@ai21/gateway 0.6.0 → 1.0.0

package/README.md

@@ -11,25 +11,55 @@ npx @ai21/gateway install --agent-id <AGENT_ID>
 
 Merges `~/.claude/settings.json` so Claude Code routes through the gateway from
 every project on the machine (pass `--repo` to configure only the current one), then
-sends one request to prove it works. The AI21 key is prompted for without echo —
-pass `--key` only for scripting, since a key in argv stays in your shell history.
+sends one request to prove it works. With no key stored it signs you in through the
+browser first and creates an AI21 key for you, all in the one command — pass `--key`
+only for scripting, since a key in argv stays in your shell history.
+
+The key is checked against the gateway *before* anything is written, so a key the
+gateway will not take — or an agent id the key does not carry — stops the command
+instead of leaving a config that fails every later request. There is no flag to skip
+that check, and it needs none: only a definite rejection stops the install. If the
+gateway cannot be reached, or answers something we cannot read, the config is written
+and a warning says the key went unchecked.
+
+`--no-verify` turns off the *post-write* check — the one that proves end to end that
+Claude Code reaches the gateway. It does not affect the pre-write key check.
 
 The dashboard prints this command for you (Add agent, or Reconnect on an existing
 agent) and offers the key as a separate copy.
 
-| Command     | Does                                             |
-| ----------- | ------------------------------------------------ |
-| `install`   | write the config and verify it (default command) |
-| `uninstall` | revert what this tool wrote                      |
+| Command     | Does                                               |
+| ----------- | -------------------------------------------------- |
+| `install`   | write the config and verify it (default command)   |
+| `login`     | sign in through the browser and create an AI21 key |
+| `uninstall` | revert what this tool wrote                        |
 
 `configure` is accepted as an alias for `install`: it was the verb's name through
 0.3.x, so commands copied from an older dashboard keep working.
 
-There is a third verb, `login`, which signs in through the browser and stores the
-session. It parses and runs but is **left out of `--help`**, because nothing spends
-that session yet: after signing in you still configure a repo with
-`install --agent-id … --key …`, so advertising it would promise a shortcut that is
-not there. Agent creation from a stored session is what makes it worth showing.
+`login` opens the browser, creates an AI21 key in your workspace and stores it with
+your session, keyed by gateway URL so a staging session cannot be handed to production.
+`install` does all this for you when you have no key yet, so `login` is only needed on
+its own to sign in ahead of time, or to move to a different workspace with
+`--workspace <id>`.
+
+The two secrets, the session's refresh token and the AI21 key, go in the macOS
+keychain or the Linux Secret Service when one is reachable. Otherwise, and always on
+Windows, they go in `~/.config/ai21-gateway/credentials.json`, readable only by you:
+mode `0600` on macOS and Linux, an owner-only ACL on Windows. That file always holds
+the rest of the session. A session written by an older version moves into the keychain
+on the next sign-in. Either way, `install` writes the key in plaintext into the agent's
+own config, because that is where the agent reads it.
+
+The workspace is chosen without a prompt: the legacy per-user `personal` workspace is
+dropped, then public workspaces are preferred over private and ties broken by id, so
+the same machine picks the same workspace every run. The chosen one is named in the
+output. Signing in again reuses the key already stored for that gateway and workspace
+rather than minting another.
+
+Keys created this way are named `ai21-gateway-cli (<hostname>)` so they can be told
+apart in the dashboard's key list. They **do not expire**, and a fresh clone or a new
+home directory mints an additional one — revoking them is a dashboard job for now.
 
 The loopback callback itself does work from a deployed dashboard. Chrome gates a
 public page's `fetch` to `127.0.0.1` behind Local Network Access and Safari refuses
@@ -79,7 +109,7 @@ last tag. `package.json` stays at `0.0.0`; the git tag is the record.
 `403` misleads: it reads as though the AI21 gateway rejected you, but it is npm
 failing to reach the registry — before the CLI has run at all.
 
