@xenosystem/agent-cli 0.5.107 → 0.5.108

package/node_modules/@xeno-corporation/account/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node.ts","../src/dpop.ts","../src/windows-host.ts","../src/errors.ts","../src/windows-host-helper.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;IAAAA,sBAAmB;;;ACiBZ,SAASC,iBAAiBC,OAAa;AAC5C,QAAMC,MAAM,IAAIC,IAAIF,KAAAA;AACpB,MAAIC,IAAIE,aAAa,SAAU,OAAM,IAAIC,MAAM,yBAAA;AAC/CH,MAAII,OAAO;AACXJ,MAAIK,SAAS;AACbL,MAAIM,WAAW;AACfN,MAAIO,WAAW;AACfP,MAAIQ,WAAWR,IAAIQ,SAASC,YAAW;AACvC,MAAIT,IAAIU,SAAS,MAAOV,KAAIU,OAAO;AACnC,SAAOV,IAAIW,SAAQ;AACrB;AAVgBb;;;ACjBhB,8BAAkC;AAClC,gCAA2D;AAC3D,yBAAgE;AAChE,uBAAqB;;;ACad,IAAMc,eAAN,cAA2BC,MAAAA;EAhBlC,OAgBkCA;;;EACvBC;EACAC;EACAC;EACAC;EACAC;EAET,YAAYC,MAOT;AACD,UAAMA,KAAKC,OAAO;AAClB,SAAKC,OAAO;AACZ,SAAKP,OAAOK,KAAKL;AACjB,SAAKC,aAAaI,KAAKJ,cAAc;AACrC,SAAKC,YAAYG,KAAKH,aAAaM,iBAAiBH,KAAKL,IAAI;AAC7D,SAAKG,eAAeE,KAAKF,gBAAgB;AACzC,SAAKC,aAAaC,KAAKD,cAAc;EACvC;AACF;AAEA,SAASI,iBAAiBR,MAAsB;AAC9C,SAAOA,SAAS,iBAAiBA,SAAS,kBAAkBA,SAAS;AACvE;AAFSQ;;;ACxCF,IAAMC,8BAA8BC,OAAOC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AF4BlD,IAAMC,iBAAiB;AAEvB,SAASC,UAAAA;AACP,SAAO,IAAIC,aAAa;IAAEC,MAAM;IAAeC,SAAS;IAAiDC,WAAW;EAAM,CAAA;AAC5H;AAFSJ;AAMT,eAAsBK,yBAAyBC,SAAkC;AAC/E,MAAIC,QAAQC,aAAa,QAAS,OAAMR,QAAAA;AACxC,QAAMS,WAAWH,QAAQG,UAAUC,YAAYJ,QAAQI,aAAaD;AACpE,QAAME,YAAYL,QAAQK,aAAa,MAAQC,SAASN,QAAQO,iBAAiB;AACjF,QAAMC,uBAAuBR,QAAQQ,wBAAwBH;AAC7D,MAAI,OAAOF,aAAa,YAAY,OAAOC,cAAc,YAAY,CAAC,iCAAiCK,KAAKN,QAAAA,KAAa,CAAC,sCAAsCM,KAAKL,SAAAA,KAChK,CAACM,OAAOC,cAAcN,SAAAA,KAAcA,YAAY,OAAQA,YAAY,OACpE,CAACK,OAAOC,cAAcL,MAAAA,KAAWA,SAAS,KAAKA,SAAS,OAAUD,aAAaC,UAC/E,CAACI,OAAOC,cAAcH,oBAAAA,KAAyBA,uBAAuB,OAAOA,uBAAuB,OACnGR,QAAQY,cAAcC,UAAa,OAAOb,QAAQY,cAAc,UAAY,OAAMlB,QAAAA;AACxF,QAAMoB,aAAab,QAAQc,IAAIC,cAAcf,QAAQc,IAAIE;AACzD,MAAI,CAACH,WAAY,OAAMpB,QAAAA;AACvB,QAAMwB,iBAAaC,uBAAKL,YAAY,gDAAA;AACpC,QAAMM,YAAQC,iCAAMH,YAAY;IAAC;IAAW;IAAc;IAAmB;IAAYI;KAA8B;IACrHC,aAAa;IAAMC,OAAO;MAAC;MAAQ;MAAQ;;IAASC,KAAKX;IACzDC,KAAK;MAAEC,YAAYF;MAAYY,QAAQZ;MAAYa,MAAM1B,QAAQc,IAAIY;MAAMC,KAAK3B,QAAQc,IAAIa;IAAI;EAClG,CAAA;AACA,QAAMC,MAAM,IAAIC,eAAeV,OAAOf,SAAAA;AACtC,MAAI0B;AACJ,MAAI;AAAEA,qBAAiB,MAAMF,IAAIG,QAAQ,QAAQ;MAAE7B;MAAUC;MAAW6B,WAAWhC,QAAQiC;MAAKtB,WAAWZ,QAAQY,cAAc;IAAK,CAAA;EAAI,QACpI;AAAE,UAAMiB,IAAIM,KAAI;AAAI,UAAMzC,QAAAA;EAAW;AAC3C,MAAI,CAACqC,kBAAkB,OAAOA,mBAAmB,UAAU;AAAE,UAAMF,IAAIM,KAAI;AAAI,UAAMzC,QAAAA;EAAW;AAChG,QAAM0C,QAAQL;AACd,QAAMM,eAAWC,+BAAW,QAAA,EAAUC,OAAO,gCAAgCnC,SAAAA,KAAcD,QAAAA,EAAU,EAAEqC,OAAO,KAAA;AAC9G,MAAIJ,MAAMK,aAAa,wCAAwCL,MAAMM,iBAAiB,KAAK,CAAChC,OAAOiC,UAAUP,MAAMQ,sBAAsB,MACnIlC,OAAO0B,MAAMQ,sBAAsB,IAAI,OAAO,KAAK,OAAOR,MAAMS,eAAe,aAChFT,MAAMU,YAAY,gBAAgBT,QAAAA,MAAc,OAAOD,MAAMW,eAAe,UAAU;AAAE,UAAMlB,IAAIM,KAAI;AAAI,UAAMzC,QAAAA;EAAW;AAChI,QAAMsD,OAAOC,OAAOC,KAAKd,MAAMW,YAAY,QAAA;AAC3C,MAAIC,KAAKG,WAAW,MAAMH,KAAKI,aAAa,CAAA,MAAO,aAAcJ,KAAKI,aAAa,CAAA,MAAO,IAAI;AAAE,UAAMvB,IAAIM,KAAI;AAAI,UAAMzC,QAAAA;EAAW;AACnI,QAAM2D,YAAY;IAAEC,KAAK;IAAMC,KAAK;IAASC,GAAGR,KAAKS,SAAS,GAAG,EAAA,EAAIC,SAAS,WAAA;IAAcC,GAAGX,KAAKS,SAAS,EAAA,EAAIC,SAAS,WAAA;EAAa;AACvI,QAAME,UAAMtB,+BAAW,QAAA,EAAUC,OAAOsB,KAAKC,UAAU;IAAEP,KAAKF,UAAUE;IAAKD,KAAKD,UAAUC;IAAKE,GAAGH,UAAUG;IAAGG,GAAGN,UAAUM;EAAE,CAAA,CAAA,EAAInB,OAAO,WAAA;AAC3I,QAAMuB,gBAAYC,oCAAgB;IAAEC,KAAKZ;IAAWa,QAAQ;EAAM,CAAA;AAClE,QAAMC,UAAU,IAAIC,0CAAAA;AACpB,MAAIC,OAAsBC,QAAQC,QAAO,GAAIC,QAAQ,GAAGC,SAAS,OAAOC,UAAU;AAClF,QAAMC,aAAa,gBAAgBxE,QAAAA;AACnC,QAAMyE,UAAU,6BAAA;AAAQ,QAAIH,UAAUC,WAAW7C,IAAIgD,OAAQ,OAAMnF,QAAAA;EAAW,GAA9D;AAChB,QAAMoF,WAAW,wBAACb,QAAAA;AAAkBW,YAAAA;AAAW,QAAIX,QAAQU,cAAcV,QAAQ,GAAGU,UAAAA,WAAsB,OAAMjF,QAAAA;EAAW,GAA1G;AACjB,QAAMqF,YAAY,8BAAUd,KAAae,SAAAA;AACvCF,aAASb,GAAAA;AACT,QAAIE,QAAQc,SAAQ,KAAMT,SAAS,GAAI,OAAM9E,QAAAA;AAC7C8E;AACA,UAAMU,QAAQb;AAAM,QAAIc;AACxBd,WAAO,IAAIC,QAAcC,CAAAA,YAAAA;AAAaY,gBAAUZ;IAAS,CAAA;AACzD,UAAMW;AACN,UAAME,QAAe;MAAEC,QAAIC,+BAAAA;MAAcC,QAAQ;IAAK;AACtD,QAAIC,WAAW;AACf,QAAI;AACFZ,cAAAA;AAAW,YAAM/C,IAAIG,QAAQ,WAAW;QAAEoD,OAAOA,MAAMC;QAAI/E;MAAO,CAAA;AAAIkF,iBAAW;AACjF,UAAIC;AACJ,UAAI;AACF,eAAO,MAAMnB,QAAQoB,KAAK;UAACvB,QAAQwB,IAAIP,OAAOJ,IAAAA;UAAO,IAAIV,QAAe,CAACsB,UAAUC,WAAAA;AACjFJ,oBAAQK,WAAW,MAAA;AAAQV,oBAAMG,SAAS;AAAO,mBAAK1D,IAAIM,KAAI;AAAI0D,qBAAOnG,QAAAA,CAAAA;YAAY,GAAGc,oBAAAA;UAC1F,CAAA;SAAG;MACL,UAAA;AAAY,YAAIiF,MAAOM,cAAaN,KAAAA;MAAQ;IAC9C,UAAA;AACEL,YAAMG,SAAS;AACf,UAAI;AAAE,YAAIC,YAAY,CAAC3D,IAAIgD,OAAQ,OAAMhD,IAAIG,QAAQ,WAAW;UAAEoD,OAAOA,MAAMC;QAAG,CAAA;MAAI,UAAA;AAC5Eb;AAASW,gBAAAA;MAAW;IAChC;EACF,GAtBkB;AAuBlB,QAAMa,iBAAiB,8BAAOC,IAAYhC,KAAaiC,QAAiC,CAAC,MAAC;AACxFpB,aAASb,GAAAA;AACT,UAAMmB,QAAQjB,QAAQc,SAAQ;AAC9B,QAAIG,OAAO;AAAE,UAAI,CAACA,MAAMG,OAAQ,OAAM7F,QAAAA;AAAW,aAAOmC,IAAIG,QAAQiE,IAAI;QAAE,GAAGC;QAAOjC;QAAKmB,OAAOA,MAAMC;MAAG,CAAA;IAAI;AAC7G,WAAON,UAAUJ,YAAY,MAAMqB,eAAeC,IAAIhC,KAAKiC,KAAAA,CAAAA;EAC7D,GALuB;AAMvB,QAAMC,QAAoB;IACxBC,eAAerB;IACf,MAAMsB,IAAIpC,KAAG;AAAI,YAAMqC,SAAS,MAAMN,eAAe,OAAO/B,GAAAA;AAAM,UAAIqC,WAAW,QAAQ,OAAOA,WAAW,SAAU,OAAM5G,QAAAA;AAAW,aAAO4G;IAAQ;IACrJ,MAAMC,IAAItC,KAAKuC,MAAI;AAAI,UAAI,OAAOA,SAAS,YAAYvD,OAAOwD,WAAWD,MAAM,MAAA,IAAU,KAAM,OAAM9G,QAAAA;AAAW,YAAMsG,eAAe,OAAO/B,KAAK;QAAE7B,OAAOoE;MAAK,CAAA;IAAI;IACnK,MAAME,OAAOzC,KAAG;AAAI,YAAM+B,eAAe,UAAU/B,GAAAA;IAAM;EAC3D;AACA,QAAM0C,aAAyB;IAC7B/C;IACA,MAAMgD,YAAYC,MAAmB;AACnCjC,cAAAA;AACA,UAAI,CAACiC,QAAQ,OAAOA,KAAKC,WAAW,YAAY,OAAOD,KAAKE,QAAQ,YAAYF,KAAKE,IAAI5D,SAAS,QAC5F0D,KAAKG,gBAAgBnG,WAAc,OAAOgG,KAAKG,gBAAgB,YAAYH,KAAKG,YAAY7D,SAAS,SACpG,CAAC,iBAAiB1C,KAAKoG,KAAKG,WAAW,MACxCH,KAAKI,UAAUpG,WAAc,OAAOgG,KAAKI,UAAU,YAAYJ,KAAKI,MAAM9D,SAAS,QAAQ,SAAS1C,KAAKoG,KAAKI,KAAK,GAAK,OAAMvH,QAAAA;AACpI,YAAMoH,SAASD,KAAKC,OAAOI,YAAW;AACtC,UAAIH;AACJ,UAAI;AAAEA,cAAM,IAAII,IAAIN,KAAKE,GAAG;MAAG,QAAQ;AAAE,cAAMrH,QAAAA;MAAW;AAC1D,UAAI,CAAC,6CAA6Ce,KAAKqG,MAAAA,KAAWC,IAAIK,YAAYL,IAAIM,YACjFN,IAAIO,aAAa,SAAU,OAAM5H,QAAAA;AACtC,YAAM6H,SAAS;QAAEC,KAAK;QAASC,KAAK;QAAYC,KAAKrE;MAAU;AAC/D,YAAMsE,SAAS;QAAEC,SAAKtC,+BAAAA;QAAcuC,KAAKf;QAAQgB,KAAKC,iBAAiBlB,KAAKE,GAAG;QAAGiB,KAAKC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;QAC7G,GAAIvB,KAAKG,cAAc;UAAEqB,SAAK/F,+BAAW,QAAA,EAAUC,OAAOsE,KAAKG,WAAW,EAAExE,OAAO,WAAA;QAAa,IAAI,CAAC;QACrG,GAAIqE,KAAKI,QAAQ;UAAEA,OAAOJ,KAAKI;QAAM,IAAI,CAAC;MAAG;AAC/C,YAAMqB,IAAIrF,OAAOC,KAAKW,KAAKC,UAAUyD,MAAAA,CAAAA,EAAS7D,SAAS,WAAA,GAAc6E,IAAItF,OAAOC,KAAKW,KAAKC,UAAU6D,MAAAA,CAAAA,EAASjE,SAAS,WAAA;AACtH,YAAM8E,eAAevF,OAAOC,KAAK,GAAGoF,CAAAA,IAAKC,CAAAA,EAAG;AAC5C,YAAME,YAAY,MAAM5G,IAAIG,QAAQ,QAAQ;QAAE0G,UAAMpG,+BAAW,QAAA,EAAUC,OAAOiG,YAAAA,EAAchG,OAAO,QAAA;MAAU,CAAA;AAC/G,UAAI,OAAOiG,cAAc,SAAU,OAAM/I,QAAAA;AACzC,YAAMiJ,QAAQ1F,OAAOC,KAAKuF,WAAW,QAAA;AACrC,UAAIE,MAAMxF,WAAW,MAAM,KAACyF,2BAAO,UAAUJ,cAAc;QAAEvE,KAAKF;QAAW8E,aAAa;MAAa,GAAGF,KAAAA,EAAQ,OAAMjJ,QAAAA;AACxHkF,cAAAA;AAAW,aAAO,GAAG0D,CAAAA,IAAKC,CAAAA,IAAKI,MAAMjF,SAAS,WAAA,CAAA;IAChD;EACF;AACA,SAAO;IAAEyC;IAAOQ;IAAYmC,SAAS;MAAEC,MAAM;MAAkCC,gBAAgB;MAAMC,eAAe;MAClHpG,YAAYT,MAAMS;MAAYC,SAASoG,OAAO9G,MAAMU,OAAO;IAAE;IAC7D,MAAMqG,MAAMjD,QAAQ,CAAC,GAAC;AACpB,UAAIzB,OAAQ;AACZ,UAAIC,WAAWF,SAAS3C,IAAIuH,kBAAmBlD,MAAMmD,oBAAoB,CAACjH,MAAMS,WAAa,OAAMnD,QAAAA;AACnGgF,gBAAU;AACV,UAAI;AACF,cAAM7C,IAAIG,QAAQ,SAAS;UAAEqH,kBAAkBnD,MAAMmD,qBAAqB;QAAK,CAAA;AAC/E5E,iBAAS;MACX,SAAS6E,OAAO;AACd,YAAIzH,IAAIgD,OAAQJ,UAAS;AACzB,cAAM6E;MACR,UAAA;AACE5E,kBAAU;AACV,YAAID,OAAQ,OAAM5C,IAAIM,KAAI;MAC5B;IACF;EACF;AACF;AApHsBpC;AAsHtB,IAAM+B,iBAAN,MAAMA,gBAAAA;EA3JN,OA2JMA;;;;;EACKyH;EACT1E,SAAS;EACQ2E,UAAU,oBAAIC,IAAAA;EACvBC,SAASzG,OAAO0G,MAAM,CAAA;EAC9B,IAAIP,iBAAyB;AAAE,WAAO,KAAKI,QAAQI;EAAM;EACzD,YAAoBxI,OAA+Cf,WAAmB;SAAlEe,QAAAA;SAA+Cf,YAAAA;AACjE,SAAKkJ,SAAS,IAAIjF,QAAQC,CAAAA,YAAAA;AACxBnD,YAAMyI,KAAK,QAAQ,MAAA;AAAQ,aAAKC,KAAI;AAAIvF,gBAAAA;MAAW,CAAA;AACnDnD,YAAMyI,KAAK,SAAS,MAAA;AAAQ,aAAKC,KAAI;AAAIvF,gBAAAA;MAAW,CAAA;IACtD,CAAA;AACAnD,UAAM2I,OAAOC,OAAM;AACnB5I,UAAM6I,OAAOC,GAAG,QAAQC,CAAAA,UAAAA;AACtB,WAAKT,SAASzG,OAAOmH,OAAO;QAAC,KAAKV;QAAQS;OAAM;AAChD,UAAI,KAAKT,OAAOjD,aAAahH,gBAAgB;AAAE,aAAKqK,KAAI;AAAI,aAAK,KAAK3H,KAAI;AAAI;MAAQ;AACtF,eAASkI,UAAUA,UAAU,KAAKX,OAAOY,QAAQ,EAAA,MAAQ,KAAI;AAC3D,cAAM3B,QAAQ,KAAKe,OAAOjG,SAAS,GAAG4G,OAAAA;AAAU,aAAKX,SAAS,KAAKA,OAAOjG,SAAS4G,UAAU,CAAA;AAC7F,YAAIE;AACJ,YAAI;AAAEA,kBAAQ1G,KAAK2G,MAAM,IAAIC,YAAY,SAAS;YAAEC,OAAO;UAAK,CAAA,EAAGC,OAAOhC,KAAAA,CAAAA;QAAS,QAC7E;AAAE,eAAKmB,KAAI;AAAI,eAAK,KAAK3H,KAAI;AAAI;QAAQ;AAC/C,cAAMyI,OAAOL,SAAS,KAAKf,QAAQnD,IAAIkE,MAAMlF,EAAE;AAC/C,YAAI,CAACuF,QAAQ,OAAOL,MAAMM,OAAO,WAAW;AAAE,eAAKf,KAAI;AAAI,eAAK,KAAK3H,KAAI;AAAI;QAAQ;AACrF4D,qBAAa6E,KAAKnF,KAAK;AAAG,aAAK+D,QAAQ9C,OAAO6D,MAAMlF,EAAE;AACtD,YAAIkF,MAAMM,GAAID,MAAKrG,QAAQgG,MAAMnI,KAAK;YAAQwI,MAAK/E,OAAOnG,QAAAA,CAAAA;MAC5D;IACF,CAAA;AACA,eAAWoL,UAAU;MAAC1J,MAAM2J;MAAO3J,MAAM6I;MAAQ7I,MAAM2I;OAAS;AAC9De,aAAOZ,GAAG,SAAS,MAAA;AAAQ,aAAKJ,KAAI;AAAI,aAAK,KAAK3H,KAAI;MAAI,CAAA;IAC5D;EACF;EACAH,QAAQiE,IAAY+E,SAAkC,CAAC,GAAqB;AAC1E,QAAI,KAAKnG,UAAU,KAAK2E,QAAQI,QAAQ,IAAK,QAAOtF,QAAQuB,OAAOnG,QAAAA,CAAAA;AACnE,UAAM2F,SAAKC,+BAAAA,GAAc2F,OAAOpH,KAAKC,UAAU;MAAE,GAAGkH;MAAQ3F;MAAIY;IAAG,CAAA,IAAK;AACxE,QAAIhD,OAAOwD,WAAWwE,IAAAA,IAAQxL,eAAgB,QAAO6E,QAAQuB,OAAOnG,QAAAA,CAAAA;AACpE,WAAO,IAAI4E,QAAQ,CAACC,SAASsB,WAAAA;AAC3B,YAAMJ,QAAQK,WAAW,MAAA;AAAQ,aAAKgE,KAAI;AAAI,aAAK,KAAK3H,KAAI;MAAI,GAAG,KAAK9B,SAAS;AACjF,WAAKmJ,QAAQjD,IAAIlB,IAAI;QAAEd;QAASsB;QAAQJ;MAAM,CAAA;AAC9C,UAAI;AAAE,aAAKrE,MAAM2J,MAAMG,MAAMD,IAAAA;MAAO,QAAQ;AAAE,aAAKnB,KAAI;AAAI,aAAK,KAAK3H,KAAI;MAAI;IAC/E,CAAA;EACF;EACQ2H,OAAa;AACnB,SAAKjF,SAAS;AACd,eAAW+F,QAAQ,KAAKpB,QAAQwB,OAAM,GAAI;AAAEjF,mBAAa6E,KAAKnF,KAAK;AAAGmF,WAAK/E,OAAOnG,QAAAA,CAAAA;IAAY;AAC9F,SAAK8J,QAAQ2B,MAAK;EACpB;EACA,MAAMhJ,OAAsB;AAC1B,SAAK2H,KAAI;AACT,QAAI,KAAK1I,MAAMgK,aAAa,QAAQ,KAAKhK,MAAMiK,eAAe,KAAM;AACpE,SAAKjK,MAAM2J,MAAMO,IAAG;AAAI,SAAKlK,MAAMe,KAAI;AACvC,UAAM,KAAKoH;EACb;AACF;;;AFjMO,SAASgC,qBAAqBC,OAA0B;AAC7D,QAAMC,SAAS,OAAOD,UAAU,WAAWE,KAAKC,MAAMH,KAAAA,IAAuBA;AAC7E,MAAIC,OAAOG,QAAQ,QAAQH,OAAOI,QAAQ,WAAW,CAACJ,OAAOK,KAAK,CAACL,OAAOM,KAAK,CAACN,OAAOO,GAAG;AACxF,UAAM,IAAIC,MAAM,yCAAA;EAClB;AACA,QAAMC,aAAaT;AACnB,QAAMU,YAAY;IAAEP,KAAK;IAAMC,KAAK;IAASC,GAAGI,WAAWJ;IAAGC,GAAGG,WAAWH;EAAE;AAC9E,QAAMK,MAAMC,oBAAAA,QAAOC,WAAW,QAAA,EAAUC,OAAOb,KAAKc,UAAU;IAAEX,KAAK;IAASD,KAAK;IAAME,GAAGI,WAAWJ;IAAGC,GAAGG,WAAWH;EAAE,CAAA,CAAA,EAAIU,OAAO,WAAA;AACrI,QAAMC,MAAML,oBAAAA,QAAOM,iBAAiB;IAAED,KAAKR;IAA4CU,QAAQ;EAAM,CAAA;AACrG,SAAO;IACLR;IACA,