openmeld 0.3.95 → 0.3.96

package/dist/{add-me-membership-DGXnp5Cm.js → add-me-membership-CWKBMx0m.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { r as runSpaceAddMembers } from "./command-D5gVrWiz.js";
+import { r as runSpaceAddMembers } from "./command-cWXoKcwr.js";
 //#region src/space/add-me-membership.ts
 async function runSpaceAddMeMembership(input) {
 	return await runSpaceAddMembers(input);
@@ -8,4 +8,4 @@ async function runSpaceAddMeMembership(input) {
 //#endregion
 export { runSpaceAddMeMembership };
 
-//# sourceMappingURL=add-me-membership-DGXnp5Cm.js.map
+//# sourceMappingURL=add-me-membership-CWKBMx0m.js.map

package/dist/{add-me-membership-DGXnp5Cm.js.map → add-me-membership-CWKBMx0m.js.map}

@@ -1 +1 @@
-{"version":3,"file":"add-me-membership-DGXnp5Cm.js","names":[],"sources":["../src/space/add-me-membership.ts"],"sourcesContent":["import { runSpaceAddMembers } from \"./command\";\nimport type { SpaceCommandNavigationStatus } from \"./navigation-status\";\n\nexport type SpaceAddMeMembershipInput = Parameters<\n  typeof runSpaceAddMembers\n>[0];\nexport type SpaceAddMeMembershipRunner = (\n  input: SpaceAddMeMembershipInput\n) => Promise<SpaceCommandNavigationStatus>;\n\nexport async function runSpaceAddMeMembership(\n  input: SpaceAddMeMembershipInput\n): Promise<SpaceCommandNavigationStatus> {\n  return await runSpaceAddMembers(input);\n}\n"],"mappings":";;;;AAUA,eAAsB,wBACpB,OACuC;CACvC,OAAO,MAAM,mBAAmB,KAAK;AACvC"}
+{"version":3,"file":"add-me-membership-CWKBMx0m.js","names":[],"sources":["../src/space/add-me-membership.ts"],"sourcesContent":["import { runSpaceAddMembers } from \"./command\";\nimport type { SpaceCommandNavigationStatus } from \"./navigation-status\";\n\nexport type SpaceAddMeMembershipInput = Parameters<\n  typeof runSpaceAddMembers\n>[0];\nexport type SpaceAddMeMembershipRunner = (\n  input: SpaceAddMeMembershipInput\n) => Promise<SpaceCommandNavigationStatus>;\n\nexport async function runSpaceAddMeMembership(\n  input: SpaceAddMeMembershipInput\n): Promise<SpaceCommandNavigationStatus> {\n  return await runSpaceAddMembers(input);\n}\n"],"mappings":";;;;AAUA,eAAsB,wBACpB,OACuC;CACvC,OAAO,MAAM,mBAAmB,KAAK;AACvC"}

package/dist/{api-client-foundation-OXokafyL.js → api-client-foundation-BJIJ540D.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { T as normalizeBaseUrl, _n as __exportAll } from "./base-url-Cv9x5Es9.js";
-import { I as OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID, R as buildOpenMeldRequestContextHeaders, h as createOpenMeldApiClient } from "./dist-DXBncfSC.js";
-import { E as MIN_SPACE_REQUEST_TIMEOUT_MS, a as getAuthSessionState, w as MAX_SPACE_REQUEST_TIMEOUT_MS, x as DEFAULT_SPACE_REQUEST_TIMEOUT_MS } from "./auth-session-yymO5FGR.js";
+import { I as OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID, R as buildOpenMeldRequestContextHeaders, h as createOpenMeldApiClient } from "./dist-BBWU3O-I.js";
+import { E as MIN_SPACE_REQUEST_TIMEOUT_MS, a as getAuthSessionState, w as MAX_SPACE_REQUEST_TIMEOUT_MS, x as DEFAULT_SPACE_REQUEST_TIMEOUT_MS } from "./auth-session-BcT7IOfJ.js";
 import crypto from "node:crypto";
 //#region src/config/auth-request-compatibility.ts
 function resolveAuthRequestCompatibility(input) {
@@ -381,4 +381,4 @@ function createCliApiClientFoundation(baseUrl, options = {}) {
 //#endregion
 export { buildOpenMeldProfileIdentityRequestHeadersWithAuth as a, buildRequestAuthHeaders as c, buildOpenMeldRequestContextFromProfile as d, buildOpenMeldRequestContextFromProfileIdentity as f, resolveSpaceRequestTimeoutMsForDiagnostics as i, canAttachAuthTokenToRequest as l, resolveAuthRequestCompatibility as m, createCliApiClientFoundation as n, buildOpenMeldProfileRequestHeadersWithAuth as o, deriveAuthBaseUrlFromGatewayUrl as p, fetchSpaceRequestWithTimeout as r, buildOpenMeldRequestContextHeadersWithAuth as s, api_client_foundation_exports as t, resolveAuthTokenAttachment as u };
 
-//# sourceMappingURL=api-client-foundation-OXokafyL.js.map
+//# sourceMappingURL=api-client-foundation-BJIJ540D.js.map

package/dist/{api-client-foundation-OXokafyL.js.map → api-client-foundation-BJIJ540D.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-client-foundation-OXokafyL.js","names":["resolveSpaceRequestTimeoutMsForDiagnostics","resolveSpaceRequestTimeoutMsForCliDiagnostics"],"sources":["../src/config/auth-request-compatibility.ts","../src/config/openmeld-request-context.ts","../src/config/request-headers.ts","../src/space/request-timeout.ts","../src/space/fetch-with-timeout.ts","../src/space/api-client-foundation.ts"],"sourcesContent":["import { normalizeBaseUrl } from \"../protocol/urls\";\nimport type { StoredAuthSession } from \"./auth-session\";\n\nexport type AuthRequestCompatibilityReason =\n  | \"invalid_request_url\"\n  | \"invalid_auth_url\"\n  | \"insecure_transport\"\n  | \"host_mismatch\"\n  | \"loopback\"\n  | \"same_host\"\n  | \"gateway_sibling\";\n\nexport type AuthRequestCompatibility = {\n  compatible: boolean;\n  reason: AuthRequestCompatibilityReason;\n  requestHost: string | null;\n  authHost: string | null;\n  expectedGatewayHost: string | null;\n};\n\nexport function resolveAuthRequestCompatibility(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthRequestCompatibility {\n  const requestUrl = parseUrlOrNull(input.requestUrl);\n  if (!requestUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_request_url\",\n      requestHost: null,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const authBaseUrl = parseUrlOrNull(input.session.authBaseUrl);\n  if (!authBaseUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_auth_url\",\n      requestHost: requestUrl.host,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const expectedGatewayHost = deriveGatewayHost(authBaseUrl);\n  const requestHost = requestUrl.host;\n  const authHost = authBaseUrl.host;\n\n  if (\n    isLoopbackHostname(requestUrl.hostname) &&\n    isLoopbackHostname(authBaseUrl.hostname)\n  ) {\n    return {\n      compatible: true,\n      reason: \"loopback\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (!isSecureTransportProtocol(requestUrl.protocol)) {\n    return {\n      compatible: false,\n      reason: \"insecure_transport\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (requestHost === authHost) {\n    return {\n      compatible: true,\n      reason: \"same_host\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (expectedGatewayHost && requestHost === expectedGatewayHost) {\n    return {\n      compatible: true,\n      reason: \"gateway_sibling\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  return {\n    compatible: false,\n    reason: \"host_mismatch\",\n    requestHost,\n    authHost,\n    expectedGatewayHost,\n  };\n}\n\nexport function canUseAuthSessionForRequest(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): boolean {\n  return resolveAuthRequestCompatibility(input).compatible;\n}\n\nexport function deriveAuthBaseUrlFromGatewayUrl(\n  gatewayUrl: string\n): string | null {\n  const parsed = parseUrlOrNull(gatewayUrl);\n  if (!parsed) {\n    return null;\n  }\n  if (!isHttpTransportProtocol(parsed.protocol)) {\n    return null;\n  }\n  if (!parsed.hostname.startsWith(\"gateway.\")) {\n    return null;\n  }\n\n  const authUrl = new URL(parsed.toString());\n  authUrl.hostname = `auth.${parsed.hostname.slice(\"gateway.\".length)}`;\n  authUrl.pathname = \"/\";\n  authUrl.search = \"\";\n  authUrl.hash = \"\";\n  return normalizeBaseUrl(authUrl.toString());\n}\n\nfunction deriveGatewayHost(authBaseUrl: URL): string | null {\n  if (!authBaseUrl.hostname.startsWith(\"auth.\")) {\n    return null;\n  }\n\n  const gatewayUrl = new URL(authBaseUrl.toString());\n  gatewayUrl.hostname = `gateway.${authBaseUrl.hostname.slice(\"auth.