@appforge-ci/admin-cli 0.1.1

package/dist/commands/agents.test.js

@@ -0,0 +1,127 @@
+// Must stay the FIRST import — see the comment below the imports.
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { waitForCommandResolution, parseTimeoutSeconds, formatAgentCommandLine } from "./agents.js";
+/**
+ * `parseTimeoutSeconds` guards `agents update`'s `--timeout` option
+ * before it ever reaches `waitForCommandResolution`'s deadline math: a
+ * non-numeric value (`Number("5m")` is `NaN`) would otherwise make the
+ * deadline `NaN`, and `Date.now() >= NaN` is always `false` — an infinite
+ * poll instead of a timeout.
+ */
+test("parseTimeoutSeconds parses a normal integer string", () => {
+    assert.equal(parseTimeoutSeconds("600"), 600);
+});
+test("parseTimeoutSeconds returns null for a non-numeric value instead of NaN", () => {
+    assert.equal(parseTimeoutSeconds("5m"), null);
+    assert.equal(parseTimeoutSeconds("abc"), null);
+});
+test("parseTimeoutSeconds returns null for zero or a negative number", () => {
+    // A non-positive timeout would make waitForCommandResolution's deadline
+    // already-elapsed before the first poll even runs.
+    assert.equal(parseTimeoutSeconds("0"), null);
+    assert.equal(parseTimeoutSeconds("-10"), null);
+});
+test("parseTimeoutSeconds returns null for an empty string", () => {
+    assert.equal(parseTimeoutSeconds(""), null);
+});
+test("parseTimeoutSeconds accepts a decimal number of seconds", () => {
+    assert.equal(parseTimeoutSeconds("0.5"), 0.5);
+});
+/**
+ * `waitForCommandResolution` backs `appforge-admin agents update
+ * [--all]` (the OTA self-update rollout, `UPDATE_AGENT`) — real
+ * deadline/polling/terminal-state logic, not thin ApiClient passthrough
+ * like the rest of this file's command wiring, so it's the one function
+ * here worth a direct test. A fake `ApiClient` exposing just
+ * `listAgentCommands` (cast — the real class has plenty of other methods
+ * this function never calls) drives each scenario; `pollIntervalMs` is
+ * injected as 1ms so "it actually loops a few times" doesn't mean a real
+ * multi-second wait.
+ */
+function fakeApi(pages) {
+    let call = 0;
+    return {
+        async listAgentCommands() {
+            const commands = pages[Math.min(call, pages.length - 1)];
+            call++;
+            return { commands };
+        },
+    };
+}
+function cmd(overrides = {}) {
+    return { id: "cmd-1", agentId: "agent-1", type: "UPDATE_AGENT", status: "pending", createdAt: "2026-01-01T00:00:00.000Z", ...overrides };
+}
+test("resolves immediately when the command is already done on the first poll", async () => {
+    const api = fakeApi([[cmd({ status: "done" })]]);
+    const result = await waitForCommandResolution(api, "agent-1", "cmd-1", 10_000, 1);
+    assert.equal(result?.status, "done");
+});
+test("treats a failed command as terminal too, not just done", async () => {
+    const api = fakeApi([[cmd({ status: "failed", result: "self-update failed: npm install exited 1" })]]);
+    const result = await waitForCommandResolution(api, "agent-1", "cmd-1", 10_000, 1);
+    assert.equal(result?.status, "failed");
+    assert.equal(result?.result, "self-update failed: npm install exited 1");
+});
+test("keeps polling while the command is pending/acked, then returns it once done", async () => {
+    const api = fakeApi([
+        [cmd({ status: "pending" })],
+        [cmd({ status: "acked" })],
+        [cmd({ status: "done" })],
+    ]);
+    const result = await waitForCommandResolution(api, "agent-1", "cmd-1", 10_000, 1);
+    assert.equal(result?.status, "done");
+});
+test("keeps polling when the command hasn't shown up in the page at all yet", async () => {
+    const api = fakeApi([
+        [], // agent hasn't acked the command yet — doesn't appear in its own history page
+        [cmd({ status: "done" })],
+    ]);
+    const result = await waitForCommandResolution(api, "agent-1", "cmd-1", 10_000, 1);
+    assert.equal(result?.status, "done");
+});
+test("returns null once timeoutMs elapses without the command ever resolving", async () => {
+    const api = fakeApi([[cmd({ status: "pending" })]]);
+    const result = await waitForCommandResolution(api, "agent-1", "cmd-1", 5, 1);
+    assert.equal(result, null);
+});
+/**
+ * Regression coverage for this cycle's fix: `agents commands <agentId>`
+ * is the admin-cli's new wrapper around `ApiClient.listAgentCommands`,
+ * which had a fully-implemented, already-tested route/DB layer
+ * (including `issuedByEmail`) but no CLI view at all —
+ * `docs/fleet-management.md` used to tell a reader to fall back to a
+ * raw `curl` for exactly this.
