@xemahq/xema 0.13.0 → 0.15.0

package/dist/dev/forked-worker.js

@@ -1,33 +1,263 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreReadyCleanupError = exports.LaunchMode = exports.WATCH_CHILD_ENV = void 0;
+exports.resolveLaunchMode = resolveLaunchMode;
+exports.registerBlockedBootstrap = registerBlockedBootstrap;
+exports.buildForkedWorkerEnvironment = buildForkedWorkerEnvironment;
 exports.spawnForkedWorker = spawnForkedWorker;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const forked_worker_bootstrap_protocol_1 = require("./forked-worker-bootstrap-protocol");
+const native_process_group_1 = require("../runtime/native-process-group");
 const READINESS_PROBE_INTERVAL_MS = 250;
 const SHUTDOWN_GRACE_MS = 5_000;
-async function spawnForkedWorker(opts, baseDir) {
-    const serviceRoot = (0, node_path_1.resolve)(baseDir, opts.siblingAppDir);
-    const mainModulePath = (0, node_path_1.resolve)(serviceRoot, 'dist', 'main.js');
-    if (!(0, node_fs_1.existsSync)(mainModulePath)) {
-        throw new Error(`${opts.name} dist not found at ${mainModulePath}. ` +
-            `Run \`pnpm --filter ${opts.name} build\` first, or use \`pnpm refresh\`.`);
+const SHUTDOWN_VERIFY_MS = 1_000;
+const BOOTSTRAP_HANDSHAKE_TIMEOUT_MS = 2_000;
+exports.WATCH_CHILD_ENV = 'XEMA_DEV_WATCH_CHILD';
+var LaunchMode;
+(function (LaunchMode) {
+    LaunchMode["Dist"] = "dist";
+    LaunchMode["Watch"] = "watch";
+})(LaunchMode || (exports.LaunchMode = LaunchMode = {}));
+function resolveLaunchMode() {
+    return process.env[exports.WATCH_CHILD_ENV] === '1'
+        ? LaunchMode.Watch
+        : LaunchMode.Dist;
+}
+class PreReadyCleanupError extends AggregateError {
+    constructor(service, startError, cleanupError) {
+        super([startError, cleanupError], `${service}: pre-ready start failed and verified cleanup also failed.`);
+        this.name = 'PreReadyCleanupError';
+    }
+}
+exports.PreReadyCleanupError = PreReadyCleanupError;
+async function registerBlockedBootstrap(service, operations) {
+    let ownership;
+    try {
+        await operations.waitUntilBlocked();
+        ownership = operations.captureOwnership();
+        await operations.persistOwnership(ownership);
+        await operations.release();
+        return ownership;
+    }
+    catch (error) {
+        try {
+            if (ownership === undefined) {
+                await operations.cleanupBlocked();
+            }
+            else {
+                await operations.cleanupCaptured(ownership);
+            }
+        }
+        catch (cleanupError) {
+            throw new PreReadyCleanupError(service, error, cleanupError);
+        }
+        throw error;
     }
-    const childEnv = {
-        ...process.env,
+}
+function buildForkedWorkerEnvironment(opts) {
+    return {
+        ...opts.parentEnv,
+        ...opts.serviceEnv,
         PORT: String(opts.port),
         SERVICE_PUBLIC_URL: `http://127.0.0.1:${String(opts.port)}`,
-        NODE_PATH: [(0, node_path_1.join)(serviceRoot, 'node_modules'), process.env.NODE_PATH]
-            .filter((p) => typeof p === 'string' && p.length > 0)
+        NODE_PATH: [
+            (0, node_path_1.join)(opts.serviceRoot, 'node_modules'),
+            opts.parentEnv.NODE_PATH,
+        ]
+            .filter((path) => typeof path === 'string' && path.length > 0)
             .join(node_path_1.delimiter),
     };
-    const child = (0, node_child_process_1.fork)(mainModulePath, [], {
+}
+async function spawnForkedWorker(opts, baseDir) {
+    (0, native_process_group_1.assertNativeProcessGroupsSupported)();
+    const serviceRoot = (0, node_path_1.resolve)(baseDir, opts.siblingAppDir);
+    const entry = opts.watch === true
+        ? resolveWatchEntry(serviceRoot, opts.name)
+        : resolveDistEntry(serviceRoot, opts.name);
+    const childEnv = buildForkedWorkerEnvironment({
+        parentEnv: process.env,
+        ...(opts.env !== undefined ? { serviceEnv: opts.env } : {}),
+        port: opts.port,
+        serviceRoot,
+    });
+    const child = (0, node_child_process_1.fork)(resolveBootstrapEntry(), [], {
         cwd: serviceRoot,
         env: childEnv,
+        detached: true,
+    });
+    const pid = child.pid;
+    if (pid === undefined) {
+        child.kill('SIGKILL');
+        throw new Error(`${opts.name}: child_process.fork() returned a process with no PID.`);
+    }
+    let ownershipRegistrationAttempted = false;
+    const registered = await registerBlockedBootstrap(opts.name, {
