@artblocks/abx-cli 0.1.0-alpha.6 → 0.1.0-alpha.61

package/dist/bin.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * abx — the published binary's entry point, and nothing else.
+ *
+ * This file exists for one reason: **ESM links the entire static import graph before any module
+ * body runs.** `main.ts` reaches `@artblocks/abx-indexer` → `node:sqlite` through `output.ts` and
+ * `config.ts`, so on a Node that cannot load `node:sqlite` the process dies during *linking* —
+ * before a single line of our code executes. A guard at the top of `main.ts` could never fire. The
+ * only place a check can run first is a module that imports nothing statically and reaches the rest
+ * of the CLI through a dynamic `import()`.
+ *
+ * What that bought before this file existed: `npm i -g @artblocks/abx-cli && abx doctor` on Node
+ * 22.5 printed a raw `ERR_UNKNOWN_BUILTIN_MODULE: No such built-in module: node:sqlite` stack trace.
+ * No mention of abx, Node versions, or what to do — on the first command we tell every user to run.
+ *
+ * We probe the *capability*, not the version number. `node:sqlite` shipped in v22.5.0 behind
+ * `--experimental-sqlite` and lost the flag in v22.13.0 / v23.4.0, so an old Node run with
+ * `NODE_OPTIONS=--experimental-sqlite` genuinely works — refusing it on a version comparison would
+ * be a false negative on a setup the reporter proved out. `engines` states what we *support*; this
+ * guard blocks only what is actually broken.
+ *
+ * KEEP THIS FILE IMPORT-FREE. A single static `import` of anything in the CLI reintroduces the
+ * crash it exists to prevent.
+ */
+/** Unflagged `node:sqlite`: v22.13.0 on the 22.x line, v23.4.0 on 23.x (nodejs/node#55890). */
+const NODE_FLOOR = '22.13.0';
+const color = !process.env.NO_COLOR && process.stderr.isTTY;
+const red = (s) => (color ? `\x1b[31m${s}\x1b[0m` : s);
+const dim = (s) => (color ? `\x1b[2m${s}\x1b[0m` : s);
+const green = (s) => (color ? `\x1b[32m${s}\x1b[0m` : s);
+/**
+ * True when this Node has `node:sqlite` but only behind `--experimental-sqlite` — i.e. the
+ * v22.5.0–v22.12.x window (and v23.0–v23.3, which is EOL and not worth naming). Only then is the
+ * NODE_OPTIONS escape hatch real; below v22.5.0 the module does not exist at any flag.
+ */
+function flagWouldWork(version) {
+    const [major, minor] = version.split('.').map(Number);
+    if (major === 22)
+        return minor >= 5 && minor < 13;
+    return major === 23;
+}
+function nodeSqliteMessage(version) {
+    const escape = flagWouldWork(version)
+        ? `\n  Need to stay on this Node? It has SQLite, just flag-gated — but abx is untested there:\n    ${green(`NODE_OPTIONS=--experimental-sqlite abx ${process.argv[2] ?? 'doctor'}`)}\n`
+        : '';
+    return (`\n${red('✗')} abx needs Node's built-in SQLite (${dim('node:sqlite')}), and this Node can't load it.\n\n` +
+        `    you have   ${red(`v${version}`)}\n` +
+        `    abx needs  ${green(`v${NODE_FLOOR}`)} or newer\n\n` +
+        `  Upgrade Node, then re-run:\n` +
+        `    ${green('nvm install 22 && nvm use 22')}   ${dim('# or: brew upgrade node')}\n` +
+        `    ${green('abx doctor')}\n` +
+        escape);
+}
+try {
+    await import('node:sqlite');
+}
+catch {
+    process.stderr.write(nodeSqliteMessage(process.versions.node));
+    process.exit(1);
+}
+await import('./main.js');
+export {};
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,+FAA+F;AAC/F,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;IAClD,OAAO,KAAK,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC;QACnC,CAAC,CAAC,mGAAmG,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,IAAI;QACvL,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,KAAK,GAAG,CAAC,GAAG,CAAC,sCAAsC,GAAG,CAAC,aAAa,CAAC,qCAAqC;QAC1G,kBAAkB,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI;QACxC,kBAAkB,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC,eAAe;QACxD,gCAAgC;QAChC,OAAO,KAAK,CAAC,8BAA8B,CAAC,MAAM,GAAG,CAAC,yBAAyB,CAAC,IAAI;QACpF,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI;QAC9B,MAAM,CACP,CAAC;AACJ,CAAC;AAED,IAAI,CAAC;IACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;AAC9B,CAAC;AAAC,MAAM,CAAC;IACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC"}

