@xenosystem/agent-cli 0.5.106 → 0.5.108

package/node_modules/@xeno-corporation/account/dist/index.mjs

@@ -0,0 +1,2191 @@
+import {
+  AccountError,
+  __name,
+  codeForStatus,
+  normalizeDpopHtu
+} from "./chunk-FELZILY4.mjs";
+
+// src/types.ts
+import { z } from "zod";
+var MICRO_PER_CREDIT = 1e6;
+var surfaceSchema = z.string().min(2).max(64).regex(/^xeno[_a-z0-9]+$/, "surface must look like xeno_post");
+var accountSchema = z.object({
+  id: z.string().min(1),
+  email: z.string().email(),
+  username: z.string().nullable().default(null),
+  displayName: z.string().nullable().default(null),
+  avatarUrl: z.string().url().nullable().default(null),
+  emailVerified: z.boolean().default(false),
+  /** Linked app surfaces for this account (unified-account view). */
+  linkedSurfaces: z.array(surfaceSchema).default([])
+});
+var tokenSetSchema = z.object({
+  accessToken: z.string().min(1),
+  /** Opaque or JWT; the SDK treats it as opaque. */
+  tokenType: z.string().default("Bearer"),
+  expiresAt: z.coerce.date().nullable().default(null),
+  refreshToken: z.string().nullable().default(null),
+  /** OIDC ID token (authentication only — never sent to resource APIs). */
+  idToken: z.string().nullable().default(null),
+  scope: z.array(z.string()).default([]),
+  /** Session id claim, the join key for back-channel logout. */
+  sid: z.string().nullable().default(null),
+  /** Signature-verified claims; never populated by unverified decoding. */
+  accessClaims: z.record(z.unknown()).nullable().default(null),
+  idClaims: z.record(z.unknown()).nullable().default(null)
+});
+var oauthTokenResponseSchema = z.object({
+  access_token: z.string(),
+  token_type: z.string().default("Bearer"),
+  expires_in: z.number().optional(),
+  refresh_token: z.string().optional(),
+  id_token: z.string().optional(),
+  scope: z.string().optional()
+});
+var balanceSchema = z.object({
+  /** Settled balance. */
+  postedMicro: z.number().int(),
+  /** Settled minus active holds. */
+  pendingMicro: z.number().int(),
+  /** Most conservative spendable amount — gate approvals on this. */
+  availableMicro: z.number().int(),
+  currency: z.literal("credits").default("credits"),
+  asOf: z.coerce.date().default(() => /* @__PURE__ */ new Date(0))
+});
+var meterAggregationSchema = z.enum([
+  "sum",
+  "count",
+  "max",
+  "min",
+  "unique_count",
+  "latest"
+]);
+var usageEventSchema = z.object({
+  surface: surfaceSchema,
+  /** Stable, producer-supplied dedup id. */
+  transactionId: z.string().min(8).max(255),
+  operation: z.string().min(1),
+  model: z.string().nullable().default(null),
+  provider: z.string().nullable().default(null),
+  /** Pre-computed cost in micro-credits, if the caller priced it. */
+  costMicro: z.number().int().nonnegative().nullable().default(null),
+  inputTokens: z.number().int().nonnegative().nullable().default(null),
+  outputTokens: z.number().int().nonnegative().nullable().default(null),
+  /** Arbitrary attribution dimensions (project, workspace, …). */
+  dimensions: z.record(z.string()).default({}),
+  occurredAt: z.coerce.date().optional()
+});
+var usageResultSchema = z.object({
+  accepted: z.boolean(),
+  /** True when the event was a duplicate (idempotent no-op). */
+  duplicate: z.boolean().default(false),
+  costMicro: z.number().int().nonnegative(),
+  transactionId: z.string(),
+  balance: balanceSchema.nullable().default(null)
+});
+var holdRequestSchema = z.object({
+  surface: surfaceSchema,
+  /** Idempotency key for the hold itself. */
+  holdId: z.string().min(8).max(255),
+  amountMicro: z.number().int().positive(),
+  operation: z.string().min(1),
+  expiresInSeconds: z.number().int().positive().max(86400).default(900),
+  dimensions: z.record(z.string()).default({})
+});
+var holdSchema = z.object({
+  holdId: z.string(),
+  state: z.enum([
+    "held",
+    "settled",
+    "voided",
+    "expired"
+  ]),
+  amountMicro: z.number().int().nonnegative(),
+  settledMicro: z.number().int().nonnegative().default(0),
+  balance: balanceSchema.nullable().default(null)
+});
+var authzCheckSchema = z.object({
+  /** e.g. `user:abc` or `agent:scout`. */
+  subject: z.string().min(1),
+  relation: z.string().min(1),
+  /** e.g. `workspace:acme` or `post:123`. */
+  object: z.string().min(1),
+  context: z.record(z.unknown()).default({})
+});
+var authzResultSchema = z.object({
+  allowed: z.boolean(),
+  /** Optional reason/trace for debugging (never authoritative). */
+  reason: z.string().nullable().default(null)
+});
+function toMicro(credits) {
+  return Math.round(credits * MICRO_PER_CREDIT);
+}
+__name(toMicro, "toMicro");
+function fromMicro(micro) {
+  return micro / MICRO_PER_CREDIT;
+}
+__name(fromMicro, "fromMicro");
+
+// src/jwt-json.ts
+function parseJwtObject(source) {
+  if (source.length > 16384) throw new SyntaxError("JWT JSON bound");
+  let offset = 0;
+  const whitespace = /* @__PURE__ */ __name(() => {
+    while (offset < source.length && /[ \t\r\n]/.test(source[offset] ?? "")) offset++;
+  }, "whitespace");
+  const invalid2 = /* @__PURE__ */ __name(() => {
+    throw new SyntaxError("Ambiguous JWT JSON");
+  }, "invalid");
+  const string = /* @__PURE__ */ __name(() => {
+    const start = offset++;
+    while (offset < source.length) {
+      const current = source[offset++];
+      if (current === '"') return JSON.parse(source.slice(start, offset));
+      if (current === "\\") offset++;
+    }
+    return invalid2();
+  }, "string");
+  const value = /* @__PURE__ */ __name((depth) => {
+    if (depth > 8) invalid2();
+    whitespace();
+    const opening = source[offset];
+    if (opening === '"') {
+      string();
+      return;
+    }
+    if (opening === "{" || opening === "[") {
+      const close = opening === "{" ? "}" : "]";
+      offset++;
+      whitespace();
+      if (source[offset] === close) {
+        offset++;
+        return;
+      }
+      const names = /* @__PURE__ */ new Set();
+      let count = 0;
+      while (offset < source.length) {
+        if (++count > 256) invalid2();
+        if (opening === "{") {
+          whitespace();
+          if (source[offset] !== '"') invalid2();
+          const key = string();
+          if (names.has(key) || key === "__proto__" || key === "constructor" || key === "prototype") invalid2();
+          names.add(key);
+          whitespace();
+          if (source[offset++] !== ":") invalid2();
+        }
+        value(depth + 1);
+        whitespace();
+        if (source[offset] === close) {
+          offset++;
+          return;
+        }
+        if (source[offset++] !== ",") invalid2();
+      }
+      return invalid2();
+    }
+    const literal = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(source.slice(offset));
+    if (!literal) return invalid2();
+    offset += literal[0].length;
+  }, "value");
+  value(0);
+  whitespace();
+  if (offset !== source.length) invalid2();
+  const parsed = JSON.parse(source, (_key, item) => {
+    if (typeof item === "number" && !Number.isFinite(item)) invalid2();
+    return item;
+  });
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) invalid2();
+  return parsed;
+}
+__name(parseJwtObject, "parseJwtObject");
+
+// src/http.ts
+function authorizationArgs(auth) {
+  return typeof auth === "function" ? {
+    authorization: auth
+  } : typeof auth === "string" ? {
+    token: auth,
+    tokenType: "Bearer"
+  } : {
+    token: auth.token,
+    tokenType: auth.tokenType,
+    headers: auth.headers
+  };
+}
+__name(authorizationArgs, "authorizationArgs");
+var Transport = class {
+  static {
+    __name(this, "Transport");
+  }
+  fetchImpl;
+  timeoutMs;
+  maxRetries;
+  userAgent;
+  maxResponseBytes;
+  constructor(opts = {}) {
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    this.timeoutMs = opts.timeoutMs ?? 8e3;
+    this.maxRetries = opts.maxRetries ?? 2;
+    this.userAgent = opts.userAgent ?? "xeno-account-client/0.1";
+    this.maxResponseBytes = opts.maxResponseBytes ?? 1024 * 1024;
+    if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1 || this.timeoutMs > 12e4 || !Number.isSafeInteger(this.maxResponseBytes) || this.maxResponseBytes < 1 || this.maxResponseBytes > 8 * 1024 * 1024 || !Number.isSafeInteger(this.maxRetries) || this.maxRetries < 0 || this.maxRetries > 10) throw new TypeError("Account transport deadline and response bound are invalid");
+  }
+  /** Perform a request and return parsed JSON (or null for empty bodies). */
+  async request(args) {
+    let body = args.body;
+    const headers = {
+      ...args.headers
+    };
+    if (body !== void 0 && typeof body !== "string") {
+      try {
+        body = JSON.stringify(body);
+      } catch {
+        throw new AccountError({
+          code: "BAD_REQUEST",
+          message: "Account request body cannot be serialized"
+        });
+      }
+      headers["content-type"] = "application/json";
+    }
+    args = Object.freeze({
+      ...args,
+      body,
+      headers: Object.freeze(headers)
+    });
+    const isMutation = args.method !== "GET";
+    const staticProof = args.tokenType === "DPoP" || Object.keys(args.headers ?? {}).some((name) => name.toLowerCase() === "dpop");
+    const retrySafe = (!isMutation || Boolean(args.idempotencyKey)) && (!staticProof || Boolean(args.authorization));
+    const attempts = retrySafe ? this.maxRetries + 1 : 1;