+        waitUntilBlocked: () => waitForBootstrapReady(child, opts.name),
+        captureOwnership: () => {
+            const lifecycle = new native_process_group_1.OwnedProcessGroupLifecycle((0, native_process_group_1.captureOwnedProcessGroup)(pid), SHUTDOWN_GRACE_MS, SHUTDOWN_VERIFY_MS);
+            const handle = {
+                name: opts.name,
+                url: `http://localhost:${String(opts.port)}`,
+                pid,
+                close: () => lifecycle.close(),
+            };
+            return { lifecycle, handle };
+        },
+        persistOwnership: async ({ handle }) => {
+            ownershipRegistrationAttempted = opts.onSpawned !== undefined;
+            await opts.onSpawned?.(handle);
+        },
+        release: () => releaseBootstrap(child, {
+            type: forked_worker_bootstrap_protocol_1.FORKED_WORKER_BOOTSTRAP_RELEASE,
+            modulePath: entry.modulePath,
+            moduleArgs: entry.forkArgs,
+            execArgv: opts.watch === true ? [] : process.execArgv,
+        }),
+        cleanupBlocked: () => stopUnreleasedBootstrap(child),
+        cleanupCaptured: async ({ lifecycle, handle }) => {
+            await lifecycle.close();
+            if (ownershipRegistrationAttempted) {
+                await opts.onStoppedBeforeReady?.(handle);
+            }
+        },
     });
-    return waitForReady(child, opts);
+    try {
+        return await waitForReady(child, opts, registered.handle, () => {
+            registered.lifecycle.refresh();
+        });
+    }
+    catch (error) {
+        try {
+            await registered.lifecycle.close();
+            if (ownershipRegistrationAttempted) {
+                await opts.onStoppedBeforeReady?.(registered.handle);
+            }
+        }
+        catch (cleanupError) {
+            throw new PreReadyCleanupError(opts.name, error, cleanupError);
+        }
+        throw error;
+    }
+}
+function resolveBootstrapEntry() {
+    const compiled = (0, node_path_1.resolve)(__dirname, 'forked-worker-bootstrap.js');
+    if ((0, node_fs_1.existsSync)(compiled)) {
+        return compiled;
+    }
+    const source = (0, node_path_1.resolve)(__dirname, 'forked-worker-bootstrap.ts');
+    if ((0, node_fs_1.existsSync)(source)) {
+        return source;
+    }
+    throw new Error('Forked-worker bootstrap module is missing from the Xema CLI installation.');
 }
-function waitForReady(child, opts) {
+function waitForBootstrapReady(child, service) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (action) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timeout);
+            child.off('message', onMessage);
+            child.off('error', onError);
+            child.off('exit', onExit);
+            action();
+        };
+        const onMessage = (message) => {
+            if (message === forked_worker_bootstrap_protocol_1.FORKED_WORKER_BOOTSTRAP_READY) {
+                finish(resolve);
+            }
+        };
+        const onError = (error) => {
+            finish(() => {
+                reject(new Error(`${service}: bootstrap process failed: ${error.message}`));
+            });
+        };
+        const onExit = (code, signal) => {
+            finish(() => {
+                reject(new Error(`${service}: bootstrap exited before ownership registration ` +
+                    `(code=${String(code)}, signal=${String(signal)}).`));
+            });
+        };
+        const timeout = setTimeout(() => {
+            finish(() => {
+                reject(new Error(`${service}: bootstrap did not acknowledge its blocked state within ` +
+                    `${String(BOOTSTRAP_HANDSHAKE_TIMEOUT_MS)}ms.`));
+            });
+        }, BOOTSTRAP_HANDSHAKE_TIMEOUT_MS);
+        child.on('message', onMessage);
+        child.once('error', onError);
+        child.once('exit', onExit);
+    });
+}
+function releaseBootstrap(child, release) {
+    return new Promise((resolve, reject) => {
+        if (!child.connected) {
+            reject(new Error('Forked-worker bootstrap IPC channel is closed.'));
+            return;
+        }
+        child.send(release, (error) => {
+            if (error === null) {
+                resolve();
+                return;
+            }
+            reject(new Error('Could not release the registered worker bootstrap.', {
+                cause: error,
+            }));
+        });
+    });
+}
+async function stopUnreleasedBootstrap(child) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+        return;
+    }