MAAMS,YAAYC,MAAmB;AACnC,YAAMC,SAAS;QAAEC,KAAK;QAASC,KAAK;QAAYC,KAAKf;MAAU;AAC/D,YAAMgB,SAAkC;QACtCC,KAAKf,oBAAAA,QAAOgB,WAAU;QACtBC,KAAKR,KAAKS,OAAOC,YAAW;QAC5BC,KAAKC,iBAAiBZ,KAAKa,GAAG;QAC9BC,KAAKC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;MAC/B;AACA,UAAIlB,KAAKmB,YAAad,QAAOe,MAAM7B,oBAAAA,QAAOC,WAAW,QAAA,EAAUC,OAAOO,KAAKmB,WAAW,EAAExB,OAAO,WAAA;AAC/F,UAAIK,KAAKqB,MAAOhB,QAAOgB,QAAQrB,KAAKqB;AACpC,YAAMC,IAAIC,OAAOC,KAAK5C,KAAKc,UAAUO,MAAAA,CAAAA,EAASwB,SAAS,WAAA;AACvD,YAAMC,IAAIH,OAAOC,KAAK5C,KAAKc,UAAUW,MAAAA,CAAAA,EAASoB,SAAS,WAAA;AACvD,YAAME,YAAYpC,oBAAAA,QAAOqC,KAAK,UAAUL,OAAOC,KAAK,GAAGF,CAAAA,IAAKI,CAAAA,EAAG,GAAG;QAAE9B;QAAKiC,aAAa;MAAa,CAAA,EAAGJ,SAAS,WAAA;AAC/G,aAAO,GAAGH,CAAAA,IAAKI,CAAAA,IAAKC,SAAAA;IACtB;EACF;AACF;AA3BgBlD;","names":["import_node_crypto","normalizeDpopHtu","value","url","URL","protocol","Error","hash","search","username","password","hostname","toLowerCase","port","toString","AccountError","Error","code","httpStatus","retryable","retryAfterMs","oauthError","args","message","name","defaultRetryable","WINDOWS_ACCOUNT_HOST_HELPER","String","raw","MAX_PIPE_BYTES","refused","AccountError","code","message","retryable","createWindowsAccountHost","options","process","platform","clientId","namespace","timeoutMs","waitMs","lockTimeoutMs","transactionTimeoutMs","test","Number","isSafeInteger","createKey","undefined","systemRoot","env","SystemRoot","SYSTEMROOT","executable","join","child","spawn","WINDOWS_ACCOUNT_HOST_HELPER","windowsHide","stdio","cwd","WINDIR","TEMP","TMP","rpc","WindowsHostRpc","initialization","request","parentPid","pid","kill","value","identity","createHash","update","digest","provider","exportPolicy","isInteger","hardwareImplementation","createdKey","keyName","publicBlob","blob","Buffer","from","length","readUInt32LE","publicJwk","kty","crv","x","subarray","toString","y","jkt","JSON","stringify","publicKey","createPublicKey","key","format","context","AsyncLocalStorage","tail","Promise","resolve","locks","closed","closing","refreshKey","current","failed","validKey","exclusive","work","getStore","prior","release","lease","id","randomUUID","active","acquired","timer","race","run","_resolve","reject","setTimeout","clearTimeout","storageRequest","op","input","store","withExclusive","get","result","set","text","byteLength","delete","dpopSigner","createProof","args","method","url","accessToken","nonce","toUpperCase","URL","username","password","protocol","header","alg","typ","jwk","claims","jti","htm","htu","normalizeDpopHtu","iat","Math","floor","Date","now","ath","a","b","signingInput","signature","hash","bytes","verify","dsaEncoding","custody","kind","hardwareBacked","nonExportable","String","close","activeRequests","deleteCreatedKey","error","exited","pending","Map","buffer","alloc","size","once","fail","stderr","resume","stdout","on","chunk","concat","newline","indexOf","reply","parse","TextDecoder","fatal","decode","item","ok","stream","stdin","values","line","write","clear","exitCode","signalCode","end","createNodeDpopSigner","input","parsed","JSON","parse","kty","crv","x","y","d","Error","privateJwk","publicJwk","jkt","crypto","createHash","update","stringify","digest","key","createPrivateKey","format","createProof","args","header","alg","typ","jwk","claims","jti","randomUUID","htm","method","toUpperCase","htu","normalizeDpopHtu","url","iat","Math","floor","Date","now","accessToken","ath","nonce","a","Buffer","from","toString","b","signature","sign","dsaEncoding"]}

package/node_modules/@xeno-corporation/account/dist/node.mjs

@@ -0,0 +1,645 @@
+import {
+  AccountError,
+  __name,
+  normalizeDpopHtu
+} from "./chunk-FELZILY4.mjs";
+
+// src/node.ts
+import crypto from "node:crypto";
+
+// src/windows-host.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { spawn } from "node:child_process";
+import { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
+import { join } from "node:path";
+
+// src/windows-host-helper.ts
+var WINDOWS_ACCOUNT_HOST_HELPER = String.raw`
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false, $true)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false, $true)
+Add-Type -TypeDefinition @'
+using System;
+using System.Text;
+using System.IO;
+using System.Threading;
+using System.Security.Cryptography;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Runtime.InteropServices;
+public static class XenoAccountWindowsHost {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] struct Credential {
+    public uint Flags; public uint Type; public string TargetName; public string Comment;
+    public long LastWritten; public uint CredentialBlobSize; public IntPtr CredentialBlob;
+    public uint Persist; public uint AttributeCount; public IntPtr Attributes;
+    public string TargetAlias; public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CredReadW(string target, uint type, uint flags, out IntPtr credential);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CredWriteW(ref Credential credential, uint flags);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CredDeleteW(string target, uint type, uint flags);
