privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-EC3LJ2KF.mjs

@@ -0,0 +1,1032 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  accountSessionsDir,
+  accountSessionsPath,
+  credentialsPath,
+  globalDir
+} from "./c-YGQHSVSK.mjs";
+import {
+  x25519
+} from "./c-4WVR32AP.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// src/auth/privateer.ts?ext=privateer-gate
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4, chmodSync as chmodSync4, rmSync as rmSync3 } from "node:fs";
+import { hostname, userInfo } from "node:os";
+
+// src/auth/accountSessions.ts?ext=privateer-gate
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+var ENTRY = /^(\d+)\.json$/;
+var CLAIM = /^(\d+)\.claim-(\d+)$/;
+function entryPath(pid) {
+  return join(accountSessionsDir(), `${pid}.json`);
+}
+__name(entryPath, "entryPath");
+function claimPath(pid, claimant = process.pid) {
+  return join(accountSessionsDir(), `${pid}.claim-${claimant}`);
+}
+__name(claimPath, "claimPath");
+function tryChmod(path, mode) {
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+__name(tryChmod, "tryChmod");
+function tryRm(path) {
+  try {
+    rmSync(path, { force: true });
+  } catch {
+  }
+}
+__name(tryRm, "tryRm");
+function readEntry(path, pid) {
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof raw?.refresh !== "string" || !raw.refresh) return null;
+    return { pid, refresh: raw.refresh, expires: typeof raw.expires === "number" ? raw.expires : 0 };
+  } catch {
+    return null;
+  }
+}
+__name(readEntry, "readEntry");
+function isAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+__name(isAlive, "isAlive");
+function recordOwnedSession(cred) {
+  try {
+    mkdirSync(accountSessionsDir(), { recursive: true });
+    tryChmod(globalDir(), 448);
+    tryChmod(accountSessionsDir(), 448);
+    const path = entryPath(process.pid);
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ refresh: cred.refresh, expires: cred.expires }) + "\n", {
+      encoding: "utf8",
+      mode: 384
+    });
+    tryChmod(tmp, 384);
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+__name(recordOwnedSession, "recordOwnedSession");
+function forgetOwnedSession() {
+  tryRm(entryPath(process.pid));
+}
+__name(forgetOwnedSession, "forgetOwnedSession");
+function orphanedSessions(now = Date.now()) {
+  let names;
+  try {
+    names = readdirSync(accountSessionsDir());
+  } catch {
+    return [];
+  }
+  const orphans = [];
+  for (const name of names) {
+    const path = join(accountSessionsDir(), name);
+    const claim = CLAIM.exec(name);
+    if (claim) {
+      if (!isAlive(Number(claim[2]))) tryRm(path);
+      continue;
+    }
+    const m = ENTRY.exec(name);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    if (pid === process.pid || isAlive(pid)) continue;
+    const entry = readEntry(path, pid);
+    if (!entry || entry.expires > 0 && entry.expires <= now) {
+      tryRm(path);
+      continue;
+    }
+    orphans.push(entry);
+  }
+  return orphans;
+}
+__name(orphanedSessions, "orphanedSessions");
+function claimOrphan(pid) {
+  try {
+    renameSync(entryPath(pid), claimPath(pid));
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(claimOrphan, "claimOrphan");
+function releaseOrphan(pid) {
+  try {
+    renameSync(claimPath(pid), entryPath(pid));
+  } catch {
+    tryRm(claimPath(pid));
+  }
+}
+__name(releaseOrphan, "releaseOrphan");
+function dropOwnedSession(pid) {
+  tryRm(claimPath(pid));
+  if (pid !== process.pid) tryRm(entryPath(pid));
+}
+__name(dropOwnedSession, "dropOwnedSession");
+function clearOwnedSessions() {
+  tryRm(accountSessionsPath());
+  try {
+    if (existsSync(accountSessionsDir())) rmSync(accountSessionsDir(), { recursive: true, force: true });
+  } catch {
+  }
+}
+__name(clearOwnedSessions, "clearOwnedSessions");
+
+// src/util/redact.ts?ext=privateer-gate
+var PLACEHOLDER = "\xABredacted\xBB";
+var KEY_PATTERNS = [
+  /\bsk-(ant|or|proj|live|test)?-?[A-Za-z0-9_-]{16,}\b/g,
+  /\bAIza[A-Za-z0-9_-]{20,}\b/g,
+  /\bxai-[A-Za-z0-9_-]{16,}\b/g,
+  /\bgsk_[A-Za-z0-9_-]{16,}\b/g,
+  /\bcsk-[A-Za-z0-9_-]{16,}\b/g,
+  /\bvapi_[A-Za-z0-9_-]{16,}\b/g,
+  /\bfw_[A-Za-z0-9_-]{16,}\b/g,
+  /\b[a-f0-9]{32}\.[A-Za-z0-9]{10,}\b/g,
+  /\b(authorization|x-api-key|x-goog-api-key)\b\s*[:=]\s*(bearer\s+)?["']?[A-Za-z0-9_\-.]{16,}["']?/gi
