@aetherpush/cli 0.4.2 → 0.5.1

package/README.md

@@ -24,7 +24,7 @@ Requires Node.js 22 or later.
 
 ## Quick start
 
-1. Create an account and log in. `register` asks for your email, name, and password, then sends a verification email; click the link before logging in.
+1. Create an account and sign in. `register` asks for your email, name, and password, then sends a verification email; click the link before signing in. `login` opens your browser, where you finish signing in — including any second factor — and authorize this machine.
 
    ```sh
    aether register
@@ -86,22 +86,38 @@ If no compiler is found, the command fails and prints the paths it tried.
 
 Known limitation: on Windows, some versions of the `hermes-compiler` package ship without a `win64-bin` binary. If a Hermes release fails on Windows with that path list, run it from macOS or Linux (for example in CI) instead.
 
-## Configuration
+## Signing in
 
-Session and server config are stored in `~/.aether/config.json`. Created on `aether login`, deleted on `aether logout`.
+`aether login` opens your browser, you approve the device there, and the CLI receives its own credential. The browser handles passwords, passkeys, authenticator codes and recovery codes, so the terminal never needs to.
 
-To target a non-default server (e.g. local development):
+On a machine with no browser — over SSH, in a container, on a locked-down host — ask for a code instead. The CLI prints a short code and a URL to open anywhere else:
 
 ```sh
-aether login --serverUrl http://localhost:3000
+aether login --device
 ```
 
-To run non-interactively (CI/CD):
+The CLI falls back to this automatically when it cannot open a browser or bind a local callback port.
+
+For CI and other machines, keep passing a key:
 
 ```sh
 aether login --accessKey <your-api-key>
 ```
 
+`aether logout` revokes the device on the server and then clears the local credential. If the server cannot be reached, the local credential is cleared anyway and the device can still be revoked from the dashboard under Account > CLI & Devices.
+
+`--password` still signs in with email and password, but it is deprecated and cannot complete sign-in on accounts with multi-factor authentication.
+
+## Configuration
+
+The credential lives in `~/.aether/credentials.json`, readable only by you. Everything else — server URL, device id, account email — is in `~/.aether/cli.json`. Both are created on `aether login`; the credential file is deleted on `aether logout`. A `~/.aether/config.json` left by an earlier version is migrated automatically the first time you run this one.
+
+To target a non-default server (e.g. local development):
+
+```sh
+aether login --serverUrl http://localhost:3000
+```
+
 ## CI/CD
 
 The CLI detects CI environments through the `CI` variable and runs non-interactively there; `--ci` forces it. Ready-made pipeline templates for GitLab CI, CircleCI, and Jenkins live in [`examples/ci/`](./examples/ci/), and GitHub Actions has a dedicated action, [`aetherpush-deploy-action`](https://github.com/Monoradioactivo/aetherpush-deploy-action). The [CI/CD guides](https://docs.aetherpush.com/ci-cd/) walk through each platform.

package/bin/script/auth/browser-launcher.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Opens a URL in whatever the platform considers the default browser.
+ *
+ * A zero exit code from the helper does not prove a browser actually appeared:
+ * `xdg-open` succeeds in containers with no display, and a proxy can swallow a
+ * loopback address afterwards. Callers therefore print the URL as well and keep
+ * a way out that does not depend on this returning the truth.
+ */
+export declare function openBrowser(url: string): boolean;

