@weftlabs/cli 0.26.10 → 0.31.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,9 +1,11 @@
 # Weft CLI
 
 Use Weft from a shell or an autonomous agent. Application code should use the
-separate [`@weftlabs/sdk`](../typescript/README.md) package. The human-oriented
+separate [`@weftlabs/sdk`](https://github.com/weftlabs/weft-sdk/blob/main/typescript/README.md) package. The human-oriented
 CLI guide is at [weftlabs.com/x402/cli](https://weftlabs.com/x402/cli).
 
+The CLI moved from `weft-sdk` on 2026-10-04. The package name is still `@weftlabs/cli`.
+
 The CLI prints one versioned JSON object per command. It accepts credentials
 through `--api-key-stdin`, `WEFT_API_KEY`, or its protected local credential
 store; it rejects API keys in command arguments so they do not leak into shell
@@ -11,6 +13,78 @@ history or process listings.
 `weft --help` and `weft <command> --help` return machine-readable JSON without
 requiring authentication.
 
+## Develop from source
+
+This path is for contributors in a cloned checkout, not live buyer use.
+Install [Mise](https://mise.jdx.dev/getting-started.html) and Git first.
+[Activate Mise in your interactive shell](https://mise.jdx.dev/getting-started.html#activate-mise)
+once. Run the blocks below separately from the repository root; after tool
+installation, wait for the next shell prompt before installing dependencies. [`.mise.toml`](.mise.toml) owns the
+Node, pnpm, and lefthook versions; [`package.json`](package.json) and
+[`pnpm-lock.yaml`](pnpm-lock.yaml) own dependencies. The CLI uses the published
+`@weftlabs/sdk`, not a local SDK checkout.
+
+Review the Mise configuration before you trust it, then install tools and
+locked dependencies. Dependency installation needs registry access, but no
+Weft credential or account. Install the normal Git hooks defined in
+[`lefthook.yml`](lefthook.yml); do not bypass them.
+
+```sh
+mise trust
+mise install
+```
+
+Then install dependencies and hooks:
+
+```sh
+pnpm install --frozen-lockfile
+lefthook install
+```
+
+Build the source and check local help without authentication:
+
+```sh
+pnpm run build
+WEFT_SKIP_SKILL_INSTALL=1 node bin/weft.mjs --help
+```
+
+Expect one JSON object with `ok: true` and `command: "help"`. This help path
+returns before credential loading, API requests, account or wallet actions,
+and Skill installation. Keep `WEFT_SKIP_SKILL_INSTALL=1` for local CLI checks
+to opt out of automatic Skill installation on ordinary commands. No `.env`,
+buyer API key, bootstrap, global CLI install, or agent host is needed here.
+Help verifies local command loading, not live API or payment behavior.
+
+The local quality commands are owned by `package.json`:
+
+```sh
+pnpm run lint:check
+pnpm run format:check
+pnpm run typecheck
+pnpm run test:unit
+```
+
+Unit tests use mocked API responses and temporary local state. Some test
+fixtures copy the vendored Skill into `dist/` and install it into temporary
+host directories; they do not install an agent runtime or a Skill in your
+normal home. The format check covers source, tests, and scripts, not Markdown.
+
+The optional package-distribution check is separate from the first-run smoke:
+
+```sh
+WEFT_SKIP_SKILL_INSTALL=1 pnpm run test:packed
+```
+
+Run it after the build. It packs the CLI, runs `prepack` to copy the vendored
+Skill into `dist/`, installs the archive in a temporary consumer project,
+and checks the SDK against the public npm registry. It needs network access;
+it does not prove buyer API access. Do not change the vendored `skills/weft/`
+files here.
+
+These are one-shot commands. No persistent server starts, so no stop command
+is needed. The buyer and bootstrap examples below are optional live workflows,
+not source-development verification.
+
 ## With a buyer API key
 
 ```sh
@@ -216,5 +290,21 @@ new bootstrap flows do not create OAuth credentials.
 
 See [`examples/agent-bootstrap.sh`](examples/agent-bootstrap.sh) for the same
 sequence as a script, and
-[`docs/operation-inventory.md`](../docs/operation-inventory.md) for commands,
+[`docs/contract.md`](docs/contract.md) for commands,
 output envelopes, and stable exit codes.
+
+## SDK follow and release
+
+`.github/workflows/sdk-follow.yml` checks npm every hour. When a newer
+`@weftlabs/sdk` is older than `minimumReleaseAge`, it opens or updates
+`bot/cli-follow-sdk-<version>`. It does not push to `main` and it does not
+merge. A breaking SDK line (a major change, or a minor change while the SDK
+is `0.x`) is titled and labeled `breaking SDK line`.
+
+After that pull request is merged, push a `v*` tag on `main`. That tag runs
+the release. If the tag exists and npm does not have the version, the same
+workflow dispatches the release again.
+
+GitHub disables a scheduled workflow in a public repository after 60 days
+with no activity. Re-enable `Follow SDK releases` in the Actions tab if the
+schedule stops.

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/credentials.ts","../src/cli.ts","../src/results.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  chmod,\n  mkdir,\n  open,\n  readFile,\n  rename,\n  rm,\n  writeFile,\n} from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\n\nconst CREDENTIALS_FILE_MODE = 0o600;\nconst CREDENTIALS_DIR_MODE = 0o700;\nconst LOCK_RETRY_MS = 50;\nconst LOCK_TIMEOUT_MS = 10_000;\n\nexport interface BootstrapCredentials {\n  base_url: string;\n  id: string;\n  status: string;\n  capabilities: string[];\n  expires_at: string | null;\n  approval: {\n    method: string;\n    expires_in: number;\n    interval: number;\n    user_code?: string;\n  };\n  temporary_api_key: string;\n}\n\nexport interface LegacyBootstrapCredentials {\n  version: 1;\n  type: \"bootstrap\";\n  base_url: string;\n  bootstrap_id: string;\n  temporary_api_key: string;\n  device_code: string;\n  client_id: string;\n  expiry: string;\n  polling_interval: number;\n}\n\nexport interface OAuthCredentials {\n  version: 1;\n  type: \"oauth\";\n  base_url: string;\n  client_id: string;\n  access_token: string;\n  refresh_token: string;\n  token_type: string;\n  scope: string;\n  expiry: string;\n}\n\nexport type StoredCredentials =\n  BootstrapCredentials | LegacyBootstrapCredentials | OAuthCredentials;\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction isBootstrapCredentials(\n  value: Record<string, unknown>,\n): BootstrapCredentials | undefined {\n  if (\n    typeof value.base_url === \"string\" &&\n    typeof value.id === \"string\" &&\n    typeof value.status === \"string\" &&\n    Array.isArray(value.capabilities) &&\n    value.capabilities.every((capability) => typeof capability === \"string\") &&\n    (typeof value.expires_at === \"string\" || value.expires_at === null) &&\n    isObject(value.approval) &&\n    typeof value.approval.method === \"string\" &&\n    typeof value.approval.expires_in === \"number\" &&\n    typeof value.approval.interval === \"number\" &&\n    (value.approval.user_code === undefined ||\n      typeof value.approval.user_code === \"string\") &&\n    typeof value.temporary_api_key === \"string\"\n  ) {\n    return value as BootstrapCredentials;\n  }\n\n  return undefined;\n}\n\nfunction isLegacyBootstrapCredentials(\n  value: Record<string, unknown>,\n): LegacyBootstrapCredentials | undefined {\n  if (\n    value.version === 1 &&\n    value.type === \"bootstrap\" &&\n    typeof value.base_url === \"string\" &&\n    typeof value.bootstrap_id === \"string\" &&\n    typeof value.temporary_api_key === \"string\" &&\n    typeof value.device_code === \"string\" &&\n    typeof value.client_id === \"string\" &&\n    typeof value.expiry === \"string\" &&\n    typeof value.polling_interval === \"number\"\n  ) {\n    return value as LegacyBootstrapCredentials;\n  }\n\n  return undefined;\n}\n\nfunction isOAuthCredentials(\n  value: Record<string, unknown>,\n): OAuthCredentials | undefined {\n  if (\n    value.type === \"oauth\" &&\n    typeof value.version === \"number\" &&\n    typeof value.base_url === \"string\" &&\n    typeof value.client_id === \"string\" &&\n    typeof value.access_token === \"string\" &&\n    typeof value.refresh_token === \"string\" &&\n    typeof value.token_type === \"string\" &&\n    typeof value.scope === \"string\" &&\n    typeof value.expiry === \"string\"\n  ) {\n    return value as OAuthCredentials;\n  }\n\n  return undefined;\n}\n\nexport function resolveCredentialsPath(\n  env: Record<string, string | undefined>,\n): string | undefined {\n  if (env.WEFT_CREDENTIALS_FILE) return env.WEFT_CREDENTIALS_FILE;\n  if (env.XDG_CONFIG_HOME)\n    return `${env.XDG_CONFIG_HOME}/weft/credentials.json`;\n  const home = env.HOME || env.USERPROFILE;\n  if (!home) return undefined;\n  return `${home}/.config/weft/credentials.json`;\n}\n\nexport async function readStoredCredentials(\n  env: Record<string, string | undefined>,\n): Promise<StoredCredentials | undefined> {\n  const path = resolveCredentialsPath(env);\n  if (!path) return undefined;\n  try {\n    const raw = await readFile(path, \"utf8\");\n    const parsed: unknown = JSON.parse(raw);\n    if (!isObject(parsed)) throw new Error(\"Stored credentials malformed\");\n    return (\n      isBootstrapCredentials(parsed) ??\n      isLegacyBootstrapCredentials(parsed) ??\n      isOAuthCredentials(parsed)\n    );\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw error;\n  }\n}\n\nexport async function writeStoredCredentials(\n  env: Record<string, string | undefined>,\n  credentials: StoredCredentials,\n): Promise<void> {\n  await withCredentialsLock(env, () =>\n    writeStoredCredentialsWhileLocked(env, credentials),\n  );\n}\n\nexport async function writeStoredCredentialsWhileLocked(\n  env: Record<string, string | undefined>,\n  credentials: StoredCredentials,\n): Promise<void> {\n  const path = resolveCredentialsPath(env);\n  if (!path) {\n    throw new Error(\"HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required\");\n  }\n  const parent = dirname(path);\n  await mkdir(parent, { recursive: true, mode: CREDENTIALS_DIR_MODE });\n  await chmod(parent, CREDENTIALS_DIR_MODE);\n\n  const tempPath = `${path}.${randomUUID()}.tmp`;\n  try {\n    await writeFile(tempPath, JSON.stringify(credentials), {\n      mode: CREDENTIALS_FILE_MODE,\n    });\n    await rename(tempPath, path);\n    await chmod(path, CREDENTIALS_FILE_MODE);\n  } catch (error) {\n    await rm(tempPath, { force: true });\n    throw error;\n  }\n}\n\nexport async function withCredentialsLock<T>(\n  env: Record<string, string | undefined>,\n  action: () => Promise<T>,\n): Promise<T> {\n  const path = resolveCredentialsPath(env);\n  if (!path) {\n    throw new Error(\"HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required\");\n  }\n  const lockPath = `${path}.lock`;\n  const deadline = Date.now() + LOCK_TIMEOUT_MS;\n  await mkdir(dirname(path), { recursive: true, mode: CREDENTIALS_DIR_MODE });\n\n  for (;;) {\n    try {\n      const lock = await open(lockPath, \"wx\", CREDENTIALS_FILE_MODE);\n      await lock.close();\n      break;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `Timed out waiting for the credential lock; if no Weft CLI process is running, remove ${lockPath}`,\n        );\n      }\n      await delay(LOCK_RETRY_MS);\n    }\n  }\n\n  try {\n    return await action();\n  } finally {\n    await rm(lockPath, { force: true });\n  }\n}\n","import {\n  readStoredCredentials,\n  type BootstrapCredentials,\n  type LegacyBootstrapCredentials,\n  type OAuthCredentials,\n  type StoredCredentials,\n  withCredentialsLock,\n  writeStoredCredentials,\n  writeStoredCredentialsWhileLocked,\n} from \"./credentials\";\nimport { spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport {\n  readableBody,\n  reserveResultDirectory,\n  writeResultFile,\n} from \"./results\";\nimport {\n  type PaidFetchRequest,\n  ResponseError,\n  WeftClient,\n  WeftError,\n} from \"@weftlabs/sdk\";\n\nexport const EXIT_SUCCESS = 0;\nexport const EXIT_USAGE = 2;\nexport const EXIT_AUTH = 3;\nexport const EXIT_API = 4;\nexport const EXIT_INTERNAL = 5;\n\ntype Command =\n  | \"bootstrap\"\n  | \"auth\"\n  | \"skill\"\n  | \"me\"\n  | \"balance\"\n  | \"search\"\n  | \"fetch\"\n  | \"purchases\";\n\nconst COMMANDS: Command[] = [\n  \"bootstrap\",\n  \"auth\",\n  \"skill\",\n  \"me\",\n  \"balance\",\n  \"search\",\n  \"fetch\",\n  \"purchases\",\n];\n\nconst WEFT_API_BASE = \"https://weft.network\";\nconst OAUTH_HOST_NAME = \"Weft CLI\";\nconst OAUTH_REFRESH_SKEW_MS = 60_000;\nconst PROCESS_OUTPUT_LIMIT = 8_192;\nconst SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst CORE_SKILL_NAMES = new Set([\"weft\", \"weft-setup\"]);\n\nconst COMMAND_HELP = {\n  bootstrap: {\n    description: \"Bootstrap an agent account\",\n    usage: \"weft bootstrap --email <email> --agent-name <name> --reason <text>\",\n    options: [\n      \"--email <email>\",\n      \"--agent-name <name>\",\n      \"--reason <text>\",\n      \"[--base-url <url>]\",\n    ],\n  },\n  auth: {\n    description: \"Check bootstrap status\",\n    usage: \"weft auth status\",\n    options: [\"status\"],\n  },\n  skill: {\n    description: \"Install the core Weft Skill or one optional workflow Skill\",\n    usage: \"weft skill install [name --agent <agent> [--global]]\",\n    options: [\"install\", \"[name]\", \"--agent <agent>\", \"--global\"],\n  },\n  me: {\n    description: \"Return the authenticated principal\",\n    usage: \"weft me\",\n    options: [],\n  },\n  balance: {\n    description: \"Return wallet balance and spending policy\",\n    usage: \"weft balance\",\n    options: [],\n  },\n  search: {\n    description: \"Search for payable resources\",\n    usage: \"weft search <query> [--max-results <1..50>]\",\n    options: [\"--max-results <1..50>\"],\n  },\n  fetch: {\n    description: \"Fetch a URL within an explicit spending limit\",\n    usage:\n      \"weft fetch <url> --max-cost-usd <amount> [--method <method>] [--body <json>] [--header <name:value>]... [--idempotency-key <key>] [--raw]\",\n    options: [\n      \"--max-cost-usd <amount>\",\n      \"--method <method>\",\n      \"--body <json>\",\n      \"--header <name:value> (repeatable)\",\n      \"--idempotency-key <key>\",\n      \"--raw\",\n    ],\n  },\n  purchases: {\n    description: \"List purchases or return one purchase by ID\",\n    usage: \"weft purchases [id] [--page <number>] [--per-page <1..100>]\",\n    options: [\"--page <number>\", \"--per-page <1..100>\"],\n  },\n} satisfies Record<\n  Command,\n  { description: string; usage: string; options: string[] }\n>;\n\ninterface SkillInstallResult {\n  status: \"ok\" | \"skipped\";\n  reason?: string;\n  installed: number;\n  hosts: string[];\n  warnings: string[];\n}\n\ntype SkillInstaller = (options?: {\n  force?: boolean;\n  silent?: boolean;\n}) => Promise<SkillInstallResult>;\n\n/**\n * The Skill installer ships as a plain script beside `dist/`, and reads the\n * packed Skill relative to its own location. The specifier is built at runtime\n * so the bundler leaves it external and that relative path stays correct in the\n * published package.\n */\nasync function loadSkillInstaller(): Promise<SkillInstaller> {\n  const specifier = new URL(\"../scripts/install-skill.mjs\", import.meta.url)\n    .href;\n  const module = (await import(specifier)) as { installSkill: SkillInstaller };\n  return module.installSkill;\n}\n\n/**\n * Best-effort Skill installation on any ordinary command. This is the safety\n * net for a user who never runs `weft skill install`, and it is what lets the\n * Skill appear in an agent host that was installed after the CLI. It is\n * idempotent, it stays silent, and it never fails the command the user asked\n * for.\n */\nasync function installSkillInBackground(): Promise<void> {\n  try {\n    const installSkill = await loadSkillInstaller();\n    await installSkill({ silent: true });\n  } catch {\n    // Deliberately ignored — `weft skill install` is the surface that reports\n    // installation problems.\n  }\n}\n\ninterface BootstrapCreateResponse {\n  data: Omit<BootstrapCredentials, \"base_url\">;\n}\n\ninterface BootstrapStatus {\n  data: {\n    id?: string;\n    status: string;\n    expires_at?: string | null;\n    capabilities?: string[];\n    approval?: BootstrapCredentials[\"approval\"];\n  };\n}\n\ninterface OAuthTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  scope: string;\n}\n\nconst GLOBAL_OPTIONS = [\"--api-key-stdin\", \"--base-url <url>\", \"--help\", \"-h\"];\n\nexport interface CliDependencies {\n  env?: Record<string, string | undefined>;\n  fetchApi?: typeof fetch;\n  readStdin?: () => Promise<string>;\n  writeOut?: (value: string) => void | Promise<void>;\n  writeErr?: (value: string) => void;\n  generateIdempotencyKey?: () => string;\n  runProcess?: ProcessRunner;\n  platform?: NodeJS.Platform;\n  nodeExecutable?: string;\n  npxCliPath?: string;\n}\n\ninterface ProcessResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\ntype ProcessRunner = (\n  command: string,\n  args: string[],\n) => Promise<ProcessResult>;\n\ninterface ParsedArgs {\n  command: Command;\n  apiKeyStdin: boolean;\n  baseUrl?: string;\n  positionals: string[];\n  options: Map<string, string | true | string[]>;\n}\n\nclass CliError extends Error {\n  constructor(\n    readonly exitCode: number,\n    readonly code: string,\n    message: string,\n    readonly details?: unknown,\n  ) {\n    super(message);\n  }\n}\n\nfunction takeValue(\n  args: string[],\n  index: number,\n  option: string,\n): [string, number] {\n  const value = args[index + 1];\n  if (value == null || value.startsWith(\"--\")) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} requires a value`,\n    );\n  }\n  return [value, index + 1];\n}\n\nfunction appendBounded(current: string, chunk: Buffer | string): string {\n  return `${current}${chunk.toString()}`.slice(-PROCESS_OUTPUT_LIMIT);\n}\n\nfunction defaultRunProcess(\n  command: string,\n  args: string[],\n): Promise<ProcessResult> {\n  return new Promise((resolve) => {\n    const child = spawn(command, args, {\n      shell: false,\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      stdout = appendBounded(stdout, chunk);\n    });\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      stderr = appendBounded(stderr, chunk);\n    });\n    child.on(\"error\", (error) => {\n      resolve({\n        exitCode: 1,\n        stdout,\n        stderr: appendBounded(stderr, error.message),\n      });\n    });\n    child.on(\"close\", (exitCode) => {\n      resolve({ exitCode: exitCode ?? 1, stdout, stderr });\n    });\n  });\n}\n\nfunction resolveNpxCliPath(\n  env: Record<string, string | undefined>,\n  nodeExecutable: string,\n): string | undefined {\n  const executableDirectory = dirname(nodeExecutable);\n  const candidates = [\n    ...(env.npm_execpath\n      ? [join(dirname(env.npm_execpath), \"npx-cli.js\")]\n      : []),\n    join(executableDirectory, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\"),\n    join(\n      executableDirectory,\n      \"..\",\n      \"lib\",\n      \"node_modules\",\n      \"npm\",\n      \"bin\",\n      \"npx-cli.js\",\n    ),\n  ];\n  return candidates.find((candidate) => existsSync(candidate));\n}\n\nfunction npxProcessInvocation(\n  processArgs: string[],\n  dependencies: CliDependencies,\n  env: Record<string, string | undefined>,\n): { executable: string; arguments: string[] } {\n  if ((dependencies.platform ?? process.platform) !