+    const exited = new Promise((resolve, reject) => {
+        child.once('exit', () => {
+            resolve();
+        });
+        child.once('error', reject);
+    });
+    if (!child.kill('SIGKILL')) {
+        if (child.exitCode !== null || child.signalCode !== null) {
+            return;
+        }
+        throw new Error('Could not stop the blocked worker bootstrap.');
+    }
+    await exited;
+}
+function resolveDistEntry(serviceRoot, name) {
+    const mainModulePath = (0, node_path_1.resolve)(serviceRoot, 'dist', 'main.js');
+    if (!(0, node_fs_1.existsSync)(mainModulePath)) {
+        throw new Error(`${name} dist not found at ${mainModulePath}. ` +
+            `Run \`pnpm --filter ${name} build\` first, or use \`pnpm refresh\`.`);
+    }
+    return { modulePath: mainModulePath, forkArgs: [] };
+}
+function resolveWatchEntry(serviceRoot, name) {
+    const srcMainPath = (0, node_path_1.resolve)(serviceRoot, 'src', 'main.ts');
+    if (!(0, node_fs_1.existsSync)(srcMainPath)) {
+        throw new Error(`${name}: --watch runs each service from source, but no entry was found at ` +
+            `${srcMainPath}. Per-service hot-reload requires a source checkout of ` +
+            `${name}; boot without \`--watch\` to run its built \`dist\`.`);
+    }
+    return {
+        modulePath: resolveTsxCli(name),
+        forkArgs: ['watch', '--clear-screen=false', srcMainPath],
+    };
+}
+function resolveTsxCli(name) {
+    try {
+        return require.resolve('tsx/cli');
+    }
+    catch {
+        throw new Error(`${name}: --watch requires the \`tsx\` dependency, but it could not be ` +
+            'resolved. Reinstall dependencies (`pnpm install`) and retry.');
+    }
+}
+function waitForReady(child, opts, handle, onReady) {
     return new Promise((resolve, reject) => {
         const pid = child.pid;
         if (pid === undefined) {
@@ -52,16 +282,24 @@ function waitForReady(child, opts) {
                 reject(new Error(`${opts.name}: child_process.fork() error: ${err.message}`));
             });
         };
+        const onMessage = (message) => {
+            if (!(0, forked_worker_bootstrap_protocol_1.isForkedWorkerTargetExit)(message)) {
+                return;
+            }
+            settle(() => {
+                reject(new Error(`${opts.name}: service target exited before /health/ready ` +
+                    `(code=${String(message.code)}, signal=${String(message.signal)}).`));
+            });
+        };
         child.once('exit', onExit);
         child.once('error', onError);
+        child.on('message', onMessage);
         const deadline = Date.now() + opts.readinessTimeoutMs;
         const probe = async () => {
             while (!settled) {
                 if (Date.now() > deadline) {
                     settle(() => {
-                        void killChild(child).then(() => {
-                            reject(new Error(`${opts.name}: /health/ready did not return 200 within ${String(opts.readinessTimeoutMs)}ms.`));
-                        });
+                        reject(new Error(`${opts.name}: /health/ready did not return 200 within ${String(opts.readinessTimeoutMs)}ms.`));
                     });
                     return;
                 }
@@ -69,12 +307,14 @@ function waitForReady(child, opts) {
                     settle(() => {
                         child.off('exit', onExit);
                         child.off('error', onError);
-                        resolve({
-                            name: opts.name,
-                            url: `http://localhost:${String(opts.port)}`,
-                            pid,
-                            close: () => killChild(child),
-                        });
+                        child.off('message', onMessage);
+                        try {
+                            onReady();
+                            resolve(handle);
+                        }
+                        catch (error) {
+                            reject(error);
+                        }
                     });
                     return;
                 }
@@ -97,7 +337,9 @@ function probeReady(port) {
             res.resume();
             resolve(res.statusCode === 200);
         });
-        req.on('error', () => { resolve(false); });
+        req.on('error', () => {
+            resolve(false);
+        });
         req.on('timeout', () => {
             req.destroy();
             resolve(false);
@@ -105,26 +347,9 @@ function probeReady(port) {