package/bin/script/auth/browser-launcher.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowser = openBrowser;
+const childProcess = require("child_process");
+/**
+ * Opens a URL in whatever the platform considers the default browser.
+ *
+ * A zero exit code from the helper does not prove a browser actually appeared:
+ * `xdg-open` succeeds in containers with no display, and a proxy can swallow a
+ * loopback address afterwards. Callers therefore print the URL as well and keep
+ * a way out that does not depend on this returning the truth.
+ */
+function openBrowser(url) {
+    // The URL came from the server, and `--serverUrl` means the server is not
+    // always ours. Anything but an http(s) address is refused before it reaches
+    // the shell, and the openers are invoked in forms that cannot read it as a
+    // flag or as command text.
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return false;
+    }
+    const { command, args } = resolveOpenCommand(parsed.toString());
+    try {
+        const child = childProcess.spawn(command, args, { stdio: "ignore", detached: true });
+        if (!child || typeof child.unref !== "function") {
+            return false;
+        }
+        // spawn reports a missing helper asynchronously. Without a listener that
+        // becomes an unhandled 'error' event, which takes the whole process down on
+        // exactly the headless machines the device flow exists for.
+        if (typeof child.on === "function") {
+            child.on("error", () => undefined);
+        }
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveOpenCommand(url) {
+    if (process.platform === "darwin") {
+        return { command: "open", args: ["--", url] };
+    }
+    if (process.platform === "win32") {
+        // Not `cmd /c start`: cmd re-parses its arguments, and Node's Windows
+        // quoting does not escape a double quote the way cmd reads one.
+        return { command: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    return { command: "xdg-open", args: ["--", url] };
+}
+//# sourceMappingURL=browser-launcher.js.map

package/bin/script/auth/browser-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launcher.js","sourceRoot":"","sources":["../../../script/auth/browser-launcher.ts"],"names":[],"mappings":";;AAUA,kCAiCC;AA3CD,8CAA8C;AAE9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,2BAA2B;IAC3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,sEAAsE;QACtE,gEAAgE;QAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/bin/script/auth/browser-login.d.ts

@@ -0,0 +1,32 @@
+import { LoopbackListener } from "./loopback-listener";
+export interface BrowserLoginResult {
+    accessKey: string;
+    expires: number;
+    credentialId?: string;
+    email?: string;
+}
+export interface BrowserLoginOptions {
+    serverUrl: string;
+    deviceId: string;
+    deviceName: string;
+    clientVersion: string;
+    clientPlatform: string;
+    headers: Record<string, string>;
+    log: (message: string) => void;
+    /** Skip the loopback attempt and go straight to the printed code. */
+    forceDeviceFlow?: boolean;
+    openBrowser?: (url: string) => boolean;
+    startLoopbackListener?: () => Promise<LoopbackListener>;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Raised when the server predates browser login, so the CLI can say so plainly. */
+export declare class UnsupportedServerError extends Error {
+    constructor(serverUrl: string);
+}
+export declare class AuthorizationDeniedError extends Error {
+    constructor();
+}
+export declare class AuthorizationExpiredError extends Error {
+    constructor();
+}
+export declare function runBrowserLogin(options: BrowserLoginOptions): Promise<BrowserLoginResult>;