\".length)}`;\n  return gatewayUrl.host;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction isSecureTransportProtocol(protocol: string): boolean {\n  return protocol === \"https:\" || protocol === \"wss:\";\n}\n\nfunction isHttpTransportProtocol(protocol: string): boolean {\n  return protocol === \"http:\" || protocol === \"https:\";\n}\n","import crypto from \"node:crypto\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\n\nexport type OpenMeldRequestContextProfileIdentity = {\n  openMeldProfileId: string;\n  profileKind?: \"human\" | \"agent\" | \"system\";\n  kind?: \"human\" | \"agent\";\n  profileHandle?: string;\n  profileName: string;\n  ownerUserId?: string;\n  ownerName?: string;\n  agentControllerConversationId?: string;\n};\n\nexport function buildOpenMeldRequestContextFromProfile(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestId?: string;\n  agentControllerConversationId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const agentControllerConversationId = normalizeOptionalText(\n    input.agentControllerConversationId\n  );\n  const ownerName = normalizeOptionalText(input.openMeldProfile.ownerName);\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.openMeldProfile.openMeldProfileId,\n      profileKind: input.openMeldProfile.profileKind,\n      profileHandle: input.openMeldProfile.profileHandle,\n      profileName: input.openMeldProfile.profileName,\n      ownerUserId: input.openMeldProfile.ownerUserId,\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nexport function buildOpenMeldRequestContextFromProfileIdentity(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const profileHandle = normalizeOptionalText(\n    input.profileIdentity.profileHandle\n  );\n  const ownerUserId = normalizeOptionalText(input.profileIdentity.ownerUserId);\n  const ownerName = normalizeOptionalText(input.profileIdentity.ownerName);\n  const agentControllerConversationId = normalizeOptionalText(\n    input.profileIdentity.agentControllerConversationId\n  );\n  const profileKind =\n    input.profileIdentity.profileKind ??\n    (input.profileIdentity.kind === \"human\" ||\n    input.profileIdentity.kind === \"agent\"\n      ? input.profileIdentity.kind\n      : \"system\");\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.profileIdentity.openMeldProfileId,\n      profileKind,\n      ...(profileHandle ? { profileHandle } : {}),\n      profileName: input.profileIdentity.profileName,\n      ...(ownerUserId ? { ownerUserId } : {}),\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nfunction normalizeOptionalText(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n","import {\n  buildOpenMeldRequestContextHeaders,\n  type OpenMeldRequestContextHeadersInput,\n} from \"@openmeld/gateway-contract\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport {\n  type AuthRequestCompatibilityReason,\n  canUseAuthSessionForRequest,\n  resolveAuthRequestCompatibility,\n} from \"./auth-request-compatibility\";\nimport { getAuthSessionState, type StoredAuthSession } from \"./auth-session\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\nimport {\n  buildOpenMeldRequestContextFromProfile,\n  buildOpenMeldRequestContextFromProfileIdentity,\n  type OpenMeldRequestContextProfileIdentity,\n} from \"./openmeld-request-context\";\n\nconst DEFAULT_TOKEN_TYPE = \"Bearer\";\nconst AUTHORIZATION_HEADER = \"Authorization\";\n\ntype RequestAuthHeadersInput = {\n  authSession?: StoredAuthSession | null;\n  requestUrl: string;\n};\n\ntype OpenMeldRequestContextHeadersWithAuthInput =\n  OpenMeldRequestContextHeadersInput & {\n    authSession?: StoredAuthSession | null;\n    requestUrl: string;\n  };\n\nexport type AuthTokenAttachment =\n  | {\n      status: \"attachable\";\n      token: string;\n      tokenType: string;\n    }\n  | {\n      status: \"dropped\";\n      reason: \"empty_token\" | AuthRequestCompatibilityReason;\n      requestHost: string | null;\n      authHost: string | null;\n      expectedGatewayHost: string | null;\n    };\n\nexport type DroppedAuthTokenAttachment = Extract<\n  AuthTokenAttachment,\n  { status: \"dropped\" }\n>;\n\nexport async function buildRequestAuthHeaders(\n  input: RequestAuthHeadersInput\n): Promise<Record<string, string>> {\n  const headers: Record<string, string> = {};\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldRequestContextHeadersWithAuth(\n  input: OpenMeldRequestContextHeadersWithAuthInput\n): Promise<Record<string, string>> {\n  const headers = buildOpenMeldRequestContextHeaders(input);\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldProfileRequestHeadersWithAuth(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  agentControllerConversationId?: string;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfile({\n      openMeldProfile: input.openMeldProfile,\n      agentControllerConversationId: input.agentControllerConversationId,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport async function buildOpenMeldProfileIdentityRequestHeadersWithAuth(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfileIdentity({\n      profileIdentity: input.profileIdentity,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport function withSpacePassword(\n  requestContext: OpenMeldRequestContext,\n  spacePassword?: string\n): OpenMeldRequestContextHeadersInput {\n  return {\n    requestContext,\n    ...(spacePassword === undefined ? {} : { spacePassword }),\n  };\n}\n\n// One decision for \"can this stored session authenticate this request\", with\n// the drop reason preserved. Header building and the daemon stream connect\n// gate must share this so they cannot drift apart.\nexport function resolveAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthTokenAttachment {\n  const compatibility = resolveAuthRequestCompatibility({\n    session: input.session,\n    requestUrl: input.requestUrl,\n  });\n  const token = normalizeAccessToken(input.session);\n  if (!token) {\n    return {\n      status: \"dropped\",\n      reason: \"empty_token\",\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  if (!compatibility.compatible) {\n    return {\n      status: \"dropped\",\n      reason: compatibility.reason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  return {\n    status: \"attachable\",\n    token,\n    tokenType: normalizeTokenType(input.session.tokenType),\n  };\n}\n\nasync function attachAuthHeader(\n  headers: Record<string, string>,\n  input: RequestAuthHeadersInput\n): Promise<void> {\n  const session = await resolveAuthSessionForHeaders(input);\n  if (session === null) {\n    // No stored credentials exist, so there is nothing to strip: the caller\n    // is knowingly sending an unauthenticated request.\n    return;\n  }\n\n  const attachment = resolveAuthTokenAttachment({\n    session,\n    requestUrl: input.requestUrl,\n  });\n  if (attachment.status === \"dropped\") {\n    // The caller holds a session it believes is usable. Dropping the token is\n    // still the safe outcome (never leak credentials to an incompatible\n    // host), but it must stay visible in diagnostics instead of silently\n    // dialing bare and surfacing as a remote 401.\n    warnDroppedAuthToken(attachment);\n    return;\n  }\n  headers[AUTHORIZATION_HEADER] = `${attachment.tokenType} ${attachment.token}`;\n}\n\nfunction warnDroppedAuthToken(attachment: DroppedAuthTokenAttachment): void {\n  console.warn(\"[openmeld.auth.request_token_dropped]\", {\n    authHost: attachment.authHost,\n    expectedGatewayHost: attachment.expectedGatewayHost,\n    reason: attachment.reason,\n    requestHost: attachment.requestHost,\n  });\n}\n\nasync function resolveAuthSessionForHeaders(\n  input: RequestAuthHeadersInput\n): Promise<StoredAuthSession | null> {\n  if (input.authSession !== undefined) {\n    return input.authSession;\n  }\n\n  const sessionState = await getAuthSessionState();\n  if (sessionState.state !== \"valid\" || sessionState.session === null) {\n    return null;\n  }\n\n  return sessionState.session;\n}\n\nfunction normalizeAccessToken(session: StoredAuthSession): string {\n  return String(session.accessToken ?? \"\").trim();\n}\n\nfunction normalizeTokenType(tokenType: string | undefined): string {\n  const normalized = String(tokenType ?? \"\").trim();\n  return normalized.length > 0 ? normalized : DEFAULT_TOKEN_TYPE;\n}\n\nexport function canAttachAuthTokenToRequest(\n  session: StoredAuthSession,\n  requestUrl: string\n): boolean {\n  return canUseAuthSessionForRequest({\n    session,\n    requestUrl,\n  });\n}\n","import {\n  DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS,\n  DEFAULT_SPACE_REQUEST_TIMEOUT_MS,\n  MAX_SPACE_REQUEST_TIMEOUT_MS,\n  MIN_SPACE_REQUEST_TIMEOUT_MS,\n} from \"../strategy-constants\";\n\nconst SPACE_REQUEST_TIMEOUT_ENV_KEY = \"OPENMELD_SPACE_REQUEST_TIMEOUT_MS\";\n\nexport function resolveSpaceRequestTimeoutMs(override?: number): number {\n  if (isFinitePositiveNumber(override)) {\n    return clampSpaceRequestTimeoutMs(override);\n  }\n\n  const fromEnv = Number.parseInt(\n    String(process.env[SPACE_REQUEST_TIMEOUT_ENV_KEY] ?? \"\"),\n    10\n  );\n  if (isFinitePositiveNumber(fromEnv)) {\n    return clampSpaceRequestTimeoutMs(fromEnv);\n  }\n\n  return DEFAULT_SPACE_REQUEST_TIMEOUT_MS;\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMs(undefined);\n}\n\nexport function resolveSpaceConversationValidateTimeoutMs(): number {\n  return Math.max(\n    resolveSpaceRequestTimeoutMs(undefined),\n    DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS\n  );\n}\n\nfunction clampSpaceRequestTimeoutMs(value: number): number {\n  const normalized = Math.trunc(value);\n  return Math.max(\n    MIN_SPACE_REQUEST_TIMEOUT_MS,\n    Math.min(MAX_SPACE_REQUEST_TIMEOUT_MS, normalized)\n  );\n}\n\nfunction isFinitePositiveNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0;\n}\n","import {\n  resolveSpaceRequestTimeoutMs,\n  resolveSpaceRequestTimeoutMsForDiagnostics as resolveSpaceRequestTimeoutMsForCliDiagnostics,\n} from \"./request-timeout\";\n\nexport async function fetchSpaceRequestWithTimeout(input: {\n  url: string;\n  operation: string;\n  init?: RequestInit;\n  timeoutMs?: number;\n}): Promise<Response> {\n  const timeoutMs = resolveSpaceRequestTimeoutMs(input.timeoutMs);\n  const timeoutSignal = AbortSignal.timeout(timeoutMs);\n  const composed = composeAbortSignals(input.init?.signal, timeoutSignal);\n\n  try {\n    try {\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    } catch (error) {\n      // A keep-alive connection that a proxy silently dropped fails exactly\n      // once and undici evicts it; the retry rides a fresh connection. This\n      // is what keeps a long-lived service working behind flaky proxies\n      // without asking users to touch their network config.