT,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,CAAC,CAAuB;YACvC,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,uBAAuB;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,EAAE;QAC7C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,SAAS,CAC1B,MAAM,qBAAqB,CACzB,MAAM;SACH,IAAI,CAAC,WAAW,CAAC;SACjB,MAAM,CAAC,wCAAwC,CAAC;SAChD,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;SACpB,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SACtC,KAAK,CAAC,CAAC,CAAC,EACX,SAAS,CACV,EACD,SAAS,CACV,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,CAAC,CAAuB;QACxC,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,iCAAiC;KAC9C,CAAC;AACJ,CAAC;AAED,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC7B,CAAC","sourcesContent":["import { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport {\n  createSupabaseDataClient,\n  deriveSupabaseRestBaseUrl,\n  requireSupabaseRestRuntime,\n  runSupabaseArrayQuery,\n  type SupabaseDataRuntime,\n} from './supabase-client.js';\n\ntype JsonObject = Record<string, unknown>;\n\nexport type SupabaseProcessRow = {\n  id: string;\n  version: string;\n  json: unknown;\n  modified_at: string | null;\n  state_code: number | null;\n};\n\nexport type SupabaseProcessLookup = {\n  row: SupabaseProcessRow;\n  sourceUrl: string;\n  resolution:\n    | 'remote_supabase_exact'\n    | 'remote_supabase_latest'\n    | 'remote_supabase_latest_fallback';\n};\n\nfunction isRecord(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction buildProcessUrl(\n  restBaseUrl: string,\n  options: {\n    id: string;\n    version?: string | null;\n    latestOnly?: boolean;\n  },\n): string {\n  const url = new URL(`${restBaseUrl.replace(/\\/+$/u, '')}/processes`);\n  url.searchParams.set('select', 'id,version,json,modified_at,state_code');\n  url.searchParams.set('id', `eq.${options.id}`);\n\n  if (options.version) {\n    url.searchParams.set('version', `eq.${options.version}`);\n  } else if (options.latestOnly) {\n    url.searchParams.set('order', 'version.desc');\n    url.searchParams.set('limit', '1');\n  }\n\n  return url.toString();\n}\n\nfunction parseRows(payload: unknown, url: string): SupabaseProcessRow[] {\n  if (!Array.isArray(payload)) {\n    throw new CliError(`Supabase REST response was not a JSON array for ${url}`, {\n      code: 'SUPABASE_REST_RESPONSE_INVALID',\n      exitCode: 1,\n      details: payload,\n    });\n  }\n\n  return payload.map((item, index) => {\n    if (!isRecord(item)) {\n      throw new CliError(`Supabase REST row ${index} was not a JSON object for ${url}`, {\n        code: 'SUPABASE_REST_RESPONSE_INVALID',\n        exitCode: 1,\n        details: item,\n      });\n    }\n\n    return {\n      id: typeof item.id === 'string' ? item.id : '',\n      version: typeof item.version === 'string' ? item.version : '',\n      json: item.json,\n      modified_at: typeof item.modified_at === 'string' ? item.modified_at : null,\n      state_code: typeof item.state_code === 'number' ? item.state_code : null,\n    };\n  });\n}\n\nfunction normalizeSupabaseProcessPayload(payload: unknown, lookupKey: string): JsonObject {\n  if (typeof payload === 'string') {\n    try {\n      const parsed = JSON.parse(payload);\n      if (!isRecord(parsed)) {\n        throw new CliError(`Supabase REST payload was not a JSON object for ${lookupKey}.`, {\n          code: 'SUPABASE_REST_PAYLOAD_INVALID',\n          exitCode: 1,\n          details: parsed,\n        });\n      }\n      return parsed;\n    } catch (error) {\n      if (error instanceof CliError) {\n        throw error;\n      }\n\n      throw new CliError(`Supabase REST payload was not valid JSON for ${lookupKey}.`, {\n        code: 'SUPABASE_REST_PAYLOAD_INVALID_JSON',\n        exitCode: 1,\n        details: String(error),\n      });\n    }\n  }\n\n  if (!isRecord(payload)) {\n    throw new CliError(`Supabase REST payload was missing json for ${lookupKey}.`, {\n      code: 'SUPABASE_REST_PAYLOAD_MISSING',\n      exitCode: 1,\n      details: payload,\n    });\n  }\n\n  return payload;\n}\n\nasync function fetchExactOrLatestProcessRow(options: {\n  runtime: SupabaseDataRuntime;\n  id: string;\n  version?: string | null;\n  timeoutMs: number;\n  fetchImpl: FetchLike;\n  fallbackToLatest?: boolean;\n}): Promise<SupabaseProcessLookup | null> {\n  const { client, restBaseUrl } = createSupabaseDataClient(\n    options.runtime,\n    options.fetchImpl,\n    options.timeoutMs,\n  );\n\n  if (!options.version) {\n    const latestUrl = buildProcessUrl(restBaseUrl, {\n      id: options.id,\n      latestOnly: true,\n    });\n    const latestRows = parseRows(\n      await runSupabaseArrayQuery(\n        client\n          .from('processes')\n          .select('id,version,json,modified_at,state_code')\n          .eq('id', options.id)\n          .order('version', { ascending: false })\n          .limit(1),\n        latestUrl,\n      ),\n      latestUrl,\n    );\n\n    if (latestRows.length === 0) {\n      return null;\n    }\n\n    return {\n      row: latestRows[0] as SupabaseProcessRow,\n      sourceUrl: latestUrl,\n      resolution: 'remote_supabase_latest',\n    };\n  }\n\n  const exactUrl = buildProcessUrl(restBaseUrl, {\n    id: options.id,\n    version: options.version,\n  });\n  const exactRows = parseRows(\n    await runSupabaseArrayQuery(\n      client\n        .from('processes')\n        .select('id,version,json,modified_at,state_code')\n        .eq('id', options.id)\n        .eq('version', options.version),\n      exactUrl,\n    ),\n    exactUrl,\n  );\n\n  if (exactRows.length > 0) {\n    return {\n      row: exactRows[0] as SupabaseProcessRow,\n      sourceUrl: exactUrl,\n      resolution: 'remote_supabase_exact',\n    };\n  }\n\n  if (!options.fallbackToLatest) {\n    return null;\n  }\n\n  const latestUrl = buildProcessUrl(restBaseUrl, {\n    id: options.id,\n    latestOnly: true,\n  });\n  const latestRows = parseRows(\n    await runSupabaseArrayQuery(\n      client\n        .from('processes')\n        .select('id,version,json,modified_at,state_code')\n        .eq('id', options.id)\n        .order('version', { ascending: false })\n        .limit(1),\n      latestUrl,\n    ),\n    latestUrl,\n  );\n\n  if (latestRows.length === 0) {\n    return null;\n  }\n\n  return {\n    row: latestRows[0] as SupabaseProcessRow,\n    sourceUrl: latestUrl,\n    resolution: 'remote_supabase_latest_fallback',\n  };\n}\n\nexport {\n  requireSupabaseRestRuntime,\n  deriveSupabaseRestBaseUrl,\n  normalizeSupabaseProcessPayload,\n  fetchExactOrLatestProcessRow,\n};\n\nexport type { SupabaseDataRuntime };\n"]}

