@allocator-one/harness-cli 1.16.0 → 1.17.0

package/dist/chunk-WSDFLMO6.js

@@ -0,0 +1,717 @@
+#!/usr/bin/env node
+import {
+  Client,
+  EXPERT_ASSIGNMENTS_PATH,
+  EXPERT_LAPSED,
+  HttpError,
+  SESSION_PATH,
+  TransportError,
+  clean,
+  defaultCredentialsPath,
+  deleteCredentials,
+  expertSummary,
+  isExpertToken,
+  isLoginCredential,
+  orgCredentialsPath,
+  readCredentials,
+  validOrgId,
+  validateBaseUrl,
+  writeCredentials
+} from "./chunk-BHBEIT5I.js";
+import {
+  invokedName,
+  named
+} from "./chunk-5THYIKLW.js";
+
+// src/core/auth.ts
+import { createHash, randomBytes } from "crypto";
+import { execFile } from "child_process";
+import { accessSync, constants as fsConstants } from "fs";
+import { createServer } from "http";
+import { delimiter, join } from "path";
+import { createInterface } from "readline";
+var DEFAULT_TIMEOUT_MS = 18e4;
+var RESPONSE_DRAIN_GRACE_MS = 100;
+var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
+var MAX_PAGE_RESPONSES = 4;
+var loginPageImport;
+function loadLoginPage() {
+  loginPageImport ??= import("./login-page-MFHNVTUV.js");
+  return loginPageImport;
+}
+var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
+function generateState() {
+  return randomBytes(24).toString("base64url");
+}
+function generateVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function challengeFor(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+async function login(baseUrl, options = {}) {
+  const validated = validateBaseUrl(baseUrl);
+  if (!validated.ok) return { ok: false, message: validated.message };
+  if (options.org !== void 0 && !validOrgId(options.org)) {
+    return { ok: false, message: "org must be an organization UUID" };
+  }
+  const base = baseUrl.replace(/\/+$/, "");
+  if (options.noBrowser === true || !browserAvailable(options)) {
+    return manualLogin(base, options);
+  }
+  return loopbackLogin(base, options);
+}
+function browserAvailable(options) {
+  if ("openBrowser" in options) return typeof options.openBrowser === "function";
+  return browserOpener() !== null && displayAvailable(options.env ?? process.env);
+}
+function findExecutable(name, pathVar = process.env["PATH"]) {
+  for (const dir of (pathVar ?? "").split(delimiter)) {
+    if (dir === "") continue;
+    const candidate = join(dir, name);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function browserOpener() {
+  const name = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+  if (name === null) return null;
+  return findExecutable(name);
+}
+function displayAvailable(env) {
+  const display = env["DISPLAY"];
+  const remote = isSet(env["SSH_CONNECTION"]) || isSet(env["SSH_TTY"]);
+  const hasDisplay = isSet(display) || isSet(env["WAYLAND_DISPLAY"]);
+  const forwarded = typeof display === "string" && display.startsWith("localhost:");
+  if (process.platform === "darwin") return !remote;
+  if (process.platform === "linux") return hasDisplay && (!remote || forwarded);
+  return !remote;
+}
+function isSet(value) {
+  return value !== void 0 && value !== "";
+}
+async function loopbackLogin(baseUrl, options) {
+  const callback = await loopbackCode((query) => `${baseUrl}/cli/login?${query.toString()}`, options);
+  if (!callback.ok) return callback;
+  try {
+    const token = await exchangeCode(baseUrl, callback.code, callback.verifier, options);
+    if (!token.ok) {
+      await callback.respond(
+        400,
+        "Harness could not exchange the browser authorization. Return to the terminal for details.",
+        "error"
+      );
+      return token;
+    }
+    const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
+    if (result.ok) {
+      await callback.respond(200, "You can close this browser and return to the terminal.", "success");
+    } else {
+      await callback.respond(
+        400,
+        "Harness could not verify and store this login. Return to the terminal for details.",
+        "error"
+      );
+    }
+    return result;
+  } catch (error) {
+    await callback.respond(500, "Harness could not finish the login. Return to the terminal for details.", "error");
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, message: `could not finish the browser login: ${detail}` };
+  } finally {
+    callback.close();
+  }
+}
+async function loopbackCode(pageUrl, options) {
+  const notify = options.notify ?? defaultNotify;
+  const state = generateState();
+  const verifier = generateVerifier();
+  const challenge = challengeFor(verifier);
+  const server = createServer();
+  const port = await new Promise((resolve) => {
+    server.once("error", () => resolve(null));
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      resolve(typeof address === "object" && address !== null ? address.port : null);
+    });
+  });
+  if (port === null) {
+    return {
+      ok: false,
+      message: "could not open a loopback port for the browser handoff"
