cleargate 0.11.4 → 0.11.5

package/dist/templates/cleargate-planning/MANIFEST.json

@@ -1,6 +1,6 @@
 {
-  "cleargate_version": "0.11.4",
-  "generated_at": "2026-05-05T17:48:13.929Z",
+  "cleargate_version": "0.11.5",
+  "generated_at": "2026-05-11T22:02:23.454Z",
   "files": [
     {
       "path": ".claude/agents/architect.md",

package/dist/{whoami-W4U6DPVG.js → whoami-GQTFZHFQ.js}

@@ -6,7 +6,7 @@ import {
   getMembershipState,
   loadConfig,
   requireMcpUrl
-} from "./chunk-Q3BTSXCK.js";
+} from "./chunk-WFNLCTY5.js";
 import "./chunk-4V4QABOJ.js";
 
 // src/commands/whoami.ts
@@ -73,4 +73,4 @@ async function whoamiHandler(opts) {
 export {
   whoamiHandler
 };
-//# sourceMappingURL=whoami-W4U6DPVG.js.map
+//# sourceMappingURL=whoami-GQTFZHFQ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleargate",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "private": false,
   "type": "module",
   "description": "Planning framework for Claude Code agents — sprint/epic/story protocol, five-role agent team (architect/developer/qa/devops/reporter), Karpathy-style awareness wiki.",

package/templates/cleargate-planning/MANIFEST.json

@@ -1,6 +1,6 @@
 {
-  "cleargate_version": "0.11.4",
-  "generated_at": "2026-05-05T17:48:13.929Z",
+  "cleargate_version": "0.11.5",
+  "generated_at": "2026-05-11T22:02:23.454Z",
   "files": [
     {
       "path": ".claude/agents/architect.md",

package/dist/chunk-Q3BTSXCK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config.ts","../src/lib/membership.ts","../src/auth/acquire.ts"],"sourcesContent":["import * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { z } from 'zod';\n\nexport const ConfigSchema = z\n  .object({\n    mcpUrl: z.string().url().optional(),\n    profile: z.string().min(1).default('default'),\n    logLevel: z.enum(['debug', 'info', 'warn', 'error']).default('info'),\n  })\n  .strict();\n\nexport type Config = z.infer<typeof ConfigSchema>;\n\n/** Partial raw config used for each layer before merge */\ntype RawConfig = Partial<{\n  mcpUrl: string | undefined;\n  profile: string | undefined;\n  logLevel: string | undefined;\n}>;\n\nexport interface LoadConfigOptions {\n  flags?: RawConfig;\n  env?: NodeJS.ProcessEnv;\n  configPath?: string;\n}\n\n/**\n * Synchronously loads and merges config from all layers:\n * flags > env > config file > zod defaults\n */\nexport function loadConfig(opts: LoadConfigOptions = {}): Config {\n  const {\n    flags = {},\n    env = process.env,\n    configPath,\n  } = opts;\n\n  // Resolve config file path\n  const resolvedConfigPath =\n    configPath ??\n    (() => {\n      const home = os.homedir();\n      if (!home) return null;\n      return path.join(home, '.cleargate', 'config.json');\n    })();\n\n  // Layer: file\n  let fileLayer: RawConfig = {};\n  if (resolvedConfigPath) {\n    try {\n      const raw = fs.readFileSync(resolvedConfigPath, 'utf8');\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        throw new Error(\n          `Failed to parse config file at ${resolvedConfigPath}: invalid JSON`,\n        );\n      }\n      // Validate file contents strictly (unknown keys will throw here)\n      const fileResult = ConfigSchema.safeParse(parsed);\n      if (!fileResult.success) {\n        throw new Error(\n          `Invalid config file at ${resolvedConfigPath}: ${fileResult.error.message}`,\n        );\n      }\n      fileLayer = fileResult.data;\n    } catch (err) {\n      // Re-throw parse/validation