\n      if (\n        timeoutSignal.aborted ||\n        composed.signal.aborted ||\n        !shouldWrapNetworkRequestError(error)\n      ) {\n        throw error;\n      }\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    }\n  } catch (error) {\n    if (timeoutSignal.aborted) {\n      throw createSpaceRequestTimeoutError({\n        operation: input.operation,\n        timeoutMs,\n        cause: error,\n      });\n    }\n    if (shouldWrapNetworkRequestError(error)) {\n      throw createSpaceRequestNetworkError({\n        operation: input.operation,\n        url: input.url,\n        cause: error,\n      });\n    }\n    throw error;\n  } finally {\n    composed.cleanup();\n  }\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMsForCliDiagnostics();\n}\n\nfunction createSpaceRequestTimeoutError(input: {\n  operation: string;\n  timeoutMs: number;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request timed out after ${input.timeoutMs}ms`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.timeout\";\n  return error;\n}\n\nfunction createSpaceRequestNetworkError(input: {\n  operation: string;\n  url: string;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request could not reach ${describeRequestTarget(input.url)} (${toErrorMessage(input.cause)})`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.request_failed\";\n  return error;\n}\n\nfunction composeAbortSignals(\n  parent: AbortSignal | null | undefined,\n  timeout: AbortSignal\n): { signal: AbortSignal; cleanup: () => void } {\n  if (!parent) {\n    return {\n      signal: timeout,\n      cleanup: () => undefined,\n    };\n  }\n\n  if (parent.aborted || timeout.aborted) {\n    const controller = new AbortController();\n    controller.abort();\n    return {\n      signal: controller.signal,\n      cleanup: () => undefined,\n    };\n  }\n\n  const controller = new AbortController();\n  const abort = () => {\n    controller.abort();\n  };\n\n  parent.addEventListener(\"abort\", abort, { once: true });\n  timeout.addEventListener(\"abort\", abort, { once: true });\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      parent.removeEventListener(\"abort\", abort);\n      timeout.removeEventListener(\"abort\", abort);\n    },\n  };\n}\n\nfunction describeRequestTarget(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    const message = error.message.trim();\n    return message.length > 0 ? message : \"request failed\";\n  }\n  const message = String(error ?? \"\").trim();\n  return message.length > 0 ? message : \"request failed\";\n}\n\nfunction shouldWrapNetworkRequestError(error: unknown): boolean {\n  if (error instanceof TypeError) {\n    return true;\n  }\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    typeof error.code === \"string\" &&\n    error.code.startsWith(\"ERR_SSL_\")\n  ) {\n    return true;\n  }\n  const message = toErrorMessage(error).toLowerCase();\n  return (\n    message.includes(\"fetch failed\") ||\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network request failed\") ||\n    message.includes(\"ssl_decryption_failed_or_bad_record_mac\")\n  );\n}\n","import {\n  createOpenMeldApiClient,\n  type OpenMeldApiClientFoundation,\n} from \"@openmeld/api-client\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID,\n} from \"@openmeld/gateway-contract\";\nimport { buildRequestAuthHeaders } from \"../config/request-headers\";\nimport { fetchSpaceRequestWithTimeout } from \"./fetch-with-timeout\";\n\nexport function createCliApiClientFoundation(\n  baseUrl: string,\n  options: {\n    onAuthHeadersResolved?: (headers: Record<string, string>) => void;\n    organizationId?: string;\n  } = {}\n): OpenMeldApiClientFoundation {\n  return createOpenMeldApiClient({\n    baseUrl,\n    transport: async (request) =>\n      await fetchSpaceRequestWithTimeout({\n        url: request.url,\n        operation: request.operation,\n        init: request.init,\n        timeoutMs: request.timeoutMs,\n      }),\n    getAuthHeaders: async ({ requestUrl }) => {\n      const headers = await buildRequestAuthHeaders({\n        requestUrl,\n      });\n      if (options.organizationId) {\n        headers[OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID] =\n          options.organizationId;\n      }\n      options.onAuthHeadersResolved?.(headers);\n      return headers;\n    },\n    getRequestContextHeaders: async ({ requestContext, spacePassword }) =>\n      buildOpenMeldRequestContextHeaders({\n        requestContext,\n        ...(spacePassword === undefined ? {} : { spacePassword }),\n      }),\n  });\n}\n"],"mappings":";;;;;;;AAoBA,SAAgB,gCAAgC,OAGnB;CAC3B,MAAM,aAAa,eAAe,MAAM,UAAU;CAClD,IAAI,CAAC,YACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa;EACb,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,cAAc,eAAe,MAAM,QAAQ,WAAW;CAC5D,IAAI,CAAC,aACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa,WAAW;EACxB,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,sBAAsB,kBAAkB,WAAW;CACzD,MAAM,cAAc,WAAW;CAC/B,MAAM,WAAW,YAAY;CAE7B,IACE,mBAAmB,WAAW,QAAQ,KACtC,mBAAmB,YAAY,QAAQ,GAEvC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,CAAC,0BAA0B,WAAW,QAAQ,GAChD,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,gBAAgB,UAClB,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,uBAAuB,gBAAgB,qBACzC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,4BAA4B,OAGhC;CACV,OAAO,gCAAgC,KAAK,CAAC,CAAC;AAChD;AAEA,SAAgB,gCACd,YACe;CACf,MAAM,SAAS,eAAe,UAAU;CACxC,IAAI,CAAC,QACH,OAAO;CAET,IAAI,CAAC,wBAAwB,OAAO,QAAQ,GAC1C,OAAO;CAET,IAAI,CAAC,OAAO,SAAS,WAAW,UAAU,GACxC,OAAO;CAGT,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,CAAC;CACzC,QAAQ,WAAW,QAAQ,OAAO,SAAS,MAAM,CAAiB;CAClE,QAAQ,WAAW;CACnB,QAAQ,SAAS;CACjB,QAAQ,OAAO;CACf,OAAO,iBAAiB,QAAQ,SAAS,CAAC;AAC5C;AAEA,SAAS,kBAAkB,aAAiC;CAC1D,IAAI,CAAC,YAAY,SAAS,WAAW,OAAO,GAC1C,OAAO;CAGT,MAAM,aAAa,IAAI,IAAI,YAAY,SAAS,CAAC;CACjD,WAAW,WAAW,WAAW,YAAY,SAAS,MAAM,CAAc;CAC1E,OAAO,WAAW;AACpB;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,0BAA0B,UAA2B;CAC5D,OAAO,aAAa,YAAY,aAAa;AAC/C;AAEA,SAAS,wBAAwB,UAA2B;CAC1D,OAAO,aAAa,WAAW,aAAa;AAC9C;;;AClJA,SAAgB,uCAAuC,OAI5B;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gCAAgC,sBACpC,MAAM,6BACR;CACA,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CAEvE,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC,aAAa,MAAM,gBAAgB;GACnC,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,gBAAgB;GACnC,aAAa,MAAM,gBAAgB;GACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAgB,+CAA+C,OAGpC;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gBAAgB,sBACpB,MAAM,gBAAgB,aACxB;CACA,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,WAAW;CAC3E,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CACvE,MAAM,gCAAgC,sBACpC,MAAM,gBAAgB,6BACxB;CACA,MAAM,cACJ,MAAM,gBAAgB,gBACrB,MAAM,gBAAgB,SAAS,WAChC,MAAM,gBAAgB,SAAS,UAC3B,MAAM,gBAAgB,OACtB;CAEN,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC;GACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GACzC,aAAa,MAAM,gBAAgB;GACnC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;;;AC7DA,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAgC7B,eAAsB,wBACpB,OACiC;CACjC,MAAM,UAAkC,CAAC;CACzC,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CACpB,OACiC;CACjC,MAAM,UAAU,mCAAmC,KAAK;CACxD,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CAA2C,OAM7B;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,uCAAuC;GACrD,iBAAiB,MAAM;GACvB,+BAA+B,MAAM;EACvC,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAEA,eAAsB,mDAAmD,OAKrC;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,+CAA+C,EAC7D,iBAAiB,MAAM,gBACzB,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAeA,SAAgB,2BAA2B,OAGnB;CACtB,MAAM,gBAAgB,gCAAgC;EACpD,SAAS,MAAM;EACf,YAAY,MAAM;CACpB,CAAC;CACD,MAAM,QAAQ,qBAAqB,MAAM,