+    };
+  }
+  const close = () => {
+    server.close();
+    const forceClose = setTimeout(
+      () => server.closeAllConnections(),
+      RESPONSE_FLUSH_TIMEOUT_MS + RESPONSE_DRAIN_GRACE_MS
+    );
+    forceClose.unref();
+  };
+  let handedOff = false;
+  try {
+    const query = new URLSearchParams({ port: String(port), state, challenge });
+    const url = pageUrl(query);
+    const callbackPromise = awaitCallback(server, state, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    void loadLoginPage().catch(() => {
+      loginPageImport = void 0;
+    });
+    const openBrowser = options.openBrowser ?? defaultOpenBrowser;
+    try {
+      openBrowser(url);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      return { ok: false, message: `could not open a browser: ${detail}` };
+    }
+    if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
+    notify(`Opening ${url}`);
+    notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
+    const callback = await callbackPromise;
+    if (!callback.ok) return callback;
+    handedOff = true;
+    return { ok: true, code: callback.code, verifier, respond: callback.respond, close };
+  } finally {
+    if (!handedOff) close();
+  }
+}
+function awaitCallback(server, state, timeoutMs) {
+  return new Promise((resolve) => {
+    let phase = "waiting";
+    let finalResponse = null;
+    let callbackPageResponses = 0;
+    const rootPageResponses = /* @__PURE__ */ new Map();
+    const acceptedResponders = [];
+    const inFlightResponses = /* @__PURE__ */ new Set();
+    const trackResponse = (responsePromise) => {
+      inFlightResponses.add(responsePromise);
+      void responsePromise.finally(() => inFlightResponses.delete(responsePromise));
+      return responsePromise;
+    };
+    const drainTrackedResponses = async () => {
+      await new Promise((settle) => setTimeout(settle, RESPONSE_DRAIN_GRACE_MS));
+      const deadline = Date.now() + RESPONSE_FLUSH_TIMEOUT_MS;
+      while (inFlightResponses.size > 0 && Date.now() < deadline) {
+        const remaining = deadline - Date.now();
+        await Promise.race([
+          Promise.allSettled([...inFlightResponses]),
+          new Promise((settle) => setTimeout(settle, remaining))
+        ]);
+      }
+    };
+    const timer = setTimeout(() => {
+      if (phase !== "waiting") return;
+      const timeoutResponse = {
+        status: 410,
+        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
+        pageState: "error"
+      };
+      phase = "terminal";
+      finalResponse = timeoutResponse;
+      resolve({
+        ok: false,
+        message: "timed out waiting for the browser authorization"
+      });
+      void drainTrackedResponses();
+    }, timeoutMs);
+    server.once("close", () => {
+      clearTimeout(timer);
+      if (phase !== "waiting") return;
+      phase = "terminal";
+      resolve({ ok: false, message: "the browser login listener closed before authorization completed" });
+    });
+    server.on("request", (request, response) => {
+      const respond = callbackResponder(response);
+      const respondWithPage = (status, message, pageState) => {
+        if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return Promise.resolve();
+        }
+        callbackPageResponses += 1;
+        return respond(status, message, pageState);
+      };
+      const respondAtRoot = (status, message, pageState) => {
+        const rootPhase = phase === "terminal" ? "terminal" : "waiting";
+        const responses = rootPageResponses.get(rootPhase) ?? 0;
+        if (responses >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return Promise.resolve();
+        }
+        rootPageResponses.set(rootPhase, responses + 1);
+        return respond(status, message, pageState);
+      };
+      let url;
+      try {
+        url = new URL(request.url ?? "/", "http://127.0.0.1");
+      } catch {
+        respondEmpty(response, 404);
+        return;
+      }
+      const path = url.pathname.replace(/\/+$/, "") || "/";
+      if (path !== "/callback") {
+        if (path === "/") {
+          const rootResponse = phase === "terminal" && finalResponse ? finalResponse : {
+            status: 200,
+            message: "Waiting for the Harness browser authorization to finish.",
+            pageState: "waiting"
+          };
+          void trackResponse(
+            respondAtRoot(rootResponse.status, rootResponse.message, rootResponse.pageState)
+          );
+        } else {
+          respondEmpty(response, path === "/favicon.ico" ? 204 : 404);
+        }
+        return;
+      }
+      const matchingState = url.searchParams.get("state") === state;
+      if (!matchingState) {
+        respondEmpty(response, 400);
+        return;
+      }
+      if (phase === "terminal") {
+        if (!url.searchParams.has("code") && !url.searchParams.has("error")) {