package/bin/script/auth/browser-login.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationExpiredError = exports.AuthorizationDeniedError = exports.UnsupportedServerError = void 0;
+exports.runBrowserLogin = runBrowserLogin;
+const pkce_1 = require("./pkce");
+const browser_launcher_1 = require("./browser-launcher");
+const loopback_listener_1 = require("./loopback-listener");
+/** Raised when the server predates browser login, so the CLI can say so plainly. */
+class UnsupportedServerError extends Error {
+    constructor(serverUrl) {
+        super(`${serverUrl} does not support browser sign-in. Update the Aether server, ` +
+            `or sign in with a key: aether login --accessKey <key>`);
+    }
+}
+exports.UnsupportedServerError = UnsupportedServerError;
+class AuthorizationDeniedError extends Error {
+    constructor() {
+        super("Authorization was denied in the browser.");
+    }
+}
+exports.AuthorizationDeniedError = AuthorizationDeniedError;
+class AuthorizationExpiredError extends Error {
+    constructor() {
+        super("The authorization request expired. Run 'aether login' again.");
+    }
+}
+exports.AuthorizationExpiredError = AuthorizationExpiredError;
+const LOOPBACK_TIMEOUT_MS = 10 * 60 * 1000;
+const SLOW_DOWN_STEP_SECONDS = 5;
+async function post(serverUrl, path, body, headers) {
+    let response;
+    try {
+        response = await fetch(`${serverUrl.replace(/\/$/, "")}${path}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json", ...headers },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        throw new Error(`Unable to reach Aether at ${serverUrl}. Are you offline, or behind a firewall or proxy?`);
+    }
+    const parsed = await response.json().catch(() => ({}));
+    return { status: response.status, body: parsed };
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runBrowserLogin(options) {
+    if (options.forceDeviceFlow) {
+        return runDeviceFlow(options);
+    }
+    const startListener = options.startLoopbackListener || loopback_listener_1.startLoopbackListener;
+    let listener;
+    try {
+        listener = await startListener();
+    }
+    catch {
+        options.log("Could not open a local callback port; switching to code entry.");
+        return runDeviceFlow(options);
+    }
+    try {
+        return await runLoopbackFlow(options, listener);
+    }
+    finally {
+        listener.close();
+    }
+}
+async function runLoopbackFlow(options, listener) {
+    const { verifier, challenge } = (0, pkce_1.generatePkcePair)();
+    const state = (0, pkce_1.generateState)();
+    const started = await post(options.serverUrl, "/v1/auth/cli/authorizations", {
+        codeChallenge: challenge,
+        codeChallengeMethod: "S256",
+        redirectUri: listener.redirectUri,
+        state,
+        deviceId: options.deviceId,
+        deviceName: options.deviceName,
+        clientName: "aether-cli",
+        clientVersion: options.clientVersion,
+        clientPlatform: options.clientPlatform,
+    }, options.headers);
+    if (started.status === 404) {
+        throw new UnsupportedServerError(options.serverUrl);
+    }
+    if (started.status !== 201) {
+        throw new Error(started.body?.error || `Could not start browser sign-in (HTTP ${started.status}).`);
+    }
+    const authorizeUrl = started.body.authorizeUrl;
+    if (typeof authorizeUrl !== "string" || authorizeUrl.length === 0) {
+        throw new Error("The server did not return an address to authorize at.");
+    }
+    options.log("Opening Aether in your browser...");
+    if (!(options.openBrowser || browser_launcher_1.openBrowser)(authorizeUrl)) {
+        // The docs promise this fallback, and a machine with no opener is exactly
+        // the machine that needs it.
+        options.log("Could not open a browser on this machine; switching to code entry.");
+        return runDeviceFlow(options);
+    }
+    options.log(`If nothing opens, visit:\n${authorizeUrl}`);
+    options.log("Waiting for authorization...");
+    const callback = await listener.waitForCallback(LOOPBACK_TIMEOUT_MS);
+    // State is checked first, including on the failure path: a response carrying
+    // someone else's outcome is not worth acting on either way.
+    if (callback.state !== state) {
+        throw new Error("The browser returned an authorization response that does not match this sign-in. Nothing was exchanged.");
+    }
+    if (callback.error === "access_denied") {
