@arizeai/phoenix-cli 1.9.0 → 1.10.0

package/build/index.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 // Phoenix CLI Entry Point
 import { main } from "./cli.js";
+import { getExitCodeForError } from "./exitCodes.js";
 import { writeError } from "./io.js";
 // Run CLI when executed directly
 void main().catch((error) => {
     writeError({
         message: `Error: ${error instanceof Error ? error.message : String(error)}`,
     });
-    process.exit(1);
+    process.exit(getExitCodeForError(error));
 });
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,0BAA0B;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,iCAAiC;AACjC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1B,UAAU,CAAC;QACT,OAAO,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;KAC5E,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,0BAA0B;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,iCAAiC;AACjC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1B,UAAU,CAAC;QACT,OAAO,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;KAC5E,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

package/build/oauth.d.ts

@@ -0,0 +1,138 @@
+import { z } from "zod";
+import { type OAuthTokens, type SettingsFile } from "./settings.js";
+export declare const OAUTH_CLIENT_ID = "phoenix-cli";
+export declare const OAUTH_CALLBACK_PATH = "/callback";
+/**
+ * Bounds every token-endpoint round trip. Without it a proxy that accepts the
+ * socket but never answers strands the CLI for undici's 300s default, long
+ * past the point where the user has already consented in the browser. Generous
+ * because the code is single-use: aborting a slow-but-live exchange costs the
+ * user the whole browser consent, so this must clear a cold-starting server.
+ */
+export declare const OAUTH_TOKEN_REQUEST_TIMEOUT_MS: number;
+/** Best-effort and blocking a wizard, so it gives up sooner than a token call. */
+export declare const OAUTH_REVOKE_TIMEOUT_MS: number;
+export declare const OAUTH_REFRESH_BUFFER_MS: number;
+export declare const OAuthTokenEndpointResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodString;
+    expires_in: z.ZodNumber;
+    token_type: z.ZodString;
+    scope: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+export type OAuthTokenEndpointResponse = z.infer<typeof OAuthTokenEndpointResponseSchema>;
+/**
+ * The RFC 8414 discovery fields the login flow depends on. Only a document
+ * that parses proves an authorization server is really there: a Phoenix
+ * without one answers unknown paths with the SPA's index.html and a 200.
+ */
+export declare const OAuthAuthorizationServerMetadataSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+}, z.core.$strip>;
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+}
+export interface CallbackSuccess {
+    status: "success";
+    code: string;
+}
+export interface CallbackDenied {
+    status: "access_denied";
+}
+export interface CallbackInvalid {
+    status: "invalid";
+    message: string;
+}
+export type CallbackParseResult = CallbackSuccess | CallbackDenied | CallbackInvalid;
+export declare function base64Url(bytes: Buffer): string;
+export declare function generatePkcePair(): PkcePair;
+export declare function generateState(): string;
+export declare function parseOAuthCallbackUrl({ redirectUrl, expectedState, }: {
+    redirectUrl: string;
+    expectedState: string;
+}): CallbackParseResult;
+export declare function buildAuthorizationUrl({ endpoint, redirectUri, state, codeChallenge, }: {
+    endpoint: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function normalizeEndpoint(endpoint: string): string;
+export declare function tokenResponseToOAuthTokens({ response, now, }: {
+    response: OAuthTokenEndpointResponse;
+    now?: Date;
+}): OAuthTokens;
+export declare function isOAuthTokenExpiring({ tokens, now, bufferMs, }: {
+    tokens: OAuthTokens;
+    now?: Date;
+    bufferMs?: number;
+}): boolean;
+export declare function exchangeAuthorizationCode({ endpoint, code, redirectUri, verifier, fetchImpl, }: {
+    endpoint: string;
+    code: string;
+    redirectUri: string;
+    verifier: string;
+    fetchImpl?: typeof fetch;
+}): Promise<OAuthTokenEndpointResponse>;
+export interface BrowserLoginFlowArgs {
+    endpoint: string;
+    /**
+     * Called with the authorization URL before the browser opens, so the user
+     * can complete the login by hand when the launch fails or goes unnoticed.
