openmeld 0.3.94 → 0.3.96

package/dist/auth-session-BcT7IOfJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-BcT7IOfJ.js","names":["toErrorMessage","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import { z } from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z.discriminatedUnion(\"operation\", [\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.literal(\"read\"),\n\taccessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])\n});\nconst macOsKeychainHelperErrorSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      return;\n    }\n    await deleteMacOsNativeKeychainToken(ref).catch(() => undefined);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref).catch(() => undefined);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref).catch(() => undefined);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      \"A future successful setup or login will move the session back to \" +\n      `Keychain. Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessToken(tokenRef).catch(() => undefined);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessToken(previousTokenRef).catch(() => undefined);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<void> {\n  cachedAuthSession = null;\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessToken(payload.tokenRef).catch(() => undefined);\n  }\n  await removeSessionFileBestEffort();\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\");\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFileBestEffort(): Promise<void> {\n  await rm(authSessionPath(), { force: true }).catch(() => undefined);\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,iCAAiC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AAClE,MAAM,qCAAqC,EAAE,KAAK;CACjD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,EAAE,mBAAmB,aAAa;CAC1E,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,OAAO;EAC5B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,MAAM;EAC3B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,QAAQ;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,EAAE,aAAa;CAC/D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AACtC,CAAC;AACD,MAAM,uCAAuC,EAAE,aAAa;CAC3D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,QAAQ,MAAM;CAC3B,aAAa,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,iCAAiC,EAAE,aAAa;CACrD,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,KAAK;CACnB,WAAW;CACX,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChD,CAAC;AACD,MAAM,oCAAoC,EAAE,MAAM;CACjD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAoCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;AC9WA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC;EAEF,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;EAC/D;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;EACxD;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;AAE5D;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,QAAQ,KACN,kPAIwB,eAAe,KAAK,GAC9C;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;;AC1cV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAIzC,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,kBAAkB,QAAQ,CAAC,CAAC,YAAY,KAAA,CAAS;EACvD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,kBAAkB,gBAAgB,CAAC,CAAC,YAAY,KAAA,CAAS;AAEnE;AAEA,eAAsB,iBAAoD;CACxE,MAAM,aAAa,MAAM,yBAAyB;CAClD,IAAI,WAAW,UAAU,aAAa,WAAW,UAAU,WACzD,OAAO;CAET,OAAO,WAAW;AACpB;AAEA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAkC;CACtD,oBAAoB;CACpB,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,YAAY,KAAA,CAAS;CAEjE,MAAM,4BAA4B;AACpC;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,IAAI;EACtC,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,8BAA6C;CAC1D,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;AACpE"}