+];
+function collectSecrets(providers) {
+  const out = /* @__PURE__ */ new Set();
+  const add = /* @__PURE__ */ __name((v) => {
+    if (v && v.trim().length >= 8) out.add(v.trim());
+  }, "add");
+  if (providers) for (const p of Object.values(providers)) add(p?.apiKey);
+  for (const k of [
+    "OPENROUTER_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GOOGLE_GENERATIVE_AI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "XAI_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "ZAI_API_KEY",
+    "Z_AI_API_KEY",
+    "MOONSHOT_API_KEY",
+    "CEREBRAS_API_KEY",
+    "FIREWORKS_API_KEY",
+    "TOGETHER_API_KEY",
+    "TOGETHER_AI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "MINIMAX_API_KEY",
+    "DASHSCOPE_API_KEY",
+    "QWEN_API_KEY",
+    "NEAR_AI_API_KEY",
+    "NEARAI_API_KEY",
+    "TINFOIL_API_KEY",
+    "VENICE_API_KEY"
+  ])
+    add(process.env[k]);
+  return [...out];
+}
+__name(collectSecrets, "collectSecrets");
+function redactText(text, secrets = collectSecrets()) {
+  let out = text;
+  for (const s of secrets) {
+    if (s) out = out.split(s).join(PLACEHOLDER);
+  }
+  for (const re of KEY_PATTERNS) out = out.replace(re, PLACEHOLDER);
+  return out;
+}
+__name(redactText, "redactText");
+
+// src/engine/errors.ts?ext=privateer-gate
+var HOST_LABELS = {
+  "openrouter.ai": "OpenRouter",
+  "api.anthropic.com": "Anthropic",
+  "api.openai.com": "OpenAI",
+  "cloud-api.near.ai": "NEAR AI",
+  "localhost:11434": "Ollama",
+  "127.0.0.1:11434": "Ollama"
+};
+var NETWORK_ERRNO = /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|EPIPE|ENETUNREACH|EHOSTUNREACH|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET|UND_ERR_BODY_TIMEOUT|UND_ERR_HEADERS_TIMEOUT)$/;
+function extract(err) {
+  const facts = {};
+  const readBody = /* @__PURE__ */ __name((body) => {
+    const b = body;
+    if (!b || typeof b !== "object") return;
+    const msg = b.error?.message ?? b.message;
+    if (facts.providerMessage == null && typeof msg === "string") facts.providerMessage = msg;
+    const c = b.error?.code ?? b.code;
+    if (facts.code == null && typeof c === "string") facts.code = c;
+  }, "readBody");
+  let cur = err;
+  for (let i = 0; i < 6 && cur && typeof cur === "object"; i++) {
+    const e = cur;
+    if (facts.statusCode == null && typeof e.statusCode === "number") facts.statusCode = e.statusCode;
+    readBody(e.data);
+    if (typeof e.responseBody === "string") {
+      try {
+        readBody(JSON.parse(e.responseBody));
+      } catch {
+      }
+    }
+    const reqBody = e.requestBodyValues;
+    if (facts.model == null && typeof reqBody?.model === "string") facts.model = reqBody.model;
+    if (facts.url == null && typeof e.url === "string" && /^https?:/.test(e.url)) {
+      facts.url = e.url;
+      try {
+        facts.provider = HOST_LABELS[new URL(e.url).host];
+      } catch {
+      }
+    }
+    if (facts.errno == null && typeof e.code === "string" && NETWORK_ERRNO.test(e.code)) {
+      facts.errno = e.code;
+    }
+    if (typeof e.message === "string" && e.message.trim()) facts.message = e.message;
+    const next = e.lastError ?? e.cause;
+    if (!next || next === cur) break;
+    cur = next;
+  }
+  return facts;
+}
+__name(extract, "extract");
+var CAP_CODE = /CAP|QUOTA|LIMIT_REACHED|INSUFFICIENT|TOP_?UP/i;
+function isAccountCapCode(code) {
+  return typeof code === "string" && CAP_CODE.test(code);
+}
+__name(isAccountCapCode, "isAccountCapCode");
+function describeAccountBalanceError(text) {
+  if (!/^\s*(?:402|429)\b/.test(text) || /<!doctype html|<html[\s>]/i.test(text)) return null;
+  const bodyStart = text.indexOf("{");
+  const facts = bodyStart < 0 ? {} : extract({ responseBody: text.slice(bodyStart) });
+  const code = facts.code;
+  const message = facts.providerMessage ?? text;
+  const balanceCode = /^(?:INSUFFICIENT_(?:BALANCE|FUNDS|CREDITS?)|(?:BALANCE|CREDITS?)_EXHAUSTED)$/i;
+  const balanceText = /\b(?:insufficient (?:credit(?:s| balance)?|balance|funds)|out of credits?|(?:credit balance|balance|credits?) (?:is |are )?exhausted)\b/i;
+  if (code ? !balanceCode.test(code) : !balanceText.test(message)) return null;
+  return {
+    message: "Your Privateer account has insufficient balance.",
+    // Use our known destination, never a URL copied from an untrusted error body.
