@amerged/ohmyhost-mcp 0.1.10

package/src/apps/product-cli/composition.ts

@@ -0,0 +1,823 @@
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import {
+  createClient,
+  getGithubOrganizationConnection,
+  revokeCurrentSession,
+} from "@ohmyhost/sdk-ts";
+import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
+
+import {
+  WorkosDeviceFlowClient,
+  parseDeviceTokens,
+  WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT,
+  type WorkosPublicHttpRequest,
+  type WorkosPublicHttpResponse,
+  type WorkosPublicTransport,
+} from "@ohmyhost/workos-auth-contracts/device-flow";
+
+import {
+  ProductCli,
+  cliMetadataResult,
+  NetworkTransportError,
+  LifecycleTransportError,
+  TokenRefreshRejectedError,
+  PublicResponseTooLargeError,
+  SecretInputError,
+  type CliResult,
+  type DiagnosticSink,
+  type DeviceAuthorizationPresenter,
+  type TokenRefresher,
+  type TokenRevoker,
+} from "./cli.js";
+import {
+  InvalidCommandError,
+  parseProductCliCommand,
+  recognizedCommandLabel,
+  type ProductCliCommand,
+} from "./command.js";
+import {
+  NativeNapiKeyringCredentialStore,
+  type CredentialStore,
+  type CurrentCredential,
+  type StoredCredential,
+} from "./credential-store.js";
+import { GeneratedSdkProductApi, type ProductApi } from "./product-api.js";
+import { workspaceOf, type WorkspaceSession } from "./workspace.js";
+import { OwnerOnlyProjectLinkStore } from "./project-link-store.js";
+import {
+  initializeRepository,
+  RepositoryInitBlockedError,
+  RepositoryInitConflictError,
+  RepositoryInitError,
+} from "./repository-init.js";
+import { runLocalPsql } from "./psql-session.js";
+import { ResponseContractError } from "./runtime-contract.js";
+import { resolveDeviceTokenExpiresAt } from "./device-token-expiry.js";
+
+export type ProductCliEnvironment = Readonly<{
+  OHMYHOST_ENVIRONMENT?: string;
+  OHMYHOST_TOKEN?: string;
+}>;
+
+export interface ProductCliIo {
+  writeStdout(value: string): void;
+  writeStderr(value: string): void;
+}
+
+export interface ProductCliCompositionOverrides {
+  readonly credentialStore?: CredentialStore;
+  readonly readSecretValue?: (signal: AbortSignal) => Promise<string>;
+}
+
+export interface AuthenticatedProductApiOverrides {
+  readonly environment?: ProductCliEnvironment;
+  readonly credentialStore?: CredentialStore;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly now?: () => Date;
+  readonly productApiOrigin?: string;
+  readonly tokenRefresher?: TokenRefresher;
+}
+
+export class ProductApiAuthenticationError extends Error {
+  public constructor(
+    readonly code: "authentication_required" | "token_refresh_failed" | "invalid_environment_token",
+  ) {
+    super(code);
+    this.name = "ProductApiAuthenticationError";
+  }
+}
+
+type OutputCommand = ReturnType<typeof recognizedCommandLabel>;
+
+const REQUEST_TIMEOUT_MS = 30_000;
+const MAX_PUBLIC_RESPONSE_BYTES = 1_048_576;
+const PRODUCT_ENVIRONMENTS = Object.freeze({
+  development: Object.freeze({
+    commandPrefix: "OHMYHOST_ENVIRONMENT=development ohmyhost",
+    apiOrigin: "https://dev.app.ohmyho.st",
+    clientId: "client_01JWHRCGD1FZJK8DNJH75V97SE",
+    verificationUri: "https://orderly-laugh-73-staging.authkit.app/device",
+    credentialService: "ohmyhost",
+    linkDirectory: ".ohmyhost",
+  }),
+  production: Object.freeze({
+    commandPrefix: "OHMYHOST_ENVIRONMENT=production ohmyhost",
+    apiOrigin: "https://app.ohmyho.st",
+    clientId: "client_01JWHRCGK30FQWWH2ZG7E29TAJ",
+    verificationUri: "https://divine-climb-22.authkit.app/device",
+    credentialService: "ohmyhost.production",
+    linkDirectory: ".ohmyhost/production",
