openmeld 0.3.42

package/dist/auth-session-_ideKYyk.js

@@ -0,0 +1,746 @@
+#!/usr/bin/env node
+
+import { Nt as openMeldRootDir, hn as __exportAll } from "./base-url-Bdqmyw0D.js";
+import { t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-rv43yBPB.js";
+import { join, resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+//#region src/strategy-constants.ts
+const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 3e4;
+const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8e3;
+const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;
+const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 1e4;
+const MIN_SPACE_REQUEST_TIMEOUT_MS = 1e3;
+const MAX_SPACE_REQUEST_TIMEOUT_MS = 12e4;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 25e3;
+const MIN_HEARTBEAT_INTERVAL_MS = 5e3;
+const MAX_HEARTBEAT_INTERVAL_MS = 6e4;
+const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 2e4;
+const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 1e4;
+const CATALOG_SYNC_RETRY_INTERVAL_MS = 5e3;
+const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1e3;
+const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15e3;
+const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 6e4;
+const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 6e4;
+const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 6e4;
+const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 6e4;
+const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 6e4;
+const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15e3;
+const REGISTER_RESPONSE_TIMEOUT_MS = 1e4;
+const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15e3;
+const DAEMON_RUNTIME_CONTRACT_EPOCH = CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;
+const OPENCLAW_CLI_TIMEOUT_MS = 3e4;
+//#endregion
+//#region src/config/token-store.ts
+const TOKEN_STORE_KEYCHAIN_SERVICE = "sh.openmeld.auth.token";
+const INSECURE_FALLBACK_ENV_KEY = "OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN";
+const FORCE_INSECURE_STORE_ENV_KEY = "OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN";
+const COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;
+const COMMAND_TIMEOUT_MS = 3e4;
+const TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;
+const EXEC_FILE_BASE_OPTIONS = {
+	windowsHide: true,
+	maxBuffer: COMMAND_MAX_BUFFER_BYTES,
+	timeout: COMMAND_TIMEOUT_MS
+};
+let insecureFallbackWarningShown = false;
+async function storeAccessToken(input) {
+	const key = buildTokenKey({
+		authBaseUrl: input.authBaseUrl,
+		clientId: input.clientId
+	});
+	if (shouldForceInsecureStore()) {
+		await setInsecureFileToken({
+			key,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "insecure-file",
+			key
+		};
+	}
+	if (process.platform === "darwin") try {
+		const account = buildMacOsAccount(key);
+		await setMacOsKeychainToken({
+			service: TOKEN_STORE_KEYCHAIN_SERVICE,
+			account,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "macos-keychain",
+			service: TOKEN_STORE_KEYCHAIN_SERVICE,
+			account
+		};
+	} catch (error) {
+		if (allowInsecureFallback()) {
+			await setInsecureFileToken({
+				key,
+				accessToken: input.accessToken
+			});
+			return {
+				provider: "insecure-file",
+				key
+			};
+		}
+		throw new Error(`failed to store access token in macOS Keychain: ${toErrorMessage(error)}`);
+	}
+	if (process.platform === "win32") try {
+		await setWindowsDpapiToken({
+			key,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "windows-dpapi",
+			key
+		};
+	} catch (error) {
+		if (allowInsecureFallback()) {
+			await setInsecureFileToken({
+				key,
+				accessToken: input.accessToken
+			});
+			return {
+				provider: "insecure-file",
+				key
+			};
+		}
+		throw new Error(`failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`);
+	}
+	if (allowInsecureFallback()) {
+		await setInsecureFileToken({
+			key,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "insecure-file",
+			key
+		};
+	}
+	throw new Error(`secure token storage is unavailable on platform "${process.platform}". Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`);
+}
+async function readAccessToken(ref) {
+	try {
+		if (ref.provider === "macos-keychain") return toAccessTokenReadResult(await getMacOsKeychainToken(ref));
+		if (ref.provider === "windows-dpapi") return toAccessTokenReadResult(await getWindowsDpapiToken(ref));