+  [DllImport("advapi32.dll")] static extern void CredFree(IntPtr credential);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetProcessTimes(IntPtr process, out long creation, out long exit, out long kernel, out long user);
+  [DllImport("kernel32.dll")] static extern uint WaitForSingleObject(IntPtr process, uint milliseconds);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  [DllImport("kernel32.dll")] static extern IntPtr GetCurrentProcess();
+  [DllImport("ncrypt.dll", CharSet=CharSet.Unicode)] static extern int NCryptGetProperty(IntPtr handle, string name, byte[] output, int size, out int written, int flags);
+  static IntPtr parent;
+  static CngKey key;
+  static Mutex mutex;
+  static string lease, prefix, refreshKey, keyName;
+  static bool createdKey;
+  static volatile bool stopping;
+  static Thread monitor;
+  static readonly UTF8Encoding Utf8 = new UTF8Encoding(false, true);
+  static string Hash(string input) {
+    using (var h = SHA256.Create()) return BitConverter.ToString(h.ComputeHash(Utf8.GetBytes(input))).Replace("-", "").ToLowerInvariant();
+  }
+  static void ParentCurrent() {
+    long birth, exit, kernel, user, helperBirth;
+    if (parent == IntPtr.Zero || !GetProcessTimes(parent, out birth, out exit, out kernel, out user)
+      || !GetProcessTimes(GetCurrentProcess(), out helperBirth, out exit, out kernel, out user)
+      || birth >= helperBirth || WaitForSingleObject(parent, 0) != 258) throw new IOException("parent unavailable");
+  }
+  static void AssertLease(string input) {
+    ParentCurrent();
+    if (lease == null || input != lease) throw new IOException("exclusive lease required");
+  }
+  static string Target(string input) {
+    if (input != refreshKey && input != refreshKey + "/pending") throw new IOException("foreign credential namespace");
+    return prefix + Hash(input);
+  }
+  static bool CredentialExists(string target) {
+    IntPtr pointer;
+    if (CredReadW(target, 1, 0, out pointer)) { CredFree(pointer); return true; }
+    if (Marshal.GetLastWin32Error() == 1168) return false;
+    throw new IOException("credential presence unavailable");
+  }
+  public static object Init(string clientId, string scope, int parentPid, bool create) {
+    if (key != null || parent != IntPtr.Zero || !System.Text.RegularExpressions.Regex.IsMatch(clientId, "^xeno-[a-z0-9][a-z0-9-]{0,63}$")
+      || !System.Text.RegularExpressions.Regex.IsMatch(scope, "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$")) throw new IOException("invalid host identity");
+    parent = OpenProcess(0x100000 | 0x1000, false, parentPid); ParentCurrent();
+    var observedParent = parent;
+    monitor = new Thread(() => {
+      while (!stopping) {
+        uint result = WaitForSingleObject(observedParent, 100);
+        if (!stopping && result != 258) Environment.Exit(75);
+      }
+    });
+    monitor.IsBackground = true; monitor.Start();
+    var identity = Hash("xeno/account/windows-host/1\0" + scope + "\0" + clientId);
+    prefix = "XENO.Account/" + identity + "/"; refreshKey = "xeno.account/" + clientId + "/refresh";
+    var owner = WindowsIdentity.GetCurrent().User;
+    var acl = new MutexSecurity(); acl.SetAccessRuleProtection(true, false); acl.SetOwner(owner);
+    acl.AddAccessRule(new MutexAccessRule(owner, MutexRights.FullControl, AccessControlType.Allow));
+    acl.AddAccessRule(new MutexAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), MutexRights.FullControl, AccessControlType.Allow));
+    bool created;
+    mutex = new Mutex(false, "Global\\Xeno.Account." + Hash(owner.Value) + "." + identity, out created, acl);
+    var rules = mutex.GetAccessControl().GetAccessRules(true, true, typeof(SecurityIdentifier));
+    foreach (MutexAccessRule rule in rules) if (rule.AccessControlType == AccessControlType.Allow && rule.IdentityReference.Value != owner.Value
+      && rule.IdentityReference.Value != "S-1-5-18") throw new IOException("public mutex custody");
+    if (mutex.GetAccessControl().GetOwner(typeof(SecurityIdentifier)).Value != owner.Value) throw new IOException("foreign mutex owner");
+    keyName = "Xeno.Account." + identity;
+    var provider = new CngProvider("Microsoft Platform Crypto Provider");
+    bool held = false;
+    try {
+      try { held = mutex.WaitOne(5000); } catch (AbandonedMutexException) { held = true; throw new IOException("abandoned init"); }
+      if (!held) throw new IOException("init lock timeout"); ParentCurrent();
+      if (CngKey.Exists(keyName, provider)) key = CngKey.Open(keyName, provider);
+      else {
+        if (!create) throw new IOException("provisioned key required");
+        if (CredentialExists(Target(refreshKey)) || CredentialExists(Target(refreshKey + "/pending")))
+          throw new IOException("existing credential cannot change key");
+        var options = new CngKeyCreationParameters(); options.Provider = provider;
+        options.KeyUsage = CngKeyUsages.Signing; options.ExportPolicy = CngExportPolicies.None;
+        key = CngKey.Create(CngAlgorithm.ECDsaP256, keyName, options); createdKey = true;