+    let lastErr = null;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      try {
+        return await this.once(args);
+      } catch (err) {
+        const ae = err instanceof AccountError ? err : new AccountError({
+          code: "UNREACHABLE",
+          message: "Account request failed before a verified response was received"
+        });
+        lastErr = ae;
+        if (!ae.retryable || attempt === attempts - 1) throw ae;
+        await sleep(backoffMs(attempt, ae.retryAfterMs), args.signal);
+      }
+    }
+    throw lastErr ?? new AccountError({
+      code: "PLATFORM_ERROR",
+      message: "request failed"
+    });
+  }
+  async once(args) {
+    const controller = new AbortController();
+    const callerAborted = /* @__PURE__ */ __name(() => controller.abort(), "callerAborted");
+    args.signal?.addEventListener("abort", callerAborted, {
+      once: true
+    });
+    if (args.signal?.aborted) callerAborted();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      if (args.signal?.aborted) throw cancellationError();
+      let auth;
+      if (args.authorization) {
+        try {
+          auth = await beforeAbort(args.authorization(args.method, args.url), controller.signal);
+        } catch (error) {
+          throw new AccountError({
+            code: error instanceof AccountError ? error.code : "UNREACHABLE",
+            message: "Account request authorization unavailable",
+            ...error instanceof AccountError ? {
+              httpStatus: error.httpStatus,
+              retryable: error.retryable
+            } : {}
+          });
+        }
+        if (!auth || typeof auth.token !== "string" || !auth.token || auth.token.length > 16384 || /[\r\n]/.test(auth.token) || ![
+          "Bearer",
+          "DPoP"
+        ].includes(auth.tokenType)) throw new AccountError({
+          code: "INVALID_TOKEN",
+          message: "Account request authorization invalid"
+        });
+        const proofHeaders = Object.entries(auth.headers ?? {}).filter(([name]) => name.toLowerCase() === "dpop");
+        if (auth.tokenType === "DPoP" && (proofHeaders.length !== 1 || typeof proofHeaders[0]?.[1] !== "string" || !proofHeaders[0][1] || proofHeaders[0][1].length > 16384 || /[\r\n]/.test(proofHeaders[0][1]))) throw new AccountError({
+          code: "INVALID_TOKEN",
+          message: "Account request proof invalid"
+        });
+      }
+      const supplied = Object.fromEntries(Object.entries(args.headers ?? {}).map(([key, value]) => [
+        key.toLowerCase(),
+        value
+      ]));
+      if (auth) {
+        delete supplied.authorization;
+        delete supplied.dpop;
+      }
+      const headers = {
+        accept: "application/json",
+        "user-agent": this.userAgent,
+        ...supplied,
+        ...Object.fromEntries(Object.entries(auth?.headers ?? {}).map(([key, value]) => [
+          key.toLowerCase(),
+          value
+        ]))
+      };
+      const token = auth?.token ?? args.token;
+      if (token) headers["authorization"] = `${auth?.tokenType ?? args.tokenType ?? "Bearer"} ${token}`;
+      if (args.idempotencyKey) headers["idempotency-key"] = args.idempotencyKey;
+      let payload;
+      if (typeof args.body === "string") {
+        payload = args.body;
+      } else if (args.body !== void 0) {
+        headers["content-type"] = "application/json";
+        try {
+          payload = JSON.stringify(args.body);
+        } catch {
+          throw new AccountError({
+            code: "BAD_REQUEST",
+            message: "Account request body cannot be serialized"
+          });
+        }
+      }
+      if (controller.signal.aborted) throw new Error("Account response deadline");
+      res = await fetchBeforeAbort(this.fetchImpl, args.url, {
+        method: args.method,
+        headers,
+        body: payload,
+        signal: controller.signal,
+        redirect: "error",
+        cache: "no-store",
+        credentials: "omit"
+      }, controller.signal);
+      if (!res.ok) {
+        const code = codeForStatus(res.status);
+        const oauthError = args.oauthErrorResponse ? await readOAuthError(res, controller.signal) : null;
+        throw new AccountError({
+          code,
+          message: `${args.method} ${safeUrl(args.url)} -> ${res.status}`,
+          httpStatus: res.status,
+          retryAfterMs: parseRetryAfter(res.headers.get("retry-after")),
+          oauthError
+        });
+      }
+      if (res.status === 204 || !res.body) return null;
+      const text = await readBoundedText(res, controller.signal, this.maxResponseBytes);
+      if (!text) return null;
+      try {
+        return JSON.parse(text);
+      } catch {
+        throw new AccountError({
+          code: "INVALID_RESPONSE",
+          message: `non-JSON response from ${safeUrl(args.url)}`
+        });
+      }
+    } catch (err) {
+      if (args.signal?.aborted) throw cancellationError();
+      if (err instanceof AccountError) throw err;
+      throw new AccountError({
+        code: "UNREACHABLE",
+        message: `request to ${safeUrl(args.url)} failed`,
+        retryable: true
+      });
+    } finally {
+      controller.abort();
+      args.signal?.removeEventListener("abort", callerAborted);
+      clearTimeout(timer);
+      if (res) cancelBody(res);
+    }
+  }
+};
+function cancelBody(response) {
+  void response.body?.cancel().catch(() => {
+  });
+}
+__name(cancelBody, "cancelBody");
+function beforeAbort(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const aborted = /* @__PURE__ */ __name(() => {
+      signal.removeEventListener("abort", aborted);
+      reject(new Error("Account response deadline"));
+    }, "aborted");
+    if (signal.aborted) {
+      void pending.catch(() => {
+      });
+      aborted();
+      return;
+    }
+    signal.addEventListener("abort", aborted, {
+      once: true
+    });
+    pending.then((value) => {
+      signal.removeEventListener("abort", aborted);
+      if (signal.aborted) aborted();
+      else resolve(value);
+    }, (error) => {
+      signal.removeEventListener("abort", aborted);
+      reject(error);
+    });
+  });
+}
+__name(beforeAbort, "beforeAbort");
+function fetchBeforeAbort(fetchImpl, url, init, signal) {
+  const pending = Promise.resolve(fetchImpl(url, init));
+  void pending.then((response) => {
+    if (signal.aborted) cancelBody(response);
+  }, () => {
+  });
+  return beforeAbort(pending, signal);
+}
+__name(fetchBeforeAbort, "fetchBeforeAbort");
+async function readBoundedText(response, signal, maxBytes) {
+  const reader = response.body?.getReader();
+  if (!reader) return "";
+  let complete = false;
+  try {
+    const decoder = new TextDecoder("utf-8", {
+      fatal: true
+    });
+    let text = "", size = 0;
+    while (true) {
+      const chunk = await beforeAbort(reader.read(), signal);
+      if (chunk.done) {
+        complete = true;
+        break;
+      }
+      size += chunk.value.byteLength;
+      if (size > maxBytes) throw new AccountError({
+        code: "INVALID_RESPONSE",
+        message: "Account response exceeds configured bound"
+      });
+      try {
+        text += decoder.decode(chunk.value, {
+          stream: true
+        });
+      } catch {
+        throw new AccountError({
+          code: "INVALID_RESPONSE",
+          message: "Account response is not valid UTF-8"
+        });
+      }
+    }
+    try {
+      return text + decoder.decode();
+    } catch {
+      throw new AccountError({
+        code: "INVALID_RESPONSE",
+        message: "Account response is not valid UTF-8"
+      });
+    }
+  } finally {
+    if (!complete) void reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}
+__name(readBoundedText, "readBoundedText");
+async function readOAuthError(response, signal) {
+  try {
+    const body = parseJwtObject(await readBoundedText(response, signal, 4096));
+    const code = body.error;
+    return typeof code === "string" && [
+      "invalid_grant",
+      "invalid_client",
+      "invalid_scope",
+      "invalid_request",
+      "unauthorized_client",
+      "unsupported_grant_type",
+      "authorization_pending",
+      "slow_down",
+      "access_denied",
+      "expired_token",
+      "use_dpop_nonce",
+      "invalid_dpop_proof"
+    ].includes(code) ? code : null;
+  } catch {
+    return null;
+  }
+}
+__name(readOAuthError, "readOAuthError");
+function backoffMs(attempt, retryAfterMs) {
+  if (retryAfterMs && retryAfterMs > 0) return Math.min(retryAfterMs, 1e4);
+  return Math.min(200 * (2 ** attempt + (attempt === 0 ? 0 : 1)), 5e3);
+}
+__name(backoffMs, "backoffMs");
+function parseRetryAfter(header) {
+  if (!header) return null;
+  const seconds = Number(header);
+  return Number.isFinite(seconds) ? seconds * 1e3 : null;
+}
+__name(parseRetryAfter, "parseRetryAfter");
+function cancellationError() {
+  return new AccountError({
+    code: "BAD_REQUEST",
+    message: "Account request was cancelled; outcome may be unconfirmed",
+    retryable: false
+  });
+}
+__name(cancellationError, "cancellationError");
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(done, ms);
+    function cleanup() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", aborted);
+    }
+    __name(cleanup, "cleanup");
+    function done() {
+      cleanup();
+      resolve();
+    }
+    __name(done, "done");
+    function aborted() {
+      cleanup();
+      reject(cancellationError());
+    }