package/dist/{command-z9T11Rju.js → command-cWXoKcwr.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 import { A as toSpaceCursorUrl, At as openMeldManagedBinaryPath, B as toSpaceUpdatesUrl, C as updateConfiguredSkillsConfig, Ct as deviceOpenClawProfileWorkspaceDir, Dt as normalizeOpenMeldProfileId, E as toDaemonRouteObservationUrl, Et as normalizeAccountKey, F as toSpaceMembersUrl, G as isOpenMeldOrphanedLockError, Gt as runtimeLogsDir, H as acquireLock, Ht as resolveOpenMeldPresetOwnedPathInput, I as toSpaceMetaUrl, Jt as systemDir, Kt as skillsDir, L as toSpacePasswordUrl, Mt as openMeldManagedVersionDir, Nt as openMeldRootDir, Ot as openMeldBackupsDir, P as toSpaceLeaveUrl, Pt as openMeldVersionsDir, Qt as runtimeAgentControllerLaunchContractSchema, R as toSpaceRemoveMembersUrl, Rt as resolveDefaultOpenMeldHomeDirname, St as deviceOpenClawProfileDir, T as normalizeBaseUrl, Tt as legacyAccountProfileSpacesDir, Ut as resolveOpenMeldRootDir, V as toSpaceWsUrl, Vt as resolveOpenMeldEnvPreset, W as isOpenMeldLockError, Wt as runtimeDir, X as resolveOpenMeldOrphanedLockIssue, Yt as formatLocalMachineIssueMessage, Z as runWithHeldLock, Zt as runtimeAgentControllerConversationIdMappingSpecSchema, _ as getRuntimeConfigReadHealth, _t as accountProfileSpaceCacheDir, a as resolveBaseUrl, an as resolveBuiltinAgentControllerConversationKind, at as writeCliContextState, b as setConfiguredSkillsConfig, bt as accountsDir, c as resolveExplicitGatewayUrlOrThrow, d as createDefaultRuntimeAgentControllerSettings, dn as canonicalizeBuiltinAgentControllerRef, dt as createBackgroundExecutionBlockedIssue, en as runtimeStreamingModeSchema, f as getConfiguredDaemonDispatchLimits, fn as normalizeBuiltinAgentControllerId, g as getConfiguredViewCustomization, gt as accountProfileLocalMetaPath, h as getConfiguredSkillsConfig, ht as OPENMELD_HOME_ENV_KEY, i as normalizeGatewayBaseUrlOrNull, in as conversationPolicySchema, it as resolveCliContextId, j as toSpaceDeleteUrl, jt as openMeldManagedVersionBinaryPath, k as toSpaceCreateUrl, kt as openMeldBinDir, l as DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE, ln as buildAgentControllerRoutingKey, lt as assessLocalMachineFailure, mn as parseAgentControllerRef$1, nt as readCliContextState, o as resolveBaseUrlOrNull, on as HOSTED_CENTER_AGENT_CONTROLLER_REF, p as getConfiguredDeviceRuntimeState, pn as normalizeKnownBuiltinAgentControllerId, r as normalizeGatewayBaseUrl, rn as buildAgentControllerConversationRef, rt as resolveCliContext, s as resolveDefaultGatewayBaseUrl, sn as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, st as resolveOpenMeldLaneDescriptor, tn as runtimeTransportModeSchema, tt as listCliContextStates, un as canonicalizeAgentControllerRef, v as resolveRuntimeSkillsCustomTargetId, vt as accountProfileViewPath, wt as isPublishedOpenMeldHome, x as updateConfiguredDeviceRuntimeState, xt as deviceOpenClawProfileBootstrapPath, yt as accountProfileWorkspacePath, zt as resolveExplicitOpenMeldEnvPreset } from "./base-url-Cv9x5Es9.js";
-import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$41, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$42, zt as agentActivityEventSchema } from "./dist-DXBncfSC.js";
+import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$41, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$42, zt as agentActivityEventSchema } from "./dist-BBWU3O-I.js";
 import { $t as conversationExecutionStateSchema, A as runtimeTransportResumeControllerConversationFramePayloadSchema, An as agentInteractionRequestSchema, Ar as resolvePublicAgentAvailabilityCopy, B as openMeldSpaceEgressActionSchema, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, D as runtimeTransportRegisterSessionRequestSchema, Dr as MAX_TEXT_LENGTH$1, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Er as trimmedStringFromUnknown, Fn as formatLocalSetupActionDescription, G as localFolderPickerHelperResultSchema, H as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Hn as localServiceComponentUpdateProjectionSchema, Ht as spaceFileNameSchema, I as openMeldDaemonTaskResultEnvelopeWriteSchema, In as formatLocalSetupActionLabel, Ir as resolveCommandAgentWorkActivity, Jt as openMeldDaemonControlPlaneRequestSchema, Kn as parseOptionalClientMessageId, L as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, Ln as installedLocalComponentsSnapshotSchema, M as runtimeTransportRouteCatalogChangedFramePayloadSchema, Mr as shouldPreferMappedPublicAgentFailureReason, Mt as SPACE_FILE_MAX_SIZE_BYTES, Nn as formatLocalComponentsSummaryDescription, O as runtimeTransportRegisterSessionResponseSchema, On as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, Or as resolveDetailedPublicAgentFailureReason$1, P as runtimeTransportSubmitTaskResultRequestSchema, Pn as formatLocalComponentsSummaryLabel, Qt as providerDispatchRuntimeContextSchema, R as openMeldDaemonTaskResultPayloadSchema, Rn as