+          respondEmpty(response, 400);
+          return;
+        }
+        const result = finalResponse ?? {
+          status: 410,
+          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
+          pageState: "error"
+        };
+        void trackResponse(respondWithPage(result.status, result.message, result.pageState));
+        return;
+      }
+      if (phase === "processing") {
+        if (url.searchParams.has("error")) {
+          respondEmpty(response, 409);
+          return;
+        }
+        const duplicateCode = url.searchParams.get("code");
+        if (duplicateCode === null || duplicateCode === "") {
+          respondEmpty(response, 400);
+          return;
+        }
+        if (acceptedResponders.length >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return;
+        }
+        acceptedResponders.push(respondWithPage);
+        return;
+      }
+      if (url.searchParams.has("error")) {
+        const denialResponse = {
+          status: 400,
+          message: "Browser authorization was denied. Return to the terminal to try again.",
+          pageState: "error"
+        };
+        phase = "terminal";
+        finalResponse = denialResponse;
+        clearTimeout(timer);
+        void (async () => {
+          await trackResponse(respondWithPage(denialResponse.status, denialResponse.message, denialResponse.pageState));
+          await drainTrackedResponses();
+          resolve({ ok: false, message: "browser authorization was denied" });
+        })();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (code !== null && code !== "") {
+        phase = "processing";
+        acceptedResponders.push(respondWithPage);
+        clearTimeout(timer);
+        resolve({
+          ok: true,
+          code,
+          respond: async (status, message, pageState) => {
+            finalResponse = { status, message, pageState };
+            phase = "terminal";
+            const responders = acceptedResponders.splice(0);
+            await Promise.all(
+              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status, message, pageState)))
+            );
+            await drainTrackedResponses();
+          }
+        });
+      } else {
+        respondEmpty(response, 400);
+      }
+    });
+  });
+}
+function callbackResponder(response) {
+  return async (status, message, state) => {
+    if (response.writableEnded || response.destroyed) return;
+    return new Promise((resolve) => {
+      let flushTimer;
+      const armFlushTimeout = () => {
+        if (flushTimer !== void 0) clearTimeout(flushTimer);
+        flushTimer = setTimeout(() => {
+          response.destroy();
+          settle();
+        }, RESPONSE_FLUSH_TIMEOUT_MS);
+        flushTimer.unref();
+      };
+      const settle = () => {
+        if (flushTimer !== void 0) clearTimeout(flushTimer);
+        response.off("finish", settle);
+        response.off("close", settle);
+        response.off("error", settle);
+        response.off("drain", armFlushTimeout);
+        resolve();
+      };
+      response.once("finish", settle);
+      response.once("close", settle);
+      response.once("error", settle);
+      response.on("drain", armFlushTimeout);
+      void loadLoginPage().then(({ loginPage }) => {
+        if (response.writableEnded || response.destroyed) {
+          settle();
+          return;
+        }
+        try {
+          const html = loginPage(message, state);
+          response.writeHead(status, {
+            "cache-control": "no-store",
+            connection: "close",
+            "content-length": String(Buffer.byteLength(html)),
+            "content-type": "text/html; charset=utf-8",
+            "x-content-type-options": "nosniff"
+          });
+          armFlushTimeout();
+          response.end(html);
+        } catch {
+          response.destroy();
+          settle();
+        }
+      }).catch(() => {
+        response.destroy();
+        settle();
+      });
+    });
+  };
+}
+function respondEmpty(response, status) {
+  response.once("error", () => void 0);
+  try {
+    response.writeHead(status, {
+      "cache-control": "no-store",
+      connection: "close",
+      "x-content-type-options": "nosniff"
+    });
+    response.end();
+  } catch {
+    response.destroy();
+  }
+}
+async function exchangeCode(baseUrl, code, verifier, options) {
+  try {
+    const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
+    const token = body.data?.token;
+    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
+    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
+    return {
+      ok: false,
+      message: "the login-code exchange returned no token \u2014 aborting"
+    };
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return {
+        ok: false,
+        message: `the login-code exchange failed: ${error.message}`
+      };
+    }
+    if (error instanceof TransportError) {