+      }
+      if (key.Provider.Provider != "Microsoft Platform Crypto Provider" || key.ExportPolicy != CngExportPolicies.None
+        || key.IsMachineKey || key.AlgorithmGroup != CngAlgorithmGroup.ECDsa || key.KeyUsage != CngKeyUsages.Signing)
+        throw new IOException("key custody differs");
+      var implementation = new byte[4]; int implementationSize;
+      if (NCryptGetProperty(key.ProviderHandle.DangerousGetHandle(), "Impl Type", implementation, 4, out implementationSize, 0) != 0
+        || implementationSize != 4 || (BitConverter.ToInt32(implementation, 0) & 1) == 0) throw new IOException("hardware provider required");
+      var blob = key.Export(CngKeyBlobFormat.EccPublicBlob);
+      if (blob.Length != 72 || BitConverter.ToUInt32(blob, 0) != 0x31534345 || BitConverter.ToUInt32(blob, 4) != 32) throw new IOException("wrong P256 key");
+      ParentCurrent();
+      return new { publicBlob = Convert.ToBase64String(blob), provider = key.Provider.Provider,
+        exportPolicy = (int)key.ExportPolicy, hardwareImplementation = BitConverter.ToInt32(implementation, 0), createdKey = createdKey, keyName = keyName };
+    } finally { if (held) mutex.ReleaseMutex(); }
+  }
+  public static void Acquire(string input, int milliseconds) {
+    ParentCurrent(); if (lease != null || input == null || input.Length != 36 || milliseconds < 1 || milliseconds > 10000) throw new IOException("invalid lease");
+    bool held = false;
+    try {
+      try { held = mutex.WaitOne(milliseconds); } catch (AbandonedMutexException) { held = true; throw new IOException("abandoned lease"); }
+      if (!held) throw new IOException("lease timeout"); ParentCurrent(); lease = input;
+    } catch { if (held) mutex.ReleaseMutex(); throw; }
+  }
+  public static void Release(string input) {
+    AssertLease(input); lease = null; mutex.ReleaseMutex();
+  }
+  public static object Get(string input, string locked) {
+    AssertLease(locked); var target = Target(input); IntPtr pointer;
+    if (!CredReadW(target, 1, 0, out pointer)) {
+      if (Marshal.GetLastWin32Error() == 1168) return null;
+      throw new IOException("credential read unavailable");
+    }
+    byte[] bytes = null;
+    try {
+      var value = (Credential)Marshal.PtrToStructure(pointer, typeof(Credential));
+      if (value.Type != 1 || value.TargetName != target || value.Persist != 2 || value.CredentialBlobSize > 2560
+        || value.AttributeCount != 0) throw new IOException("credential profile differs");
+      bytes = new byte[value.CredentialBlobSize]; Marshal.Copy(value.CredentialBlob, bytes, 0, bytes.Length);
+      var result = Utf8.GetString(bytes); ParentCurrent(); return result;
+    } finally { if (bytes != null) Array.Clear(bytes, 0, bytes.Length); CredFree(pointer); }
+  }
+  public static void Set(string input, string text, string locked) {
+    AssertLease(locked); var target = Target(input); var bytes = Utf8.GetBytes(text);
+    if (bytes.Length > 2560) throw new IOException("credential bound");
+    IntPtr buffer = Marshal.AllocHGlobal(bytes.Length);
+    try {
+      Marshal.Copy(bytes, 0, buffer, bytes.Length);
+      var value = new Credential { Type = 1, TargetName = target, CredentialBlob = buffer,
+        CredentialBlobSize = (uint)bytes.Length, Persist = 2, UserName = "XENO Account" };
+      if (!CredWriteW(ref value, 0)) throw new IOException("credential write unavailable"); ParentCurrent();
+    } finally { for (int i=0;i<bytes.Length;i++) Marshal.WriteByte(buffer, i, 0); Marshal.FreeHGlobal(buffer); Array.Clear(bytes, 0, bytes.Length); }
+  }
+  public static void Delete(string input, string locked) {
+    AssertLease(locked); if (!CredDeleteW(Target(input), 1, 0) && Marshal.GetLastWin32Error() != 1168) throw new IOException("credential deletion unavailable"); ParentCurrent();
+  }
+  public static object Sign(string encoded) {
+    ParentCurrent(); var hash = Convert.FromBase64String(encoded); if (hash.Length != 32) throw new IOException("SHA256 bound");
+    using (var signer = new ECDsaCng(key)) {
+      var result = signer.SignHash(hash); if (result.Length != 64) throw new IOException("signature bound");
+      ParentCurrent(); return Convert.ToBase64String(result);
+    }
+  }
+  public static void Close(bool deleteCreated) {
+    bool cleanupHeld = false;
+    if (deleteCreated) {
+      if (!createdKey || lease != null) throw new IOException("original idle cleanup owner required");
+      try { cleanupHeld = mutex.WaitOne(5000); } catch (AbandonedMutexException) { mutex.ReleaseMutex(); throw new IOException("abandoned cleanup"); }
+      if (!cleanupHeld) throw new IOException("cleanup timeout");
+      try {
+        ParentCurrent();
+        if (CredentialExists(Target(refreshKey)) || CredentialExists(Target(refreshKey + "/pending"))) throw new IOException("qualification key cleanup requires empty vault");
+      } catch { mutex.ReleaseMutex(); throw; }
+    }
+    try {
+      stopping = true;
+      if (monitor != null) { if (!monitor.Join(1000)) throw new IOException("parent monitor did not stop"); monitor = null; }