+    hint: "Top up at https://privateer.pro/top-up, then try again.",
+    retryable: false
+  };
+}
+__name(describeAccountBalanceError, "describeAccountBalanceError");
+var MAX_ERROR_CHARS = 2e3;
+var MAX_PAGE_TEXT_CHARS = 600;
+var HTML_DOC = /<!doctype html|<html[\s>]/i;
+var NON_PROSE = /<(script|style|svg|head|noscript)\b[\s\S]*?<\/\1\s*>/gi;
+var ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " ",
+  "#39": "'",
+  "#x27": "'"
+};
+function plainText(html) {
+  return html.replace(/<[^>]*>/g, " ").replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (m, code) => {
+    const key = code.toLowerCase();
+    if (ENTITIES[key] !== void 0) return ENTITIES[key];
+    if (key.startsWith("#x")) return String.fromCodePoint(parseInt(key.slice(2), 16) || 0) || m;
+    if (key.startsWith("#")) return String.fromCodePoint(parseInt(key.slice(1), 10) || 0) || m;
+    return m;
+  }).replace(/\s+/g, " ").trim();
+}
+__name(plainText, "plainText");
+function compactProviderError(raw) {
+  const text = typeof raw === "string" ? raw : String(raw ?? "");
+  if (!HTML_DOC.test(text)) {
+    if (text.length <= MAX_ERROR_CHARS) return text;
+    return `${text.slice(0, MAX_ERROR_CHARS)}\u2026 [dropped ${text.length - MAX_ERROR_CHARS} chars]`;
+  }
+  const status = /^\s*(\d{3})\b/.exec(text)?.[1];
+  const title = plainText(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(text)?.[1] ?? "");
+  const body = plainText(text.replace(NON_PROSE, " "));
+  const visible = [title, body].filter(Boolean).join(" \u2014 ").slice(0, MAX_PAGE_TEXT_CHARS);
+  return `${status ?? "HTTP error"} \u2014 an HTML page, not an API response (something in front of the provider answered: a WAF, a proxy, or a captive portal): ${visible || "(no readable text)"} [dropped ${text.length} chars of HTML]`;
+}
+__name(compactProviderError, "compactProviderError");
+var IDLE_TIMEOUT_CODE = /^UND_ERR_(?:BODY|HEADERS)_TIMEOUT$/;
+var IDLE_TIMEOUT_TEXT = /(?:^|\b)(?:Body|Headers) Timeout Error\b/i;
+function isIdleTimeoutError(text) {
+  const s = typeof text === "string" ? text : "";
+  return IDLE_TIMEOUT_TEXT.test(s) || IDLE_TIMEOUT_CODE.test(s.trim());
+}
+__name(isIdleTimeoutError, "isIdleTimeoutError");
+var IDLE_TIMEOUT_DESCRIPTION = {
+  message: "The provider stopped responding \u2014 the connection went idle.",
+  hint: "No data arrived for the whole idle-timeout window, so the turn was cut off. Send it again, or run /model to switch providers \u2014 a slow model can be given longer under /settings \u2192 HTTP idle timeout."