-The last one catches people out: this project _is_ `@ai21/gateway`, so npx
+The last one catches people out: this project *is* `@ai21/gateway`, so npx
 resolves the name to the working directory instead of the registry, finds no
 linked binary, and fails. The published artifact can never be exercised from its
 own source tree — use a scratch directory.

package/dist/args.d.ts

@@ -52,6 +52,7 @@ export interface ParsedArgs {
     readonly agentIdGuard?: string | undefined;
     /** Anthropic credential for the direct verifying ping. Never written to disk. */
     readonly anthropicKey?: string | undefined;
+    readonly workspaceId?: string | undefined;
     readonly noVerify: boolean;
     readonly print: boolean;
     readonly json: boolean;
@@ -70,8 +71,9 @@ export type ParseOutcome = {
     readonly message: string;
 };
 /**
- * Shared with the interactive prompt, which is a second way these values enter
- * the program and must not be a second way the rule is skipped.
+ * Every AI21 key ends up as a line in the newline-separated ANTHROPIC_CUSTOM_HEADERS,
+ * so a control character in one forges an extra header on every agent request. The
+ * header flags apply the same rule at parse time; this covers keys minted or stored.
  */
 export declare function containsControlCharacters(value: string): boolean;
 /**

package/dist/args.js

@@ -6,6 +6,7 @@
  * spawning anything.
  */
 import { parseArgs } from "node:util";
+import { isWorkspaceId } from "./login/contract.js";
 /**
  * Baked-in endpoints. Shipping these means the happy path needs no URL, and the
  * snippets we tell people to copy carry no hostname that can go stale.
@@ -65,9 +66,7 @@ export function dashboardUrl(urls, workspaceId) {
 export const CLIENTS = ["claude-code"];
 export const DEFAULT_CLIENT = "claude-code";
 export const VERBS = ["install", "login", "uninstall"];
-/* `login` is accepted but not advertised: nothing spends the session it stores yet, so
- * the reader would still have to `install --agent-id … --key …` afterwards. */
-export const DOCUMENTED_VERBS = ["install", "uninstall"];
+export const DOCUMENTED_VERBS = ["install", "login", "uninstall"];
 /** `configure` was this verb's name through 0.3.x, and the dashboard printed it. Still
  *  accepted so a copied command keeps working; deliberately absent from help. (`setup`
  *  was never released, so it needs no alias.) */
@@ -88,13 +87,14 @@ const ALLOWED_FLAGS = {
         "yes",
         "anthropic-key",
         "no-verify",
+        "workspace",
     ],
     /* `--app` names the webapp when the gateway host does not (see appOriginFor).
      * `--print`, `--client`, `--repo`, `--user`, `--anthropic-key` and `--no-verify` are all
      * dead here since login stopped writing and verifying — `--print` still renders a
      * settings.json this verb never writes. Worth removing together with the verb's next
      * change, rather than one at a time. */
-    login: ["gateway", "app", "client", "repo", "user", "print", "json", "anthropic-key", "no-verify"],
+    login: ["gateway", "app", "client", "repo", "user", "print", "json", "anthropic-key", "no-verify", "workspace"],
     // `uninstall` needs --repo/--user for the same reason `install` does: it has to
     // revert whichever settings.json was written, and a --user config would
     // otherwise be unrevertable. It takes no --env/--gateway, though — it reads an
@@ -119,6 +119,7 @@ const OPTION_SPEC = {
     "anthropic-key": { type: "string" },
     app: { type: "string" },
     "no-verify": { type: "boolean" },
+    workspace: { type: "string" },
 };
 function fail(message) {
     return { kind: "error", message };
@@ -151,8 +152,9 @@ const VERIFY_FLAGS = ["anthropic-key", "no-verify"];
 // eslint-disable-next-line no-control-regex
 const CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
 /**
- * Shared with the interactive prompt, which is a second way these values enter
- * the program and must not be a second way the rule is skipped.
+ * Every AI21 key ends up as a line in the newline-separated ANTHROPIC_CUSTOM_HEADERS,
+ * so a control character in one forges an extra header on every agent request. The
+ * header flags apply the same rule at parse time; this covers keys minted or stored.
  */
 export function containsControlCharacters(value) {
     return CONTROL_CHARS.test(value);
@@ -282,6 +284,12 @@ export function parseCliArgs(argv) {
         if (problem !== undefined)
             return fail(problem);
     }
+    const workspaceId = typeof values.workspace === "string" ? values.workspace : undefined;
+    /* Same shape the callback's workspace id is held to: it lands in a query parameter and
+     * must not be able to carry anything else there. */
+    if (workspaceId !== undefined && !isWorkspaceId(workspaceId)) {
+        return fail(`--workspace must be a workspace id, got '${workspaceId}'.`);
+    }
     if (values.repo === true && values.user === true) {
         return fail("--repo and --user are mutually exclusive; pass at most one.");
     }
@@ -322,6 +330,7 @@ export function parseCliArgs(argv) {
             userId: typeof values["user-id"] === "string" ? values["user-id"] : undefined,
             agentIdGuard: verb === "uninstall" && typeof values["agent-id"] === "string" ? values["agent-id"] : undefined,
             anthropicKey: typeof values["anthropic-key"] === "string" ? values["anthropic-key"] : undefined,
+            workspaceId,
             noVerify: values["no-verify"] === true,
             print: values.print === true,
             json: values.json === true,