OAAO;CAChD,IAAI,CAAC,OACH,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,IAAI,CAAC,cAAc,YACjB,OAAO;EACL,QAAQ;EACR,QAAQ,cAAc;EACtB,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,OAAO;EACL,QAAQ;EACR;EACA,WAAW,mBAAmB,MAAM,QAAQ,SAAS;CACvD;AACF;AAEA,eAAe,iBACb,SACA,OACe;CACf,MAAM,UAAU,MAAM,6BAA6B,KAAK;CACxD,IAAI,YAAY,MAGd;CAGF,MAAM,aAAa,2BAA2B;EAC5C;EACA,YAAY,MAAM;CACpB,CAAC;CACD,IAAI,WAAW,WAAW,WAAW;EAKnC,qBAAqB,UAAU;EAC/B;CACF;CACA,QAAQ,wBAAwB,GAAG,WAAW,UAAU,GAAG,WAAW;AACxE;AAEA,SAAS,qBAAqB,YAA8C;CAC1E,QAAQ,KAAK,yCAAyC;EACpD,UAAU,WAAW;EACrB,qBAAqB,WAAW;EAChC,QAAQ,WAAW;EACnB,aAAa,WAAW;CAC1B,CAAC;AACH;AAEA,eAAe,6BACb,OACmC;CACnC,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,MAAM;CAGf,MAAM,eAAe,MAAM,oBAAoB;CAC/C,IAAI,aAAa,UAAU,WAAW,aAAa,YAAY,MAC7D,OAAO;CAGT,OAAO,aAAa;AACtB;AAEA,SAAS,qBAAqB,SAAoC;CAChE,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,mBAAmB,WAAuC;CACjE,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAgB,4BACd,SACA,YACS;CACT,OAAO,4BAA4B;EACjC;EACA;CACF,CAAC;AACH;;;ACxNA,MAAM,gCAAgC;AAEtC,SAAgB,6BAA6B,UAA2B;CACtE,IAAI,uBAAuB,QAAQ,GACjC,OAAO,2BAA2B,QAAQ;CAG5C,MAAM,UAAU,OAAO,SACrB,OAAO,QAAQ,IAAI,kCAAkC,EAAE,GACvD,EACF;CACA,IAAI,uBAAuB,OAAO,GAChC,OAAO,2BAA2B,OAAO;CAG3C,OAAO;AACT;AAEA,SAAgBA,+CAAqD;CACnE,OAAO,6BAA6B,KAAA,CAAS;AAC/C;AASA,SAAS,2BAA2B,OAAuB;CAEzD,OAAO,KAAK,IACV,8BACA,KAAK,IAAI,8BAHQ,KAAK,MAAM,KAGoB,CAAC,CACnD;AACF;AAEA,SAAS,uBAAuB,OAAiC;CAC/D,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE;;;ACzCA,eAAsB,6BAA6B,OAK7B;CACpB,MAAM,YAAY,6BAA6B,MAAM,SAAS;CAC9D,MAAM,gBAAgB,YAAY,QAAQ,SAAS;CACnD,MAAM,WAAW,oBAAoB,MAAM,MAAM,QAAQ,aAAa;CAEtE,IAAI;EACF,IAAI;GACF,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH,SAAS,OAAO;GAKd,IACE,cAAc,WACd,SAAS,OAAO,WAChB,CAAC,8BAA8B,KAAK,GAEpC,MAAM;GAER,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH;CACF,SAAS,OAAO;EACd,IAAI,cAAc,SAChB,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB;GACA,OAAO;EACT,CAAC;EAEH,IAAI,8BAA8B,KAAK,GACrC,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB,KAAK,MAAM;GACX,OAAO;EACT,CAAC;EAEH,MAAM;CACR,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AAEA,SAAgB,6CAAqD;CACnE,OAAOC,6CAA8C;AACvD;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,MAAM,UAAU,KAC9D,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,sBAAsB,MAAM,GAAG,EAAE,IAAI,eAAe,MAAM,KAAK,EAAE,IAC/G,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,oBACP,QACA,SAC8C;CAC9C,IAAI,CAAC,QACH,OAAO;EACL,QAAQ;EACR,eAAe,KAAA;CACjB;CAGF,IAAI,OAAO,WAAW,QAAQ,SAAS;EACrC,MAAM,aAAa,IAAI,gBAAgB;EACvC,WAAW,MAAM;EACjB,OAAO;GACL,QAAQ,WAAW;GACnB,eAAe,KAAA;EACjB;CACF;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc;EAClB,WAAW,MAAM;CACnB;CAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CAEvD,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,OAAO,oBAAoB,SAAS,KAAK;GACzC,QAAQ,oBAAoB,SAAS,KAAK;EAC5C;CACF;AACF;AAEA,SAAS,sBAAsB,KAAqB;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK;EACnC,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC;CACA,MAAM,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CACzC,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,IAAI,iBAAiB,WACnB,OAAO;CAET,IACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,WAAW,UAAU,GAEhC,OAAO;CAET,MAAM,UAAU,eAAe,KAAK,CAAC,CAAC,YAAY;CAClD,OACE,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,wBAAwB,KACzC,QAAQ,SAAS,yCAAyC;AAE9D;;;;ACxJA,SAAgB,6BACd,SACA,UAGI,CAAC,GACwB;CAC7B,OAAO,wBAAwB;EAC7B;EACA,WAAW,OAAO,YAChB,MAAM,6BAA6B;GACjC,KAAK,QAAQ;GACb,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;EACrB,CAAC;EACH,gBAAgB,OAAO,EAAE,iBAAiB;GACxC,MAAM,UAAU,MAAM,wBAAwB,EAC5C,WACF,CAAC;GACD,IAAI,QAAQ,gBACV,QAAQ,6CACN,QAAQ;GAEZ,QAAQ,wBAAwB,OAAO;GACvC,OAAO;EACT;EACA,0BAA0B,OAAO,EAAE,gBAAgB,oBACjD,mCAAmC;GACjC;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,CAAC;CACL,CAAC;AACH"}
+{"version":3,"file":"api-client-foundation-BJIJ540D.js","names":["resolveSpaceRequestTimeoutMsForDiagnostics","resolveSpaceRequestTimeoutMsForCliDiagnostics"],"sources":["../src/config/auth-request-compatibility.ts","../src/config/openmeld-request-context.ts","../src/config/request-headers.ts","../src/space/request-timeout.ts","../src/space/fetch-with-timeout.ts","../src/space/api-client-foundation.ts"],"sourcesContent":["import { normalizeBaseUrl } from \"../protocol/urls\";\nimport type { StoredAuthSession } from \"./auth-session\";\n\nexport type AuthRequestCompatibilityReason =\n  | \"invalid_request_url\"\n  | \"invalid_auth_url\"\n  | \"insecure_transport\"\n  | \"host_mismatch\"\n  | \"loopback\"\n  | \"same_host\"\n  | \"gateway_sibling\";\n\nexport type AuthRequestCompatibility = {\n  compatible: boolean;\n  reason: AuthRequestCompatibilityReason;\n  requestHost: string | null;\n  authHost: string | null;\n  expectedGatewayHost: string | null;\n};\n\nexport function resolveAuthRequestCompatibility(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthRequestCompatibility {\n  const requestUrl = parseUrlOrNull(input.requestUrl);\n  if (!requestUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_request_url\",\n      requestHost: null,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const authBaseUrl = parseUrlOrNull(input.session.authBaseUrl);\n  if (!authBaseUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_auth_url\",\n      requestHost: requestUrl.host,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const expectedGatewayHost = deriveGatewayHost(authBaseUrl);\n  const requestHost = requestUrl.host;\n  const authHost = authBaseUrl.host;\n\n  if (\n    isLoopbackHostname(requestUrl.hostname) &&\n    isLoopbackHostname(authBaseUrl.hostname)\n  ) {\n    return {\n      compatible: true,\n      reason: \"loopback\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (!isSecureTransportProtocol(requestUrl.protocol)) {\n    return {\n      compatible: false,\n      reason: \"insecure_transport\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (requestHost === authHost) {\n    return {\n      compatible: true,\n      reason: \"same_host\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (expectedGatewayHost && requestHost === expectedGatewayHost) {\n    return {\n      compatible: true,\n      reason: \"gateway_sibling\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  return {\n    compatible: false,\n    reason: \"host_mismatch\",\n    requestHost,\n    authHost,\n    expectedGatewayHost,\n  };\n}\n\nexport function canUseAuthSessionForRequest(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): boolean {\n  return resolveAuthRequestCompatibility(input).compatible;\n}\n\nexport function deriveAuthBaseUrlFromGatewayUrl(\n  gatewayUrl: string\n): string | null {\n  const parsed = parseUrlOrNull(gatewayUrl);\n  if (!parsed) {\n    return null;\n  }\n  if (!isHttpTransportProtocol(parsed.protocol)) {\n    return null;\n  }\n  if (!parsed.hostname.startsWith(\"gateway.\")) {\n    return null;\n  }\n\n  const authUrl = new URL(parsed.toString());\n  authUrl.hostname = `auth.${parsed.hostname.slice(\"gateway.\".length)}`;\n  authUrl.pathname = \"/\";\n  authUrl.search = \"\";\n  authUrl.hash = \"\";\n  return normalizeBaseUrl(authUrl.toString());\n}\n\nfunction deriveGatewayHost(authBaseUrl: URL): string | null {\n  if (!authBaseUrl.hostname.startsWith(\"auth.\")) {\n    return null;\n  }\n\n  const gatewayUrl = new URL(authBaseUrl.toString());\n  gatewayUrl.hostname = `gateway.${authBaseUrl.hostname.slice(\"auth.\".length)}`;\n  return gatewayUrl.host;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction isSecureTransportProtocol(protocol: string): boolean {\n  return protocol === \"https:\" || protocol === \"wss:\";\n}\n\nfunction isHttpTransportProtocol(protocol: string): boolean {\n  return protocol === \"http:\" || protocol === \"https:\";\n}\n","import crypto from \"node:crypto\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\n\nexport type OpenMeldRequestContextProfileIdentity = {\n  openMeldProfileId: string;\n  profileKind?: \"human\" | \"agent\" | \"system\";\n  kind?: \"human\" | \"agent\";\n  profileHandle?: string;\n  profileName: string;\n  ownerUserId?: string;\n  ownerName?: string;\n  agentControllerConversationId?: string;\n};\n\nexport function buildOpenMeldRequestContextFromProfile(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestId?: string;\n  agentControllerConversationId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const agentControllerConversationId = normalizeOptionalText(\n    input.agentControllerConversationId\n  );\n  const ownerName = normalizeOptionalText(input.openMeldProfile.ownerName);\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.openMeldProfile.openMeldProfileId,\n      profileKind: input.openMeldProfile.profileKind,\n      profileHandle: input.openMeldProfile.profileHandle,\n      profileName: input.openMeldProfile.profileName,\n      ownerUserId: input.openMeldProfile.ownerUserId,\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nexport function buildOpenMeldRequestContextFromProfileIdentity(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const profileHandle = normalizeOptionalText(\n    input.profileIdentity.profileHandle\n  );\n  const ownerUserId = normalizeOptionalText(input.profileIdentity.ownerUserId);\n  const ownerName = normalizeOptionalText(input.profileIdentity.ownerName);\n  const agentControllerConversationId = normalizeOptionalText(\n    input.profileIdentity.agentControllerConversationId\n  );\n  const profileKind =\n    input.profileIdentity.profileKind ??