+     */
+    onAuthorizationUrl: (url: string) => void;
+    /** False keeps the browser shut, leaving the pasted-URL lane (if allowed). */
+    openBrowserWindow?: boolean;
+    /** Narrates a failed launch; the pasted-redirect prompt is the fallback. */
+    onBrowserOpenFailed?: (error: unknown) => void;
+    /**
+     * Accept a hand-pasted redirect URL when no browser was opened — the only
+     * way to finish a login over SSH or in a container.
+     */
+    allowPastedRedirect?: boolean;
+    /** Abandon the wait — the caller's escape hatch from an unanswered login. */
+    signal?: AbortSignal;
+}
+export type BrowserLoginFlowResult = {
+    status: "success";
+    tokens: OAuthTokenEndpointResponse;
+}
+/** The user declined consent, or abandoned the wait via `signal`. */
+ | {
+    status: "cancelled";
+} | {
+    status: "invalid";
+    message: string;
+};
+/**
+ * The Authorization Code + PKCE browser login, end to end: callback server,
+ * browser launch, the wait, and the token exchange. Both `px auth login` (which
+ * persists the tokens) and `px setup` (which spends the access token once to
+ * mint an API key) drive it — the differences between them are the arguments
+ * above, not a second copy of the sequence.
+ */
+export declare function runBrowserLoginFlow({ endpoint, onAuthorizationUrl, openBrowserWindow, onBrowserOpenFailed, allowPastedRedirect, signal, }: BrowserLoginFlowArgs): Promise<BrowserLoginFlowResult>;
+export declare function refreshOAuthToken({ endpoint, refreshToken, fetchImpl, }: {
+    endpoint: string;
+    refreshToken: string;
+    fetchImpl?: typeof fetch;
+}): Promise<OAuthTokenEndpointResponse>;
+export declare function revokeOAuthToken({ endpoint, refreshToken, fetchImpl, }: {
+    endpoint: string;
+    refreshToken: string;
+    fetchImpl?: typeof fetch;
+}): Promise<void>;
+export declare function refreshOAuthTokensForProfile({ endpoint, profileName, currentTokens, force, settingsPath, fetchImpl, }: {
+    endpoint: string;
+    profileName: string;
+    currentTokens: OAuthTokens;
+    force?: boolean;
+    settingsPath?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<OAuthTokens>;
+export declare function resolveTargetProfileName(settings: SettingsFile, explicit?: string): string;
+export declare function withSettingsLock<T>(settingsPath: string, action: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=oauth.d.ts.map

package/build/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EAMlB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,QAAY,CAAC;AACjD,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAIjD,eAAO,MAAM,gCAAgC;;;;;;iBAM3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC;;;;iBAIjD,CAAC;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,cAAc,GACd,eAAe,CAAC;AAQpB,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAI3C;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,qBAAqB,CAAC,EACpC,WAAW,EACX,aAAa,GACd,EAAE;IACD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,mBAAmB,CAmCtB;AAED,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACR,WAAW,EACX,KAAK,EACL,aAAa,GACd,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAYT;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,0BAA0B,CAAC,EACzC,QAAQ,EACR,GAAgB,GACjB,EAAE;IACD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,WAAW,CASd;AAED,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,GAAgB,EAChB,QAAkC,GACnC,EAAE;IACD,MAAM,EAAE,WAAW,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAEV;AA4ID,wBAAsB,yBAAyB,CAAC,EAC9C,QAAQ,EACR,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,SAAiB,GAClB,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAStC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE;AAC3D,qEAAqE;GACnE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,kBAAkB,EAClB,iBAAwB,EACxB,mBAAmB,EACnB,mBAA2B,EAC3B,MAAM,GACP,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2ExD;AAaD,wBAAsB,iBAAiB,CAAC,EACtC,QAAQ,EACR,YAAY,EACZ,SAAiB,GAClB,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAOtC;AAqDD,wBAAsB,gBAAgB,CAAC,EACrC,QAAQ,EACR,YAAY,EACZ,SAAiB,GAClB,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,wBAAsB,4BAA4B,CAAC,EACjD,QAAQ,EACR,WAAW,EACX,aAAa,EACb,KAAa,EACb,YAAgC,EAChC,SAAiB,GAClB,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,WAAW,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BvB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,YAAY,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAKR;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,CAAC,CAAC,CA+CZ"}

package/build/oauth.js

@@ -0,0 +1,465 @@
+import { spawn } from "child_process";
+import { createHash, randomBytes } from "crypto";
+import * as fs from "fs";
+import * as http from "http";
+import * as path from "path";
+import * as readline from "readline";
+import { z } from "zod";
+import { AuthRequiredError, NetworkError } from "./exitCodes.js";
+import { renderOAuthCallbackPage } from "./oauthCallbackPage.js";
+import { getProfileByName, getSettingsPath, getStoredActiveProfile, loadSettings, saveSettings, } from "./settings.js";
+export const OAUTH_CLIENT_ID = "phoenix-cli";
+export const OAUTH_CALLBACK_PATH = "/callback";
+const OAUTH_LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * Bounds every token-endpoint round trip. Without it a proxy that accepts the
+ * socket but never answers strands the CLI for undici's 300s default, long
+ * past the point where the user has already consented in the browser. Generous
+ * because the code is single-use: aborting a slow-but-live exchange costs the
+ * user the whole browser consent, so this must clear a cold-starting server.