== \"win32\") {\n    return { executable: \"npx\", arguments: processArgs };\n  }\n\n  const nodeExecutable = dependencies.nodeExecutable ?? process.execPath;\n  const npxCliPath =\n    dependencies.npxCliPath ?? resolveNpxCliPath(env, nodeExecutable);\n  if (!npxCliPath) {\n    throw new CliError(\n      EXIT_INTERNAL,\n      \"NPX_NOT_FOUND\",\n      \"Could not find the npm npx program. Install npm, then run the command again.\",\n    );\n  }\n  return {\n    executable: nodeExecutable,\n    arguments: [npxCliPath, ...processArgs],\n  };\n}\n\nfunction rejectUnsafeCredentialArgument(args: string[]): void {\n  if (args.some((arg) => arg === \"--api-key\" || arg.startsWith(\"--api-key=\"))) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"UNSAFE_CREDENTIAL_ARGUMENT\",\n      \"API keys are accepted only through WEFT_API_KEY or --api-key-stdin\",\n    );\n  }\n}\n\nfunction requestedHelp(args: string[]): Command | \"all\" | undefined {\n  const isHelp = (value: string) => value === \"--help\" || value === \"-h\";\n  if (args.length === 1 && isHelp(args[0])) return \"all\";\n  if (\n    args.length === 2 &&\n    COMMANDS.includes(args[0] as Command) &&\n    isHelp(args[1])\n  ) {\n    return args[0] as Command;\n  }\n  return undefined;\n}\n\nfunction helpData(command: Command | \"all\") {\n  if (command !== \"all\") {\n    return {\n      command,\n      ...COMMAND_HELP[command],\n      global_options: GLOBAL_OPTIONS,\n    };\n  }\n  return {\n    usage: \"weft <command> [options]\",\n    commands: COMMANDS.map((name) => ({ name, ...COMMAND_HELP[name] })),\n    global_options: GLOBAL_OPTIONS,\n    authentication: [\"WEFT_API_KEY\", \"--api-key-stdin\"],\n    exit_codes: { success: 0, usage: 2, auth: 3, api: 4, internal: 5 },\n  };\n}\n\nfunction parseArgs(args: string[]): ParsedArgs {\n  let command: Command | undefined;\n  let apiKeyStdin = false;\n  let baseUrl: string | undefined;\n  const positionals: string[] = [];\n  const options = new Map<string, string | true | string[]>();\n\n  for (let index = 0; index < args.length; index += 1) {\n    const arg = args[index];\n    if (arg === \"--api-key-stdin\") {\n      apiKeyStdin = true;\n    } else if (arg === \"--base-url\") {\n      [baseUrl, index] = takeValue(args, index, arg);\n    } else if (arg === \"--global\" || arg === \"--raw\") {\n      options.set(arg.slice(2), true);\n    } else if (arg.startsWith(\"--\")) {\n      const [value, nextIndex] = takeValue(args, index, arg);\n      const name = arg.slice(2);\n      if (name === \"header\") {\n        const previous = options.get(name);\n        if (typeof previous === \"string\") {\n          options.set(name, [previous, value]);\n        } else if (Array.isArray(previous)) {\n          previous.push(value);\n        } else {\n          options.set(name, value);\n        }\n      } else {\n        options.set(name, value);\n      }\n      index = nextIndex;\n    } else if (!command) {\n      if (!COMMANDS.includes(arg as Command)) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"UNKNOWN_COMMAND\",\n          `Unknown command: ${arg}`,\n        );\n      }\n      command = arg as Command;\n    } else {\n      positionals.push(arg);\n    }\n  }\n\n  if (!command) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"COMMAND_REQUIRED\",\n      \"Command required: bootstrap, auth, me, balance, search, fetch, or purchases\",\n    );\n  }\n\n  return { command, apiKeyStdin, baseUrl, positionals, options };\n}\n\nfunction positiveInteger(\n  value: string | true | string[] | undefined,\n  option: string,\n  maximum?: number,\n): number | undefined {\n  if (value == null) return undefined;\n  if (typeof value !== \"string\") {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be a positive integer`,\n    );\n  }\n  const parsed = Number(value);\n  if (!Number.isInteger(parsed) || parsed <= 0) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be a positive integer`,\n    );\n  }\n  if (maximum != null && parsed > maximum) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be at most ${maximum}`,\n    );\n  }\n  return parsed;\n}\n\nfunction requiredOption(\n  options: Map<string, string | true | string[]>,\n  name: string,\n): string {\n  const value = options.get(name);\n  if (typeof value !== \"string\" || !value.trim()) {\n    throw new CliError(EXIT_USAGE, \"MISSING_ARGUMENT\", `--${name} is required`);\n  }\n  return value;\n}\n\nfunction fetchHeaders(\n  raw: string | true | string[] | undefined,\n  hasJsonBody: boolean,\n): PaidFetchRequest[\"headers\"] {\n  const values =\n    typeof raw === \"string\" ? [raw] : Array.isArray(raw) ? raw : [];\n  const headers: Record<string, string> = {};\n  for (const rawHeader of values) {\n    const colon = rawHeader.indexOf(\":\");\n    if (colon <= 0) {\n      throw new CliError(\n        EXIT_USAGE,\n        \"INVALID_ARGUMENT\",\n        \"--header must be Name:Value\",\n      );\n    }\n    headers[rawHeader.slice(0, colon).trim()] = rawHeader\n      .slice(colon + 1)\n      .trim();\n  }\n  if (\n    hasJsonBody &&\n    !Object.keys(headers).some((name) => name.toLowerCase() === \"content-type\")\n  ) {\n    headers[\"content-type\"] = \"application/json\";\n  }\n  return Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nfunction baseApiUrl(\n  baseUrl: string | undefined,\n  env: Record<string, string | undefined>,\n): string {\n  const raw = baseUrl ?? env.WEFT_BASE_URL ?? WEFT_API_BASE;\n  return raw.endsWith(\"/\") ? raw.slice(0, -1) : raw;\n}\n\nfunction resolveApiKeyFromStored(\n  credentials?: StoredCredentials,\n): string | undefined {\n  if (!credentials) return undefined;\n  if (\n    \"access_token\" in credentials &&\n    typeof credentials.access_token === \"string\" &&\n    credentials.access_token.trim()\n  ) {\n    return credentials.access_token;\n  }\n  if (\n    \"temporary_api_key\" in credentials &&\n    typeof credentials.temporary_api_key === \"string\" &&\n    credentials.temporary_api_key.trim()\n  ) {\n    return credentials.temporary_api_key;\n  }\n  return undefined;\n}\n\nfunction isOAuthCredentials(\n  credentials: StoredCredentials | undefined,\n): credentials is OAuthCredentials {\n  return Boolean(\n    credentials && \"type\" in credentials && credentials.type === \"oauth\",\n  );\n}\n\nfunction isLegacyBootstrapCredentials(\n  credentials: StoredCredentials | undefined,\n): credentials is LegacyBootstrapCredentials {\n  return Boolean(\n    credentials && \"type\" in credentials && credentials.type === \"bootstrap\",\n  );\n}\n\nfunction oauthNeedsRefresh(credentials: OAuthCredentials): boolean {\n  const expiry = Date.parse(credentials.expiry);\n  return (\n    !Number.isFinite(expiry) || expiry <= Date.now() + OAUTH_REFRESH_SKEW_MS\n  );\n}\n\nasync function refreshOAuthCredentials(\n  fetchApi: typeof fetch,\n  env: Record<string, string | undefined>,\n  stored: OAuthCredentials,\n): Promise<OAuthCredentials> {\n  const token = await requestJson<OAuthTokenResponse>(\n    fetchApi,\n    `${stored.base_url}/oauth/token`,\n    {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: stored.refresh_token,\n        client_id: stored.client_id,\n      }).toString(),\n    },\n    true,\n  );\n  const refreshed: OAuthCredentials = {\n    ...stored,\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    token_type: token.token_type,\n    scope: token.scope,\n    expiry: new Date(Date.now() + token.expires_in * 1000).toISOString(),\n  };\n  await writeStoredCredentialsWhileLocked(env, refreshed);\n  return refreshed;\n}\n\nfunction noSecretFields(data: object): Record<string, unknown> {\n  return {\n    ...data,\n    temporary_api_key: undefined,\n    access_token: undefined,\n    refresh_token: undefined,\n    client_secret: undefined,\n  };\n}\n\nasync function requestJson<T>(\n  fetchApi: typeof fetch,\n  url: string,\n  init: RequestInit,\n  redactError = false,\n): Promise<T> {\n  const response = await fetchApi(url, init);\n  if (!response.ok) {\n    if (redactError) {\n      throw new CliError(\n        response.status === 401 || response.status === 403\n          ? EXIT_AUTH\n          : response.status >= 500\n            ? EXIT_INTERNAL\n            : EXIT_API,\n        \"OAUTH_TOKEN_ERROR\",\n        `OAuth token request failed with HTTP ${response.status}`,\n      );\n    }\n    throw new ResponseError(response);\n  }\n\n  return (await response.json()) as T;\n}\n\nfunction withCredentials(\n  headers: Record<string, string>,\n  apiKey: string,\n): Record<string, string> {\n  return {\n    ...headers,\n    authorization: `Bearer ${apiKey}`,\n  };\n}\n\nfunction ensureOnly(\n  options: Map<string, string | true | string[]>,\n  allowed: string[],\n): void {\n  for (const name of options.keys()) {\n    if (!allowed.includes(name)) {\n      throw new CliError(\n        EXIT_USAGE,\n        \"UNKNOWN_OPTION\",\n        `Unknown option: --${name}`,\n      );\n    }\n  }\n}\n\nasync function responseDetails(error: ResponseError): Promise<unknown> {\n  try {\n    return await error.response.json();\n  } catch {\n    return undefined;\n  }\n}\n\nasync function normalizeError(error: unknown): Promise<CliError> {\n  if (error instanceof CliError) return error;\n  if (error instanceof WeftError) {\n    // status 0 is a transport failure with no API response; it exits like an\n    // internal failure, not an API rejection.\n    const exitCode =\n      error.status === 401 || error.status === 403\n        ? EXIT_AUTH\n        : error.status >= 500 || error.status === 0\n          ? EXIT_INTERNAL\n          : EXIT_API;\n    return new CliError(exitCode, error.code, error.message, error.details);\n  }\n  if (error instanceof ResponseError) {\n    const details = await responseDetails(error);\n    const body = details as\n      | {\n          error?: { code?: string; message?: string } | string;\n          error_description?: string;\n        }\n      | undefined;\n    const nested = typeof body?.error === \"object\" ? body.error : undefined;\n    const code =\n      nested?.code ??\n      (typeof body?.error === \"string\"\n        ? body.error\n        : `HTTP_${error.response.status}`);\n    const message =\n      nested?.message ??\n      body?.error_description ??\n      `Weft API returned HTTP ${error.response.status}`;\n    const exitCode =\n      error.response.status === 401 || error.response.status === 403\n        ? EXIT_AUTH\n        : error.response.status >= 500\n          ? EXIT_INTERNAL\n          : EXIT_API;\n    return new CliError(exitCode, code, message, details);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new CliError(EXIT_INTERNAL, \"INTERNAL_ERROR\", message);\n}\n\nasync function defaultReadStdin(): Promise<string> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of process.stdin) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n  }\n  return Buffer.concat(chunks).toString(\"utf8\");\n}\n\nasync function defaultWriteOut(value: string): Promise<void> {\n  await new Promise<void>((resolve, reject) => {\n    // The write callback reports failure before the stream emits its error.\n    // Keep the one-shot listener until that event to prevent an uncaught EPIPE.\n    const onError = (error: Error) => reject(error);\n    process.stdout.once(\"error\", onError);\n    process.stdout.write(value, (error) => {\n      if (error) {\n        reject(error);\n      } else {\n        process.stdout.removeListener(\"error\", onError);\n        resolve();\n      }\n    });\n  });\n}\n\nexport async function runCli(\n  args: string[],\n  dependencies: CliDependencies = {},\n): Promise<number> {\n  const outputWriter = dependencies.writeOut ?? defaultWriteOut;\n  const writeErr =\n    dependencies.writeErr ?? ((value) => process.stderr.write(value));\n  let command = \"unknown\";\n  let idempotencyKey: string | undefined;\n  let schemaVersion = \"1\";\n  let meta: Record<string, unknown> | undefined;\n  let deliveryReceipt: Record<string, unknown> | undefined;\n  const fetchApi = dependencies.fetchApi ?? fetch;\n  const writeOut = async (value: string) => {\n    try {\n      await outputWriter(value);\n    } catch {\n      throw new CliError(\n        EXIT_INTERNAL,\n        command === \"fetch\" ? \"RESULT_OUTPUT_FAILED\" : \"OUTPUT_FAILED\",\n        \"Cannot write stdout. Use the saved result paths below if present. Otherwise keep this receipt and retry the same fetch with --idempotency-key and the same key.\",\n        deliveryReceipt === undefined\n          ? undefined\n          : { receipt: deliveryReceipt },\n      );\n    }\n  };\n\n  try {\n    rejectUnsafeCredentialArgument(args);\n    const help = requestedHelp(args);\n    if (help !== undefined) {\n      command = \"help\";\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: helpData(help),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    const parsed = parseArgs(args);\n    command = parsed.command;\n    const env = dependencies.env ?? process.env;\n    const baseUrl = baseApiUrl(parsed.baseUrl, env);\n\n    if (parsed.command === \"skill\") {\n      if (\n        parsed.positionals[0] !== \"install\" ||\n        parsed.positionals.length > 2\n      ) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"skill requires 'install' and accepts at most one Skill name\",\n        );\n      }\n\n      const skillName = parsed.positionals[1];\n      if (skillName) {\n        ensureOnly(parsed.options, [\"agent\", \"global\"]);\n        const agent = requiredOption(parsed.options, \"agent\");\n        if (!SKILL_NAME_PATTERN.test(skillName)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"Skill name must contain only lowercase letters, numbers, and single hyphens\",\n          );\n        }\n        if (CORE_SKILL_NAMES.has(skillName)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            `Use 'weft skill install' without a name to install the core ${skillName} Skill`,\n          );\n        }\n        if (!SKILL_NAME_PATTERN.test(agent)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"Agent name must contain only lowercase letters, numbers, and single hyphens\",\n          );\n        }\n\n        const processArgs = [\n          \"--yes\",\n          \"skills\",\n          \"add\",\n          \"weftlabs/skills\",\n          \"--skill\",\n          skillName,\n          \"--agent\",\n          agent,\n          \"--yes\",\n          ...(parsed.options.get(\"global\") === true ? [\"--global\"] : []),\n        ];\n        const invocation = npxProcessInvocation(processArgs, dependencies, env);\n        const result = await (dependencies.runProcess ?? defaultRunProcess)(\n          invocation.executable,\n          invocation.arguments,\n        );\n        if (result.exitCode !== 0) {\n          const remediation = `npx ${processArgs.join(\" \")}`;\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"SKILL_INSTALL_FAILED\",\n            `Could not install ${skillName}. Run '${remediation}' directly for more detail.`,\n            {\n              executable: invocation.executable,\n              arguments: invocation.arguments,\n              exit_code: result.exitCode,\n              stderr: result.stderr,\n            },\n          );\n        }\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"installed\",\n              skill: skillName,\n              agent,\n              scope:\n                parsed.options.get(\"global\") === true ? \"global\" : \"project\",\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n\n      ensureOnly(parsed.options, []);\n      const installSkill = await loadSkillInstaller();\n      const result = await installSkill({ force: true });\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: {\n            status: result.status,\n            installed: result.installed,\n            hosts: result.hosts,\n            ...(result.reason === undefined ? {} : { reason: result.reason }),\n            ...(result.warnings.length === 0\n              ? {}\n              : { warnings: result.warnings }),\n          },\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    await installSkillInBackground();\n\n    if (parsed.command === \"bootstrap\") {\n      ensureOnly(parsed.options, [\"email\", \"agent-name\", \"reason\"]);\n      if (parsed.positionals.length !== 0) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"bootstrap does not accept positional arguments\",\n        );\n      }\n      const email = requiredOption(parsed.options, \"email\");\n      const agentName = requiredOption(parsed.options, \"agent-name\");\n      const reason = requiredOption(parsed.options, \"reason\");\n\n      const bootstrap = await requestJson<BootstrapCreateResponse>(\n        fetchApi,\n        `${baseUrl}/api/v1/account_bootstraps`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n          },\n          body: JSON.stringify({\n            email,\n            agent_name: agentName,\n            host_name: OAUTH_HOST_NAME,\n            reason,\n          }),\n        },\n      );\n\n      const stored: BootstrapCredentials = {\n        ...bootstrap.data,\n        base_url: baseUrl,\n      };\n\n      await writeStoredCredentials(env, stored);\n\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: noSecretFields(stored),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    if (parsed.command === \"auth\") {\n      ensureOnly(parsed.options, []);\n      if (\n        parsed.positionals.length !== 1 ||\n        parsed.positionals[0] !== \"status\"\n      ) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"auth requires 'status'\",\n        );\n      }\n\n      const stored = await readStoredCredentials(env);\n      if (isOAuthCredentials(stored)) {\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"consumed\",\n              authentication: \"oauth\",\n              scope: stored.scope,\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n      if (isLegacyBootstrapCredentials(stored)) {\n        const status = await requestJson<BootstrapStatus>(\n          fetchApi,\n          `${stored.base_url}/api/v1/account_bootstraps/${stored.bootstrap_id}`,\n          {\n            method: \"GET\",\n            headers: withCredentials({}, stored.temporary_api_key),\n          },\n        );\n        if (\n          status.data.status !== \"claimed\" &&\n          status.data.status !== \"consumed\"\n        ) {\n          await writeOut(\n            `${JSON.stringify({\n              schema_version: \"1\",\n              ok: true,\n              command,\n              data: { status: status.data.status },\n            })}\\n`,\n          );\n          return EXIT_SUCCESS;\n        }\n\n        const token = await requestJson<OAuthTokenResponse>(\n          fetchApi,\n          `${stored.base_url}/oauth/token`,\n          {\n            method: \"POST\",\n            headers: {\n              \"content-type\": \"application/x-www-form-urlencoded\",\n            },\n            body: new URLSearchParams({\n              grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n              device_code: stored.device_code,\n              client_id: stored.client_id,\n              name: \"Weft CLI\",\n            }).toString(),\n          },\n          true,\n        );\n        const oauth: OAuthCredentials = {\n          version: 1,\n          type: \"oauth\",\n          base_url: stored.base_url,\n          client_id: stored.client_id,\n          access_token: token.access_token,\n          refresh_token: token.refresh_token,\n          token_type: token.token_type,\n          scope: token.scope,\n          expiry: new Date(Date.now() + token.expires_in * 1000).toISOString(),\n        };\n        const active = await withCredentialsLock(env, async () => {\n          const current = await readStoredCredentials(env);\n          if (isOAuthCredentials(current)) return current;\n          if (\n            !isLegacyBootstrapCredentials(current) ||\n            JSON.stringify(current) !