\n    (input.profileIdentity.kind === \"human\" ||\n    input.profileIdentity.kind === \"agent\"\n      ? input.profileIdentity.kind\n      : \"system\");\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.profileIdentity.openMeldProfileId,\n      profileKind,\n      ...(profileHandle ? { profileHandle } : {}),\n      profileName: input.profileIdentity.profileName,\n      ...(ownerUserId ? { ownerUserId } : {}),\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nfunction normalizeOptionalText(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n","import {\n  buildOpenMeldRequestContextHeaders,\n  type OpenMeldRequestContextHeadersInput,\n} from \"@openmeld/gateway-contract\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport {\n  type AuthRequestCompatibilityReason,\n  canUseAuthSessionForRequest,\n  resolveAuthRequestCompatibility,\n} from \"./auth-request-compatibility\";\nimport { getAuthSessionState, type StoredAuthSession } from \"./auth-session\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\nimport {\n  buildOpenMeldRequestContextFromProfile,\n  buildOpenMeldRequestContextFromProfileIdentity,\n  type OpenMeldRequestContextProfileIdentity,\n} from \"./openmeld-request-context\";\n\nconst DEFAULT_TOKEN_TYPE = \"Bearer\";\nconst AUTHORIZATION_HEADER = \"Authorization\";\n\ntype RequestAuthHeadersInput = {\n  authSession?: StoredAuthSession | null;\n  requestUrl: string;\n};\n\ntype OpenMeldRequestContextHeadersWithAuthInput =\n  OpenMeldRequestContextHeadersInput & {\n    authSession?: StoredAuthSession | null;\n    requestUrl: string;\n  };\n\nexport type AuthTokenAttachment =\n  | {\n      status: \"attachable\";\n      token: string;\n      tokenType: string;\n    }\n  | {\n      status: \"dropped\";\n      reason: \"empty_token\" | AuthRequestCompatibilityReason;\n      requestHost: string | null;\n      authHost: string | null;\n      expectedGatewayHost: string | null;\n    };\n\nexport type DroppedAuthTokenAttachment = Extract<\n  AuthTokenAttachment,\n  { status: \"dropped\" }\n>;\n\nexport async function buildRequestAuthHeaders(\n  input: RequestAuthHeadersInput\n): Promise<Record<string, string>> {\n  const headers: Record<string, string> = {};\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldRequestContextHeadersWithAuth(\n  input: OpenMeldRequestContextHeadersWithAuthInput\n): Promise<Record<string, string>> {\n  const headers = buildOpenMeldRequestContextHeaders(input);\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldProfileRequestHeadersWithAuth(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  agentControllerConversationId?: string;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfile({\n      openMeldProfile: input.openMeldProfile,\n      agentControllerConversationId: input.agentControllerConversationId,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport async function buildOpenMeldProfileIdentityRequestHeadersWithAuth(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfileIdentity({\n      profileIdentity: input.profileIdentity,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport function withSpacePassword(\n  requestContext: OpenMeldRequestContext,\n  spacePassword?: string\n): OpenMeldRequestContextHeadersInput {\n  return {\n    requestContext,\n    ...(spacePassword === undefined ? {} : { spacePassword }),\n  };\n}\n\n// One decision for \"can this stored session authenticate this request\", with\n// the drop reason preserved. Header building and the daemon stream connect\n// gate must share this so they cannot drift apart.\nexport function resolveAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthTokenAttachment {\n  const compatibility = resolveAuthRequestCompatibility({\n    session: input.session,\n    requestUrl: input.requestUrl,\n  });\n  const token = normalizeAccessToken(input.session);\n  if (!token) {\n    return {\n      status: \"dropped\",\n      reason: \"empty_token\",\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  if (!compatibility.compatible) {\n    return {\n      status: \"dropped\",\n      reason: compatibility.reason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  return {\n    status: \"attachable\",\n    token,\n    tokenType: normalizeTokenType(input.session.tokenType),\n  };\n}\n\nasync function attachAuthHeader(\n  headers: Record<string, string>,\n  input: RequestAuthHeadersInput\n): Promise<void> {\n  const session = await resolveAuthSessionForHeaders(input);\n  if (session === null) {\n    // No stored credentials exist, so there is nothing to strip: the caller\n    // is knowingly sending an unauthenticated request.\n    return;\n  }\n\n  const attachment = resolveAuthTokenAttachment({\n    session,\n    requestUrl: input.requestUrl,\n  });\n  if (attachment.status === \"dropped\") {\n    // The caller holds a session it believes is usable. Dropping the token is\n    // still the safe outcome (never leak credentials to an incompatible\n    // host), but it must stay visible in diagnostics instead of silently\n    // dialing bare and surfacing as a remote 401.\n    warnDroppedAuthToken(attachment);\n    return;\n  }\n  headers[AUTHORIZATION_HEADER] = `${attachment.tokenType} ${attachment.token}`;\n}\n\nfunction warnDroppedAuthToken(attachment: DroppedAuthTokenAttachment): void {\n  console.warn(\"[openmeld.auth.request_token_dropped]\", {\n    authHost: attachment.authHost,\n    expectedGatewayHost: attachment.expectedGatewayHost,\n    reason: attachment.reason,\n    requestHost: attachment.requestHost,\n  });\n}\n\nasync function resolveAuthSessionForHeaders(\n  input: RequestAuthHeadersInput\n): Promise<StoredAuthSession | null> {\n  if (input.authSession !== undefined) {\n    return input.authSession;\n  }\n\n  const sessionState = await getAuthSessionState();\n  if (sessionState.state !== \"valid\" || sessionState.session === null) {\n    return null;\n  }\n\n  return sessionState.session;\n}\n\nfunction normalizeAccessToken(session: StoredAuthSession): string {\n  return String(session.accessToken ?? \"\").trim();\n}\n\nfunction normalizeTokenType(tokenType: string | undefined): string {\n  const normalized = String(tokenType ?? \"\").trim();\n  return normalized.length > 0 ? normalized : DEFAULT_TOKEN_TYPE;\n}\n\nexport function canAttachAuthTokenToRequest(\n  session: StoredAuthSession,\n  requestUrl: string\n): boolean {\n  return canUseAuthSessionForRequest({\n    session,\n    requestUrl,\n  });\n}\n","import {\n  DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS,\n  DEFAULT_SPACE_REQUEST_TIMEOUT_MS,\n  MAX_SPACE_REQUEST_TIMEOUT_MS,\n  MIN_SPACE_REQUEST_TIMEOUT_MS,\n} from \"../strategy-constants\";\n\nconst SPACE_REQUEST_TIMEOUT_ENV_KEY = \"OPENMELD_SPACE_REQUEST_TIMEOUT_MS\";\n\nexport function resolveSpaceRequestTimeoutMs(override?: number): number {\n  if (isFinitePositiveNumber(override)) {\n    return clampSpaceRequestTimeoutMs(override);\n  }\n\n  const fromEnv = Number.parseInt(\n    String(process.env[SPACE_REQUEST_TIMEOUT_ENV_KEY] ?? \"\"),\n    10\n  );\n  if (isFinitePositiveNumber(fromEnv)) {\n    return clampSpaceRequestTimeoutMs(fromEnv);\n  }\n\n  return DEFAULT_SPACE_REQUEST_TIMEOUT_MS;\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMs(undefined);\n}\n\nexport function resolveSpaceConversationValidateTimeoutMs(): number {\n  return Math.max(\n    resolveSpaceRequestTimeoutMs(undefined),\n    DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS\n  );\n}\n\nfunction clampSpaceRequestTimeoutMs(value: number): number {\n  const normalized = Math.trunc(value);\n  return Math.max(\n    MIN_SPACE_REQUEST_TIMEOUT_MS,\n    Math.min(MAX_SPACE_REQUEST_TIMEOUT_MS, normalized)\n  );\n}\n\nfunction isFinitePositiveNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0;\n}\n","import {\n  resolveSpaceRequestTimeoutMs,\n  resolveSpaceRequestTimeoutMsForDiagnostics as resolveSpaceRequestTimeoutMsForCliDiagnostics,\n} from \"./request-timeout\";\n\nexport async function fetchSpaceRequestWithTimeout(input: {\n  url: string;\n  operation: string;\n  init?: RequestInit;\n  timeoutMs?: number;\n}): Promise<Response> {\n  const timeoutMs = resolveSpaceRequestTimeoutMs(input.timeoutMs);\n  const timeoutSignal = AbortSignal.timeout(timeoutMs);\n  const composed = composeAbortSignals(input.init?.signal, timeoutSignal);\n\n  try {\n    try {\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    } catch (error) {\n      // A keep-alive connection that a proxy silently dropped fails exactly\n      // once and undici evicts it; the retry rides a fresh connection. This\n      // is what keeps a long-lived service working behind flaky proxies\n      // without asking users to touch their network config.