+      if (lease != null) { mutex.ReleaseMutex(); lease = null; }
+      if (key != null) { if (deleteCreated) key.Delete(); key.Dispose(); key=null; }
+      if (mutex != null) { if (cleanupHeld) mutex.ReleaseMutex(); mutex.Dispose(); mutex=null; }
+      if (parent != IntPtr.Zero) { CloseHandle(parent); parent=IntPtr.Zero; }
+    } catch { Environment.Exit(76); }
+  }
+}
+'@
+try {
+  while ($null -ne ($line = [Console]::ReadLine())) {
+    if ($line.Length -gt 50000) { break }
+    $request = $null
+    try {
+      $request = $line | ConvertFrom-Json
+      $value = $null
+      switch ($request.op) {
+        'init' { $value = [XenoAccountWindowsHost]::Init($request.clientId, $request.namespace, [int]$request.parentPid, [bool]$request.createKey) }
+        'acquire' { [XenoAccountWindowsHost]::Acquire($request.lease, [int]$request.waitMs) }
+        'release' { [XenoAccountWindowsHost]::Release($request.lease) }
+        'get' { $value = [XenoAccountWindowsHost]::Get($request.key, $request.lease) }
+        'set' { [XenoAccountWindowsHost]::Set($request.key, $request.value, $request.lease) }
+        'delete' { [XenoAccountWindowsHost]::Delete($request.key, $request.lease) }
+        'sign' { $value = [XenoAccountWindowsHost]::Sign($request.hash) }
+        'close' { [XenoAccountWindowsHost]::Close([bool]$request.deleteCreatedKey) }
+        default { throw 'unsupported request' }
+      }
+      [Console]::WriteLine((@{id=$request.id;ok=$true;value=$value} | ConvertTo-Json -Depth 4 -Compress))
+      if ($request.op -eq 'close') { break }
+    } catch {
+      [Console]::WriteLine((@{id=$request.id;ok=$false;code='WINDOWS_ACCOUNT_HOST_REFUSED'} | ConvertTo-Json -Compress))
+      if ($null -eq $request -or $request.op -eq 'init') { break }
+    }
+  }
+} finally { [XenoAccountWindowsHost]::Close($false) }
+`;
+
+// src/windows-host.ts
+var MAX_PIPE_BYTES = 65536;
+function refused() {
+  return new AccountError({
+    code: "UNREACHABLE",
+    message: "Windows account host authority is unavailable",
+    retryable: false
+  });
+}
+__name(refused, "refused");
+async function createWindowsAccountHost(options) {
+  if (process.platform !== "win32") throw refused();
+  const clientId = options.clientId, namespace = options.namespace ?? clientId;
+  const timeoutMs = options.timeoutMs ?? 15e3, waitMs = options.lockTimeoutMs ?? 5e3;
+  const transactionTimeoutMs = options.transactionTimeoutMs ?? timeoutMs;
+  if (typeof clientId !== "string" || typeof namespace !== "string" || !/^xeno-[a-z0-9][a-z0-9-]{0,63}$/.test(clientId) || !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(namespace) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 6e4 || !Number.isSafeInteger(waitMs) || waitMs < 1 || waitMs > 1e4 || timeoutMs <= waitMs || !Number.isSafeInteger(transactionTimeoutMs) || transactionTimeoutMs < 100 || transactionTimeoutMs > 6e4 || options.createKey !== void 0 && typeof options.createKey !== "boolean") throw refused();
+  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
+  if (!systemRoot) throw refused();
+  const executable = join(systemRoot, "System32/WindowsPowerShell/v1.0/powershell.exe");
+  const child = spawn(executable, [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    WINDOWS_ACCOUNT_HOST_HELPER
+  ], {
+    windowsHide: true,
+    stdio: [
+      "pipe",
+      "pipe",
+      "pipe"
+    ],
+    cwd: systemRoot,
+    env: {
+      SystemRoot: systemRoot,
+      WINDIR: systemRoot,
+      TEMP: process.env.TEMP,
+      TMP: process.env.TMP
+    }
+  });
+  const rpc = new WindowsHostRpc(child, timeoutMs);
+  let initialization;
+  try {
+    initialization = await rpc.request("init", {
+      clientId,
+      namespace,
+      parentPid: process.pid,
+      createKey: options.createKey === true
+    });
+  } catch {
+    await rpc.kill();
+    throw refused();
+  }
+  if (!initialization || typeof initialization !== "object") {
+    await rpc.kill();
+    throw refused();
+  }
+  const value = initialization;
+  const identity = createHash("sha256").update(`xeno/account/windows-host/1\0${namespace}\0${clientId}`).digest("hex");
+  if (value.provider !== "Microsoft Platform Crypto Provider" || value.exportPolicy !== 0 || !Number.isInteger(value.hardwareImplementation) || (Number(value.hardwareImplementation) & 1) === 0 || typeof value.createdKey !== "boolean" || value.keyName !== `Xeno.Account.${identity}` || typeof value.publicBlob !== "string") {
+    await rpc.kill();
+    throw refused();
+  }
+  const blob = Buffer.from(value.publicBlob, "base64");
+  if (blob.length !== 72 || blob.readUInt32LE(0) !== 827540293 || blob.readUInt32LE(4) !== 32) {
+    await rpc.kill();
+    throw refused();
+  }
+  const publicJwk = {
+    kty: "EC",
+    crv: "P-256",
+    x: blob.subarray(8, 40).toString("base64url"),
+    y: blob.subarray(40).toString("base64url")
+  };
+  const jkt = createHash("sha256").update(JSON.stringify({
+    crv: publicJwk.crv,
+    kty: publicJwk.kty,
+    x: publicJwk.x,
+    y: publicJwk.y
+  })).digest("base64url");