+};
+var MAX_RETRY_DELAY_MS = 6e4;
+var RETRY_AFTER_PATTERNS = [
+  /retry-after(?:-ms)?["'\s:=]+(\d+(?:\.\d+)?)/i,
+  /(?:retry|try) again in (\d+(?:\.\d+)?)\s*(m?s|seconds?|minutes?)/i,
+  /retry after (\d+(?:\.\d+)?)\s*(m?s|seconds?|minutes?)/i
+];
+function retryAfterMs(text) {
+  const s = typeof text === "string" ? text : "";
+  for (const re of RETRY_AFTER_PATTERNS) {
+    const m = re.exec(s);
+    if (!m) continue;
+    const value = Number.parseFloat(m[1]);
+    if (!Number.isFinite(value) || value <= 0) continue;
+    const unit = (m[2] ?? "").toLowerCase();
+    const ms = unit === "ms" || /retry-after-ms/i.test(m[0]) ? value : unit.startsWith("m") && unit !== "ms" ? value * 6e4 : value * 1e3;
+    return Math.min(Math.max(Math.round(ms), 1e3), MAX_RETRY_DELAY_MS);
+  }
+  return null;
+}
+__name(retryAfterMs, "retryAfterMs");
+var PROVIDER_LABELS = {
+  privateer: "Privateer",
+  anthropic: "Anthropic",
+  openai: "OpenAI",
+  openrouter: "OpenRouter",
+  google: "Google",
+  tinfoil: "Tinfoil",
+  ollama: "Ollama"
+};
+function providerLabel(provider) {
+  if (!provider) return "the model provider";
+  return PROVIDER_LABELS[provider] ?? provider;
+}
+__name(providerLabel, "providerLabel");
+var CONNECTION_FAILURE = /^\s*(?:connection error\.?|fetch failed|other side closed|socket hang up|(?:read |connect )?(?:ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH)\b)/i;
+function isConnectionFailureText(text) {
+  return CONNECTION_FAILURE.test(typeof text === "string" ? text : "");
+}
+__name(isConnectionFailureText, "isConnectionFailureText");
+function describeErrorText(text, context = {}) {
+  const s = typeof text === "string" ? text : "";
+  const status = Number(/^\s*(\d{3})\b/.exec(s)?.[1] ?? NaN);
+  const account = context.provider === "privateer";
+  const who = providerLabel(context.provider);
+  if (!Number.isFinite(status)) {
+    if (isIdleTimeoutError(s)) {
+      return {
+        message: redactText(IDLE_TIMEOUT_DESCRIPTION.message),
+        hint: IDLE_TIMEOUT_DESCRIPTION.hint
+      };
+    }
+    if (isConnectionFailureText(s)) {
+      return {
+        message: redactText(`Couldn't reach ${who} \u2014 the request got no response ("${s.trim().slice(0, 80)}").`),
+        hint: account ? "Check this machine's connection. If it started around a sign-in, the session reconnects on your next message; if every message fails while a fresh `privateer` works, start a new session with /new." : "Check your connection and the provider's base URL, then send it again \u2014 or run /model to switch providers.",
+        retryable: true
+      };
+    }
+    return null;
+  }
+  if (status === 429) {
+    const stated = retryAfterMs(s);
+    return {
+      message: redactText(`Rate limited (429).`),
+      hint: stated ? `The provider asked for ${Math.ceil(stated / 1e3)}s. Wait that long and send it again.` : "Wait a moment and send it again \u2014 or run /model to switch to another provider.",
+      retryable: true
+    };
+  }
+  if (status === 401 || status === 403) {
+    const bare = /\(no body\)\s*$/i.test(s) || s.trim() === String(status);
+    const refused = status === 401 ? "rejected the credential" : "refused access";
+    return {
+      message: redactText(
+        bare ? `${who} ${refused} this request was sent with (${status}).` : compactProviderError(s)
+      ),
+      hint: account ? "This run's Privateer session was refused. A fresh one is opened automatically \u2014 send the message again, or re-run a one-shot (`-p`) command. Only if it keeps failing, check `privateer auth status`." : `Check the API key for ${who} \u2014 run /login, or set the provider's API key env var.`
+    };
+  }
+  if (status === 404) {
+    return {
+      message: redactText(compactProviderError(s)),
+      hint: "Check the model id \u2014 run /model to switch."
+    };
+  }
+  if (status === 413 || /413\b|payload too large|request_too_large|request entity too large/i.test(s)) {
+    return {
+      message: redactText(`Request payload too large (413).`),
+      hint: "The conversation history or attached files exceed the server limit. Start a new session (/new) or remove large attachments."