localCliComponentUpdateProjectionSchema, Rt as resolveSpaceFileMimeType, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, U as localFolderPickerDaemonFrameSchema, V as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, W as localFolderPickerHelperProtocolResultSchema, Xn as runtimeCoordinatorExecutionTokenEnvelopeSchema, Yt as openMeldDaemonControlPlaneResponseSchema, Zn as runtimeTransportDeliveryExecutionIdentitySchema, Zt as skippedDaemonProfileSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as getSpaceMessageAddressingRelationSupportForTargetKind, _r as openMeldRuntimeProfileIdSchema, a as runtimeTransportCapabilitiesSchema, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, bn as resolveMessageEnvelopeTargetField, c as runtimeTransportDispatchInteractionRequestSchema, ct as CONVERSATION_CONTINUITY_WARNING_PURPOSE, d as runtimeTransportDispatchPreviewEndRequestSchema, er as normalizeSpacePasswordText, f as runtimeTransportDispatchPreviewRequestSchema, ft as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, g as runtimeTransportForkAgentSessionResultSchema, gn as formatCanonicalMentionLiteral, gr as normalizeOptionalWorkingDirectory, gt as sanitizeSignalTextPreview, h as runtimeTransportErrorCodeSchema, hn as collectCanonicalMentionTextFragments, hr as agentProfileIdSchema, i as localWakeRouteReportSchema, j as runtimeTransportResumeControllerConversationResultFramePayloadSchema, jn as agentInteractionResolutionSchema, jr as resolvePublicAgentFailureRecovery, k as runtimeTransportRejectedProfileRegistrationSchema, kr as resolveMappedPublicAgentFailureReason, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, m as runtimeTransportDispatchToolActivityRequestSchema, mn as MESSAGE_MENTION_TYPE_VALUES, mr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, mt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, nr as resolveSingleSpaceMentionLabels, o as runtimeTransportDeliverDispatchRequestSchema, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, pr as openMeldRequestContextSchema, pt as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, r as daemonStreamFrameSchema, rr as resolveSpaceMentionLabels, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, u as runtimeTransportDispatchLifecycleRequestSchema, v as runtimeTransportHeartbeatResponseSchema, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xr as profileWorkspaceModeSchema, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as normalizeMessageEnvelope } from "./runtime-transport-J50KvRbm.js";
 import { r as daemonServiceLaneSchema, t as daemonServiceContractSchema } from "./service-contract-DZWQdPz5.js";
 import { A as isDaemonServiceRuntimeHeartbeatStale, B as setDaemonServiceRuntimeState, C as daemonServiceStableExecutableWrapperPath, D as getDaemonRuntimeStatus, E as ensureDaemonControlPlaneToken, F as releaseDaemonServiceLifecycleLock, G as withDaemonServiceStopLock, H as withDaemonServiceReconcileLock, I as resolveDaemonControlPlaneEndpoint, K as readDaemonLocalStateFile, L as resolveDaemonServiceRuntimeMetadata, M as readDaemonServiceLifecycleLockMeta, N as readDaemonServiceLifecycleLockMetaWithCleanup, O as getDaemonStatus, P as readDaemonServiceRuntimeSnapshot, R as restoreDaemonInstallStateSnapshot, S as daemonServiceRepairJournalPath, T as daemonStatePath, U as withDaemonServiceRegistrationMutationLock, V as uninstallDaemon, W as withDaemonServiceRunLock, _ as daemonRuntimeServiceManagerPath, a as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, b as daemonServiceLegacyExecutableWrapperPath, c as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, d as clearDaemonServiceRuntimeState, f as daemonDispatchJournalPath, g as daemonRuntimeRootPath, h as daemonRuntimeDataPath, i as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, j as readDaemonControlPlaneToken, k as installDaemon, l as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, m as daemonRuntimeBundlesPath, n as writeDaemonRuntimeLease, o as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, p as daemonLifecycleJournalPath, q as writeDaemonLocalStateFile, r as DAEMON_HEARTBEAT_STALE_MS, s as DAEMON_SERVICE_RUNTIME_MODE_ENV, t as readDaemonRuntimeLease, u as acquireDaemonServiceLifecycleLock, v as daemonRuntimeStateRootPath, w as daemonServiceStableLauncherPath, x as daemonServiceRecognizedExecutableWrapperPaths, y as daemonServiceActiveBundleStatePath, z as rotateDaemonControlPlaneTokenIfExpired } from "./daemon-runtime-lease-DiRoGxhm.js";