+        throw new AuthorizationDeniedError();
+    }
+    if (callback.error) {
+        throw new Error(`The browser reported ${callback.error}. Run 'aether login' again.`);
+    }
+    if (!callback.code) {
+        throw new Error("The browser did not return an authorization code.");
+    }
+    const exchanged = await post(options.serverUrl, "/v1/auth/cli/token", {
+        grantType: "authorization_code",
+        code: callback.code,
+        codeVerifier: verifier,
+        redirectUri: listener.redirectUri,
+    }, options.headers);
+    if (exchanged.status !== 200) {
+        throw new Error(describeTokenError(exchanged.body));
+    }
+    return toResult(exchanged.body);
+}
+async function runDeviceFlow(options) {
+    const sleep = options.sleep || defaultSleep;
+    const started = await post(options.serverUrl, "/v1/auth/cli/device", {
+        deviceId: options.deviceId,
+        deviceName: options.deviceName,
+        clientName: "aether-cli",
+        clientVersion: options.clientVersion,
+        clientPlatform: options.clientPlatform,
+    }, options.headers);
+    if (started.status === 404) {
+        throw new UnsupportedServerError(options.serverUrl);
+    }
+    if (started.status !== 201) {
+        throw new Error(started.body?.error || `Could not start device sign-in (HTTP ${started.status}).`);
+    }
+    const deviceCode = started.body.device_code;
+    const userCode = started.body.user_code;
+    const verificationUri = started.body.verification_uri;
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new Error("The server did not return a usable device authorization.");
+    }
+    const expiresInSeconds = typeof started.body.expires_in === "number" ? started.body.expires_in : 600;
+    let intervalSeconds = typeof started.body.interval === "number" && started.body.interval > 0 ? started.body.interval : 5;
+    options.log(`Open:\n${verificationUri}\n\nEnter code:\n${userCode}`);
+    const completeUri = started.body.verification_uri_complete;
+    (options.openBrowser || browser_launcher_1.openBrowser)(typeof completeUri === "string" && completeUri.length > 0 ? completeUri : verificationUri);
+    options.log("Waiting for authorization...");
+    const deadline = Date.now() + expiresInSeconds * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalSeconds * 1000);
+        let polled;
+        try {
+            polled = await post(options.serverUrl, "/v1/auth/cli/token", { grantType: "device_code", deviceCode }, options.headers);
+        }
+        catch {
+            // A dropped connection or a server restart mid-ceremony is not a reason
+            // to abandon a request the user may already have approved. Back off and
+            // keep asking until the request itself expires.
+            intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+            continue;
+        }
+        if (polled.status === 200) {
+            return toResult(polled.body);
+        }
+        // Throttling and server faults are transient by definition, and neither
+        // carries a device-flow code to branch on.
+        if (polled.status === 429 || polled.status >= 500) {
+            intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+            continue;
+        }
+        const error = polled.body?.error;
+        if (error === "authorization_pending") {
+            continue;
+        }
+        if (error === "slow_down") {
+            intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+            continue;
+        }
+        if (error === "access_denied") {
+            throw new AuthorizationDeniedError();
+        }
+        if (error === "expired_token") {
+            throw new AuthorizationExpiredError();
+        }
+        throw new Error(describeTokenError(polled.body));
+    }
+    throw new AuthorizationExpiredError();
+}
+function describeTokenError(body) {
+    if (body?.error_description) {
+        return body.error_description;
+    }
+    if (body?.error) {
+        return `Sign-in failed: ${body.error}`;
+    }
+    return "Sign-in failed.";
+}
+function toResult(body) {
+    if (!body?.accessKey) {
+        throw new Error("The server did not return a credential.");
+    }
+    return {
+        accessKey: body.accessKey,
+        expires: body.expires,
+        credentialId: body.credentialId,
+        email: body.account?.email,
+    };
+}
+//# sourceMappingURL=browser-login.js.map