+    };
+  }
+  if (status >= 500) {
+    return {
+      message: redactText(compactProviderError(s)),
+      hint: "Usually transient \u2014 retry shortly.",
+      retryable: true
+    };
+  }
+  return null;
+}
+__name(describeErrorText, "describeErrorText");
+
+// src/crypto/terminalKey.ts?ext=privateer-gate
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, chmodSync as chmodSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+function keyPath() {
+  return join2(globalDir(), "terminal-key.json");
+}
+__name(keyPath, "keyPath");
+var cached;
+function b64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+__name(b64, "b64");
+function fromB64(s, label) {
+  const buf = Buffer.from(s, "base64");
+  if (buf.length !== 32) throw new Error(`${label} must be 32 bytes`);
+  return new Uint8Array(buf);
+}
+__name(fromB64, "fromB64");
+function loadOrCreate() {
+  if (cached) return cached;
+  try {
+    const parsed = JSON.parse(readFileSync2(keyPath(), "utf8"));
+    if (parsed?.v === 1 && parsed.publicKey && parsed.secretKey) {
+      cached = {
+        publicKey: fromB64(parsed.publicKey, "terminal public key"),
+        secretKey: fromB64(parsed.secretKey, "terminal secret key")
+      };
+      return cached;
+    }
+  } catch {
+  }
+  const secretKey = x25519.utils.randomPrivateKey();
+  const publicKey = x25519.getPublicKey(secretKey);
+  const file = { v: 1, publicKey: b64(publicKey), secretKey: b64(secretKey) };
+  mkdirSync2(globalDir(), { recursive: true, mode: 448 });
+  writeFileSync2(keyPath(), JSON.stringify(file), { mode: 384 });
+  try {
+    chmodSync2(keyPath(), 384);
+  } catch {
+  }
+  cached = { publicKey, secretKey };
+  return cached;
+}
+__name(loadOrCreate, "loadOrCreate");
+function terminalPublicKeyBase64() {
+  return b64(loadOrCreate().publicKey);
+}
+__name(terminalPublicKeyBase64, "terminalPublicKeyBase64");
+
+// src/crypto/accountTrust.ts?ext=privateer-gate
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, chmodSync as chmodSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+function trustPath() {
+  return join3(globalDir(), "account-trust.json");
+}
+__name(trustPath, "trustPath");
+function pinAccountSignKey(pub) {
+  const value = (pub ?? "").trim();
+  if (!value) return;
+  try {
+    const file = { v: 1, accountSignPub: value };
+    writeFileSync3(trustPath(), JSON.stringify(file), { mode: 384 });
+    try {
+      chmodSync3(trustPath(), 384);
+    } catch {
+    }
+  } catch {
+  }
+}
+__name(pinAccountSignKey, "pinAccountSignKey");
+function loadAccountSignKey() {
+  try {
+    const parsed = JSON.parse(readFileSync3(trustPath(), "utf8"));
+    return parsed?.v === 1 && typeof parsed.accountSignPub === "string" ? parsed.accountSignPub : void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(loadAccountSignKey, "loadAccountSignKey");
+function clearAccountSignKey() {
+  try {
+    rmSync2(trustPath(), { force: true });
+  } catch {
+  }
+}
+__name(clearAccountSignKey, "clearAccountSignKey");
+function tsPath() {
+  return join3(globalDir(), "control-sig.json");
+}
+__name(tsPath, "tsPath");
+function loadControlSig() {
+  try {
+    const parsed = JSON.parse(readFileSync3(tsPath(), "utf8"));
+    if (parsed?.v === 1 && parsed.byTerm && typeof parsed.byTerm === "object") return parsed;
+  } catch {
+  }
+  return { v: 1, byTerm: {} };
+}
+__name(loadControlSig, "loadControlSig");
+function loadLastControlTs(termId) {
+  const ts = loadControlSig().byTerm[termId];
+  return typeof ts === "number" ? ts : 0;
+}
+__name(loadLastControlTs, "loadLastControlTs");
+function saveLastControlTs(termId, ts) {
+  try {
+    const file = loadControlSig();
+    file.byTerm[termId] = Math.max(file.byTerm[termId] ?? 0, ts);
+    writeFileSync3(tsPath(), JSON.stringify(file), { mode: 384 });
+  } catch {
+  }
+}
+__name(saveLastControlTs, "saveLastControlTs");
+
+// src/auth/privateer.ts?ext=privateer-gate
+var DEFAULT_SERVER_URL = "https://helix-server-m1ac.onrender.com";
+function isSafeServerUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1")) {
+    return true;
+  }
+  return false;
+}
+__name(isSafeServerUrl, "isSafeServerUrl");
+function serverBaseUrl() {
+  const env = process.env.PRIVATEER_SERVER_URL?.replace(/\/$/, "");
+  if (env) {
+    if (!isSafeServerUrl(env)) {
+      throw new Error(
+        `Refusing PRIVATEER_SERVER_URL=${env}: must be https:// (http allowed only for localhost). This protects your account token from being sent over an insecure or attacker-controlled connection.`
+      );
+    }
+    return env;
+  }
+  const base = (loadCredentials()?.serverBaseUrl || DEFAULT_SERVER_URL).replace(/\/$/, "");
+  if (!isSafeServerUrl(base)) {