+    __name(aborted, "aborted");
+    signal?.addEventListener("abort", aborted, {
+      once: true
+    });
+    if (signal?.aborted) aborted();
+  });
+}
+__name(sleep, "sleep");
+function safeUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.origin;
+  } catch {
+    return "[invalid account URL]";
+  }
+}
+__name(safeUrl, "safeUrl");
+
+// src/account.ts
+var AccountClient = class {
+  static {
+    __name(this, "AccountClient");
+  }
+  base;
+  transport;
+  constructor(base, transport) {
+    this.base = base;
+    this.transport = transport;
+  }
+  /** Resolve a token to its account, or throw an AccountError. */
+  async me(auth) {
+    let raw;
+    try {
+      raw = await this.transport.request({
+        method: "GET",
+        url: `${this.base}/api/v2/me`,
+        ...authorizationArgs(auth)
+      });
+    } catch (err) {
+      const isDpop = typeof auth === "object" && auth.tokenType === "DPoP";
+      if (err instanceof AccountError && err.code === "NOT_FOUND" && !isDpop) {
+        raw = await this.transport.request({
+          method: "GET",
+          url: `${this.base}/api/auth/me`,
+          ...authorizationArgs(auth)
+        });
+      } else {
+        throw err;
+      }
+    }
+    const account = normalize(raw);
+    if (!account) {
+      throw new AccountError({
+        code: "INVALID_RESPONSE",
+        message: "/me returned an unrecognised shape"
+      });
+    }
+    return account;
+  }
+};
+function normalize(body) {
+  if (!body || typeof body !== "object") return null;
+  const root = body;
+  const user = root["user"] ?? root["data"] ?? root;
+  if (!user || typeof user !== "object") return null;
+  const id = str(user["id"]);
+  const email = str(user["email"]);
+  if (!id || !email) return null;
+  const linked = Array.isArray(user["linkedSurfaces"]) ? [
+    ...new Set(user["linkedSurfaces"].map(normalizeSurface).filter(isSurface))
+  ] : [];
+  const parsed = accountSchema.safeParse({
+    id,
+    email,
+    username: str(user["username"]) ?? null,
+    displayName: str(user["display_name"]) ?? str(user["displayName"]) ?? null,
+    avatarUrl: str(user["avatar_url"]) ?? str(user["avatarUrl"]) ?? null,
+    emailVerified: Boolean(user["email_verified"] ?? user["emailVerified"] ?? false),
+    linkedSurfaces: linked
+  });
+  return parsed.success ? parsed.data : null;
+}
+__name(normalize, "normalize");
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+__name(str, "str");
+function normalizeSurface(value) {
+  if (typeof value !== "string") return void 0;
+  const parsed = surfaceSchema.safeParse(value.trim().toLowerCase().replace(/-/g, "_"));
+  return parsed.success ? parsed.data : void 0;
+}
+__name(normalizeSurface, "normalizeSurface");
+function isSurface(value) {
+  return value !== void 0;
+}
+__name(isSurface, "isSurface");
+
+// src/ledger.ts
+var LedgerClient = class {
+  static {
+    __name(this, "LedgerClient");
+  }
+  apiBase;
+  transport;
+  constructor(apiBase, transport) {
+    this.apiBase = apiBase;
+    this.transport = transport;
+  }
+  /** Posted / pending / available balance for the token's account. */
+  async getBalance(auth) {
+    const raw = await this.transport.request({
+      method: "GET",
+      url: `${this.apiBase}/api/v2/ledger/balance`,
+      ...authorizationArgs(auth)
+    });
+    return parse(balanceSchema, raw);
+  }
+  /**
+  * Record a usage event (the meter). Idempotent on `transactionId`; a duplicate
+  * returns `{ duplicate: true }` and does not charge again.
+  */
+  async recordUsage(auth, event) {
+    const e = usageEventSchema.parse(event);
+    const raw = await this.transport.request({
+      method: "POST",
+      url: `${this.apiBase}/api/v2/ledger/usage`,
+      ...authorizationArgs(auth),
+      body: e,
+      idempotencyKey: e.transactionId
+    });
+    return parse(usageResultSchema, raw);
+  }
+  /**
+  * Reserve credits for a per-use action (phase 1 of two-phase spend). Rejected
+  * with `INSUFFICIENT_CREDITS` if `available < amount`. Idempotent on `holdId`.
+  */
+  async hold(auth, req) {
+    const r = holdRequestSchema.parse(req);
+    const raw = await this.transport.request({
+      method: "POST",
+      url: `${this.apiBase}/api/v2/ledger/holds`,
+      ...authorizationArgs(auth),
+      body: r,
+      idempotencyKey: r.holdId
+    });
+    return parse(holdSchema, raw);
+  }
+  /**
+  * Settle a hold for the actual cost (phase 2). Posting less than the held
+  * amount auto-restores the remainder. Idempotent on `holdId`.
+  */
+  async settle(auth, holdId, actualCostMicro) {
+    const raw = await this.transport.request({
+      method: "POST",
+      url: `${this.apiBase}/api/v2/ledger/holds/${encodeURIComponent(holdId)}/settle`,
+      ...authorizationArgs(auth),
+      body: {
+        actualCostMicro
+      },
+      idempotencyKey: `${holdId}:settle`
+    });
+    return parse(holdSchema, raw);
+  }
+  /** Release a hold without charging (failure/cancel). Idempotent on `holdId`. */
+  async void(auth, holdId) {
+    const raw = await this.transport.request({
+      method: "POST",
+      url: `${this.apiBase}/api/v2/ledger/holds/${encodeURIComponent(holdId)}/void`,
+      ...authorizationArgs(auth),
+      body: {},
+      idempotencyKey: `${holdId}:void`
+    });
+    return parse(holdSchema, raw);
+  }
+};
+function parse(schema, raw) {
+  const r = schema.safeParse(raw);
+  if (!r.success || r.data === void 0) {
+    throw new AccountError({
+      code: "INVALID_RESPONSE",
+      message: "ledger returned an unrecognised shape"
+    });
+  }
+  return r.data;
+}
+__name(parse, "parse");
+
+// src/authz.ts
+var AuthzClient = class {
+  static {
+    __name(this, "AuthzClient");
+  }
+  apiBase;
+  transport;
+  constructor(apiBase, transport) {
+    this.apiBase = apiBase;
+    this.transport = transport;
+  }
+  async check(auth, check) {
+    const raw = await this.transport.request({
+      method: "POST",
+      url: `${this.apiBase}/api/v2/authz/check`,
+      ...authorizationArgs(auth),
+      body: check
+    });
+    const parsed = authzResultSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new AccountError({
+        code: "INVALID_RESPONSE",
+        message: "authz returned an unrecognised shape"
+      });
+    }
+    return parsed.data;
+  }
+};
+
+// src/verification.ts
+var jwksCache = /* @__PURE__ */ new Map();
+function bytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(normalized + "=".repeat((4 - normalized.length % 4) % 4));
+  return Uint8Array.from(bin, (char) => char.charCodeAt(0));
+}
+__name(bytes, "bytes");
+function decode(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) throw invalid("malformed JWT");
+  try {
+    return {
+      header: JSON.parse(new TextDecoder().decode(bytes(parts[0]))),
+      payload: JSON.parse(new TextDecoder().decode(bytes(parts[1]))),
+      signingInput: new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
+      signature: bytes(parts[2])
+    };
+  } catch {
+    throw invalid("malformed JWT");
+  }
+}
+__name(decode, "decode");
+function invalid(message) {
+  return new AccountError({
+    code: "INVALID_RESPONSE",
+    message: `OIDC verification failed: ${message}`
+  });
+}
+__name(invalid, "invalid");
+function audience(value, expected) {
+  return value === expected || Array.isArray(value) && value.includes(expected);
+}
+__name(audience, "audience");
+async function fetchJwks(transport, issuer, jwksUrl, force = false) {
+  const url = jwksUrl ?? `${issuer.replace(/\/+$/, "")}/api/oauth2/jwks`;
+  const cached = jwksCache.get(url);
+  if (!force && cached && cached.expiresAt > Date.now()) return cached.keys;
+  const response = await transport.request({
+    method: "GET",
+    url
+  });
+  if (!Array.isArray(response.keys) || response.keys.length === 0) throw invalid("empty JWKS");
+  jwksCache.set(url, {
+    keys: response.keys,
+    expiresAt: Date.now() + 5 * 6e4
+  });
+  return response.keys;
+}
+__name(fetchJwks, "fetchJwks");
+async function verifySignature(decoded, keys) {
+  if (decoded.header.alg !== "ES256" || typeof decoded.header.kid !== "string") return "invalid";
+  const jwk = keys.find((candidate) => candidate.kid === decoded.header.kid && candidate.kty === "EC" && candidate.crv === "P-256");
+  if (!jwk) return "unknown-kid";
+  try {
+    const key = await globalThis.crypto.subtle.importKey("jwk", jwk, {
+      name: "ECDSA",
+      namedCurve: "P-256"
+    }, false, [
+      "verify"
+    ]);
+    return await globalThis.crypto.subtle.verify({
+      name: "ECDSA",
+      hash: "SHA-256"
+    }, key, decoded.signature, decoded.signingInput) ? "valid" : "invalid";
+  } catch {
+    return "invalid";
+  }
+}
+__name(verifySignature, "verifySignature");
+async function verifiedPayload(token, transport, issuer, jwksUrl) {
+  const decoded = decode(token);
+  let keys = await fetchJwks(transport, issuer, jwksUrl);
+  let result = await verifySignature(decoded, keys);
+  if (result === "unknown-kid") {
+    keys = await fetchJwks(transport, issuer, jwksUrl, true);
+    result = await verifySignature(decoded, keys);
+  }
+  if (result !== "valid") throw invalid("signature or algorithm");
+  return decoded;
+}
+__name(verifiedPayload, "verifiedPayload");
+function temporal(payload, now) {
+  if (!Number.isInteger(payload.exp) || Number(payload.exp) <= now) throw invalid("token expired");