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;GAGG;AACH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,GAAG,EAAE,sBAAsB;IAC3B,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,sBAAsB;CACxB,CAAC;AASX;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,4DAA4D;IAC5D,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAE3D,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,eAAwB,EAAE,WAAoB;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC;IAC1B,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,OAAO,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAErF,OAAO;QACL,GAAG,EAAE,CAAC,WAAW,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,OAAO;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,GAAG,OAAO,kBAAkB;KACrC,CAAC;AACJ,CAAC;AAED;;gCAEgC;AAChC,MAAM,UAAU,YAAY,CAAC,IAAkB,EAAE,WAAmB;IAClE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;uFACuF;AACvF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,aAAa,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAW,aAAa,CAAC;AAEpD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAGhE;+EAC+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAE1E;;iDAEiD;AACjD,MAAM,YAAY,GAAmC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAoC;IACrD,OAAO,EAAE;QACP,KAAK;QACL,UAAU;QACV,QAAQ;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,KAAK;QACL,eAAe;QACf,WAAW;KACZ;IACD;;;;4CAIwC;IACxC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC;IAClG,gFAAgF;IAChF,wEAAwE;IACxE,+EAA+E;IAC/E,+EAA+E;IAC/E,kEAAkE;IAClE,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;CACtE,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACxB,CAAC;AA6BX,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAQ,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC;AAEnE;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAAC,eAAe,CAAU,CAAC;AAE9D,sEAAsE;AACtE,MAAM,YAAY,GAAG,CAAC,eAAe,EAAE,WAAW,CAAU,CAAC;AAE7D,sEAAsE;AACtE,4CAA4C;AAC5C,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,IAAI,qBAAqB,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,IAAI,kFAAkF,CAAC;IACrG,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,IAAI,kCAAkC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,OAAO,KAAK,IAAI,0BAA0B,MAAM,CAAC,QAAQ,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,KAAa,EAAsB,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAEjG;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,QAAQ,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,IAAI,yCAAyC,KAAK,GAAG,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,IAAI,MAAoD,CAAC;IACzD,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YACnC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAElD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAExD,MAAM,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,GAAG,WAAW,CAAC;IAChD,IAAI,IAAI,GAAS,SAAS,CAAC;IAE3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,oBAAoB,KAAK,yBAAyB,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,GAAG,QAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,IAAI,wCAAwC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,yEAAyE;QACzE,gDAAgD;QAChD,OAAO,IAAI,CACT,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mBAAmB,IAAI,KAAK;YACnH,oBAAoB,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,kBAAkB,EAAE,GAAG,0BAA0B,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAExC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,MAAM,GAAW,cAAc,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,+EAA+E;YAC/E,mEAAmE;YACnE,OAAO,IAAI,CAAC,uBAAuB,SAAS,4BAA4B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;IAED,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,qDAAqD;IACrD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAED;wBACoB;IACpB,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,oCAAoC,OAAO,+CAA+C,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC/G,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CACT,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7D,GAAG,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,6DAA6D,CACpH,CAAC;IACJ,CAAC;IAED;;wDAEoD;IACpD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE;YACJ,IAAI;YACJ,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;YAC/B,6EAA6E;YAC7E,mFAAmF;YACnF,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC9C,MAAM;YACN,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACtG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC5D,MAAM,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7E,YAAY,EAAE,IAAI,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7G,YAAY,EAAE,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/F,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI;YACtC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI;YAC1B,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,IAAI;YACxB,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,IAAI;SAC3C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;GAGG;AACH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,GAAG,EAAE,sBAAsB;IAC3B,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,sBAAsB;CACxB,CAAC;AASX;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,4DAA4D;IAC5D,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAE3D,