+    throw new Error(`Stored Privateer server URL is not https (${base}). Run /logout then /login again.`);
+  }
+  return base;
+}
+__name(serverBaseUrl, "serverBaseUrl");
+function defaultDeviceLabel() {
+  try {
+    return `${userInfo().username}@${hostname()}`;
+  } catch {
+    return "terminal";
+  }
+}
+__name(defaultDeviceLabel, "defaultDeviceLabel");
+var SHARED = /* @__PURE__ */ Symbol.for("privateer.auth.shared");
+function shared() {
+  const g = globalThis;
+  return g[SHARED] ??= { cache: null, signedIn: /* @__PURE__ */ new Set(), expired: /* @__PURE__ */ new Set() };
+}
+__name(shared, "shared");
+var _child = null;
+var _spawnInFlight = null;
+var _refreshInFlight = null;
+var _account = null;
+function loadCredentials() {
+  const state = shared();
+  if (state.cache) return state.cache;
+  const path = credentialsPath();
+  if (!existsSync2(path)) return null;
+  try {
+    state.cache = JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return null;
+  }
+  return state.cache;
+}
+__name(loadCredentials, "loadCredentials");
+function saveCredentials(creds) {
+  const dir = globalDir();
+  mkdirSync3(dir, { recursive: true });
+  tryChmod2(dir, 448);
+  const path = credentialsPath();
+  writeFileSync4(path, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  tryChmod2(path, 384);
+  shared().cache = creds;
+}
+__name(saveCredentials, "saveCredentials");
+var ARMED_SLOT = /* @__PURE__ */ Symbol.for("privateer.accountCredential");
+function forgetArmedAccountCredential() {
+  const slot = globalThis[ARMED_SLOT];
+  if (slot) slot.cred = void 0;
+}
+__name(forgetArmedAccountCredential, "forgetArmedAccountCredential");
+function clearCredentials() {
+  try {
+    rmSync3(credentialsPath(), { force: true });
+  } catch {
+  }
+  clearAccountSignKey();
+  shared().cache = null;
+  _child = null;
+  _account = null;
+  forgetArmedAccountCredential();
+}
+__name(clearCredentials, "clearCredentials");
+function hasCredentials() {
+  return loadCredentials() !== null;
+}
+__name(hasCredentials, "hasCredentials");
+function currentUser() {
+  return loadCredentials()?.user ?? null;
+}
+__name(currentUser, "currentUser");
+function tryChmod2(path, mode) {
+  try {
+    chmodSync4(path, mode);
+  } catch {
+  }
+}
+__name(tryChmod2, "tryChmod");
+function onSessionExpired(listener) {
+  const listeners = shared().expired;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+__name(onSessionExpired, "onSessionExpired");
+function notifySessionExpired() {
+  for (const listener of shared().expired) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+}
+__name(notifySessionExpired, "notifySessionExpired");
+function handleServerRevoke() {
+  if (!hasCredentials()) return;
+  clearCredentials();
+  notifySessionExpired();
+}
+__name(handleServerRevoke, "handleServerRevoke");
+function onSignedIn(listener) {
+  const listeners = shared().signedIn;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+__name(onSignedIn, "onSignedIn");
+function notifySignedIn() {
+  for (const listener of shared().signedIn) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+}
+__name(notifySignedIn, "notifySignedIn");
+async function postJson(base, path, body, init = {}) {
+  return fetch(`${base}${path}`, {
+    ...init,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...init.headers || {} },
+    body: JSON.stringify(body)
+  });
+}
+__name(postJson, "postJson");
+async function requestDeviceCode(deviceLabel = defaultDeviceLabel()) {
+  const base = serverBaseUrl();
+  let terminalPub;
+  try {
+    terminalPub = terminalPublicKeyBase64();
+  } catch {
+  }
+  const res = await postJson(base, "/auth/device/code", { deviceLabel, terminalPub });
+  if (!res.ok) {
+    throw new Error(`Couldn't start login (${res.status}). Check your connection or PRIVATEER_SERVER_URL.`);
+  }
+  return await res.json();
+}
+__name(requestDeviceCode, "requestDeviceCode");
+async function pollForToken(code, opts = {}) {
+  const base = serverBaseUrl();
+  let interval = Math.max(1, code.interval || 5) * 1e3;
+  const deadline = Date.now() + (code.expires_in || 600) * 1e3;
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) throw new Error("Login cancelled.");
+    await sleep(interval, opts.signal);
+    const res = await postJson(base, "/auth/device/token", { device_code: code.device_code });
+    if (res.ok) {
+      const data = await res.json();
+      const creds = { accessToken: data.accessToken, refreshToken: data.refreshToken, user: data.user, serverBaseUrl: base };
+      saveCredentials(creds);
+      pinAccountSignKey(data.accountSignPub);
+      notifySignedIn();
+      return creds;
+    }
+    let err = "";
+    try {
+      err = (await res.json()).error || "";