+		if (ref.provider === "insecure-file") return toAccessTokenReadResult(await getInsecureFileToken(ref));
+		return { status: "missing" };
+	} catch (error) {
+		return {
+			errorMessage: toErrorMessage(error),
+			status: "unavailable"
+		};
+	}
+}
+async function deleteAccessToken(ref) {
+	if (ref.provider === "macos-keychain") {
+		await deleteMacOsKeychainToken(ref).catch(() => void 0);
+		return;
+	}
+	if (ref.provider === "windows-dpapi") {
+		await deleteWindowsDpapiToken(ref).catch(() => void 0);
+		return;
+	}
+	if (ref.provider === "insecure-file") await deleteInsecureFileToken(ref).catch(() => void 0);
+}
+function isStoredTokenRef(value) {
+	if (!(value && typeof value === "object")) return false;
+	const record = value;
+	const provider = normalizeString(record.provider);
+	if (provider === "macos-keychain") return Boolean(normalizeString(record.service) && normalizeString(record.account));
+	if (provider === "windows-dpapi" || provider === "insecure-file") return normalizeTokenFileKey(record.key) !== null;
+	return false;
+}
+function buildTokenKey(input) {
+	const rootDir = resolve(openMeldRootDir());
+	return createHash("sha256").update(`${input.clientId}\n${input.authBaseUrl}\n${rootDir}`).digest("hex");
+}
+function buildMacOsAccount(key) {
+	return `openmeld-auth-${key}`;
+}
+async function setMacOsKeychainToken(input) {
+	await runCommand("security", [
+		"add-generic-password",
+		"-U",
+		"-a",
+		input.account,
+		"-s",
+		input.service,
+		"-w",
+		input.accessToken
+	]);
+}
+async function getMacOsKeychainToken(input) {
+	try {
+		return (await runCommand("security", [
+			"find-generic-password",
+			"-a",
+			input.account,
+			"-s",
+			input.service,
+			"-w"
+		])).stdout.trim();
+	} catch (error) {
+		if (isMacOsNotFoundError(error)) return null;
+		throw error;
+	}
+}
+async function deleteMacOsKeychainToken(input) {
+	try {
+		await runCommand("security", [
+			"delete-generic-password",
+			"-a",
+			input.account,
+			"-s",
+			input.service
+		]);
+	} catch (error) {
+		if (isMacOsNotFoundError(error)) return;
+		throw error;
+	}
+}
+async function setWindowsDpapiToken(input) {
+	const encrypted = await runPowerShellScript(WINDOWS_DPAPI_ENCRYPT_SCRIPT, input.accessToken, input.key);
+	await mkdir(tokenDirectoryPath(), { recursive: true });
+	await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+async function getWindowsDpapiToken(input) {
+	const encrypted = await readFile(windowsDpapiTokenPath(input.key), "utf8").catch((error) => {
+		if (isFileNotFoundError(error)) return null;
+		throw error;
+	});
+	if (!encrypted) return null;
+	return runPowerShellScript(WINDOWS_DPAPI_DECRYPT_SCRIPT, encrypted.trim(), input.key);
+}
+async function deleteWindowsDpapiToken(input) {
+	await rm(windowsDpapiTokenPath(input.key), { force: true });
+}
+async function setInsecureFileToken(input) {
+	await mkdir(tokenDirectoryPath(), { recursive: true });
+	await writeFile(insecureTokenPath(input.key), `${input.accessToken}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+async function getInsecureFileToken(input) {
+	const raw = await readFile(insecureTokenPath(input.key), "utf8").catch((error) => {
+		if (isFileNotFoundError(error)) return null;
+		throw error;
+	});
+	return raw ? raw.trim() : null;
+}
+async function deleteInsecureFileToken(input) {
+	await rm(insecureTokenPath(input.key), { force: true });
+}
+function tokenDirectoryPath() {
+	return join(openMeldRootDir(), "auth", "tokens");
+}
+function windowsDpapiTokenPath(key) {
+	return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);
+}
+function insecureTokenPath(key) {
+	return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);
+}
+function allowInsecureFallback() {
+	if (process.env[INSECURE_FALLBACK_ENV_KEY] === "1") {
+		warnInsecureFallback("env");
+		return true;
+	}
+	const fallbackEnabled = !isNativeSecureStorePlatform();
+	if (fallbackEnabled) warnInsecureFallback("platform");
+	return fallbackEnabled;
+}
+function warnInsecureFallback(reason) {
+	if (insecureFallbackWarningShown) return;
+	insecureFallbackWarningShown = true;
+	const reasonText = reason === "env" ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1` : `enabled automatically on platform "${process.platform}"`;
+	console.warn(`[openmeld auth] plaintext file token storage fallback is active (${reasonText}). Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, and prefer macOS or Windows for native secure token storage.`);