package/dist/src/lib/supabase-session.js

@@ -0,0 +1,424 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createClient } from '@supabase/supabase-js';
+import { CliError } from './errors.js';
+import { withStateFileLock } from './state-lock.js';
+import { createSupabaseFetch, deriveSupabaseProjectBaseUrl, } from './supabase-client.js';
+import { fingerprintSecret, fingerprintUserApiKey, requireUserApiKeyCredentials, } from './user-api-key.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+const SESSION_REFRESH_WINDOW_SECONDS = 300;
+const SESSION_MEMORY_CACHE = new Map();
+const SESSION_OPERATION_CHAINS = new Map();
+function trimToken(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function nowSeconds(now) {
+    return Math.floor(now.getTime() / 1000);
+}
+function computeExpiresAt(session, now) {
+    if (typeof session.expires_at === 'number' && Number.isFinite(session.expires_at)) {
+        return Math.floor(session.expires_at);
+    }
+    if (typeof session.expires_in === 'number' && Number.isFinite(session.expires_in)) {
+        return nowSeconds(now) + Math.max(Math.floor(session.expires_in), 0);
+    }
+    return null;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseCachedSessionRecord(value) {
+    if (!isRecord(value)) {
+        return null;
+    }
+    if (value.schema_version !== 1) {
+        return null;
+    }
+    const supabaseUrl = trimToken(value.supabase_url);
+    const publishableKeyFingerprint = trimToken(value.publishable_key_fingerprint);
+    const userApiKeyFingerprint = trimToken(value.user_api_key_fingerprint);
+    const userEmail = trimToken(value.user_email);
+    const accessToken = trimToken(value.access_token);
+    const refreshToken = trimToken(value.refresh_token);
+    const updatedAtUtc = trimToken(value.updated_at_utc);
+    const expiresAt = typeof value.expires_at === 'number' && Number.isFinite(value.expires_at)
+        ? Math.floor(value.expires_at)
+        : value.expires_at === null
+            ? null
+            : NaN;
+    if (!supabaseUrl ||
+        !publishableKeyFingerprint ||
+        !userApiKeyFingerprint ||
+        !userEmail ||
+        !accessToken ||
+        !refreshToken ||
+        !updatedAtUtc ||
+        Number.isNaN(expiresAt)) {
+        return null;
+    }
+    return {
+        schema_version: 1,
+        supabase_url: supabaseUrl,
+        publishable_key_fingerprint: publishableKeyFingerprint,
+        user_api_key_fingerprint: userApiKeyFingerprint,
+        user_email: userEmail,
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt,
+        updated_at_utc: updatedAtUtc,
+    };
+}
+function resolveDefaultSessionFilePath(options) {
+    if (options.xdgStateHome) {
+        return path.join(options.xdgStateHome, 'tiangong-lca-cli', 'session.json');
+    }
+    if (options.homeDir) {
+        return path.join(options.homeDir, '.local', 'state', 'tiangong-lca-cli', 'session.json');
+    }
+    if (options.platform === 'darwin') {
+        return path.join(os.homedir(), 'Library', 'Application Support', 'tiangong-lca-cli', 'session.json');
+    }
+    if (options.platform === 'win32' && options.localAppData) {
+        return path.join(options.localAppData, 'tiangong-lca-cli', 'session.json');
+    }
+    return path.resolve('.tiangong-lca-session.json');
+}
+function resolveSessionFilePath(runtime) {
+    if (runtime.disableSessionCache) {
+        return null;
+    }
+    if (runtime.sessionFile) {
+        return path.resolve(runtime.sessionFile);
+    }
+    return resolveDefaultSessionFilePath({
+        platform: process.platform,
+        homeDir: trimToken(os.homedir()),
+        xdgStateHome: trimToken(process.env.XDG_STATE_HOME) || null,
+        localAppData: trimToken(process.env.LOCALAPPDATA) || null,
+    });
+}
+function buildRuntimeIdentity(runtime) {
+    const projectBaseUrl = deriveSupabaseProjectBaseUrl(runtime.apiBaseUrl);
+    const publishableKeyFingerprint = fingerprintSecret(runtime.publishableKey);
+    const userApiKeyFingerprint = fingerprintUserApiKey(runtime.userApiKey);
+    const sessionFilePath = resolveSessionFilePath(runtime);
+    return {
+        projectBaseUrl,
+        publishableKeyFingerprint,
+        userApiKeyFingerprint,
+        sessionFilePath,
+        memoKey: [
+            projectBaseUrl,
+            publishableKeyFingerprint,
+            userApiKeyFingerprint,
+            sessionFilePath ?? 'memory-only',
+        ].join('|'),
+    };
+}
+function recordMatchesRuntime(record, runtime) {
+    return (record.supabase_url === runtime.projectBaseUrl &&
+        record.publishable_key_fingerprint === runtime.publishableKeyFingerprint &&
+        record.user_api_key_fingerprint === runtime.userApiKeyFingerprint);
+}
+function isSessionFresh(record, now) {
+    return (typeof record.expires_at === 'number' &&
+        Number.isFinite(record.expires_at) &&
+        record.expires_at > nowSeconds(now) + SESSION_REFRESH_WINDOW_SECONDS);
+}
+function buildCachedSessionRecord(options) {
+    const accessToken = trimToken(options.session.access_token);
+    const refreshToken = trimToken(options.session.refresh_token);
+    if (!accessToken || !refreshToken) {
+        throw new CliError('Supabase auth did not return a usable session.', {
+            code: 'SUPABASE_AUTH_SESSION_INVALID',
+            exitCode: 1,
+        });
+    }
+    return {
+        schema_version: 1,
+        supabase_url: options.runtime.projectBaseUrl,
+        publishable_key_fingerprint: options.runtime.publishableKeyFingerprint,
