import{a as e,n as t}from"./chunk-DR8-3Aex.js";import{n,t as r}from"./memoize-DNnuA2aU.js";import{n as i,t as a}from"./axios-DhfaybwJ.js";import{Bn as o,Mt as s,S as c,Vn as l,_ as u,l as d,on as f}from"./paths-Ci1iwL5Y.js";import{E as p,O as m,U as h,l as g,p as _,z as v}from"./debug-otxXY3j-.js";import{l as y,u as b}from"./oauth-CdZEzMww.js";import{d as x,f as S}from"./log-DSV4Ht5l.js";import{hostname as C}from"os";function w(){return u(k,!1)}function T(){if(w())return A()}function E(){A.cache?.clear?.()}function D(){if(!w())return;let e=o();try{let t=e.read();t?.trustedDeviceToken&&(delete t.trustedDeviceToken,e.update(t))}catch{}A.cache?.clear?.()}async function O(){try{if(!await d(k)){_(`[trusted-device] Gate ${k} is off, skipping enrollment`);return}if(process.env.CLAUDE_TRUSTED_DEVICE_TOKEN){_(`[trusted-device] CLAUDE_TRUSTED_DEVICE_TOKEN env var is set, skipping enrollment (env var takes precedence)`);return}let{getClaudeAIOAuthTokens:t}=(f(),e(s)),n=t()?.accessToken;if(!n){_(`[trusted-device] No OAuth token, skipping enrollment`);return}let r=o();if(S()){_(`[trusted-device] Essential traffic only, skipping enrollment`);return}let a=y().BASE_API_URL,c;try{c=await i.post(`${a}/api/auth/trusted_devices`,{display_name:`Claude Code on ${C()} · ${process.platform}`},{headers:{Authorization:`Bearer ${n}`,"Content-Type":`application/json`},timeout:1e4,validateStatus:e=>e<500})}catch(e){_(`[trusted-device] Enrollment request failed: ${v(e)}`);return}if(c.status!==200&&c.status!==201){_(`[trusted-device] Enrollment failed ${c.status}: ${m(c.data).slice(0,200)}`);return}let l=c.data?.device_token;if(!l||typeof l!=`string`){_(`[trusted-device] Enrollment response missing device_token field`);return}try{let e=r.read();if(!e){_(`[trusted-device] Cannot read storage, skipping token persist`);return}e.trustedDeviceToken=l;let t=r.update(e);if(!t.success){_(`[trusted-device] Failed to persist token: ${t.warning??`unknown`}`);return}A.cache?.clear?.(),_(`[trusted-device] Enrolled device_id=${c.data.device_id??`unknown`}`)}catch(e){_(`[trusted-device] Storage write failed: ${v(e)}`)}}catch(e){_(`[trusted-device] Enrollment error: ${v(e)}`)}}var k,A,j=t((()=>{a(),r(),b(),c(),g(),h(),x(),l(),p(),k=`tengu_sessions_elevated_auth_enforcement`,A=n(()=>process.env.CLAUDE_TRUSTED_DEVICE_TOKEN||o().read()?.trustedDeviceToken)}));export{j as a,T as i,E as n,O as r,D as t};