-import { D as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, E as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, N as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, S as MAX_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, a as getAuthSessionState, c as setAuthSession, d as resolveOpenMeldDistribution, f as CATALOG_SYNC_RETRY_INTERVAL_MS$1, g as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, h as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, j as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, k as REGISTER_RESPONSE_TIMEOUT_MS$1, m as DAEMON_RUNTIME_CONTRACT_EPOCH$1, n as clearAuthSession, p as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, r as getAuthSession, u as isBinaryDistribution, v as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, w as MIN_HEARTBEAT_INTERVAL_MS$2, x as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, y as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-CTkKQOEP.js";
-import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-BjoKBD1e.js";
+import { A as REGISTER_RESPONSE_TIMEOUT_MS$1, C as MAX_HEARTBEAT_INTERVAL_MS$2, D as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, N as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, P as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, S as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, T as MIN_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, a as getAuthSessionState, b as DEFAULT_HEARTBEAT_INTERVAL_MS$1, c as setAuthSession, d as isBinaryDistribution, f as resolveOpenMeldDistribution, g as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, h as DAEMON_RUNTIME_CONTRACT_EPOCH$1, k as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, m as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, n as clearAuthSession, p as CATALOG_SYNC_RETRY_INTERVAL_MS$1, r as getAuthSession, v as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, y as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1 } from "./auth-session-BcT7IOfJ.js";
+import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-BJIJ540D.js";
 import { createRequire } from "node:module";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { z } from "zod/v4";
@@ -34,7 +34,7 @@ import { Box, Container, Editor, Key, ProcessTerminal, TUI, Text, getEditorKeybi
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.94",
+	version: "0.3.96",
 	openMeldReleaseDate: "2026-08-24",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
@@ -11953,7 +11953,6 @@ const MAX_MODEL_DIAGNOSTIC_IDS$1 = 100;
 const MAX_MODEL_DIAGNOSTIC_ID_CHARS$1 = 512;
 const CONTEXT_NOT_FOUND_RE = /(?:path not found|unknown session|session.+not found|no such session)/iu;
 const AUTH_FAILURE_RE = /(?:unauthenticated|authentication|sign[ -]?in|required.+login|token.+expired|invalid.+token)/iu;
-const QUOTA_FAILURE_RE = /(?:quota|rate.?limit|usage limit|credits?|entitlement|upgrade.+plan)/iu;
 var GrokBuildAcpTransportError = class extends Error {
 	code;
 	diagnostics;
@@ -12016,13 +12015,17 @@ async function invokeGrokBuildAcpTransport(input) {
 		session.beginTurn();
 		let promptResult;
 		try {
-			promptResult = await session.request("session/prompt", {
-				prompt: [{
-					text: prompt,
-					type: "text"
-				}],
-				sessionId: descriptor.sessionId
-			});
+			try {
+				promptResult = await session.request("session/prompt", {
+					prompt: [{
+						text: prompt,
+						type: "text"
+					}],
+					sessionId: descriptor.sessionId
+				});
+			} catch (error) {
+				throw await toPromptWakeFailureError(error, session);
+			}
 		} finally {
 			session.endTurn();
 			unregisterActiveTurn?.();
@@ -12054,6 +12057,27 @@ async function invokeGrokBuildAcpTransport(input) {
 		await session.closeProcess();
 	}
 }
+const PROVIDER_USAGE_EXHAUSTED_ERROR_CODE = "grok-build.quota_or_entitlement";
+/**
+* A provider rejection without a self-describing message surfaces as
+* protocol.request_failed. When the usage projection shows credits are
+* exhausted, the quota failure code is far more accurate than a generic
+* protocol error.
+*/
+function upgradePromptProtocolFailureWithExhaustedUsage(classified, usageLimits) {