errors; silently skip only ENOENT\n      if (\n        err instanceof Error &&\n        'code' in err &&\n        (err as NodeJS.ErrnoException).code === 'ENOENT'\n      ) {\n        // file doesn't exist — skip silently\n      } else {\n        throw err;\n      }\n    }\n  }\n\n  // Layer: env\n  const envLayer: RawConfig = {};\n  if (env['CLEARGATE_MCP_URL']) {\n    envLayer.mcpUrl = env['CLEARGATE_MCP_URL'];\n  }\n  if (env['CLEARGATE_PROFILE']) {\n    envLayer.profile = env['CLEARGATE_PROFILE'];\n  }\n  if (env['CLEARGATE_LOG_LEVEL']) {\n    envLayer.logLevel = env['CLEARGATE_LOG_LEVEL'];\n  }\n\n  // Merge: flags > env > file (start from {} so zod defaults fill in missing fields)\n  const merged: Record<string, unknown> = {\n    ...fileLayer,\n    ...envLayer,\n    ...(flags.mcpUrl !== undefined ? { mcpUrl: flags.mcpUrl } : {}),\n    ...(flags.profile !== undefined ? { profile: flags.profile } : {}),\n    ...(flags.logLevel !== undefined ? { logLevel: flags.logLevel } : {}),\n  };\n\n  // Remove undefined values so zod defaults apply properly\n  for (const key of Object.keys(merged)) {\n    if (merged[key] === undefined) {\n      delete merged[key];\n    }\n  }\n\n  const result = ConfigSchema.safeParse(merged);\n  if (!result.success) {\n    throw new Error(`Config validation failed: ${result.error.message}`);\n  }\n\n  return result.data;\n}\n\n/**\n * Asserts mcpUrl is present, throws a user-friendly error if not.\n */\nexport function requireMcpUrl(cfg: Config): string {\n  if (cfg.mcpUrl === undefined) {\n    throw new Error(\n      'mcpUrl not configured. Run `cleargate join <invite-url>` first.',\n    );\n  }\n  return cfg.mcpUrl;\n}\n","/**\n * membership.ts — CR-011\n *\n * Single source of truth for ClearGate membership state detection.\n * Cheap-path: reads ~/.cleargate/auth.json, decodes the stored refresh JWT\n * (introspection only — no signature verification), checks expiry.\n *\n * Returns 'pre-member' on: file missing | malformed JSON | malformed JWT | exp <= now.\n * Returns 'member' with decoded claims otherwise.\n *\n * No network call. Used by whoami --json, preAction gating hook, doctor --session-start banner.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { Buffer } from 'node:buffer';\n\n// ─── Public types ─────────────────────────────────────────────────────────────\n\nexport type MembershipState =\n  | { state: 'member'; email: string; project_id: string; expires_at: string }\n  | { state: 'pre-member' };\n\nexport interface GetMembershipStateOpts {\n  /** Profile name (default: 'default'). */\n  profile?: string;\n  /** Test seam: override the ~/.cleargate home directory. */\n  cleargateHome?: string;\n  /** Test seam: clock for expiry comparison (ms epoch). */\n  now?: () => number;\n}\n\n// ─── JWT decode helper (extracted from whoami.ts) ─────────────────────────────\n\n/**\n * Decode a JWT payload without verifying the signature (introspection only).\n * Returns null if the token is malformed.\n */\nexport function decodeJwtPayload(jwt: string): Record<string, unknown> | null {\n  const parts = jwt.split('.');\n  if (parts.length !== 3) return null;\n  try {\n    const json = Buffer.from(parts[1]!, 'base64url').toString('utf8');\n    return JSON.parse(json) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Auth file schema (mirrors src/auth/file-store.ts without Zod) ────────────\n\ninterface AuthFile {\n  version: number;\n  profiles: Record<string, { refreshToken: string }>;\n}\n\nfunction readAuthFile(authFilePath: string): AuthFile | null {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(authFilePath, 'utf8');\n  } catch {\n    // ENOENT or permission error → pre-member\n    return null;\n  }\n  try {\n    const parsed = JSON.parse(raw) as unknown;\n    if (\n      typeof parsed !