+ */
+export const OAUTH_TOKEN_REQUEST_TIMEOUT_MS = 30 * 1000;
+/** Best-effort and blocking a wizard, so it gives up sooner than a token call. */
+export const OAUTH_REVOKE_TIMEOUT_MS = 10 * 1000;
+export const OAUTH_REFRESH_BUFFER_MS = 60 * 1000;
+const SETTINGS_LOCK_TIMEOUT_MS = 10 * 1000;
+const SETTINGS_LOCK_RETRY_MS = 50;
+export const OAuthTokenEndpointResponseSchema = z.object({
+    access_token: z.string().min(1),
+    refresh_token: z.string().min(1),
+    expires_in: z.number().int().positive(),
+    token_type: z.string().regex(/^bearer$/i),
+    scope: z.string().optional().default(""),
+});
+/**
+ * The RFC 8414 discovery fields the login flow depends on. Only a document
+ * that parses proves an authorization server is really there: a Phoenix
+ * without one answers unknown paths with the SPA's index.html and a 200.
+ */
+export const OAuthAuthorizationServerMetadataSchema = z.object({
+    issuer: z.string().min(1),
+    authorization_endpoint: z.string().min(1),
+    token_endpoint: z.string().min(1),
+});
+export function base64Url(bytes) {
+    return bytes.toString("base64url");
+}
+export function generatePkcePair() {
+    const verifier = base64Url(randomBytes(64));
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function generateState() {
+    return base64Url(randomBytes(32));
+}
+export function parseOAuthCallbackUrl({ redirectUrl, expectedState, }) {
+    let url;
+    try {
+        url = new URL(redirectUrl);
+    }
+    catch {
+        return { status: "invalid", message: "Invalid redirect URL." };
+    }
+    const state = url.searchParams.get("state");
+    if (state !== expectedState) {
+        return {
+            status: "invalid",
+            message: "OAuth state mismatch; possible CSRF.",
+        };
+    }
+    const error = url.searchParams.get("error");
+    if (error === "access_denied") {
+        return { status: "access_denied" };
+    }
+    if (error) {
+        return {
+            status: "invalid",
+            message: `OAuth authorization failed: ${error}`,
+        };
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+        return {
+            status: "invalid",
+            message: "OAuth callback did not include a code.",
+        };
+    }
+    return { status: "success", code };
+}
+export function buildAuthorizationUrl({ endpoint, redirectUri, state, codeChallenge, }) {
+    const authorizationUrl = new URL("oauth2/authorize", normalizeEndpoint(endpoint));
+    authorizationUrl.searchParams.set("response_type", "code");
+    authorizationUrl.searchParams.set("client_id", OAUTH_CLIENT_ID);
+    authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizationUrl.searchParams.set("state", state);
+    authorizationUrl.searchParams.set("code_challenge", codeChallenge);
+    authorizationUrl.searchParams.set("code_challenge_method", "S256");
+    return authorizationUrl.toString();
+}
+export function normalizeEndpoint(endpoint) {
+    return endpoint.endsWith("/") ? endpoint : `${endpoint}/`;
+}
+export function tokenResponseToOAuthTokens({ response, now = new Date(), }) {
+    return {
+        accessToken: response.access_token,
+        refreshToken: response.refresh_token,
+        expiresAt: new Date(now.getTime() + response.expires_in * 1000).toISOString(),
+        scope: response.scope,
+    };
+}
+export function isOAuthTokenExpiring({ tokens, now = new Date(), bufferMs = OAUTH_REFRESH_BUFFER_MS, }) {
+    return Date.parse(tokens.expiresAt) - now.getTime() <= bufferMs;
+}
+async function startLoginCallbackServer({ expectedState, }) {
+    let resolveResult;
+    const resultPromise = new Promise((resolve) => {
+        resolveResult = resolve;
+    });
+    const server = http.createServer((request, response) => {
+        // Parse against a fixed loopback base: the Host header is untrusted input,
+        // and a malformed value would make the URL constructor throw inside the
+        // request handler, crashing the CLI mid-login.