+        user_api_key_fingerprint: options.runtime.userApiKeyFingerprint,
+        user_email: options.userEmail,
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: computeExpiresAt(options.session, options.now),
+        updated_at_utc: options.now.toISOString(),
+    };
+}
+function toResolvedSession(record, runtime, source) {
+    return {
+        accessToken: record.access_token,
+        refreshToken: record.refresh_token,
+        expiresAt: record.expires_at,
+        userEmail: record.user_email,
+        projectBaseUrl: runtime.projectBaseUrl,
+        sessionFile: runtime.sessionFilePath,
+        source,
+    };
+}
+function readCachedSessionRecord(sessionFilePath) {
+    try {
+        const text = readFileSync(sessionFilePath, 'utf8').trim();
+        if (!text) {
+            return null;
+        }
+        return parseCachedSessionRecord(JSON.parse(text));
+    }
+    catch {
+        return null;
+    }
+}
+function writeCachedSessionRecord(sessionFilePath, record) {
+    mkdirSync(path.dirname(sessionFilePath), {
+        recursive: true,
+        mode: 0o700,
+    });
+    const tempPath = `${sessionFilePath}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(tempPath, `${JSON.stringify(record, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+        renameSync(tempPath, sessionFilePath);
+        chmodSync(sessionFilePath, 0o600);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
+function getMemoizedRecord(runtime) {
+    return SESSION_MEMORY_CACHE.get(runtime.memoKey) ?? null;
+}
+function memoizeRecord(runtime, record) {
+    SESSION_MEMORY_CACHE.set(runtime.memoKey, record);
+}
+function dropMemoizedRecord(runtime) {
+    SESSION_MEMORY_CACHE.delete(runtime.memoKey);
+}
+async function withSessionOperationLock(memoKey, task) {
+    const previous = SESSION_OPERATION_CHAINS.get(memoKey) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve) => {
+        release = resolve;
+    });
+    const chain = previous.catch(() => undefined).then(() => gate);
+    SESSION_OPERATION_CHAINS.set(memoKey, chain);
+    await previous.catch(() => undefined);
+    try {
+        return await task();
+    }
+    finally {
+        release();
+        if (SESSION_OPERATION_CHAINS.get(memoKey) === chain) {
+            SESSION_OPERATION_CHAINS.delete(memoKey);
+        }
+    }
+}
+function createSupabaseAuthClient(runtime, publishableKey, fetchImpl, timeoutMs) {
+    return createClient(runtime.projectBaseUrl, publishableKey, {
+        auth: {
+            autoRefreshToken: false,
+            persistSession: false,
+            detectSessionInUrl: false,
+        },
+        global: {
+            fetch: createSupabaseFetch(fetchImpl, timeoutMs),
+        },
+    });
+}
+async function signInWithUserApiKey(options) {
+    const credentials = requireUserApiKeyCredentials(options.runtime.userApiKey);
+    const authClient = createSupabaseAuthClient(options.runtimeIdentity, options.runtime.publishableKey, options.fetchImpl, options.timeoutMs);
+    const { data, error } = await authClient.auth.signInWithPassword({
+        email: credentials.email,
+        password: credentials.password,
+    });
+    if (error || !data.session) {
+        throw new CliError('Failed to sign in with TIANGONG_LCA_API_KEY.', {
+            code: 'SUPABASE_AUTH_SIGN_IN_FAILED',
+            exitCode: 1,
+            details: error?.message ?? 'Supabase auth session missing from sign-in response.',
+        });
+    }
+    return buildCachedSessionRecord({
+        runtime: options.runtimeIdentity,
+        session: data.session,
+        userEmail: trimToken(data.user?.email) || credentials.email,
+        now: options.now,
+    });
+}
+async function refreshWithRefreshToken(options) {
+    const normalizedRefreshToken = trimToken(options.refreshToken);
+    if (!normalizedRefreshToken) {
+        return null;
+    }
+    try {
+        const authClient = createSupabaseAuthClient(options.runtimeIdentity, options.runtime.publishableKey, options.fetchImpl, options.timeoutMs);
+        const { data, error } = await authClient.auth.refreshSession({
+            refresh_token: normalizedRefreshToken,
+        });
+        if (error || !data.session) {
+            return null;
+        }
+        return buildCachedSessionRecord({
+            runtime: options.runtimeIdentity,
+            session: data.session,
+            userEmail: trimToken(data.user?.email) || options.userEmail,
+            now: options.now,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveAndPersistSession(options) {
+    const { runtime, runtimeIdentity } = options;
+    const memoized = getMemoizedRecord(runtimeIdentity);
+    if (!options.forceRefresh &&
+        !runtime.forceReauth &&
+        memoized &&
+        recordMatchesRuntime(memoized, runtimeIdentity) &&
+        isSessionFresh(memoized, options.now)) {
+        return toResolvedSession(memoized, runtimeIdentity, 'memory');
+    }
+    const cachedFromDisk = runtimeIdentity.sessionFilePath !== null
+        ? readCachedSessionRecord(runtimeIdentity.sessionFilePath)
+        : null;
+    if (!options.forceRefresh &&
+        !runtime.forceReauth &&
+        cachedFromDisk &&
+        recordMatchesRuntime(cachedFromDisk, runtimeIdentity) &&
+        isSessionFresh(cachedFromDisk, options.now)) {
+        memoizeRecord(runtimeIdentity, cachedFromDisk);
+        return toResolvedSession(cachedFromDisk, runtimeIdentity, 'cache');
+    }
+    if (!runtime.forceReauth) {
+        const refreshCandidate = cachedFromDisk &&
+            recordMatchesRuntime(cachedFromDisk, runtimeIdentity) &&
+            trimToken(cachedFromDisk.refresh_token)
+            ? cachedFromDisk
+            : memoized &&
+                recordMatchesRuntime(memoized, runtimeIdentity) &&
+                trimToken(memoized.refresh_token)
+                ? memoized
+                : null;
+        if (refreshCandidate) {
+            const refreshed = await refreshWithRefreshToken({
+                runtime,
+                runtimeIdentity,
+                refreshToken: refreshCandidate.refresh_token,