+  const publicKey = createPublicKey({
+    key: publicJwk,
+    format: "jwk"
+  });
+  const context = new AsyncLocalStorage();
+  let tail = Promise.resolve(), locks = 0, closed = false, closing = false;
+  const refreshKey = `xeno.account/${clientId}/refresh`;
+  const current = /* @__PURE__ */ __name(() => {
+    if (closed || closing || rpc.failed) throw refused();
+  }, "current");
+  const validKey = /* @__PURE__ */ __name((key) => {
+    current();
+    if (key !== refreshKey && key !== `${refreshKey}/pending`) throw refused();
+  }, "validKey");
+  const exclusive = /* @__PURE__ */ __name(async (key, work) => {
+    validKey(key);
+    if (context.getStore() || locks >= 64) throw refused();
+    locks++;
+    const prior = tail;
+    let release;
+    tail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await prior;
+    const lease = {
+      id: randomUUID(),
+      active: true
+    };
+    let acquired = false;
+    try {
+      current();
+      await rpc.request("acquire", {
+        lease: lease.id,
+        waitMs
+      });
+      acquired = true;
+      let timer;
+      try {
+        return await Promise.race([
+          context.run(lease, work),
+          new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+              lease.active = false;
+              void rpc.kill();
+              reject(refused());
+            }, transactionTimeoutMs);
+          })
+        ]);
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+    } finally {
+      lease.active = false;
+      try {
+        if (acquired && !rpc.failed) await rpc.request("release", {
+          lease: lease.id
+        });
+      } finally {
+        locks--;
+        release();
+      }
+    }
+  }, "exclusive");
+  const storageRequest = /* @__PURE__ */ __name(async (op, key, input = {}) => {
+    validKey(key);
+    const lease = context.getStore();
+    if (lease) {
+      if (!lease.active) throw refused();
+      return rpc.request(op, {
+        ...input,
+        key,
+        lease: lease.id
+      });
+    }
+    return exclusive(refreshKey, () => storageRequest(op, key, input));
+  }, "storageRequest");
+  const store = {
+    withExclusive: exclusive,
+    async get(key) {
+      const result = await storageRequest("get", key);
+      if (result !== null && typeof result !== "string") throw refused();
+      return result;
+    },
+    async set(key, text) {
+      if (typeof text !== "string" || Buffer.byteLength(text, "utf8") > 2560) throw refused();
+      await storageRequest("set", key, {
+        value: text
+      });
+    },
+    async delete(key) {
+      await storageRequest("delete", key);
+    }
+  };
+  const dpopSigner = {
+    jkt,
+    async createProof(args) {
+      current();
+      if (!args || typeof args.method !== "string" || typeof args.url !== "string" || args.url.length > 8192 || args.accessToken !== void 0 && (typeof args.accessToken !== "string" || args.accessToken.length > 16384 || !/^[\x21-\x7e]+$/.test(args.accessToken)) || args.nonce !== void 0 && (typeof args.nonce !== "string" || args.nonce.length > 4096 || /[\r\n]/.test(args.nonce))) throw refused();
+      const method = args.method.toUpperCase();
+      let url;
+      try {
+        url = new URL(args.url);
+      } catch {
+        throw refused();
+      }
+      if (!/^(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)$/.test(method) || url.username || url.password || url.protocol !== "https:") throw refused();
+      const header = {
+        alg: "ES256",
+        typ: "dpop+jwt",
+        jwk: publicJwk
+      };
+      const claims = {
+        jti: randomUUID(),
+        htm: method,
+        htu: normalizeDpopHtu(args.url),
+        iat: Math.floor(Date.now() / 1e3),
+        ...args.accessToken ? {
+          ath: createHash("sha256").update(args.accessToken).digest("base64url")
+        } : {},
+        ...args.nonce ? {
+          nonce: args.nonce
+        } : {}
+      };
+      const a = Buffer.from(JSON.stringify(header)).toString("base64url"), b = Buffer.from(JSON.stringify(claims)).toString("base64url");
+      const signingInput = Buffer.from(`${a}.${b}`);
+      const signature = await rpc.request("sign", {
+        hash: createHash("sha256").update(signingInput).digest("base64")
+      });
+      if (typeof signature !== "string") throw refused();
+      const bytes = Buffer.from(signature, "base64");
+      if (bytes.length !== 64 || !verify("sha256", signingInput, {
+        key: publicKey,
+        dsaEncoding: "ieee-p1363"
+      }, bytes)) throw refused();
+      current();
+      return `${a}.${b}.${bytes.toString("base64url")}`;
+    }
+  };
+  return {
+    store,
+    dpopSigner,
+    custody: {
+      kind: "windows-credential-manager+tpm",
+      hardwareBacked: true,
+      nonExportable: true,
+      createdKey: value.createdKey,
+      keyName: String(value.keyName)
+    },
+    async close(input = {}) {
+      if (closed) return;
+      if (closing || locks || rpc.activeRequests || input.deleteCreatedKey && !value.createdKey) throw refused();
+      closing = true;
+      try {