+ */
+test("formatAgentCommandLine shows the issuing admin's email", () => {
+    const line = formatAgentCommandLine(cmd({ type: "DRAIN", status: "done", createdAt: "2026-01-02T00:00:00.000Z", issuedByEmail: "admin@example.com" }));
+    assert.match(line, /DRAIN/);
+    assert.match(line, /done/);
+    assert.match(line, /by:admin@example\.com/);
+});
+test("formatAgentCommandLine reports 'system/auto' for a null issuedByEmail", () => {
+    const line = formatAgentCommandLine(cmd({ issuedByEmail: null }));
+    assert.match(line, /by:system\/auto/);
+});
+test("formatAgentCommandLine appends the result string when present", () => {
+    const line = formatAgentCommandLine(cmd({ status: "failed", result: "self-update failed: npm install exited 1", issuedByEmail: "admin@example.com" }));
+    assert.match(line, /result:self-update failed: npm install exited 1/);
+});
+test("formatAgentCommandLine omits the result segment entirely when there's no result yet", () => {
+    const line = formatAgentCommandLine(cmd({ status: "pending", issuedByEmail: "admin@example.com" }));
+    assert.doesNotMatch(line, /result:/);
+});
+// OTA/self-update Phase 4, second slice (ROADMAP.md) — an auto-issued
+// rollback UPDATE_AGENT must read as visibly different from an ordinary
+// one in this same audit-trail view, not just inferrable from result text.
+test("formatAgentCommandLine tags an auto-rollback UPDATE_AGENT distinctly", () => {
+    const line = formatAgentCommandLine(cmd({ type: "UPDATE_AGENT", isAutoRollback: 1, issuedByEmail: null }));
+    assert.match(line, /\[AUTO-ROLLBACK\]/);
+});
+test("formatAgentCommandLine tags nothing for an ordinary UPDATE_AGENT (isAutoRollback null/0/undefined)", () => {
+    assert.doesNotMatch(formatAgentCommandLine(cmd({ type: "UPDATE_AGENT" })), /AUTO-ROLLBACK/);
+    assert.doesNotMatch(formatAgentCommandLine(cmd({ type: "UPDATE_AGENT", isAutoRollback: 0 })), /AUTO-ROLLBACK/);
+    assert.doesNotMatch(formatAgentCommandLine(cmd({ type: "UPDATE_AGENT", isAutoRollback: null })), /AUTO-ROLLBACK/);
+});
+//# sourceMappingURL=agents.test.js.map

package/dist/commands/agents.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.test.js","sourceRoot":"","sources":["../../src/commands/agents.test.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEpG;;;;;;GAMG;AACH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,SAAS,OAAO,CAAC,KAAuB;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO;QACL,KAAK,CAAC,iBAAiB;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;YAC1D,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;KACsB,CAAC;AAC5B,CAAC;AAED,SAAS,GAAG,CAAC,YAAmC,EAAE;IAChD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,GAAG,SAAS,EAAE,CAAC;AAC3I,CAAC;AAED,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1B,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,EAAE,EAAE,8EAA8E;QAClF,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,IAAI,GAAG,sBAAsB,CACjC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAClH,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,IAAI,GAAG,sBAAsB,CACjC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,0CAA0C,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAClH,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iDAAiD,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,GAAG,EAAE;IAC9G,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5F,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/G,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACpH,CAAC,CAAC,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,38 @@
+import { Command } from "commander";
+import { ApiClient } from "@appforge-ci/core";
+export type DeviceAuthPollOutcome = {
+    status: "approved";
+    token: string;
+    orgId: string;
+    orgName: string;
+} | {
+    status: "denied";
+} | {
+    status: "expired";
+} | {
+    status: "timeout";
+};
+/**
+ * Pure polling loop, split out of `loginWeb` below so it's testable
+ * without a real terminal/browser/`process.exit` — same "extract the
+ * actual logic, leave I/O (and the process-exiting) at the call site"
+ * shape this run's other command extractions (`followBuildLogs`,
+ * `waitForCommandResolution`) already established. `sleepImpl` defaults
+ * to the real `sleep`; every real caller omits it.