+                userEmail: refreshCandidate.user_email,
+                fetchImpl: options.fetchImpl,
+                timeoutMs: options.timeoutMs,
+                now: options.now,
+            });
+            if (refreshed) {
+                if (runtimeIdentity.sessionFilePath) {
+                    writeCachedSessionRecord(runtimeIdentity.sessionFilePath, refreshed);
+                }
+                memoizeRecord(runtimeIdentity, refreshed);
+                return toResolvedSession(refreshed, runtimeIdentity, 'refresh');
+            }
+        }
+    }
+    const signedIn = await signInWithUserApiKey({
+        runtime,
+        runtimeIdentity,
+        fetchImpl: options.fetchImpl,
+        timeoutMs: options.timeoutMs,
+        now: options.now,
+    });
+    if (runtimeIdentity.sessionFilePath) {
+        writeCachedSessionRecord(runtimeIdentity.sessionFilePath, signedIn);
+    }
+    memoizeRecord(runtimeIdentity, signedIn);
+    return toResolvedSession(signedIn, runtimeIdentity, 'signin');
+}
+export async function resolveSupabaseUserSession(options) {
+    const runtimeIdentity = buildRuntimeIdentity(options.runtime);
+    const now = options.now ?? new Date();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const forceRefresh = Boolean(options.forceRefresh);
+    if (!forceRefresh && !options.runtime.forceReauth) {
+        const memoized = getMemoizedRecord(runtimeIdentity);
+        if (memoized &&
+            recordMatchesRuntime(memoized, runtimeIdentity) &&
+            isSessionFresh(memoized, now)) {
+            return toResolvedSession(memoized, runtimeIdentity, 'memory');
+        }
+        if (runtimeIdentity.sessionFilePath) {
+            const cached = readCachedSessionRecord(runtimeIdentity.sessionFilePath);
+            if (cached && recordMatchesRuntime(cached, runtimeIdentity) && isSessionFresh(cached, now)) {
+                memoizeRecord(runtimeIdentity, cached);
+                return toResolvedSession(cached, runtimeIdentity, 'cache');
+            }
+        }
+    }
+    return withSessionOperationLock(runtimeIdentity.memoKey, async () => {
+        if (runtimeIdentity.sessionFilePath) {
+            return withStateFileLock(runtimeIdentity.sessionFilePath, {
+                reason: forceRefresh ? 'refresh_supabase_user_session' : 'resolve_supabase_user_session',
+            }, () => resolveAndPersistSession({
+                runtime: options.runtime,
+                runtimeIdentity,
+                fetchImpl: options.fetchImpl,
+                timeoutMs,
+                now,
+                forceRefresh,
+            }));
+        }
+        return resolveAndPersistSession({
+            runtime: options.runtime,
+            runtimeIdentity,
+            fetchImpl: options.fetchImpl,
+            timeoutMs,
+            now,
+            forceRefresh,
+        });
+    });
+}
+export function createSupabaseDataRuntime(options) {
+    return {
+        apiBaseUrl: options.runtime.apiBaseUrl,
+        publishableKey: options.runtime.publishableKey,
+        getAccessToken: async () => (await resolveSupabaseUserSession({
+            runtime: options.runtime,
+            fetchImpl: options.fetchImpl,
+            timeoutMs: options.timeoutMs,
+            now: options.now,
+        })).accessToken,
+        refreshAccessToken: async () => (await resolveSupabaseUserSession({
+            runtime: options.runtime,
+            fetchImpl: options.fetchImpl,
+            timeoutMs: options.timeoutMs,
+            now: options.now,
+            forceRefresh: true,
+        })).accessToken,
+    };
+}
+export const __testInternals = {
+    SESSION_MEMORY_CACHE,
+    SESSION_OPERATION_CHAINS,
+    buildCachedSessionRecord,
+    buildRuntimeIdentity,
+    computeExpiresAt,
+    createSupabaseAuthClient,
+    dropMemoizedRecord,
+    getMemoizedRecord,
+    isSessionFresh,
+    memoizeRecord,
+    parseCachedSessionRecord,
+    readCachedSessionRecord,
+    recordMatchesRuntime,
+    refreshWithRefreshToken,
+    resolveDefaultSessionFilePath,
+    resolveAndPersistSession,
+    resolveSessionFilePath,
+    signInWithUserApiKey,
+    withSessionOperationLock,
+    writeCachedSessionRecord,
+};
+//# sourceMappingURL=supabase-session.js.map

package/dist/src/lib/supabase-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-session.js","sourceRoot":"","sources":["../../../src/lib/supabase-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAgB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAG7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAgC3C,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAC5E,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElE,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,GAAS;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,GAAS;IACnD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,yBAAyB,GAAG,SAAS,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/E,MAAM,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC;IAEZ,IACE,CAAC,WAAW;QACZ,CAAC,yBAAyB;QAC1B,CAAC,qBAAqB;QACtB,CAAC,SAAS;QACV,CAAC,WAAW;QACZ,CAAC,YAAY;QACb,CAAC,YAAY;QACb,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,WAAW;QACzB,2BAA2B,EAAE,yBAAyB;QACtD,wBAAwB,EAAE,qBAAqB;QAC/C,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,YAAY;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAKtC;IACC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA4B;IAC1D,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,6BAA6B,CAAC;QACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI;QAC3D,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;KAC1D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4B;IACxD,MAAM,cAAc,GAAG,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAExD,OAAO;QACL,cAAc;QACd,yBAAyB;QACzB,qBAAqB;QACrB,eAAe;QACf,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB;YACzB,qBAAqB;YACrB,eAAe,IAAI,aAAa;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAmC,EACnC,OAAwB;IAExB,OAAO,CACL,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,cAAc;QAC9C,MAAM,CAAC,2BAA2B,KAAK,OAAO,CAAC,yBAAyB;QACxE,MAAM,CAAC,wBAAwB,KAAK,OAAO,CAAC,qBAAqB,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAmC,EAAE,GAAS;IACpE,OAAO,CACL,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAClC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,8BAA8B,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAKjC;IACC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,gDAAgD,EAAE;YACnE,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;QAC5C,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,yBAAyB;QACtE,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,qBAAqB;QAC/D,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;QAC1D,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAmC,EACnC,OAAwB,EACxB,MAA6C;IAE7C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,eAAe;QACpC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,eAAuB;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,eAAuB,EACvB,MAAmC;IAEnC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;QACvC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,eAAe,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvE,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9D,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB;IACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB,EAAE,MAAmC;IAClF,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAwB;IAClD,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAI,OAAe,EAAE,IAAsB;IAChF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5E,IAAI,OAAoB,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE7C,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACpD,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAwB,EACxB,cAAsB,EACtB,SAAoB,EACpB,SAAiB;IAEjB,OAAO,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE;QAC1D,IAAI,EAAE;YACJ,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,KAAK;SAC1B;QACD,MAAM,EAAE;YACN,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;SACjD;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAMnC;IACC,MAAM,WAAW,GAAG,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,wBAAwB,CACzC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,OAAO,CAAC,cAAc,EAC9B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC/D,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE;YACjE,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,sDAAsD;SAClF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,wBAAwB,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,eAAe;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAQtC;IACC,MAAM,sBAAsB,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,wBAAwB,CACzC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,OAAO,CAAC,cAAc,EAC9B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;YAC3D,aAAa,EAAE,sBAAsB;SACtC,CAAC,CAAC;QAEH,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,wBAAwB,CAAC;YAC9B,OAAO,EAAE,OAAO,CAAC,eAAe;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS;YAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,OAOvC;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACpD,IACE,CAAC,OAAO,CAAC,YAAY;QACrB,CAAC,OAAO,CAAC,WAAW;QACpB,QAAQ;QACR,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC/C,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,EACrC,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,cAAc,GAClB,eAAe,CAAC,eAAe,KAAK,IAAI;QACtC,CAAC,CAAC,uBAAuB,CAAC,eAAe,CAAC,eAAe,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC;IACX,IACE,CAAC,OAAO,CAAC,YAAY;QACrB,CAAC,OAAO,CAAC,WAAW;QACpB,cAAc;QACd,oBAAoB,CAAC,cAAc,EAAE,eAAe,CAAC;QACrD,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,EAC3C,CAAC;QACD,aAAa,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAC/C,OAAO,iBAAiB,CAAC,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,gBAAgB,GACpB,cAAc;YACd,oBAAoB,CAAC,cAAc,EAAE,eAAe,CAAC;YACrD,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC;YACrC,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,QAAQ;gBACN,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC;gBAC/C,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACnC,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,CAAC;QAEb,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,OAAO;gBACP,eAAe;gBACf,YAAY,EAAE,gBAAgB,CAAC,aAAa;gBAC5C,SAAS,EAAE,gBAAgB,CAAC,UAAU;gBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;oBACpC,wBAAwB,CAAC,eAAe,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;gBACvE,CAAC;gBACD,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;gBAC1C,OAAO,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;QAC1C,OAAO;QACP,eAAe;QACf,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;QACpC,wBAAwB,CAAC,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAMhD;IACC,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEnD,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACpD,IACE,QAAQ;YACR,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC;YAC/C,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,EAC7B,CAAC;YACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3F,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBACvC,OAAO,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,wBAAwB,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAClE,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,iBAAiB,CACtB,eAAe,CAAC,eAAe,EAC/B;gBACE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,+BAA+B;aACzF,EACD,GAAG,EAAE,CACH,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe;gBACf,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS;gBACT,GAAG;gBACH,YAAY;aACb,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,wBAAwB,CAAC;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe;YACf,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS;YACT,GAAG;YACH,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAKzC;IACC,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;QACtC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;QAC9C,cAAc,EAAE,KAAK,IAAI,EAAE,CACzB,CACE,MAAM,0BAA0B,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CACH,CAAC,WAAW;QACf,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAC7B,CACE,MAAM,0BAA0B,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CACH,CAAC,WAAW;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,oBAAoB;IACpB,gBAAgB;IAChB,wBAAwB;IACxB,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,uBAAuB;IACvB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { createClient, type Session } from '@supabase/supabase-js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport { withStateFileLock } from './state-lock.js';\nimport {\n  createSupabaseFetch,\n  deriveSupabaseProjectBaseUrl,\n  type SupabaseDataRuntime,\n  type SupabaseRestRuntime,\n} from './supabase-client.js';\nimport {\n  fingerprintSecret,\n  fingerprintUserApiKey,\n  requireUserApiKeyCredentials,\n} from './user-api-key.js';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst SESSION_REFRESH_WINDOW_SECONDS = 300;\n\nexport type CachedSupabaseSessionRecord = {\n  schema_version: 1;\n  supabase_url: string;\n  publishable_key_fingerprint: string;\n  user_api_key_fingerprint: string;\n  user_email: string;\n  access_token: string;\n  refresh_token: string;\n  expires_at: number | null;\n  updated_at_utc: string;\n};\n\nexport type ResolvedSupabaseUserSession = {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: number | null;\n  userEmail: string;\n  projectBaseUrl: string;\n  sessionFile: string | null;\n  source: 'memory' | 'cache' | 'refresh' | 'signin';\n};\n\ntype RuntimeIdentity = {\n  projectBaseUrl: string;\n  publishableKeyFingerprint: string;\n  userApiKeyFingerprint: string;\n  sessionFilePath: string | null;\n  memoKey: string;\n};\n\nconst SESSION_MEMORY_CACHE = new Map<string, CachedSupabaseSessionRecord>();\nconst SESSION_OPERATION_CHAINS = new Map<string, Promise<void>>();\n\nfunction trimToken(value: unknown): string {\n  return typeof value === 'string' ? value.trim() : '';\n}\n\nfunction nowSeconds(now: Date): number {\n  return Math.floor(now.getTime() / 1000);\n}\n\nfunction computeExpiresAt(session: Session, now: Date): number | null {\n  if (typeof session.expires_at === 'number' && Number.isFinite(session.expires_at)) {\n    return Math.floor(session.expires_at);\n  }\n\n  if (typeof session.expires_in === 'number' && Number.isFinite(session.expires_in)) {\n    return nowSeconds(now) + Math.max(Math.floor(session.expires_in), 0);\n  }\n\n  return null;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction parseCachedSessionRecord(value: unknown): CachedSupabaseSessionRecord | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n\n  if (value.schema_version !== 1) {\n    return null;\n  }\n\n  const supabaseUrl = trimToken(value.supabase_url);\n  const publishableKeyFingerprint = trimToken(value.publishable_key_fingerprint);\n  const userApiKeyFingerprint = trimToken(value.user_api_key_fingerprint);\n  const userEmail = trimToken(value.user_email);\n  const accessToken = trimToken(value.access_token);\n  const refreshToken = trimToken(value.refresh_token);\n  const updatedAtUtc = trimToken(value.updated_at_utc);\n  const expiresAt =\n    typeof value.expires_at === 'number' && Number.isFinite(value.expires_at)\n      ? Math.floor(value.expires_at)\n      : value.expires_at === null\n        ? null\n        : NaN;\n\n  if (\n    !supabaseUrl ||\n    !publishableKeyFingerprint ||\n    !userApiKeyFingerprint ||\n    !userEmail ||\n    !accessToken ||\n    !refreshToken ||\n    !updatedAtUtc ||\n    Number.isNaN(expiresAt)\n  ) {\n    return null;\n  }\n\n  return {\n    schema_version: 1,\n    supabase_url: supabaseUrl,\n    publishable_key_fingerprint: publishableKeyFingerprint,\n    user_api_key_fingerprint: userApiKeyFingerprint,\n    user_email: userEmail,\n    access_token: accessToken,\n    refresh_token: refreshToken,\n    expires_at: expiresAt,\n    updated_at_utc: updatedAtUtc,\n  };\n}\n\nfunction resolveDefaultSessionFilePath(options: {\n  platform: NodeJS.Platform;\n  homeDir: string;\n  xdgStateHome: string | null;\n  localAppData: string | null;\n}): string {\n  if (options.xdgStateHome) {\n    return path.join(options.xdgStateHome, 'tiangong-lca-cli', 'session.json');\n  }\n\n  if (options.homeDir) {\n    return path.join(options.homeDir, '.local', 'state', 'tiangong-lca-cli', 'session.json');\n  }\n\n  if (options.platform === 'darwin') {\n    return path.join(\n      os.homedir(),\n      'Library',\n      'Application Support',\n      'tiangong-lca-cli',\n      'session.json',\n    );\n  }\n\n  if (options.platform === 'win32' && options.localAppData) {\n    return path.join(options.localAppData, 'tiangong-lca-cli', 'session.json');\n  }\n\n  return path.resolve('.tiangong-lca-session.json');\n}\n\nfunction resolveSessionFilePath(runtime: SupabaseRestRuntime): string | null {\n  if (runtime.disableSessionCache) {\n    return null;\n  }\n\n  if (runtime.sessionFile) {\n    return path.resolve(runtime.sessionFile);\n  }\n\n  return resolveDefaultSessionFilePath({\n    platform: process.platform,\n    homeDir: trimToken(os.homedir()),\n    xdgStateHome: trimToken(process.env.XDG_STATE_HOME) || null,\n    localAppData: trimToken(process.env.LOCALAPPDATA) || null,\n  });\n}\n\nfunction buildRuntimeIdentity(runtime: SupabaseRestRuntime): RuntimeIdentity {\n  const projectBaseUrl = deriveSupabaseProjectBaseUrl(runtime.apiBaseUrl);\n  const publishableKeyFingerprint = fingerprintSecret(runtime.publishableKey);\n  const userApiKeyFingerprint = fingerprintUserApiKey(runtime.userApiKey);\n  const sessionFilePath = resolveSessionFilePath(runtime);\n\n  return {\n    projectBaseUrl,\n    publishableKeyFingerprint,\n    userApiKeyFingerprint,\n    sessionFilePath,\n    memoKey: [\n      projectBaseUrl,\n      publishableKeyFingerprint,\n      userApiKeyFingerprint,\n      sessionFilePath ?? 