== JSON.stringify(stored)\n          ) {\n            throw new CliError(\n              EXIT_AUTH,\n              \"CREDENTIALS_CHANGED\",\n              \"Stored credentials changed; rerun auth status\",\n            );\n          }\n          await writeStoredCredentialsWhileLocked(env, oauth);\n          return oauth;\n        });\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"consumed\",\n              authentication: \"oauth\",\n              scope: active.scope,\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n      if (!stored) {\n        throw new CliError(\n          EXIT_AUTH,\n          \"BOOTSTRAP_REQUIRED\",\n          \"Run weft bootstrap before auth status\",\n        );\n      }\n\n      const status = await requestJson<BootstrapStatus>(\n        fetchApi,\n        `${stored.base_url}/api/v1/account_bootstraps/${stored.id}`,\n        {\n          method: \"GET\",\n          headers: withCredentials({}, stored.temporary_api_key),\n        },\n      );\n\n      const merged: BootstrapCredentials = {\n        base_url: stored.base_url,\n        id: status.data.id ?? stored.id,\n        status: status.data.status,\n        capabilities: status.data.capabilities ?? stored.capabilities,\n        expires_at:\n          status.data.expires_at === undefined\n            ? stored.expires_at\n            : status.data.expires_at,\n        approval: status.data.approval ?? stored.approval,\n        temporary_api_key: stored.temporary_api_key,\n      };\n      const active = await withCredentialsLock(env, async () => {\n        const current = await readStoredCredentials(env);\n        if (JSON.stringify(current) !== JSON.stringify(stored)) {\n          throw new CliError(\n            EXIT_AUTH,\n            \"CREDENTIALS_CHANGED\",\n            \"Stored credentials changed; rerun auth status\",\n          );\n        }\n        await writeStoredCredentialsWhileLocked(env, merged);\n        return merged;\n      });\n\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: noSecretFields(active),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    const rawKey = parsed.apiKeyStdin\n      ? await (dependencies.readStdin ?? defaultReadStdin)()\n      : env.WEFT_API_KEY;\n    let apiKey = rawKey?.trim();\n    let authenticatedBaseUrl = baseUrl;\n    if (parsed.apiKeyStdin && !apiKey) {\n      throw new CliError(\n        EXIT_AUTH,\n        \"API_KEY_REQUIRED\",\n        \"--api-key-stdin requires a non-empty API key\",\n      );\n    }\n    if (!apiKey && !parsed.apiKeyStdin) {\n      let stored = await readStoredCredentials(env);\n      if (isOAuthCredentials(stored) && oauthNeedsRefresh(stored)) {\n        stored = await withCredentialsLock(env, async () => {\n          const current = await readStoredCredentials(env);\n          if (isOAuthCredentials(current) && oauthNeedsRefresh(current)) {\n            return refreshOAuthCredentials(fetchApi, env, current);\n          }\n          return current;\n        });\n      }\n      apiKey = resolveApiKeyFromStored(stored);\n      if (stored) {\n        authenticatedBaseUrl = stored.base_url;\n      }\n    }\n\n    if (!apiKey) {\n      throw new CliError(\n        EXIT_AUTH,\n        \"API_KEY_REQUIRED\",\n        \"Set WEFT_API_KEY, pass --api-key-stdin, or store credentials\",\n      );\n    }\n\n    const client = new WeftClient({\n      apiKey,\n      baseUrl: authenticatedBaseUrl,\n      fetchApi,\n    });\n\n    let data: unknown;\n    if (parsed.command === \"me\") {\n      ensureOnly(parsed.options, []);\n      data = await client.me();\n    } else if (parsed.command === \"balance\") {\n      ensureOnly(parsed.options, []);\n      data = await client.balance();\n    } else if (parsed.command === \"search\") {\n      ensureOnly(parsed.options, [\"max-results\"]);\n      if (parsed.positionals.length !== 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"search requires exactly one query\",\n        );\n      }\n      data = await client.search({\n        query: parsed.positionals[0],\n        maxResults: positiveInteger(\n          parsed.options.get(\"max-results\"),\n          \"--max-results\",\n          50,\n        ),\n      });\n    } else if (parsed.command === \"fetch\") {\n      ensureOnly(parsed.options, [\n        \"max-cost-usd\",\n        \"method\",\n        \"body\",\n        \"header\",\n        \"idempotency-key\",\n        \"raw\",\n      ]);\n      const raw = parsed.options.has(\"raw\");\n      schemaVersion = raw ? \"1\" : \"2\";\n      if (parsed.positionals.length !== 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"fetch requires exactly one URL\",\n        );\n      }\n      const maxCostUsd = requiredOption(parsed.options, \"max-cost-usd\");\n      if (!/^\\d+(?:\\.\\d+)?$/.test(maxCostUsd)) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"--max-cost-usd must be a non-negative decimal\",\n        );\n      }\n      const method = parsed.options.get(\"method\");\n      const rawBody = parsed.options.get(\"body\");\n      let body: PaidFetchRequest[\"body\"];\n      if (typeof rawBody === \"string\") {\n        try {\n          JSON.parse(rawBody);\n        } catch {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"--body must be JSON\",\n          );\n        }\n        body = rawBody;\n      }\n      const headers = fetchHeaders(\n        parsed.options.get(\"header\"),\n        typeof rawBody === \"string\",\n      );\n      const request: PaidFetchRequest = {\n        url: parsed.positionals[0],\n        maxCostUsd,\n        method:\n          typeof method === \"string\"\n            ? (method.toUpperCase() as PaidFetchRequest[\"method\"])\n            : undefined,\n        body,\n        headers,\n      };\n      const explicitKey = parsed.options.get(\"idempotency-key\");\n      idempotencyKey =\n        typeof explicitKey === \"string\"\n          ? explicitKey\n          : (dependencies.generateIdempotencyKey ?? randomUUID)();\n      let resultDirectory: string | undefined;\n      if (!raw) {\n        try {\n          resultDirectory = await reserveResultDirectory(env);\n        } catch {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_STORAGE_UNAVAILABLE\",\n            \"Cannot reserve local result storage. Set WEFT_RESULTS_DIR to a directory you own that is writable only by you, with no symlink at that path, then retry. No fetch was sent.\",\n          );\n        }\n      }\n      const response = await client.fetch(request, { idempotencyKey });\n      meta = { idempotency_key: idempotencyKey };\n      data = response;\n      const { bodyBase64, ...receipt } = response;\n      deliveryReceipt = receipt;\n      if (resultDirectory) {\n        const savedPath = join(resultDirectory, \"body\");\n        const receiptPath = join(resultDirectory, \"receipt.json\");\n        const bytes =\n          typeof bodyBase64 === \"string\"\n            ? Buffer.from(bodyBase64, \"base64\")\n            : undefined;\n        if (!bytes || bytes.toString(\"base64\") !== bodyBase64) {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_DECODE_FAILED\",\n            \"Fetch returned invalid Base64. No body was saved. Keep this receipt and retry the same request with --idempotency-key and the same key; if it persists, report the artifact ID to support.\",\n            { receipt, file_complete: false },\n          );\n        }\n        try {\n          meta = {\n            ...meta,\n            saved_path: savedPath,\n            receipt_path: receiptPath,\n            byte_count: bytes.length,\n          };\n          await writeResultFile(\n            receiptPath,\n            `${JSON.stringify({ schema_version: \"2\", meta, data: receipt })}\\n`,\n          );\n          await writeResultFile(savedPath, bytes);\n          data = { ...receipt, ...readableBody(bytes, response.headers) };\n        } catch {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_STORAGE_FAILED\",\n            \"Fetch returned, but local result delivery failed. Keep this receipt. Check local storage, then retry the same request with --idempotency-key and the key below. Do not use a new key.\",\n            {\n              receipt,\n              saved_path: savedPath,\n              receipt_path: receiptPath,\n              file_complete: false,\n            },\n          );\n        }\n      }\n    } else {\n      ensureOnly(parsed.options, [\"page\", \"per-page\"]);\n      if (parsed.positionals.length > 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"purchases accepts at most one purchase ID\",\n        );\n      }\n      data = parsed.positionals[0]\n        ? await client.purchase(\n            positiveInteger(parsed.positionals[0], \"purchase ID\")!,\n          )\n        : await client.purchases({\n            page: positiveInteger(parsed.options.get(\"page\"), \"--page\"),\n            perPage: positiveInteger(\n              parsed.options.get(\"per-page\"),\n              \"--per-page\",\n              100,\n            ),\n          });\n    }\n\n    await writeOut(\n      `${JSON.stringify({\n        schema_version: schemaVersion,\n        ok: true,\n        command,\n        ...(meta === undefined ? {} : { meta }),\n        data,\n      })}\\n`,\n    );\n    return EXIT_SUCCESS;\n  } catch (error) {\n    const normalized = await normalizeError(error);\n    writeErr(\n      `${JSON.stringify({\n        schema_version: schemaVersion,\n        ok: false,\n        command,\n        ...(idempotencyKey === undefined\n          ? {}\n          : { meta: { ...meta, idempotency_key: idempotencyKey } }),\n        error: {\n          code: normalized.code,\n          message: normalized.message,\n          ...(normalized.details === undefined\n            ? {}\n            : { details: normalized.details }),\n        },\n      })}\\n`,\n    );\n    return normalized.exitCode;\n  }\n}\n","import { chmod, lstat, mkdir, mkdtemp, open, realpath } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport async function reserveResultDirectory(\n  env: Record<string, string | undefined>,\n): Promise<string> {\n  const root = resolve(\n    env.WEFT_RESULTS_DIR ||\n      join(env.HOME || env.USERPROFILE || homedir(), \".weft-results\"),\n  );\n  await mkdir(root, { recursive: true, mode: 0o700 });\n  const stat = await lstat(root);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) {\n    throw new Error(\n      \"The result storage root must be a directory, not a symlink\",\n    );\n  }\n  if (\n    process.platform !== \"win32\" &&\n    ((stat.mode & 0o022) !== 0 || stat.uid !== process.getuid?.())\n  ) {\n    throw new Error(\n      \"The result storage root must be owned by this user and not writable by others\",\n    );\n  }\n  // A private child keeps payloads protected without changing an existing parent.\n  const directory = await mkdtemp(join(await realpath(root), \"result-\"));\n  await chmod(directory, 0o700);\n  return directory;\n}\n\nexport async function writeResultFile(\n  path: string,\n  contents: string | Buffer,\n): Promise<void> {\n  const file = await open(path, \"wx\", 0o600);\n  try {\n    await file.chmod(0o600);\n    await file.writeFile(contents);\n    await file.sync();\n  } finally {\n    await file.close();\n  }\n}\n\nexport function readableBody(\n  bytes: Buffer,\n  headers: Record<string, string>,\n): {\n  media_type: string | null;\n  body_encoding: \"utf-8\" | \"file\";\n  body?: string;\n} {\n  const header = (name: string) =>\n    Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];\n  const contentType = header(\"content-type\")?.toLowerCase() ?? \"\";\n  const mediaType = contentType.split(\";\", 1)[0].trim();\n  const charset = /(?:^|;)\\s*charset\\s*=\\s*\"?([^;\"\\s]+)/.exec(contentType)?.[1];\n  const encoding = header(\"content-encoding\")?.trim().toLowerCase();\n  const file = {\n    media_type: mediaType || null,\n    body_encoding: \"file\" as const,\n  };\n  const textual =\n    mediaType.startsWith(\"text/\") ||\n    /^application\\/(?:json|xml|javascript|x-ndjson|x-www-form-urlencoded|[^;]+\\+(?:json|xml))$/.test(\n      mediaType,\n    );\n  if (\n    (encoding && encoding !== \"identity\") ||\n    (charset && ![\"utf-8\", \"utf8\", \"us-ascii\"].includes(charset)) ||\n    (!textual && !(bytes.length === 0 && !mediaType))\n  )\n    return file;\n  try {\n    // Keep a UTF-8 BOM and JSON spelling exactly as delivered.\n    const body = new TextDecoder(\"utf-8\", {\n      fatal: true,\n      ignoreBOM: true,\n    }).decode(bytes);\n    return { media_type: mediaType || null, body_encoding: \"utf-8\", body };\n  } catch {\n    return file;\n  }\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,cAAc,aAAa;AAEpC,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AA4CxB,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEA,SAAS,uBACP,OACkC;AAClC,MACE,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,WAAW,YACxB,MAAM,QAAQ,MAAM,YAAY,KAChC,MAAM,aAAa,MAAM,CAAC,eAAe,OAAO,eAAe,QAAQ,MACtE,OAAO,MAAM,eAAe,YAAY,MAAM,eAAe,SAC9D,SAAS,MAAM,QAAQ,KACvB,OAAO,MAAM,SAAS,WAAW,YACjC,OAAO,MAAM,SAAS,eAAe,YACrC,OAAO,MAAM,SAAS,aAAa,aAClC,MAAM,SAAS,cAAc,UAC5B,OAAO,MAAM,SAAS,cAAc,aACtC,OAAO,MAAM,sBAAsB,UACnC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,6BACP,OACwC;AACxC,MACE,MAAM,YAAY,KAClB,MAAM,SAAS,eACf,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,sBAAsB,YACnC,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,qBAAqB,UAClC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,OAC8B;AAC9B,MACE,MAAM,SAAS,WACf,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,kBAAkB,YAC/B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,UAAU,YACvB,OAAO,MAAM,WAAW,UACxB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,uBACd,KACoB;AACpB,MAAI,IAAI,sBAAuB,QAAO,IAAI;AAC1C,MAAI,IAAI;AACN,WAAO,GAAG,IAAI,eAAe;AAC/B,QAAM,OAAO,IAAI,QAAQ,IAAI;AAC7B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,GAAG,IAAI;AAChB;AAEA,eAAsB,sBACpB,KACwC;AACxC,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,MAAM,MAAM;AACvC,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AACrE,WACE,uBAAuB,MAAM,KAC7B,6BAA6B,MAAM,KACnC,mBAAmB,MAAM;AAAA,EAE7B,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,uBACpB,KACA,aACe;AACf,QAAM;AAAA,IAAoB;AAAA,IAAK,MAC7B,kCAAkC,KAAK,WAAW;AAAA,EACpD;AACF;AAEA,eAAsB,kCACpB,KACA,aACe;AACf,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,MAAM,qBAAqB,CAAC;AACnE,QAAM,MAAM,QAAQ,oBAAoB;AAExC,QAAM,WAAW,GAAG,IAAI,IAAI,WAAW,CAAC;AACxC,MAAI;AACF,UAAM,UAAU,UAAU,KAAK,UAAU,WAAW,GAAG;AAAA,MACrD,MAAM;AAAA,IACR,CAAC;AACD,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,MAAM,MAAM,qBAAqB;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC;AAClC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,oBACpB,KACA,QACY;AACZ,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,WAAW,GAAG,IAAI;AACxB,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,qBAAqB,CAAC;AAE1E,aAAS;AACP,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,UAAU,MAAM,qBAAqB;AAC7D,YAAM,KAAK,MAAM;AACjB;AAAA,IACF,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAC9D,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI;AAAA,UACR,wFAAwF,QAAQ;AAAA,QAClG;AAAA,MACF;AACA,YAAM,MAAM,aAAa;AAAA,IAC3B;AAAA,EACF;AAEA,MAAI;AACF,WAAO,MAAM,OAAO;AAAA,EACtB,UAAE;AACA,UAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC;AAAA,EACpC;AACF;;;ACxNA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACb9B,SAAS,SAAAC,QAAO,OAAO,SAAAC,QAAO,SAAS,QAAAC,OAAM,gBAAgB;AAC7D,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAE9B,eAAsB,uBACpB,KACiB;AACjB,QAAM,OAAO;AAAA,IACX,IAAI,oBACF,KAAK,IAAI,QAAQ,IAAI,eAAe,QAAQ,GAAG,eAAe;AAAA,EAClE;AACA,QAAMD,OAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,MAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,GAAG;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,aAAa,aACnB,KAAK,OAAO,QAAW,KAAK,KAAK,QAAQ,QAAQ,SAAS,IAC5D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,SAAS,IAAI,GAAG,SAAS,CAAC;AACrE,QAAMD,OAAM,WAAW,GAAK;AAC5B,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,UACe;AACf,QAAM,OAAO,MAAME,MAAK,MAAM,MAAM,GAAK;AACzC,MAAI;AACF,UAAM,KAAK,MAAM,GAAK;AACtB,UAAM,KAAK,UAAU,QAAQ;AAC7B,UAAM,KAAK,KAAK;AAAA,EAClB,UAAE;AACA,UAAM,KAAK,MAAM;AAAA,EACnB;AACF;AAEO,SAAS,aACd,OACA,SAKA;AACA,QAAM,SAAS,CAAC,SACd,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,IAAI,IAAI,CAAC;AACzE,QAAM,cAAc,OAAO,cAAc,GAAG,YAAY,KAAK;AAC7D,QAAM,YAAY,YAAY,MAAM,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK;AACpD,QAAM,UAAU,uCAAuC,KAAK,WAAW,IAAI,CAAC;AAC5E,QAAM,WAAW,OAAO,kBAAkB,GAAG,KAAK,EAAE,YAAY;AAChE,QAAM,OAAO;AAAA,IACX,YAAY,aAAa;AAAA,IACzB,eAAe;AAAA,EACjB;AACA,QAAM,UACJ,UAAU,WAAW,OAAO,KAC5B,4FAA4F;AAAA,IAC1F;AAAA,EACF;AACF,MACG,YAAY,aAAa,cACzB,WAAW,CAAC,CAAC,SAAS,QAAQ,UAAU,EAAE,SAAS,OAAO,KAC1D,CAAC,WAAW,EAAE,MAAM,WAAW,KAAK,CAAC;AAEtC,WAAO;AACT,MAAI;AAEF,UAAM,OAAO,IAAI,YAAY,SAAS;AAAA,MACpC,OAAO;AAAA,MACP,WAAW;AAAA,IACb,CAAC,EAAE,OAAO,KAAK;AACf,WAAO,EAAE,YAAY,aAAa,MAAM,eAAe,SAAS,KAAK;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADlEA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,gBAAgB;AAY7B,IAAM,WAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAEvD,IAAM,eAAe;AAAA,EACnB,WAAW;AAAA,IACT,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,QAAQ;AAAA,EACpB;AAAA,EACA,OAAO;AAAA,IACL,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,WAAW,UAAU,mBAAmB,UAAU;AAAA,EAC9D;AAAA,EACA,IAAI;AAAA,IACF,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,IACP,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,EACZ;AAAA,EACA,QAAQ;AAAA,IACN,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,uBAAuB;AAAA,EACnC;AAAA,EACA,OAAO;AAAA,IACL,aAAa;AAAA,IACb,OACE;AAAA,IACF,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,mBAAmB,qBAAqB;AAAA,EACpD;AACF;AAwBA,eAAe,qBAA8C;AAC3D,QAAM,YAAY,IAAI,IAAI,gCAAgC,YAAY,GAAG,EACtE;AACH,QAAM,SAAU,MAAM,OAAO;AAC7B,SAAO,OAAO;AAChB;AASA,eAAe,2BAA0C;AACvD,MAAI;AACF,UAAM,eAAe,MAAM,mBAAmB;AAC9C,UAAM,aAAa,EAAE,QAAQ,KAAK,CAAC;AAAA,EACrC,QAAQ;AAAA,EAGR;AACF;AAwBA,IAAM,iBAAiB,CAAC,mBAAmB,oBAAoB,UAAU,IAAI;AAkC7E,IAAM,WAAN,cAAuB,MAAM;AAAA,EAC3B,YACW,UACA,MACT,SACS,SACT;AACA,UAAM,OAAO;AALJ;AACA;AAEA;AAAA,EAGX;AACF;AAEA,SAAS,UACP,MACA,OACA,QACkB;AAClB,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,SAAS,QAAQ,MAAM,WAAW,IAAI,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,SAAO,CAAC,OAAO,QAAQ,CAAC;AAC1B;AAEA,SAAS,cAAc,SAAiB,OAAgC;AACtE,SAAO,GAAG,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,oBAAoB;AACpE;AAEA,SAAS,kBACP,SACA,MACwB;AACxB,SAAO,IAAI,QAAQ,CAACC,aAAY;AAC9B,UAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,MACjC,OAAO;AAAA,MACP,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,QAAI,SAAS;AACb,QAAI,SAAS;AACb,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,UAAU;AAC3B,MAAAA,SAAQ;AAAA,QACN,UAAU;AAAA,QACV;AAAA,QACA,QAAQ,cAAc,QAAQ,MAAM,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,aAAa;AAC9B,MAAAA,SAAQ,EAAE,UAAU,YAAY,GAAG,QAAQ,OAAO,CAAC;AAAA,IACrD,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,kBACP,KACA,gBACoB;AACpB,QAAM,sBAAsBC,SAAQ,cAAc;AAClD,QAAM,aAAa;AAAA,IACjB,GAAI,IAAI,eACJ,CAACC,MAAKD,SAAQ,IAAI,YAAY,GAAG,YAAY,CAAC,IAC9C,CAAC;AAAA,IACLC,MAAK,qBAAqB,gBAAgB,OAAO,OAAO,YAAY;AAAA,IACpEA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,WAAW,KAAK,CAAC,cAAc,WAAW,SAAS,CAAC;AAC7D;AAEA,SAAS,qBACP,aACA,cACA,KAC6C;AAC7C,OAAK,aAAa,YAAY,QAAQ,cAAc,SAAS;AAC3D,WAAO,EAAE,YAAY,OAAO,WAAW,YAAY;AAAA,EACrD;AAEA,QAAM,iBAAiB,aAAa,kBAAkB,QAAQ;AAC9D,QAAM,aACJ,aAAa,cAAc,kBAAkB,KAAK,cAAc;AAClE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,CAAC,YAAY,GAAG,