+ */
+export declare function pollDeviceAuthLogin(api: ApiClient, params: {
+    deviceCode: string;
+    expiresInSeconds: number;
+    intervalSeconds: number;
+}, sleepImpl?: (ms: number) => Promise<unknown>): Promise<DeviceAuthPollOutcome>;
+/**
+ * Auth still goes through apps/api (login/signup/API tokens live there,
+ * not on apps/admin-api) — this command just also requires --admin-api-url
+ * up front and only ever uses the resulting token against the admin
+ * Worker afterward. The account itself still needs to be on
+ * PLATFORM_ADMIN_EMAILS server-side; logging in here with a regular
+ * customer account works (auth succeeds) but every subsequent `agents`
+ * command will 403, same as calling the admin API any other way.
+ */
+export declare function registerLoginCommand(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAe9C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EACjF,SAAS,GAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAS,GAClD,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAuDpD"}

package/dist/commands/login.js

@@ -0,0 +1,128 @@
+import { execFile } from "node:child_process";
+import { ApiClient } from "@appforge-ci/core";
+import { saveAdminCliConfig } from "../lib/config.js";
+import { prompt, promptHidden } from "../lib/prompt.js";
+import { loginWithTwoFactor } from "../lib/two-factor.js";
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Best-effort — over SSH or with no GUI this just fails silently and the
+ *  user copies the printed URL by hand instead. */
+function tryOpenBrowser(url) {
+    execFile("open", [url], () => { });
+}
+/**
+ * Pure polling loop, split out of `loginWeb` below so it's testable
+ * without a real terminal/browser/`process.exit` — same "extract the
+ * actual logic, leave I/O (and the process-exiting) at the call site"
+ * shape this run's other command extractions (`followBuildLogs`,
+ * `waitForCommandResolution`) already established. `sleepImpl` defaults
+ * to the real `sleep`; every real caller omits it.
+ */
+export async function pollDeviceAuthLogin(api, params, sleepImpl = sleep) {
+    const deadline = Date.now() + params.expiresInSeconds * 1000;
+    for (;;) {
+        if (Date.now() > deadline)
+            return { status: "timeout" };
+        await sleepImpl(params.intervalSeconds * 1000);
+        const result = await api.pollDeviceAuth(params.deviceCode);
+        if (result.status === "denied")
+            return { status: "denied" };
+        if (result.status === "expired")
+            return { status: "expired" };
+        if (result.status !== "approved")
+            continue; // still pending
+        return { status: "approved", token: result.token, orgId: result.orgId, orgName: result.orgName };
+    }
+}
+/**
+ * Browser-based device-authorization flow (#5) — same shape as `gh auth
+ * login --web`: no password ever touches this terminal or its history.
+ * See apps/api/src/routes/auth.ts's /auth/device/* handlers for the
+ * server side of this handshake.
+ */
+async function loginWeb(api, apiUrl, adminApiUrl) {
+    const { deviceCode, userCode, verificationUrl, expiresInSeconds, intervalSeconds } = await api.startDeviceAuth();
+    console.log(`First, confirm this code matches what's shown after you approve: ${userCode}\n`);
+    console.log(`Opening ${verificationUrl} in your browser...`);
+    console.log(`(if it doesn't open, visit that URL yourself and enter the code above)\n`);
+    tryOpenBrowser(verificationUrl);
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode, expiresInSeconds, intervalSeconds });
+    if (outcome.status === "timeout") {
+        console.error("Login timed out waiting for approval — run 'appforge-admin login --web' again.");
+        process.exit(1);
+    }
+    if (outcome.status === "denied") {
+        console.error("Login was denied.");
+        process.exit(1);
+    }
+    if (outcome.status === "expired") {
+        console.error("That code expired before it was approved — run 'appforge-admin login --web' again.");
+        process.exit(1);
+    }
+    // approved — the dashboard's /auth/device/approve already minted the
+    // afk_ API token server-side, so there's no separate createApiToken
+    // call here like the password flow needs.