package/bin/script/auth/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../../../script/auth/browser-login.ts"],"names":[],"mappings":";;;AA4EA,0CAoBC;AAhGD,iCAAyD;AACzD,yDAAuE;AACvE,2DAA8G;AAwB9G,oFAAoF;AACpF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,SAAiB;QAC3B,KAAK,CACH,GAAG,SAAS,+DAA+D;YACzE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;CACF;AAPD,wDAOC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpD,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACxE,CAAC;CACF;AAJD,8DAIC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAOjC,KAAK,UAAU,IAAI,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAa,EAAE,OAA+B;IACjG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,mDAAmD,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,qBAAqB,IAAI,yCAA4B,CAAC;IAEpF,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAA4B,EAAE,QAA0B;IACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAA,uBAAgB,GAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,oBAAa,GAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,OAAO,CAAC,SAAS,EACjB,6BAA6B,EAC7B;QACE,aAAa,EAAE,SAAS;QACxB,mBAAmB,EAAE,MAAM;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,EACD,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,yCAAyC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,YAAY,GAAW,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,8BAAkB,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,0EAA0E;QAC1E,6BAA6B;QAC7B,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAErE,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAC1B,OAAO,CAAC,SAAS,EACjB,oBAAoB,EACpB;QACE,SAAS,EAAE,oBAAoB;QAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,EACD,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAA4B;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,OAAO,CAAC,SAAS,EACjB,qBAAqB,EACrB;QACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,EACD,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,wCAAwC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,UAAU,GAAW,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;IACpD,MAAM,QAAQ,GAAW,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,eAAe,GAAW,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,gBAAgB,GAAW,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7G,IAAI,eAAe,GAAW,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjI,OAAO,CAAC,GAAG,CAAC,UAAU,eAAe,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC3D,CAAC,OAAO,CAAC,WAAW,IAAI,8BAAkB,CAAC,CACzC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAC1F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAEtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAEpC,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,wEAAwE;YACxE,gDAAgD;YAChD,eAAe,IAAI,sBAAsB,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,wEAAwE;QACxE,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAClD,eAAe,IAAI,sBAAsB,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,eAAe,IAAI,sBAAsB,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,yBAAyB,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAS;IACnC,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QAChB,OAAO,mBAAmB,IAAI,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAS;IACzB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK;KAC3B,CAAC;AACJ,CAAC"}