+	if (classified.code !== "protocol.request_failed" || !usageLimits.some((limit) => limit.status === "exhausted")) return classified;
+	return new GrokBuildAcpTransportError({
+		cause: classified,
+		code: PROVIDER_USAGE_EXHAUSTED_ERROR_CODE,
+		errorType: "auth",
+		message: "grok-build.quota_or_entitlement: the provider account has used all of its included credits for this period"
+	});
+}
+async function toPromptWakeFailureError(error, session) {
+	const classified = toGrokBuildTransportError(error, session.readStderr(), session.readDiagnostics());
+	if (classified.code !== "protocol.request_failed" || isContextNotFoundError(classified)) return classified;
+	return upgradePromptProtocolFailureWithExhaustedUsage(classified, await session.readUsageLimitsSafe());
+}
 var GrokBuildAcpSession = class {
 	#input;
 	#process;
@@ -12146,6 +12170,13 @@ var GrokBuildAcpSession = class {
 			response
 		}), () => createUnavailableProviderUsageLimits((/* @__PURE__ */ new Date()).toISOString()));
 	}
+	async readUsageLimitsSafe() {
+		try {
+			return await this.readUsageLimits();
+		} catch {
+			return createUnavailableProviderUsageLimits((/* @__PURE__ */ new Date()).toISOString());
+		}
+	}
 	async openSession(input) {
 		const operation = input.sessionId ? "resume" : "new";
 		let result;
@@ -12542,11 +12573,6 @@ function classifyGrokBuildProviderFailure(message) {
 		errorType: "auth",
 		message: `auth.failed: ${normalized}`
 	});
-	if (QUOTA_FAILURE_RE.test(normalized)) return new GrokBuildAcpTransportError({
-		code: "grok-build.quota_or_entitlement",
-		errorType: "auth",
-		message: `grok-build.quota_or_entitlement: ${normalized}`
-	});
 	return null;
 }
 function isContextNotFoundError(error) {
@@ -17603,7 +17629,7 @@ function resolveOpenMeldAccountContext(input) {
 	};
 }
 async function resolveCurrentOpenMeldAccountContext() {
-	const { getAuthSessionMetadata } = await import("./auth-session-CTkKQOEP.js").then((n) => n.t);
+	const { getAuthSessionMetadata } = await import("./auth-session-BcT7IOfJ.js").then((n) => n.t);
 	return resolveOpenMeldAccountContext({ session: await getAuthSessionMetadata().catch(() => null) });
 }
 function resolveHostKey(baseUrl) {
@@ -37239,9 +37265,9 @@ function createModelCatalogReadSession(input) {
 async function readModelCatalogOnce(baseUrl) {
 	try {
 		const [apiClient, baseUrlModule, clientFoundationModule] = await Promise.all([
-			import("./dist-DXBncfSC.js").then((n) => n.w),
+			import("./dist-BBWU3O-I.js").then((n) => n.w),
 			import("./base-url-Cv9x5Es9.js").then((n) => n.n),
-			import("./api-client-foundation-BjoKBD1e.js").then((n) => n.t)
+			import("./api-client-foundation-BJIJ540D.js").then((n) => n.t)
 		]);
 		if (typeof apiClient.createConfigApi !== "function") throw new Error("config api client is unavailable");
 		const resolvedBaseUrl = baseUrl ?? await baseUrlModule.resolveBaseUrl();
@@ -53948,6 +53974,8 @@ function buildAuthStatusSnapshot(input) {
 	if (!session) return {
 		signedIn: false,
 		state: input.state,
+		...input.reasonCode ? { reasonCode: input.reasonCode } : {},
+		...input.errorMessage ? { errorMessage: input.errorMessage } : {},
 		userId: null,
 		userEmail: null,
 		userName: null,
@@ -53969,6 +53997,8 @@ function buildAuthStatusSnapshot(input) {
 	return {
 		signedIn: input.state === "valid",
 		state: input.state,
+		...input.reasonCode ? { reasonCode: input.reasonCode } : {},
+		...input.errorMessage ? { errorMessage: input.errorMessage } : {},
 		userId: normalizeOptionalString$8(session.user?.id),
 		userEmail: normalizeOptionalString$8(session.user?.email),
 		userName: normalizeOptionalString$8(session.user?.name),
@@ -54705,6 +54735,8 @@ function buildAuthStatusPayload(input) {
 	return {
 		signedIn: input.signedIn,
 		state: input.state,
+		...input.reasonCode ? { reasonCode: input.reasonCode } : {},
+		...input.errorMessage ? { errorMessage: input.errorMessage } : {},
 		authBaseUrl: input.authBaseUrl,
 		clientId: input.clientId,
 		tokenType: input.tokenType,
@@ -106480,4 +106512,4 @@ function isHumanInteractiveSpaceRuntime(runtime) {
 //#endregion