== 'object' ||\n      parsed === null ||\n      (parsed as Record<string, unknown>)['version'] !== 1 ||\n      typeof (parsed as Record<string, unknown>)['profiles'] !== 'object'\n    ) {\n      return null;\n    }\n    return parsed as AuthFile;\n  } catch {\n    return null;\n  }\n}\n\n// ─── Main export ─────────────────────────────────────────────────────────────\n\n/**\n * Detect membership state locally.\n *\n * Algorithm:\n *  1. Resolve auth file path: <cleargateHome>/auth.json  (default: ~/.cleargate/auth.json)\n *  2. Read & parse the file as an AuthFile { version, profiles }.\n *  3. Look up the profile's refreshToken.\n *  4. Decode the refreshToken as a JWT (base64url, no sig verify).\n *  5. Extract exp, sub (= email proxy), project_id.\n *  6. If exp <= now (ms) → pre-member.\n *  7. Otherwise → member.\n */\nexport function getMembershipState(opts?: GetMembershipStateOpts): MembershipState {\n  const profile = opts?.profile ?? 'default';\n  const nowMs = (opts?.now ?? Date.now)();\n\n  // Resolve the auth file path\n  const home = opts?.cleargateHome ?? path.join(os.homedir(), '.cleargate');\n  const authFilePath = path.join(home, 'auth.json');\n\n  // Read the auth file\n  const authFile = readAuthFile(authFilePath);\n  if (authFile === null) {\n    return { state: 'pre-member' };\n  }\n\n  // Look up the profile\n  const profileEntry = authFile.profiles[profile];\n  if (!profileEntry || typeof profileEntry.refreshToken !== 'string') {\n    return { state: 'pre-member' };\n  }\n\n  // Decode the stored refresh token as a JWT\n  const claims = decodeJwtPayload(profileEntry.refreshToken);\n  if (claims === null) {\n    return { state: 'pre-member' };\n  }\n\n  // Check expiry (exp is in seconds per JWT spec)\n  const exp = claims['exp'];\n  if (typeof exp !== 'number' || !Number.isFinite(exp)) {\n    return { state: 'pre-member' };\n  }\n  const expMs = exp * 1000;\n  if (expMs <= nowMs) {\n    return { state: 'pre-member' };\n  }\n\n  // Extract claims for member state\n  // sub is the member UUID; we use it as the email proxy since the JWT\n  // doesn't carry a separate email field (flashcard: sub = member UUID, not email).\n  const sub = claims['sub'];\n  const email = typeof sub === 'string' ? sub : '';\n  const projectId = typeof claims['project_id'] === 'string' ? claims['project_id'] : '';\n  const expiresAt = new Date(expMs).toISOString();\n\n  return { state: 'member', email, project_id: projectId, expires_at: expiresAt };\n}\n","/**\n * acquireAccessToken — resolve a short-lived MCP access-token JWT.\n *\n * Resolution order (first success wins):\n *   1. CLEARGATE_MCP_TOKEN env var — CI / dev short-circuit (assumed JWT, not verified locally).\n *   2. In-memory single-flight cache (keyed by `${profile}::${mcpUrl}`) — returns cached token\n *      if still valid (expires 60s before access token's `exp` claim).\n *   3. Stored refresh token (keychain/file) + POST /auth/refresh → rotates refresh token, returns access token.\n *\n * Errors surface to caller with a clear message so command handlers can exit cleanly.