+  if (!Number.isInteger(payload.iat) || Number(payload.iat) > now + 60) throw invalid("invalid issued-at time");
+  if (payload.nbf !== void 0 && (!Number.isInteger(payload.nbf) || Number(payload.nbf) > now + 60)) throw invalid("token not yet valid");
+}
+__name(temporal, "temporal");
+async function verifyAccessToken(args) {
+  const decoded = await verifiedPayload(args.token, args.transport, args.issuer, args.jwksUrl);
+  const p = decoded.payload;
+  const now = Math.floor(Date.now() / 1e3);
+  temporal(p, now);
+  if (decoded.header.typ !== "at+jwt" || p.typ !== "at+jwt" || p.iss !== args.issuer || !audience(p.aud, "xeno-api")) throw invalid("access-token profile");
+  if (p.client_id !== args.clientId || p.azp !== args.clientId) throw invalid("client binding");
+  if (typeof p.sub !== "string" || typeof p.sid !== "string" || !Number.isInteger(p.auth_epoch)) throw invalid("session claims");
+  if (!p.cnf || typeof p.cnf !== "object" || p.cnf.jkt !== args.dpopJkt) throw invalid("DPoP binding");
+  if (p.act !== void 0) {
+    const act = p.act;
+    if (act.client_id !== "xeno-hub" || typeof act.installation_id_hash !== "string" || !act.installation_id_hash) throw invalid("broker actor");
+  }
+  if (args.requireBrokerActor && p.act === void 0) throw invalid("missing broker actor");
+  const held = new Set(String(p.scope ?? "").split(/\s+/).filter(Boolean));
+  for (const scope of args.expectedScopes ?? []) if (!held.has(scope)) throw invalid(`missing scope ${scope}`);
+  return p;
+}
+__name(verifyAccessToken, "verifyAccessToken");
+async function verifyIdToken(args) {
+  const decoded = await verifiedPayload(args.token, args.transport, args.issuer, args.jwksUrl);
+  const p = decoded.payload;
+  temporal(p, Math.floor(Date.now() / 1e3));
+  if (p.iss !== args.issuer || !audience(p.aud, args.clientId) || typeof p.sub !== "string" || typeof p.sid !== "string" || !Number.isInteger(p.auth_time)) throw invalid("ID-token profile");
+  if (args.expectedNonce !== void 0 && p.nonce !== args.expectedNonce) throw invalid("nonce mismatch");
+  if (args.expectedSubject !== void 0 && p.sub !== args.expectedSubject) throw invalid("subject mismatch");
+  return p;
+}
+__name(verifyIdToken, "verifyIdToken");
+async function verifyLogoutToken(args) {
+  const decoded = await verifiedPayload(args.token, args.transport, args.issuer, args.jwksUrl);
+  const p = decoded.payload;
+  temporal(p, Math.floor(Date.now() / 1e3));
+  const event = "http://schemas.openid.net/event/backchannel-logout";
+  if (decoded.header.typ !== "logout+jwt" || p.iss !== args.issuer || !audience(p.aud, args.clientId)) throw invalid("logout-token profile");
+  if (typeof p.jti !== "string" || !p.jti || p.nonce !== void 0) throw invalid("logout-token claims");
+  if (typeof p.sid !== "string" && typeof p.sub !== "string") throw invalid("logout subject");
+  if (!p.events || typeof p.events !== "object" || !(event in p.events)) throw invalid("logout event");
+  return p;
+}
+__name(verifyLogoutToken, "verifyLogoutToken");
+
+// src/oidc.ts
+async function generatePkce() {
+  const verifierBytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(verifierBytes);
+  const verifier = base64url(verifierBytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return {
+    verifier,
+    challenge: base64url(new Uint8Array(digest))
+  };
+}
+__name(generatePkce, "generatePkce");
+function generateState() {
+  const b = new Uint8Array(24);
+  globalThis.crypto.getRandomValues(b);
+  return base64url(b);
+}
+__name(generateState, "generateState");
+function base64url(bytes2) {
+  let bin = "";
+  for (let i = 0; i < bytes2.length; i += 1) bin += String.fromCharCode(bytes2[i]);
+  const b64 = typeof btoa === "function" ? btoa(bin) : Buffer.from(bytes2).toString("base64");
+  return b64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+__name(base64url, "base64url");
+function endpoints(cfg) {
+  const base = cfg.issuer.replace(/\/+$/, "");
+  return {
+    authorize: cfg.authorizeUrl ?? `${base}/api/oauth2/authorize`,
+    token: cfg.tokenUrl ?? `${base}/api/oauth2/token`,
+    device: cfg.deviceAuthorizationUrl ?? `${base}/api/oauth2/device_authorization`
+  };
+}
+__name(endpoints, "endpoints");
+var DEFAULT_SCOPES = [
+  "openid",
+  "profile",
+  "email",
+  "ledger"
+];
+function buildAuthorizeUrl(cfg, args) {
+  const redirectUri = args.redirectUri ?? cfg.redirectUri;
+  if (!redirectUri) {
+    throw new AccountError({
+      code: "BAD_REQUEST",
+      message: "redirectUri required for authorize"
+    });
+  }
+  const url = new URL(endpoints(cfg).authorize);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", cfg.clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", (args.scopes ?? cfg.scopes ?? DEFAULT_SCOPES).join(" "));
+  url.searchParams.set("state", args.state);
+  url.searchParams.set("code_challenge", args.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  if (args.nonce) url.searchParams.set("nonce", args.nonce);
+  if (args.prompt) url.searchParams.set("prompt", args.prompt);
+  if (args.maxAge !== void 0) url.searchParams.set("max_age", String(args.maxAge));
+  if (args.acrValues) url.searchParams.set("acr_values", args.acrValues);
+  return url.toString();
+}
+__name(buildAuthorizeUrl, "buildAuthorizeUrl");
+async function exchangeCode(cfg, transport, args) {
+  const redirectUri = args.redirectUri ?? cfg.redirectUri;
+  if (!redirectUri) {
+    throw new AccountError({
+      code: "BAD_REQUEST",
+      message: "redirectUri required for code exchange"
+    });
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: args.code,
+    redirect_uri: redirectUri,
+    client_id: cfg.clientId,
+    code_verifier: args.codeVerifier
+  });
+  if (cfg.clientSecret) body.set("client_secret", cfg.clientSecret);
+  return postToken(cfg, transport, body, {
+    requireIdToken: true,
+    expectedNonce: args.expectedNonce,
+    expectedScopes: args.expectedScopes,
+    signal: args.signal
+  });
+}
+__name(exchangeCode, "exchangeCode");
+async function refreshTokens(cfg, transport, refreshToken) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: cfg.clientId
+  });
+  if (cfg.clientSecret) body.set("client_secret", cfg.clientSecret);
+  return postToken(cfg, transport, body);
+}
+__name(refreshTokens, "refreshTokens");
+async function startDeviceAuthorization(cfg, transport, scopes) {
+  const body = new URLSearchParams({
+    client_id: cfg.clientId,
+    scope: (scopes ?? cfg.scopes ?? DEFAULT_SCOPES).join(" ")
+  });
+  const raw = await transport.request({
+    method: "POST",
+    url: endpoints(cfg).device,
+    headers: {
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: body.toString()
+  });
+  const expiresIn = Number(raw["expires_in"] ?? 600);
+  return {
+    deviceCode: String(raw["device_code"] ?? ""),
+    userCode: String(raw["user_code"] ?? ""),
+    verificationUri: String(raw["verification_uri"] ?? ""),
+    verificationUriComplete: typeof raw["verification_uri_complete"] === "string" ? raw["verification_uri_complete"] : null,
+    expiresAt: new Date(Date.now() + expiresIn * 1e3),
+    intervalSeconds: Number(raw["interval"] ?? 5)
+  };
+}
+__name(startDeviceAuthorization, "startDeviceAuthorization");
+async function pollDeviceToken(cfg, transport, device, opts = {}) {
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve) => {
+    const signal = opts.signal;
+    const timer = setTimeout(done, ms);
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    }
+    __name(done, "done");
+    signal?.addEventListener("abort", done, {
+      once: true
+    });
+    if (signal?.aborted) done();
+  }));
+  let intervalMs = device.intervalSeconds * 1e3;
+  while (Date.now() < device.expiresAt.getTime()) {
+    if (opts.signal?.aborted) {
+      throw new AccountError({
+        code: "BAD_REQUEST",
+        message: "device authorization aborted"
+      });
+    }
+    await sleep2(intervalMs);
+    if (opts.signal?.aborted) {
+      throw new AccountError({
+        code: "BAD_REQUEST",
+        message: "device authorization aborted"
+      });
+    }
+    if (Date.now() >= device.expiresAt.getTime()) break;
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: device.deviceCode,
+      client_id: cfg.clientId
+    });
+    try {
+      const tokens = await postToken(cfg, transport, body, {
+        requireIdToken: true,
+        signal: opts.signal
+      });
+      if (opts.signal?.aborted) throw new AccountError({
+        code: "BAD_REQUEST",
+        message: "device authorization aborted"
+      });
+      return tokens;
+    } catch (err) {
+      if (!(err instanceof AccountError)) throw err;
+      const oauthErr = err.oauthError;
+      if (err.httpStatus === 400 && oauthErr === "authorization_pending") continue;
+      if (err.httpStatus === 400 && oauthErr === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new AccountError({
+    code: "BAD_REQUEST",
+    message: "device code expired before approval"
+  });
+}
+__name(pollDeviceToken, "pollDeviceToken");
+async function postToken(cfg, transport, body, verify = {}) {
+  const tokenUrl = endpoints(cfg).token;
+  const dpop = await cfg.dpopSigner.createProof({
+    method: "POST",
+    url: tokenUrl
+  });
+  if (verify.signal?.aborted) throw new AccountError({
+    code: "BAD_REQUEST",
+    message: "Account sign-in was cancelled",
+    retryable: false
+  });
+  const raw = await transport.request({
+    method: "POST",