+    const authed = new ApiClient({ baseUrl: apiUrl, token: outcome.token });
+    const me = await authed.me();
+    if (!me.user.isPlatformAdmin) {
+        console.warn(`Warning: ${me.user.email} isn't on this instance's PLATFORM_ADMIN_EMAILS allowlist — ` +
+            `"agents" commands will 403 until it is.`);
+    }
+    saveAdminCliConfig({ apiUrl, adminApiUrl, token: outcome.token, orgId: outcome.orgId });
+    console.log(`Logged in as ${me.user.email} (org: ${outcome.orgName}).`);
+}
+/**
+ * Auth still goes through apps/api (login/signup/API tokens live there,
+ * not on apps/admin-api) — this command just also requires --admin-api-url
+ * up front and only ever uses the resulting token against the admin
+ * Worker afterward. The account itself still needs to be on
+ * PLATFORM_ADMIN_EMAILS server-side; logging in here with a regular
+ * customer account works (auth succeeds) but every subsequent `agents`
+ * command will 403, same as calling the admin API any other way.
+ */
+export function registerLoginCommand(program) {
+    program
+        .command("login")
+        .description("Log in as a platform admin and store an API token in ~/.appforge-admin/config.json")
+        .requiredOption("--api-url <url>", "Customer-facing control-plane API URL (where auth lives)")
+        .requiredOption("--admin-api-url <url>", "Fleet-management API URL (apps/admin-api)")
+        .option("--email <email>")
+        .option("--web", "Log in via a browser instead of typing your password into this terminal")
+        .option("--totp-code <code>", "6-digit authenticator code, if 2FA is enabled on this account")
+        .option("--recovery-code <code>", "2FA recovery code, if you've lost your authenticator")
+        .action(async (opts) => {
+        const api = new ApiClient({ baseUrl: opts.apiUrl });
+        if (opts.web) {
+            await loginWeb(api, opts.apiUrl, opts.adminApiUrl);
+            return;
+        }
+        if (opts.totpCode && opts.recoveryCode) {
+            console.error("Pass either --totp-code or --recovery-code, not both.");
+            process.exit(1);
+        }
+        const email = opts.email ?? (await prompt("Email: "));
+        const password = await promptHidden("Password: ");
+        const { token, user } = await loginWithTwoFactor((twoFactor) => api.login(email, password, twoFactor), { totpCode: opts.totpCode, recoveryCode: opts.recoveryCode }, async () => {
+            const code = await prompt("Two-factor code (6 digits from your authenticator app), or leave blank to use a recovery code instead: ");
+            if (code.trim() !== "")
+                return { totpCode: code.trim() };
+            return { recoveryCode: (await prompt("Recovery code: ")).trim() };
+        });
+        const authed = new ApiClient({ baseUrl: opts.apiUrl, token });
+        const me = await authed.me();
+        const org = me.orgs[0];
+        if (!org) {
+            console.error("Your account has no orgs yet — sign up in the dashboard first.");
+            process.exit(1);
+        }
+        if (!user.isPlatformAdmin) {
+            console.warn(`Warning: ${user.email} isn't on this instance's PLATFORM_ADMIN_EMAILS allowlist — ` +
+                `"agents" commands will 403 until it is.`);
+        }
+        const { token: apiToken } = await authed.createApiToken(org.id, `admin-cli:${email}`);
+        saveAdminCliConfig({ apiUrl: opts.apiUrl, adminApiUrl: opts.adminApiUrl, token: apiToken, orgId: org.id });
+        console.log(`Logged in as ${user.email} (org: ${org.name}).`);
+    });
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;mDACmD;AACnD,SAAS,cAAc,CAAC,GAAW;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAc,EACd,MAAiF,EACjF,YAA8C,KAAK;IAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC7D,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS,CAAC,gBAAgB;QAC5D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAc,EAAE,MAAc,EAAE,WAAmB;IACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC;IAEjH,OAAO,CAAC,GAAG,CAAC,oEAAoE,QAAQ,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,WAAW,eAAe,qBAAqB,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACxF,cAAc,CAAC,eAAe,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CACV,YAAY,EAAE,CAAC,IAAI,CAAC,KAAK,8DAA8D;YACrF,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,KAAK,UAAU,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,iBAAiB,EAAE,0DAA0D,CAAC;SAC7F,cAAc,