 export { runAgentsRepair as $, uninstallAgentActivityIntegrations as $a, performManagedInstall as $i, formatDaemonServiceDowngradeBlockedRecommendation as $n, resolveProfileWorkspaceRuntime as $r, readBundledOpenMeldCliSkillDocumentByPath as $t, assertFullSignalIdArgument as A, getSelectedOpenMeldProfileId as Aa, getAgentControllerPermissionModeDisplayMetadata as Ai, inspectSpaceCacheFile as An, enqueueControllerTaskLifecycleEventWhileLocked as Ao, buildAgentOverviewFromContract as Ar, shouldEmitAgentOverview as At, persistAgentTransportSelection as B, LocalProjectConnectionError as Ba, getCurrentCommandCheckState as Bi, formatRemovedCcRelationMessage as Bn, cliJsonOutputEnvelopeSchema as Bo, runDaemonServiceFullAlignment as Br, parseJsonResponse$1 as Bt, toSpaceMetaUpsertInput as C, deleteOpenMeldProfile as Ca, classifyDaemonServiceWakeability as Ci, submitProfileRuntimeAgentControllerReport as Cn, listProjectConnectionsWithStatus as Co, registerSpaceMemberSelectionOptions as Cr, runDaemonTeardownStrict as Ct, formatHumanReadTargetList as D, updateOpenMeldProfile as Da, resolveOpenMeldEnvironmentTarget as Di, resolveLocalAgentControllerBlockerReasonCodes as Dn, setDefaultProjectConnection as Do, registerDaemonControlTargetOptions as Dr, reconcileCliVersionView as Dt, buildHumanReplyContextSummary as E, resolveOpenMeldProfile as Ea, resolveDaemonDeviceId as Ei, collectLocalAgentControllerInventory as En, runIfAgentActivityBindingGenerationIsCurrent as Eo, getCliVersionInfo as Er, buildProfileWorkspaceRows as Et, emitSpaceAgentOverview as F, resolveAuthenticationGuidance as Fa, resolveAgentExecutionStatus as Fi, buildSignalIndex as Fn, emitCliJsonEnvelope as Fo, OPENMELD_AGENT_MENTAL_MODEL_LINES as Fr, fetchSpaceMeta as Ft, runAgentsCustomList as G, registerAgentActivityRoute as Ga, resolveVersionChangeDirection as Gi, assessCliUpdate as Gn, organizationJoinLinkErrorResponseSchema as Go, formatAgentReplyReadinessLabel as Gr, runDaemonStartDecisionPrompt as Gt, runAgents as H, LocalDaemonControlPlaneClientError as Ha, resetCurrentCommandCheckState as Hi, promptSearchSelect as Hn, cliJsonSkillsLoadEnvelopeSchema as Ho, resolveServiceReadinessFromServiceStatus as Hr, writeInstalledLocalComponentsSnapshot as Ht, emitSpaceCliAgentOverview as I, resolveAuthenticationGuidanceFromError as Ia, resolveAgentProfileEditCapabilities as Ii, buildSignalMessageReadProjection as In, errLine as Io, SPACE_CONTRACT_ALLOWED_ACTION_ORDER as Ir, updateSpaceMeta as It, runAgentsDetect as J, AGENT_ACTIVITY_INTEGRATION_OWNER as Ja, getDaemonSystemServiceLogPath as Ji, readDispatchOwnedRuntimeGuard as Jn, package_default as Jo, mapAgentReplyReadinessToLegacyAutoReply as Jr, runSkillsEnsure as Jt, runAgentsCustomRemove as K, resolveAgentActivityRouteForPath as Ka, readCurrentDaemonRuntimeContext as Ki, isCliUpdateCheckApplicable as Kn, revokeOrganizationJoinLinkResponseSchema as Ko, formatDeviceReplyReadinessLabel as Kr, collectSkillsReadinessSnapshot as Kt, prepareLocalAgentReadiness as L, resolveAuthenticationGuidanceFromMessage as La, resolveEvidenceSyncHealth as Li, buildSpaceRoundReadProjection as Ln, outJsonLine as Lo, areAllowedActionsEquivalent as Lr, readGatewayJsonResponse as Lt, prepareAuthenticatedSpaceCommandContext as M, buildAgentAuthenticationGuide as Ma, listAgentControllerPermissionModeOptions as Mi, assertNoRemovedCcSpaceAddressingSyntax as Mn, renderInfoCard as Mo, formatDualViewGuideForDisplay as Mr, readDaemonStartFailureLogTailLines as Mt, resolveOpenMeldProfileForSpaceCommand as N, buildHumanAuthenticationCard as Na, parseAgentControllerRef as Ni, buildDispatchResultMessageReadProjection as Nn, renderTextInfoCard as No, buildDualViewGuideMessage as Nr, fetchSpaceUpdates as Nt, parseEnvelope as O, alignSelectedOpenMeldProfileStorage as Oa, buildAgentControllerRef as Oi, resolveLocalAgentControllerLaunchability as On, unbindProject as Oo, registerAuthLoginRequestOptions as Or, emitDaemonAgentOverview as Ot, resolveSpaceAccessLabel as P, createAuthenticationError as Pa, resolveAgentControllerPermissionModeForController as Pi, buildDispatchResultReplyWorkflowProjection as Pn, sanitizeTerminalDisplayText as Po, formatAgentOverviewPayload as Pr, createCliSpaceApi as Pt, runAgentsManage as Q, resolveAgentActivityDispatcherCommand as Qa, buildInstallSelfJsonPayload as Qi, resolveElapsedTimeMs as Qn, createModelCatalogReadSession as Qr, ensureLocalSkills as Qt, buildReplyReadinessGuidance as R, getProfileDefaultView as