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,eAAwB,EAAE,WAAoB;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC;IAC1B,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,OAAO,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAErF,OAAO;QACL,GAAG,EAAE,CAAC,WAAW,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,OAAO;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,GAAG,OAAO,kBAAkB;KACrC,CAAC;AACJ,CAAC;AAED;;gCAEgC;AAChC,MAAM,UAAU,YAAY,CAAC,IAAkB,EAAE,WAAmB;IAClE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;uFACuF;AACvF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,aAAa,CAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAW,aAAa,CAAC;AAEpD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAGhE,MAAM,CAAC,MAAM,gBAAgB,GAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAEnF;;iDAEiD;AACjD,MAAM,YAAY,GAAmC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAoC;IACrD,OAAO,EAAE;QACP,KAAK;QACL,UAAU;QACV,QAAQ;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,KAAK;QACL,eAAe;QACf,WAAW;QACX,WAAW;KACZ;IACD;;;;4CAIwC;IACxC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;IAC/G,gFAAgF;IAChF,wEAAwE;IACxE,+EAA+E;IAC/E,+EAA+E;IAC/E,kEAAkE;IAClE,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;CACtE,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CACrB,CAAC;AA8BX,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAQ,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC;AAEnE;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAAC,eAAe,CAAU,CAAC;AAE9D,sEAAsE;AACtE,MAAM,YAAY,GAAG,CAAC,eAAe,EAAE,WAAW,CAAU,CAAC;AAE7D,sEAAsE;AACtE,4CAA4C;AAC5C,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,IAAI,qBAAqB,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,IAAI,kFAAkF,CAAC;IACrG,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,IAAI,kCAAkC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,OAAO,KAAK,IAAI,0BAA0B,MAAM,CAAC,QAAQ,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,KAAa,EAAsB,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAEjG;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,QAAQ,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,IAAI,yCAAyC,KAAK,GAAG,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,IAAI,MAAoD,CAAC;IACzD,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YACnC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAElD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAExD,MAAM,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,GAAG,WAAW,CAAC;IAChD,IAAI,IAAI,GAAS,SAAS,CAAC;IAE3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,oBAAoB,KAAK,yBAAyB,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,GAAG,QAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,IAAI,wCAAwC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,yEAAyE;QACzE,gDAAgD;QAChD,OAAO,IAAI,CACT,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mBAAmB,IAAI,KAAK;YACnH,oBAAoB,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,kBAAkB,EAAE,GAAG,0BAA0B,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAExC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,MAAM,GAAW,cAAc,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,+EAA+E;YAC/E,mEAAmE;YACnE,OAAO,IAAI,CAAC,uBAAuB,SAAS,4BAA4B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF;wDACoD;IACpD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,4CAA4C,WAAW,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;IAED,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,qDAAqD;IACrD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAED;wBACoB;IACpB,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,oCAAoC,OAAO,+CAA+C,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC/G,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CACT,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7D,GAAG,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,6DAA6D,CACpH,CAAC;IACJ,CAAC;IAED;;wDAEoD;IACpD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE;YACJ,IAAI;YACJ,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;YAC/B,6EAA6E;YAC7E,mFAAmF;YACnF,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC9C,MAAM;YACN,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACtG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC5D,MAAM,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7E,YAAY,EAAE,IAAI,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7G,YAAY,EAAE,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/F,WAAW;YACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI;YACtC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI;YAC1B,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,IAAI;YACxB,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,IAAI;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { type RunResult } from "./result.js";
 export { EXIT, type RunResult } from "./result.js";