+}
+function shouldForceInsecureStore() {
+	return process.env[FORCE_INSECURE_STORE_ENV_KEY] === "1";
+}
+function isNativeSecureStorePlatform() {
+	return process.platform === "darwin" || process.platform === "win32";
+}
+async function runPowerShellScript(script, token, entropy) {
+	const payload = JSON.stringify({
+		token,
+		entropy
+	});
+	return (await runCommand("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-ExecutionPolicy",
+		"Bypass",
+		"-Command",
+		script
+	], payload)).stdout.trim();
+}
+async function runCommand(command, args, stdinPayload) {
+	try {
+		if (stdinPayload === void 0) return await runExecFile(command, args);
+		const { execFile } = await import("node:child_process");
+		return await new Promise((resolve, reject) => {
+			let stdout = "";
+			let stderr = "";
+			const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });
+			child.stdout?.setEncoding("utf8");
+			child.stderr?.setEncoding("utf8");
+			child.stdout?.on("data", (chunk) => {
+				stdout += String(chunk);
+			});
+			child.stderr?.on("data", (chunk) => {
+				stderr += String(chunk);
+			});
+			child.on("error", (error) => {
+				reject(toCommandError(error, command));
+			});
+			child.on("close", (code) => {
+				if (code === 0) {
+					resolve({
+						stdout,
+						stderr
+					});
+					return;
+				}
+				reject(toCommandError({ message: `command failed (${command}) with exit code ${code}` }, command));
+			});
+			child.stdin?.write(stdinPayload);
+			child.stdin?.end();
+		});
+	} catch (error) {
+		throw toCommandError(error, command);
+	}
+}
+async function runExecFile(command, args) {
+	const { execFile } = await import("node:child_process");
+	return await new Promise((resolve, reject) => {
+		execFile(command, args, {
+			...EXEC_FILE_BASE_OPTIONS,
+			encoding: "utf8"
+		}, (error, stdout, stderr) => {
+			if (error) {
+				reject(toCommandError(error, command));
+				return;
+			}
+			resolve({
+				stdout: String(stdout ?? ""),
+				stderr: String(stderr ?? "")
+			});
+		});
+	});
+}
+function toCommandError(error, command) {
+	if (!(error && typeof error === "object")) return /* @__PURE__ */ new Error(`command failed (${command}): ${String(error)}`);
+	const e = error;
+	const code = typeof e.code === "number" ? e.code : null;
+	const messageParts = [`command failed (${command})`];
+	if (typeof e.stderr === "string" && e.stderr.trim()) messageParts.push(`stderr: ${e.stderr.trim()}`);
+	else if (e.message) messageParts.push(e.message);
+	const wrapped = new Error(messageParts.join("; "));
+	wrapped.code = code;
+	wrapped.stdout = e.stdout;
+	wrapped.stderr = e.stderr;
+	return wrapped;
+}
+function isMacOsNotFoundError(error) {
+	if (!(error && typeof error === "object")) return false;
+	const record = error;
+	const text = `${record.stderr ?? ""} ${record.message ?? ""}`.toLowerCase();
+	return record.code === 44 || text.includes("could not be found in the keychain") || text.includes("the specified item could not be found");
+}
+function normalizeString(value) {
+	return String(value ?? "").trim();
+}
+function normalizeTokenFileKey(value) {
+	const normalized = normalizeString(value);
+	if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) return null;
+	return normalized;
+}
+function requireValidTokenFileKey(value) {
+	const normalized = normalizeTokenFileKey(value);
+	if (normalized === null) throw new Error("stored token key is invalid");
+	return normalized;
+}
+function normalizeToken(value) {
+	if (value === null) return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function toAccessTokenReadResult(value) {
+	const accessToken = normalizeToken(value);
+	if (!accessToken) return { status: "missing" };
+	return {
+		accessToken,
+		status: "found"
+	};
+}
+function toErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function isFileNotFoundError(error) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+const WINDOWS_DPAPI_ENCRYPT_SCRIPT = [
+	"$ErrorActionPreference='Stop'",
+	"$rawInput = [Console]::In.ReadToEnd()",
+	"$payload = $rawInput | ConvertFrom-Json",
+	"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)",
+	"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)",
+	"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+	"[System.Convert]::ToBase64String($cipher)"
+].join(";");
+const WINDOWS_DPAPI_DECRYPT_SCRIPT = [