+    } catch {
+    }
+    if (err === "authorization_pending") {
+      opts.onPoll?.("pending");
+    } else if (err === "slow_down") {
+      interval += 2e3;
+      opts.onPoll?.("slow_down");
+    } else if (err === "access_denied") {
+      throw new Error("Login was denied in the app.");
+    } else if (err === "expired_token") {
+      throw new Error("This login code expired. Run /login again.");
+    } else {
+      throw new Error(`Login failed (${res.status}${err ? `: ${err}` : ""}).`);
+    }
+  }
+  throw new Error("This login code expired. Run /login again.");
+}
+__name(pollForToken, "pollForToken");
+async function runDeviceLogin(opts) {
+  const code = await requestDeviceCode(opts.deviceLabel);
+  opts.onCode(code);
+  const creds = await pollForToken(code, { onPoll: opts.onPoll, signal: opts.signal });
+  return creds.user;
+}
+__name(runDeviceLogin, "runDeviceLogin");
+async function spawnFailure(res) {
+  if (res.status === 401) {
+    if (hasCredentials()) {
+      clearCredentials();
+      notifySessionExpired();
+    }
+    return new Error("Your Privateer session expired. Run /login to sign in again.");
+  }
+  let message;
+  try {
+    message = (await res.json()).message;
+  } catch {
+  }
+  return new Error(message?.trim() || `Couldn't start a Privateer session (HTTP ${res.status}).`);
+}
+__name(spawnFailure, "spawnFailure");
+async function spawnChildSession() {
+  const parent = loadCredentials();
+  if (!parent) throw new Error("Not logged in to Privateer. Run /login.");
+  const res = await postJson(serverBaseUrl(), "/auth/session/spawn", {
+    refreshToken: parent.refreshToken,
+    deviceLabel: defaultDeviceLabel()
+  }, {
+    headers: { Authorization: `Bearer ${parent.accessToken}` }
+  });
+  if (!res.ok) throw await spawnFailure(res);
+  const { accessToken, refreshToken } = await res.json();
+  _child = { accessToken, refreshToken };
+  return _child;
+}
+__name(spawnChildSession, "spawnChildSession");
+async function warmSession() {
+  if (!hasCredentials()) return;
+  try {
+    await ensureChildSession();
+  } catch {
+  }
+}
+__name(warmSession, "warmSession");
+function ensureChildSession() {
+  if (_child) return Promise.resolve(_child);
+  if (!_spawnInFlight) {
+    _spawnInFlight = spawnChildSession().finally(() => {
+      _spawnInFlight = null;
+    });
+  }
+  return _spawnInFlight;
+}
+__name(ensureChildSession, "ensureChildSession");
+function refreshChildSession() {
+  if (_refreshInFlight) return _refreshInFlight;
+  _refreshInFlight = (async () => {
+    if (_child) {
+      const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: _child.refreshToken });
+      if (res.ok) {
+        const { accessToken, refreshToken } = await res.json();
+        _child = { accessToken, refreshToken };
+        return _child;
+      }
+    }
+    _child = null;
+    return spawnChildSession();
+  })().finally(() => {
+    _refreshInFlight = null;
+  });
+  return _refreshInFlight;
+}
+__name(refreshChildSession, "refreshChildSession");
+async function authedFetch(input, init = {}) {
+  const bodyBuf = init.body;
+  const withAuth = /* @__PURE__ */ __name((token) => {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return { ...init, headers };
+  }, "withAuth");
+  let child = await ensureChildSession();
+  let res = await fetch(input, withAuth(child.accessToken));
+  if (res.status === 401) {
+    child = await refreshChildSession();
+    res = await fetch(input, { ...withAuth(child.accessToken), body: bodyBuf });
+  }
+  return await defuseRetryableCap(res);
+}
+__name(authedFetch, "authedFetch");
+async function defuseRetryableCap(res) {
+  if (res.status !== 429) return res;
+  const body = await res.text();
+  let code;
+  try {
+    const parsed = JSON.parse(body);
+    code = parsed.code ?? parsed.error?.code;
+  } catch {
+  }
+  const status = isAccountCapCode(typeof code === "string" ? code : void 0) ? 402 : 429;
+  return new Response(body, { status, statusText: res.statusText, headers: res.headers });
+}
+__name(defuseRetryableCap, "defuseRetryableCap");
+async function apiRequest(path, init = {}) {
+  const base = serverBaseUrl();
+  return authedFetch(`${base}${path}`, init);
+}
+__name(apiRequest, "apiRequest");
+async function deleteSession(accessToken, timeoutMs) {
+  try {
+    await fetch(`${serverBaseUrl()}/auth/session/current`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch {
+  }
+}
+__name(deleteSession, "deleteSession");
+async function revokeChildSession(timeoutMs = 1500) {
+  const child = _child;
+  if (!child) return;
+  _child = null;
+  await deleteSession(child.accessToken, timeoutMs);
+}
+__name(revokeChildSession, "revokeChildSession");