-export declare const USAGE = "ai21-gateway \u2014 point a local coding agent at the AI21 Intelligent Gateway\n\nUsage:\n  ai21-gateway install --agent-id <id>        configure this machine (default command)\n  ai21-gateway uninstall                      revert what this tool wrote\n  ai21-gateway --help\n  ai21-gateway --version\n\nInstall flags:\n  --agent-id <id>   agent to attribute requests to (required)\n  --key <key>       AI21 key; prompted for without echo when omitted. Prefer the\n                    prompt: a key passed here is kept in your shell history\n  --user-id <id>    adds the x-ai21-user-id attribution header\n  --client <name>   which agent to configure; 'claude-code' (default) is the only\n                    one supported so far\n  --gateway <url>   override the gateway URL outright\n  --user | --repo   write to the home directory (default) or repo-local\n  --yes             overwrite an existing conflicting value\n  --print           render the resolved configuration instead of writing it\n                    (the key is always masked)\n  --json            machine-readable output\n\nUninstall flags:\n  --agent-id <id>   guard: refuse unless the stored agent matches\n  --from-backup     restore settings.json.bak verbatim instead of removing\n                    only this tool's keys \u2014 discards later edits\n  --yes             proceed with a --from-backup restore that discards changes\n  --user | --repo   which settings.json to revert (home by default)\n\nBy default 'uninstall' removes only the keys this tool wrote, leaving unrelated\nsettings and any later edits of your own intact.\n\nVerification flags:\n  --anthropic-key <key>  Anthropic credential for the verifying request; used\n                         only when 'claude' is not on PATH, never written to disk\n  --no-verify            write the configuration without verifying it\n\nAfter a successful write the CLI sends one request through the gateway to confirm\nthe configuration works: 'claude -p' when it is on PATH, otherwise a direct\nrequest if an Anthropic credential is available. With neither, verification is\nskipped with a warning \u2014 it never changes the exit code.\n\nRe-running the same command is a no-op. An existing settings.json is backed up\nto settings.json.bak before it is changed, and is left untouched if the CLI\nrefuses.";
+export declare const USAGE = "ai21-gateway \u2014 point a local coding agent at the AI21 Intelligent Gateway\n\nUsage:\n  ai21-gateway install --agent-id <id>        configure this machine (default command)\n  ai21-gateway login                          sign in and create an AI21 key\n  ai21-gateway uninstall                      revert what this tool wrote\n  ai21-gateway --help\n  ai21-gateway --version\n\nInstall flags:\n  --agent-id <id>   agent to attribute requests to (required)\n  --key <key>       AI21 key. Omit it and the CLI uses the key from your signed-in\n                    session, signing you in through the browser if you are not\n                    already. A key passed here is kept in your shell history\n  --workspace <id>  workspace to create the key in; the default is chosen for you\n  --user-id <id>    adds the x-ai21-user-id attribution header\n  --client <name>   which agent to configure; 'claude-code' (default) is the only\n                    one supported so far\n  --gateway <url>   override the gateway URL outright\n  --user | --repo   write to the home directory (default) or repo-local\n  --yes             overwrite an existing conflicting value\n  --print           render the resolved configuration instead of writing it\n                    (the key is always masked)\n  --json            machine-readable output\n\nLogin flags:\n  --workspace <id>  workspace to create the key in. Without it one is chosen for\n                    you and named in the output\n  --gateway <url>   override the gateway URL outright\n  --app <url>       the webapp origin serving the sign-in page\n\n'login' opens your browser, creates an AI21 key in your workspace and stores it\nunder ~/.config/ai21-gateway. 'install' does this for you when you have no key\nyet, so it is only needed on its own to sign in ahead of time or to move to a\ndifferent workspace.\n\nUninstall flags:\n  --agent-id <id>   guard: refuse unless the stored agent matches\n  --from-backup     restore settings.json.bak verbatim instead of removing\n                    only this tool's keys \u2014 discards later edits\n  --yes             proceed with a --from-backup restore that discards changes\n  --user | --repo   which settings.json to revert (home by default)\n\nBy default 'uninstall' removes only the keys this tool wrote, leaving unrelated\nsettings and any later edits of your own intact.\n\nVerification flags:\n  --anthropic-key <key>  Anthropic credential for the verifying request; used\n                         only when 'claude' is not on PATH, never written to disk\n  --no-verify            write the configuration without verifying it\n\nAfter a successful write the CLI sends one request through the gateway to confirm\nthe configuration works: 'claude -p' when it is on PATH, otherwise a direct\nrequest if an Anthropic credential is available. With neither, verification is\nskipped with a warning \u2014 it never changes the exit code.\n\nRe-running the same command is a no-op. An existing settings.json is backed up\nto settings.json.bak before it is changed, and is left untouched if the CLI\nrefuses.";
 export declare function readVersion(): string;
 /**
  * Pure entry point: argv in, streams-and-exit-code out. Keeping I/O at the edge