+	"$ErrorActionPreference='Stop'",
+	"$rawInput = [Console]::In.ReadToEnd()",
+	"$payload = $rawInput | ConvertFrom-Json",
+	"$cipher=[System.Convert]::FromBase64String($payload.token)",
+	"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)",
+	"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+	"[System.Text.Encoding]::UTF8.GetString($plain)"
+].join(";");
+//#endregion
+//#region src/config/auth-session.ts
+var auth_session_exports = /* @__PURE__ */ __exportAll({
+	clearAuthSession: () => clearAuthSession,
+	getAuthSession: () => getAuthSession,
+	getAuthSessionMetadata: () => getAuthSessionMetadata,
+	getAuthSessionState: () => getAuthSessionState,
+	getCurrentAuthOwnerUserId: () => getCurrentAuthOwnerUserId,
+	normalizeStoredActiveOrganization: () => normalizeStoredActiveOrganization,
+	setAuthSession: () => setAuthSession,
+	updateAuthSessionActiveOrganization: () => updateAuthSessionActiveOrganization
+});
+const TRAILING_SLASHES_RE = /\/+$/u;
+async function getAuthSessionState(options = {}) {
+	const localState = await getLocalAuthSessionState();
+	switch (localState.state) {
+		case "missing":
+		case "invalid":
+		case "expired": return localState;
+		case "valid": break;
+		default: return localState;
+	}
+	if (!options.validateRemote) return localState;
+	const remoteValidation = await getRemoteAuthSessionState(localState.session);
+	if (remoteValidation.state === "valid") return localState;
+	if (remoteValidation.state === "unknown") return localState;
+	return {
+		reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),
+		state: remoteValidation.state,
+		session: null
+	};
+}
+async function getCurrentAuthOwnerUserId() {
+	const ownerUserId = (await getAuthSessionState({ validateRemote: false }).catch(() => null))?.session?.user?.id?.trim() ?? "";
+	return ownerUserId.length > 0 ? ownerUserId : null;
+}
+async function setAuthSession(input) {
+	const accessToken = String(input.accessToken ?? "").trim();
+	if (!accessToken) throw new Error("access token is required");
+	const authBaseUrl = String(input.authBaseUrl ?? "").trim();
+	if (!authBaseUrl) throw new Error("auth base URL is required");
+	const clientId = String(input.clientId ?? "").trim();
+	if (!clientId) throw new Error("client_id is required");
+	const tokenRef = await storeAccessToken({
+		accessToken,
+		authBaseUrl,
+		clientId
+	});
+	const payload = {
+		v: 1,
+		tokenRef,
+		tokenType: String(input.tokenType ?? "Bearer").trim() || "Bearer",
+		authBaseUrl,
+		clientId,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		...input.expiresAt ? { expiresAt: input.expiresAt } : {},
+		...input.scope ? { scope: input.scope } : {},
+		...buildAuthUserPayload(input.user),
+		...buildActiveOrganizationPayload(input.activeOrganization)
+	};
+	const path = authSessionPath();
+	await mkdir(join(openMeldRootDir(), "auth"), { recursive: true });
+	try {
+		await writeSessionPayloadAtomically(path, payload);
+	} catch (error) {
+		await deleteAccessToken(tokenRef).catch(() => void 0);
+		throw error;
+	}
+}
+async function getAuthSession() {
+	const localState = await getLocalAuthSessionState();
+	if (localState.state === "missing" || localState.state === "invalid") return null;
+	return localState.session;
+}
+async function getAuthSessionMetadata() {
+	const payload = await readSessionPayload();
+	if (payload?.v !== 1) return null;
+	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+	const clientId = normalizeOptionalString(payload.clientId);
+	const createdAt = normalizeOptionalString(payload.createdAt);
+	if (!(authBaseUrl && clientId && createdAt)) return null;
+	return {
+		authBaseUrl,
+		clientId,
+		createdAt,
+		...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
+		...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+		...buildAuthUserPayload(payload.user),
+		...buildActiveOrganizationPayload(payload.activeOrganization)
+	};
+}
+async function updateAuthSessionActiveOrganization(activeOrganization) {
+	const payload = await readSessionPayload();
+	if (payload?.v !== 1) throw new Error("cannot update active organization without auth session");
+	const tokenRef = normalizeTokenRef(payload.tokenRef);
+	const tokenType = normalizeOptionalString(payload.tokenType);
+	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+	const clientId = normalizeOptionalString(payload.clientId);