+async function revokeAccountSession(timeoutMs = 1500) {
+  const account = _account;
+  if (!account) return;
+  _account = null;
+  forgetOwnedSession();
+  await deleteSession(account.accessToken, timeoutMs);
+}
+__name(revokeAccountSession, "revokeAccountSession");
+async function revokeLocalSessions(timeoutMs = 1500) {
+  await Promise.all([revokeChildSession(timeoutMs), revokeAccountSession(timeoutMs)]);
+}
+__name(revokeLocalSessions, "revokeLocalSessions");
+async function logout() {
+  const parent = loadCredentials();
+  if (parent) {
+    try {
+      const fresh = await rotateSession(parent.refreshToken);
+      await deleteSession(fresh.access, 5e3);
+    } catch {
+    }
+  }
+  _child = null;
+  _account = null;
+  clearOwnedSessions();
+  clearCredentials();
+}
+__name(logout, "logout");
+function jwtExpMs(token, fallbackMs = 5 * 6e4) {
+  try {
+    const seg = token.split(".")[1];
+    const payload = JSON.parse(Buffer.from(seg, "base64").toString("utf8"));
+    if (typeof payload.exp === "number") return payload.exp * 1e3 - 3e4;
+  } catch {
+  }
+  return Date.now() + fallbackMs;
+}
+__name(jwtExpMs, "jwtExpMs");
+async function spawnAccountCredentials() {
+  const parent = loadCredentials();
+  if (!parent) throw new Error("Not logged in to Privateer. Run /login.");
+  const res = await postJson(
+    serverBaseUrl(),
+    "/auth/session/spawn",
+    { refreshToken: parent.refreshToken, deviceLabel: defaultDeviceLabel() },
+    { headers: { Authorization: `Bearer ${parent.accessToken}` } }
+  );
+  if (!res.ok) throw await spawnFailure(res);
+  const { accessToken, refreshToken } = await res.json();
+  _account = { accessToken };
+  const cred = { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+  recordOwnedSession(cred);
+  return cred;
+}
+__name(spawnAccountCredentials, "spawnAccountCredentials");
+function isRefreshRejection(e) {
+  return e instanceof Error && typeof e.status === "number";
+}
+__name(isRefreshRejection, "isRefreshRejection");
+async function rotateSession(refresh) {
+  const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: refresh });
+  if (!res.ok) {
+    const err = new Error(`account refresh failed (${res.status})`);
+    err.status = res.status;
+    throw err;
+  }
+  const { accessToken, refreshToken } = await res.json();
+  return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+}
+__name(rotateSession, "rotateSession");
+async function refreshAccountCredentials(refresh) {
+  const cred = await rotateSession(refresh);
+  _account = { accessToken: cred.access };
+  recordOwnedSession(cred);
+  return cred;
+}
+__name(refreshAccountCredentials, "refreshAccountCredentials");
+async function acquireAccountCredential() {
+  const orphans = orphanedSessions();
+  let adopted = null;
+  let attempted = 0;
+  while (attempted < orphans.length && !adopted) {
+    const orphan = orphans[attempted++];
+    if (!claimOrphan(orphan.pid)) continue;
+    try {
+      adopted = await refreshAccountCredentials(orphan.refresh);
+      dropOwnedSession(orphan.pid);
+    } catch (e) {
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
+    }
+  }
+  const leftovers = orphans.slice(attempted);
+  if (leftovers.length) void revokeOrphanedSessions(leftovers);
+  return adopted ?? await spawnAccountCredentials();
+}
+__name(acquireAccountCredential, "acquireAccountCredential");
+async function revokeOrphanedSessions(orphans, timeoutMs = 1500) {
+  for (const orphan of orphans) {
+    if (!claimOrphan(orphan.pid)) continue;
+    try {
+      const cred = await rotateSession(orphan.refresh);
+      await deleteSession(cred.access, timeoutMs);
+      dropOwnedSession(orphan.pid);
+    } catch (e) {
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
+    }
+  }
+}
+__name(revokeOrphanedSessions, "revokeOrphanedSessions");
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new Error("Login cancelled."));
+      },
+      { once: true }
+    );
+  });
+}
+__name(sleep, "sleep");
+
+export {
+  redactText,
+  describeAccountBalanceError,
+  isConnectionFailureText,
+  describeErrorText,
+  loadAccountSignKey,
+  loadLastControlTs,
+  saveLastControlTs,
+  DEFAULT_SERVER_URL,
+  isSafeServerUrl,
+  serverBaseUrl,
+  defaultDeviceLabel,
+  loadCredentials,
+  saveCredentials,
+  clearCredentials,
+  hasCredentials,
+  currentUser,
+  onSessionExpired,
+  handleServerRevoke,
+  onSignedIn,
+  notifySignedIn,
+  requestDeviceCode,
+  pollForToken,
+  runDeviceLogin,
+  warmSession,
+  authedFetch,
+  apiRequest,
+  revokeChildSession,
+  revokeAccountSession,
+  revokeLocalSessions,
+  logout,
+  spawnAccountCredentials,
+  isRefreshRejection,
+  refreshAccountCredentials,
+  acquireAccountCredential
+};