+  }),
+});
+
+export function resolveProductCliEnvironment(environment: ProductCliEnvironment = {}) {
+  const name = environment.OHMYHOST_ENVIRONMENT ?? "production";
+  if (name !== "development" && name !== "production") throw new Error("invalid_environment");
+  return PRODUCT_ENVIRONMENTS[name];
+}
+
+function environmentToken(environment: ProductCliEnvironment = {}): string | undefined {
+  const value = environment.OHMYHOST_TOKEN;
+  if (value !== undefined && !WORKOS_USER_API_KEY_PATTERN.test(value))
+    throw new ProductApiAuthenticationError("invalid_environment_token");
+  return value;
+}
+
+export const createProductionAuthenticatedProductApi = async (
+  signal: AbortSignal,
+  overrides: AuthenticatedProductApiOverrides = {},
+): Promise<ProductApi> => {
+  const transport = await createAuthenticatedProductTransport(signal, overrides);
+  return new GeneratedSdkProductApi(transport.baseUrl, transport.accessToken, transport.fetch);
+};
+
+/** Private client composition data, never a public API or MCP response. */
+export const createAuthenticatedProductTransport = async (
+  signal: AbortSignal,
+  overrides: AuthenticatedProductApiOverrides = {},
+) => {
+  const profile = resolveProductCliEnvironment(overrides.environment);
+  const apiToken = environmentToken(overrides.environment);
+  const boundedFetch = createBoundedFetch(
+    overrides.fetch ?? fetch,
+    signal,
+    REQUEST_TIMEOUT_MS,
+    MAX_PUBLIC_RESPONSE_BYTES,
+  );
+  if (apiToken !== undefined)
+    return {
+      baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+      accessToken: apiToken,
+      fetch: boundedFetch,
+      // A user API token carries a fixed scope; there is no session that could select a workspace.
+      workspace: undefined,
+    };
+  const store =
+    overrides.credentialStore ??
+    new NativeNapiKeyringCredentialStore(undefined, profile.credentialService);
+  const stored = await store.read();
+  if (stored === undefined) throw new ProductApiAuthenticationError("authentication_required");
+  const now = overrides.now ?? (() => new Date());
+  const refresher =
+    overrides.tokenRefresher ??
+    new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now);
+  const credential = await currentCredential(stored, store, signal, now, refresher);
+  return {
+    baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+    accessToken: credential.accessToken,
+    fetch: boundedFetch,
+    workspace: { store, refresher } satisfies WorkspaceSession,
+  };
+};
+
+const currentCredential = async (
+  stored: StoredCredential,
+  store: CredentialStore,
+  signal: AbortSignal,
+  now: () => Date,
+  tokenRefresher: TokenRefresher,
+): Promise<CurrentCredential> => {
+  const expiresAt = stored.expiresAt === undefined ? NaN : Date.parse(stored.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt > now().getTime() + REQUEST_TIMEOUT_MS) {
+    return stored as CurrentCredential;
+  }
+  try {
+    const refreshed = await tokenRefresher.refresh(
+      stored.refreshToken,
+      boundedSignal(signal, REQUEST_TIMEOUT_MS),
+      stored.workosOrganizationId,
+    );
+    const refreshedExpiry = Date.parse(refreshed.expiresAt);
+    if (
+      refreshed.accessToken.length === 0 ||
+      refreshed.refreshToken.length === 0 ||
+      !Number.isFinite(refreshedExpiry) ||
+      refreshedExpiry <= now().getTime()
+    ) {
+      throw new Error("invalid refreshed credential");
+    }
+    // WorkOS returns a bare credential; the selection only survives if we carry it forward.
+    // WorkOS returns a bare credential; the selection only survives if we carry it forward.