+    url: tokenUrl,
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      dpop
+    },
+    body: body.toString(),
+    oauthErrorResponse: true,
+    signal: verify.signal
+  });
+  const parsed = oauthTokenResponseSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new AccountError({
+      code: "INVALID_RESPONSE",
+      message: "token endpoint returned an unrecognised shape"
+    });
+  }
+  const t = parsed.data;
+  if (t.token_type.toLowerCase() !== "dpop") throw new AccountError({
+    code: "INVALID_RESPONSE",
+    message: "token endpoint did not issue a DPoP token"
+  });
+  if (verify.requireIdToken && !t.id_token) throw new AccountError({
+    code: "INVALID_RESPONSE",
+    message: "token endpoint omitted id_token"
+  });
+  const accessClaims = await verifyAccessToken({
+    token: t.access_token,
+    transport,
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    dpopJkt: cfg.dpopSigner.jkt,
+    jwksUrl: cfg.jwksUrl,
+    expectedScopes: verify.expectedScopes
+  });
+  const idClaims = t.id_token ? await verifyIdToken({
+    token: t.id_token,
+    transport,
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    jwksUrl: cfg.jwksUrl,
+    expectedNonce: verify.expectedNonce,
+    expectedSubject: accessClaims.sub
+  }) : null;
+  return tokenSetSchema.parse({
+    accessToken: t.access_token,
+    tokenType: t.token_type,
+    expiresAt: t.expires_in ? new Date(Date.now() + t.expires_in * 1e3) : null,
+    refreshToken: t.refresh_token ?? null,
+    idToken: t.id_token ?? null,
+    scope: t.scope ? t.scope.split(/\s+/).filter(Boolean) : [],
+    sid: idClaims?.sid ?? accessClaims.sid,
+    accessClaims,
+    idClaims
+  });
+}
+__name(postToken, "postToken");
+
+// src/tokenStore.ts
+function memoryStore() {
+  const m = /* @__PURE__ */ new Map();
+  const locks = /* @__PURE__ */ new Map();
+  return {
+    async withExclusive(key, work) {
+      const prior = locks.get(key) ?? Promise.resolve();
+      let release;
+      const held = new Promise((resolve) => {
+        release = resolve;
+      });
+      const tail = prior.then(() => held);
+      locks.set(key, tail);
+      await prior;
+      try {
+        return await work();
+      } finally {
+        release();
+        if (locks.get(key) === tail) locks.delete(key);
+      }
+    },
+    async get(k) {
+      return m.get(k) ?? null;
+    },
+    async set(k, v) {
+      m.set(k, v);
+    },
+    async delete(k) {
+      m.delete(k);
+    }
+  };
+}
+__name(memoryStore, "memoryStore");
+function keychainStore(kc) {
+  return {
+    ...kc.withExclusive ? {
+      withExclusive: /* @__PURE__ */ __name((key, work) => kc.withExclusive(key, work), "withExclusive")
+    } : {},
+    async get(k) {
+      return await kc.get(k) ?? null;
+    },
+    async set(k, v) {
+      await kc.set(k, v);
+    },
+    async delete(k) {
+      await kc.delete(k);
+    }
+  };
+}
+__name(keychainStore, "keychainStore");
+
+// src/client.ts
+var XenoAccountClient = class {
+  static {
+    __name(this, "XenoAccountClient");
+  }
+  surface;
+  account;
+  ledger;
+  authz;
+  oidcConfig;
+  transport;
+  store;
+  apiKey;
+  broker;
+  refreshStoreKey;
+  refreshPendingKey;
+  access = null;
+  user = null;
+  interactive;
+  resolutionFlight = null;
+  generation = 0;
+  locallySignedOut = false;
+  listeners = /* @__PURE__ */ new Set();
+  constructor(cfg) {
+    this.surface = surfaceSchema.parse(cfg.surface);
+    this.transport = new Transport(cfg.transport);
+    this.oidcConfig = {
+      issuer: cfg.issuer,
+      ...cfg.oidc
+    };
+    this.refreshStoreKey = `xeno.account/${this.oidcConfig.clientId}/refresh`;
+    this.refreshPendingKey = `${this.refreshStoreKey}/pending`;
+    this.account = new AccountClient(cfg.issuer, this.transport);
+    this.ledger = new LedgerClient(cfg.apiBase, this.transport);
+    this.authz = new AuthzClient(cfg.apiBase, this.transport);
+    this.store = cfg.store ?? memoryStore();
+    this.apiKey = cfg.apiKey ?? (typeof process !== "undefined" ? process.env?.XENO_API_KEY : void 0) ?? void 0;
+    this.broker = cfg.broker;
+  }
+  // ─── Session workhorse (priority chain, XENO AUTH §5) ───────────────────
+  /**
+  * Return a valid Bearer for the gate, walking the chain:
+  *   1 in-memory access token → 2 explicit override (apiKey/XENO_API_KEY) →
+  *   3 [broker — host-wired] → 4 this product's own refresh token →
+  *   5 interactive sign-in (host-provided; skipped when `silent`) → null.
+  */
+  async getAccessToken(opts = {}) {
+    const generation = this.generation;
+    const scopes = opts.scopes ? [
+      ...opts.scopes
+    ] : void 0;
+    if (this.access && this.access.expiresAtMs - 6e4 > Date.now() && containsScopes(this.access.scopes, scopes)) {
+      const held = this.access;
+      if (await this.cacheCurrent(held) && this.generation === generation) return held.token;
+    }
+    if (this.apiKey) return this.apiKey;
+    if (this.locallySignedOut && opts.silent) return null;
+    if (!this.resolutionFlight) {
+      const flight = this.resolveSession({
+        scopes,
+        silent: opts.silent
+      }, generation);
+      this.resolutionFlight = flight;
+      void flight.finally(() => {
+        if (this.resolutionFlight === flight) this.resolutionFlight = null;
+      }).catch(() => {
+      });
+    }
+    await this.resolutionFlight;
+    if (this.generation !== generation || !this.access) return null;
+    if (!await this.cacheCurrent(this.access) || this.generation !== generation || !this.access) return null;
+    if (!containsScopes(this.access.scopes, scopes)) throw new AccountError({
+      code: "INVALID_TOKEN",
+      message: "Current account session lacks required scope",
+      retryable: false
+    });
+    if (this.access.expiresAtMs <= Date.now()) return null;
+    return this.access.token;
+  }
+  async resolveSession(opts, generation) {
+    if (this.locallySignedOut) {
+      if (!opts.silent && this.interactive) await this.resolveInteractive(opts.scopes, generation);
+      return;
+    }
+    const pending = await this.storeRead(this.refreshPendingKey);
+    if (this.generation !== generation) return;
+    if (pending && !/^ready:v1:[A-Za-z0-9_-]{32}$/.test(pending)) {
+      if (!opts.silent && this.interactive) {
+        await this.resolveInteractive(opts.scopes, generation);
+        return;
+      }
+      if (pending === "signed-out:v1") {
+        this.setUnauthenticated();
+        if (!await this.storeRead(this.refreshStoreKey)) return;
+      } else {
+        throw new AccountError({
+          code: "CONFLICT",
+          message: "Previous account transition is unconfirmed; explicit sign-in recovery required",
+          retryable: false
+        });
+      }
+      if (pending === "signed-out:v1") throw transitionConflict();
+    }
+    if (this.broker) {
+      try {
+        const brokerToken = await this.broker.getToken({
+          clientId: this.oidcConfig.clientId,
+          scopes: opts.scopes ?? this.oidcConfig.scopes ?? [],
+          resource: "https://api.xenostudio.ai",
+          childDpopJkt: this.oidcConfig.dpopSigner.jkt
+        });
+        if (brokerToken) {
+          const claims = await verifyAccessToken({
+            token: brokerToken.accessToken,
+            transport: this.transport,
+            issuer: this.oidcConfig.issuer,
+            clientId: this.oidcConfig.clientId,
+            dpopJkt: this.oidcConfig.dpopSigner.jkt,
+            jwksUrl: this.oidcConfig.jwksUrl,
+            expectedScopes: opts.scopes,
+            requireBrokerActor: true
+          });
+          if (brokerToken.refreshToken) throw new AccountError({
+            code: "INVALID_RESPONSE",
+            message: "Broker cannot transfer refresh credentials",
+            retryable: false
+          });
+          await this.applyTokenSet({
+            ...brokerToken,
+            accessClaims: claims,
+            idClaims: null
+          }, generation, pending, true);
+          return;
+        }
+      } catch {
+      }
+    }
+    if (this.generation !== generation) return;
+    const transition = `refresh:v1:${generateState()}`;
+    const rt = await this.exclusiveStore(async () => {
+      if (this.generation !== generation) return null;
+      if (await this.store.get(this.refreshPendingKey) !== pending) throw transitionConflict();
+      const value = await this.store.get(this.refreshStoreKey);
+      if (value) await this.store.set(this.refreshPendingKey, transition);
+      return value;
+    });
+    if (this.generation !== generation) return;
+    if (rt) {
+      try {
+        const tokens = await this.refresh(rt);
+        if (!tokens.refreshToken) throw new AccountError({
+          code: "INVALID_RESPONSE",
+          message: "Rotating refresh response omitted successor credential",
+          retryable: false
+        });
+        await this.applyTokenSet(tokens, generation, transition);
+        return;
+      } catch (error) {
+        if (this.generation !== generation) return;
+        if (!(error instanceof AccountError && error.httpStatus === 400 && error.oauthError === "invalid_grant")) {
+          throw new AccountError({
+            code: error instanceof AccountError ? error.code : "UNREACHABLE",
+            message: "Account refresh outcome is unconfirmed; explicit recovery required",
+            retryable: false,
+            ...error instanceof AccountError ? {