package/bin/script/auth/key-store.d.ts

@@ -0,0 +1,24 @@
+export interface StoredCredential {
+    accessKey: string;
+    serverUrl?: string;
+    credentialId?: string;
+    deviceId?: string;
+    accountEmail?: string;
+    preserveAccessKeyOnLogout?: boolean;
+}
+export declare function getConfigPath(): string;
+export declare function getCredentialPath(): string;
+export declare function getLegacyConfigPath(): string;
+/**
+ * Moves a pre-0.5 `config.json` into the split files. Returns what it found so
+ * the caller can keep using it in the same run.
+ */
+export declare function migrateLegacyConfig(): StoredCredential | null;
+export declare function readCredential(): StoredCredential | null;
+export declare function writeCredential(credential: StoredCredential): void;
+/**
+ * Drops the secret and forgets the session, but keeps the machine identity so
+ * the next sign-in shows up as the same device in the dashboard.
+ */
+export declare function clearCredential(): void;
+export declare function readOrCreateDeviceId(generate: () => string): string;

package/bin/script/auth/key-store.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfigPath = getConfigPath;
+exports.getCredentialPath = getCredentialPath;
+exports.getLegacyConfigPath = getLegacyConfigPath;
+exports.migrateLegacyConfig = migrateLegacyConfig;
+exports.readCredential = readCredential;
+exports.writeCredential = writeCredential;
+exports.clearCredential = clearCredential;
+exports.readOrCreateDeviceId = readOrCreateDeviceId;
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+/**
+ * Local credential storage.
+ *
+ * Two files, deliberately. The secret lives alone in a 0600 file; everything
+ * else is plain state that is fine to read. The legacy `config.json` held both
+ * at whatever the umask allowed, and is removed once its contents are carried
+ * over: a CLI old enough to still read it would otherwise find a file with no
+ * key in it and refuse to log in while every other command failed.
+ *
+ * The OS keychain backends drop in behind this module later; callers only ever
+ * see the functions below.
+ */
+const DIRECTORY_NAME = ".aether";
+const CONFIG_FILE = "cli.json";
+const CREDENTIAL_FILE = "credentials.json";
+const LEGACY_CONFIG_FILE = "config.json";
+const SECRET_FILE_MODE = 0o600;
+const DIRECTORY_MODE = 0o700;
+function baseDirectory() {
+    return path.join(process.env.LOCALAPPDATA || process.env.HOME || os.homedir(), DIRECTORY_NAME);
+}
+function getConfigPath() {
+    return path.join(baseDirectory(), CONFIG_FILE);
+}
+function getCredentialPath() {
+    return path.join(baseDirectory(), CREDENTIAL_FILE);
+}
+function getLegacyConfigPath() {
+    return path.join(baseDirectory(), LEGACY_CONFIG_FILE);
+}
+function readJson(filePath) {
+    try {
+        return JSON.parse(fs.readFileSync(filePath, { encoding: "utf8" }));
+    }
+    catch {
+        return null;
+    }
+}
+function writeJson(filePath, value, mode) {
+    const directory = path.dirname(filePath);
+    fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });
+    // mkdirSync applies its mode only to directories it creates, so a ~/.aether
+    // left behind by an older CLI keeps whatever the old umask gave it.
+    try {
+        fs.chmodSync(directory, DIRECTORY_MODE);
+    }
+    catch {
+        // No POSIX mode to set here.
+    }
+    if (mode === undefined) {
+        fs.writeFileSync(filePath, JSON.stringify(value), { encoding: "utf8" });
+        return;
+    }
+    // O_NOFOLLOW refuses a symlink planted at the path, and narrowing the mode
+    // before the write means the secret is never briefly world-readable in an
+    // existing file.
+    let flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC;
+    if (typeof fs.constants.O_NOFOLLOW === "number") {
+        flags |= fs.constants.O_NOFOLLOW;
+    }
+    const handle = fs.openSync(filePath, flags, mode);
+    try {
+        try {
+            fs.fchmodSync(handle, mode);
+        }
+        catch {
+            // Windows and some network filesystems have no POSIX mode to set.
+        }
+        fs.writeFileSync(handle, JSON.stringify(value), { encoding: "utf8" });
+    }
+    finally {
+        fs.closeSync(handle);
+    }
+}
+/** Returns false only when the file is still there afterwards. */
+function removeFile(filePath) {
+    try {
+        fs.unlinkSync(filePath);
+        return true;
+    }
+    catch {
+        return !fs.existsSync(filePath);
+    }
+}
+/**
+ * Moves a pre-0.5 `config.json` into the split files. Returns what it found so
+ * the caller can keep using it in the same run.
+ */
+function migrateLegacyConfig() {
+    const legacy = readJson(getLegacyConfigPath());
+    if (!legacy) {
+        return null;
+    }
+    const accessKey = legacy.accessKey || legacy.accessKeyName;
+    if (!accessKey) {
+        removeFile(getLegacyConfigPath());
+        return null;
+    }
+    const credential = {
+        accessKey,
+        serverUrl: legacy.customServerUrl,
+        preserveAccessKeyOnLogout: legacy.preserveAccessKeyOnLogout,
+        deviceId: readConfig().deviceId,
+    };
+    try {
+        writeCredential(credential);
+        if (!removeFile(getLegacyConfigPath())) {
+            // The key is now in two places, one of them world-readable.
+            console.warn(`[Aether] Could not delete ${getLegacyConfigPath()}. It still holds your access key; remove it by hand.`);
+        }
+    }
+    catch {
+        // A read-only home must not break every command. Serve the credential from
+        // memory this run and try the migration again next time.
+    }
+    return credential;
+}
+function readConfig() {
+    return readJson(getConfigPath()) || {};
+}
+function readCredential() {
+    const secret = readJson(getCredentialPath());
+    if (!secret || !secret.accessKey) {
+        return migrateLegacyConfig();
+    }
+    const config = readConfig();
+    return {
+        accessKey: secret.accessKey,
+        serverUrl: config.serverUrl,
+        credentialId: config.credentialId,
+        deviceId: config.deviceId,
+        accountEmail: config.accountEmail,
+        preserveAccessKeyOnLogout: config.preserveAccessKeyOnLogout,
+    };
+}
+function writeCredential(credential) {
+    const config = {
+        serverUrl: credential.serverUrl,
+        credentialId: credential.credentialId,
+        deviceId: credential.deviceId || readConfig().deviceId,
+        accountEmail: credential.accountEmail,
+        preserveAccessKeyOnLogout: credential.preserveAccessKeyOnLogout,
+    };
+    writeJson(getConfigPath(), config);
+    writeJson(getCredentialPath(), { accessKey: credential.accessKey }, SECRET_FILE_MODE);
+}
+/**
+ * Drops the secret and forgets the session, but keeps the machine identity so
+ * the next sign-in shows up as the same device in the dashboard.
+ */
+function clearCredential() {
+    const deviceId = readConfig().deviceId;
+    const removed = removeFile(getCredentialPath());
+    removeFile(getLegacyConfigPath());
+    if (deviceId) {
+        writeJson(getConfigPath(), { deviceId });
+    }
+    else {
+        removeFile(getConfigPath());
+    }
+    if (!removed) {
+        throw new Error(`Could not delete ${getCredentialPath()}. Remove it by hand to finish signing out.`);
+    }
+}
+function readOrCreateDeviceId(generate) {
+    const config = readConfig();
+    if (config.deviceId) {
+        return config.deviceId;
+    }
+    const deviceId = generate();
+    try {
+        writeJson(getConfigPath(), { ...config, deviceId });
+    }
+    catch {
+        // A home we cannot write to still gets a working sign-in; the machine just
+        // shows up as a new device next time.
+    }
+    return deviceId;
+}
+//# sourceMappingURL=key-store.js.map