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,+BAA+B,MAAsB;AAC5D,MAAI,KAAK,KAAK,CAAC,QAAQ,QAAQ,eAAe,IAAI,WAAW,YAAY,CAAC,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAA6C;AAClE,QAAM,SAAS,CAAC,UAAkB,UAAU,YAAY,UAAU;AAClE,MAAI,KAAK,WAAW,KAAK,OAAO,KAAK,CAAC,CAAC,EAAG,QAAO;AACjD,MACE,KAAK,WAAW,KAChB,SAAS,SAAS,KAAK,CAAC,CAAY,KACpC,OAAO,KAAK,CAAC,CAAC,GACd;AACA,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,SAAS,SAA0B;AAC1C,MAAI,YAAY,OAAO;AACrB,WAAO;AAAA,MACL;AAAA,MACA,GAAG,aAAa,OAAO;AAAA,MACvB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,UAAU,SAAS,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,IAAI,EAAE,EAAE;AAAA,IAClE,gBAAgB;AAAA,IAChB,gBAAgB,CAAC,gBAAgB,iBAAiB;AAAA,IAClD,YAAY,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,EAAE;AAAA,EACnE;AACF;AAEA,SAAS,UAAU,MAA4B;AAC7C,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACJ,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAU,oBAAI,IAAsC;AAE1D,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,MAAM,KAAK,KAAK;AACtB,QAAI,QAAQ,mBAAmB;AAC7B,oBAAc;AAAA,IAChB,WAAW,QAAQ,cAAc;AAC/B,OAAC,SAAS,KAAK,IAAI,UAAU,MAAM,OAAO,GAAG;AAAA,IAC/C,WAAW,QAAQ,cAAc,QAAQ,SAAS;AAChD,cAAQ,IAAI,IAAI,MAAM,CAAC,GAAG,IAAI;AAAA,IAChC,WAAW,IAAI,WAAW,IAAI,GAAG;AAC/B,YAAM,CAAC,OAAO,SAAS,IAAI,UAAU,MAAM,OAAO,GAAG;AACrD,YAAM,OAAO,IAAI,MAAM,CAAC;AACxB,UAAI,SAAS,UAAU;AACrB,cAAM,WAAW,QAAQ,IAAI,IAAI;AACjC,YAAI,OAAO,aAAa,UAAU;AAChC,kBAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;AAAA,QACrC,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,mBAAS,KAAK,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,IAAI,MAAM,KAAK;AAAA,QACzB;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI,MAAM,KAAK;AAAA,MACzB;AACA,cAAQ;AAAA,IACV,WAAW,CAAC,SAAS;AACnB,UAAI,CAAC,SAAS,SAAS,GAAc,GAAG;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA,oBAAoB,GAAG;AAAA,QACzB;AAAA,MACF;AACA,gBAAU;AAAA,IACZ,OAAO;AACL,kBAAY,KAAK,GAAG;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,aAAa,SAAS,aAAa,QAAQ;AAC/D;AAEA,SAAS,gBACP,OACA,QACA,SACoB;AACpB,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,MAAI,WAAW,QAAQ,SAAS,SAAS;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM,oBAAoB,OAAO;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,SACA,MACQ;AACR,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,SAAS,YAAY,oBAAoB,KAAK,IAAI,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,aACP,KACA,aAC6B;AAC7B,QAAM,SACJ,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC;AAChE,QAAM,UAAkC,CAAC;AACzC,aAAW,aAAa,QAAQ;AAC9B,UAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,QAAI,SAAS,GAAG;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,YAAQ,UAAU,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,UACzC,MAAM,QAAQ,CAAC,EACf,KAAK;AAAA,EACV;AACA,MACE,eACA,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,YAAY,MAAM,cAAc,GAC1E;AACA,YAAQ,cAAc,IAAI;AAAA,EAC5B;AACA,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAAS,WACP,SACA,KACQ;AACR,QAAM,MAAM,WAAW,IAAI,iBAAiB;AAC5C,SAAO,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,IAAI;AAChD;AAEA,SAAS,wBACP,aACoB;AACpB,MAAI,CAAC,YAAa,QAAO;AACzB,MACE,kBAAkB,eAClB,OAAO,YAAY,iBAAiB,YACpC,YAAY,aAAa,KAAK,GAC9B;AACA,WAAO,YAAY;AAAA,EACrB;AACA,MACE,uBAAuB,eACvB,OAAO,YAAY,sBAAsB,YACzC,YAAY,kBAAkB,KAAK,GACnC;AACA,WAAO,YAAY;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAASC,oBACP,aACiC;AACjC,SAAO;AAAA,IACL,eAAe,UAAU,eAAe,YAAY,SAAS;AAAA,EAC/D;AACF;AAEA,SAASC,8BACP,aAC2C;AAC3C,SAAO;AAAA,IACL,eAAe,UAAU,eAAe,YAAY,SAAS;AAAA,EAC/D;AACF;AAEA,SAAS,kBAAkB,aAAwC;AACjE,QAAM,SAAS,KAAK,MAAM,YAAY,MAAM;AAC5C,SACE,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AAEvD;AAEA,eAAe,wBACb,UACA,KACA,QAC2B;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,OAAO;AAAA,QACtB,WAAW,OAAO;AAAA,MACpB,CAAC,EAAE,SAAS;AAAA,IACd;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAA8B;AAAA,IAClC,GAAG;AAAA,IACH,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,OAAO,MAAM;AAAA,IACb,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,aAAa,GAAI,EAAE,YAAY;AAAA,EACrE;AACA,QAAM,kCAAkC,KAAK,SAAS;AACtD,SAAO;AACT;AAEA,SAAS,eAAe,MAAuC;AAC7D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,eAAe;AAAA,IACf,eAAe;AAAA,EACjB;AACF;AAEA,eAAe,YACb,UACA,KACA,MACA,cAAc,OACF;AACZ,QAAM,WAAW,MAAM,SAAS,KAAK,IAAI;AACzC,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,aAAa;AACf,YAAM,IAAI;AAAA,QACR,SAAS,WAAW,OAAO,SAAS,WAAW,MAC3C,YACA,SAAS,UAAU,MACjB,gBACA;AAAA,QACN;AAAA,QACA,wCAAwC,SAAS,MAAM;AAAA,MACzD;AAAA,IACF;AACA,UAAM,IAAI,cAAc,QAAQ;AAAA,EAClC;AAEA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAEA,SAAS,gBACP,SACA,QACwB;AACxB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,eAAe,UAAU,MAAM;AAAA,EACjC;AACF;AAEA,SAAS,WACP,SACA,SACM;AACN,aAAW,QAAQ,QAAQ,KAAK,GAAG;AACjC,QAAI,CAAC,QAAQ,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,qBAAqB,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBAAgB,OAAwC;AACrE,MAAI;AACF,WAAO,MAAM,MAAM,SAAS,KAAK;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eAAe,OAAmC;AAC/D,MAAI,iBAAiB,SAAU,QAAO;AACtC,MAAI,iBAAiB,WAAW;AAG9B,UAAM,WACJ,MAAM,WAAW,OAAO,MAAM,WAAW,MACrC,YACA,MAAM,UAAU,OAAO,MAAM,WAAW,IACtC,gBACA;AACR,WAAO,IAAI,SAAS,UAAU,MAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AAAA,EACxE;AACA,MAAI,iBAAiB,eAAe;AAClC,UAAM,UAAU,MAAM,gBAAgB,KAAK;AAC3C,UAAM,OAAO;AAMb,UAAM,SAAS,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC9D,UAAM,OACJ,QAAQ,SACP,OAAO,MAAM,UAAU,WACpB,KAAK,QACL,QAAQ,MAAM,SAAS,MAAM;AACnC,UAAMC,WACJ,QAAQ,WACR,MAAM,qBACN,0BAA0B,MAAM,SAAS,MAAM;AACjD,UAAM,WACJ,MAAM,SAAS,WAAW,OAAO,MAAM,SAAS,WAAW,MACvD,YACA,MAAM,SAAS,UAAU,MACvB,gBACA;AACR,WAAO,IAAI,SAAS,UAAU,MAAMA,UAAS,OAAO;AAAA,EACtD;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,SAAS,eAAe,kBAAkB,OAAO;AAC9D;AAEA,eAAe,mBAAoC;AACjD,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,QAAQ,OAAO;AACvC,WAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,EACjE;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAC9C;AAEA,eAAe,gBAAgB,OAA8B;AAC3D,QAAM,IAAI,QAAc,CAACL,UAAS,WAAW;AAG3C,UAAM,UAAU,CAAC,UAAiB,OAAO,KAAK;AAC9C,YAAQ,OAAO,KAAK,SAAS,OAAO;AACpC,YAAQ,OAAO,MAAM,OAAO,CAAC,UAAU;AACrC,UAAI,OAAO;AACT,eAAO,KAAK;AAAA,MACd,OAAO;AACL,gBAAQ,OAAO,eAAe,SAAS,OAAO;AAC9C,QAAAA,SAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,OACpB,MACA,eAAgC,CAAC,GAChB;AACjB,QAAM,eAAe,aAAa,YAAY;AAC9C,QAAM,WACJ,aAAa,aAAa,CAAC,UAAU,QAAQ,OAAO,MAAM,KAAK;AACjE,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,gBAAgB;AACpB,MAAI;AACJ,MAAI;AACJ,QAAM,WAAW,aAAa,YAAY;AAC1C,QAAM,WAAW,OAAO,UAAkB;AACxC,QAAI;AACF,YAAM,aAAa,KAAK;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,UAAU,yBAAyB;AAAA,QAC/C;AAAA,QACA,oBAAoB,SAChB,SACA,EAAE,SAAS,gBAAgB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,mCAA+B,IAAI;AACnC,UAAM,OAAO,cAAc,IAAI;AAC/B,QAAI,SAAS,QAAW;AACtB,gBAAU;AACV,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,SAAS,IAAI;AAAA,QACrB,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,UAAU,IAAI;AAC7B,cAAU,OAAO;AACjB,UAAM,MAAM,aAAa,OAAO,QAAQ;AACxC,UAAM,UAAU,WAAW,OAAO,SAAS,GAAG;AAE9C,QAAI,OAAO,YAAY,SAAS;AAC9B,UACE,OAAO,YAAY,CAAC,MAAM,aAC1B,OAAO,YAAY,SAAS,GAC5B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,YAAY,OAAO,YAAY,CAAC;AACtC,UAAI,WAAW;AACb,mBAAW,OAAO,SAAS,CAAC,SAAS,QAAQ,CAAC;AAC9C,cAAM,QAAQ,eAAe,OAAO,SAAS,OAAO;AACpD,YAAI,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACvC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,iBAAiB,IAAI,SAAS,GAAG;AACnC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,+DAA+D,SAAS;AAAA,UAC1E;AAAA,QACF;AACA,YAAI,CAAC,mBAAmB,KAAK,KAAK,GAAG;AACnC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM,OAAO,CAAC,UAAU,IAAI,CAAC;AAAA,QAC9D;AACA,cAAM,aAAa,qBAAqB,aAAa,cAAc,GAAG;AACtE,cAAMM,UAAS,OAAO,aAAa,cAAc;AAAA,UAC/C,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AACA,YAAIA,QAAO,aAAa,GAAG;AACzB,gBAAM,cAAc,OAAO,YAAY,KAAK,GAAG,CAAC;AAChD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,qBAAqB,SAAS,UAAU,WAAW;AAAA,YACnD;AAAA,cACE,YAAY,WAAW;AAAA,cACvB,WAAW,WAAW;AAAA,cACtB,WAAWA,QAAO;AAAA,cAClB,QAAQA,QAAO;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP;AAAA,cACA,OACE,OAAO,QAAQ,IAAI,QAAQ,MAAM,OAAO,WAAW;AAAA,YACvD;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AAEA,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,YAAM,eAAe,MAAM,mBAAmB;AAC9C,YAAM,SAAS,MAAM,aAAa,EAAE,OAAO,KAAK,CAAC;AACjD,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,YACJ,QAAQ,OAAO;AAAA,YACf,WAAW,OAAO;AAAA,YAClB,OAAO,OAAO;AAAA,YACd,GAAI,OAAO,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;AAAA,YAC/D,GAAI,OAAO,SAAS,WAAW,IAC3B,CAAC,IACD,EAAE,UAAU,OAAO,SAAS;AAAA,UAClC;AAAA,QACF,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,yBAAyB;AAE/B,QAAI,OAAO,YAAY,aAAa;AAClC,iBAAW,OAAO,SAAS,CAAC,SAAS,cAAc,QAAQ,CAAC;AAC5D,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,QAAQ,eAAe,OAAO,SAAS,OAAO;AACpD,YAAM,YAAY,eAAe,OAAO,SAAS,YAAY;AAC7D,YAAM,SAAS,eAAe,OAAO,SAAS,QAAQ;AAEtD,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA,GAAG,OAAO;AAAA,QACV;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU;AAAA,YACnB;AAAA,YACA,YAAY;AAAA,YACZ,WAAW;AAAA,YACX;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,SAA+B;AAAA,QACnC,GAAG,UAAU;AAAA,QACb,UAAU;AAAA,MACZ;AAEA,YAAM,uBAAuB,KAAK,MAAM;AAExC,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,eAAe,MAAM;AAAA,QAC7B,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,YAAY,QAAQ;AAC7B,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,UACE,OAAO,YAAY,WAAW,KAC9B,OAAO,YAAY,CAAC,MAAM,UAC1B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,UAAIH,oBAAmB,MAAM,GAAG;AAC9B,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,gBAAgB;AAAA,cAChB,OAAO,OAAO;AAAA,YAChB;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AACA,UAAIC,8BAA6B,MAAM,GAAG;AACxC,cAAMG,UAAS,MAAM;AAAA,UACnB;AAAA,UACA,GAAG,OAAO,QAAQ,8BAA8B,OAAO,YAAY;AAAA,UACnE;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,gBAAgB,CAAC,GAAG,OAAO,iBAAiB;AAAA,UACvD;AAAA,QACF;AACA,YACEA,QAAO,KAAK,WAAW,aACvBA,QAAO,KAAK,WAAW,YACvB;AACA,gBAAM;AAAA,YACJ,GAAG,KAAK,UAAU;AAAA,cAChB,gBAAgB;AAAA,cAChB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,EAAE,QAAQA,QAAO,KAAK,OAAO;AAAA,YACrC,CAAC,CAAC;AAAA;AAAA,UACJ;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA,GAAG,OAAO,QAAQ;AAAA,UAClB;AAAA,YACE,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,YAClB;AAAA,YACA,MAAM,IAAI,gBAAgB;AAAA,cACxB,YAAY;AAAA,cACZ,aAAa,OAAO;AAAA,cACpB,WAAW,OAAO;AAAA,cAClB,MAAM;AAAA,YACR,CAAC,EAAE,SAAS;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAA0B;AAAA,UAC9B,SAAS;AAAA,UACT,MAAM;AAAA,UACN,UAAU,OAAO;AAAA,UACjB,WAAW,OAAO;AAAA,UAClB,cAAc,MAAM;AAAA,UACpB,eAAe,MAAM;AAAA,UACrB,YAAY,MAAM;AAAA,UAClB,OAAO,MAAM;AAAA,UACb,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,aAAa,GAAI,EAAE,YAAY;AAAA,QACrE;AACA,cAAMC,UAAS,MAAM,oBAAoB,KAAK,YAAY;AACxD,gBAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,cAAIL,oBAAmB,OAAO,EAAG,QAAO;AACxC,cACE,CAACC,8BAA6B,OAAO,KACrC,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,MAAM,GACjD;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,gBAAM,kCAAkC,KAAK,KAAK;AAClD,iBAAO;AAAA,QACT,CAAC;AACD,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,gBAAgB;AAAA,cAChB,OAAOI,QAAO;AAAA,YAChB;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AACA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,GAAG,OAAO,QAAQ,8BAA8B,OAAO,EAAE;AAAA,QACzD;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,gBAAgB,CAAC,GAAG,OAAO,iBAAiB;AAAA,QACvD;AAAA,MACF;AAEA,YAAM,SAA+B;AAAA,QACnC,UAAU,OAAO;AAAA,QACjB,IAAI,OAAO,KAAK,MAAM,OAAO;AAAA,QAC7B,QAAQ,OAAO,KAAK;AAAA,QACpB,cAAc,OAAO,KAAK,gBAAgB,OAAO;AAAA,QACjD,YACE,OAAO,KAAK,eAAe,SACvB,OAAO,aACP,OAAO,KAAK;AAAA,QAClB,UAAU,OAAO,KAAK,YAAY,OAAO;AAAA,QACzC,mBAAmB,OAAO;AAAA,MAC5B;AACA,YAAM,SAAS,MAAM,oBAAoB,KAAK,YAAY;AACxD,cAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,YAAI,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,MAAM,GAAG;AACtD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,kCAAkC,KAAK,MAAM;AACnD,eAAO;AAAA,MACT,CAAC;AAED,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,eAAe,MAAM;AAAA,QAC7B,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,OAAO,cAClB,OAAO,aAAa,aAAa,kBAAkB,IACnD,IAAI;AACR,QAAI,SAAS,QAAQ,KAAK;AAC1B,QAAI,uBAAuB;AAC3B,QAAI,OAAO,eAAe,CAAC,QAAQ;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,aAAa;AAClC,UAAI,SAAS,MAAM,sBAAsB,GAAG;AAC5C,UAAIL,oBAAmB,MAAM,KAAK,kBAAkB,MAAM,GAAG;AAC3D,iBAAS,MAAM,oBAAoB,KAAK,YAAY;AAClD,gBAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,cAAIA,oBAAmB,OAAO,KAAK,kBAAkB,OAAO,GAAG;AAC7D,mBAAO,wBAAwB,UAAU,KAAK,OAAO;AAAA,UACvD;AACA,iBAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,eAAS,wBAAwB,MAAM;AACvC,UAAI,QAAQ;AACV,+BAAuB,OAAO;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,WAAW;AAAA,MAC5B;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,OAAO,YAAY,MAAM;AAC3B,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,aAAO,MAAM,OAAO,GAAG;AAAA,IACzB,WAAW,OAAO,YAAY,WAAW;AACvC,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,aAAO,MAAM,OAAO,QAAQ;AAAA,IAC9B,WAAW,OAAO,YAAY,UAAU;AACtC,iBAAW,OAAO,SAAS,CAAC,aAAa,CAAC;AAC1C,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,MAAM,OAAO,OAAO;AAAA,QACzB,OAAO,OAAO,YAAY,CAAC;AAAA,QAC3B,YAAY;AAAA,UACV,OAAO,QAAQ,IAAI,aAAa;AAAA,UAChC;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,WAAW,OAAO,YAAY,SAAS;AACrC,iBAAW,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,MAAM,OAAO,QAAQ,IAAI,KAAK;AACpC,sBAAgB,MAAM,MAAM;AAC5B,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa,eAAe,OAAO,SAAS,cAAc;AAChE,UAAI,CAAC,kBAAkB,KAAK,UAAU,GAAG;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,OAAO,QAAQ,IAAI,QAAQ;AAC1C,YAAM,UAAU,OAAO,QAAQ,IAAI,MAAM;AACzC,UAAI;AACJ,UAAI,OAAO,YAAY,UAAU;AAC/B,YAAI;AACF,eAAK,MAAM,OAAO;AAAA,QACpB,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU;AAAA,QACd,OAAO,QAAQ,IAAI,QAAQ;AAAA,QAC3B,OAAO,YAAY;AAAA,MACrB;AACA,YAAM,UAA4B;AAAA,QAChC,KAAK,OAAO,YAAY,CAAC;AAAA,QACzB;AAAA,QACA,QACE,OAAO,WAAW,WACb,OAAO,YAAY,IACpB;AAAA,QACN;AAAA,QACA;AAAA,MACF;AACA,YAAM,cAAc,OAAO,QAAQ,IAAI,iBAAiB;AACxD,uBACE,OAAO,gBAAgB,WACnB,eACC,aAAa,0BAA0BM,aAAY;AAC1D,UAAI;AACJ,UAAI,CAAC,KAAK;AACR,YAAI;AACF,4BAAkB,MAAM,uBAAuB,GAAG;AAAA,QACpD,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,MAAM,OAAO,MAAM,SAAS,EAAE,eAAe,CAAC;AAC/D,aAAO,EAAE,iBAAiB,eAAe;AACzC,aAAO;AACP,YAAM,EAAE,YAAY,GAAG,QAAQ,IAAI;AACnC,wBAAkB;AAClB,UAAI,iBAAiB;AACnB,cAAM,YAAYP,MAAK,iBAAiB,MAAM;AAC9C,cAAM,cAAcA,MAAK,iBAAiB,cAAc;AACxD,cAAM,QACJ,OAAO,eAAe,WAClB,OAAO,KAAK,YAAY,QAAQ,IAChC;AACN,YAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,MAAM,YAAY;AACrD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,YACA,EAAE,SAAS,eAAe,MAAM;AAAA,UAClC;AAAA,QACF;AACA,YAAI;AACF,iBAAO;AAAA,YACL,GAAG;AAAA,YACH,YAAY;AAAA,YACZ,cAAc;AAAA,YACd,YAAY,MAAM;AAAA,UACpB;AACA,gBAAM;AAAA,YACJ;AAAA,YACA,GAAG,KAAK,UAAU,EAAE,gBAAgB,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA;AAAA,UACjE;AACA,gBAAM,gBAAgB,WAAW,KAAK;AACtC,iBAAO,EAAE,GAAG,SAAS,GAAG,aAAa,OAAO,SAAS,OAAO,EAAE;AAAA,QAChE,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,cACE;AAAA,cACA,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,iBAAW,OAAO,SAAS,CAAC,QAAQ,UAAU,CAAC;AAC/C,UAAI,OAAO,YAAY,SAAS,GAAG;AACjC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,OAAO,YAAY,CAAC,IACvB,MAAM,OAAO;AAAA,QACX,gBAAgB,OAAO,YAAY,CAAC,GAAG,aAAa;AAAA,MACtD,IACA,MAAM,OAAO,UAAU;AAAA,QACrB,MAAM,gBAAgB,OAAO,QAAQ,IAAI,MAAM,GAAG,QAAQ;AAAA,QAC1D,SAAS;AAAA,UACP,OAAO,QAAQ,IAAI,UAAU;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACP;AAEA,UAAM;AAAA,MACJ,GAAG,KAAK,UAAU;AAAA,QAChB,gBAAgB;AAAA,QAChB,IAAI;AAAA,QACJ;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,QACrC;AAAA,MACF,CAAC,CAAC;AAAA;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,aAAa,MAAM,eAAe,KAAK;AAC7C;AAAA,MACE,GAAG,KAAK,UAAU;AAAA,QAChB,gBAAgB;AAAA,QAChB,IAAI;AAAA,QACJ;AAAA,QACA,GAAI,mBAAmB,SACnB,CAAC,IACD,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,eAAe,EAAE;AAAA,QACzD,OAAO;AAAA,UACL,MAAM,WAAW;AAAA,UACjB,SAAS,WAAW;AAAA,UACpB,GAAI,WAAW,YAAY,SACvB,CAAC,IACD,EAAE,SAAS,WAAW,QAAQ;AAAA,QACpC;AAAA,MACF,CAAC,CAAC;AAAA;AAAA,IACJ;AACA,WAAO,WAAW;AAAA,EACpB;AACF;","names":["randomUUID","dirname","join","chmod","mkdir","open","resolve","dirname","join","isOAuthCredentials","isLegacyBootstrapCredentials","message","result","status","active","randomUUID"]}
+{"version":3,"sources":["../src/credentials.ts","../src/cli.ts","../src/results.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  chmod,\n  mkdir,\n  open,\n  readFile,\n  rename,\n  rm,\n  writeFile,\n} from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\n\nconst CREDENTIALS_FILE_MODE = 0o600;\nconst CREDENTIALS_DIR_MODE = 0o700;\nconst LOCK_RETRY_MS = 50;\nconst LOCK_TIMEOUT_MS = 10_000;\n\nexport interface BootstrapCredentials {\n  base_url: string;\n  id: string;\n  status: string;\n  capabilities: string[];\n  expires_at: string | null;\n  approval: {\n    method: string;\n    expires_in: number;\n    interval: number;\n    user_code?: string;\n  };\n  temporary_api_key: string;\n}\n\nexport interface LegacyBootstrapCredentials {\n  version: 1;\n  type: \"bootstrap\";\n  base_url: string;\n  bootstrap_id: string;\n  temporary_api_key: string;\n  device_code: string;\n  client_id: string;\n  expiry: string;\n  polling_interval: number;\n}\n\nexport interface OAuthCredentials {\n  version: 1;\n  type: \"oauth\";\n  base_url: string;\n  client_id: string;\n  access_token: string;\n  refresh_token: string;\n  token_type: string;\n  scope: string;\n  expiry: string;\n}\n\nexport type StoredCredentials =\n  BootstrapCredentials | LegacyBootstrapCredentials | OAuthCredentials;\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction isBootstrapCredentials(\n  value: Record<string, unknown>,\n): BootstrapCredentials | undefined {\n  if (\n    typeof value.base_url === \"string\" &&\n    typeof value.id === \"string\" &&\n    typeof value.status === \"string\" &&\n    Array.isArray(value.capabilities) &&\n    value.capabilities.every((capability) => typeof capability === \"string\") &&\n    (typeof value.expires_at === \"string\" || value.expires_at === null) &&\n    isObject(value.approval) &&\n    typeof value.approval.method === \"string\" &&\n    typeof value.approval.expires_in === \"number\" &&\n    typeof value.approval.interval === \"number\" &&\n    (value.approval.user_code === undefined ||\n      typeof value.approval.user_code === \"string\") &&\n    typeof value.temporary_api_key === \"string\"\n  ) {\n    return value as unknown as BootstrapCredentials;\n  }\n\n  return undefined;\n}\n\nfunction isLegacyBootstrapCredentials(\n  value: Record<string, unknown>,\n): LegacyBootstrapCredentials | undefined {\n  if (\n    value.version === 1 &&\n    value.type === \"bootstrap\" &&\n    typeof value.base_url === \"string\" &&\n    typeof value.bootstrap_id === \"string\" &&\n    typeof value.temporary_api_key === \"string\" &&\n    typeof value.device_code === \"string\" &&\n    typeof value.client_id === \"string\" &&\n    typeof value.expiry === \"string\" &&\n    typeof value.polling_interval === \"number\"\n  ) {\n    return value as unknown as LegacyBootstrapCredentials;\n  }\n\n  return undefined;\n}\n\nfunction isOAuthCredentials(\n  value: Record<string, unknown>,\n): OAuthCredentials | undefined {\n  if (\n    value.type === \"oauth\" &&\n    typeof value.version === \"number\" &&\n    typeof value.base_url === \"string\" &&\n    typeof value.client_id === \"string\" &&\n    typeof value.access_token === \"string\" &&\n    typeof value.refresh_token === \"string\" &&\n    typeof value.token_type === \"string\" &&\n    typeof value.scope === \"string\" &&\n    typeof value.expiry === \"string\"\n  ) {\n    return value as unknown as OAuthCredentials;\n  }\n\n  return undefined;\n}\n\nexport function resolveCredentialsPath(\n  env: Record<string, string | undefined>,\n): string | undefined {\n  if (env.WEFT_CREDENTIALS_FILE) return env.WEFT_CREDENTIALS_FILE;\n  if (env.XDG_CONFIG_HOME)\n    return `${env.XDG_CONFIG_HOME}/weft/credentials.json`;\n  const home = env.HOME || env.USERPROFILE;\n  if (!home) return undefined;\n  return `${home}/.config/weft/credentials.json`;\n}\n\nexport async function readStoredCredentials(\n  env: Record<string, string | undefined>,\n): Promise<StoredCredentials | undefined> {\n  const path = resolveCredentialsPath(env);\n  if (!path) return undefined;\n  try {\n    const raw = await readFile(path, \"utf8\");\n    const parsed: unknown = JSON.parse(raw);\n    if (!isObject(parsed)) throw new Error(\"Stored credentials malformed\");\n    return (\n      isBootstrapCredentials(parsed) ??