package/dist/cli.js

@@ -6,22 +6,28 @@ import { fileURLToPath } from "node:url";
 import { parseCliArgs } from "./args.js";
 import { EXIT } from "./result.js";
 import { dispatch } from "./router.js";
-import { nodeVerifyDeps } from "./verify.js";
+import { nodePrecheckDeps } from "./precheck.js";
+import { isExecutableFile, nodeVerifyDeps } from "./verify.js";
 import { nodeBrowserDeps, openBrowser } from "./login/browser.js";
+import { selectSecretStore } from "./login/keychain/select.js";
+import { runCredentialCommand } from "./login/keychain/runner.js";
 import { startLoopback } from "./login/loopback.js";
 export { EXIT } from "./result.js";
 export const USAGE = `ai21-gateway — point a local coding agent at the AI21 Intelligent Gateway
 
 Usage:
   ai21-gateway install --agent-id <id>        configure this machine (default command)
+  ai21-gateway login                          sign in and create an AI21 key
   ai21-gateway uninstall                      revert what this tool wrote
   ai21-gateway --help
   ai21-gateway --version
 
 Install flags:
   --agent-id <id>   agent to attribute requests to (required)
-  --key <key>       AI21 key; prompted for without echo when omitted. Prefer the
-                    prompt: a key passed here is kept in your shell history
+  --key <key>       AI21 key. Omit it and the CLI uses the key from your signed-in
+                    session, signing you in through the browser if you are not
+                    already. A key passed here is kept in your shell history
+  --workspace <id>  workspace to create the key in; the default is chosen for you
   --user-id <id>    adds the x-ai21-user-id attribution header
   --client <name>   which agent to configure; 'claude-code' (default) is the only
                     one supported so far
@@ -32,6 +38,17 @@ Install flags:
                     (the key is always masked)
   --json            machine-readable output
 
+Login flags:
+  --workspace <id>  workspace to create the key in. Without it one is chosen for
+                    you and named in the output
+  --gateway <url>   override the gateway URL outright
+  --app <url>       the webapp origin serving the sign-in page
+
+'login' opens your browser, creates an AI21 key in your workspace and stores it
+under ~/.config/ai21-gateway. 'install' does this for you when you have no key
+yet, so it is only needed on its own to sign in ahead of time or to move to a
+different workspace.
+
 Uninstall flags:
   --agent-id <id>   guard: refuse unless the stored agent matches
   --from-backup     restore settings.json.bak verbatim instead of removing
@@ -98,7 +115,9 @@ export async function run(argv) {
             return versionResult();
         case "error":
             return { code: EXIT.USAGE, out: "", err: `${outcome.message}\n\n${USAGE}\n` };
-        case "args":
+        case "args": {
+            // One stream for login's progress and credential-file warnings, so neither is missed.
+            const notify = (message) => void process.stderr.write(`${message}\n`);
             // Everything the CLI needs from the outside world is gathered here, at the
             // edge, so every layer below stays pure and testable against a temp
             // directory and a pair of fake streams.
@@ -107,15 +126,36 @@ export async function run(argv) {
                 prompt: { input: process.stdin, output: process.stderr },
                 processEnv: process.env,
                 verify: nodeVerifyDeps(process.env),
+                precheck: nodePrecheckDeps(),
                 login: {
                     startListener: startLoopback,
                     openBrowser: (url) => openBrowser(url, nodeBrowserDeps()),
                     fetchImpl: fetch,
+                    secrets: selectSecretStore({
+                        paths: { home: homedir(), warn: notify },
+                        run: runCredentialCommand,
+                        platform: process.platform,
+                        lookup: { platform: process.platform, processEnv: process.env, isExecutableFile },
+                        osRelease: readOsRelease,
+                    }),
                 },
                 // stderr, so `--json` on stdout stays a single parseable object even while
                 // login narrates its progress.
-                notify: (message) => process.stderr.write(`${message}\n`),
+                notify,
             });
+        }
+    }
+}
+/**
+ * WSL identifies itself here, and the Linux keychain tier skips it. Absent on macOS and
+ * Windows, where the tier never asks.
+ */
+function readOsRelease() {
+    try {
+        return readFileSync("/proc/sys/kernel/osrelease", "utf8");
+    }
+    catch {
+        return undefined;
     }
 }
 function isMain() {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA4CZ,CAAC;AAEV,+EAA+E;AAC/E,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,6GAA6G;SACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM;YACT,2EAA2E;YAC3E,oEAAoE;YACpE,wCAAwC;YACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC9C,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxD,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;gBACnC,KAAK,EAAE;oBACL,aAAa,EAAE,aAAa;oBAC5B,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;oBACzD,SAAS,EAAE,KAAK;iBACjB;gBACD,2EAA2E;gBAC3E,+BAA+B;gBAC/B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;aAC1D,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,MAAM,EAAE,EAAE,CAAC;IACb,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA0DZ,CAAC;AAEV,+EAA+E;AAC/E,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,6GAA6G;SACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,sFAAsF;YACtF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;YAEpF,2EAA2E;YAC3E,oEAAoE;YACpE,wCAAwC;YACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC9C,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxD,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;gBACnC,QAAQ,EAAE,gBAAgB,EAAE;gBAC5B,KAAK,EAAE;oBACL,aAAa,EAAE,aAAa;oBAC5B,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;oBACzD,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,iBAAiB,CAAC;wBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACxC,GAAG,EAAE,oBAAoB;wBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE;wBACjF,SAAS,EAAE,aAAa;qBACzB,CAAC;iBACH;gBACD,2EAA2E;gBAC3E,+BAA+B;gBAC/B,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,MAAM,EAAE,EAAE,CAAC;IACb,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}