+    const carried = { ...refreshed, ...workspaceOf(stored) };
+    await store.replace(carried);
+    return carried;
+  } catch (error) {
+    if (error instanceof TokenRefreshRejectedError) {
+      await store.clear();
+      throw new ProductApiAuthenticationError("authentication_required");
+    }
+    throw new ProductApiAuthenticationError("token_refresh_failed");
+  }
+};
+
+export const runProductionCli = async (
+  argv: readonly string[],
+  environment: ProductCliEnvironment,
+  io: ProductCliIo,
+  signal: AbortSignal,
+  overrides: ProductCliCompositionOverrides = {},
+): Promise<number> => {
+  const diagnostics = new StderrDiagnosticSink(io);
+  let command: ProductCliCommand;
+  try {
+    command = parseProductCliCommand(argv);
+  } catch (error) {
+    const result =
+      error instanceof InvalidCommandError
+        ? invalidCommandFailure(recognizedCommandLabel(argv))
+        : errorDocument("unknown", 1, "internal_error", false, "Retry the command.");
+    if (!(error instanceof InvalidCommandError)) {
+      diagnostics.record({
+        correlationId: randomUUID(),
+        category: "internal",
+        subsystem: "parser",
+        errorKind: "unexpected",
+      });
+    }
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+  if (command.kind === "init") {
+    return runOfflineInit(command, io, diagnostics);
+  }
+  if (command.kind === "help" || command.kind === "version") {
+    const result = cliMetadataResult(
+      command.kind,
+      command.kind === "help" ? command.topic : undefined,
+    );
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+  let profile: ReturnType<typeof resolveProductCliEnvironment>;
+  try {
+    profile = resolveProductCliEnvironment(environment);
+  } catch {
+    const result = errorDocument(
+      recognizedCommandLabel(argv),
+      2,
+      "invalid_environment",
+      false,
+      "Set OHMYHOST_ENVIRONMENT to development or production.",
+    );
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+  let apiToken: string | undefined;
+  try {
+    apiToken = environmentToken(environment);
+  } catch {
+    const result = errorDocument(
+      recognizedCommandLabel(argv),
+      2,
+      "invalid_environment_token",
+      false,
+      "Set OHMYHOST_TOKEN to a valid user API key, or unset it to use interactive login.",
+    );
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+  if (apiToken !== undefined && (command.kind === "login" || command.kind === "logout")) {
+    const result = errorDocument(
+      recognizedCommandLabel(argv),
+      2,
+      "environment_token_active",
+      false,
+      "Unset OHMYHOST_TOKEN before changing interactive login credentials. Logout does not revoke a user API key.",
+    );
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+  const selectedOverrides = {
+    ...overrides,
+    credentialStore:
+      overrides.credentialStore ??
+      new NativeNapiKeyringCredentialStore(undefined, profile.credentialService),
+  };
+  if (command.kind === "logout" && !command.revoke) {
+    return runOfflineLogout(io, diagnostics, selectedOverrides);
+  }
+  // Login itself reads the account profile, so every authenticated command needs the origin.
+  const productApiOrigin = profile.apiOrigin;
+  const transport = new FetchWorkosPublicTransport(signal, REQUEST_TIMEOUT_MS);
+  const lifecycle = new GeneratedSdkSessionRevoker({
+    environment,
+    credentialStore: selectedOverrides.credentialStore,
+  });
+  const cli = new ProductCli({
+    ...(apiToken === undefined ? {} : { apiToken }),
+    commandPrefix: profile.commandPrefix,
+    credentialStore: () => selectedOverrides.credentialStore,
+    deviceFlow: new WorkosDeviceFlowClient(
+      {
+        clientId: profile.clientId,
+        scope: "openid offline_access",
+        verificationUri: profile.verificationUri,
+      },
+      transport,
+      { now: () => new Date() },
+    ),
+    deviceAuthorizationPresenter: new StderrDeviceAuthorizationPresenter(io),
+    productApi: (accessToken) =>
+      new GeneratedSdkProductApi(
+        productApiOrigin,
+        accessToken,
+        createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+      ),
+    // Login receives read-only workspace and GitHub queries instead of the product surface.