+      return {
+        ok: false,
+        message: `the login-code exchange failed: cannot reach the API (${error.message})`
+      };
+    }
+    throw error;
+  }
+}
+async function manualLogin(baseUrl, options) {
+  const notify = options.notify ?? defaultNotify;
+  const prompt = options.prompt ?? defaultPrompt;
+  if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
+  notify(
+    `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
+  );
+  const token = (await prompt()).trim();
+  if (token === "") return { ok: false, message: "no token entered" };
+  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
+}
+async function verifyAndStore(baseUrl, token, options, received) {
+  const defaultPath = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const path = options.org === void 0 ? defaultPath : orgCredentialsPath(defaultPath, baseUrl, options.org);
+  const client = bareClient(baseUrl, token, options);
+  const expert = isExpertToken(token);
+  let kind = received.kind;
+  try {
+    if (expert) {
+      if (options.org !== void 0) return { ok: false, message: "cannot verify an outside expert credential against a repo org \u2014 nothing was stored" };
+      await client.get(EXPERT_ASSIGNMENTS_PATH);
+    } else {
+      const described = isLoginCredential(token) ? await describeSession(client) : null;
+      if (described !== null) kind = described.session.kind ?? kind;
+      if (options.org !== void 0 && (typeof described?.session.org?.["id"] !== "string" || described.session.org["id"].toLowerCase() !== options.org.toLowerCase())) {
+        const revoked = received.minted && await revokeSession(client, token);
+        return { ok: false, message: `the received token does not verify organization ${options.org} \u2014 nothing was stored` + (revoked ? ", and the token was revoked" : "") };
+      }
+      if (described === null) await client.get("/api/v1/teams");
+    }
+  } catch (error) {
+    if (error instanceof HttpError) {
+      const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
+      const revoked = received.minted && await revokeSession(client, token);
+      return {
+        ok: false,
+        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
+      };
+    }
+    if (error instanceof TransportError) {
+      return {
+        ok: false,
+        message: `could not verify the token: cannot reach the API (${error.message}) \u2014 nothing was stored`
+      };
+    }
+    throw error;
+  }
+  const stored = readCredentials(path);
+  const superseded = stored !== null && stored.token !== token ? stored : null;
+  try {
+    writeCredentials(path, baseUrl, token);
+  } catch (error) {
+    if (received.minted) await revokeSession(client, token);
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
+    };
+  }
+  let supersededNote = "";
+  if (superseded !== null) {
+    await revokeSession(bareClient(superseded.url, superseded.token, options), superseded.token);
+    if (isExpertToken(superseded.token)) {
+      supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
+    }
+  }
+  const name = invokedName();
+  return {
+    ok: true,
+    json: { url: baseUrl, credentials: path, kind },
+    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
+` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
+`) + kindNote(kind) + supersededNote
+  };
+}
+function kindNote(kind) {
+  if (kind === "operator-cli") {
+    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+  }
+  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
+  return "";
+}
+async function describeSession(client) {
+  try {
+    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
+    return { session: sessionOf(envelope.data), apiVersion };
+  } catch (error) {
+    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
+    throw error;
+  }
+}
+function sessionOf(data) {
+  if (!isRecord(data)) return NO_SESSION;
+  const text = (value) => typeof value === "string" ? value : null;
+  return {
+    kind: text(data["kind"]),
+    expires_at: text(data["expires_at"]),
+    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
+    user: isRecord(data["user"]) ? data["user"] : null,
+    org: isRecord(data["org"]) ? data["org"] : null
+  };
+}
+async function revokeSession(client, token) {
+  if (isExpertToken(token)) return false;
+  return client.delete("/api/v1/session").then(() => true).catch(() => false);
+}
+async function logout(options = {}) {
+  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
+  const stored = readCredentials(path);
+  if (stored === null) {
+    const envToken = (options.env ?? process.env)["HARNESS_API_TOKEN"] ?? "";
+    return {
+      ok: false,
+      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 " + (isExpertToken(envToken.trim()) ? "unset it, or revoke the pxc_ credential in your expert view." : "unset it, or disable the token in the admin UI.")