package/dist/login/apiKeys.d.ts

@@ -0,0 +1,20 @@
+import type { FetchLike } from "./tokens.js";
+export type MintOutcome = {
+    readonly kind: "key";
+    readonly value: string;
+}
+/** The message is shown to the user, so it names the cause and never the credential. */
+ | {
+    readonly kind: "failed";
+    readonly reason: string;
+};
+/**
+ * Names the machine in the dashboard's key list, so someone with several can tell which
+ * laptop a key belongs to and revoke the right one.
+ */
+export declare function keyName(machine?: string): string;
+/**
+ * Mints one key in `workspaceId`. Never throws: a failure here is reported to the user
+ * with the session already stored, so signing in again is not the remedy.
+ */
+export declare function mintApiKey(gatewayUrl: string, idToken: string, workspaceId: string, name?: string, fetchImpl?: FetchLike): Promise<MintOutcome>;

package/dist/login/apiKeys.js

@@ -0,0 +1,75 @@
+/**
+ * Minting the AI21 key `install` writes, so nobody has to fetch one from the dashboard
+ * by hand.
+ *
+ * Identity's `POST /identity/api-keys` takes `workspace_id` and `key_name` as query
+ * parameters — not a body — and authenticates with the same `firebase-token` header the
+ * workspace listing uses (language-studio-identity: api_keys/api_keys_router.py,
+ * auth/middleware.py). It answers with the key value in full; `GET` masks it, which is
+ * why a minted key is kept locally rather than re-read later.
+ */
+import { hostname } from "node:os";
+import { containsControlCharacters } from "../args.js";
+import { identityBase } from "./workspaces.js";
+const API_KEYS_PATH = "/identity/api-keys";
+const TIMEOUT_MS = 20_000;
+/** Identity's own default is "API Key", which says nothing in a list of them. */
+const KEY_NAME_PREFIX = "ai21-gateway-cli";
+const MAX_HOST_LENGTH = 48;
+/**
+ * Names the machine in the dashboard's key list, so someone with several can tell which
+ * laptop a key belongs to and revoke the right one.
+ */
+export function keyName(machine = hostname()) {
+    // eslint-disable-next-line no-control-regex
+    const cleaned = machine.replace(/[\u0000-\u001F\u007F]/g, "").trim();
+    return cleaned === "" ? KEY_NAME_PREFIX : `${KEY_NAME_PREFIX} (${cleaned.slice(0, MAX_HOST_LENGTH)})`;
+}
+/**
+ * Mints one key in `workspaceId`. Never throws: a failure here is reported to the user
+ * with the session already stored, so signing in again is not the remedy.
+ */
+export async function mintApiKey(gatewayUrl, idToken, workspaceId, name = keyName(), fetchImpl = fetch) {
+    const base = identityBase(gatewayUrl);
+    if (base === undefined)
+        return { kind: "failed", reason: `'${gatewayUrl}' is not a URL a key can be minted from` };
+    const url = `${base}${API_KEYS_PATH}?workspace_id=${encodeURIComponent(workspaceId)}&key_name=${encodeURIComponent(name)}`;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "POST",
+            headers: { "firebase-token": idToken },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        return { kind: "failed", reason: `could not reach identity: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    if (!response.ok) {
+        /* 403 is the one worth naming: identity returns it both for an unverified email and
+         * for a workspace the user cannot manage keys in, and neither is retryable. */
+        return {
+            kind: "failed",
+            reason: response.status === 403
+                ? "identity refused (403) — check the email on the account is verified, and that you can manage keys in this workspace"
+                : `identity refused the request (${response.status})`,
+        };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(await response.text());
+    }
+    catch {
+        return { kind: "failed", reason: "identity returned a body that is not JSON" };
+    }
+    const value = payload.key_value;
+    if (typeof value !== "string" || value === "") {
+        return { kind: "failed", reason: "identity returned no key value" };
+    }
+    // The same rule as `--key`: this value becomes a header line.
+    if (containsControlCharacters(value)) {
+        return { kind: "failed", reason: "identity returned a key containing control characters" };
+    }
+    return { kind: "key", value };
+}
+//# sourceMappingURL=apiKeys.js.map