         req.end();
     });
 }
-function killChild(child) {
+function sleep(ms) {
     return new Promise((resolve) => {
-        if (child.exitCode !== null || child.signalCode !== null) {
-            resolve();
-            return;
-        }
-        const killTimer = setTimeout(() => {
-            if (child.exitCode === null && child.signalCode === null) {
-                child.kill('SIGKILL');
-            }
-        }, SHUTDOWN_GRACE_MS);
-        const onExit = () => {
-            clearTimeout(killTimer);
-            resolve();
-        };
-        child.once('exit', onExit);
-        child.kill('SIGTERM');
+        setTimeout(resolve, ms);
     });
 }
-function sleep(ms) {
-    return new Promise((resolve) => { setTimeout(resolve, ms); });
-}
 //# sourceMappingURL=forked-worker.js.map

package/dist/dev/forked-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"forked-worker.js","sourceRoot":"","sources":["../../src/dev/forked-worker.ts"],"names":[],"mappings":";;AA8EA,8CAyDC;AAvID,2DAA6D;AAC7D,qCAAqC;AACrC,yCAAoE;AAoCpE,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAuCzB,KAAK,UAAU,iBAAiB,CACrC,IAA8B,EAC9B,OAAe;IAEf,MAAM,WAAW,GAAG,IAAA,mBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAA,mBAAW,EAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,IAAA,oBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,sBAAsB,cAAc,IAAI;YAClD,uBAAuB,IAAI,CAAC,IAAI,0CAA0C,CAC7E,CAAC;IACJ,CAAC;IAkBD,MAAM,QAAQ,GAAsB;QAClC,GAAG,OAAO,CAAC,GAAG;QACd,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,kBAAkB,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3D,SAAS,EAAE,CAAC,IAAA,gBAAI,EAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;aAClE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aACjE,IAAI,CAAC,qBAAS,CAAC;KACnB,CAAC;IAeF,MAAM,KAAK,GAAG,IAAA,yBAAI,EAAC,cAAc,EAAE,EAAE,EAAE;QACrC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CACnB,KAAmB,EACnB,IAA8B;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,wDAAwD,CACrE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;YACtC,IAAI,OAAO,EAAE,CAAC;gBAAA,OAAO;YAAA,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAQ,EAAE;YAC1E,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,6CAA6C,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CACpG,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,OAAO,EAAE,CAAC,CACtE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAEtD,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;YACtC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,EAAE;wBACV,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;4BAC9B,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,6CAA6C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC9F,CACF,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,EAAE;wBAKV,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;wBAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAC5B,OAAO,CAAC;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,GAAG,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;4BAC5C,GAAG;4BACH,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;yBAC9B,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,KAAK,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAI7B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAoB,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,2BAA2B;SACrC,EACD,CAAC,GAAG,EAAE,EAAE;YAEN,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAClC,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAmB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAID,MAAM,SAAS,GAAmB,UAAU,CAAC,GAAG,EAAE;YAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,GAAE,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"forked-worker.js","sourceRoot":"","sources":["../../src/dev/forked-worker.ts"],"names":[],"mappings":";;;AAyFA,8CAIC;AAkFD,4DAuBC;AAED,oEAiBC;AAQD,8CA2HC;AA5VD,2DAA6D;AAC7D,qCAAqC;AACrC,yCAAoE;AAEpE,yFAK4C;AAC5C,0EAIyC;AAsCzC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AAWhC,QAAA,eAAe,GAAG,sBAAsB,CAAC;AAYtD,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,2BAAa,CAAA;IACb,6BAAe,CAAA;AACjB,CAAC,EAHW,UAAU,0BAAV,UAAU,QAGrB;AAQD,SAAgB,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAe,CAAC,KAAK,GAAG;QACzC,CAAC,CAAC,UAAU,CAAC,KAAK;QAClB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;AACtB,CAAC;AA2DD,MAAa,oBAAqB,SAAQ,cAAc;IACtD,YACE,OAAe,EACf,UAAmB,EACnB,YAAqB;QAErB,KAAK,CACH,CAAC,UAAU,EAAE,YAAY,CAAC,EAC1B,GAAG,OAAO,4DAA4D,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAZD,oDAYC;AAWM,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