+        let requestUrl;
+        try {
+            requestUrl = new URL(request.url ?? "/", "http://127.0.0.1");
+        }
+        catch {
+            response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+            response.end("Bad request");
+            return;
+        }
+        if (requestUrl.pathname !== OAUTH_CALLBACK_PATH) {
+            response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+            response.end("Not found");
+            return;
+        }
+        const result = parseOAuthCallbackUrl({
+            redirectUrl: requestUrl.toString(),
+            expectedState,
+        });
+        resolveResult(result);
+        response.writeHead(result.status === "invalid" ? 400 : 200, {
+            "Content-Type": "text/html; charset=utf-8",
+        });
+        response.end(renderOAuthCallbackPage(result));
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+        await closeServer(server);
+        throw new Error("Could not bind OAuth callback server.");
+    }
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}${OAUTH_CALLBACK_PATH}`,
+        resultPromise,
+        close: () => closeServer(server),
+    };
+}
+function waitForPastedRedirectUrl({ expectedState, input = process.stdin, output = process.stderr, }) {
+    output.write("Paste the full redirect URL and press Enter: ");
+    const reader = readline.createInterface({ input, output });
+    const resultPromise = new Promise((resolve) => {
+        reader.once("line", (line) => {
+            reader.close();
+            resolve(parseOAuthCallbackUrl({
+                redirectUrl: line.trim(),
+                expectedState,
+            }));
+        });
+    });
+    return { resultPromise, close: () => reader.close() };
+}
+function withTimeout({ promise, timeoutMs, }) {
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            reject(new NetworkError("OAuth login timed out."));
+        }, timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timeout);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timeout);
+            reject(error);
+        });
+    });
+}
+async function openBrowser(url) {
+    const platform = process.platform;
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.once("error", reject);
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}
+export async function exchangeAuthorizationCode({ endpoint, code, redirectUri, verifier, fetchImpl = fetch, }) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: OAUTH_CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier,
+    });
+    return postTokenRequest({ endpoint, body, fetchImpl });
+}
+/**
+ * The Authorization Code + PKCE browser login, end to end: callback server,
+ * browser launch, the wait, and the token exchange. Both `px auth login` (which
+ * persists the tokens) and `px setup` (which spends the access token once to
+ * mint an API key) drive it — the differences between them are the arguments
+ * above, not a second copy of the sequence.
+ */
+export async function runBrowserLoginFlow({ endpoint, onAuthorizationUrl, openBrowserWindow = true, onBrowserOpenFailed, allowPastedRedirect = false, signal, }) {
+    // Bail before binding a port or launching a browser for a login the caller
+    // has already given up on.