Ra, resolveNativeAgentControllerPermissionModeForController as Ri, buildUpdatesReplyWorkflowProjection as Rn, outLine as Ro, buildAgentFacingPublicationModeGuideLines as Rr, readGatewayTextResponse as Rt, loadSpaceSignalIndexOrNull as S, createOpenMeldHumanProfile as Sa, classifyDaemonServiceRunStartability as Si, computeRetryDelayMs as Sn, listProjectBindings as So, getCommandHintsFromContract as Sr, runDaemonStop as St, buildFormalSignalReadPayload as T, primeOpenMeldProfilesSessionCache as Ta, ensureDaemonRuntimePaths as Ti, submitRuntimeAgentControllerReports as Tn, removeProjectConnection as To, registerSkillsTargetSelectionOptions as Tr, buildProfileWorkspacePresentation as Tt, runAgentsConfig as U, requestLocalAgentActivitySync as Ua, startCurrentCommandCheckScope as Ui, isReturnKeypress as Un, cliJsonSkillsShowEnvelopeSchema as Uo, resolveDaemonServiceFreshnessWarning as Ur, resolveDaemonServiceParticipationStatus as Ut, resolveAgentProfileSetup as V, validateLocalProjectConnectionPath as Va, isCurrentCommandCheckScopeActive as Vi, promptSearchMultiselect as Vn, cliJsonSkillsListEnvelopeSchema as Vo, formatDaemonFailureContextText as Vr, resolveLocalComponentsStatus as Vt, runAgentsCustomAdd as W, isAgentActivityRouteRegistered as Wa, inspectDaemonServiceInventory as Wi, runInteractivePrompt as Wn, getOrganizationJoinLinkResponseSchema as Wo, resolveCurrentReplyReadinessSnapshot as Wr, runDaemonServiceParticipationGate as Wt, runAgentsEnable as X, installAgentActivityIntegrations as Xa, readDaemonServiceJobCrashExitCode as Xi, writeDispatchSpaceActionRecord as Xn, resolveOpenClawLocalDiagnosticsValue as Xr, runSkillsUninstall as Xt, runAgentsDisable as Y, defaultManagedIntegrationPaths as Ya, isDaemonServiceJobNeverSpawned as Yi, readDispatchSpaceActionContextFromEnv as Yn, resolveGatewayChainReadiness as Yr, runSkillsInstall as Yt, runAgentsList as Z, readAgentActivityIntegrationStatus as Za, resolveDaemonServiceManager as Zi, formatElapsedTime as Zn, syncProfileWorkspaceState as Zr, runSkillsUpdate as Zt, runSpaceWriteWithPasswordRetry as _, resolveViewProfileKey as _a, buildDaemonRouteObservationPresentation as _i, promptTextEntry as _n, enqueueAgentActivityHookEvent as _o, createSpaceUpdatesGuideError as _r, runDaemonInterrupt as _t, runSpaceDelete as a, readVersionState as aa, setOpenMeldManagedProfileWorkspace as ai, ensureCommandAuthenticationOrCancel as an, formatProfileAwareOpenMeldCliCommands as ao, createProfileMenuGuideError as ar, printOpenMeldBanner as at, buildIdentityOnlyMembersSnapshotForReadProjection as b, resolveOpenMeldProfileOrNull as ba, buildDaemonServiceTargetSpec as bi, resolveServiceParticipationReadiness as bn, removeProjectOutbox as bo, createUpgradeConfirmationGuideError as br, runDaemonSnapshot as bt, runSpaceLeave as c, toStartBackgroundHelperExecutionCompatibility as ca, syncDeviceRuntimeStateProjection as ci, runAuthLogout as cn, syncLocalAgentActivity as co, createSpaceAliasTargetGuideError as cr, renderOpenMeldLogo as ct, runSpaceRemoveMembers as d, renderHumanErrorCard as da, listAgentTargetStates as di, buildAuthStatusRows as dn, readAgentActivityContextForPath as do, createSpaceMenuGuideError as dr, resolveSpaceSendText as dt, buildNextVersionState as ea, ensureOpenMeldManagedProfileWorkspace as ei, readRuntimeReportingHealthState as en, formatInlineOpenMeldCliCommands as eo, formatDaemonServiceMissingRecommendation as er, runAgentsShow as et, runSpaceSend as f, renderHumanTextErrorCard as fa, reconcileNewRunnableBuiltinAgentsForSetup as fi, buildAuthStatusSnapshot as fn, removeAgentActivityContextCache as fo, createSpacePublicationSetGuideError as fr, runDaemon as ft, runSpaceReadWithPasswordRetry as g, resolveRuntimeContext as ga, PREPARE_SESSION_RECONNECT_GRACE_MS as gi, resolveCreateProfileName as gn, readCodexSessionTitles as go, createSpaceTargetGuideError as gr, runDaemonInstall as gt, uploadPreparedSpaceFiles as h, parseCliViewMode as ha, resolveLocalRegistryAgentIdFromAgentControllerRef as hi, resolveCreateProfileKind as hn, normalizeSharedSessionTitle as ho, createSpaceSubcommandTargetGuideError as hr, runDaemonCancel as ht, runSpaceCreate as i, fetchLatestPackageInfo as ia, setCustomProfileWorkspace as ii, buildCommandAuthenticationPromptMessage as in, formatOpenMeldCliTextBlock as io, createProfileCreateGuideError