\n *\n * Lives here (not in mcp-client.ts) because the refresh flow needs TokenStore + mcpUrl and\n * mcp-client.ts is kept thin (just: host, bearer, JSON-RPC).\n */\nimport { createTokenStore } from './factory.js';\nimport type { TokenStore } from './token-store.js';\n\n// ── Single-flight in-memory cache ─────────────────────────────────────────────\n// Process-local; naturally cleared when the Node CLI exits.\n// Key: `${profile}::${mcpUrl}` — R1 mitigation: two profiles in same process never collide.\n// Env-token path (CLEARGATE_MCP_TOKEN) bypasses this cache entirely.\n\nconst CACHE = new Map<string, { accessToken: string; expiresAtMs: number }>();\n\n/** Test seam: clear the acquire cache between tests. */\nexport function __resetAcquireCache(): void {\n  CACHE.clear();\n}\n\n/** Decode a JWT payload without verifying the signature (CLI-side only). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const json = Buffer.from(padded, 'base64').toString('utf8');\n    return JSON.parse(json) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport interface AcquireOptions {\n  mcpUrl: string;\n  profile: string;\n  /** Force a fresh /auth/refresh even if the cache has a valid entry. */\n  forceRefresh?: boolean;\n  /** Test seam: overrides globalThis.fetch */\n  fetch?: typeof globalThis.fetch;\n  /** Test seam: overrides createTokenStore */\n  createStore?: () => Promise<TokenStore>;\n  /** Test seam: overrides process.env lookup */\n  env?: NodeJS.ProcessEnv;\n  /** Test seam: overrides Date.now() for expiry calculations. */\n  now?: () => number;\n}\n\nexport class AcquireError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | 'env_token'\n      | 'no_stored_token'\n      | 'invalid_token'\n      | 'token_revoked'\n      | 'transport'\n      | 'unexpected_status'\n      | 'bad_response',\n  ) {\n    super(message);\n    this.name = 'AcquireError';\n  }\n}\n\n/**\n * Returns a bearer string suitable for Authorization headers against /mcp and\n * /admin-api. Rotates the stored refresh token on success.\n */\nexport async function acquireAccessToken(opts: AcquireOptions): Promise<string> {\n  const env = opts.env ?? process.env;\n  const nowFn = opts.now ?? Date.now;\n\n  // 1. Env short-circuit — CI / dev / manual paste. Assumed to be a valid JWT.\n  // Env tokens are NOT cached — they have no known exp without decoding + the\n  // env is set per-invocation in CI anyway.\n  const envToken = env['CLEARGATE_MCP_TOKEN'];\n  if (envToken && envToken.length > 0) {\n    return envToken;\n  }\n\n  // 2. Single-flight cache check (skip when forceRefresh is set).\n  const cacheKey = `${opts.profile}::${opts.mcpUrl}`;\n  if (!opts.forceRefresh) {\n    const cached = CACHE.get(cacheKey);\n    if (cached && nowFn() < cached.expiresAtMs) {\n      return cached.accessToken;\n    }\n  }\n\n  // 3. Stored refresh token → POST /auth/refresh.\n  const store = await (opts.createStore ?? createTokenStore)();\n  const stored = await store.load(opts.profile);\n  if (!stored) {\n    throw new AcquireError(\n      `No stored credentials for profile '${opts.profile}'. Run \\`cleargate join <invite-url>\\` first, or export CLEARGATE_MCP_TOKEN.