+    accountProfile: async (accessToken) =>
+      await new GeneratedSdkProductApi(
+        productApiOrigin,
+        accessToken,
+        createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+      ).getAccountProfile(),
+    githubConnectionStatus: (accessToken, organizationId) =>
+      getGithubOrganizationConnection(
+        { organization_id: organizationId },
+        {
+          client: createClient({
+            baseUrl: productApiOrigin,
+            auth: accessToken,
+            throwOnError: true,
+            fetch: createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+          }),
+          signal,
+        },
+      ),
+    projectLinkStore: new OwnerOnlyProjectLinkStore(join(process.cwd(), profile.linkDirectory)),
+    productApiOrigin: profile.apiOrigin,
+    tokenRefresher: new PublicWorkosTokenRefresher(environment),
+    tokenRevoker: lifecycle,
+    now: () => new Date(),
+    waitUntil,
+    lifecycleTimeoutMs: REQUEST_TIMEOUT_MS,
+    createCorrelationId: randomUUID,
+    diagnosticSink: diagnostics,
+    operationEventSink: { write: (value) => io.writeStdout(value) },
+    readSecretValue:
+      overrides.readSecretValue ??
+      ((readSignal) => readSecretValueFromStandardInput(process.stdin, readSignal)),
+    spawnPsql: runLocalPsql,
+  });
+  const result = await cli.runCommand(command, signal);
+  io.writeStdout(result.stdout);
+  if (result.stderr.length > 0) io.writeStderr(result.stderr);
+  return result.exitCode;
+};
+
+const runOfflineInit = async (
+  command: Extract<ProductCliCommand, { kind: "init" }>,
+  io: ProductCliIo,
+  diagnostics: DiagnosticSink,
+): Promise<number> => {
+  try {
+    const result = await initializeRepository({
+      directory: command.directory,
+      ...(command.project === undefined ? {} : { project: command.project }),
+      ...(command.root === undefined ? {} : { root: command.root }),
+      ...(command.region === undefined ? {} : { region: command.region }),
+      dryRun: command.dryRun,
+    });
+    // A write that is blocked exits 9 through RepositoryInitBlockedError; a dry run reports the
+    // same blockers, so it must not read as a clean analysis either.
+    const blocked = result.blockers.length > 0;
+    io.writeStdout(
+      `${JSON.stringify({
+        version: 1,
+        command: "init",
+        status: blocked ? "blocked" : result.status,
+        written: result.written,
+        applicationRoot: result.applicationRoot,
+        applicationRootSource: result.applicationRootSource,
+        configuration: {
+          path: result.configurationPath,
+          sha256: result.configurationSha256,
+          yaml: result.configurationYaml,
+        },
+        inventory: result.inventory,
+        compatibility: result.compatibility,
+        blockers: result.blockers,
+        requirements: result.requirements,
+        companion: result.companion,
+        // The functions runtime reports its own bindings and packages; dropping it left a
+        // storage-enabled functions app with no contract to read at all.
+        worker: result.worker,
+      })}\n`,
+    );
+    return blocked ? 9 : 0;
+  } catch (error) {
+    const known = error instanceof RepositoryInitError;
+    diagnostics.record({
+      correlationId: randomUUID(),
+      category: known ? "configuration" : "internal",
+      subsystem: "runtime",
+      errorKind: known ? "invalid_response" : "unexpected",
+    });
+    const code =
+      error instanceof RepositoryInitBlockedError
+        ? "repository_init_blocked"
+        : error instanceof RepositoryInitConflictError
+          ? "repository_configuration_exists"
+          : known
+            ? error.code
+            : "internal_error";
+    const exitCode = error instanceof RepositoryInitBlockedError ? 9 : known ? 2 : 1;
+    const result = errorDocument(
+      "init",
+      exitCode,
+      code,
+      false,
+      error instanceof RepositoryInitConflictError
+        ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying."
+        : error instanceof RepositoryInitError && error.code === "project_name_invalid"
+          ? "Pass a lowercase deployment slug with '--project', then rerun init."