,UAAqD;IAErD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAC;QACpC,SAAS,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAAoC;IAEpC,OAAO;QACL,GAAG,IAAI,CAAC,SAAS;QACjB,GAAG,IAAI,CAAC,UAAU;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,kBAAkB,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3D,SAAS,EAAE;YACT,IAAA,gBAAI,EAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,SAAS;SACzB;aACE,MAAM,CACL,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE;aACA,IAAI,CAAC,qBAAS,CAAC;KACnB,CAAC;AACJ,CAAC;AAQM,KAAK,UAAU,iBAAiB,CACrC,IAA8B,EAC9B,OAAe;IAEf,IAAA,yDAAkC,GAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAA,mBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAM7D,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,IAAI;QACjB,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAkB/C,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW;KACZ,CAAC,CAAC;IAsBH,MAAM,KAAK,GAAG,IAAA,yBAAI,EAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE;QAC9C,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,wDAAwD,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,8BAA8B,GAAG,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE;QAC3D,gBAAgB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;QAC/D,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,SAAS,GAAG,IAAI,iDAA0B,CAC9C,IAAA,+CAAwB,EAAC,GAAG,CAAC,EAC7B,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;YACF,MAAM,MAAM,GAAuB;gBACjC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG;gBACH,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE;aAC/B,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACrC,8BAA8B,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;YAC9D,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CACZ,gBAAgB,CAAC,KAAK,EAAE;YACtB,IAAI,EAAE,kEAA+B;YACrC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;SACtD,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACpD,eAAe,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;YAC/C,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,8BAA8B,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE;YAC7D,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,8BAA8B,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACtE,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACpE,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAmB,EACnB,OAAe;IAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAQ,EAAE;YAC3C,IAAI,OAAO,KAAK,gEAA6B,EAAE,CAAC;gBAC9C,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACrC,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CAAC,GAAG,OAAO,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CACb,IAAmB,EACnB,MAA6B,EACvB,EAAE;YACR,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,OAAO,mDAAmD;oBAC3D,SAAS,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CACtD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,OAAO,2DAA2D;oBACnE,GAAG,MAAM,CAAC,8BAA8B,CAAC,KAAK,CACjD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACnC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmB,EACnB,OAAqC;IAErC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,CACJ,IAAI,KAAK,CAAC,oDAAoD,EAAE;gBAC9D,KAAK,EAAE,KAAK;aACb,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAmB;IAEnB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,CAAC;AACf,CAAC;AAaD,SAAS,gBAAgB,CAAC,WAAmB,EAAE,IAAY;IACzD,MAAM,cAAc,GAAG,IAAA,mBAAW,EAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,IAAA,oBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,sBAAsB,cAAc,IAAI;YAC7C,uBAAuB,IAAI,0CAA0C,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AASD,SAAS,iBAAiB,CAAC,WAAmB,EAAE,IAAY;IAC1D,MAAM,WAAW,GAAG,IAAA,mBAAW,EAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qEAAqE;YAC1E,GAAG,WAAW,yDAAyD;YACvE,GAAG,IAAI,uDAAuD,CACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC;QAC/B,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,WAAW,CAAC;KACzD,CAAC;AACJ,CAAC;AAQD,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,iEAAiE;YACtE,8DAA8D,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,KAAmB,EACnB,IAA8B,EAC9B,MAA0B,EAC1B,OAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,wDAAwD,CACrE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;YACtC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CACb,IAAmB,EACnB,MAA6B,EACvB,EAAE;YACR,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,6CAA6C,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CACpG,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,OAAO,EAAE,CAAC,CACtE