as ir, colorizeDisplayProfileLabel as it, assertValidSpaceIdTarget as j, setSelectedOpenMeldProfileId as ja, getAgentControllerPermissionModeFieldLabel as ji, upsertSpaceConfig as jn, readControllerTaskLifecycleOutboxHealth as jo, DualViewGuideError as jr, runDaemonStartupPreflight as jt, isSpaceCommandOutputHandledError as k, clearSelectedOpenMeldProfileId as ka, createAgentExecutionStatusDisplayRows as ki, resolveLocalAgentControllerReportDecision as kn, canonicalizeLocalProjectPath as ko, registerBuiltinAgentSelectionOptions as kr, createDelayedSpinner as kt, runSpaceList as l, resolveCurrentDaemonExpectedVersion as la, createPrimaryBindingReadSession as li, runAuthMenu as ln, readDaemonServiceContract as lo, createSpaceContractSetGuideError as lr, renderOpenMeldTagline as lt, prepareRequestedSpaceSendFiles as m, formatMessage as ma, notifyDaemonRouteCatalogChanged as mi, createProfileByKind as mn, resolveObservedAgentActivityBinding as mo, createSpaceResultGuideError as mr, runDaemonBackgroundStartForDecision as mt, promptAndConfirmSpacePassword as n, ensureVersionStateReady as na, readProfileWorkspaceConfig as ni, connectWebSocket as nn, formatOpenMeldCliCommands as no, createDoctorFailedGuideError as nr, postLocalParticipationMutationReconcile as nt, runSpaceHistory as o, writeVersionState as oa, validateCustomProfileWorkspacePath as oi, evaluateCommandAuthentication as on, resolveSetupFollowUpCliEntryCommand as oo, createResetConfirmationGuideError as or, renderOpenMeldBrandBlockLines as ot, runSpaceWatch as p, createPresenter as pa, listBuiltinAgentsRegistryEntries as pi, formatActiveOrganizationLabel as pn, buildAgentActivityEvent as po, createSpaceRemoveMembersGuideError as pr, runDaemonAutostart as pt, runAgentsCustomUpdate as q, unregisterAgentActivityRoute as qa, readCurrentObservedDaemonRuntimeStatus as qi, assertDispatchOwnedRuntimePublicWriteAllowed as qn, compareAgentControllerRefsForDisplay as qo, formatHumanReplyReadinessReason as qr, runSkillsCheck as qt, runSpaceAddMembers as r, fetchLatestCliBinaryRelease as ra, resolveConfiguredProfileWorkspacePath as ri, assessServerRequiredVersion as rn, formatOpenMeldCliLine as ro, createProfileActionGuideError as rr, colorizeAgentLabel as rt, runSpaceJoin as s, resolveDaemonRuntimeContractCompatibility as sa, describeProfileWorkspacePathValidationFailure as si, runAuthLogin as sn, resolveUserFacingCliEntryCommand as so, createSpaceAddMembersGuideError as sr, renderOpenMeldHeader as st, buildCreateSpacePasswordPromptConfig as t, compareSemver as ta, normalizeCustomProfileWorkspacePath as ti, readRecentDaemonDispatchJournalEvents as tn, formatOpenMeldCliCommand as to, canUseInteractivePrompts as tr, formatTransportModeDisplay as tt, runSpacePassword as u, buildHumanErrorCopy as ua, resolveAgentProfilePrimaryAgentControllerReport as ui, runAuthStatus as un, upsertDaemonServiceContract as uo, createSpaceLeaveGuideError as ur, resolveGatewayWebOrigin as ut, buildHumanReadSignalsTranscriptItems as v, isSelectedOpenMeldProfileRequiredError as va, buildOnboardingPlan as vi, ensureAgentProfileRuntimeBinding as vn, removeProjectInbox as vo, createStartAgentIdentityGuideError as vr, runDaemonReinstall as vt, buildFormalDispatchResultReadPayload as w, listOpenMeldProfiles as wa, readRecentDaemonLifecycleEvents as wi, submitRuntimeAgentControllerReport as wn, migrateProjectBindingStore as wo, SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS as wr, runDaemonUninstall as wt, loadSpaceIdentityDirectoryOrNull as x, createOpenMeldAgentProfile as xa, resolveDaemonServiceAlignmentDecision as xi, assessActionParticipationCandidate as xn, bindProject as xo, getCommandEntryContract as xr, runDaemonStatusFlow as xt, emitHumanReadSignalsTextProjection as y, requireOpenMeldProfile as ya, getSetupFlowCopy as yi, formatServiceParticipationReadinessLabel as yn, readAgentActivityOutboxHealth as yo, createStartAuthenticationGuideError as yr, runDaemonRunAfterEntryChecks as yt, resolveHumanControllerDisplayName as z, setProfileDefaultView as za, finishCurrentCommandCheckScope as zi, createSpaceMemberIdentityIndex as zn, cliBinaryDeltaPatchSchema as zo, canonicalizeAllowedActions as zr, toStructuredGatewayFailure as zt };
 
-//# sourceMappingURL=command-z9T11Rju.js.map
+//# sourceMappingURL=command-cWXoKcwr.js.map