+              httpStatus: error.httpStatus
+            } : {}
+          });
+        }
+        await this.exclusiveStore(async () => {
+          if (this.generation !== generation) return;
+          if (await this.store.get(this.refreshPendingKey) !== transition) throw transitionConflict();
+          await this.store.delete(this.refreshStoreKey);
+          await this.store.set(this.refreshPendingKey, "signed-out:v1");
+        });
+        if (this.generation !== generation) return;
+        this.setUnauthenticated();
+      }
+    }
+    if (!opts.silent && this.interactive) {
+      await this.resolveInteractive(opts.scopes, generation);
+    }
+    return;
+  }
+  /** Register the host's interactive sign-in (loopback PKCE / device grant). */
+  setInteractiveSignIn(fn) {
+    this.interactive = fn;
+  }
+  isAuthenticated() {
+    return !!this.access && this.access.expiresAtMs > Date.now();
+  }
+  currentUser() {
+    return this.user;
+  }
+  /** Subscribe to login/refresh/logout/backchannel. Returns an unsubscribe fn. */
+  onAuthChanged(cb) {
+    this.listeners.add(cb);
+    return () => this.listeners.delete(cb);
+  }
+  /** Local wipe only, used after durable host-side invalidation/reconciliation. */
+  async signOutLocal() {
+    this.generation++;
+    this.locallySignedOut = true;
+    this.resolutionFlight = null;
+    this.setUnauthenticated();
+    await this.exclusiveStore(async () => {
+      await this.store.set(this.refreshPendingKey, "signed-out:v1");
+      await this.store.delete(this.refreshStoreKey);
+    });
+  }
+  /** Revoke this subject-owned session, then always clear local state. */
+  async signOut() {
+    const original = this.access;
+    const local = this.signOutLocal();
+    void local.catch(() => {
+    });
+    let serverRevoked = false;
+    try {
+      if (original?.tokenType === "DPoP") {
+        const url = `${this.oidcConfig.issuer.replace(/\/+$/, "")}/api/oauth2/end_session`;
+        const dpop = await this.createProof({
+          method: "POST",
+          url,
+          accessToken: original.token
+        });
+        await this.transport.request({
+          method: "POST",
+          url,
+          token: original.token,
+          tokenType: "DPoP",
+          headers: {
+            dpop
+          },
+          idempotencyKey: `logout:${original.sid ?? "current"}`
+        });
+        serverRevoked = true;
+      }
+    } finally {
+      await local;
+    }
+    return {
+      serverRevoked
+    };
+  }
+  /** Step-up protected, subject-keyed global logout. Only authorized clients can call it. */
+  async signOutEverywhere() {
+    if (!this.access || this.access.tokenType !== "DPoP") throw new Error("fresh DPoP session required");
+    const original = this.access, generation = this.generation;
+    const url = `${this.oidcConfig.issuer.replace(/\/+$/, "")}/api/oauth2/logout_everywhere`;
+    const dpop = await this.createProof({
+      method: "POST",
+      url,
+      accessToken: original.token
+    });
+    if (this.generation !== generation || this.access !== original) throw new AccountError({
+      code: "CONFLICT",
+      message: "Account session changed before global revocation",
+      retryable: false
+    });
+    await this.transport.request({
+      method: "POST",
+      url,
+      token: original.token,
+      tokenType: "DPoP",
+      headers: {
+        dpop
+      },
+      idempotencyKey: `logout-all:${original.sid ?? "current"}`
+    });
+    try {
+      await this.broker?.logout?.();
+    } finally {
+      if (this.generation === generation) {
+        this.generation++;
+        this.locallySignedOut = true;
+        this.resolutionFlight = null;
+        this.setUnauthenticated();
+        await this.exclusiveStore(async () => {
+          if (await this.store.get(this.refreshPendingKey) !== original.storeTransition) return;
+          await this.store.set(this.refreshPendingKey, "signed-out:v1");
+          await this.store.delete(this.refreshStoreKey);
+        });
+      }
+    }
+  }
+  setUnauthenticated() {
+    this.access = null;
+    this.user = null;
+    this.emit(null);
+  }
+  emit(a) {
+    for (const cb of [
+      ...this.listeners
+    ]) {
+      try {
+        cb(a);
+      } catch {
+      }
+    }
+  }
+  async storeRead(key) {
+    try {
+      return await this.store.get(key);
+    } catch {
+      throw new AccountError({
+        code: "UNREACHABLE",
+        message: "Secure account store is unavailable",
+        retryable: false
+      });
+    }
+  }
+  async cacheCurrent(held) {
+    const transition = await this.storeRead(this.refreshPendingKey);
+    if (this.access === held && transition === held.storeTransition) return true;
+    if (this.access === held) this.setUnauthenticated();
+    return false;
+  }
+  async exclusiveStore(work) {
+    if (!this.store.withExclusive) throw new AccountError({
+      code: "UNREACHABLE",
+      message: "Secure account store exclusion is unavailable",
+      retryable: false
+    });
+    try {
+      return await this.store.withExclusive(this.refreshStoreKey, work);
+    } catch (error) {
+      if (error instanceof AccountError) throw error;
+      throw new AccountError({
+        code: "UNREACHABLE",
+        message: "Secure account state commit is unavailable",
+        retryable: false
+      });
+    }
+  }
+  async reserveSignIn(generation) {
+    const transition = `sign-in:v1:${generateState()}`;
+    await this.exclusiveStore(async () => {
+      if (this.generation !== generation) throw transitionConflict();
+      await this.store.set(this.refreshPendingKey, transition);
+    });
+    return transition;
+  }
+  async resolveInteractive(scopes, generation) {
+    const transition = await this.reserveSignIn(generation);
+    await this.applyTokenSet(await this.interactive(scopes), generation, transition);
+  }
+  /** Cache the access token, persist the rotated refresh token, update the user. */
+  async applyTokenSet(ts, generation, transition, preserveRefresh = false, signal) {
+    if (this.generation !== generation) return;
+    const claims = await verifyAccessToken({
+      token: ts.accessToken,
+      transport: this.transport,
+      issuer: this.oidcConfig.issuer,
+      clientId: this.oidcConfig.clientId,
+      dpopJkt: this.oidcConfig.dpopSigner.jkt,
+      jwksUrl: this.oidcConfig.jwksUrl
+    });
+    const idClaims = ts.idToken ? await verifyIdToken({
+      token: ts.idToken,
+      transport: this.transport,
+      issuer: this.oidcConfig.issuer,
+      clientId: this.oidcConfig.clientId,
+      jwksUrl: this.oidcConfig.jwksUrl,
+      expectedSubject: claims.sub
+    }) : null;
+    if (idClaims && idClaims.sid !== claims.sid) throw new AccountError({
+      code: "INVALID_RESPONSE",
+      message: "ID and access session binding differ",
+      retryable: false
+    });
+    if (ts.tokenType.toLowerCase() !== "dpop") throw new AccountError({
+      code: "INVALID_RESPONSE",
+      message: "Canonical session requires DPoP token type",
+      retryable: false
+    });
+    if (this.generation !== generation) return;
+    const expMs = Math.min(claims.exp * 1e3, ts.expiresAt?.getTime() ?? claims.exp * 1e3);
+    const storeTransition = `ready:v1:${generateState()}`;
+    await this.exclusiveStore(async () => {
+      if (this.generation !== generation) return;
+      if (await this.store.get(this.refreshPendingKey) !== transition) throw transitionConflict();
+      if (ts.refreshToken) {
+        await this.store.set(this.refreshStoreKey, ts.refreshToken);
+      } else if (!preserveRefresh) await this.store.delete(this.refreshStoreKey);
+      if (this.generation !== generation || signal?.aborted) throw transitionConflict();
+      await this.store.set(this.refreshPendingKey, storeTransition);
+      if (signal?.aborted) {
+        if (await this.store.get(this.refreshPendingKey) === storeTransition) {
+          await this.store.set(this.refreshPendingKey, "signed-out:v1");
+          await this.store.delete(this.refreshStoreKey);
+        }
+        throw transitionConflict();
+      }
+    });
+    if (this.generation !== generation) {
+      if (signal?.aborted) await this.cancelCommittedSignIn(storeTransition);
+      return;
+    }
+    this.access = {
+      token: ts.accessToken,
+      tokenType: ts.tokenType.toLowerCase() === "dpop" ? "DPoP" : "Bearer",
+      expiresAtMs: expMs,
+      scopes: claims.scope.split(/\s+/).filter(Boolean),
+      sid: claims.sid,
+      storeTransition
+    };
+    this.locallySignedOut = false;
+    if (idClaims) {
+      const u = accountFromVerifiedClaims(idClaims);
+      if (u) this.user = u;
+    } else if (this.user?.id !== claims.sub) this.user = null;
+    this.emit(this.user);
+    return storeTransition;
+  }
+  async cancelCommittedSignIn(transition) {
+    await this.exclusiveStore(async () => {
+      if (await this.store.get(this.refreshPendingKey) !== transition) return;
+      await this.store.set(this.refreshPendingKey, "signed-out:v1");
+      await this.store.delete(this.refreshStoreKey);
+    });
+  }
+  // ─── OIDC sign-in (Authorization Code + PKCE) ───────────────────────────
+  /**
+  * Begin "Continue with XENO". Returns the authorize URL to redirect to, plus
+  * the `{ state, verifier }` the caller MUST persist (encrypted) to complete
+  * the flow in {@link completeSignIn}.