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;SACpF,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CAAC,OAAO,EAAE,yEAAyE,CAAC;SAC1F,MAAM,CAAC,oBAAoB,EAAE,+DAA+D,CAAC;SAC7F,MAAM,CAAC,wBAAwB,EAAE,sDAAsD,CAAC;SACxF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAElD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAC9C,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EACpD,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EAC5D,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,yGAAyG,CAC1G,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,CAAC,CACF,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,CAAC,KAAK,8DAA8D;gBAClF,yCAAyC,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,KAAK,EAAE,CAAC,CAAC;QACtF,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAE3G,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/login.test.d.ts

@@ -0,0 +1,2 @@
+import "../test-support/home-sandbox.js";
+//# sourceMappingURL=login.test.d.ts.map

package/dist/commands/login.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.test.d.ts","sourceRoot":"","sources":["../../src/commands/login.test.ts"],"names":[],"mappings":"AACA,OAAO,iCAAiC,CAAC"}

package/dist/commands/login.test.js

@@ -0,0 +1,69 @@
+// Must stay the FIRST import — see the comment below the imports.
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { pollDeviceAuthLogin } from "./login.js";
+function fakeApi(pages) {
+    let call = 0;
+    return {
+        async pollDeviceAuth() {
+            return pages[Math.min(call++, pages.length - 1)];
+        },
+    };
+}
+// A real (if near-zero) macrotask delay, not an instantly-resolving
+// microtask — a mutation that turns a terminal check into an infinite
+// loop needs the event loop's timer phase to actually run so node:test's
+// own per-test `timeout` can fire and fail it cleanly, the same
+// "an unbounded loop needs a real timer tick, not an assumption it'll
+// terminate" lesson `build.test.ts` already learned this run.
+function noopSleep() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}
+test("resolves 'approved' immediately once the very first poll reports it", async () => {
+    const api = fakeApi([{ status: "approved", token: "afk_web_token", orgId: "org_1", orgName: "Acme" }]);
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode: "dc1", expiresInSeconds: 600, intervalSeconds: 5 }, noopSleep);
+    assert.deepEqual(outcome, { status: "approved", token: "afk_web_token", orgId: "org_1", orgName: "Acme" });
+});
+test("keeps polling through 'pending' before eventually resolving 'approved'", { timeout: 5000 }, async () => {
+    const api = fakeApi([
+        { status: "pending" },
+        { status: "pending" },
+        { status: "approved", token: "afk_web_token", orgId: "org_1", orgName: "Acme" },
+    ]);
+    let calls = 0;
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode: "dc1", expiresInSeconds: 600, intervalSeconds: 5 }, () => {
+        calls++;
+        return new Promise((resolve) => setTimeout(resolve, 0));
+    });
+    assert.equal(outcome.status, "approved");
+    assert.equal(calls, 3); // one sleep per poll, including the two pending ones
+});
+test("resolves 'denied' as soon as the server reports it, without waiting for a timeout", { timeout: 5000 }, async () => {
+    const api = fakeApi([{ status: "denied" }]);
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode: "dc1", expiresInSeconds: 600, intervalSeconds: 5 }, noopSleep);
+    assert.deepEqual(outcome, { status: "denied" });
+});
+test("resolves 'expired' as soon as the server reports it", { timeout: 5000 }, async () => {
+    const api = fakeApi([{ status: "expired" }]);
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode: "dc1", expiresInSeconds: 600, intervalSeconds: 5 }, noopSleep);
+    assert.deepEqual(outcome, { status: "expired" });
+});
+test("resolves 'timeout' once the deadline has passed, without ever polling again", { timeout: 5000 }, async () => {
+    let calls = 0;
+    const api = {
+        async pollDeviceAuth() {
+            calls++;
+            return { status: "pending" };
+        },
+    };
+    // A negative expiresInSeconds puts the deadline strictly in the past
+    // regardless of clock granularity, guaranteeing Date.now() > deadline
+    // is already true before the very first sleep/poll — the real
+    // regression this pins is the deadline check happening *before*
+    // polling starts, not just eventually.