`,\n      'no_stored_token',\n    );\n  }\n\n  const fetchFn = opts.fetch ?? globalThis.fetch;\n\n  let response: Response;\n  try {\n    response = await fetchFn(`${opts.mcpUrl}/auth/refresh`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ refresh_token: stored }),\n    });\n  } catch (err) {\n    throw new AcquireError(\n      `cannot reach ${opts.mcpUrl} (${err instanceof Error ? err.message : String(err)})`,\n      'transport',\n    );\n  }\n\n  if (response.status === 401) {\n    const body = (await response.json().catch(() => ({}))) as { error?: string };\n    if (body.error === 'token_revoked') {\n      throw new AcquireError(\n        'refresh token was revoked. Run `cleargate join <invite-url>` to re-authenticate.',\n        'token_revoked',\n      );\n    }\n    throw new AcquireError(\n      'refresh token is invalid or expired. Run `cleargate join <invite-url>` to re-authenticate.',\n      'invalid_token',\n    );\n  }\n\n  if (!response.ok) {\n    throw new AcquireError(`unexpected status ${response.status} from /auth/refresh`, 'unexpected_status');\n  }\n\n  const body = (await response.json().catch(() => null)) as\n    | { access_token?: unknown; refresh_token?: unknown }\n    | null;\n  if (\n    !body ||\n    typeof body.access_token !== 'string' ||\n    typeof body.refresh_token !== 'string' ||\n    body.access_token.length === 0 ||\n    body.refresh_token.length === 0\n  ) {\n    throw new AcquireError('server returned unexpected /auth/refresh response shape', 'bad_response');\n  }\n\n  // Rotate — store the new refresh token so the next call uses a fresh jti.\n  await store.save(opts.profile, body.refresh_token);\n\n  const accessToken = body.access_token;\n\n  // 4. Cache the new access token (expire 60s before the JWT exp claim).\n  const payload = decodeJwtPayload(accessToken);\n  const exp = payload?.exp;\n  if (typeof exp === 'number' && Number.isFinite(exp)) {\n    const expiresAtMs = (exp - 60) * 1000;\n    CACHE.set(cacheKey, { accessToken, expiresAtMs });\n  }\n  // If exp is missing or non-numeric, do NOT cache — next call will re-refresh.\n\n  return accessToken;\n}\n"],"mappings":";;;;;;AAAA,YAAY,QAAQ;AACpB,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,SAAS;AAEX,IAAM,eAAe,EACzB,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,CAAC,EAAE,QAAQ,MAAM;AACrE,CAAC,EACA,OAAO;AAqBH,SAAS,WAAW,OAA0B,CAAC,GAAW;AAC/D,QAAM;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,MAAM,QAAQ;AAAA,IACd;AAAA,EACF,IAAI;AAGJ,QAAM,qBACJ,eACC,MAAM;AACL,UAAM,OAAU,WAAQ;AACxB,QAAI,CAAC,KAAM,QAAO;AAClB,WAAY,UAAK,MAAM,cAAc,aAAa;AAAA,EACpD,GAAG;AAGL,MAAI,YAAuB,CAAC;AAC5B,MAAI,oBAAoB;AACtB,QAAI;AACF,YAAM,MAAS,gBAAa,oBAAoB,MAAM;AACtD,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN,cAAM,IAAI;AAAA,UACR,kCAAkC,kBAAkB;AAAA,QACtD;AAAA,MACF;AAEA,YAAM,aAAa,aAAa,UAAU,MAAM;AAChD,UAAI,CAAC,WAAW,SAAS;AACvB,cAAM,IAAI;AAAA,UACR,0BAA0B,kBAAkB,KAAK,WAAW,MAAM,OAAO;AAAA,QAC3E;AAAA,MACF;AACA,kBAAY,WAAW;AAAA,IACzB,SAAS,KAAK;AAEZ,UACE,eAAe,SACf,UAAU,OACT,IAA8B,SAAS,UACxC;AAAA,MAEF,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,WAAsB,CAAC;AAC7B,MAAI,IAAI,mBAAmB,GAAG;AAC5B,aAAS,SAAS,IAAI,mBAAmB;AAAA,EAC3C;AACA,MAAI,IAAI,mBAAmB,GAAG;AAC5B,aAAS,UAAU,IAAI,mBAAmB;AAAA,EAC5C;AACA,MAAI,IAAI,qBAAqB,GAAG;AAC9B,aAAS,WAAW,IAAI,qBAAqB;AAAA,EAC/C;AAGA,QAAM,SAAkC;AAAA,IACtC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AAGA,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,OAAO,GAAG,MAAM,QAAW;AAC7B,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,SAAS,aAAa,UAAU,MAAM;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,6BAA6B,OAAO,MAAM,OAAO,EAAE;AAAA,EACrE;AAEA,SAAO,OAAO;AAChB;AAKO,SAAS,cAAc,KAAqB;AACjD,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI;AACb;;;ACpHA,YAAYA,SAAQ;AACpB,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