+  */
+  async beginSignIn(args = {}) {
+    const state = generateState();
+    const nonce = generateState();
+    const pkce = await generatePkce();
+    const url = buildAuthorizeUrl(this.oidcConfig, {
+      state,
+      codeChallenge: pkce.challenge,
+      redirectUri: args.redirectUri,
+      scopes: args.scopes,
+      nonce,
+      ...args.fresh ? {
+        prompt: "login",
+        maxAge: 60,
+        acrValues: "urn:xeno:acr:fresh"
+      } : {}
+    });
+    return {
+      url,
+      state,
+      nonce,
+      pkce
+    };
+  }
+  /** Complete the code flow: exchange `code` (with the saved verifier) for tokens,
+  *  then cache the access token + persist the refresh token + set the user. */
+  async completeSignIn(args) {
+    const generation = ++this.generation;
+    this.resolutionFlight = null;
+    const invalidate = this.bindSignInCancellation(generation, args.signal);
+    try {
+      if (args.signal?.aborted) throw transitionConflict();
+      const transition = await this.reserveSignIn(generation);
+      if (args.signal?.aborted || this.generation !== generation) throw transitionConflict();
+      const ts = await exchangeCode(this.oidcConfig, this.transport, args);
+      const committed = await this.applyTokenSet(ts, generation, transition, false, args.signal);
+      if (this.generation !== generation || args.signal?.aborted) {
+        if (committed && args.signal?.aborted) await this.cancelCommittedSignIn(committed);
+        throw transitionConflict();
+      }
+      return ts;
+    } catch (error) {
+      if (args.signal?.aborted) throw transitionConflict();
+      throw error;
+    } finally {
+      invalidate();
+    }
+  }
+  bindSignInCancellation(generation, signal) {
+    const cancelled = /* @__PURE__ */ __name(() => {
+      if (this.generation !== generation) return;
+      this.generation++;
+      this.resolutionFlight = null;
+      this.setUnauthenticated();
+    }, "cancelled");
+    signal?.addEventListener("abort", cancelled, {
+      once: true
+    });
+    if (signal?.aborted) cancelled();
+    return () => signal?.removeEventListener("abort", cancelled);
+  }
+  /** Headers for one sender-constrained resource request. */
+  async authorization(method, url, opts = {}) {
+    const generation = this.generation;
+    const token = await this.getAccessToken(opts);
+    if (!token || this.generation !== generation) return null;
+    if (this.apiKey && token === this.apiKey) return {
+      token,
+      tokenType: "Bearer"
+    };
+    if (!this.access || this.access.token !== token || this.access.tokenType !== "DPoP") return {
+      token,
+      tokenType: "Bearer"
+    };
+    const dpop = await this.createProof({
+      method,
+      url,
+      accessToken: token
+    });
+    if (this.generation !== generation || this.access?.token !== token || this.access.expiresAtMs <= Date.now()) return null;
+    if (!await this.cacheCurrent(this.access) || this.generation !== generation || this.access?.token !== token) return null;
+    return {
+      token,
+      tokenType: "DPoP",
+      headers: {
+        dpop
+      }
+    };
+  }
+  /** Verify and sender-constrain a previously persisted access token. Server
+  * consumers use this for encrypted per-workspace sessions without placing
+  * those tokens into the process-global client cache. */
+  async authorizationForToken(token, method, url, expectedScopes) {
+    await verifyAccessToken({
+      token,
+      transport: this.transport,
+      issuer: this.oidcConfig.issuer,
+      clientId: this.oidcConfig.clientId,
+      dpopJkt: this.oidcConfig.dpopSigner.jkt,
+      jwksUrl: this.oidcConfig.jwksUrl,
+      expectedScopes
+    });
+    const dpop = await this.createProof({
+      method,
+      url,
+      accessToken: token
+    });
+    return {
+      token,
+      tokenType: "DPoP",
+      headers: {
+        dpop
+      }
+    };
+  }
+  /** Verify a provider-originated Back-Channel Logout Token. */
+  verifyBackchannelLogout(token) {
+    return verifyLogoutToken({
+      token,
+      transport: this.transport,
+      issuer: this.oidcConfig.issuer,
+      clientId: this.oidcConfig.clientId,
+      jwksUrl: this.oidcConfig.jwksUrl
+    });
+  }
+  async createProof(args) {
+    try {
+      return await this.oidcConfig.dpopSigner.createProof(args);
+    } catch {
+      throw new AccountError({
+        code: "UNREACHABLE",
+        message: "Host account request signing is unavailable",
+        retryable: false
+      });
+    }
+  }
+  /** Rotate tokens. Persist the returned refreshToken; a failure means re-auth. */
+  refresh(refreshToken) {
+    return refreshTokens(this.oidcConfig, this.transport, refreshToken);
+  }
+  // ─── Device grant (CLI / headless) ──────────────────────────────────────
+  startDeviceLogin(scopes) {
+    return startDeviceAuthorization(this.oidcConfig, this.transport, scopes);
+  }
+  async awaitDeviceLogin(device, opts) {
+    const generation = ++this.generation;
+    this.resolutionFlight = null;
+    const invalidate = this.bindSignInCancellation(generation, opts?.signal);
+    try {
+      if (opts?.signal?.aborted) throw transitionConflict();
+      const transition = await this.reserveSignIn(generation);
+      if (opts?.signal?.aborted || this.generation !== generation) throw transitionConflict();
+      const ts = await pollDeviceToken(this.oidcConfig, this.transport, device, opts);
+      const committed = await this.applyTokenSet(ts, generation, transition, false, opts?.signal);
+      if (this.generation !== generation || opts?.signal?.aborted) {
+        if (committed && opts?.signal?.aborted) await this.cancelCommittedSignIn(committed);
+        throw transitionConflict();
+      }
+      return ts;
+    } catch (error) {
+      if (opts?.signal?.aborted) throw transitionConflict();
+      throw error;
+    } finally {
+      invalidate();
+    }
+  }
+};
+function accountFromVerifiedClaims(p) {
+  if (!p.sub) return null;
+  return {
+    id: p.sub,
+    email: p.email ?? "",
+    username: p.preferred_username ?? null,
+    displayName: p.name ?? null,
+    avatarUrl: p.picture ?? null,
+    emailVerified: p.email_verified === true,
+    linkedSurfaces: []
+  };
+}
+__name(accountFromVerifiedClaims, "accountFromVerifiedClaims");
+function containsScopes(held, requested) {
+  if (!requested?.length) return true;
+  const set = new Set(held);
+  return requested.every((scope) => set.has(scope));
+}
+__name(containsScopes, "containsScopes");
+function transitionConflict() {
+  return new AccountError({
+    code: "CONFLICT",
+    message: "Account credential transition changed; explicit recovery required",
+    retryable: false
+  });
+}
+__name(transitionConflict, "transitionConflict");
+
+// src/bff.ts
+var BffSessionClient = class {
+  static {
+    __name(this, "BffSessionClient");
+  }
+  baseUrl;
+  fetchImpl;
+  csrf;
+  constructor(baseUrl = "/api/session", fetchImpl = globalThis.fetch, csrf) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+    this.csrf = csrf;
+  }
+  loginUrl(returnUrl) {
+    if (!returnUrl.startsWith("/") || returnUrl.startsWith("//")) throw new AccountError({
+      code: "BAD_REQUEST",
+      message: "returnUrl must be same-origin"
+    });
+    return `${this.baseUrl}/login/start?return_url=${encodeURIComponent(returnUrl)}`;
+  }
+  session() {
+    return this.request("GET", "/session");
+  }
+  refresh(idempotencyKey) {
+    return this.request("POST", "/refresh", idempotencyKey);
+  }
+  async logout() {
+    await this.request("POST", "/logout");
+  }
+  async request(method, path, idempotencyKey) {
+    const headers = {
+      accept: "application/json"
+    };
+    if (method === "POST") {
+      const csrf = this.csrf();
+      if (!csrf) throw new AccountError({
+        code: "BAD_REQUEST",
+        message: "missing BFF CSRF value"
+      });
+      headers["x-xeno-csrf"] = csrf;
+      if (idempotencyKey) headers["idempotency-key"] = idempotencyKey;
+    }
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      credentials: "include",
+      headers
+    });
+    if (!response.ok) throw new AccountError({
+      code: response.status === 401 ? "INVALID_TOKEN" : "PLATFORM_ERROR",
+      message: `BFF session request failed: ${response.status}`,
+      httpStatus: response.status
+    });
+    if (response.status === 204) return void 0;
+    return response.json();
+  }
+};
+
+// src/redaction.ts
+var TOKEN_RE = /(eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,})|([A-Za-z0-9_-]{40,})/g;
+function redact(input) {
+  const s = typeof input === "string" ? input : safeStringify(input);
+  return s.replace(TOKEN_RE, (m) => `${m.slice(0, 6)}\u2026[redacted:${m.length}]`);
+}
+__name(redact, "redact");
+function safeStringify(v) {
+  try {
+    return JSON.stringify(v) ?? String(v);
+  } catch {
+    return String(v);
+  }
+}
+__name(safeStringify, "safeStringify");
+
+// src/resource-authorization.ts
+var MAX_JWT_BYTES = 16384;
+var PRIVATE_FIELDS = [
+  "d",
+  "p",
+  "q",
+  "dp",
+  "dq",
+  "qi",
+  "oth",
+  "k"
+];
+function denied() {
+  return new AccountError({
+    code: "INVALID_TOKEN",
+    message: "Resource authorization refused",
+    retryable: false,
+    httpStatus: 401
+  });
+}
+__name(denied, "denied");
+function unavailable() {
+  return new AccountError({
+    code: "UNREACHABLE",
+    message: "Resource authorization authority unavailable",
+    retryable: true,
+    httpStatus: 503
+  });
+}
+__name(unavailable, "unavailable");
+function decodePart(part) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(part) || part.length % 4 === 1) throw denied();
+  const padded = part.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - part.length % 4) % 4);
+  try {
+    return Uint8Array.from(atob(padded), (value) => value.charCodeAt(0));
+  } catch {
+    throw denied();
+  }
+}
+__name(decodePart, "decodePart");
+function record(bytes2) {
+  try {
+    return parseJwtObject(new TextDecoder("utf-8", {
+      fatal: true
+    }).decode(bytes2));
+  } catch {
+    throw denied();