\n      isLegacyBootstrapCredentials(parsed) ??\n      isOAuthCredentials(parsed)\n    );\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw error;\n  }\n}\n\nexport async function writeStoredCredentials(\n  env: Record<string, string | undefined>,\n  credentials: StoredCredentials,\n): Promise<void> {\n  await withCredentialsLock(env, () =>\n    writeStoredCredentialsWhileLocked(env, credentials),\n  );\n}\n\nexport async function writeStoredCredentialsWhileLocked(\n  env: Record<string, string | undefined>,\n  credentials: StoredCredentials,\n): Promise<void> {\n  const path = resolveCredentialsPath(env);\n  if (!path) {\n    throw new Error(\"HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required\");\n  }\n  const parent = dirname(path);\n  await mkdir(parent, { recursive: true, mode: CREDENTIALS_DIR_MODE });\n  await chmod(parent, CREDENTIALS_DIR_MODE);\n\n  const tempPath = `${path}.${randomUUID()}.tmp`;\n  try {\n    await writeFile(tempPath, JSON.stringify(credentials), {\n      mode: CREDENTIALS_FILE_MODE,\n    });\n    await rename(tempPath, path);\n    await chmod(path, CREDENTIALS_FILE_MODE);\n  } catch (error) {\n    await rm(tempPath, { force: true });\n    throw error;\n  }\n}\n\nexport async function withCredentialsLock<T>(\n  env: Record<string, string | undefined>,\n  action: () => Promise<T>,\n): Promise<T> {\n  const path = resolveCredentialsPath(env);\n  if (!path) {\n    throw new Error(\"HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required\");\n  }\n  const lockPath = `${path}.lock`;\n  const deadline = Date.now() + LOCK_TIMEOUT_MS;\n  await mkdir(dirname(path), { recursive: true, mode: CREDENTIALS_DIR_MODE });\n\n  for (;;) {\n    try {\n      const lock = await open(lockPath, \"wx\", CREDENTIALS_FILE_MODE);\n      await lock.close();\n      break;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n      if (Date.now() >= deadline) {\n        throw new Error(\n          `Timed out waiting for the credential lock; if no Weft CLI process is running, remove ${lockPath}`,\n        );\n      }\n      await delay(LOCK_RETRY_MS);\n    }\n  }\n\n  try {\n    return await action();\n  } finally {\n    await rm(lockPath, { force: true });\n  }\n}\n","import {\n  readStoredCredentials,\n  type BootstrapCredentials,\n  type LegacyBootstrapCredentials,\n  type OAuthCredentials,\n  type StoredCredentials,\n  withCredentialsLock,\n  writeStoredCredentials,\n  writeStoredCredentialsWhileLocked,\n} from \"./credentials\";\nimport { spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport {\n  readableBody,\n  reserveResultDirectory,\n  writeResultFile,\n} from \"./results\";\nimport {\n  type PaidFetchRequest,\n  ResponseError,\n  WeftClient,\n  WeftError,\n} from \"@weftlabs/sdk\";\n\nexport const EXIT_SUCCESS = 0;\nexport const EXIT_USAGE = 2;\nexport const EXIT_AUTH = 3;\nexport const EXIT_API = 4;\nexport const EXIT_INTERNAL = 5;\n\ntype Command =\n  | \"bootstrap\"\n  | \"auth\"\n  | \"skill\"\n  | \"me\"\n  | \"balance\"\n  | \"search\"\n  | \"fetch\"\n  | \"purchases\";\n\nconst COMMANDS: Command[] = [\n  \"bootstrap\",\n  \"auth\",\n  \"skill\",\n  \"me\",\n  \"balance\",\n  \"search\",\n  \"fetch\",\n  \"purchases\",\n];\n\nconst WEFT_API_BASE = \"https://weft.network\";\nconst OAUTH_HOST_NAME = \"Weft CLI\";\nconst OAUTH_REFRESH_SKEW_MS = 60_000;\nconst PROCESS_OUTPUT_LIMIT = 8_192;\nconst SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst CORE_SKILL_NAMES = new Set([\"weft\", \"weft-setup\"]);\n\nconst COMMAND_HELP = {\n  bootstrap: {\n    description: \"Bootstrap an agent account\",\n    usage: \"weft bootstrap --email <email> --agent-name <name> --reason <text>\",\n    options: [\n      \"--email <email>\",\n      \"--agent-name <name>\",\n      \"--reason <text>\",\n      \"[--base-url <url>]\",\n    ],\n  },\n  auth: {\n    description: \"Check bootstrap status\",\n    usage: \"weft auth status\",\n    options: [\"status\"],\n  },\n  skill: {\n    description: \"Install the core Weft Skill or one optional workflow Skill\",\n    usage: \"weft skill install [name --agent <agent> [--global]]\",\n    options: [\"install\", \"[name]\", \"--agent <agent>\", \"--global\"],\n  },\n  me: {\n    description: \"Return the authenticated principal\",\n    usage: \"weft me\",\n    options: [],\n  },\n  balance: {\n    description: \"Return wallet balance and spending policy\",\n    usage: \"weft balance\",\n    options: [],\n  },\n  search: {\n    description: \"Search for payable resources\",\n    usage: \"weft search <query> [--max-results <1..50>]\",\n    options: [\"--max-results <1..50>\"],\n  },\n  fetch: {\n    description: \"Fetch a URL within an explicit spending limit\",\n    usage:\n      \"weft fetch <url> --max-cost-usd <amount> [--method <method>] [--body <json>] [--header <name:value>]... [--idempotency-key <key>] [--raw]\",\n    options: [\n      \"--max-cost-usd <amount>\",\n      \"--method <method>\",\n      \"--body <json>\",\n      \"--header <name:value> (repeatable)\",\n      \"--idempotency-key <key>\",\n      \"--raw\",\n    ],\n  },\n  purchases: {\n    description: \"List purchases or return one purchase by ID\",\n    usage: \"weft purchases [id] [--page <number>] [--per-page <1..100>]\",\n    options: [\"--page <number>\", \"--per-page <1..100>\"],\n  },\n} satisfies Record<\n  Command,\n  { description: string; usage: string; options: string[] }\n>;\n\ninterface SkillInstallResult {\n  status: \"ok\" | \"skipped\";\n  reason?: string;\n  installed: number;\n  hosts: string[];\n  warnings: string[];\n}\n\ntype SkillInstaller = (options?: {\n  force?: boolean;\n  silent?: boolean;\n}) => Promise<SkillInstallResult>;\n\n/**\n * The Skill installer ships as a plain script beside `dist/`, and reads the\n * packed Skill relative to its own location. The specifier is built at runtime\n * so the bundler leaves it external and that relative path stays correct in the\n * published package.\n */\nasync function loadSkillInstaller(): Promise<SkillInstaller> {\n  const specifier = new URL(\"../scripts/install-skill.mjs\", import.meta.url)\n    .href;\n  const module = (await import(specifier)) as { installSkill: SkillInstaller };\n  return module.installSkill;\n}\n\n/**\n * Best-effort Skill installation on any ordinary command. This is the safety\n * net for a user who never runs `weft skill install`, and it is what lets the\n * Skill appear in an agent host that was installed after the CLI. It is\n * idempotent, it stays silent, and it never fails the command the user asked\n * for.\n */\nasync function installSkillInBackground(): Promise<void> {\n  try {\n    const installSkill = await loadSkillInstaller();\n    await installSkill({ silent: true });\n  } catch {\n    // Deliberately ignored — `weft skill install` is the surface that reports\n    // installation problems.\n  }\n}\n\ninterface BootstrapCreateResponse {\n  data: Omit<BootstrapCredentials, \"base_url\">;\n}\n\ninterface BootstrapStatus {\n  data: {\n    id?: string;\n    status: string;\n    expires_at?: string | null;\n    capabilities?: string[];\n    approval?: BootstrapCredentials[\"approval\"];\n  };\n}\n\ninterface OAuthTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  scope: string;\n}\n\nconst GLOBAL_OPTIONS = [\"--api-key-stdin\", \"--base-url <url>\", \"--help\", \"-h\"];\n\nexport interface CliDependencies {\n  env?: Record<string, string | undefined>;\n  fetchApi?: typeof fetch;\n  readStdin?: () => Promise<string>;\n  writeOut?: (value: string) => void | Promise<void>;\n  writeErr?: (value: string) => void;\n  generateIdempotencyKey?: () => string;\n  runProcess?: ProcessRunner;\n  platform?: NodeJS.Platform;\n  nodeExecutable?: string;\n  npxCliPath?: string;\n}\n\ninterface ProcessResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\ntype ProcessRunner = (\n  command: string,\n  args: string[],\n) => Promise<ProcessResult>;\n\ninterface ParsedArgs {\n  command: Command;\n  apiKeyStdin: boolean;\n  baseUrl?: string;\n  positionals: string[];\n  options: Map<string, string | true | string[]>;\n}\n\nclass CliError extends Error {\n  constructor(\n    readonly exitCode: number,\n    readonly code: string,\n    message: string,\n    readonly details?: unknown,\n  ) {\n    super(message);\n  }\n}\n\nfunction takeValue(\n  args: string[],\n  index: number,\n  option: string,\n): [string, number] {\n  const value = args[index + 1];\n  if (value == null || value.startsWith(\"--\")) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} requires a value`,\n    );\n  }\n  return [value, index + 1];\n}\n\nfunction appendBounded(current: string, chunk: Buffer | string): string {\n  return `${current}${chunk.toString()}`.slice(-PROCESS_OUTPUT_LIMIT);\n}\n\nfunction defaultRunProcess(\n  command: string,\n  args: string[],\n): Promise<ProcessResult> {\n  return new Promise((resolve) => {\n    const child = spawn(command, args, {\n      shell: false,\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      stdout = appendBounded(stdout, chunk);\n    });\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      stderr = appendBounded(stderr, chunk);\n    });\n    child.on(\"error\", (error) => {\n      resolve({\n        exitCode: 1,\n        stdout,\n        stderr: appendBounded(stderr, error.message),\n      });\n    });\n    child.on(\"close\", (exitCode) => {\n      resolve({ exitCode: exitCode ?? 1, stdout, stderr });\n    });\n  });\n}\n\nfunction resolveNpxCliPath(\n  env: Record<string, string | undefined>,\n  nodeExecutable: string,\n): string | undefined {\n  const executableDirectory = dirname(nodeExecutable);\n  const candidates = [\n    ...(env.npm_execpath\n      ? [join(dirname(env.npm_execpath), \"npx-cli.js\")]\n      : []),\n    join(executableDirectory, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\"),\n    join(\n      executableDirectory,\n      \"..\",\n      \"lib\",\n      \"node_modules\",\n      \"npm\",\n      \"bin\",\n      \"npx-cli.js\",\n    ),\n  ];\n  return candidates.find((candidate) => existsSync(candidate));\n}\n\nfunction npxProcessInvocation(\n  processArgs: string[],\n  dependencies: CliDependencies,\n  env: Record<string, string | undefined>,\n): { executable: string; arguments: string[] } {\n  if ((dependencies.platform ?? process.platform) !== \"win32\") {\n    return { executable: \"npx\", arguments: processArgs };\n  }\n\n  const nodeExecutable = dependencies.nodeExecutable ?? process.execPath;\n  const npxCliPath =\n    dependencies.npxCliPath ?? resolveNpxCliPath(env, nodeExecutable);\n  if (!npxCliPath) {\n    throw new CliError(\n      EXIT_INTERNAL,\n      \"NPX_NOT_FOUND\",\n      \"Could not find the npm npx program. Install npm, then run the command again.\",\n    );\n  }\n  return {\n    executable: nodeExecutable,\n    arguments: [npxCliPath, ...processArgs],\n  };\n}\n\nfunction rejectUnsafeCredentialArgument(args: string[]): void {\n  if (args.some((arg) => arg === \"--api-key\" || arg.startsWith(\"--api-key=\"))) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"UNSAFE_CREDENTIAL_ARGUMENT\",\n      \"API keys are accepted only through WEFT_API_KEY or --api-key-stdin\",\n    );\n  }\n}\n\nfunction requestedHelp(args: string[]): Command | \"all\" | undefined {\n  const isHelp = (value: string) => value === \"--help\" || value === \"-h\";\n  if (args.length === 1 && isHelp(args[0])) return \"all\";\n  if (\n    args.length === 2 &&\n    COMMANDS.includes(args[0] as Command) &&\n    isHelp(args[1])\n  ) {\n    return args[0] as Command;\n  }\n  return undefined;\n}\n\nfunction helpData(command: Command | \"all\") {\n  if (command !== \"all\") {\n    return {\n      command,\n      ...COMMAND_HELP[command],\n      global_options: GLOBAL_OPTIONS,\n    };\n  }\n  return {\n    usage: \"weft <command> [options]\",\n    commands: COMMANDS.map((name) => ({ name, ...COMMAND_HELP[name] })),\n    global_options: GLOBAL_OPTIONS,\n    authentication: [\"WEFT_API_KEY\", \"--api-key-stdin\"],\n    exit_codes: { success: 0, usage: 2, auth: 3, api: 4, internal: 5 },\n  };\n}\n\nfunction parseArgs(args: string[]): ParsedArgs {\n  let command: Command | undefined;\n  let apiKeyStdin = false;\n  let baseUrl: string | undefined;\n  const positionals: string[] = [];\n  const options = new Map<string, string | true | string[]>();\n\n  for (let index = 0; index < args.length; index += 1) {\n    const arg = args[index];\n    if (arg === \"--api-key-stdin\") {\n      apiKeyStdin = true;\n    } else if (arg === \"--base-url\") {\n      [baseUrl, index] = takeValue(args, index, arg);\n    } else if (arg === \"--global\" || arg === \"--raw\") {\n      options.set(arg.slice(2), true);\n    } else if (arg.startsWith(\"--\")) {\n      const [value, nextIndex] = takeValue(args, index, arg);\n      const name = arg.slice(2);\n      if (name === \"header\") {\n        const previous = options.get(name);\n        if (typeof previous === \"string\") {\n          options.set(name, [previous, value]);\n        } else if (Array.isArray(previous)) {\n          previous.push(value);\n        } else {\n          options.set(name, value);\n        }\n      } else {\n        options.set(name, value);\n      }\n      index = nextIndex;\n    } else if (!command) {\n      if (!COMMANDS.includes(arg as Command)) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"UNKNOWN_COMMAND\",\n          `Unknown command: ${arg}`,\n        );\n      }\n      command = arg as Command;\n    } else {\n      positionals.push(arg);\n    }\n  }\n\n  if (!command) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"COMMAND_REQUIRED\",\n      \"Command required: bootstrap, auth, me, balance, search, fetch, or purchases\",\n    );\n  }\n\n  return { command, apiKeyStdin, baseUrl, positionals, options };\n}\n\nfunction positiveInteger(\n  value: string | true | string[] | undefined,\n  option: string,\n  maximum?: number,\n): number | undefined {\n  if (value == null) return undefined;\n  if (typeof value !== \"string\") {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be a positive integer`,\n    );\n  }\n  const parsed = Number(value);\n  if (!Number.isInteger(parsed) || parsed <= 0) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be a positive integer`,\n    );\n  }\n  if (maximum != null && parsed > maximum) {\n    throw new CliError(\n      EXIT_USAGE,\n      \"INVALID_ARGUMENT\",\n      `${option} must be at most ${maximum}`,\n    );\n  }\n  return parsed;\n}\n\nfunction requiredOption(\n  options: Map<string, string | true | string[]>,\n  name: string,\n): string {\n  const value = options.get(name);\n  if (typeof value !== \"string\" || !value.trim()) {\n    throw new CliError(EXIT_USAGE, \"MISSING_ARGUMENT\", `--${name} is required`);\n  }\n  return value;\n}\n\nfunction fetchHeaders(\n  raw: string | true | string[] | undefined,\n  hasJsonBody: boolean,\n): PaidFetchRequest[\"headers\"] {\n  const values =\n    typeof raw === \"string\" ? [raw] : Array.isArray(raw) ? raw : [];\n  const headers: Record<string, string> = {};\n  for (const rawHeader of values) {\n    const colon = rawHeader.indexOf(\":\");\n    if (colon <= 0) {\n      throw new CliError(\n        EXIT_USAGE,\n        \"INVALID_ARGUMENT\",\n        \"--header must be Name:Value\",\n      );\n    }\n    headers[rawHeader.slice(0, colon).trim()] = rawHeader\n      .slice(colon + 1)\n      .trim();\n  }\n  if (\n    hasJsonBody &&\n    !Object.keys(headers).some((name) => name.toLowerCase() === \"content-type\")\n  ) {\n    headers[\"content-type\"] = \"application/json\";\n  }\n  return Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nfunction baseApiUrl(\n  baseUrl: string | undefined,\n  env: Record<string, string | undefined>,\n): string {\n  const raw = baseUrl ?? env.WEFT_BASE_URL ?? WEFT_API_BASE;\n  return raw.endsWith(\"/\") ? raw.slice(0, -1) : raw;\n}\n\nfunction resolveApiKeyFromStored(\n  credentials?: StoredCredentials,\n): string | undefined {\n  if (!credentials) return undefined;\n  if (\n    \"access_token\" in credentials &&\n    typeof credentials.access_token === \"string\" &&\n    credentials.access_token.trim()\n  ) {\n    return credentials.access_token;\n  }\n  if (\n    \"temporary_api_key\" in credentials &&\n    typeof credentials.temporary_api_key === \"string\" &&\n    credentials.temporary_api_key.trim()\n  ) {\n    return credentials.temporary_api_key;\n  }\n  return undefined;\n}\n\nfunction isOAuthCredentials(\n  credentials: StoredCredentials | undefined,\n): credentials is OAuthCredentials {\n  return Boolean(\n    credentials && \"type\" in credentials && credentials.type === \"oauth\",\n  );\n}\n\nfunction isLegacyBootstrapCredentials(\n  credentials: StoredCredentials | undefined,\n): credentials is LegacyBootstrapCredentials {\n  return Boolean(\n    credentials && \"type\" in credentials && credentials.type === \"bootstrap\",\n  );\n}\n\nfunction oauthNeedsRefresh(credentials: OAuthCredentials): boolean {\n  const expiry = Date.parse(credentials.expiry);\n  return (\n    !Number.isFinite(expiry) || expiry <= Date.now() + OAUTH_REFRESH_SKEW_MS\n  );\n}\n\nasync function refreshOAuthCredentials(\n  fetchApi: typeof fetch,\n  env: Record<string, string | undefined>,\n  stored: OAuthCredentials,\n): Promise<OAuthCredentials> {\n  const token = await requestJson<OAuthTokenResponse>(\n    fetchApi,\n    `${stored.base_url}/oauth/token`,\n    {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"refresh_token\",\n        refresh_token: stored.refresh_token,\n        client_id: stored.client_id,\n      }).toString(),\n    },\n    true,\n  );\n  const refreshed: OAuthCredentials = {\n    ...stored,\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    token_type: token.token_type,\n    scope: token.scope,\n    expiry: new Date(Date.now() + token.expires_in * 1000).toISOString(),\n  };\n  await writeStoredCredentialsWhileLocked(env, refreshed);\n  return refreshed;\n}\n\nfunction noSecretFields(data: object): Record<string, unknown> {\n  return {\n    ...data,\n    temporary_api_key: undefined,\n    access_token: undefined,\n    refresh_token: undefined,\n    client_secret: undefined,\n  };\n}\n\nasync function requestJson<T>(\n  fetchApi: typeof fetch,\n  url: string,\n  init: RequestInit,\n  redactError = false,\n): Promise<T> {\n  const response = await fetchApi(url, init);\n  if (!response.ok) {\n    if (redactError) {\n      throw new CliError(\n        response.status === 401 || response.status === 403\n          ? EXIT_AUTH\n          : response.status >= 500\n            ? EXIT_INTERNAL\n            : EXIT_API,\n        \"OAUTH_TOKEN_ERROR\",\n        `OAuth token request failed with HTTP ${response.status}`,\n      );\n    }\n    throw new ResponseError(response);\n  }\n\n  return (await response.json()) as T;\n}\n\nfunction withCredentials(\n  headers: Record<string, string>,\n  apiKey: string,\n): Record<string, string> {\n  return {\n    ...headers,\n    authorization: `Bearer ${apiKey}`,\n  };\n}\n\nfunction ensureOnly(\n  options: Map<string, string | true | string[]>,\n  allowed: string[],\n): void {\n  for (const name of options.keys()) {\n    if (!allowed.includes(name)) {\n      throw new CliError(\n        EXIT_USAGE,\n        \"UNKNOWN_OPTION\",\n        `Unknown option: --${name}`,\n      );\n    }\n  }\n}\n\nasync function responseDetails(error: ResponseError): Promise<unknown> {\n  try {\n    return await error.response.json();\n  } catch {\n    return undefined;\n  }\n}\n\nasync function normalizeError(error: unknown): Promise<CliError> {\n  if (error instanceof CliError) return error;\n  if (error instanceof WeftError) {\n    // status 0 is a transport failure with no API response; it exits like an\n    // internal failure, not an API rejection.