\n      if (\n        timeoutSignal.aborted ||\n        composed.signal.aborted ||\n        !shouldWrapNetworkRequestError(error)\n      ) {\n        throw error;\n      }\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    }\n  } catch (error) {\n    if (timeoutSignal.aborted) {\n      throw createSpaceRequestTimeoutError({\n        operation: input.operation,\n        timeoutMs,\n        cause: error,\n      });\n    }\n    if (shouldWrapNetworkRequestError(error)) {\n      throw createSpaceRequestNetworkError({\n        operation: input.operation,\n        url: input.url,\n        cause: error,\n      });\n    }\n    throw error;\n  } finally {\n    composed.cleanup();\n  }\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMsForCliDiagnostics();\n}\n\nfunction createSpaceRequestTimeoutError(input: {\n  operation: string;\n  timeoutMs: number;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request timed out after ${input.timeoutMs}ms`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.timeout\";\n  return error;\n}\n\nfunction createSpaceRequestNetworkError(input: {\n  operation: string;\n  url: string;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request could not reach ${describeRequestTarget(input.url)} (${toErrorMessage(input.cause)})`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.request_failed\";\n  return error;\n}\n\nfunction composeAbortSignals(\n  parent: AbortSignal | null | undefined,\n  timeout: AbortSignal\n): { signal: AbortSignal; cleanup: () => void } {\n  if (!parent) {\n    return {\n      signal: timeout,\n      cleanup: () => undefined,\n    };\n  }\n\n  if (parent.aborted || timeout.aborted) {\n    const controller = new AbortController();\n    controller.abort();\n    return {\n      signal: controller.signal,\n      cleanup: () => undefined,\n    };\n  }\n\n  const controller = new AbortController();\n  const abort = () => {\n    controller.abort();\n  };\n\n  parent.addEventListener(\"abort\", abort, { once: true });\n  timeout.addEventListener(\"abort\", abort, { once: true });\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      parent.removeEventListener(\"abort\", abort);\n      timeout.removeEventListener(\"abort\", abort);\n    },\n  };\n}\n\nfunction describeRequestTarget(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    const message = error.message.trim();\n    return message.length > 0 ? message : \"request failed\";\n  }\n  const message = String(error ?? \"\").trim();\n  return message.length > 0 ? message : \"request failed\";\n}\n\nfunction shouldWrapNetworkRequestError(error: unknown): boolean {\n  if (error instanceof TypeError) {\n    return true;\n  }\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    typeof error.code === \"string\" &&\n    error.code.startsWith(\"ERR_SSL_\")\n  ) {\n    return true;\n  }\n  const message = toErrorMessage(error).toLowerCase();\n  return (\n    message.includes(\"fetch failed\") ||\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network request failed\") ||\n    message.includes(\"ssl_decryption_failed_or_bad_record_mac\")\n  );\n}\n","import {\n  createOpenMeldApiClient,\n  type OpenMeldApiClientFoundation,\n} from \"@openmeld/api-client\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID,\n} from \"@openmeld/gateway-contract\";\nimport { buildRequestAuthHeaders } from \"../config/request-headers\";\nimport { fetchSpaceRequestWithTimeout } from \"./fetch-with-timeout\";\n\nexport function createCliApiClientFoundation(\n  baseUrl: string,\n  options: {\n    onAuthHeadersResolved?: (headers: Record<string, string>) => void;\n    organizationId?: string;\n  } = {}\n): OpenMeldApiClientFoundation {\n  return createOpenMeldApiClient({\n    baseUrl,\n    transport: async (request) =>\n      await fetchSpaceRequestWithTimeout({\n        url: request.url,\n        operation: request.operation,\n        init: request.init,\n        timeoutMs: request.timeoutMs,\n      }),\n    getAuthHeaders: async ({ requestUrl }) => {\n      const headers = await buildRequestAuthHeaders({\n        requestUrl,\n      });\n      if (options.organizationId) {\n        headers[OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID] =\n          options.organizationId;\n      }\n      options.onAuthHeadersResolved?.(headers);\n      return headers;\n    },\n    getRequestContextHeaders: async ({ requestContext, spacePassword }) =>\n      buildOpenMeldRequestContextHeaders({\n        requestContext,\n        ...(spacePassword === undefined ? {} : { spacePassword }),\n      }),\n  });\n}\n"],"mappings":";;;;;;;AAoBA,SAAgB,gCAAgC,OAGnB;CAC3B,MAAM,aAAa,eAAe,MAAM,UAAU;CAClD,IAAI,CAAC,YACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa;EACb,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,cAAc,eAAe,MAAM,QAAQ,WAAW;CAC5D,IAAI,CAAC,aACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa,WAAW;EACxB,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,sBAAsB,kBAAkB,WAAW;CACzD,MAAM,cAAc,WAAW;CAC/B,MAAM,WAAW,YAAY;CAE7B,IACE,mBAAmB,WAAW,QAAQ,KACtC,mBAAmB,YAAY,QAAQ,GAEvC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,CAAC,0BAA0B,WAAW,QAAQ,GAChD,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,gBAAgB,UAClB,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,uBAAuB,gBAAgB,qBACzC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,4BAA4B,OAGhC;CACV,OAAO,gCAAgC,KAAK,CAAC,CAAC;AAChD;AAEA,SAAgB,gCACd,YACe;CACf,MAAM,SAAS,eAAe,UAAU;CACxC,IAAI,CAAC,QACH,OAAO;CAET,IAAI,CAAC,wBAAwB,OAAO,QAAQ,GAC1C,OAAO;CAET,IAAI,CAAC,OAAO,SAAS,WAAW,UAAU,GACxC,OAAO;CAGT,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,CAAC;CACzC,QAAQ,WAAW,QAAQ,OAAO,SAAS,MAAM,CAAiB;CAClE,QAAQ,WAAW;CACnB,QAAQ,SAAS;CACjB,QAAQ,OAAO;CACf,OAAO,iBAAiB,QAAQ,SAAS,CAAC;AAC5C;AAEA,SAAS,kBAAkB,aAAiC;CAC1D,IAAI,CAAC,YAAY,SAAS,WAAW,OAAO,GAC1C,OAAO;CAGT,MAAM,aAAa,IAAI,IAAI,YAAY,SAAS,CAAC;CACjD,WAAW,WAAW,WAAW,YAAY,SAAS,MAAM,CAAc;CAC1E,OAAO,WAAW;AACpB;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,0BAA0B,UAA2B;CAC5D,OAAO,aAAa,YAAY,aAAa;AAC/C;AAEA,SAAS,wBAAwB,UAA2B;CAC1D,OAAO,aAAa,WAAW,aAAa;AAC9C;;;AClJA,SAAgB,uCAAuC,OAI5B;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gCAAgC,sBACpC,MAAM,6BACR;CACA,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CAEvE,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC,aAAa,MAAM,gBAAgB;GACnC,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,gBAAgB;GACnC,aAAa,MAAM,gBAAgB;GACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAgB,+CAA+C,OAGpC;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gBAAgB,sBACpB,MAAM,gBAAgB,aACxB;CACA,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,WAAW;CAC3E,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CACvE,MAAM,gCAAgC,sBACpC,MAAM,gBAAgB,6BACxB;CACA,MAAM,cACJ,MAAM,gBAAgB,gBACrB,MAAM,gBAAgB,SAAS,WAChC,MAAM,gBAAgB,SAAS,UAC3B,MAAM,gBAAgB,OACtB;CAEN,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC;GACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GACzC,aAAa,MAAM,gBAAgB;GACnC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;;;AC7DA,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAgC7B,eAAsB,wBACpB,OACiC;CACjC,MAAM,UAAkC,CAAC;CACzC,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CACpB,OACiC;CACjC,MAAM,UAAU,mCAAmC,KAAK;CACxD,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CAA2C,OAM7B;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,uCAAuC;GACrD,iBAAiB,MAAM;GACvB,+BAA+B,MAAM;EACvC,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAEA,eAAsB,mDAAmD,OAKrC;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,+CAA+C,EAC7D,iBAAiB,MAAM,gBACzB,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAeA,SAAgB,2BAA2B,OAGnB;CACtB,MAAM,gBAAgB,gCAAgC;EACpD,SAAS,MAAM;EACf,YAAY,MAAM;CACpB,CAAC;CACD,MAAM,QAAQ,qBAAqB,MAAM,OAAO;CAChD,IAAI,CAAC,OACH,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,IAAI,CAAC,cAAc,YACjB,OAAO;EACL,QAAQ;EACR,QAAQ,cAAc;EACtB,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,OAAO;EACL,QAAQ;EACR;EACA,WAAW,mBAAmB,MAAM,QAAQ,SAAS;CACvD;AACF;AAEA,eAAe,iBACb,SACA,OACe;CACf,MAAM,UAAU,MAAM,6BAA6B,KAAK;CACxD,IAAI,YAAY,MAGd;CAGF,MAAM,aAAa,2BAA2B;EAC5C;EACA,YAAY,MAAM;CACpB,CAAC;CACD,IAAI,WAAW,WAAW,WAAW;EAKnC,qBAAqB,UAAU;EAC/B;CACF;CACA,QAAQ,wBAAwB,GAAG,WAAW,UAAU,GAAG,WAAW;AACxE;AAEA,SAAS,qBAAqB,YAA8C;CAC1E,QAAQ,KAAK,yCAAyC;EACpD,UAAU,WAAW;EACrB,qBAAqB,WAAW;EAChC,QAAQ,WAAW;EACnB,aAAa,WAAW;CAC1B,CAAC;AACH;AAEA,eAAe,6BACb,OACmC;CACnC,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,MAAM;CAGf,MAAM,eAAe,MAAM,oBAAoB;CAC/C,IAAI,aAAa,UAAU,WAAW,aAAa,YAAY,MAC7D,OAAO;CAGT,OAAO,aAAa;AACtB;AAEA,SAAS,qBAAqB,SAAoC;CAChE,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,mBAAmB,WAAuC;CACjE,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAgB,4BACd,SACA,YACS;CACT,OAAO,4BAA4B;EACjC;EACA;CACF,CAAC;AACH;;;ACxNA,MAAM,gCAAgC;AAEtC,SAAgB,6BAA6B,UAA2B;CACtE,IAAI,uBAAuB,QAAQ,GACjC,OAAO,2BAA2B,QAAQ;CAG5C,MAAM,UAAU,OAAO,SACrB,OAAO,QAAQ,IAAI,kCAAkC,EAAE,GACvD,EACF;CACA,IAAI,uBAAuB,OAAO,GAChC,OAAO,2BAA2B,OAAO;CAG3C,OAAO;AACT;AAEA,SAAgBA,+CAAqD;CACnE,OAAO,6BAA6B,KAAA,CAAS;AAC/C;AASA,SAAS,2BAA2B,OAAuB;CAEzD,OAAO,KAAK,IACV,8BACA,KAAK,IAAI,8BAHQ,KAAK,MAAM,KAGoB,CAAC,CACnD;AACF;AAEA,SAAS,uBAAuB,OAAiC;CAC/D,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE;;;ACzCA,eAAsB,6BAA6B,OAK7B;CACpB,MAAM,YAAY,6BAA6B,MAAM,SAAS;CAC9D,MAAM,gBAAgB,YAAY,QAAQ,SAAS;CACnD,MAAM,WAAW,oBAAoB,MAAM,MAAM,QAAQ,aAAa;CAEtE,IAAI;EACF,IAAI;GACF,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH,SAAS,OAAO;GAKd,IACE,cAAc,WACd,SAAS,OAAO,WAChB,CAAC,8BAA8B,KAAK,GAEpC,MAAM;GAER,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH;CACF,SAAS,OAAO;EACd,IAAI,cAAc,SAChB,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB;GACA,OAAO;EACT,CAAC;EAEH,IAAI,8BAA8B,KAAK,GACrC,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB,KAAK,MAAM;GACX,OAAO;EACT,CAAC;EAEH,MAAM;CACR,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AAEA,SAAgB,6CAAqD;CACnE,OAAOC,6CAA8C;AACvD;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,MAAM,UAAU,KAC9D,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,sBAAsB,MAAM,GAAG,EAAE,IAAI,eAAe,MAAM,KAAK,EAAE,IAC/G,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,oBACP,QACA,SAC8C;CAC9C,IAAI,CAAC,QACH,OAAO;EACL,QAAQ;EACR,eAAe,KAAA;CACjB;CAGF,IAAI,OAAO,WAAW,QAAQ,SAAS;EACrC,MAAM,aAAa,IAAI,gBAAgB;EACvC,WAAW,MAAM;EACjB,OAAO;GACL,QAAQ,WAAW;GACnB,eAAe,KAAA;EACjB;CACF;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc;EAClB,WAAW,MAAM;CACnB;CAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CAEvD,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,OAAO,oBAAoB,SAAS,KAAK;GACzC,QAAQ,oBAAoB,SAAS,KAAK;EAC5C;CACF;AACF;AAEA,SAAS,sBAAsB,KAAqB;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK;EACnC,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC;CACA,MAAM,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CACzC,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,IAAI,iBAAiB,WACnB,OAAO;CAET,IACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,WAAW,UAAU,GAEhC,OAAO;CAET,MAAM,UAAU,eAAe,KAAK,CAAC,CAAC,YAAY;CAClD,OACE,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,wBAAwB,KACzC,QAAQ,SAAS,yCAAyC;AAE9D;;;;ACxJA,SAAgB,6BACd,SACA,UAGI,CAAC,GACwB;CAC7B,OAAO,wBAAwB;EAC7B;EACA,WAAW,OAAO,YAChB,MAAM,6BAA6B;GACjC,KAAK,QAAQ;GACb,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;EACrB,CAAC;EACH,gBAAgB,OAAO,EAAE,iBAAiB;GACxC,MAAM,UAAU,MAAM,wBAAwB,EAC5C,WACF,CAAC;GACD,IAAI,QAAQ,gBACV,QAAQ,6CACN,QAAQ;GAEZ,QAAQ,wBAAwB,OAAO;GACvC,OAAO;EACT;EACA,0BAA0B,OAAO,EAAE,gBAAgB,oBACjD,mCAAmC;GACjC;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,CAAC;CACL,CAAC;AACH"}

package/dist/{auth-session-yymO5FGR.js → auth-session-BcT7IOfJ.js}

@@ -10,6 +10,7 @@ import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/pro
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 //#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
+const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
 const macOsKeychainServiceSchema = z.string().trim().min(1).max(512);
 const macOsKeychainAccountSchema = z.string().trim().min(1).max(512);
 const macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);
@@ -20,38 +21,41 @@ const macOsKeychainHelperOperationSchema = z.enum([
 ]);
 const macOsKeychainHelperRequestSchema = z.discriminatedUnion("operation", [
 	z.strictObject({
-		schemaVersion: z.literal(1),
+		schemaVersion: z.literal(2),
 		operation: z.literal("store"),
 		service: macOsKeychainServiceSchema,
 		account: macOsKeychainAccountSchema,
-		accessToken: macOsKeychainAccessTokenSchema
+		accessToken: macOsKeychainAccessTokenSchema,
+		authenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
 	}),
 	z.strictObject({
-		schemaVersion: z.literal(1),
+		schemaVersion: z.literal(2),
 		operation: z.literal("read"),
 		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
 	}),
 	z.strictObject({
-		schemaVersion: z.literal(1),
+		schemaVersion: z.literal(2),
 		operation: z.literal("delete"),
 		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
 	})
 ]);
 const macOsKeychainHelperMutationSuccessSchema = z.strictObject({
-	schemaVersion: z.literal(1),
+	schemaVersion: z.literal(2),
 	ok: z.literal(true),
 	operation: z.enum(["store", "delete"])
 });
 const macOsKeychainHelperReadSuccessSchema = z.strictObject({
-	schemaVersion: z.literal(1),
+	schemaVersion: z.literal(2),
 	ok: z.literal(true),
 	operation: z.literal("read"),
 	accessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])
 });
 const macOsKeychainHelperErrorSchema = z.strictObject({
-	schemaVersion: z.literal(1),
+	schemaVersion: z.literal(2),
 	ok: z.literal(false),
 	operation: macOsKeychainHelperOperationSchema,
 	errorMessage: z.string().trim().min(1).max(2048)
@@ -141,7 +145,8 @@ async function deleteMacOsNativeKeychainToken(input) {
 }
 async function runMacOsNativeKeychainRequestInChild(input, options = {}) {
 	const request = macOsKeychainHelperRequestSchema.parse({
-		schemaVersion: 1,
+		schemaVersion: 2,
+		authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,
 		...input
 	});
 	const timeoutMs = options.timeoutMs ?? 5e3;
@@ -225,7 +230,7 @@ async function runMacOsNativeKeychainHelperIfRequested(argv = process.argv) {
 	const request = macOsKeychainHelperRequestSchema.safeParse(json);
 	if (!request.success) throw new Error("invalid macOS Keychain helper request");
 	const response = await executeHelperRequest(request.data).catch((error) => ({
-		schemaVersion: 1,
+		schemaVersion: 2,
 		ok: false,
 		operation: request.data.operation,
 		errorMessage: truncateErrorMessage(toErrorMessage$1(error))
@@ -261,7 +266,7 @@ async function executeHelperRequest(input) {
 	if (input.operation === "store") {
 		addon.store(input.service, input.account, input.accessToken);
 		return {
-			schemaVersion: 1,
+			schemaVersion: 2,
 			ok: true,
 			operation: "store"
 		};
@@ -269,13 +274,13 @@ async function executeHelperRequest(input) {
 	if (input.operation === "delete") {
 		addon.remove(input.service, input.account);
 		return {
-			schemaVersion: 1,
+			schemaVersion: 2,
 			ok: true,
 			operation: "delete"
 		};
 	}
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		ok: true,
 		operation: "read",
 		accessToken: addon.read(input.service, input.account)
@@ -320,6 +325,7 @@ async function loadAddon() {
 const TOKEN_STORE_KEYCHAIN_SERVICE = "sh.openmeld.auth.token";
 const INSECURE_FALLBACK_ENV_KEY = "OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN";
 const FORCE_INSECURE_STORE_ENV_KEY = "OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN";
+const MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE = "macOS Keychain access is unavailable in this OpenMeld distribution. OpenMeld will not open an authorization window from an unattended process. Run setup or login with the current packaged OpenMeld CLI.";
 const COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;
 const COMMAND_TIMEOUT_MS = 3e4;
 const TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;
@@ -352,11 +358,7 @@ async function storeAccessToken(input) {
 			service: TOKEN_STORE_KEYCHAIN_SERVICE,
 			accessToken: input.accessToken
 		});
-		else await setMacOsKeychainToken({
-			service: TOKEN_STORE_KEYCHAIN_SERVICE,
-			account,
-			accessToken: input.accessToken
-		});
+		else throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);
 		return {
 			provider: "macos-keychain",
 			service: TOKEN_STORE_KEYCHAIN_SERVICE,
@@ -420,7 +422,10 @@ async function storeAccessToken(input) {
 }
 async function readAccessToken(ref) {
 	try {
-		if (ref.provider === "macos-keychain") return toAccessTokenReadResult(shouldUseNativeMacOsKeychain() ? await readMacOsNativeKeychainToken(ref) : await getMacOsKeychainToken(ref));
+		if (ref.provider === "macos-keychain") {
+			if (!shouldUseNativeMacOsKeychain()) throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);
+			return toAccessTokenReadResult(await readMacOsNativeKeychainToken(ref));
+		}
