archal 0.9.20 → 0.10.0

package/dist/vitest/{chunk-ARVS45PP.js → chunk-7L4BBB6M.js}

@@ -136,26 +136,6 @@ function parsePositiveInteger(rawValue, fallback, minimum = 1) {
   const parsed = Number(normalized);
   return Number.isSafeInteger(parsed) && parsed >= minimum ? parsed : fallback;
 }
-function normalizeApiBaseUrl(value) {
-  if (!value) return null;
-  const normalized = value.trim().replace(/\/+$/, "");
-  if (!normalized) return null;
-  let parsed;
-  try {
-    parsed = new URL(normalized);
-  } catch {
-    throw new Error(`Invalid ARCHAL_API_URL: "${normalized}" is not a valid URL`);
-  }
-  const isLocalhostHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
-  if (parsed.protocol !== "https:" && !isLocalhostHttp) {
-    throw new Error(`Hosted API URL must use HTTPS (or localhost HTTP). Received ${normalized}.`);
-  }
-  const pathname = parsed.pathname.replace(/\/+$/, "");
-  parsed.pathname = pathname.endsWith("/api") ? pathname.slice(0, -4) || "/" : pathname || "/";
-  parsed.search = "";
-  parsed.hash = "";
-  return parsed.toString().replace(/\/$/, "");
-}
 function resolveHostedWorkspaceHeader() {
   return trimEnv("ARCHAL_WORKSPACE_ID");
 }
@@ -652,6 +632,8 @@ var CREDENTIALS_MASTER_KEY_ENV_VAR = "ARCHAL_CREDENTIALS_MASTER_KEY";
 var KEYCHAIN_SERVICE = "archal-cli";
 var KEYCHAIN_ACCOUNT = "credentials-master-key";
 var HOSTED_DEFAULT_AUTH_BASE_URL = "https://www.archal.ai";
+var HOSTED_DEFAULT_API_BASE_URL = "https://api.archal.ai";
+var WORKSPACE_API_KEY_PREFIX = "archal_ws_";
 var STRICT_ENDPOINTS_ENV_VAR = "ARCHAL_STRICT_ENDPOINTS";
 var REQUEST_TIMEOUT_MS = 8e3;
 var ENV_TOKEN_FALLBACK_TTL_SECONDS = 24 * 60 * 60;
@@ -661,11 +643,6 @@ function isPlan(value) {
   return value === "free" || value === "pro" || value === "enterprise";
 }
 
-// ../node-auth/src/errors.ts
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 // ../node-auth/src/credential-store.ts
 import { spawnSync } from "child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
@@ -698,7 +675,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Cal.com",
     description: "Event types, schedules, availability slots, bookings, calendars, and webhooks.",
     stage: "preview",
-    toolCount: 18,
+    toolCount: 35,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -716,7 +693,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "ClickUp",
     description: "Teams, spaces, folders, lists, tasks, comments, tags, time tracking, and checklists.",
     stage: "preview",
-    toolCount: 40,
+    toolCount: 123,
     transport: "both",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -729,7 +706,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Customer.io",
     description: "Messaging automation across campaigns, broadcasts, transactional email, segments, customers, and message delivery.",
     stage: "preview",
-    toolCount: 22,
+    toolCount: 129,
     transport: "rest",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -794,7 +771,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "GitLab",
     description: "Projects, branches, commits, issues, merge requests, pipelines, labels, milestones, releases, and webhooks.",
     stage: "preview",
-    toolCount: 46,
+    toolCount: 559,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -829,7 +806,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "HubSpot",