+	const createdAt = normalizeOptionalString(payload.createdAt);
+	if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) throw new Error("cannot update active organization for invalid auth session");
+	const nextPayload = {
+		v: 1,
+		tokenRef,
+		tokenType,
+		authBaseUrl,
+		clientId,
+		createdAt,
+		...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
+		...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+		...buildAuthUserPayload(payload.user),
+		...buildActiveOrganizationPayload(activeOrganization)
+	};
+	await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+}
+async function clearAuthSession() {
+	const payload = await readSessionPayload();
+	if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) await deleteAccessToken(payload.tokenRef).catch(() => void 0);
+	await removeSessionFileBestEffort();
+}
+async function getLocalAuthSessionState() {
+	const payload = await readSessionPayload();
+	if (payload?.v !== 1) return {
+		reasonCode: "session_missing",
+		state: "missing",
+		session: null
+	};
+	const tokenRef = normalizeTokenRef(payload.tokenRef);
+	if (!tokenRef) return {
+		reasonCode: "session_token_ref_invalid",
+		state: "invalid",
+		session: null
+	};
+	const tokenType = normalizeOptionalString(payload.tokenType);
+	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+	const clientId = normalizeOptionalString(payload.clientId);
+	const createdAt = normalizeOptionalString(payload.createdAt);
+	if (!(tokenType && authBaseUrl && clientId && createdAt)) return {
+		reasonCode: "session_metadata_invalid",
+		state: "invalid",
+		session: null
+	};
+	const accessToken = await readAccessToken(tokenRef);
+	if (accessToken.status === "missing") return {
+		reasonCode: "session_token_missing",
+		state: "invalid",
+		session: null
+	};
+	if (accessToken.status === "unavailable") return {
+		errorMessage: accessToken.errorMessage,
+		reasonCode: "session_token_unavailable",
+		state: "invalid",
+		session: null
+	};
+	const session = {
+		v: 1,
+		accessToken: accessToken.accessToken,
+		tokenType,
+		authBaseUrl,
+		clientId,
+		createdAt,
+		...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
+		...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+		...buildAuthUserPayload(payload.user),
+		...buildActiveOrganizationPayload(payload.activeOrganization)
+	};
+	if (isExpired(session.expiresAt)) return {
+		reasonCode: "session_expired",
+		state: "expired",
+		session
+	};
+	return {
+		state: "valid",
+		session
+	};
+}
+function normalizeTokenRef(input) {
+	if (!isStoredTokenRef(input)) return null;
+	return input;
+}
+async function getRemoteAuthSessionState(session) {
+	let endpoint = "";
+	try {
+		endpoint = toAuthEndpoint(session.authBaseUrl, "/api/auth/get-session");
+	} catch {
+		return { state: "invalid" };
+	}
+	try {
+		const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);
+		const response = await fetch(endpoint, {
+			method: "GET",
+			headers: { Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}` },
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (response.status === 401 || response.status === 403) return { state: "revoked" };
+		if (!response.ok) return { state: "unknown" };
+		if (!hasActiveSessionPayload(await parseResponseJson(response))) return { state: "invalid" };
+		return { state: "valid" };
+	} catch {
+		return { state: "unknown" };
+	}
+}
+function resolveRemoteSessionTimeoutMs(endpoint) {
+	const url = parseUrlOrNull(endpoint);
+	if (url && isLoopbackHostname(url.hostname)) return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;
+	return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;
+}
+function parseUrlOrNull(value) {
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+}
+function isLoopbackHostname(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function hasActiveSessionPayload(payload) {
+	if (!isRecord(payload)) return false;
+	return isRecord(payload.session) && isRecord(payload.user);
+}
+function isExpired(expiresAt) {
+	if (!expiresAt) return false;
+	const expiresAtMs = Date.parse(expiresAt);
+	if (Number.isNaN(expiresAtMs)) return false;
+	return expiresAtMs <= Date.now();
+}
+function resolveRemoteAuthSessionReasonCode(state) {
+	switch (state) {
+		case "invalid": return "remote_session_invalid";
+		case "revoked": return "remote_session_revoked";
+		default: throw new Error(`unsupported remote auth session state: ${state}`);
+	}