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAQ,EAAE;YAC3C,IAAI,CAAC,IAAA,2DAAwB,EAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,EAAE;gBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,+CAA+C;oBACzD,SAAS,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CACtE,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAEtD,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;YACtC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,EAAE;wBACV,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,IAAI,6CAA6C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC9F,CACF,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,EAAE;wBAKV,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;wBAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAC5B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;wBAChC,IAAI,CAAC;4BACH,OAAO,EAAE,CAAC;4BACV,OAAO,CAAC,MAAM,CAAC,CAAC;wBAClB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChB,CAAC;oBACH,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,KAAK,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAI7B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAoB,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,2BAA2B;SACrC,EACD,CAAC,GAAG,EAAE,EAAE;YAEN,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAClC,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/dev/opa-policies.d.ts

@@ -0,0 +1,3 @@
+import type { RosterEntry } from '../runtime/roster';
+export declare function ensureOpaPolicies(roster: readonly RosterEntry[], monorepoRoot: string, log: (message: string) => void): Promise<void>;
+//# sourceMappingURL=opa-policies.d.ts.map

package/dist/dev/opa-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-policies.d.ts","sourceRoot":"","sources":["../../src/dev/opa-policies.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmBrD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}

package/dist/dev/opa-policies.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureOpaPolicies = ensureOpaPolicies;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const OPA_IMAGE = 'openpolicyagent/opa:latest';
+const POLICY_ENTRYPOINT = 'xema/policy/decision';
+async function ensureOpaPolicies(roster, monorepoRoot, log) {
+    const authz = roster.find((entry) => entry.name === 'authorization-api');
+    if (authz?.servicePath === undefined || authz.sourceRoot !== undefined) {
+        return;
+    }
+    const policiesDir = (0, node_path_1.join)(monorepoRoot, authz.servicePath, 'policies');
+    const rego = (0, node_path_1.join)(policiesDir, 'xema.rego');
+    const distDir = (0, node_path_1.join)(policiesDir, 'dist');
+    const wasm = (0, node_path_1.join)(distDir, 'policy.wasm');
+    if ((0, node_fs_1.existsSync)(wasm) || !(0, node_fs_1.existsSync)(rego)) {
+        return;
+    }
+    log('opa      : building authorization-api policy.wasm (embedded mode) …');
+    try {
+        (0, node_fs_1.mkdirSync)(distDir, { recursive: true });
+        await run('docker', [
+            'run',
+            '--rm',
+            '-v',
+            `${policiesDir}:/w`,
+            '-w',
+            '/w',
+            OPA_IMAGE,
+            'build',
+            '-t',
+            'wasm',
+            '-e',
+            POLICY_ENTRYPOINT,
+            'xema.rego',
+            '-o',
+            '/w/dist/bundle.tar.gz',
+        ]);
+        await run('tar', ['-xzf', (0, node_path_1.join)(distDir, 'bundle.tar.gz'), '-C', distDir]);
+        if (!(0, node_fs_1.existsSync)(wasm)) {
+            throw new Error('opa build did not produce policy.wasm');
+        }
+        log('opa      : policy.wasm built.');
+    }
+    catch (err) {
+        log(`opa      : WARN could not build policy.wasm (${err instanceof Error ? err.message : String(err)}) — authorization-api embedded OPA will fail; the rest of the roster boots.`);
+    }
+}
+function run(cmd, args) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(cmd, args, { stdio: 'ignore' });
+        child.once('error', reject);
+        child.once('exit', (code) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`${cmd} exited with code ${String(code)}`));
+        });
+    });
+}
+//# sourceMappingURL=opa-policies.js.map