'memory-only',\n    ].join('|'),\n  };\n}\n\nfunction recordMatchesRuntime(\n  record: CachedSupabaseSessionRecord,\n  runtime: RuntimeIdentity,\n): boolean {\n  return (\n    record.supabase_url === runtime.projectBaseUrl &&\n    record.publishable_key_fingerprint === runtime.publishableKeyFingerprint &&\n    record.user_api_key_fingerprint === runtime.userApiKeyFingerprint\n  );\n}\n\nfunction isSessionFresh(record: CachedSupabaseSessionRecord, now: Date): boolean {\n  return (\n    typeof record.expires_at === 'number' &&\n    Number.isFinite(record.expires_at) &&\n    record.expires_at > nowSeconds(now) + SESSION_REFRESH_WINDOW_SECONDS\n  );\n}\n\nfunction buildCachedSessionRecord(options: {\n  runtime: RuntimeIdentity;\n  session: Session;\n  userEmail: string;\n  now: Date;\n}): CachedSupabaseSessionRecord {\n  const accessToken = trimToken(options.session.access_token);\n  const refreshToken = trimToken(options.session.refresh_token);\n  if (!accessToken || !refreshToken) {\n    throw new CliError('Supabase auth did not return a usable session.', {\n      code: 'SUPABASE_AUTH_SESSION_INVALID',\n      exitCode: 1,\n    });\n  }\n\n  return {\n    schema_version: 1,\n    supabase_url: options.runtime.projectBaseUrl,\n    publishable_key_fingerprint: options.runtime.publishableKeyFingerprint,\n    user_api_key_fingerprint: options.runtime.userApiKeyFingerprint,\n    user_email: options.userEmail,\n    access_token: accessToken,\n    refresh_token: refreshToken,\n    expires_at: computeExpiresAt(options.session, options.now),\n    updated_at_utc: options.now.toISOString(),\n  };\n}\n\nfunction toResolvedSession(\n  record: CachedSupabaseSessionRecord,\n  runtime: RuntimeIdentity,\n  source: ResolvedSupabaseUserSession['source'],\n): ResolvedSupabaseUserSession {\n  return {\n    accessToken: record.access_token,\n    refreshToken: record.refresh_token,\n    expiresAt: record.expires_at,\n    userEmail: record.user_email,\n    projectBaseUrl: runtime.projectBaseUrl,\n    sessionFile: runtime.sessionFilePath,\n    source,\n  };\n}\n\nfunction readCachedSessionRecord(sessionFilePath: string): CachedSupabaseSessionRecord | null {\n  try {\n    const text = readFileSync(sessionFilePath, 'utf8').trim();\n    if (!text) {\n      return null;\n    }\n\n    return parseCachedSessionRecord(JSON.parse(text));\n  } catch {\n    return null;\n  }\n}\n\nfunction writeCachedSessionRecord(\n  sessionFilePath: string,\n  record: CachedSupabaseSessionRecord,\n): void {\n  mkdirSync(path.dirname(sessionFilePath), {\n    recursive: true,\n    mode: 0o700,\n  });\n\n  const tempPath = `${sessionFilePath}.${process.pid}.${Date.now()}.tmp`;\n  try {\n    writeFileSync(tempPath, `${JSON.stringify(record, null, 2)}\\n`, {\n      encoding: 'utf8',\n      mode: 0o600,\n    });\n    renameSync(tempPath, sessionFilePath);\n    chmodSync(sessionFilePath, 0o600);\n  } catch (error) {\n    rmSync(tempPath, { force: true });\n    throw error;\n  }\n}\n\nfunction getMemoizedRecord(runtime: RuntimeIdentity): CachedSupabaseSessionRecord | null {\n  return SESSION_MEMORY_CACHE.get(runtime.memoKey) ?? null;\n}\n\nfunction memoizeRecord(runtime: RuntimeIdentity, record: CachedSupabaseSessionRecord): void {\n  SESSION_MEMORY_CACHE.set(runtime.memoKey, record);\n}\n\nfunction dropMemoizedRecord(runtime: RuntimeIdentity): void {\n  SESSION_MEMORY_CACHE.delete(runtime.memoKey);\n}\n\nasync function withSessionOperationLock<T>(memoKey: string, task: () => Promise<T>): Promise<T> {\n  const previous = SESSION_OPERATION_CHAINS.get(memoKey) ?? Promise.resolve();\n  let release!: () => void;\n  const gate = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const chain = previous.catch(() => undefined).then(() => gate);\n  SESSION_OPERATION_CHAINS.set(memoKey, chain);\n\n  await previous.catch(() => undefined);\n  try {\n    return await task();\n  } finally {\n    release();\n    if (SESSION_OPERATION_CHAINS.get(memoKey) === chain) {\n      SESSION_OPERATION_CHAINS.delete(memoKey);\n    }\n  }\n}\n\nfunction createSupabaseAuthClient(\n  runtime: RuntimeIdentity,\n  publishableKey: string,\n  fetchImpl: FetchLike,\n  timeoutMs: number,\n) {\n  return createClient(runtime.projectBaseUrl, publishableKey, {\n    auth: {\n      autoRefreshToken: false,\n      persistSession: false,\n      detectSessionInUrl: false,\n    },\n    global: {\n      fetch: createSupabaseFetch(fetchImpl, timeoutMs),\n    },\n  });\n}\n\nasync function signInWithUserApiKey(options: {\n  runtime: SupabaseRestRuntime;\n  runtimeIdentity: RuntimeIdentity;\n  fetchImpl: FetchLike;\n  timeoutMs: number;\n  now: Date;\n}): Promise<CachedSupabaseSessionRecord> {\n  const credentials = requireUserApiKeyCredentials(options.runtime.userApiKey);\n  const authClient = createSupabaseAuthClient(\n    options.runtimeIdentity,\n    options.runtime.publishableKey,\n    options.fetchImpl,\n    options.timeoutMs,\n  );\n  const { data, error } = await authClient.auth.signInWithPassword({\n    email: credentials.email,\n    password: credentials.password,\n  });\n\n  if (error || !data.session) {\n    throw new CliError('Failed to sign in with TIANGONG_LCA_API_KEY.', {\n      code: 'SUPABASE_AUTH_SIGN_IN_FAILED',\n      exitCode: 1,\n      details: error?.message ?? 'Supabase auth session missing from sign-in response.',\n    });\n  }\n\n  return buildCachedSessionRecord({\n    runtime: options.runtimeIdentity,\n    session: data.session,\n    userEmail: trimToken(data.user?.email) || credentials.email,\n    now: options.now,\n  });\n}\n\nasync function refreshWithRefreshToken(options: {\n  runtime: SupabaseRestRuntime;\n  runtimeIdentity: RuntimeIdentity;\n  refreshToken: string;\n  userEmail: string;\n  fetchImpl: FetchLike;\n  timeoutMs: number;\n  now: Date;\n}): Promise<CachedSupabaseSessionRecord | null> {\n  const normalizedRefreshToken = trimToken(options.refreshToken);\n  if (!normalizedRefreshToken) {\n    return null;\n  }\n\n  try {\n    const authClient = createSupabaseAuthClient(\n      options.runtimeIdentity,\n      options.runtime.publishableKey,\n      options.fetchImpl,\n      options.timeoutMs,\n    );\n    const { data, error } = await authClient.auth.refreshSession({\n      refresh_token: normalizedRefreshToken,\n    });\n\n    if (error || !data.session) {\n      return null;\n    }\n\n    return buildCachedSessionRecord({\n      runtime: options.runtimeIdentity,\n      session: data.session,\n      userEmail: trimToken(data.user?.email) || options.userEmail,\n      now: options.now,\n    });\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAndPersistSession(options: {\n  runtime: SupabaseRestRuntime;\n  runtimeIdentity: RuntimeIdentity;\n  fetchImpl: FetchLike;\n  timeoutMs: number;\n  now: Date;\n  forceRefresh: boolean;\n}): Promise<ResolvedSupabaseUserSession> {\n  const { runtime, runtimeIdentity } = options;\n  const memoized = getMemoizedRecord(runtimeIdentity);\n  if (\n    !options.forceRefresh &&\n    !runtime.forceReauth &&\n    memoized &&\n    recordMatchesRuntime(memoized, runtimeIdentity) &&\n    isSessionFresh(memoized, options.now)\n  ) {\n    return toResolvedSession(memoized, runtimeIdentity, 'memory');\n  }\n\n  const cachedFromDisk =\n    runtimeIdentity.sessionFilePath !