     description: "CRM contacts, companies, deals, tickets, and engagements.",
     stage: "preview",
-    toolCount: 41,
+    toolCount: 44,
     transport: "rest",
     architectureClass: "replay-shell",
     domainPrimitives: [
@@ -864,7 +841,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Linear",
     description: "Issues, projects, teams, cycles, and workflows.",
     stage: "public",
-    toolCount: 50,
+    toolCount: 53,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -933,7 +910,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Sentry",
     description: "Error monitoring across organizations, projects, teams, issues, events, releases, and DSN keys.",
     stage: "preview",
-    toolCount: 25,
+    toolCount: 34,
     transport: "rest",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -1035,14 +1012,10 @@ var GENERATED_CLONE_CATALOG = [
     name: "Webflow",
     description: "Sites, pages, CMS collections, items, assets, forms, and webhooks.",
     stage: "preview",
-    toolCount: 19,
-    transport: "rest",
-    architectureClass: "replay-shell",
-    domainPrimitives: [
-      "recording replay cursor",
-      "CMS collection/item overlays",
-      "publish lifecycle captures"
-    ],
+    toolCount: 104,
+    transport: "both",
+    architectureClass: "standard-core",
+    domainPrimitives: [],
     behaviorOwner: null,
     opsCoverage: 100
   }
@@ -1138,142 +1111,11 @@ var STARTABLE_CLONE_CATALOG = CLONE_CATALOG.filter(
   (entry) => STARTABLE_CLONE_ID_SET.has(entry.id)
 );
 
-// ../billing-constants/src/credit-catalog.ts
-var CREDIT_COGS_MARKUP = 3;
-var CREDIT_TARGET_GROSS_MARGIN_PERCENT = Math.round(
-  (1 - 1 / CREDIT_COGS_MARKUP) * 100
-);
-
-// ../billing-constants/src/index.ts
-var PLAN_MONTHLY_TWIN_MINUTE_LIMITS = {
-  free: 500,
-  pro: 5e3,
-  enterprise: null
-};
-var PLAN_CONCURRENT_SESSION_LIMITS = {
-  free: 3,
-  pro: 10,
-  enterprise: 50
-};
-var FREE_WORKSPACE_MEMBER_LIMIT = 2;
-var PRO_PLAN_PRICE_USD = 199;
-function formatMinutesLabel(minutes) {
-  return minutes.toLocaleString("en-US");
-}
-var FREE_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.free;
-var PRO_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.pro;
-if (FREE_MINUTES == null || PRO_MINUTES == null) {
-  throw new Error("PLAN_MONTHLY_TWIN_MINUTE_LIMITS: free and pro must be non-null");
-}
-var PRO_EVALS_PER_SEAT = 500;
-var PRO_SESSION_MINUTES_PER_SEAT = 5e3;
-var PRO_MAX_SEATS = 5;
-var FREE_EVALS_PER_MONTH = 100;
-var PLAN_DISPLAY = {
-  free: {
-    tag: "Free",
-    priceLabel: "$0",
-    periodLabel: "",
-    included: [
-      `${formatMinutesLabel(FREE_MINUTES)} session-minutes / account`,
-      `${FREE_EVALS_PER_MONTH} evals / account`,
-      `1 workspace (${FREE_WORKSPACE_MEMBER_LIMIT} users max)`,
-      `${PLAN_CONCURRENT_SESSION_LIMITS.free} concurrent sessions / workspace`,
-      "All clones included"
-    ]
-  },
-  pro: {
-    tag: "Pro",
-    priceLabel: `$${PRO_PLAN_PRICE_USD}`,
-    periodLabel: "/mo per seat",
-    included: [
-      `${formatMinutesLabel(PRO_SESSION_MINUTES_PER_SEAT)} session-minutes / seat / month`,
-      `${PRO_EVALS_PER_SEAT} evals / seat / month`,
-      "All clones included",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.pro} concurrent sessions / workspace`,
-      `1 workspace, up to ${PRO_MAX_SEATS} seats with pooled usage`