 		if (ref.provider === "windows-dpapi") return toAccessTokenReadResult(await getWindowsDpapiToken(ref));
 		if (ref.provider === "insecure-file") return toAccessTokenReadResult(await getInsecureFileToken(ref));
 		return { status: "missing" };
@@ -433,7 +438,8 @@ async function readAccessToken(ref) {
 }
 async function deleteAccessToken(ref) {
 	if (ref.provider === "macos-keychain") {
-		await (shouldUseNativeMacOsKeychain() ? deleteMacOsNativeKeychainToken(ref) : deleteMacOsKeychainToken(ref)).catch(() => void 0);
+		if (!shouldUseNativeMacOsKeychain()) return;
+		await deleteMacOsNativeKeychainToken(ref).catch(() => void 0);
 		return;
 	}
 	if (ref.provider === "windows-dpapi") {
@@ -463,47 +469,6 @@ function buildUniqueTokenFileKey(key) {
 function shouldUseNativeMacOsKeychain() {
 	return isBinaryDistribution();
 }
-async function setMacOsKeychainToken(input) {
-	await runCommand("security", [
-		"add-generic-password",
-		"-U",
-		"-a",
-		input.account,
-		"-s",
-		input.service,
-		"-w",
-		input.accessToken
-	]);
-}
-async function getMacOsKeychainToken(input) {
-	try {
-		return (await runCommand("security", [
-			"find-generic-password",
-			"-a",
-			input.account,
-			"-s",
-			input.service,
-			"-w"
-		])).stdout.trim();
-	} catch (error) {
-		if (isMacOsNotFoundError(error)) return null;
-		throw error;
-	}
-}
-async function deleteMacOsKeychainToken(input) {
-	try {
-		await runCommand("security", [
-			"delete-generic-password",
-			"-a",
-			input.account,
-			"-s",
-			input.service
-		]);
-	} catch (error) {
-		if (isMacOsNotFoundError(error)) return;
-		throw error;
-	}
-}
 async function setWindowsDpapiToken(input) {
 	const encrypted = await runPowerShellScript(WINDOWS_DPAPI_ENCRYPT_SCRIPT, input.accessToken, input.key);
 	await mkdir(tokenDirectoryPath(), { recursive: true });
@@ -601,7 +566,6 @@ async function runPowerShellScript(script, token, entropy) {
 }
 async function runCommand(command, args, stdinPayload) {
 	try {
-		if (stdinPayload === void 0) return await runExecFile(command, args);
 		const { execFile } = await import("node:child_process");
 		return await new Promise((resolve, reject) => {
 			let stdout = "";
@@ -635,24 +599,6 @@ async function runCommand(command, args, stdinPayload) {
 		throw toCommandError(error, command);
 	}
 }
-async function runExecFile(command, args) {
-	const { execFile } = await import("node:child_process");
-	return await new Promise((resolve, reject) => {
-		execFile(command, args, {
-			...EXEC_FILE_BASE_OPTIONS,
-			encoding: "utf8"
-		}, (error, stdout, stderr) => {
-			if (error) {
-				reject(toCommandError(error, command));
-				return;
-			}
-			resolve({
-				stdout: String(stdout ?? ""),
-				stderr: String(stderr ?? "")
-			});
-		});
-	});
-}
 function toCommandError(error, command) {
 	if (!(error && typeof error === "object")) return /* @__PURE__ */ new Error(`command failed (${command}): ${String(error)}`);
 	const e = error;
@@ -666,12 +612,6 @@ function toCommandError(error, command) {
 	wrapped.stderr = e.stderr;
 	return wrapped;
 }
-function isMacOsNotFoundError(error) {
-	if (!(error && typeof error === "object")) return false;
-	const record = error;
-	const text = `${record.stderr ?? ""} ${record.message ?? ""}`.toLowerCase();
-	return record.code === 44 || text.includes("could not be found in the keychain") || text.includes("the specified item could not be found");
-}
 function normalizeString(value) {
 	return String(value ?? "").trim();
 }
@@ -1130,4 +1070,4 @@ async function removeSessionFileBestEffort() {
 //#endregion
 export { REGISTER_RESPONSE_TIMEOUT_MS as A, MAX_HEARTBEAT_INTERVAL_MS as C, OPENCLAW_CLI_TIMEOUT_MS as D, MIN_SPACE_REQUEST_TIMEOUT_MS as E, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as M, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as N, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as O, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as P, HEARTBEAT_RESPONSE_TIMEOUT_MS as S, MIN_HEARTBEAT_INTERVAL_MS as T, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as _, getAuthSessionState as a, DEFAULT_HEARTBEAT_INTERVAL_MS as b, setAuthSession as c, isBinaryDistribution as d, resolveOpenMeldDistribution as f, DAEMON_STREAM_CONNECT_TIMEOUT_MS as g, DAEMON_RUNTIME_CONTRACT_EPOCH as h, getAuthSessionMetadata as i, ROUTE_CATALOG_LOAD_TIMEOUT_MS as j, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as k, updateAuthSessionActiveOrganization as l, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as m, clearAuthSession as n, getCurrentAuthOwnerUserId as o, CATALOG_SYNC_RETRY_INTERVAL_MS as p, getAuthSession as r, normalizeStoredActiveOrganization as s, auth_session_exports as t, runMacOsNativeKeychainHelperIfRequested as u, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as v, MAX_SPACE_REQUEST_TIMEOUT_MS as w, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as x, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as y };
 
-//# sourceMappingURL=auth-session-yymO5FGR.js.map
+//# sourceMappingURL=auth-session-BcT7IOfJ.js.map

package/dist/auth-session-BcT7IOfJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-BcT7IOfJ.js","names":["toErrorMessage","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import { z } from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z.discriminatedUnion(\"operation\", [\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.literal(\"read\"),\n\taccessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])\n});\nconst macOsKeychainHelperErrorSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      return;\n    }\n    await deleteMacOsNativeKeychainToken(ref).catch(() => undefined);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref).catch(() => undefined);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref).catch(() => undefined);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      \"A future successful setup or login will move the session back to \" +\n      `Keychain. Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessToken(tokenRef).catch(() => undefined);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessToken(previousTokenRef).catch(() => undefined);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<void> {\n  cachedAuthSession = null;\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessToken(payload.tokenRef).catch(() => undefined);\n  }\n  await removeSessionFileBestEffort();\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\");\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFileBestEffort(): Promise<void> {\n  await rm(authSessionPath(), { force: true }).catch(() => undefined);\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,iCAAiC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AAClE,MAAM,qCAAqC,EAAE,KAAK;CACjD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,EAAE,mBAAmB,aAAa;CAC1E,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,OAAO;EAC5B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,MAAM;EAC3B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,QAAQ;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,EAAE,aAAa;CAC/D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AACtC,CAAC;AACD,MAAM,uCAAuC,EAAE,aAAa;CAC3D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,QAAQ,MAAM;CAC3B,aAAa,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,iCAAiC,EAAE,aAAa;CACrD,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,KAAK;CACnB,WAAW;CACX,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChD,CAAC;AACD,MAAM,oCAAoC,EAAE,MAAM;CACjD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAoCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;AC9WA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC;EAEF,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;EAC/D;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;EACxD;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;AAE5D;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,QAAQ,KACN,kPAIwB,eAAe,KAAK,GAC9C;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;;AC1cV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAIzC,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,kBAAkB,QAAQ,CAAC,CAAC,YAAY,KAAA,CAAS;EACvD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,kBAAkB,gBAAgB,CAAC,CAAC,YAAY,KAAA,CAAS;AAEnE;AAEA,eAAsB,iBAAoD;CACxE,MAAM,aAAa,MAAM,yBAAyB;CAClD,IAAI,WAAW,UAAU,aAAa,WAAW,UAAU,WACzD,OAAO;CAET,OAAO,WAAW;AACpB;AAEA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAkC;CACtD,oBAAoB;CACpB,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,YAAY,KAAA,CAAS;CAEjE,MAAM,4BAA4B;AACpC;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,IAAI;EACtC,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,8BAA6C;CAC1D,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;AACpE"}