package/dist/dev/opa-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-policies.js","sourceRoot":"","sources":["../../src/dev/opa-policies.ts"],"names":[],"mappings":";;AAuBA,8CAmDC;AA1ED,2DAA2C;AAC3C,qCAAgD;AAChD,yCAAiC;AAKjC,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAc1C,KAAK,UAAU,iBAAiB,CACrC,MAA8B,EAC9B,YAAoB,EACpB,GAA8B;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IACzE,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1C,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,GAAG,CAAC,qEAAqE,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,QAAQ,EAAE;YAClB,KAAK;YACL,MAAM;YACN,IAAI;YACJ,GAAG,WAAW,KAAK;YACnB,IAAI;YACJ,IAAI;YACJ,SAAS;YACT,OAAO;YACP,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,iBAAiB;YACjB,WAAW;YACX,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAGH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,gDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,6EAA6E,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,IAAuB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/cli-errors.d.ts

@@ -0,0 +1,7 @@
+import { XemaCliExitCode } from './exit-codes';
+export declare class CliConfigurationError extends Error {
+    constructor(message: string);
+}
+export declare function lifecycleExitCode(err: unknown): XemaCliExitCode;
+export declare function asConfigError<T>(fn: () => T): T;
+//# sourceMappingURL=cli-errors.d.ts.map

package/dist/lib/cli-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../../src/lib/cli-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAI/D;AASD,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAS/C"}

package/dist/lib/cli-errors.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliConfigurationError = void 0;
+exports.lifecycleExitCode = lifecycleExitCode;
+exports.asConfigError = asConfigError;
+const exit_codes_1 = require("./exit-codes");
+class CliConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CliConfigurationError';
+    }
+}
+exports.CliConfigurationError = CliConfigurationError;
+function lifecycleExitCode(err) {
+    return err instanceof CliConfigurationError
+        ? exit_codes_1.XemaCliExitCode.ConfigurationError
+        : exit_codes_1.XemaCliExitCode.GenericError;
+}
+function asConfigError(fn) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        if (err instanceof CliConfigurationError) {
+            throw err;
+        }
+        throw new CliConfigurationError(err instanceof Error ? err.message : String(err));
+    }
+}
+//# sourceMappingURL=cli-errors.js.map

package/dist/lib/cli-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-errors.js","sourceRoot":"","sources":["../../src/lib/cli-errors.ts"],"names":[],"mappings":";;;AAwBA,8CAIC;AASD,sCASC;AA9CD,6CAA+C;AAW/C,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAQD,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,OAAO,GAAG,YAAY,qBAAqB;QACzC,CAAC,CAAC,4BAAe,CAAC,kBAAkB;QACpC,CAAC,CAAC,4BAAe,CAAC,YAAY,CAAC;AACnC,CAAC;AASD,SAAgB,aAAa,CAAI,EAAW;IAC1C,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/lib/control-plane.d.ts

@@ -13,12 +13,16 @@ export interface StackImportResult {
 export interface ControlPlaneFlags {
     endpoint?: string;
     token?: string;
+    tokenEnv?: string;
+    orgId?: string;
 }
 export interface ControlPlaneTarget {
     baseUrl: string;
     token: string;
+    orgId?: string;
 }
-export declare function resolveTarget(flags: ControlPlaneFlags): ControlPlaneTarget;
+export declare function authHeaders(target: ControlPlaneTarget): Record<string, string>;
+export declare function resolveTarget(flags: ControlPlaneFlags): Promise<ControlPlaneTarget>;
 export declare function loadManifest(path: string): Promise<XemaManifest>;
 export declare function writeManifest(path: string, manifest: XemaManifest): Promise<void>;
 export declare function resolveStack(flag: string | undefined, manifest?: XemaManifest): string;

package/dist/lib/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/lib/control-plane.ts"],"names":[],"mappings":"AAsBA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,mCAAmC,CAAC;AAM3C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAOD,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAkB1E;AAOD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsBtE;AAGD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,MAAM,CAEtF;AA6CD,wBAAgB,SAAS,CACvB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAO3B;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC,CAOvB;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAO5B"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/lib/control-plane.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,mCAAmC,CAAC;AAS3C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IAWf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,wBAAgB,WAAW,CACzB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAoCD,wBAAsB,aAAa,CACjC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAOD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsBtE;AAGD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,MAAM,CAEtF;AAwDD,wBAAgB,SAAS,CACvB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAO3B;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC,CAOvB;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAO5B"}