+    };
+  }
+  const expert = isExpertToken(stored.token);
+  const revoked = await revokeSession(bareClient(stored.url, stored.token, options), stored.token);
+  const note = revoked ? "" : " (server-side revoke failed \u2014 the token still expires on its own)";
+  try {
+    deleteCredentials(path);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      message: `could not remove ${path} (${detail}) \u2014 delete it manually.` + (revoked ? " The token itself was revoked." : "")
+    };
+  }
+  return {
+    ok: true,
+    json: { logged_out: true, revoked },
+    human: expert ? `Forgot the outside expert's pxc_ credential for ${stored.url}. It stays valid until it expires: revoke it in your expert view to end it now.
+` : `Logged out of ${stored.url}${note}.
+`
+  };
+}
+async function whoami(config, credentialSource) {
+  const client = new Client(config);
+  const expert = isExpertToken(config.token);
+  let probe;
+  let session = null;
+  let serverVersion;
+  try {
+    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
+    if (described2 !== null) {
+      session = described2.session;
+      serverVersion = described2.apiVersion;
+    } else {
+      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
+      probe = answered.envelope.data;
+      serverVersion = answered.apiVersion;
+    }
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return {
+        ok: false,
+        message: expert ? `signed in to ${config.baseUrl} with an outside expert's pxc_ credential (${credentialSource}), but it was refused: ${error.message} (HTTP ${error.status})${error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : ""}` : `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
+      };
+    }
+    throw error;
+  }
+  let seat = null;
+  if (expert) {
+    seat = expertSeat(probe);
+    if (seat === null) {
+      return {
+        ok: false,
+        message: `signed in to ${config.baseUrl} with an outside expert's pxc_ credential, but the assignments response carried no expert`
+      };
+    }
+  }
+  serverVersion ??= "unknown";
+  const hostSourceLabels = {
+    env: "HARNESS_API_URL",
+    "repo-config": ".harness-cli/config.json",
+    "stored-login": "stored login",
+    default: "workspace default"
+  };
+  const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
+  const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
+Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
+`;
+  const described = session ?? NO_SESSION;
+  return {
+    ok: true,
+    json: {
+      url: config.baseUrl,
+      source: credentialSource,
+      verified: true,
+      server_version: serverVersion,
+      host_source: config.hostSource,
+      kind: described.kind,
+      expires_at: described.expires_at,
+      scopes: described.scopes,
+      user: described.user,
+      org: described.org,
+      expert: seat
+    },
+    human: `Host:        ${config.baseUrl}${via}
+Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
+` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
+`
+  };
+}
+function kindLabel(kind) {
+  if (kind === null) return "";
+  if (kind === "harness-cli") return ", harness-cli (full access)";
+  if (kind === "operator-cli") return ", operator-cli (Operator only)";
+  return `, ${clean(kind)}`;
+}
+function sessionLines(session) {
+  let lines = "";
+  const user = session.user;
+  if (user !== null) {
+    const name = clean(user["name"]);
+    const email = clean(user["email"]);
+    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
+`;
+  }
+  const org = session.org;
+  if (org !== null) {
+    const name = clean(org["name"]);
+    const slug = clean(org["slug"]);
+    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
+`;
+  }
+  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
+`;
+  if (session.kind === "operator-cli") {
+    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  }
+  return lines;
+}
+function expertSeat(data) {
+  if (!isRecord(data) || !isRecord(data["expert"])) return null;
+  const plan = isRecord(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
+  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord).length : 0;
+  return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan, assigned_steps: steps };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function bareClient(baseUrl, token, options) {
+  const config = {
+    baseUrl: baseUrl.replace(/\/+$/, ""),
+    token,
+    actor: null,
+    team: null,
+    cacheDir: ""
+  };
+  if (options.fetchImpl !== void 0) config.fetchImpl = options.fetchImpl;
+  return new Client(config);
+}
+function defaultNotify(line) {
+  process.stderr.write(named(line + "\n"));
+}
+function defaultPrompt() {
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
+  return new Promise((resolve) => {
+    readline.question("Token: ", (answer) => {
+      readline.close();
+      resolve(answer);
+    });
+  });
+}
+function defaultOpenBrowser(url) {
+  const opener = browserOpener();
+  if (opener !== null) {
+    execFile(opener, [url], () => void 0);
+  }
+}
+
+export {
+  login,
+  browserAvailable,
+  loopbackCode,
+  logout,
+  whoami
+};