package/bin/script/auth/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../../script/auth/key-store.ts"],"names":[],"mappings":";;AAyDA,sCAEC;AAED,8CAEC;AAED,kDAEC;AA4DD,kDA8BC;AAMD,wCAeC;AAED,0CAWC;AAMD,0CAeC;AAED,oDAcC;AApOD,yBAAyB;AACzB,yBAAyB;AACzB,6BAA6B;AAE7B;;;;;;;;;;;GAWG;AAEH,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,cAAc,GAAG,KAAK,CAAC;AA+B7B,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACjG,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,mBAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAI,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAM,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAc,EAAE,IAAa;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACnE,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,iBAAiB;IACjB,IAAI,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;IAChF,IAAI,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAoB,mBAAmB,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAqB;QACnC,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ;KAChC,CAAC;IAEF,IAAI,CAAC;QACH,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;YACvC,4DAA4D;YAC5D,OAAO,CAAC,IAAI,CAAC,6BAA6B,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yDAAyD;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,QAAQ,CAAkB,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAsB,iBAAiB,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;KAC5D,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,UAA4B;IAC1D,MAAM,MAAM,GAAoB;QAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC,QAAQ;QACtD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;KAChE,CAAC;IAEF,SAAS,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,iBAAiB,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe;IAC7B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,QAAQ,CAAC;IAEvC,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChD,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,sCAAsC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/bin/script/auth/loopback-listener.d.ts

@@ -0,0 +1,19 @@
+export interface LoopbackCallback {
+    code: string;
+    state: string | null;
+    error: string | null;
+}
+export interface LoopbackListener {
+    redirectUri: string;
+    waitForCallback(timeoutMs: number): Promise<LoopbackCallback>;
+    close(): void;
+}
+/**
+ * A one-shot HTTP listener on the loopback interface that receives the
+ * authorization code the browser is redirected to.
+ *
+ * Bound to 127.0.0.1 rather than every interface, and on an ephemeral port the
+ * server pins to this ceremony, so nothing off this machine can reach it and a
+ * second `aether login` cannot collide with the first.
+ */
+export declare function startLoopbackListener(): Promise<LoopbackListener>;