,UAAAC,eAAc;AAuBhB,SAAS,iBAAiB,KAA6C;AAC5E,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,OAAOA,QAAO,KAAK,MAAM,CAAC,GAAI,WAAW,EAAE,SAAS,MAAM;AAChE,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,aAAa,cAAuC;AAC3D,MAAI;AACJ,MAAI;AACF,UAAS,iBAAa,cAAc,MAAM;AAAA,EAC5C,QAAQ;AAEN,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QACE,OAAO,WAAW,YAClB,WAAW,QACV,OAAmC,SAAS,MAAM,KACnD,OAAQ,OAAmC,UAAU,MAAM,UAC3D;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAgBO,SAAS,mBAAmB,MAAgD;AACjF,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,SAAS,MAAM,OAAO,KAAK,KAAK;AAGtC,QAAM,OAAO,MAAM,iBAAsB,WAAQ,YAAQ,GAAG,YAAY;AACxE,QAAM,eAAoB,WAAK,MAAM,WAAW;AAGhD,QAAM,WAAW,aAAa,YAAY;AAC1C,MAAI,aAAa,MAAM;AACrB,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAGA,QAAM,eAAe,SAAS,SAAS,OAAO;AAC9C,MAAI,CAAC,gBAAgB,OAAO,aAAa,iBAAiB,UAAU;AAClE,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAGA,QAAM,SAAS,iBAAiB,aAAa,YAAY;AACzD,MAAI,WAAW,MAAM;AACnB,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAGA,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG;AACpD,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AACA,QAAM,QAAQ,MAAM;AACpB,MAAI,SAAS,OAAO;AAClB,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B;AAKA,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM;AAC9C,QAAM,YAAY,OAAO,OAAO,YAAY,MAAM,WAAW,OAAO,YAAY,IAAI;AACpF,QAAM,YAAY,IAAI,KAAK,KAAK,EAAE,YAAY;AAE9C,SAAO,EAAE,OAAO,UAAU,OAAO,YAAY,WAAW,YAAY,UAAU;AAChF;;;ACtHA,IAAM,QAAQ,oBAAI,IAA0D;AAQ5E,SAASC,kBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,SAAS,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC5D,UAAM,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC1D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YACE,SACgB,MAQhB;AACA,UAAM,OAAO;AATG;AAUhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAYpB;AAMA,eAAsB,mBAAmB,MAAuC;AAC9E,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAM,QAAQ,KAAK,OAAO,KAAK;AAK/B,QAAM,WAAW,IAAI,qBAAqB;AAC1C,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,WAAO;AAAA,EACT;AAGA,QAAM,WAAW,GAAG,KAAK,OAAO,KAAK,KAAK,MAAM;AAChD,MAAI,CAAC,KAAK,cAAc;AACtB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,UAAU,MAAM,IAAI,OAAO,aAAa;AAC1C,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,QAAQ,OAAO,KAAK,eAAe,kBAAkB;AAC3D,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK,OAAO;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,OAAO;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,KAAK,SAAS,WAAW;AAEzC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,iBAAiB;AAAA,MACtD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,OAAO,CAAC;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,gBAAgB,KAAK,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAMC,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,QAAIA,MAAK,UAAU,iBAAiB;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,aAAa,qBAAqB,SAAS,MAAM,uBAAuB,mBAAmB;AAAA,EACvG;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAGpD,MACE,CAAC,QACD,OAAO,KAAK,iBAAiB,YAC7B,OAAO,KAAK,kBAAkB,YAC9B,KAAK,aAAa,WAAW,KAC7B,KAAK,cAAc,WAAW,GAC9B;AACA,UAAM,IAAI,aAAa,2DAA2D,cAAc;AAAA,EAClG;AAGA,QAAM,MAAM,KAAK,KAAK,SAAS,KAAK,aAAa;AAEjD,QAAM,cAAc,KAAK;AAGzB,QAAM,UAAUD,kBAAiB,WAAW;AAC5C,QAAM,MAAM,SAAS;AACrB,MAAI,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,GAAG;AACnD,UAAM,eAAe,MAAM,MAAM;AACjC,UAAM,IAAI,UAAU,EAAE,aAAa,YAAY,CAAC;AAAA,EAClD;AAGA,SAAO;AACT;","names":["fs","os","path","Buffer","decodeJwtPayload","body"]}