+    if (signal?.aborted) {
+        return { status: "cancelled" };
+    }
+    const pkce = generatePkcePair();
+    const state = generateState();
+    const callbackServer = await startLoginCallbackServer({
+        expectedState: state,
+    });
+    let pastedRedirectPrompt;
+    try {
+        const authorizationUrl = buildAuthorizationUrl({
+            endpoint,
+            redirectUri: callbackServer.redirectUri,
+            state,
+            codeChallenge: pkce.challenge,
+        });
+        onAuthorizationUrl(authorizationUrl);
+        let browserOpened = false;
+        if (openBrowserWindow) {
+            try {
+                await openBrowser(authorizationUrl);
+                browserOpened = true;
+            }
+            catch (error) {
+                onBrowserOpenFailed?.(error);
+            }
+        }
+        // Only when no browser opened: otherwise the prompt would hold stdin for a
+        // login the browser is about to complete on its own.
+        pastedRedirectPrompt =
+            allowPastedRedirect && !browserOpened
+                ? waitForPastedRedirectUrl({ expectedState: state })
+                : undefined;
+        const races = [
+            callbackServer.resultPromise,
+        ];
+        if (pastedRedirectPrompt !== undefined) {
+            races.push(pastedRedirectPrompt.resultPromise);
+        }
+        if (signal !== undefined) {
+            races.push(abortedPromise(signal));
+        }
+        const callbackResult = await withTimeout({
+            promise: Promise.race(races),
+            timeoutMs: OAUTH_LOGIN_TIMEOUT_MS,
+        });
+        if (callbackResult === "aborted" ||
+            callbackResult.status === "access_denied") {
+            return { status: "cancelled" };
+        }
+        if (callbackResult.status === "invalid") {
+            return { status: "invalid", message: callbackResult.message };
+        }
+        const tokens = await exchangeAuthorizationCode({
+            endpoint,
+            code: callbackResult.code,
+            redirectUri: callbackServer.redirectUri,
+            verifier: pkce.verifier,
+        });
+        return { status: "success", tokens };
+    }
+    finally {
+        // Release stdin when the loopback callback won the race — an open readline
+        // interface would keep the process alive after success.
+        pastedRedirectPrompt?.close();
+        await callbackServer.close();
+    }
+}
+/** Resolves — never rejects — so it can lose a `Promise.race` harmlessly. */
+function abortedPromise(signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve("aborted");
+            return;
+        }
+        signal.addEventListener("abort", () => resolve("aborted"), { once: true });
+    });
+}
+export async function refreshOAuthToken({ endpoint, refreshToken, fetchImpl = fetch, }) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: OAUTH_CLIENT_ID,
+        refresh_token: refreshToken,
+    });
+    return postTokenRequest({ endpoint, body, fetchImpl });
+}
+async function postTokenRequest({ endpoint, body, fetchImpl, }) {
+    let response;
+    try {
+        response = await fetchImpl(new URL("oauth2/token", normalizeEndpoint(endpoint)), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body,
+            signal: AbortSignal.timeout(OAUTH_TOKEN_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        // A bare AbortError/DOMException is neither actionable nor mapped to an
+        // exit code by the callers, which recognize NetworkError.
+        if (error instanceof Error && error.name === "TimeoutError") {
+            throw new NetworkError(`The OAuth token endpoint at ${endpoint} did not respond within ${OAUTH_TOKEN_REQUEST_TIMEOUT_MS / 1000}s.`);
+        }
+        throw error;
+    }
+    if (response.status === 404) {
+        throw new AuthRequiredError("This Phoenix server does not support OAuth login; use an API key.");
+    }
+    if (!response.ok) {
+        const text = await response.text();
+        throw new AuthRequiredError(text || `OAuth token exchange failed with HTTP ${response.status}.`);
+    }
+    const json = await response.json();
+    return OAuthTokenEndpointResponseSchema.parse(json);
+}
+export async function revokeOAuthToken({ endpoint, refreshToken, fetchImpl = fetch, }) {
+    const body = new URLSearchParams({
+        token: refreshToken,
+        token_type_hint: "refresh_token",
+    });
+    await fetchImpl(new URL("oauth2/revoke", normalizeEndpoint(endpoint)), {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+        signal: AbortSignal.timeout(OAUTH_REVOKE_TIMEOUT_MS),
+    });
+}
+export async function refreshOAuthTokensForProfile({ endpoint, profileName, currentTokens, force = false, settingsPath = getSettingsPath(), fetchImpl = fetch, }) {
+    return withSettingsLock(settingsPath, async () => {