-    ]
-  },
-  enterprise: {
-    tag: "Enterprise",
-    priceLabel: "Contact us",
-    periodLabel: "",
-    included: [
-      "Unlimited session-minutes",
-      "Unlimited seats per workspace",
-      "Unlimited workspaces",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.enterprise} concurrent sessions / workspace`,
-      "SSO / SAML",
-      "SOC 2 (in progress)",
-      "Custom clones & eval support",
-      "Dedicated onboarding & support"
-    ]
-  }
-};
-var PLAN_MAX_SESSION_TTL_SECONDS = {
-  free: 30 * 60,
-  // 30 minutes
-  pro: 60 * 60,
-  // 60 minutes
-  enterprise: 90 * 60
-  // 90 minutes
-};
-var MAX_ABSOLUTE_SESSION_LIFETIME_SECONDS = 4 * 60 * 60;
-var LIFETIME_PERIOD_RESETS_AT = new Date(Date.UTC(9999, 11, 31));
-var ALL_ENTITLED_CLONES = ALL_STARTABLE_CLONE_IDS;
-var SCENARIO_USAGE_WINDOW_DAYS = 7;
-var SCENARIO_USAGE_WINDOW_MS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
-var SCENARIO_USAGE_WINDOW_SECONDS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60;
-var LLM_PRICING_USD_PER_M_TOKENS = {
-  // Google Gemini (verified 2026-05-05, standard tier <=200K input tokens)
-  "gemini-2.5-pro": { input: 1.25, output: 10 },
-  "gemini-2.5-flash": { input: 0.3, output: 2.5 },
-  // OpenAI flagship text models (verified 2026-05-21, standard short-context tier)
-  "gpt-5.5": { input: 5, output: 30 },
-  "gpt-5.5-pro": { input: 30, output: 180 },
-  "gpt-5.4": { input: 2.5, output: 15 },
-  "gpt-5.4-mini": { input: 0.75, output: 4.5 },
-  "gpt-5.4-nano": { input: 0.2, output: 1.25 },
-  "gpt-5.4-pro": { input: 30, output: 180 },
-  "gpt-4o-mini": { input: 0.15, output: 0.6 },
-  "gpt-4o": { input: 2.5, output: 10 },
-  "gpt-4.1-mini": { input: 0.4, output: 1.6 },
-  "gpt-4.1-nano": { input: 0.1, output: 0.4 },
-  "gpt-4.1": { input: 2, output: 8 },
-  // DeepSeek (verified 2026-05-05; legacy names map to v4-flash per vendor)
-  "deepseek-chat": { input: 0.14, output: 0.28 },
-  "deepseek-reasoner": { input: 0.14, output: 0.28 },
-  "deepseek-v4-flash": { input: 0.14, output: 0.28 }
-};
-var LLM_PRICING_FAMILY_RATES = [
-  { match: /^gemini-2\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-pro"] },
-  { match: /^gemini-2\.5-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-flash"] },
-  { match: /^gpt-5\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5-pro"] },
-  { match: /^gpt-5\.5/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5"] },
-  { match: /^gpt-5\.4-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-pro"] },
-  { match: /^gpt-5\.4-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-mini"] },
-  { match: /^gpt-5\.4-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-nano"] },
-  { match: /^gpt-5\.4/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4"] },
-  { match: /^gpt-4o-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o-mini"] },
-  { match: /^gpt-4o(?!-mini)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o"] },
-  { match: /^gpt-4\.1-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-mini"] },
-  { match: /^gpt-4\.1-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-nano"] },
-  { match: /^gpt-4\.1(?!-mini|-nano)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1"] },
-  // Anthropic Claude 4.x list prices (verified 2026): Opus $5/$25, Sonnet
-  // $3/$15, Haiku 4.5 $1/$5 per 1M tokens (input/output).