\n    const exitCode =\n      error.status === 401 || error.status === 403\n        ? EXIT_AUTH\n        : error.status >= 500 || error.status === 0\n          ? EXIT_INTERNAL\n          : EXIT_API;\n    return new CliError(exitCode, error.code, error.message, error.details);\n  }\n  if (error instanceof ResponseError) {\n    const details = await responseDetails(error);\n    const body = details as\n      | {\n          error?: { code?: string; message?: string } | string;\n          error_description?: string;\n        }\n      | undefined;\n    const nested = typeof body?.error === \"object\" ? body.error : undefined;\n    const code =\n      nested?.code ??\n      (typeof body?.error === \"string\"\n        ? body.error\n        : `HTTP_${error.response.status}`);\n    const message =\n      nested?.message ??\n      body?.error_description ??\n      `Weft API returned HTTP ${error.response.status}`;\n    const exitCode =\n      error.response.status === 401 || error.response.status === 403\n        ? EXIT_AUTH\n        : error.response.status >= 500\n          ? EXIT_INTERNAL\n          : EXIT_API;\n    return new CliError(exitCode, code, message, details);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new CliError(EXIT_INTERNAL, \"INTERNAL_ERROR\", message);\n}\n\nasync function defaultReadStdin(): Promise<string> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of process.stdin) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n  }\n  return Buffer.concat(chunks).toString(\"utf8\");\n}\n\nasync function defaultWriteOut(value: string): Promise<void> {\n  await new Promise<void>((resolve, reject) => {\n    // The write callback reports failure before the stream emits its error.\n    // Keep the one-shot listener until that event to prevent an uncaught EPIPE.\n    const onError = (error: Error) => reject(error);\n    process.stdout.once(\"error\", onError);\n    process.stdout.write(value, (error) => {\n      if (error) {\n        reject(error);\n      } else {\n        process.stdout.removeListener(\"error\", onError);\n        resolve();\n      }\n    });\n  });\n}\n\nexport async function runCli(\n  args: string[],\n  dependencies: CliDependencies = {},\n): Promise<number> {\n  const outputWriter = dependencies.writeOut ?? defaultWriteOut;\n  const writeErr =\n    dependencies.writeErr ?? ((value) => process.stderr.write(value));\n  let command = \"unknown\";\n  let idempotencyKey: string | undefined;\n  let schemaVersion = \"1\";\n  let meta: Record<string, unknown> | undefined;\n  let deliveryReceipt: Record<string, unknown> | undefined;\n  const fetchApi = dependencies.fetchApi ?? fetch;\n  const writeOut = async (value: string) => {\n    try {\n      await outputWriter(value);\n    } catch {\n      throw new CliError(\n        EXIT_INTERNAL,\n        command === \"fetch\" ? \"RESULT_OUTPUT_FAILED\" : \"OUTPUT_FAILED\",\n        \"Cannot write stdout. Use the saved result paths below if present. Otherwise keep this receipt and retry the same fetch with --idempotency-key and the same key.\",\n        deliveryReceipt === undefined\n          ? undefined\n          : { receipt: deliveryReceipt },\n      );\n    }\n  };\n\n  try {\n    rejectUnsafeCredentialArgument(args);\n    const help = requestedHelp(args);\n    if (help !== undefined) {\n      command = \"help\";\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: helpData(help),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    const parsed = parseArgs(args);\n    command = parsed.command;\n    const env = dependencies.env ?? process.env;\n    const baseUrl = baseApiUrl(parsed.baseUrl, env);\n\n    if (parsed.command === \"skill\") {\n      if (\n        parsed.positionals[0] !== \"install\" ||\n        parsed.positionals.length > 2\n      ) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"skill requires 'install' and accepts at most one Skill name\",\n        );\n      }\n\n      const skillName = parsed.positionals[1];\n      if (skillName) {\n        ensureOnly(parsed.options, [\"agent\", \"global\"]);\n        const agent = requiredOption(parsed.options, \"agent\");\n        if (!SKILL_NAME_PATTERN.test(skillName)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"Skill name must contain only lowercase letters, numbers, and single hyphens\",\n          );\n        }\n        if (CORE_SKILL_NAMES.has(skillName)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            `Use 'weft skill install' without a name to install the core ${skillName} Skill`,\n          );\n        }\n        if (!SKILL_NAME_PATTERN.test(agent)) {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"Agent name must contain only lowercase letters, numbers, and single hyphens\",\n          );\n        }\n\n        const processArgs = [\n          \"--yes\",\n          \"skills\",\n          \"add\",\n          \"weftlabs/skills\",\n          \"--skill\",\n          skillName,\n          \"--agent\",\n          agent,\n          \"--yes\",\n          ...(parsed.options.get(\"global\") === true ? [\"--global\"] : []),\n        ];\n        const invocation = npxProcessInvocation(processArgs, dependencies, env);\n        const result = await (dependencies.runProcess ?? defaultRunProcess)(\n          invocation.executable,\n          invocation.arguments,\n        );\n        if (result.exitCode !== 0) {\n          const remediation = `npx ${processArgs.join(\" \")}`;\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"SKILL_INSTALL_FAILED\",\n            `Could not install ${skillName}. Run '${remediation}' directly for more detail.`,\n            {\n              executable: invocation.executable,\n              arguments: invocation.arguments,\n              exit_code: result.exitCode,\n              stderr: result.stderr,\n            },\n          );\n        }\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"installed\",\n              skill: skillName,\n              agent,\n              scope:\n                parsed.options.get(\"global\") === true ? \"global\" : \"project\",\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n\n      ensureOnly(parsed.options, []);\n      const installSkill = await loadSkillInstaller();\n      const result = await installSkill({ force: true });\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: {\n            status: result.status,\n            installed: result.installed,\n            hosts: result.hosts,\n            ...(result.reason === undefined ? {} : { reason: result.reason }),\n            ...(result.warnings.length === 0\n              ? {}\n              : { warnings: result.warnings }),\n          },\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    await installSkillInBackground();\n\n    if (parsed.command === \"bootstrap\") {\n      ensureOnly(parsed.options, [\"email\", \"agent-name\", \"reason\"]);\n      if (parsed.positionals.length !== 0) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"bootstrap does not accept positional arguments\",\n        );\n      }\n      const email = requiredOption(parsed.options, \"email\");\n      const agentName = requiredOption(parsed.options, \"agent-name\");\n      const reason = requiredOption(parsed.options, \"reason\");\n\n      const bootstrap = await requestJson<BootstrapCreateResponse>(\n        fetchApi,\n        `${baseUrl}/api/v1/account_bootstraps`,\n        {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n          },\n          body: JSON.stringify({\n            email,\n            agent_name: agentName,\n            host_name: OAUTH_HOST_NAME,\n            reason,\n          }),\n        },\n      );\n\n      const stored: BootstrapCredentials = {\n        ...bootstrap.data,\n        base_url: baseUrl,\n      };\n\n      await writeStoredCredentials(env, stored);\n\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: noSecretFields(stored),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    if (parsed.command === \"auth\") {\n      ensureOnly(parsed.options, []);\n      if (\n        parsed.positionals.length !== 1 ||\n        parsed.positionals[0] !== \"status\"\n      ) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"auth requires 'status'\",\n        );\n      }\n\n      const stored = await readStoredCredentials(env);\n      if (isOAuthCredentials(stored)) {\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"consumed\",\n              authentication: \"oauth\",\n              scope: stored.scope,\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n      if (isLegacyBootstrapCredentials(stored)) {\n        const status = await requestJson<BootstrapStatus>(\n          fetchApi,\n          `${stored.base_url}/api/v1/account_bootstraps/${stored.bootstrap_id}`,\n          {\n            method: \"GET\",\n            headers: withCredentials({}, stored.temporary_api_key),\n          },\n        );\n        if (\n          status.data.status !== \"claimed\" &&\n          status.data.status !== \"consumed\"\n        ) {\n          await writeOut(\n            `${JSON.stringify({\n              schema_version: \"1\",\n              ok: true,\n              command,\n              data: { status: status.data.status },\n            })}\\n`,\n          );\n          return EXIT_SUCCESS;\n        }\n\n        const token = await requestJson<OAuthTokenResponse>(\n          fetchApi,\n          `${stored.base_url}/oauth/token`,\n          {\n            method: \"POST\",\n            headers: {\n              \"content-type\": \"application/x-www-form-urlencoded\",\n            },\n            body: new URLSearchParams({\n              grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n              device_code: stored.device_code,\n              client_id: stored.client_id,\n              name: \"Weft CLI\",\n            }).toString(),\n          },\n          true,\n        );\n        const oauth: OAuthCredentials = {\n          version: 1,\n          type: \"oauth\",\n          base_url: stored.base_url,\n          client_id: stored.client_id,\n          access_token: token.access_token,\n          refresh_token: token.refresh_token,\n          token_type: token.token_type,\n          scope: token.scope,\n          expiry: new Date(Date.now() + token.expires_in * 1000).toISOString(),\n        };\n        const active = await withCredentialsLock(env, async () => {\n          const current = await readStoredCredentials(env);\n          if (isOAuthCredentials(current)) return current;\n          if (\n            !isLegacyBootstrapCredentials(current) ||\n            JSON.stringify(current) !== JSON.stringify(stored)\n          ) {\n            throw new CliError(\n              EXIT_AUTH,\n              \"CREDENTIALS_CHANGED\",\n              \"Stored credentials changed; rerun auth status\",\n            );\n          }\n          await writeStoredCredentialsWhileLocked(env, oauth);\n          return oauth;\n        });\n        await writeOut(\n          `${JSON.stringify({\n            schema_version: \"1\",\n            ok: true,\n            command,\n            data: {\n              status: \"consumed\",\n              authentication: \"oauth\",\n              scope: active.scope,\n            },\n          })}\\n`,\n        );\n        return EXIT_SUCCESS;\n      }\n      if (!stored) {\n        throw new CliError(\n          EXIT_AUTH,\n          \"BOOTSTRAP_REQUIRED\",\n          \"Run weft bootstrap before auth status\",\n        );\n      }\n\n      const status = await requestJson<BootstrapStatus>(\n        fetchApi,\n        `${stored.base_url}/api/v1/account_bootstraps/${stored.id}`,\n        {\n          method: \"GET\",\n          headers: withCredentials({}, stored.temporary_api_key),\n        },\n      );\n\n      const merged: BootstrapCredentials = {\n        base_url: stored.base_url,\n        id: status.data.id ?? stored.id,\n        status: status.data.status,\n        capabilities: status.data.capabilities ?? stored.capabilities,\n        expires_at:\n          status.data.expires_at === undefined\n            ? stored.expires_at\n            : status.data.expires_at,\n        approval: status.data.approval ?? stored.approval,\n        temporary_api_key: stored.temporary_api_key,\n      };\n      const active = await withCredentialsLock(env, async () => {\n        const current = await readStoredCredentials(env);\n        if (JSON.stringify(current) !== JSON.stringify(stored)) {\n          throw new CliError(\n            EXIT_AUTH,\n            \"CREDENTIALS_CHANGED\",\n            \"Stored credentials changed; rerun auth status\",\n          );\n        }\n        await writeStoredCredentialsWhileLocked(env, merged);\n        return merged;\n      });\n\n      await writeOut(\n        `${JSON.stringify({\n          schema_version: \"1\",\n          ok: true,\n          command,\n          data: noSecretFields(active),\n        })}\\n`,\n      );\n      return EXIT_SUCCESS;\n    }\n\n    const rawKey = parsed.apiKeyStdin\n      ? await (dependencies.readStdin ?? defaultReadStdin)()\n      : env.WEFT_API_KEY;\n    let apiKey = rawKey?.trim();\n    let authenticatedBaseUrl = baseUrl;\n    if (parsed.apiKeyStdin && !apiKey) {\n      throw new CliError(\n        EXIT_AUTH,\n        \"API_KEY_REQUIRED\",\n        \"--api-key-stdin requires a non-empty API key\",\n      );\n    }\n    if (!apiKey && !parsed.apiKeyStdin) {\n      let stored = await readStoredCredentials(env);\n      if (isOAuthCredentials(stored) && oauthNeedsRefresh(stored)) {\n        stored = await withCredentialsLock(env, async () => {\n          const current = await readStoredCredentials(env);\n          if (isOAuthCredentials(current) && oauthNeedsRefresh(current)) {\n            return refreshOAuthCredentials(fetchApi, env, current);\n          }\n          return current;\n        });\n      }\n      apiKey = resolveApiKeyFromStored(stored);\n      if (stored) {\n        authenticatedBaseUrl = stored.base_url;\n      }\n    }\n\n    if (!apiKey) {\n      throw new CliError(\n        EXIT_AUTH,\n        \"API_KEY_REQUIRED\",\n        \"Set WEFT_API_KEY, pass --api-key-stdin, or store credentials\",\n      );\n    }\n\n    const client = new WeftClient({\n      apiKey,\n      baseUrl: authenticatedBaseUrl,\n      fetchApi,\n    });\n\n    let data: unknown;\n    if (parsed.command === \"me\") {\n      ensureOnly(parsed.options, []);\n      data = await client.me();\n    } else if (parsed.command === \"balance\") {\n      ensureOnly(parsed.options, []);\n      data = await client.balance();\n    } else if (parsed.command === \"search\") {\n      ensureOnly(parsed.options, [\"max-results\"]);\n      if (parsed.positionals.length !== 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"search requires exactly one query\",\n        );\n      }\n      data = await client.search({\n        query: parsed.positionals[0],\n        maxResults: positiveInteger(\n          parsed.options.get(\"max-results\"),\n          \"--max-results\",\n          50,\n        ),\n      });\n    } else if (parsed.command === \"fetch\") {\n      ensureOnly(parsed.options, [\n        \"max-cost-usd\",\n        \"method\",\n        \"body\",\n        \"header\",\n        \"idempotency-key\",\n        \"raw\",\n      ]);\n      const raw = parsed.options.has(\"raw\");\n      schemaVersion = raw ? \"1\" : \"2\";\n      if (parsed.positionals.length !== 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"fetch requires exactly one URL\",\n        );\n      }\n      const maxCostUsd = requiredOption(parsed.options, \"max-cost-usd\");\n      if (!/^\\d+(?:\\.\\d+)?$/.test(maxCostUsd)) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"--max-cost-usd must be a non-negative decimal\",\n        );\n      }\n      const method = parsed.options.get(\"method\");\n      const rawBody = parsed.options.get(\"body\");\n      let body: PaidFetchRequest[\"body\"];\n      if (typeof rawBody === \"string\") {\n        try {\n          JSON.parse(rawBody);\n        } catch {\n          throw new CliError(\n            EXIT_USAGE,\n            \"INVALID_ARGUMENT\",\n            \"--body must be JSON\",\n          );\n        }\n        body = rawBody;\n      }\n      const headers = fetchHeaders(\n        parsed.options.get(\"header\"),\n        typeof rawBody === \"string\",\n      );\n      const request: PaidFetchRequest = {\n        url: parsed.positionals[0],\n        maxCostUsd,\n        method:\n          typeof method === \"string\"\n            ? (method.toUpperCase() as PaidFetchRequest[\"method\"])\n            : undefined,\n        body,\n        headers,\n      };\n      const explicitKey = parsed.options.get(\"idempotency-key\");\n      idempotencyKey =\n        typeof explicitKey === \"string\"\n          ? explicitKey\n          : (dependencies.generateIdempotencyKey ?? randomUUID)();\n      let resultDirectory: string | undefined;\n      if (!raw) {\n        try {\n          resultDirectory = await reserveResultDirectory(env);\n        } catch {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_STORAGE_UNAVAILABLE\",\n            \"Cannot reserve local result storage. Set WEFT_RESULTS_DIR to a directory you own that is writable only by you, with no symlink at that path, then retry. No fetch was sent.\",\n          );\n        }\n      }\n      const response = await client.fetch(request, { idempotencyKey });\n      meta = { idempotency_key: idempotencyKey };\n      data = response;\n      const { bodyBase64, ...receipt } = response;\n      deliveryReceipt = receipt;\n      if (resultDirectory) {\n        const savedPath = join(resultDirectory, \"body\");\n        const receiptPath = join(resultDirectory, \"receipt.json\");\n        const bytes =\n          typeof bodyBase64 === \"string\"\n            ? Buffer.from(bodyBase64, \"base64\")\n            : undefined;\n        if (!bytes || bytes.toString(\"base64\") !== bodyBase64) {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_DECODE_FAILED\",\n            \"Fetch returned invalid Base64. No body was saved. Keep this receipt and retry the same request with --idempotency-key and the same key; if it persists, report the artifact ID to support.\",\n            { receipt, file_complete: false },\n          );\n        }\n        try {\n          meta = {\n            ...meta,\n            saved_path: savedPath,\n            receipt_path: receiptPath,\n            byte_count: bytes.length,\n          };\n          await writeResultFile(\n            receiptPath,\n            `${JSON.stringify({ schema_version: \"2\", meta, data: receipt })}\\n`,\n          );\n          await writeResultFile(savedPath, bytes);\n          data = { ...receipt, ...readableBody(bytes, response.headers) };\n        } catch {\n          throw new CliError(\n            EXIT_INTERNAL,\n            \"RESULT_STORAGE_FAILED\",\n            \"Fetch returned, but local result delivery failed. Keep this receipt. Check local storage, then retry the same request with --idempotency-key and the key below. Do not use a new key.