+        const settings = loadSettings({ strict: true, settingsPath });
+        const profile = getProfileByName(settings, profileName);
+        const latestTokens = profile?.entry.oauthTokens ?? currentTokens;
+        if (!force && !isOAuthTokenExpiring({ tokens: latestTokens })) {
+            return latestTokens;
+        }
+        const response = await refreshOAuthToken({
+            endpoint,
+            refreshToken: latestTokens.refreshToken,
+            fetchImpl,
+        });
+        const rotatedTokens = tokenResponseToOAuthTokens({ response });
+        if (!profile) {
+            return rotatedTokens;
+        }
+        const updatedSettings = {
+            ...settings,
+            profiles: {
+                ...settings.profiles,
+                [profileName]: {
+                    ...profile.entry,
+                    oauthTokens: rotatedTokens,
+                },
+            },
+        };
+        saveSettings(updatedSettings, { settingsPath });
+        return rotatedTokens;
+    });
+}
+export function resolveTargetProfileName(settings, explicit) {
+    if (explicit !== undefined) {
+        return explicit;
+    }
+    return getStoredActiveProfile(settings)?.name ?? "default";
+}
+export async function withSettingsLock(settingsPath, action) {
+    const lockPath = `${settingsPath}.lock`;
+    const startedAt = Date.now();
+    let descriptor;
+    while (descriptor === undefined) {
+        try {
+            fs.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+            descriptor = fs.openSync(lockPath, "wx", 0o600);
+        }
+        catch (error) {
+            if (typeof error !== "object" ||
+                error === null ||
+                error.code !== "EEXIST") {
+                throw error;
+            }
+            // A lock left behind by a killed process would otherwise block every
+            // future settings write; steal it once it is older than the timeout.
+            if (isLockStale(lockPath)) {
+                try {
+                    fs.unlinkSync(lockPath);
+                }
+                catch {
+                    // Another process stole it first; retry the open.
+                }
+                continue;
+            }
+            if (Date.now() - startedAt >= SETTINGS_LOCK_TIMEOUT_MS) {
+                throw new Error(`Timed out waiting for the settings lock at ${lockPath}. ` +
+                    "If no other px process is running, delete the file and retry.");
+            }
+            await sleep(SETTINGS_LOCK_RETRY_MS);
+        }
+    }
+    try {
+        return await action();
+    }
+    finally {
+        fs.closeSync(descriptor);
+        try {
+            fs.unlinkSync(lockPath);
+        }
+        catch {
+            // Another process may have cleaned up the lock after the refresh was persisted.
+        }
+    }
+}
+function isLockStale(lockPath) {
+    try {
+        return (Date.now() - fs.statSync(lockPath).mtimeMs > SETTINGS_LOCK_TIMEOUT_MS);
+    }
+    catch {
+        // The lock disappeared; the next open attempt will settle it.
+        return false;
+    }
+}
+function sleep(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}
+//# sourceMappingURL=oauth.js.map

package/build/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC,CAAC;AAMH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAgCH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EACpC,WAAW,EACX,aAAa,GAId;IACC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,+BAA+B,KAAK,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EACR,WAAW,EACX,KAAK,EACL,aAAa,GAMd;IACC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,kBAAkB,EAClB,iBAAiB,CAAC,QAAQ,CAAC,CAC5B,CAAC;IACF,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAChE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC/D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACnE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,EACzC,QAAQ,EACR,GAAG,GAAG,IAAI,IAAI,EAAE,GAIjB;IACC,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;QACpC,SAAS,EAAE,IAAI,IAAI,CACjB,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAC3C,CAAC,WAAW,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,QAAQ,GAAG,uBAAuB,GAKnC;IACC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,EACtC,aAAa,GAGd;IACC,IAAI,aAAqD,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;QACjE,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,2EAA2E;QAC3E,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACzE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACzE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE;YAClC,aAAa;SACd,CAAC,CAAC;QACH,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YAC1D,cAAc,EAAE,0BAA0B;SAC3C,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,GAAG,mBAAmB,EAAE;QACrE,aAAa;QACb,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;KACjC,CAAC;AACJ,CAAC;AAYD,SAAS,wBAAwB,CAAC,EAChC,aAAa,EACb,KAAK,GAAG,OAAO,CAAC,KAAK,EACrB,MAAM,GAAG,OAAO,CAAC,MAAM,GAKxB;IACC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;QACjE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CACL,qBAAqB,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,aAAa;aACd,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAI,EACtB,OAAO,EACP,SAAS,GAIV;IACC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACrD,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GACX,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,QAAQ,EACR,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,SAAS,GAAG,KAAK,GAOlB;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,eAAe;QAC1B,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AACzD,CAAC;AA4BD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,GAAG,IAAI,EACxB,mBAAmB,EACnB,mBAAmB,GAAG,KAAK,EAC3B,MAAM,GACe;IACrB,2EAA2E;IAC3E,2BAA2B;IAC3B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC;QACpD,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,oBAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;YAC7C,QAAQ;YACR,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC,CAAC;QACH,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAErC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBACpC,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,qDAAqD;QACrD,oBAAoB;YAClB,mBAAmB,IAAI,CAAC,aAAa;gBACnC,CAAC,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,KAAK,GAA+C;YACxD,cAAc,CAAC,aAAa;SAC7B,CAAC;QACF,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5B,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;QAEH,IACE,cAAc,KAAK,SAAS;YAC5B,cAAc,CAAC,MAAM,KAAK,eAAe,EACzC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,QAAQ;YACR,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,wDAAwD;QACxD,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,MAAmB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,SAAS,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,QAAQ,EACR,YAAY,EACZ,SAAS,GAAG,KAAK,GAKlB;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAC9B,QAAQ,EACR,IAAI,EACJ,SAAS,GAKV;IACC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CACxB,IAAI,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EACpD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC;SAC5D,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,+BAA+B,QAAQ,2BACrC,8BAA8B,GAAG,IACnC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,IAAI,IAAI,yCAAyC,QAAQ,CAAC,MAAM,GAAG,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,gCAAgC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,QAAQ,EACR,YAAY,EACZ,SAAS,GAAG,KAAK,GAKlB;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,KAAK,EAAE,YAAY;QACnB,eAAe,EAAE,eAAe;KACjC,CAAC,CAAC;IACH,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE;QACrE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI;QACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,QAAQ,EACR,WAAW,EACX,aAAa,EACb,KAAK,GAAG,KAAK,EACb,YAAY,GAAG,eAAe,EAAE,EAChC,SAAS,GAAG,KAAK,GAQlB;IACC,OAAO,gBAAgB,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,IAAI,aAAa,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC9D,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACvC,QAAQ;YACR,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,SAAS;SACV,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,eAAe,GAAiB;YACpC,GAAG,QAAQ;YACX,QAAQ,EAAE;gBACR,GAAG,QAAQ,CAAC,QAAQ;gBACpB,CAAC,WAAW,CAAC,EAAE;oBACb,GAAG,OAAO,CAAC,KAAK;oBAChB,WAAW,EAAE,aAAa;iBAC3B;aACF;SACF,CAAC;QACF,YAAY,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAsB,EACtB,QAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,MAAwB;IAExB,MAAM,QAAQ,GAAG,GAAG,YAAY,OAAO,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,UAA8B,CAAC;IAEnC,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,KAAK,IAAI;gBACb,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAClD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,wBAAwB,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,IAAI;oBACxD,+DAA+D,CAClE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,CACL,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,wBAAwB,CACtE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/oauthCallbackPage.d.ts

@@ -0,0 +1,9 @@
+import type { CallbackParseResult } from "./oauth.js";
+/**
+ * Render the standalone HTML page shown in the browser after the OAuth2
+ * authorization redirect lands on the CLI's loopback callback server. The
+ * page is fully self-contained (inline styles and SVG) because the loopback
+ * server serves nothing else.
+ */
+export declare function renderOAuthCallbackPage(result: CallbackParseResult): string;
+//# sourceMappingURL=oauthCallbackPage.d.ts.map

package/build/oauthCallbackPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCallbackPage.d.ts","sourceRoot":"","sources":["../src/oauthCallbackPage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAwDnD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CA+D3E"}