-  { match: /^claude-opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^claude-haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^claude-sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^deepseek-chat/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-chat"] },
-  { match: /^deepseek-reasoner/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-reasoner"] },
-  { match: /^deepseek-v4-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-v4-flash"] }
-];
-
-// ../node-auth/src/clone-entitlements.ts
-var ENTITLED_CLONE_SET = new Set(ALL_ENTITLED_CLONES);
+// ../node-auth/src/credential-store.ts
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var ENTITLED_CLONE_SET = new Set(ALL_STARTABLE_CLONE_IDS);
 function normalizeEntitledCloneIds(cloneIds) {
   if (!cloneIds) {
     return [];
@@ -1290,8 +1132,6 @@ function normalizeEntitledCloneIds(cloneIds) {
   }
   return [...normalized];
 }
-
-// ../node-auth/src/credential-store.ts
 var KEYCHAIN_COMMAND_TIMEOUT_MS = 1500;
 var ARCHAL_DIR_NAME = ".archal";
 var TEST_SANDBOX_ID_ENV_VAR = "ARCHAL_TEST_SANDBOX_ID";
@@ -1363,7 +1203,7 @@ function seedSandboxFromRealHomeOnce(sandboxDir) {
   }
 }
 function getArchalDir() {
-  const explicit = process.env["ARCHAL_HOME"];
+  const explicit = process.env["ARCHAL_HOME"]?.trim();
   if (explicit) {
     return explicit;
   }
@@ -1647,7 +1487,66 @@ function readCredentialsFile(options) {
   return readCredentialsFileAtPath(getCredentialsPath(), options);
 }
 function isWorkspaceApiKey(token) {
-  return token.startsWith("archal_ws_") || token.startsWith("archal_") && !token.includes(".");
+  return token.startsWith(WORKSPACE_API_KEY_PREFIX) || token.startsWith("archal_") && !token.includes(".");
+}
+var WORKSPACE_API_KEY_EXPIRES_SECONDS = 365 * 24 * 60 * 60;
+function parseEnvToken(token, envName = AUTH_TOKEN_ENV_VAR, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return { status: "invalid", message: `${envName} is empty.` };
+  }
+  if (isWorkspaceApiKey(trimmed)) {
+    return {
+      status: "ok",
+      credentials: {
+        token: trimmed,
+        refreshToken: "",
+        email: "(workspace-api-key)",
+        plan: "pro",
+        selectedCloneIds: [],
+        expiresAt: nowSeconds + WORKSPACE_API_KEY_EXPIRES_SECONDS
+      }
+    };
+  }
+  const claims = decodeJwtPayload(trimmed);
+  if (claims === null) {
+    return {
+      status: "invalid",
+      message: `${envName} must be a JWT with valid plan and exp claims or a workspace API key (archal_ws_...).`
+    };
+  }
+  const email = typeof claims["email"] === "string" ? claims["email"] : `(from ${envName})`;
+  if (!isPlan(claims["plan"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid plan claim.`
+    };
+  }
+  const plan = claims["plan"];
+  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid exp claim.`
+    };
+  }
+  const expiresAt = claims["exp"];
+  if (expiresAt <= nowSeconds) {
+    return {
+      status: "expired",
+      message: `${envName} is expired. Remove it or replace it with a valid token.`
+    };
+  }
+  return {
+    status: "ok",
+    credentials: {
+      token: trimmed,
+      refreshToken: "",
+      email,
+      plan,
+      selectedCloneIds: [],
+      expiresAt
+    }
+  };
 }
 function getStoredCredentials(options) {