+  }
+}
+__name(record, "record");
+async function sha(value) {
+  const bytes2 = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+  return btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+__name(sha, "sha");
+function frozenClaims(claims) {
+  return Object.freeze({
+    iss: claims.iss,
+    sub: claims.sub,
+    aud: claims.aud,
+    exp: claims.exp,
+    iat: claims.iat,
+    sid: claims.sid,
+    client_id: claims.client_id,
+    azp: claims.azp,
+    scope: claims.scope,
+    typ: claims.typ,
+    auth_epoch: claims.auth_epoch,
+    ...claims.auth_time === void 0 ? {} : {
+      auth_time: claims.auth_time
+    },
+    ...claims.acr ? {
+      acr: claims.acr
+    } : {},
+    cnf: Object.freeze({
+      jkt: claims.cnf.jkt
+    }),
+    ...Array.isArray(claims.aud) ? {
+      aud: Object.freeze([
+        ...claims.aud
+      ])
+    } : {},
+    ...claims.act ? {
+      act: Object.freeze({
+        client_id: claims.act.client_id,
+        installation_id_hash: claims.act.installation_id_hash,
+        ...claims.act.sub ? {
+          sub: claims.act.sub
+        } : {}
+      })
+    } : {},
+    ...claims.amr ? {
+      amr: Object.freeze([
+        ...claims.amr
+      ])
+    } : {}
+  });
+}
+__name(frozenClaims, "frozenClaims");
+function createResourceRequestAuthorizer(options) {
+  const issuer = normalizeDpopHtu(options.issuer);
+  if (issuer.replace(/\/$/, "") !== options.issuer || !options.clientIds.length || options.clientIds.length > 128 || options.clientIds.some((id) => !/^[a-zA-Z0-9._-]{1,128}$/.test(id)) || new Set(options.clientIds).size !== options.clientIds.length) throw new TypeError("Explicit canonical issuer and unique clients required");
+  const clients = new Set(options.clientIds);
+  return {
+    async authorize(request) {
+      request = Object.freeze({
+        ...request,
+        ...request.scopes ? {
+          scopes: [
+            ...request.scopes
+          ]
+        } : {}
+      });
+      if (!/^[A-Z]{3,16}$/.test(request.method) || request.url.length > 8192 || request.authorization.length > MAX_JWT_BYTES + 5 || request.proof.length > MAX_JWT_BYTES || !request.proof || (request.scopes?.length ?? 0) > 128) throw denied();
+      let url;
+      try {
+        const parsed = new URL(request.url);
+        if (parsed.username || parsed.password || parsed.hash) throw denied();
+        url = normalizeDpopHtu(request.url);
+      } catch {
+        throw denied();
+      }
+      const match = /^DPoP ([a-zA-Z0-9_.-]+)$/.exec(request.authorization);
+      if (!match) throw denied();
+      const token = match[1];
+      const parts = request.proof.split(".");
+      if (parts.length !== 3) throw denied();
+      const header = record(decodePart(parts[0])), proof = record(decodePart(parts[1]));
+      if (header.typ !== "dpop+jwt" || header.alg !== "ES256" || header.crit !== void 0 || header.b64 !== void 0 || !header.jwk || typeof header.jwk !== "object" || Array.isArray(header.jwk)) throw denied();
+      const supplied = header.jwk;
+      if (PRIVATE_FIELDS.some((field) => supplied[field] !== void 0) || supplied.kty !== "EC" || supplied.crv !== "P-256" || typeof supplied.x !== "string" || typeof supplied.y !== "string" || decodePart(supplied.x).length !== 32 || decodePart(supplied.y).length !== 32) throw denied();
+      const jwk = {
+        kty: "EC",
+        crv: "P-256",
+        x: supplied.x,
+        y: supplied.y
+      };
+      const jkt = await sha(JSON.stringify({
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x,
+        y: jwk.y
+      }));
+      const now = Math.floor(Date.now() / 1e3);
+      if (typeof proof.jti !== "string" || !/^[a-zA-Z0-9._:-]{1,128}$/.test(proof.jti) || !Number.isSafeInteger(proof.iat) || Number(proof.iat) < now - 60 || Number(proof.iat) > now + 60 || proof.htm !== request.method || proof.htu !== url || proof.ath !== await sha(token) || (request.nonce === void 0 ? proof.nonce !== void 0 : proof.nonce !== request.nonce)) throw denied();
+      try {
+        const key = await crypto.subtle.importKey("jwk", jwk, {
+          name: "ECDSA",
+          namedCurve: "P-256"
+        }, false, [
+          "verify"
+        ]);
+        if (!await crypto.subtle.verify({
+          name: "ECDSA",
+          hash: "SHA-256"
+        }, key, decodePart(parts[2]), new TextEncoder().encode(`${parts[0]}.${parts[1]}`))) throw denied();
+      } catch {
+        throw denied();
+      }
+      const tokenParts = token.split(".");
+      if (tokenParts.length !== 3) throw denied();
+      const tokenHeader = record(decodePart(tokenParts[0]));
+      if (tokenHeader.alg !== "ES256" || tokenHeader.typ !== "at+jwt" || typeof tokenHeader.kid !== "string" || tokenHeader.kid.length > 128 || tokenHeader.crit !== void 0 || tokenHeader.b64 !== void 0 || tokenHeader.jku !== void 0 || tokenHeader.jwk !== void 0 || tokenHeader.x5u !== void 0) throw denied();
+      const untrusted = record(decodePart(tokenParts[1]));
+      if (untrusted.auth_time !== void 0 && (!Number.isSafeInteger(untrusted.auth_time) || Number(untrusted.auth_time) < 0 || Number(untrusted.auth_time) > now + 30)) throw denied();
+      if (untrusted.acr !== void 0 && (typeof untrusted.acr !== "string" || untrusted.acr.length > 128)) throw denied();
+      if (untrusted.amr !== void 0 && (!Array.isArray(untrusted.amr) || untrusted.amr.length > 16 || untrusted.amr.some((method) => typeof method !== "string" || !/^[a-zA-Z0-9._:-]{1,64}$/.test(method)))) throw denied();
+      if (typeof untrusted.client_id !== "string" || !clients.has(untrusted.client_id)) throw denied();
+      let verified;
+      try {
+        verified = await verifyAccessToken({
+          token,
+          transport: options.transport,
+          issuer: options.issuer,
+          clientId: untrusted.client_id,
+          dpopJkt: jkt,
+          expectedScopes: [
+            ...request.scopes ?? []
+          ]
+        });
+      } catch (error) {
+        if (error instanceof AccountError && error.retryable) throw unavailable();
+        throw denied();
+      }
+      if (!verified.sub || verified.sub.length > 256 || !verified.sid || verified.sid.length > 256 || !Number.isSafeInteger(verified.auth_epoch) || verified.auth_epoch < 0 || typeof verified.scope !== "string" || verified.scope.length > 8192) throw denied();
+      const claims = frozenClaims(verified);
+      const active = /* @__PURE__ */ __name(async () => {
+        if (claims.exp <= Math.floor(Date.now() / 1e3)) throw denied();
+        let current;
+        try {
+          current = await options.sessionActive(claims, token);
+        } catch {
+          throw unavailable();
+        }
+        if (current !== true) throw denied();
+      }, "active");
+      await active();
+      let consumed;
+      try {
+        consumed = await options.replayStore.consume({
+          keyThumbprint: jkt,
+          proofId: proof.jti,
+          method: request.method,
+          url,
+          expiresAtMs: Math.min(claims.exp * 1e3, (Number(proof.iat) + 61) * 1e3)
+        });
+      } catch {
+        throw unavailable();
+      }
+      if (consumed !== true) throw denied();
+      await active();
+      return Object.freeze({
+        claims,
+        revalidate: active
+      });
+    }
+  };
+}
+__name(createResourceRequestAuthorizer, "createResourceRequestAuthorizer");
+function createOidcIntrospectionSessionAuthority(options) {
+  const base = new URL(options.issuer);
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  if (base.origin !== options.issuer || base.protocol !== "https:" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 3e4) throw new TypeError("Canonical HTTPS issuer and bounded introspection timeout required");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  return async (claims, token) => {
+    if (token.length > MAX_JWT_BYTES || !token) throw unavailable();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetchBeforeAbort(fetchImpl, `${base.origin}/api/oauth2/introspect`, {
+        method: "POST",
+        redirect: "error",
+        cache: "no-store",
+        credentials: "omit",
+        signal: controller.signal,
+        headers: {
+          accept: "application/json",
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          token
+        }).toString()
+      }, controller.signal);
+      if (!response.ok || !response.body) throw unavailable();
+      const value = parseJwtObject(await readBoundedText(response, controller.signal, 32768));
+      if (value.active === false) return false;
+      const canonicalAudience = Array.isArray(value.aud) ? value.aud.includes("xeno-api") : value.aud === "xeno-api";
+      return value.active === true && value.token_type === "access_token" && value.iss === claims.iss && value.sub === claims.sub && value.sid === claims.sid && value.client_id === claims.client_id && value.exp === claims.exp && value.scope === claims.scope && canonicalAudience;
+    } catch {
+      throw unavailable();
+    } finally {
+      controller.abort();
+      clearTimeout(timer);
+      if (response) cancelBody(response);
+    }
+  };
+}
+__name(createOidcIntrospectionSessionAuthority, "createOidcIntrospectionSessionAuthority");
+export {
+  AccountClient,
+  AccountError,
+  AuthzClient,
+  BffSessionClient,
+  LedgerClient,
+  MICRO_PER_CREDIT,
+  Transport,
+  XenoAccountClient,
+  accountSchema,
+  authzCheckSchema,
+  authzResultSchema,
+  balanceSchema,
+  buildAuthorizeUrl,
+  codeForStatus,
+  createOidcIntrospectionSessionAuthority,
+  createResourceRequestAuthorizer,
+  exchangeCode,
+  fromMicro,
+  generatePkce,
+  generateState,
+  holdRequestSchema,
+  holdSchema,
+  keychainStore,
+  memoryStore,
+  meterAggregationSchema,
+  normalize,
+  normalizeDpopHtu,
+  oauthTokenResponseSchema,
+  pollDeviceToken,
+  redact,
+  refreshTokens,
+  startDeviceAuthorization,
+  surfaceSchema,
+  toMicro,
+  tokenSetSchema,
+  usageEventSchema,
+  usageResultSchema,
+  verifyAccessToken,
+  verifyIdToken,
+  verifyLogoutToken
+};
+//# sourceMappingURL=index.mjs.map