\",\n            {\n              receipt,\n              saved_path: savedPath,\n              receipt_path: receiptPath,\n              file_complete: false,\n            },\n          );\n        }\n      }\n    } else {\n      ensureOnly(parsed.options, [\"page\", \"per-page\"]);\n      if (parsed.positionals.length > 1) {\n        throw new CliError(\n          EXIT_USAGE,\n          \"INVALID_ARGUMENT\",\n          \"purchases accepts at most one purchase ID\",\n        );\n      }\n      data = parsed.positionals[0]\n        ? await client.purchase(\n            positiveInteger(parsed.positionals[0], \"purchase ID\")!,\n          )\n        : await client.purchases({\n            page: positiveInteger(parsed.options.get(\"page\"), \"--page\"),\n            perPage: positiveInteger(\n              parsed.options.get(\"per-page\"),\n              \"--per-page\",\n              100,\n            ),\n          });\n    }\n\n    await writeOut(\n      `${JSON.stringify({\n        schema_version: schemaVersion,\n        ok: true,\n        command,\n        ...(meta === undefined ? {} : { meta }),\n        data,\n      })}\\n`,\n    );\n    return EXIT_SUCCESS;\n  } catch (error) {\n    const normalized = await normalizeError(error);\n    writeErr(\n      `${JSON.stringify({\n        schema_version: schemaVersion,\n        ok: false,\n        command,\n        ...(idempotencyKey === undefined\n          ? {}\n          : { meta: { ...meta, idempotency_key: idempotencyKey } }),\n        error: {\n          code: normalized.code,\n          message: normalized.message,\n          ...(normalized.details === undefined\n            ? {}\n            : { details: normalized.details }),\n        },\n      })}\\n`,\n    );\n    return normalized.exitCode;\n  }\n}\n","import { chmod, lstat, mkdir, mkdtemp, open, realpath } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport async function reserveResultDirectory(\n  env: Record<string, string | undefined>,\n): Promise<string> {\n  const root = resolve(\n    env.WEFT_RESULTS_DIR ||\n      join(env.HOME || env.USERPROFILE || homedir(), \".weft-results\"),\n  );\n  await mkdir(root, { recursive: true, mode: 0o700 });\n  const stat = await lstat(root);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) {\n    throw new Error(\n      \"The result storage root must be a directory, not a symlink\",\n    );\n  }\n  if (\n    process.platform !== \"win32\" &&\n    ((stat.mode & 0o022) !== 0 || stat.uid !== process.getuid?.())\n  ) {\n    throw new Error(\n      \"The result storage root must be owned by this user and not writable by others\",\n    );\n  }\n  // A private child keeps payloads protected without changing an existing parent.\n  const directory = await mkdtemp(join(await realpath(root), \"result-\"));\n  await chmod(directory, 0o700);\n  return directory;\n}\n\nexport async function writeResultFile(\n  path: string,\n  contents: string | Buffer,\n): Promise<void> {\n  const file = await open(path, \"wx\", 0o600);\n  try {\n    await file.chmod(0o600);\n    await file.writeFile(contents);\n    await file.sync();\n  } finally {\n    await file.close();\n  }\n}\n\nexport function readableBody(\n  bytes: Buffer,\n  headers: Record<string, string>,\n): {\n  media_type: string | null;\n  body_encoding: \"utf-8\" | \"file\";\n  body?: string;\n} {\n  const header = (name: string) =>\n    Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];\n  const contentType = header(\"content-type\")?.toLowerCase() ?? \"\";\n  const mediaType = contentType.split(\";\", 1)[0].trim();\n  const charset = /(?:^|;)\\s*charset\\s*=\\s*\"?([^;\"\\s]+)/.exec(contentType)?.[1];\n  const encoding = header(\"content-encoding\")?.trim().toLowerCase();\n  const file = {\n    media_type: mediaType || null,\n    body_encoding: \"file\" as const,\n  };\n  const textual =\n    mediaType.startsWith(\"text/\") ||\n    /^application\\/(?:json|xml|javascript|x-ndjson|x-www-form-urlencoded|[^;]+\\+(?:json|xml))$/.test(\n      mediaType,\n    );\n  if (\n    (encoding && encoding !== \"identity\") ||\n    (charset && ![\"utf-8\", \"utf8\", \"us-ascii\"].includes(charset)) ||\n    (!textual && !(bytes.length === 0 && !mediaType))\n  )\n    return file;\n  try {\n    // Keep a UTF-8 BOM and JSON spelling exactly as delivered.\n    const body = new TextDecoder(\"utf-8\", {\n      fatal: true,\n      ignoreBOM: true,\n    }).decode(bytes);\n    return { media_type: mediaType || null, body_encoding: \"utf-8\", body };\n  } catch {\n    return file;\n  }\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,cAAc,aAAa;AAEpC,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AA4CxB,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEA,SAAS,uBACP,OACkC;AAClC,MACE,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,WAAW,YACxB,MAAM,QAAQ,MAAM,YAAY,KAChC,MAAM,aAAa,MAAM,CAAC,eAAe,OAAO,eAAe,QAAQ,MACtE,OAAO,MAAM,eAAe,YAAY,MAAM,eAAe,SAC9D,SAAS,MAAM,QAAQ,KACvB,OAAO,MAAM,SAAS,WAAW,YACjC,OAAO,MAAM,SAAS,eAAe,YACrC,OAAO,MAAM,SAAS,aAAa,aAClC,MAAM,SAAS,cAAc,UAC5B,OAAO,MAAM,SAAS,cAAc,aACtC,OAAO,MAAM,sBAAsB,UACnC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,6BACP,OACwC;AACxC,MACE,MAAM,YAAY,KAClB,MAAM,SAAS,eACf,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,sBAAsB,YACnC,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,qBAAqB,UAClC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,OAC8B;AAC9B,MACE,MAAM,SAAS,WACf,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,kBAAkB,YAC/B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,UAAU,YACvB,OAAO,MAAM,WAAW,UACxB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,uBACd,KACoB;AACpB,MAAI,IAAI,sBAAuB,QAAO,IAAI;AAC1C,MAAI,IAAI;AACN,WAAO,GAAG,IAAI,eAAe;AAC/B,QAAM,OAAO,IAAI,QAAQ,IAAI;AAC7B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,GAAG,IAAI;AAChB;AAEA,eAAsB,sBACpB,KACwC;AACxC,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,MAAM,MAAM;AACvC,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,8BAA8B;AACrE,WACE,uBAAuB,MAAM,KAC7B,6BAA6B,MAAM,KACnC,mBAAmB,MAAM;AAAA,EAE7B,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,uBACpB,KACA,aACe;AACf,QAAM;AAAA,IAAoB;AAAA,IAAK,MAC7B,kCAAkC,KAAK,WAAW;AAAA,EACpD;AACF;AAEA,eAAsB,kCACpB,KACA,aACe;AACf,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,MAAM,qBAAqB,CAAC;AACnE,QAAM,MAAM,QAAQ,oBAAoB;AAExC,QAAM,WAAW,GAAG,IAAI,IAAI,WAAW,CAAC;AACxC,MAAI;AACF,UAAM,UAAU,UAAU,KAAK,UAAU,WAAW,GAAG;AAAA,MACrD,MAAM;AAAA,IACR,CAAC;AACD,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,MAAM,MAAM,qBAAqB;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC;AAClC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,oBACpB,KACA,QACY;AACZ,QAAM,OAAO,uBAAuB,GAAG;AACvC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,WAAW,GAAG,IAAI;AACxB,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,qBAAqB,CAAC;AAE1E,aAAS;AACP,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,UAAU,MAAM,qBAAqB;AAC7D,YAAM,KAAK,MAAM;AACjB;AAAA,IACF,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAC9D,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM,IAAI;AAAA,UACR,wFAAwF,QAAQ;AAAA,QAClG;AAAA,MACF;AACA,YAAM,MAAM,aAAa;AAAA,IAC3B;AAAA,EACF;AAEA,MAAI;AACF,WAAO,MAAM,OAAO;AAAA,EACtB,UAAE;AACA,UAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC;AAAA,EACpC;AACF;;;ACxNA,SAAS,aAAa;AACtB,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACb9B,SAAS,SAAAC,QAAO,OAAO,SAAAC,QAAO,SAAS,QAAAC,OAAM,gBAAgB;AAC7D,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAE9B,eAAsB,uBACpB,KACiB;AACjB,QAAM,OAAO;AAAA,IACX,IAAI,oBACF,KAAK,IAAI,QAAQ,IAAI,eAAe,QAAQ,GAAG,eAAe;AAAA,EAClE;AACA,QAAMD,OAAM,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,MAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,GAAG;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,aAAa,aACnB,KAAK,OAAO,QAAW,KAAK,KAAK,QAAQ,QAAQ,SAAS,IAC5D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,SAAS,IAAI,GAAG,SAAS,CAAC;AACrE,QAAMD,OAAM,WAAW,GAAK;AAC5B,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,UACe;AACf,QAAM,OAAO,MAAME,MAAK,MAAM,MAAM,GAAK;AACzC,MAAI;AACF,UAAM,KAAK,MAAM,GAAK;AACtB,UAAM,KAAK,UAAU,QAAQ;AAC7B,UAAM,KAAK,KAAK;AAAA,EAClB,UAAE;AACA,UAAM,KAAK,MAAM;AAAA,EACnB;AACF;AAEO,SAAS,aACd,OACA,SAKA;AACA,QAAM,SAAS,CAAC,SACd,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,IAAI,IAAI,CAAC;AACzE,QAAM,cAAc,OAAO,cAAc,GAAG,YAAY,KAAK;AAC7D,QAAM,YAAY,YAAY,MAAM,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK;AACpD,QAAM,UAAU,uCAAuC,KAAK,WAAW,IAAI,CAAC;AAC5E,QAAM,WAAW,OAAO,kBAAkB,GAAG,KAAK,EAAE,YAAY;AAChE,QAAM,OAAO;AAAA,IACX,YAAY,aAAa;AAAA,IACzB,eAAe;AAAA,EACjB;AACA,QAAM,UACJ,UAAU,WAAW,OAAO,KAC5B,4FAA4F;AAAA,IAC1F;AAAA,EACF;AACF,MACG,YAAY,aAAa,cACzB,WAAW,CAAC,CAAC,SAAS,QAAQ,UAAU,EAAE,SAAS,OAAO,KAC1D,CAAC,WAAW,EAAE,MAAM,WAAW,KAAK,CAAC;AAEtC,WAAO;AACT,MAAI;AAEF,UAAM,OAAO,IAAI,YAAY,SAAS;AAAA,MACpC,OAAO;AAAA,MACP,WAAW;AAAA,IACb,CAAC,EAAE,OAAO,KAAK;AACf,WAAO,EAAE,YAAY,aAAa,MAAM,eAAe,SAAS,KAAK;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADlEA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,IAAM,eAAe;AACrB,IAAM,aAAa;AACnB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,gBAAgB;AAY7B,IAAM,WAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAEvD,IAAM,eAAe;AAAA,EACnB,WAAW;AAAA,IACT,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,QAAQ;AAAA,EACpB;AAAA,EACA,OAAO;AAAA,IACL,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,WAAW,UAAU,mBAAmB,UAAU;AAAA,EAC9D;AAAA,EACA,IAAI;AAAA,IACF,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,IACP,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,EACZ;AAAA,EACA,QAAQ;AAAA,IACN,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,uBAAuB;AAAA,EACnC;AAAA,EACA,OAAO;AAAA,IACL,aAAa;AAAA,IACb,OACE;AAAA,IACF,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,aAAa;AAAA,IACb,OAAO;AAAA,IACP,SAAS,CAAC,mBAAmB,qBAAqB;AAAA,EACpD;AACF;AAwBA,eAAe,qBAA8C;AAC3D,QAAM,YAAY,IAAI,IAAI,gCAAgC,YAAY,GAAG,EACtE;AACH,QAAM,SAAU,MAAM,OAAO;AAC7B,SAAO,OAAO;AAChB;AASA,eAAe,2BAA0C;AACvD,MAAI;AACF,UAAM,eAAe,MAAM,mBAAmB;AAC9C,UAAM,aAAa,EAAE,QAAQ,KAAK,CAAC;AAAA,EACrC,QAAQ;AAAA,EAGR;AACF;AAwBA,IAAM,iBAAiB,CAAC,mBAAmB,oBAAoB,UAAU,IAAI;AAkC7E,IAAM,WAAN,cAAuB,MAAM;AAAA,EAC3B,YACW,UACA,MACT,SACS,SACT;AACA,UAAM,OAAO;AALJ;AACA;AAEA;AAAA,EAGX;AACF;AAEA,SAAS,UACP,MACA,OACA,QACkB;AAClB,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,SAAS,QAAQ,MAAM,WAAW,IAAI,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,SAAO,CAAC,OAAO,QAAQ,CAAC;AAC1B;AAEA,SAAS,cAAc,SAAiB,OAAgC;AACtE,SAAO,GAAG,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,oBAAoB;AACpE;AAEA,SAAS,kBACP,SACA,MACwB;AACxB,SAAO,IAAI,QAAQ,CAACC,aAAY;AAC9B,UAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,MACjC,OAAO;AAAA,MACP,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,QAAI,SAAS;AACb,QAAI,SAAS;AACb,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,UAAU;AAC3B,MAAAA,SAAQ;AAAA,QACN,UAAU;AAAA,QACV;AAAA,QACA,QAAQ,cAAc,QAAQ,MAAM,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,aAAa;AAC9B,MAAAA,SAAQ,EAAE,UAAU,YAAY,GAAG,QAAQ,OAAO,CAAC;AAAA,IACrD,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,kBACP,KACA,gBACoB;AACpB,QAAM,sBAAsBC,SAAQ,cAAc;AAClD,QAAM,aAAa;AAAA,IACjB,GAAI,IAAI,eACJ,CAACC,MAAKD,SAAQ,IAAI,YAAY,GAAG,YAAY,CAAC,IAC9C,CAAC;AAAA,IACLC,MAAK,qBAAqB,gBAAgB,OAAO,OAAO,YAAY;AAAA,IACpEA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,WAAW,KAAK,CAAC,cAAc,WAAW,SAAS,CAAC;AAC7D;AAEA,SAAS,qBACP,aACA,cACA,KAC6C;AAC7C,OAAK,aAAa,YAAY,QAAQ,cAAc,SAAS;AAC3D,WAAO,EAAE,YAAY,OAAO,WAAW,YAAY;AAAA,EACrD;AAEA,QAAM,iBAAiB,aAAa,kBAAkB,QAAQ;AAC9D,QAAM,aACJ,aAAa,cAAc,kBAAkB,KAAK,cAAc;AAClE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,CAAC,YAAY,GAAG,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,+BAA+B,MAAsB;AAC5D,MAAI,KAAK,KAAK,CAAC,QAAQ,QAAQ,eAAe,IAAI,WAAW,YAAY,CAAC,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAA6C;AAClE,QAAM,SAAS,CAAC,UAAkB,UAAU,YAAY,UAAU;AAClE,MAAI,KAAK,WAAW,KAAK,OAAO,KAAK,CAAC,CAAC,EAAG,QAAO;AACjD,MACE,KAAK,WAAW,KAChB,SAAS,SAAS,KAAK,CAAC,CAAY,KACpC,OAAO,KAAK,CAAC,CAAC,GACd;AACA,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,SAAS,SAA0B;AAC1C,MAAI,YAAY,OAAO;AACrB,WAAO;AAAA,MACL;AAAA,MACA,GAAG,aAAa,OAAO;AAAA,MACvB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,UAAU,SAAS,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,IAAI,EAAE,EAAE;AAAA,IAClE,gBAAgB;AAAA,IAChB,gBAAgB,CAAC,gBAAgB,iBAAiB;AAAA,IAClD,YAAY,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,EAAE;AAAA,EACnE;AACF;AAEA,SAAS,UAAU,MAA4B;AAC7C,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACJ,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAU,oBAAI,IAAsC;AAE1D,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,MAAM,KAAK,KAAK;AACtB,QAAI,QAAQ,mBAAmB;AAC7B,oBAAc;AAAA,IAChB,WAAW,QAAQ,cAAc;AAC/B,OAAC,SAAS,KAAK,IAAI,UAAU,MAAM,OAAO,GAAG;AAAA,IAC/C,WAAW,QAAQ,cAAc,QAAQ,SAAS;AAChD,cAAQ,IAAI,IAAI,MAAM,CAAC,GAAG,IAAI;AAAA,IAChC,WAAW,IAAI,WAAW,IAAI,GAAG;AAC/B,YAAM,CAAC,OAAO,SAAS,IAAI,UAAU,MAAM,OAAO,GAAG;AACrD,YAAM,OAAO,IAAI,MAAM,CAAC;AACxB,UAAI,SAAS,UAAU;AACrB,cAAM,WAAW,QAAQ,IAAI,IAAI;AACjC,YAAI,OAAO,aAAa,UAAU;AAChC,kBAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;AAAA,QACrC,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,mBAAS,KAAK,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,IAAI,MAAM,KAAK;AAAA,QACzB;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI,MAAM,KAAK;AAAA,MACzB;AACA,cAAQ;AAAA,IACV,WAAW,CAAC,SAAS;AACnB,UAAI,CAAC,SAAS,SAAS,GAAc,GAAG;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA,oBAAoB,GAAG;AAAA,QACzB;AAAA,MACF;AACA,gBAAU;AAAA,IACZ,OAAO;AACL,kBAAY,KAAK,GAAG;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,aAAa,SAAS,aAAa,QAAQ;AAC/D;AAEA,SAAS,gBACP,OACA,QACA,SACoB;AACpB,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,MAAI,WAAW,QAAQ,SAAS,SAAS;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,MAAM,oBAAoB,OAAO;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,SACA,MACQ;AACR,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,SAAS,YAAY,oBAAoB,KAAK,IAAI,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,aACP,KACA,aAC6B;AAC7B,QAAM,SACJ,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC;AAChE,QAAM,UAAkC,CAAC;AACzC,aAAW,aAAa,QAAQ;AAC9B,UAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,QAAI,SAAS,GAAG;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,YAAQ,UAAU,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,UACzC,MAAM,QAAQ,CAAC,EACf,KAAK;AAAA,EACV;AACA,MACE,eACA,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,YAAY,MAAM,cAAc,GAC1E;AACA,YAAQ,cAAc,IAAI;AAAA,EAC5B;AACA,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAAS,WACP,SACA,KACQ;AACR,QAAM,MAAM,WAAW,IAAI,iBAAiB;AAC5C,SAAO,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,IAAI;AAChD;AAEA,SAAS,wBACP,aACoB;AACpB,MAAI,CAAC,YAAa,QAAO;AACzB,MACE,kBAAkB,eAClB,OAAO,YAAY,iBAAiB,YACpC,YAAY,aAAa,KAAK,GAC9B;AACA,WAAO,YAAY;AAAA,EACrB;AACA,MACE,uBAAuB,eACvB,OAAO,YAAY,sBAAsB,YACzC,YAAY,kBAAkB,KAAK,GACnC;AACA,WAAO,YAAY;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAASC,oBACP,aACiC;AACjC,SAAO;AAAA,IACL,eAAe,UAAU,eAAe,YAAY,SAAS;AAAA,EAC/D;AACF;AAEA,SAASC,8BACP,aAC2C;AAC3C,SAAO;AAAA,IACL,eAAe,UAAU,eAAe,YAAY,SAAS;AAAA,EAC/D;AACF;AAEA,SAAS,kBAAkB,aAAwC;AACjE,QAAM,SAAS,KAAK,MAAM,YAAY,MAAM;AAC5C,SACE,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AAEvD;AAEA,eAAe,wBACb,UACA,KACA,QAC2B;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,OAAO;AAAA,QACtB,WAAW,OAAO;AAAA,MACpB,CAAC,EAAE,SAAS;AAAA,IACd;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAA8B;AAAA,IAClC,GAAG;AAAA,IACH,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,OAAO,MAAM;AAAA,IACb,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,aAAa,GAAI,EAAE,YAAY;AAAA,EACrE;AACA,QAAM,kCAAkC,KAAK,SAAS;AACtD,SAAO;AACT;AAEA,SAAS,eAAe,MAAuC;AAC7D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,eAAe;AAAA,IACf,eAAe;AAAA,EACjB;AACF;AAEA,eAAe,YACb,UACA,KACA,MACA,cAAc,OACF;AACZ,QAAM,WAAW,MAAM,SAAS,KAAK,IAAI;AACzC,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,aAAa;AACf,YAAM,IAAI;AAAA,QACR,SAAS,WAAW,OAAO,SAAS,WAAW,MAC3C,YACA,SAAS,UAAU,MACjB,gBACA;AAAA,QACN;AAAA,QACA,wCAAwC,SAAS,MAAM;AAAA,MACzD;AAAA,IACF;AACA,UAAM,IAAI,cAAc,QAAQ;AAAA,EAClC;AAEA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAEA,SAAS,gBACP,SACA,QACwB;AACxB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,eAAe,UAAU,MAAM;AAAA,EACjC;AACF;AAEA,SAAS,WACP,SACA,SACM;AACN,aAAW,QAAQ,QAAQ,KAAK,GAAG;AACjC,QAAI,CAAC,QAAQ,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,qBAAqB,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBAAgB,OAAwC;AACrE,MAAI;AACF,WAAO,MAAM,MAAM,SAAS,KAAK;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eAAe,OAAmC;AAC/D,MAAI,iBAAiB,SAAU,QAAO;AACtC,MAAI,iBAAiB,WAAW;AAG9B,UAAM,WACJ,MAAM,WAAW,OAAO,MAAM,WAAW,MACrC,YACA,MAAM,UAAU,OAAO,MAAM,WAAW,IACtC,gBACA;AACR,WAAO,IAAI,SAAS,UAAU,MAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AAAA,EACxE;AACA,MAAI,iBAAiB,eAAe;AAClC,UAAM,UAAU,MAAM,gBAAgB,KAAK;AAC3C,UAAM,OAAO;AAMb,UAAM,SAAS,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC9D,UAAM,OACJ,QAAQ,SACP,OAAO,MAAM,UAAU,WACpB,KAAK,QACL,QAAQ,MAAM,SAAS,MAAM;AACnC,UAAMC,WACJ,QAAQ,WACR,MAAM,qBACN,0BAA0B,MAAM,SAAS,MAAM;AACjD,UAAM,WACJ,MAAM,SAAS,WAAW,OAAO,MAAM,SAAS,WAAW,MACvD,YACA,MAAM,SAAS,UAAU,MACvB,gBACA;AACR,WAAO,IAAI,SAAS,UAAU,MAAMA,UAAS,OAAO;AAAA,EACtD;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,SAAS,eAAe,kBAAkB,OAAO;AAC9D;AAEA,eAAe,mBAAoC;AACjD,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,QAAQ,OAAO;AACvC,WAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,EACjE;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAC9C;AAEA,eAAe,gBAAgB,OAA8B;AAC3D,QAAM,IAAI,QAAc,CAACL,UAAS,WAAW;AAG3C,UAAM,UAAU,CAAC,UAAiB,OAAO,KAAK;AAC9C,YAAQ,OAAO,KAAK,SAAS,OAAO;AACpC,YAAQ,OAAO,MAAM,OAAO,CAAC,UAAU;AACrC,UAAI,OAAO;AACT,eAAO,KAAK;AAAA,MACd,OAAO;AACL,gBAAQ,OAAO,eAAe,SAAS,OAAO;AAC9C,QAAAA,SAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,OACpB,MACA,eAAgC,CAAC,GAChB;AACjB,QAAM,eAAe,aAAa,YAAY;AAC9C,QAAM,WACJ,aAAa,aAAa,CAAC,UAAU,QAAQ,OAAO,MAAM,KAAK;AACjE,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,gBAAgB;AACpB,MAAI;AACJ,MAAI;AACJ,QAAM,WAAW,aAAa,YAAY;AAC1C,QAAM,WAAW,OAAO,UAAkB;AACxC,QAAI;AACF,YAAM,aAAa,KAAK;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,UAAU,yBAAyB;AAAA,QAC/C;AAAA,QACA,oBAAoB,SAChB,SACA,EAAE,SAAS,gBAAgB;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,mCAA+B,IAAI;AACnC,UAAM,OAAO,cAAc,IAAI;AAC/B,QAAI,SAAS,QAAW;AACtB,gBAAU;AACV,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,SAAS,IAAI;AAAA,QACrB,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,UAAU,IAAI;AAC7B,cAAU,OAAO;AACjB,UAAM,MAAM,aAAa,OAAO,QAAQ;AACxC,UAAM,UAAU,WAAW,OAAO,SAAS,GAAG;AAE9C,QAAI,OAAO,YAAY,SAAS;AAC9B,UACE,OAAO,YAAY,CAAC,MAAM,aAC1B,OAAO,YAAY,SAAS,GAC5B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,YAAY,OAAO,YAAY,CAAC;AACtC,UAAI,WAAW;AACb,mBAAW,OAAO,SAAS,CAAC,SAAS,QAAQ,CAAC;AAC9C,cAAM,QAAQ,eAAe,OAAO,SAAS,OAAO;AACpD,YAAI,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACvC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,iBAAiB,IAAI,SAAS,GAAG;AACnC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,+DAA+D,SAAS;AAAA,UAC1E;AAAA,QACF;AACA,YAAI,CAAC,mBAAmB,KAAK,KAAK,GAAG;AACnC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM,OAAO,CAAC,UAAU,IAAI,CAAC;AAAA,QAC9D;AACA,cAAM,aAAa,qBAAqB,aAAa,cAAc,GAAG;AACtE,cAAMM,UAAS,OAAO,aAAa