   const creds = readCredentialsFile(options);
@@ -1804,8 +1703,37 @@ function getConfiguredAuthBaseUrl(options) {
   }
   return isStrictEndpointModeEnabled() ? null : HOSTED_DEFAULT_AUTH_BASE_URL;
 }
+function readConfiguredUrlFromEnvChain(envVarNames, options) {
+  const uniqueEnvVars = [...new Set(envVarNames)];
+  return readConfiguredUrl(options, ...uniqueEnvVars);
+}
+function getConfiguredAuthValidationBaseUrl(options = {}) {
+  const apiUrlEnvVar = options.apiUrlEnvVar ?? "ARCHAL_API_URL";
+  const authUrlEnvVar = options.authUrlEnvVar ?? "ARCHAL_AUTH_URL";
+  const resolved = readConfiguredUrlFromEnvChain([
+    apiUrlEnvVar,
+    authUrlEnvVar,
+    "ARCHAL_AUTH_URL",
+    "ARCHAL_AUTH_BASE_URL",
+    "ARCHAL_API_URL",
+    "ARCHAL_API_BASE_URL"
+  ], options);
+  if (resolved) {
+    return resolved;
+  }
+  return isStrictEndpointModeEnabled() ? null : HOSTED_DEFAULT_AUTH_BASE_URL;
+}
+function getConfiguredVitestApiBaseUrl(fallback = HOSTED_DEFAULT_API_BASE_URL, options) {
+  return readConfiguredUrlFromEnvChain([
+    "ARCHAL_VITEST_API_URL",
+    "ARCHAL_API_URL",
+    "ARCHAL_API_BASE_URL",
+    "ARCHAL_AUTH_URL",
+    "ARCHAL_AUTH_BASE_URL"
+  ], options) ?? fallback;
+}
 
-// ../node-auth/src/request-metadata.ts
+// ../node-auth/src/token-exchange.ts
 function buildAuthRequestHeaders(metadata, includeContentType = false) {
   const headers = {};
   if (includeContentType) {
@@ -1933,34 +1861,6 @@ import { createHash as createHash2, timingSafeEqual } from "crypto";
 var STORED_CREDENTIALS_LOCK_TIMEOUT_MS = 3e4;
 var STORED_CREDENTIALS_STALE_LOCK_MS = STORED_CREDENTIALS_LOCK_TIMEOUT_MS;
 var STORED_CREDENTIALS_LOCK_POLL_INTERVAL_MS = 50;
-var DEFAULT_AUTH_BASE_URL = "https://www.archal.ai";
-var WORKSPACE_API_KEY_EXPIRES_SECONDS = 365 * 24 * 60 * 60;
-function readFirstConfiguredBaseUrl(envVars) {
-  for (const envVar of envVars) {
-    const configured = trimEnv(envVar);
-    if (!configured) {
-      continue;
-    }
-    const normalized = normalizeApiBaseUrl(configured);
-    if (normalized) {
-      return normalized;
-    }
-  }
-  return null;
-}
-function resolveHostedAuthBaseUrl(options) {
-  const authUrlEnvVar = options.authUrlEnvVar ?? "ARCHAL_AUTH_URL";
-  const apiUrlEnvVar = options.apiUrlEnvVar ?? "ARCHAL_API_URL";
-  const envVars = [.../* @__PURE__ */ new Set([
-    apiUrlEnvVar,
-    authUrlEnvVar,
-    "ARCHAL_AUTH_URL",
-    "ARCHAL_AUTH_BASE_URL",
-    "ARCHAL_API_URL",
-    "ARCHAL_API_BASE_URL"
-  ])];
-  return readFirstConfiguredBaseUrl(envVars) ?? DEFAULT_AUTH_BASE_URL;
-}
 function isImplicitTestSandboxFlow() {
   if (trimEnv("ARCHAL_HOME")) {
     return false;
@@ -1977,59 +1877,11 @@ function readExplicitEnvCredentials(envName) {
   if (!token) {
     return { kind: "missing" };
   }
-  const claims = decodeJwtPayload(token);
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  if (claims === null) {
-    if (isWorkspaceApiKey(token)) {
-      return {
-        kind: "valid",
-        credentials: {
-          token,
-          refreshToken: "",
-          email: "(workspace-api-key)",
-          plan: "pro",
-          selectedCloneIds: [],
-          expiresAt: nowSeconds + WORKSPACE_API_KEY_EXPIRES_SECONDS
-        }
-      };
-    }
-    return {