+    const outcome = await pollDeviceAuthLogin(api, { deviceCode: "dc1", expiresInSeconds: -1, intervalSeconds: 5 }, noopSleep);
+    assert.deepEqual(outcome, { status: "timeout" });
+    assert.equal(calls, 0);
+});
+//# sourceMappingURL=login.test.js.map

package/dist/commands/login.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.test.js","sourceRoot":"","sources":["../../src/commands/login.test.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiBjD,SAAS,OAAO,CAAC,KAAmB;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO;QACL,KAAK,CAAC,cAAc;YAClB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;QACpD,CAAC;KACsB,CAAC;AAC5B,CAAC;AAED,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,gEAAgE;AAChE,sEAAsE;AACtE,8DAA8D;AAC9D,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5H,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;IAC3G,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,EAAE,MAAM,EAAE,SAAS,EAAE;QACrB,EAAE,MAAM,EAAE,SAAS,EAAE;QACrB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;KAChF,CAAC,CAAC;IACH,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;QACpH,KAAK,EAAE,CAAC;QACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,qDAAqD;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5H,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5H,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;IAChH,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAG;QACV,KAAK,CAAC,cAAc;YAClB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,MAAM,EAAE,SAAS,EAAgB,CAAC;QAC7C,CAAC;KACsB,CAAC;IAC1B,qEAAqE;IACrE,sEAAsE;IACtE,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3H,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { apiErrorMessage } from "@appforge-ci/core";
+import { registerLoginCommand } from "./commands/login.js";
+import { registerAgentsCommands } from "./commands/agents.js";
+/**
+ * appforge-admin — fleet management for the AppForge platform operator.
+ *
+ * A deliberately separate tool from `appforge` (@appforge-ci/cli): that one
+ * is for AppForge's customers (login, apps, builds, billing) and never
+ * shows or touches fleet/agent commands at all, the same way a Codemagic
+ * customer has no equivalent of "manage Codemagic's own build machines."
+ * This one talks to apps/admin-api, a separately deployed Worker regular
+ * customers can't reach — see docs/self-hosting.md's "Fleet management"
+ * section for the full story of why these are two tools, not one with a
+ * role flag.
+ */
+const program = new Command();
+program
+    .name("appforge-admin")
+    .description("AppForge fleet management — enroll/list/drain/reboot Mac minis (platform admins only)")
+    .version("0.1.0");
+registerLoginCommand(program);
+registerAgentsCommands(program);
+program.parseAsync(process.argv).catch((err) => {
+    // Preserves the original "print whatever was thrown" fallback for a
+    // non-Error throw (rare, but not this fix's concern) — only the
+    // Error/ApiError branch changes, to extract ApiError's own
+    // body.error instead of its raw `API error ${status}: {...}` message.
+    // eslint-disable-next-line no-console
+    console.error(err instanceof Error ? apiErrorMessage(err, err.message) : err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,gBAAgB,CAAC;KACtB,WAAW,CAAC,uFAAuF,CAAC;KACpG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D,sEAAsE;IACtE,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/bootstrap.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Appends a PATH block once, idempotently — re-running `agents bootstrap`
+ * (e.g. after installing a toolchain that was missing the first time)
+ * shouldn't pile up duplicate exports on every run.
+ *
+ * Exported for bootstrap.test.ts — every other caller in this file only
+ * ever uses it as an internal helper, but its idempotency and
+ * existing-content-preservation are worth testing directly rather than
+ * only indirectly through bootstrapSafeToolchains(), which can't be
+ * exercised at all in a headless environment (it shells out to a real
+ * `brew`/`sdkmanager`/Homebrew toolchain install).
+ */
+export declare function ensurePathBlock(profilePath: string, lines: string[]): void;
+export declare function bootstrapSafeToolchains(): Promise<void>;
+/**
+ * The system/security-sensitive half of bootstrap.sh — never run unless
+ * explicitly requested via `--full`. Appropriate for a dedicated always-on
+ * Mac mini; not something to do to a machine you use day to day.
+ */
+export declare function bootstrapPrivileged(): void;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/lib/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":"AAyDA;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAS1E;AA2DD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0E7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAiC1C"}