package/dist/lib/control-plane.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.authHeaders = authHeaders;
 exports.resolveTarget = resolveTarget;
 exports.loadManifest = loadManifest;
 exports.writeManifest = writeManifest;
@@ -12,16 +13,66 @@ const promises_1 = require("node:fs/promises");
 const resource_1 = require("@xemahq/kernel-contracts/resource");
 const yaml_1 = require("yaml");
 const exit_codes_1 = require("./exit-codes");
-function resolveTarget(flags) {
-    const endpoint = flags.endpoint ?? process.env.XEMA_ENDPOINT;
-    const token = flags.token ?? process.env.XEMA_TOKEN;
+const http_error_1 = require("./http-error");
+const session_auth_1 = require("../runtime/auth/session-auth");
+const credentials_1 = require("../runtime/sources/credentials");
+function authHeaders(target) {
+    return {
+        authorization: `Bearer ${target.token}`,
+        ...(target.orgId !== undefined && target.orgId.length > 0
+            ? { 'x-xema-org-id': target.orgId }
+            : {}),
+    };
+}
+function resolveExplicitToken(flags) {
+    if (flags.token !== undefined && flags.token.length > 0) {
+        return flags.token;
+    }
+    if (flags.tokenEnv !== undefined && flags.tokenEnv.length > 0) {
+        return new credentials_1.CredentialResolver().resolve(flags.tokenEnv, '--token-env');
+    }
+    const ambient = process.env.XEMA_TOKEN;
+    return ambient !== undefined && ambient.length > 0 ? ambient : undefined;
+}
+async function resolveTarget(flags) {
+    let token;
+    try {
+        token = resolveExplicitToken(flags);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+    }
+    let endpoint = flags.endpoint ?? process.env.XEMA_ENDPOINT;
+    if (token === undefined || endpoint === undefined || endpoint.length === 0) {
+        let session;
+        try {
+            session = await (0, session_auth_1.loadUsableSession)();
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+        }
+        if (session !== undefined) {
+            token = token ?? session.accessToken;
+            endpoint =
+                endpoint !== undefined && endpoint.length > 0
+                    ? endpoint
+                    : session.endpoint;
+        }
+    }
     if (endpoint === undefined || endpoint.length === 0) {
-        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No control-plane endpoint. Pass --endpoint <url> or set XEMA_ENDPOINT.');
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No control-plane endpoint. Pass --endpoint <url>, set XEMA_ENDPOINT, or run `xema login`.');
     }
     if (token === undefined || token.length === 0) {
-        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No org-admin token. Pass --token <jwt> or set XEMA_TOKEN.');
+        (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, 'No token. Pass --token <jwt>, set XEMA_TOKEN, or run `xema login`.');
     }
-    return { baseUrl: endpoint.replace(/\/+$/, ''), token };
+    const orgId = flags.orgId ?? process.env.XEMA_ORG_ID;
+    return {
+        baseUrl: endpoint.replace(/\/+$/, ''),
+        token,
+        ...(orgId !== undefined && orgId.length > 0 ? { orgId } : {}),
+    };
 }
 async function loadManifest(path) {
     let raw;
@@ -73,9 +124,11 @@ async function call(target, method, path, body) {
     }
     const text = await res.text();
     if (!res.ok) {
-        return (0, exit_codes_1.exitWith)(res.status === 404 ? exit_codes_1.XemaCliExitCode.NotFound : exit_codes_1.XemaCliExitCode.GenericError, `Control plane ${method} ${path} → ${res.status}: ${text || res.statusText}`);
+        return (0, exit_codes_1.exitWith)(res.status === 404 ? exit_codes_1.XemaCliExitCode.NotFound : exit_codes_1.XemaCliExitCode.GenericError, `Control plane ${method} ${path} → ${res.status}: ` +
+            (0, http_error_1.extractServerError)(res.status, text || res.statusText));
     }
-    return (text.length > 0 ? JSON.parse(text) : {});
+    const envelope = (text.length > 0 ? JSON.parse(text) : {});
+    return envelope.data;
 }
 const encode = (name) => encodeURIComponent(name);
 function planStack(target, stack, manifest) {