+          : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.",
+    );
+    io.writeStdout(result.stdout);
+    return result.exitCode;
+  }
+};
+
+class FetchWorkosPublicTransport implements WorkosPublicTransport {
+  public constructor(
+    private readonly parentSignal: AbortSignal,
+    private readonly timeoutMs: number,
+    private readonly fetcher: typeof globalThis.fetch = fetch,
+  ) {}
+
+  public async send(request: WorkosPublicHttpRequest): Promise<WorkosPublicHttpResponse> {
+    let response: Response;
+    try {
+      response = await this.fetcher(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: request.body,
+        redirect: request.redirect,
+        signal: boundedSignal(this.parentSignal, this.timeoutMs),
+      });
+    } catch (error) {
+      if (isAbortOrTimeout(error)) throw error;
+      throw new NetworkTransportError();
+    }
+    let body: string;
+    try {
+      body = await readBoundedResponseBody(response, MAX_PUBLIC_RESPONSE_BYTES);
+    } catch (error) {
+      if (
+        error instanceof PublicResponseTooLargeError ||
+        error instanceof ResponseContractError ||
+        isAbortOrTimeout(error)
+      ) {
+        throw error;
+      }
+      throw new NetworkTransportError();
+    }
+    return { status: response.status, body };
+  }
+}
+
+export class StderrDeviceAuthorizationPresenter implements DeviceAuthorizationPresenter {
+  public constructor(private readonly io: ProductCliIo) {}
+
+  public async present(input: {
+    readonly verificationUri: string;
+    readonly verificationUriComplete?: string;
+    readonly userCode: string;
+    readonly expiresInSeconds: number;
+  }): Promise<void> {
+    // The customer needs to know how long they have, and that running out is not the end of it:
+    // a code that lapses is replaced here while the sign-in window lasts.
+    const validFor = `It is valid for ${String(Math.max(1, Math.round(input.expiresInSeconds / 60)))} minutes; if it lapses, a fresh code appears here.`;
+    this.io.writeStderr(
+      input.verificationUriComplete === undefined
+        ? `Open ${input.verificationUri} and enter code ${input.userCode}. ${validFor}\n`
+        : `Open ${input.verificationUriComplete} to sign in; it already carries code ${input.userCode}. Create your account on that page if you do not have one yet. ${validFor}\n`,
+    );
+  }
+}
+
+export class PublicWorkosTokenRefresher implements TokenRefresher {
+  private readonly clientId: string;
+
+  public constructor(
+    environment: ProductCliEnvironment = {},
+    private readonly fetcher: typeof globalThis.fetch = fetch,
+    private readonly now: () => Date = () => new Date(),
+  ) {
+    this.clientId = resolveProductCliEnvironment(environment).clientId;
+  }
+
+  public async refresh(
+    refreshToken: string,
+    signal: AbortSignal,
+    workosOrganizationId?: string,
+  ): Promise<CurrentCredential> {
+    if (typeof refreshToken !== "string" || !/^[\u0021-\u007e]{1,16384}$/u.test(refreshToken))
+      throw new TokenRefreshRejectedError();
+    try {
+      const response = await new FetchWorkosPublicTransport(
+        signal,
+        REQUEST_TIMEOUT_MS,
+        this.fetcher,
+      ).send({
+        url: WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT,
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          client_id: this.clientId,
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          // The workspace is a property of the token, so every refresh must ask for it again.