,cAAc;AAAA,UAC/C,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AACA,YAAIA,QAAO,aAAa,GAAG;AACzB,gBAAM,cAAc,OAAO,YAAY,KAAK,GAAG,CAAC;AAChD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,qBAAqB,SAAS,UAAU,WAAW;AAAA,YACnD;AAAA,cACE,YAAY,WAAW;AAAA,cACvB,WAAW,WAAW;AAAA,cACtB,WAAWA,QAAO;AAAA,cAClB,QAAQA,QAAO;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP;AAAA,cACA,OACE,OAAO,QAAQ,IAAI,QAAQ,MAAM,OAAO,WAAW;AAAA,YACvD;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AAEA,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,YAAM,eAAe,MAAM,mBAAmB;AAC9C,YAAM,SAAS,MAAM,aAAa,EAAE,OAAO,KAAK,CAAC;AACjD,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,YACJ,QAAQ,OAAO;AAAA,YACf,WAAW,OAAO;AAAA,YAClB,OAAO,OAAO;AAAA,YACd,GAAI,OAAO,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;AAAA,YAC/D,GAAI,OAAO,SAAS,WAAW,IAC3B,CAAC,IACD,EAAE,UAAU,OAAO,SAAS;AAAA,UAClC;AAAA,QACF,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,yBAAyB;AAE/B,QAAI,OAAO,YAAY,aAAa;AAClC,iBAAW,OAAO,SAAS,CAAC,SAAS,cAAc,QAAQ,CAAC;AAC5D,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,QAAQ,eAAe,OAAO,SAAS,OAAO;AACpD,YAAM,YAAY,eAAe,OAAO,SAAS,YAAY;AAC7D,YAAM,SAAS,eAAe,OAAO,SAAS,QAAQ;AAEtD,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA,GAAG,OAAO;AAAA,QACV;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU;AAAA,YACnB;AAAA,YACA,YAAY;AAAA,YACZ,WAAW;AAAA,YACX;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,SAA+B;AAAA,QACnC,GAAG,UAAU;AAAA,QACb,UAAU;AAAA,MACZ;AAEA,YAAM,uBAAuB,KAAK,MAAM;AAExC,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,eAAe,MAAM;AAAA,QAC7B,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,YAAY,QAAQ;AAC7B,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,UACE,OAAO,YAAY,WAAW,KAC9B,OAAO,YAAY,CAAC,MAAM,UAC1B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,UAAIH,oBAAmB,MAAM,GAAG;AAC9B,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,gBAAgB;AAAA,cAChB,OAAO,OAAO;AAAA,YAChB;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AACA,UAAIC,8BAA6B,MAAM,GAAG;AACxC,cAAMG,UAAS,MAAM;AAAA,UACnB;AAAA,UACA,GAAG,OAAO,QAAQ,8BAA8B,OAAO,YAAY;AAAA,UACnE;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,gBAAgB,CAAC,GAAG,OAAO,iBAAiB;AAAA,UACvD;AAAA,QACF;AACA,YACEA,QAAO,KAAK,WAAW,aACvBA,QAAO,KAAK,WAAW,YACvB;AACA,gBAAM;AAAA,YACJ,GAAG,KAAK,UAAU;AAAA,cAChB,gBAAgB;AAAA,cAChB,IAAI;AAAA,cACJ;AAAA,cACA,MAAM,EAAE,QAAQA,QAAO,KAAK,OAAO;AAAA,YACrC,CAAC,CAAC;AAAA;AAAA,UACJ;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA,GAAG,OAAO,QAAQ;AAAA,UAClB;AAAA,YACE,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,YAClB;AAAA,YACA,MAAM,IAAI,gBAAgB;AAAA,cACxB,YAAY;AAAA,cACZ,aAAa,OAAO;AAAA,cACpB,WAAW,OAAO;AAAA,cAClB,MAAM;AAAA,YACR,CAAC,EAAE,SAAS;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAA0B;AAAA,UAC9B,SAAS;AAAA,UACT,MAAM;AAAA,UACN,UAAU,OAAO;AAAA,UACjB,WAAW,OAAO;AAAA,UAClB,cAAc,MAAM;AAAA,UACpB,eAAe,MAAM;AAAA,UACrB,YAAY,MAAM;AAAA,UAClB,OAAO,MAAM;AAAA,UACb,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,aAAa,GAAI,EAAE,YAAY;AAAA,QACrE;AACA,cAAMC,UAAS,MAAM,oBAAoB,KAAK,YAAY;AACxD,gBAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,cAAIL,oBAAmB,OAAO,EAAG,QAAO;AACxC,cACE,CAACC,8BAA6B,OAAO,KACrC,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,MAAM,GACjD;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,gBAAM,kCAAkC,KAAK,KAAK;AAClD,iBAAO;AAAA,QACT,CAAC;AACD,cAAM;AAAA,UACJ,GAAG,KAAK,UAAU;AAAA,YAChB,gBAAgB;AAAA,YAChB,IAAI;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,gBAAgB;AAAA,cAChB,OAAOI,QAAO;AAAA,YAChB;AAAA,UACF,CAAC,CAAC;AAAA;AAAA,QACJ;AACA,eAAO;AAAA,MACT;AACA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,GAAG,OAAO,QAAQ,8BAA8B,OAAO,EAAE;AAAA,QACzD;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,gBAAgB,CAAC,GAAG,OAAO,iBAAiB;AAAA,QACvD;AAAA,MACF;AAEA,YAAM,SAA+B;AAAA,QACnC,UAAU,OAAO;AAAA,QACjB,IAAI,OAAO,KAAK,MAAM,OAAO;AAAA,QAC7B,QAAQ,OAAO,KAAK;AAAA,QACpB,cAAc,OAAO,KAAK,gBAAgB,OAAO;AAAA,QACjD,YACE,OAAO,KAAK,eAAe,SACvB,OAAO,aACP,OAAO,KAAK;AAAA,QAClB,UAAU,OAAO,KAAK,YAAY,OAAO;AAAA,QACzC,mBAAmB,OAAO;AAAA,MAC5B;AACA,YAAM,SAAS,MAAM,oBAAoB,KAAK,YAAY;AACxD,cAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,YAAI,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,MAAM,GAAG;AACtD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,kCAAkC,KAAK,MAAM;AACnD,eAAO;AAAA,MACT,CAAC;AAED,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU;AAAA,UAChB,gBAAgB;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,MAAM,eAAe,MAAM;AAAA,QAC7B,CAAC,CAAC;AAAA;AAAA,MACJ;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,OAAO,cAClB,OAAO,aAAa,aAAa,kBAAkB,IACnD,IAAI;AACR,QAAI,SAAS,QAAQ,KAAK;AAC1B,QAAI,uBAAuB;AAC3B,QAAI,OAAO,eAAe,CAAC,QAAQ;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,aAAa;AAClC,UAAI,SAAS,MAAM,sBAAsB,GAAG;AAC5C,UAAIL,oBAAmB,MAAM,KAAK,kBAAkB,MAAM,GAAG;AAC3D,iBAAS,MAAM,oBAAoB,KAAK,YAAY;AAClD,gBAAM,UAAU,MAAM,sBAAsB,GAAG;AAC/C,cAAIA,oBAAmB,OAAO,KAAK,kBAAkB,OAAO,GAAG;AAC7D,mBAAO,wBAAwB,UAAU,KAAK,OAAO;AAAA,UACvD;AACA,iBAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,eAAS,wBAAwB,MAAM;AACvC,UAAI,QAAQ;AACV,+BAAuB,OAAO;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,WAAW;AAAA,MAC5B;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAED,QAAI;AACJ,QAAI,OAAO,YAAY,MAAM;AAC3B,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,aAAO,MAAM,OAAO,GAAG;AAAA,IACzB,WAAW,OAAO,YAAY,WAAW;AACvC,iBAAW,OAAO,SAAS,CAAC,CAAC;AAC7B,aAAO,MAAM,OAAO,QAAQ;AAAA,IAC9B,WAAW,OAAO,YAAY,UAAU;AACtC,iBAAW,OAAO,SAAS,CAAC,aAAa,CAAC;AAC1C,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,MAAM,OAAO,OAAO;AAAA,QACzB,OAAO,OAAO,YAAY,CAAC;AAAA,QAC3B,YAAY;AAAA,UACV,OAAO,QAAQ,IAAI,aAAa;AAAA,UAChC;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,WAAW,OAAO,YAAY,SAAS;AACrC,iBAAW,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,MAAM,OAAO,QAAQ,IAAI,KAAK;AACpC,sBAAgB,MAAM,MAAM;AAC5B,UAAI,OAAO,YAAY,WAAW,GAAG;AACnC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa,eAAe,OAAO,SAAS,cAAc;AAChE,UAAI,CAAC,kBAAkB,KAAK,UAAU,GAAG;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAS,OAAO,QAAQ,IAAI,QAAQ;AAC1C,YAAM,UAAU,OAAO,QAAQ,IAAI,MAAM;AACzC,UAAI;AACJ,UAAI,OAAO,YAAY,UAAU;AAC/B,YAAI;AACF,eAAK,MAAM,OAAO;AAAA,QACpB,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU;AAAA,QACd,OAAO,QAAQ,IAAI,QAAQ;AAAA,QAC3B,OAAO,YAAY;AAAA,MACrB;AACA,YAAM,UAA4B;AAAA,QAChC,KAAK,OAAO,YAAY,CAAC;AAAA,QACzB;AAAA,QACA,QACE,OAAO,WAAW,WACb,OAAO,YAAY,IACpB;AAAA,QACN;AAAA,QACA;AAAA,MACF;AACA,YAAM,cAAc,OAAO,QAAQ,IAAI,iBAAiB;AACxD,uBACE,OAAO,gBAAgB,WACnB,eACC,aAAa,0BAA0BM,aAAY;AAC1D,UAAI;AACJ,UAAI,CAAC,KAAK;AACR,YAAI;AACF,4BAAkB,MAAM,uBAAuB,GAAG;AAAA,QACpD,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,MAAM,OAAO,MAAM,SAAS,EAAE,eAAe,CAAC;AAC/D,aAAO,EAAE,iBAAiB,eAAe;AACzC,aAAO;AACP,YAAM,EAAE,YAAY,GAAG,QAAQ,IAAI;AACnC,wBAAkB;AAClB,UAAI,iBAAiB;AACnB,cAAM,YAAYP,MAAK,iBAAiB,MAAM;AAC9C,cAAM,cAAcA,MAAK,iBAAiB,cAAc;AACxD,cAAM,QACJ,OAAO,eAAe,WAClB,OAAO,KAAK,YAAY,QAAQ,IAChC;AACN,YAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,MAAM,YAAY;AACrD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,YACA,EAAE,SAAS,eAAe,MAAM;AAAA,UAClC;AAAA,QACF;AACA,YAAI;AACF,iBAAO;AAAA,YACL,GAAG;AAAA,YACH,YAAY;AAAA,YACZ,cAAc;AAAA,YACd,YAAY,MAAM;AAAA,UACpB;AACA,gBAAM;AAAA,YACJ;AAAA,YACA,GAAG,KAAK,UAAU,EAAE,gBAAgB,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA;AAAA,UACjE;AACA,gBAAM,gBAAgB,WAAW,KAAK;AACtC,iBAAO,EAAE,GAAG,SAAS,GAAG,aAAa,OAAO,SAAS,OAAO,EAAE;AAAA,QAChE,QAAQ;AACN,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,cACE;AAAA,cACA,YAAY;AAAA,cACZ,cAAc;AAAA,cACd,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,iBAAW,OAAO,SAAS,CAAC,QAAQ,UAAU,CAAC;AAC/C,UAAI,OAAO,YAAY,SAAS,GAAG;AACjC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,OAAO,YAAY,CAAC,IACvB,MAAM,OAAO;AAAA,QACX,gBAAgB,OAAO,YAAY,CAAC,GAAG,aAAa;AAAA,MACtD,IACA,MAAM,OAAO,UAAU;AAAA,QACrB,MAAM,gBAAgB,OAAO,QAAQ,IAAI,MAAM,GAAG,QAAQ;AAAA,QAC1D,SAAS;AAAA,UACP,OAAO,QAAQ,IAAI,UAAU;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACP;AAEA,UAAM;AAAA,MACJ,GAAG,KAAK,UAAU;AAAA,QAChB,gBAAgB;AAAA,QAChB,IAAI;AAAA,QACJ;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,QACrC;AAAA,MACF,CAAC,CAAC;AAAA;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,aAAa,MAAM,eAAe,KAAK;AAC7C;AAAA,MACE,GAAG,KAAK,UAAU;AAAA,QAChB,gBAAgB;AAAA,QAChB,IAAI;AAAA,QACJ;AAAA,QACA,GAAI,mBAAmB,SACnB,CAAC,IACD,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,eAAe,EAAE;AAAA,QACzD,OAAO;AAAA,UACL,MAAM,WAAW;AAAA,UACjB,SAAS,WAAW;AAAA,UACpB,GAAI,WAAW,YAAY,SACvB,CAAC,IACD,EAAE,SAAS,WAAW,QAAQ;AAAA,QACpC;AAAA,MACF,CAAC,CAAC;AAAA;AAAA,IACJ;AACA,WAAO,WAAW;AAAA,EACpB;AACF;","names":["randomUUID","dirname","join","chmod","mkdir","open","resolve","dirname","join","isOAuthCredentials","isLegacyBootstrapCredentials","message","result","status","active","randomUUID"]}

package/docs/contract.md

@@ -0,0 +1,97 @@
+# CLI commands
+
+| CLI command | API operation |
+| --- | --- |
+| `weft bootstrap` | `createAccountBootstrap` |
+| `weft auth status` | `getAccountBootstrap` |
+| `weft me` | `getMe` |
+| `weft balance` | `getBalance` |
+| `weft search QUERY` | `search` |
+| `weft fetch URL --max-cost-usd USD` | `fetch` |
+| `weft purchases` | `listPurchases` |
+| `weft purchases ID` | `getPurchase` |
+
+## CLI contract
+
+Authentication precedence is explicit `--api-key-stdin`, then `WEFT_API_KEY`,
+then the protected local bootstrap or legacy OAuth credential store. A
+`--api-key VALUE` argument is rejected so credentials do not leak into shell
+history or process listings. Legacy stored OAuth credentials refresh before expiry.
+The API origin defaults to `https://weft.network` and can be changed with
+`WEFT_BASE_URL` or `--base-url`; stored credentials retain their API origin.
+
+Every command prints one versioned JSON object. Most successes use
+`{"schema_version":"1","ok":true,"command":"…","data":…}` on stdout.
+Errors use
+`{"schema_version":"1","ok":false,"command":"…","error":{"code":"…","message":"…","details":…}}`
+on stderr. Fetch success also includes
+`"meta":{"idempotency_key":"…"}` so an uncertain call can be retried with
+the exact same key. Default `weft fetch` uses schema version `"2"` for results
+and for errors after fetch option validation starts. Other commands and
+`weft fetch --raw` retain schema version `"1"`.
+
+Default fetch saves exact response bytes before stdout. Its `meta` object
+precedes `data` and includes `saved_path`, `receipt_path`, `byte_count`, and
+`idempotency_key`. Both paths are absolute. `data` retains the SDK's camelCase
+receipt fields but replaces `bodyBase64` with `body_encoding`, `media_type`,
+and, for valid UTF-8 text or JSON, the complete original `body` string. JSON
+body values are not parsed or reformatted. Binary, compressed, and invalid
+UTF-8 responses use `body_encoding: "file"` and omit `body`. Fetch with `--raw`
+retains the original SDK result with `bodyBase64` and does not write files.
+
+Local files use private per-result directories and are not deleted automatically.
+`RESULT_STORAGE_UNAVAILABLE` means no fetch was sent. `RESULT_STORAGE_FAILED`
+means the response arrived but local delivery failed; its error details keep
+the body-free receipt and mark `file_complete: false`, while `meta` keeps the
+retry key. Both use exit code `5`. See [CLI result storage](../README.md#fetch-results)
+for paths, permissions, cleanup, and retry instructions.
+Invalid transport Base64 returns `RESULT_DECODE_FAILED`, with the receipt and
+retry key. A failed stdout write returns `RESULT_OUTPUT_FAILED`, with the
+receipt and any saved paths. Both use exit code `5`; reading a saved local file
+requires no fetch or payment.
+
+`weft --help` returns every command, global option, authentication method, and
+exit code as JSON. `weft <command> --help` returns command-specific usage and
+options. Help does not require authentication or make a network request.
+
+Exit codes are stable:
+
+- `0`: success
+- `2`: invalid command, argument, or option
+- `3`: missing authentication or an HTTP `401`/`403`
+- `4`: other HTTP `4xx` API or policy rejection
+- `5`: HTTP `5xx`, network, runtime, or unexpected internal failure
+
+`weft fetch` always requires `--max-cost-usd`. It accepts
+`--idempotency-key`; when omitted, the CLI generates a UUID for the
+`Idempotency-Key` header.
+
+`--max-results` is validated as `1..50`, and `--per-page` as `1..100`,
+before a network request is made.
+
+## Agent bootstrap
+
+The package implements the bootstrap lifecycle. Read `weft --help` before
+scripting it so the installed CLI remains the source of command syntax.
+
+| Command | Purpose |
+| --- | --- |
+| `weft bootstrap --email EMAIL --agent-name NAME --reason TEXT` | Create a temporary bootstrap, email the human a claim link, store the `wbt_` credential in a mode-0600 local file |
+| `weft auth status` | Report the bootstrap lifecycle state; poll at the interval returned by `weft bootstrap` |
+
+The `wbt_` credential is secret. Before claim it is temporary for 30 minutes and
+has exactly `search`, `status`, and `cancel`. Human approval promotes the same
+bearer to durable `identity`, `search`, `balance`, `fetch`, `purchases`,
+`status`, and `revoke` capabilities. It remains valid until revoked. Seller,
+organization, API-key administration, dashboard-session, transfer, withdrawal,
+and MCP surfaces always refuse it. Lifecycle states are `pending`, `claimed`,
+`rejected`, `expired`, and `revoked`; the last three are terminal. Claimed
+credentials retain search. Cancellation and revocation are API capabilities; no
+CLI cancel or revoke command is shipped in this version.
+
+New bootstrap flows make no OAuth registration or token request. Existing
+stored OAuth credentials remain compatible and refresh before expiry.
+
+Ask the human to verify the claim email. Weft applies the one-time signup grant
+after verification; then check the balance. Do not ask for a wallet top-up
+during onboarding.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weftlabs/cli",
-  "version": "0.26.10",
+  "version": "0.31.0",
   "description": "Command-line client for the Weft buyer runtime",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "dist",
     "examples",
     "README.md",
+    "docs/contract.md",
     "scripts/install-skill.mjs",
     "scripts/skill-paths.mjs"
   ],
@@ -25,32 +26,34 @@
   "homepage": "https://weftlabs.com/x402/cli",
   "repository": {
     "type": "git",
-    "url": "https://github.com/weftlabs/weft-sdk",
-    "directory": "cli"
+    "url": "https://github.com/weftlabs/weft-cli"
+  },
+  "bugs": {
+    "url": "https://github.com/weftlabs/weft-cli/issues"
   },
   "dependencies": {
-    "@weftlabs/sdk": "0.26.10"
+    "@weftlabs/sdk": "^0.31.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
-    "@typescript-eslint/eslint-plugin": "^8.29.1",
-    "@typescript-eslint/parser": "^8.29.1",
-    "eslint": "^10.4.1",
-    "prettier": "3.9.6",
-    "tsup": "^8.4.0",
+    "@types/node": "^26.6.2",
+    "@typescript-eslint/eslint-plugin": "^8.70.1",
+    "@typescript-eslint/parser": "^8.70.1",
+    "eslint": "^10.11.0",
+    "prettier": "3.9.9",
+    "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.3"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
     "build": "tsup",
-    "pretest": "pnpm --filter @weftlabs/sdk build",
-    "test": "vitest run",
-    "pretest:unit": "pnpm --filter @weftlabs/sdk build",
-    "test:unit": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run tests && node --test scripts/publish-npm-archive.test.mjs scripts/sdk-follow.test.mjs scripts/skill-drift.test.mjs",
+    "test:unit": "vitest run tests && node --test scripts/publish-npm-archive.test.mjs scripts/sdk-follow.test.mjs scripts/skill-drift.test.mjs",
+    "test:packed": "node scripts/test-packed-artifact.mjs",
     "lint:check": "eslint",
-    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\""
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.mjs\""
   }
 }

package/scripts/install-skill.mjs

@@ -20,7 +20,7 @@ import {
 } from "./skill-paths.mjs";
 
 const bundledRoot = "../dist/weft-skill/";
-const workspaceSkill = new URL("../../skills/weft/SKILL.md", import.meta.url);
+const workspaceSkill = new URL("../skills/weft/SKILL.md", import.meta.url);
 
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 
@@ -59,9 +59,7 @@ async function removeLegacySkill(skillsRootRelative, warn) {
     legacySkill !== undefined &&
     marker !== JSON.stringify({ sha256: sha256(legacySkill) })
   ) {
-    warn(
-      `Kept modified legacy Skill at ${skillPath}; remove it manually.`,
-    );
+    warn(`Kept modified legacy Skill at ${skillPath}; remove it manually.`);
     return;
   }
   if (legacySkill !== undefined) await unlink(skillPath);
@@ -70,9 +68,7 @@ async function removeLegacySkill(skillsRootRelative, warn) {
   await rm(join(legacyDirectory, ".weft-cli-backup"), { force: true });
   await rmdir(legacyDirectory).catch((error) => {
     if (error.code !== "ENOTEMPTY") throw error;
-    warn(
-      `Kept non-empty legacy Skill directory at ${legacyDirectory}.`,
-    );
+    warn(`Kept non-empty legacy Skill directory at ${legacyDirectory}.`);
   });
 }
 
@@ -85,7 +81,13 @@ export async function installSkill({ force = false, silent = false } = {}) {
   const hosts = [];
 
   if (process.env.WEFT_SKIP_SKILL_INSTALL === "1") {
-    return { status: "skipped", reason: "opt-out", installed: 0, hosts, warnings };
+    return {
+      status: "skipped",
+      reason: "opt-out",
+      installed: 0,
+      hosts,
+      warnings,
+    };
   }
 
   if (!force && process.env.WEFT_FORCE_SKILL_INSTALL !== "1") {
@@ -147,9 +149,15 @@ export async function installSkill({ force = false, silent = false } = {}) {
       const marker = await readIfPresent(markerTarget);
       if (marker !== undefined) {
         for (const file of skillFiles) {
-          await rm(join(dirname(join(directory, file)), `.weft-next-${basename(file)}`), {
-            force: true,
-          });
+          await rm(
+            join(
+              dirname(join(directory, file)),
+              `.weft-next-${basename(file)}`,
+            ),
+            {
+              force: true,
+            },
+          );
         }
       }
 
@@ -177,7 +185,8 @@ export async function installSkill({ force = false, silent = false } = {}) {
         // it. Anything else is user-owned or user-modified and stays.
         let recorded;
         try {
-          recorded = marker === undefined ? undefined : JSON.parse(marker).sha256;
+          recorded =
+            marker === undefined ? undefined : JSON.parse(marker).sha256;
         } catch {
           recorded = undefined;
         }
@@ -204,7 +213,10 @@ export async function installSkill({ force = false, silent = false } = {}) {
         for (const file of skillFiles) {
           const target = join(directory, file);
           await mkdir(dirname(target), { recursive: true });
-          const temporary = join(dirname(target), `.weft-next-${basename(file)}`);
+          const temporary = join(
+            dirname(target),
+            `.weft-next-${basename(file)}`,
+          );
           await writeFile(temporary, skill.get(file), {
             encoding: "utf8",
             mode: 0o600,
@@ -257,7 +269,7 @@ export async function installSkill({ force = false, silent = false } = {}) {
 
 // Still runnable as a script (`node scripts/install-skill.mjs`) for tests and
 // for anyone repairing an install by hand. Nothing invokes it automatically —
-// see cli/README.md for why this is no longer a postinstall hook.
+// see README.md for why this is no longer a postinstall hook.
 if (
   process.argv[1] &&
   import.meta.url === pathToFileURL(process.argv[1]).href