+        await rpc.request("close", {
+          deleteCreatedKey: input.deleteCreatedKey === true
+        });
+        closed = true;
+      } catch (error) {
+        if (rpc.failed) closed = true;
+        throw error;
+      } finally {
+        closing = false;
+        if (closed) await rpc.kill();
+      }
+    }
+  };
+}
+__name(createWindowsAccountHost, "createWindowsAccountHost");
+var WindowsHostRpc = class WindowsHostRpc2 {
+  static {
+    __name(this, "WindowsHostRpc");
+  }
+  child;
+  timeoutMs;
+  exited;
+  failed = false;
+  pending = /* @__PURE__ */ new Map();
+  buffer = Buffer.alloc(0);
+  get activeRequests() {
+    return this.pending.size;
+  }
+  constructor(child, timeoutMs) {
+    this.child = child;
+    this.timeoutMs = timeoutMs;
+    this.exited = new Promise((resolve) => {
+      child.once("exit", () => {
+        this.fail();
+        resolve();
+      });
+      child.once("error", () => {
+        this.fail();
+        resolve();
+      });
+    });
+    child.stderr.resume();
+    child.stdout.on("data", (chunk) => {
+      this.buffer = Buffer.concat([
+        this.buffer,
+        chunk
+      ]);
+      if (this.buffer.byteLength > MAX_PIPE_BYTES) {
+        this.fail();
+        void this.kill();
+        return;
+      }
+      for (let newline; (newline = this.buffer.indexOf(10)) >= 0; ) {
+        const bytes = this.buffer.subarray(0, newline);
+        this.buffer = this.buffer.subarray(newline + 1);
+        let reply;
+        try {
+          reply = JSON.parse(new TextDecoder("utf-8", {
+            fatal: true
+          }).decode(bytes));
+        } catch {
+          this.fail();
+          void this.kill();
+          return;
+        }
+        const item = reply && this.pending.get(reply.id);
+        if (!item || typeof reply.ok !== "boolean") {
+          this.fail();
+          void this.kill();
+          return;
+        }
+        clearTimeout(item.timer);
+        this.pending.delete(reply.id);
+        if (reply.ok) item.resolve(reply.value);
+        else item.reject(refused());
+      }
+    });
+    for (const stream of [
+      child.stdin,
+      child.stdout,
+      child.stderr
+    ]) {
+      stream.on("error", () => {
+        this.fail();
+        void this.kill();
+      });
+    }
+  }
+  request(op, values = {}) {
+    if (this.failed || this.pending.size >= 128) return Promise.reject(refused());
+    const id = randomUUID(), line = JSON.stringify({
+      ...values,
+      id,
+      op
+    }) + "\n";
+    if (Buffer.byteLength(line) > MAX_PIPE_BYTES) return Promise.reject(refused());
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.fail();
+        void this.kill();
+      }, this.timeoutMs);
+      this.pending.set(id, {
+        resolve,
+        reject,
+        timer
+      });
+      try {
+        this.child.stdin.write(line);
+      } catch {
+        this.fail();
+        void this.kill();
+      }
+    });
+  }
+  fail() {
+    this.failed = true;
+    for (const item of this.pending.values()) {
+      clearTimeout(item.timer);
+      item.reject(refused());
+    }
+    this.pending.clear();
+  }
+  async kill() {
+    this.fail();
+    if (this.child.exitCode !== null || this.child.signalCode !== null) return;
+    this.child.stdin.end();
+    this.child.kill();
+    await this.exited;
+  }
+};
+
+// src/node.ts
+function createNodeDpopSigner(input) {
+  const parsed = typeof input === "string" ? JSON.parse(input) : input;
+  if (parsed.kty !== "EC" || parsed.crv !== "P-256" || !parsed.x || !parsed.y || !parsed.d) {
+    throw new Error("DPoP private JWK must be a P-256 EC key");
+  }
+  const privateJwk = parsed;
+  const publicJwk = {
+    kty: "EC",
+    crv: "P-256",
+    x: privateJwk.x,
+    y: privateJwk.y
+  };
+  const jkt = crypto.createHash("sha256").update(JSON.stringify({
+    crv: "P-256",
+    kty: "EC",
+    x: privateJwk.x,
+    y: privateJwk.y
+  })).digest("base64url");
+  const key = crypto.createPrivateKey({
+    key: privateJwk,
+    format: "jwk"
+  });
+  return {
+    jkt,
+    async createProof(args) {
+      const header = {
+        alg: "ES256",
+        typ: "dpop+jwt",
+        jwk: publicJwk
+      };
+      const claims = {
+        jti: crypto.randomUUID(),
+        htm: args.method.toUpperCase(),
+        htu: normalizeDpopHtu(args.url),
+        iat: Math.floor(Date.now() / 1e3)
+      };
+      if (args.accessToken) claims.ath = crypto.createHash("sha256").update(args.accessToken).digest("base64url");
+      if (args.nonce) claims.nonce = args.nonce;
+      const a = Buffer.from(JSON.stringify(header)).toString("base64url");
+      const b = Buffer.from(JSON.stringify(claims)).toString("base64url");
+      const signature = crypto.sign("sha256", Buffer.from(`${a}.${b}`), {
+        key,
+        dsaEncoding: "ieee-p1363"
+      }).toString("base64url");
+      return `${a}.${b}.${signature}`;
+    }
+  };
+}
+__name(createNodeDpopSigner, "createNodeDpopSigner");
+export {
+  createNodeDpopSigner,
+  createWindowsAccountHost
+};
+//# sourceMappingURL=node.mjs.map