+          ...(workosOrganizationId === undefined ? {} : { organization_id: workosOrganizationId }),
+        }).toString(),
+        redirect: "error",
+      });
+      const body: unknown = JSON.parse(response.body);
+      if (response.status < 200 || response.status >= 300) {
+        if (
+          response.status === 400 &&
+          typeof body === "object" &&
+          body !== null &&
+          "error" in body &&
+          body.error === "invalid_grant"
+        )
+          throw new TokenRefreshRejectedError();
+        throw new LifecycleTransportError();
+      }
+      const tokens = parseDeviceTokens(body);
+      if (tokens.tokenType.toLowerCase() !== "bearer") throw new LifecycleTransportError();
+      return {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: resolveDeviceTokenExpiresAt(
+          tokens.accessToken,
+          tokens.expiresInSeconds,
+          this.now(),
+        ),
+      };
+    } catch (error) {
+      if (error instanceof TokenRefreshRejectedError || isAbortOrTimeout(error)) throw error;
+      throw new LifecycleTransportError();
+    }
+  }
+}
+
+export class GeneratedSdkSessionRevoker implements TokenRevoker {
+  constructor(private readonly overrides: AuthenticatedProductApiOverrides = {}) {}
+
+  public async revoke(_refreshToken: string, signal: AbortSignal): Promise<void> {
+    try {
+      const transport = await createAuthenticatedProductTransport(signal, this.overrides);
+      const client = createClient({
+        baseUrl: transport.baseUrl,
+        auth: transport.accessToken,
+        fetch: transport.fetch,
+        throwOnError: true,
+      });
+      const result = await revokeCurrentSession(
+        { "Idempotency-Key": randomUUID() },
+        { client, signal },
+      );
+      if (result.revoked !== true) throw new LifecycleTransportError();
+    } catch (error) {
+      if (signal.aborted) throw error;
+      throw new LifecycleTransportError();
+    }
+  }
+}
+
+class StderrDiagnosticSink implements DiagnosticSink {
+  public constructor(private readonly io: ProductCliIo) {}
+
+  public record(event: Parameters<DiagnosticSink["record"]>[0]): void {
+    this.io.writeStderr(
+      `[ohmyhost:${event.correlationId}] ${event.category}/${event.subsystem}/${event.errorKind}\n`,
+    );
+  }
+}
+
+export const readBoundedResponseBody = async (
+  response: Response,
+  limit: number,
+): Promise<string> => {
+  assertDeclaredLength(response, limit);
+  if (response.body === null) return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let size = 0;
+  let body = "";
+  for (;;) {
+    const chunk = await reader.read();
+    if (chunk.done) break;
+    size += chunk.value.byteLength;
+    if (size > limit) {
+      await reader.cancel().catch(() => undefined);
+      throw new PublicResponseTooLargeError();
+    }
+    body += decodeUtf8(decoder, chunk.value, true);
+  }
+  return body + decodeUtf8(decoder, undefined, false);
+};
+
+export const createBoundedFetch =
+  (
+    baseFetch: typeof globalThis.fetch,
+    parentSignal: AbortSignal,
+    timeoutMs: number,
+    responseLimit: number,
+  ): typeof globalThis.fetch =>
+  async (input, init) => {
+    const requestHeaders =
+      init?.headers === undefined && input instanceof Request
+        ? input.headers
+        : new Headers(init?.headers);
+    const streaming = requestHeaders.get("accept") === "text/event-stream";
+    let response: Response;
+    try {
+      response = await baseFetch(input, {
+        ...init,
+        signal: AbortSignal.any(
+          [
+            parentSignal,
+            init?.signal,
+            ...(streaming ? [] : [AbortSignal.timeout(timeoutMs)]),
+          ].filter(
+            (candidate): candidate is AbortSignal => candidate !== null && candidate !== undefined,
+          ),
+        ),
+      });
+    } catch (error) {
+      if (isAbortOrTimeout(error)) throw error;
+      throw new NetworkTransportError();
+    }
+    return streaming ? response : bufferBoundedResponse(response, responseLimit);
+  };
+
+const bufferBoundedResponse = async (response: Response, limit: number): Promise<Response> => {
+  assertDeclaredLength(response, limit);
+  if (response.body === null) return response;
+  const reader = response.body.getReader();
+  let size = 0;
+  const chunks: Array<Uint8Array> = [];