+}
+async function readSessionPayload() {
+	const raw = await readFile(authSessionPath(), "utf8").catch(() => null);
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function authSessionPath() {
+	return join(openMeldRootDir(), "auth", "session.json");
+}
+async function writeSessionPayloadAtomically(path, payload) {
+	const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;
+	try {
+		const file = await open(tempPath, "wx");
+		try {
+			await file.writeFile(`${JSON.stringify(payload, null, 2)}\n`, "utf8");
+			await file.sync();
+		} finally {
+			await file.close();
+		}
+		await rename(tempPath, path);
+	} catch (error) {
+		await rm(tempPath, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+function buildAuthUserPayload(value) {
+	if (!(value && typeof value === "object")) return {};
+	const record = value;
+	const id = normalizeOptionalString(record.id);
+	const email = normalizeOptionalString(record.email);
+	const name = normalizeOptionalString(record.name);
+	if (!(id || email || name)) return {};
+	return { user: {
+		...id ? { id } : {},
+		...email ? { email } : {},
+		...name ? { name } : {}
+	} };
+}
+function buildActiveOrganizationPayload(value) {
+	const activeOrganization = normalizeStoredActiveOrganization(value);
+	return activeOrganization ? { activeOrganization } : {};
+}
+function normalizeStoredActiveOrganization(value) {
+	if (!isRecord(value)) return null;
+	const id = normalizeOptionalString(value.id);
+	const slug = normalizeOptionalString(value.slug);
+	const name = normalizeOptionalString(value.name);
+	const role = normalizeOptionalString(value.role);
+	const personal = readOrganizationIsPersonal(value);
+	if (!(id && slug && name)) return null;
+	return {
+		id,
+		slug,
+		name,
+		...role ? { role } : {},
+		...personal ? { personal } : {}
+	};
+}
+function normalizeTokenType(value) {
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : "Bearer";
+}
+function normalizeOptionalString(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function readOrganizationIsPersonal(value) {
+	if (value.personal === true || value.isPersonal === true) return true;
+	return readOrganizationMetadata(value.metadata)?.personal === true;
+}
+function readOrganizationMetadata(metadata) {
+	if (metadata === null || metadata === void 0) return null;
+	if (typeof metadata === "string") try {
+		const parsed = JSON.parse(metadata);
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+	return isRecord(metadata) ? metadata : null;
+}
+function toAuthEndpoint(baseUrl, pathname) {
+	const url = new URL(baseUrl);
+	url.pathname = `${url.pathname.replace(TRAILING_SLASHES_RE, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}` || "/";
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object");
+}
+async function parseResponseJson(response) {
+	const raw = await response.text();
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return { message: raw };
+	}
+}
+async function removeSessionFileBestEffort() {
+	await rm(authSessionPath(), { force: true }).catch(() => void 0);
+}
+//#endregion
+export { RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as A, MIN_SPACE_REQUEST_TIMEOUT_MS as C, REGISTER_RESPONSE_TIMEOUT_MS as D, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as E, ROUTE_CATALOG_LOAD_TIMEOUT_MS as O, MIN_HEARTBEAT_INTERVAL_MS as S, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as T, DEFAULT_HEARTBEAT_INTERVAL_MS as _, getAuthSessionState as a, MAX_HEARTBEAT_INTERVAL_MS as b, setAuthSession as c, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as d, DAEMON_RUNTIME_CONTRACT_EPOCH as f, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as g, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as h, getAuthSessionMetadata as i, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as j, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as k, updateAuthSessionActiveOrganization as l, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as m, clearAuthSession as n, getCurrentAuthOwnerUserId as o, DAEMON_STREAM_CONNECT_TIMEOUT_MS as p, getAuthSession as r, normalizeStoredActiveOrganization as s, auth_session_exports as t, CATALOG_SYNC_RETRY_INTERVAL_MS as u, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as v, OPENCLAW_CLI_TIMEOUT_MS as w, MAX_SPACE_REQUEST_TIMEOUT_MS as x, HEARTBEAT_RESPONSE_TIMEOUT_MS as y };
+
+//# sourceMappingURL=auth-session-_ideKYyk.js.map