== null\n      ? readCachedSessionRecord(runtimeIdentity.sessionFilePath)\n      : null;\n  if (\n    !options.forceRefresh &&\n    !runtime.forceReauth &&\n    cachedFromDisk &&\n    recordMatchesRuntime(cachedFromDisk, runtimeIdentity) &&\n    isSessionFresh(cachedFromDisk, options.now)\n  ) {\n    memoizeRecord(runtimeIdentity, cachedFromDisk);\n    return toResolvedSession(cachedFromDisk, runtimeIdentity, 'cache');\n  }\n\n  if (!runtime.forceReauth) {\n    const refreshCandidate =\n      cachedFromDisk &&\n      recordMatchesRuntime(cachedFromDisk, runtimeIdentity) &&\n      trimToken(cachedFromDisk.refresh_token)\n        ? cachedFromDisk\n        : memoized &&\n            recordMatchesRuntime(memoized, runtimeIdentity) &&\n            trimToken(memoized.refresh_token)\n          ? memoized\n          : null;\n\n    if (refreshCandidate) {\n      const refreshed = await refreshWithRefreshToken({\n        runtime,\n        runtimeIdentity,\n        refreshToken: refreshCandidate.refresh_token,\n        userEmail: refreshCandidate.user_email,\n        fetchImpl: options.fetchImpl,\n        timeoutMs: options.timeoutMs,\n        now: options.now,\n      });\n\n      if (refreshed) {\n        if (runtimeIdentity.sessionFilePath) {\n          writeCachedSessionRecord(runtimeIdentity.sessionFilePath, refreshed);\n        }\n        memoizeRecord(runtimeIdentity, refreshed);\n        return toResolvedSession(refreshed, runtimeIdentity, 'refresh');\n      }\n    }\n  }\n\n  const signedIn = await signInWithUserApiKey({\n    runtime,\n    runtimeIdentity,\n    fetchImpl: options.fetchImpl,\n    timeoutMs: options.timeoutMs,\n    now: options.now,\n  });\n\n  if (runtimeIdentity.sessionFilePath) {\n    writeCachedSessionRecord(runtimeIdentity.sessionFilePath, signedIn);\n  }\n  memoizeRecord(runtimeIdentity, signedIn);\n  return toResolvedSession(signedIn, runtimeIdentity, 'signin');\n}\n\nexport async function resolveSupabaseUserSession(options: {\n  runtime: SupabaseRestRuntime;\n  fetchImpl: FetchLike;\n  timeoutMs?: number;\n  now?: Date;\n  forceRefresh?: boolean;\n}): Promise<ResolvedSupabaseUserSession> {\n  const runtimeIdentity = buildRuntimeIdentity(options.runtime);\n  const now = options.now ?? new Date();\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const forceRefresh = Boolean(options.forceRefresh);\n\n  if (!forceRefresh && !options.runtime.forceReauth) {\n    const memoized = getMemoizedRecord(runtimeIdentity);\n    if (\n      memoized &&\n      recordMatchesRuntime(memoized, runtimeIdentity) &&\n      isSessionFresh(memoized, now)\n    ) {\n      return toResolvedSession(memoized, runtimeIdentity, 'memory');\n    }\n\n    if (runtimeIdentity.sessionFilePath) {\n      const cached = readCachedSessionRecord(runtimeIdentity.sessionFilePath);\n      if (cached && recordMatchesRuntime(cached, runtimeIdentity) && isSessionFresh(cached, now)) {\n        memoizeRecord(runtimeIdentity, cached);\n        return toResolvedSession(cached, runtimeIdentity, 'cache');\n      }\n    }\n  }\n\n  return withSessionOperationLock(runtimeIdentity.memoKey, async () => {\n    if (runtimeIdentity.sessionFilePath) {\n      return withStateFileLock(\n        runtimeIdentity.sessionFilePath,\n        {\n          reason: forceRefresh ? 'refresh_supabase_user_session' : 'resolve_supabase_user_session',\n        },\n        () =>\n          resolveAndPersistSession({\n            runtime: options.runtime,\n            runtimeIdentity,\n            fetchImpl: options.fetchImpl,\n            timeoutMs,\n            now,\n            forceRefresh,\n          }),\n      );\n    }\n\n    return resolveAndPersistSession({\n      runtime: options.runtime,\n      runtimeIdentity,\n      fetchImpl: options.fetchImpl,\n      timeoutMs,\n      now,\n      forceRefresh,\n    });\n  });\n}\n\nexport function createSupabaseDataRuntime(options: {\n  runtime: SupabaseRestRuntime;\n  fetchImpl: FetchLike;\n  timeoutMs?: number;\n  now?: Date;\n}): SupabaseDataRuntime {\n  return {\n    apiBaseUrl: options.runtime.apiBaseUrl,\n    publishableKey: options.runtime.publishableKey,\n    getAccessToken: async () =>\n      (\n        await resolveSupabaseUserSession({\n          runtime: options.runtime,\n          fetchImpl: options.fetchImpl,\n          timeoutMs: options.timeoutMs,\n          now: options.now,\n        })\n      ).accessToken,\n    refreshAccessToken: async () =>\n      (\n        await resolveSupabaseUserSession({\n          runtime: options.runtime,\n          fetchImpl: options.fetchImpl,\n          timeoutMs: options.timeoutMs,\n          now: options.now,\n          forceRefresh: true,\n        })\n      ).accessToken,\n  };\n}\n\nexport const __testInternals = {\n  SESSION_MEMORY_CACHE,\n  SESSION_OPERATION_CHAINS,\n  buildCachedSessionRecord,\n  buildRuntimeIdentity,\n  computeExpiresAt,\n  createSupabaseAuthClient,\n  dropMemoizedRecord,\n  getMemoizedRecord,\n  isSessionFresh,\n  memoizeRecord,\n  parseCachedSessionRecord,\n  readCachedSessionRecord,\n  recordMatchesRuntime,\n  refreshWithRefreshToken,\n  resolveDefaultSessionFilePath,\n  resolveAndPersistSession,\n  resolveSessionFilePath,\n  signInWithUserApiKey,\n  withSessionOperationLock,\n  writeCachedSessionRecord,\n};\n"]}