-      kind: "invalid",
-      message: `${envName} must be a JWT with valid plan and exp claims or a workspace API key (archal_ws_...).`
-    };
-  }
-  const email = typeof claims["email"] === "string" ? claims["email"] : `(from ${envName})`;
-  if (!isPlan(claims["plan"])) {
-    return {
-      kind: "invalid",
-      message: `${envName} JWT does not contain a valid plan claim.`
-    };
-  }
-  const plan = claims["plan"];
-  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
-    return {
-      kind: "invalid",
-      message: `${envName} JWT does not contain a valid exp claim.`
-    };
-  }
-  const expiresAt = claims["exp"];
-  if (expiresAt <= nowSeconds) {
-    return {
-      kind: "invalid",
-      message: `${envName} is expired. Remove it or replace it with a valid token.`
-    };
+  const parsed = parseEnvToken(token, envName);
+  if (parsed.status !== "ok") {
+    return { kind: "invalid", message: parsed.message };
   }
-  return {
-    kind: "valid",
-    credentials: {
-      token,
-      refreshToken: "",
-      email,
-      plan,
-      selectedCloneIds: [],
-      expiresAt
-    }
-  };
+  return { kind: "valid", credentials: parsed.credentials };
 }
 function readStoredCredentials(includeExpired = false) {
   prepareStoredCredentialSources();
@@ -2061,16 +1913,6 @@ function resolveCredentialsWithSource(tokenEnvVar, includeExpiredStored = false)
   }
   return { credentials: storedCredentials, source: "stored" };
 }
-function resolveHostedCredentials(tokenEnvVar = "ARCHAL_TOKEN") {
-  return resolveCredentialsWithSource(tokenEnvVar)?.credentials ?? null;
-}
-function getCredentials2(tokenEnvVar = "ARCHAL_TOKEN") {
-  const credentials = resolveHostedCredentials(tokenEnvVar);
-  if (!credentials) {
-    return null;
-  }
-  return credentials.expiresAt > Math.floor(Date.now() / 1e3) ? credentials : null;
-}
 function prepareStoredCredentialSources() {
   if (isImplicitTestSandboxFlow()) {
     seedTestSandboxCredentialsFromRealHome();
@@ -2156,7 +1998,15 @@ async function resolveCurrentCredentials(credentials, source, forceValidation, a
 }
 async function createHostedAuthLease(options = {}) {
   const tokenEnvVar = options.tokenEnvVar ?? "ARCHAL_TOKEN";
-  const authBaseUrl = resolveHostedAuthBaseUrl(options);
+  const authBaseUrl = getConfiguredAuthValidationBaseUrl({
+    apiUrlEnvVar: options.apiUrlEnvVar,
+    authUrlEnvVar: options.authUrlEnvVar
+  });
+  if (!authBaseUrl) {
+    throw new Error(
+      "Hosted auth validation requires ARCHAL_AUTH_URL or ARCHAL_API_URL when ARCHAL_STRICT_ENDPOINTS=1."
+    );
+  }
   const resolved = resolveCredentialsWithSource(tokenEnvVar, true);
   if (!resolved) {
     const tokenSources = Array.from(/* @__PURE__ */ new Set([tokenEnvVar, "ARCHAL_TOKEN"])).join(", ");
@@ -2739,6 +2589,7 @@ function positiveIntegerFromEnv(name, fallback) {
 }
 
 export {
+  getConfiguredVitestApiBaseUrl,
   sleep,
   DEFAULT_HOSTED_API_BASE_URL,
   DEFAULT_SESSION_TTL_SECONDS,
@@ -2748,11 +2599,9 @@ export {
   MIN_READY_TIMEOUT_MS,
   trimEnv,
   parsePositiveInteger,
-  normalizeApiBaseUrl,
   fileExists,
   requestedSeedsMatchSession,
   HostedSessionClient,
-  getCredentials2 as getCredentials,
   createHostedAuthLease,
   getSessionIdFilePath,
   loadFileSeedsIntoClones,