+  try {
+    for (;;) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      size += chunk.value.byteLength;
+      if (size > limit) {
+        await reader.cancel().catch(() => undefined);
+        throw new PublicResponseTooLargeError();
+      }
+      chunks.push(chunk.value);
+    }
+  } catch (error) {
+    if (error instanceof PublicResponseTooLargeError || isAbortOrTimeout(error)) throw error;
+    throw new NetworkTransportError();
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+};
+
+const assertDeclaredLength = (response: Response, limit: number): void => {
+  const declaredLength = response.headers.get("content-length");
+  if (
+    declaredLength !== null &&
+    (!/^\d+$/u.test(declaredLength) || Number(declaredLength) > limit)
+  ) {
+    throw new PublicResponseTooLargeError();
+  }
+};
+
+const decodeUtf8 = (
+  decoder: TextDecoder,
+  chunk: Uint8Array | undefined,
+  stream: boolean,
+): string => {
+  try {
+    return decoder.decode(chunk, { stream });
+  } catch {
+    throw new ResponseContractError();
+  }
+};
+
+const waitUntil = async (instant: Date, signal: AbortSignal): Promise<void> => {
+  const delay = Math.max(0, instant.getTime() - Date.now());
+  await new Promise<void>((resolve, reject) => {
+    const cleanup = (): void => signal.removeEventListener("abort", cancel);
+    const complete = (): void => {
+      cleanup();
+      resolve();
+    };
+    const cancel = (): void => {
+      clearTimeout(timer);
+      cleanup();
+      reject(signal.reason);
+    };
+    const timer = setTimeout(complete, delay);
+    if (signal.aborted) cancel();
+    else signal.addEventListener("abort", cancel, { once: true });
+  });
+};
+
+const boundedSignal = (parent: AbortSignal, timeoutMs: number): AbortSignal =>
+  AbortSignal.any([parent, AbortSignal.timeout(timeoutMs)]);
+
+const isAbortOrTimeout = (error: unknown): boolean =>
+  error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
+
+const runOfflineLogout = async (
+  io: ProductCliIo,
+  diagnostics: StderrDiagnosticSink,
+  overrides: ProductCliCompositionOverrides,
+): Promise<number> => {
+  let result: CliResult;
+  try {
+    await (overrides.credentialStore ?? new NativeNapiKeyringCredentialStore()).clear();
+    result = resultDocument("logout", 0, "logged_out");
+  } catch {
+    diagnostics.record({
+      correlationId: randomUUID(),
+      category: "credential_store",
+      subsystem: "credential_store",
+      errorKind: "unavailable",
+    });
+    result = errorDocument(
+      "logout",
+      3,
+      "credential_store_unavailable",
+      true,
+      "Unlock or repair the selected credential store and retry.",
+    );
+  }
+  io.writeStdout(result.stdout);
+  return result.exitCode;
+};
+
+export const readSecretValueFromStandardInput = async (
+  input: AsyncIterable<Uint8Array | string>,
+  signal: AbortSignal,
+): Promise<string> => {
+  const chunks: Uint8Array[] = [];
+  let totalBytes = 0;
+  for await (const chunk of input) {
+    if (signal.aborted) throw signal.reason;
+    const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+    totalBytes += bytes.byteLength;
+    if (totalBytes > 5_120) throw new SecretInputError();
+    chunks.push(bytes);
+  }
+  if (signal.aborted) throw signal.reason;
+  if (totalBytes === 0) throw new SecretInputError();
+  const value = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    value.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(value);
+  } catch {
+    throw new SecretInputError();
+  } finally {
+    value.fill(0);
+  }
+};
+
+const invalidCommandFailure = (command: OutputCommand): CliResult =>
+  errorDocument(command, 2, "invalid_command", false, "Check 'ohmyhost --help'.");
+
+const resultDocument = (command: OutputCommand, exitCode: number, status: string): CliResult => ({
+  exitCode,
+  stdout: `${JSON.stringify({ version: 1, command, status })}\n`,
+  stderr: "",
+});
+
+const errorDocument = (
+  command: OutputCommand,
+  exitCode: number,
+  code: string,
+  retryable: boolean,
+  suggestedAction: string,
+): CliResult => ({
+  exitCode,
+  stdout: `${JSON.stringify({
+    version: 1,
+    command,
+    status: "error",
+    error: {
+      code,
+      retryable,
+      suggested_action: suggestedAction,
+    },
+  })}\n`,
+  stderr: "",
+});