package/dist/login/apiKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/login/apiKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,iFAAiF;AACjF,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,eAAe,GAAG,EAAE,CAAC;AAO3B;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,UAAkB,QAAQ,EAAE;IAClD,4CAA4C;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAErE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,eAAe,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAkB,EAClB,OAAe,EACf,WAAmB,EACnB,OAAe,OAAO,EAAE,EACxB,YAAuB,KAAK;IAE5B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,UAAU,yCAAyC,EAAE,CAAC;IAEnH,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,aAAa,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAE3H,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB;uFAC+E;QAC/E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACrB,CAAC,CAAC,qHAAqH;gBACvH,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAI,OAAmC,CAAC,SAAS,CAAC;IAE7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACtE,CAAC;IAED,8DAA8D;IAC9D,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC7F,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/login/credentials.d.ts

@@ -1,5 +1,7 @@
-export interface StoredCredential {
-    readonly refreshToken: string;
+import { type FileAcl } from "./fileAcl.js";
+import type { SecretStore } from "./secretStore.js";
+/** The non-secret half of a stored session. Safe to log; none of it authenticates. */
+export interface StoredMetadata {
     readonly firebaseApiKey: string;
     readonly projectId: string;
     readonly userId: string;
@@ -8,16 +10,20 @@ export interface StoredCredential {
     /** ISO 8601, for `whoami` to say how old the session is. */
     readonly obtainedAt: string;
 }
-/** Injected so tests never touch a real home directory. */
+/** Injected so tests never touch a real home directory or a real ACL. */
 export interface CredentialPaths {
     readonly home: string;
+    /** Replaces the POSIX mode as the owner-only mechanism. Defaults to NTFS ACLs on Windows only. */
+    readonly acl?: FileAcl | undefined;
+    /** Hears about ACL problems, which never fail a command. */
+    readonly warn?: ((message: string) => void) | undefined;
 }
 export declare function credentialsPath(ctx: CredentialPaths): string;
 export type LoadOutcome = {
     readonly kind: "none";
 } | {
     readonly kind: "credential";
-    readonly credential: StoredCredential;
+    readonly credential: StoredMetadata;
 }
 /** The file exists but cannot be trusted or read — the message says what to do. */
  | {
@@ -25,10 +31,17 @@ export type LoadOutcome = {
     readonly reason: string;
 };
 export declare function load(gateway: string, ctx: CredentialPaths): LoadOutcome;
+/** Sits beside the credentials file, so one lock covers every gateway's entry. */
+export declare function lockPath(ctx: CredentialPaths): string;
 /**
- * Writes one gateway's credential, leaving the others alone. Created at 0600 rather than
- * chmodded after: the gap between the two is openable by another local user.
+ * Replaces the metadata and keeps only the secret fields. Not a blanket merge: an
+ * optional field such as `workspaceId` would otherwise survive from the previous user.
+ */
+export declare function save(gateway: string, metadata: StoredMetadata, ctx: CredentialPaths): void;
+/** Keeps secrets in the credentials file itself; the fallback where no keychain is reachable. */
+export declare function fileSecretStore(ctx: CredentialPaths): SecretStore;
+/**
+ * Removes one gateway's entry from this file. Returns false when there was none.
+ * Secrets held by another tier are not touched; forget them through the store.
  */
-export declare function save(gateway: string, credential: StoredCredential, ctx: CredentialPaths): void;
-/** Forgets one gateway's session. Returns false when there was nothing to forget. */
 export declare function clear(gateway: string, ctx: CredentialPaths): boolean;