package/dist/capabilities.d.ts

@@ -0,0 +1,126 @@
+import type { Flags } from './flags.js';
+/**
+ * The machine-readable ABX capability contract.
+ *
+ * Keep this deliberately smaller than command help: it records product boundaries and the
+ * supported combinations agents routinely get wrong. Command-specific syntax still belongs to
+ * `abx help <command>`, while deploy planning belongs to `<deploy-command> --dry-run --json`.
+ * Human help, the shipped skill, and tests consume this object instead of maintaining competing
+ * matrices in prose.
+ */
+export declare const ABX_CAPABILITIES: {
+    readonly schemaVersion: 3;
+    readonly defaultChain: string;
+    readonly chains: readonly import("@artblocks/abx-sdk").ChainSupport[];
+    /** Compatibility field for consumers that only need selectable chain keys. */
+    readonly supportedChains: readonly string[];
+    readonly signingLanes: {
+        readonly send: {
+            readonly flag: "--send";
+            readonly summary: "local environment key pays gas";
+            readonly supportLevel: "supported";
+        };
+        readonly sign: {
+            readonly flag: "--sign";
+            readonly summary: "connected browser wallet pays gas";
+            readonly supportLevel: "supported";
+        };
+        readonly sponsor: {
+            readonly flag: "--sponsor";
+            readonly summary: "account-bound ABX creator wallet; ABX Services pays eligible gas";
+            readonly supportLevel: "beta";
+            readonly chainIds: readonly [8453, 84532];
+            readonly limits: readonly ["zero value", "network and provider gas policy", "no direct CREATE", "no staged --onchain-image"];
+        };
+        readonly unsigned: {
+            readonly flag: "--unsigned";
+            readonly summary: "print for an external signer";
+            readonly supportLevel: "supported";
+        };
+    };
+    readonly deploymentCommands: {
+        readonly deploy: {
+            readonly artifact: "one static work";
+            readonly unique: {
+                readonly contract: "OneOfOneImage (ERC-721)";
+                readonly inputs: readonly ["--image"];
+            };
+            readonly edition: {
+                readonly contract: "OneOfOneEdition (ERC-1155)";
+                readonly selector: "--copies <n|open>";
+                readonly summary: "one work × copies; supports on-chain bytes, on-chain JSON with external media, or a resolver";
+                readonly supported: readonly ["--onchain-image (hot or wallet signing)", "--onchain-uri", "--backend", "--public-base-url"];
+                readonly unsupported: readonly ["--onchain-image with --unsigned"];
+            };
+        };
+        readonly deploySeries: {
+            readonly artifact: "a folder of distinct static works";
+            readonly unique: {
+                readonly contract: "SeriesImage (ERC-721)";
+                readonly inputs: readonly ["--dir"];
+            };
+            readonly edition: {
+                readonly contract: "EditionImage (ERC-1155)";
+                readonly selector: "--copies <n|open>";
+                readonly summary: "N folder items × copies per id; supports on-chain bytes, on-chain JSON with external media, or a resolver";
+                readonly supported: readonly ["--onchain-image (hot or wallet signing)", "--onchain-uri", "--backend", "--public-base-url"];
+                readonly unsupported: readonly ["--onchain-image with --unsigned"];
+            };
+        };
+        readonly deployCode: {
+            readonly artifact: "a program or field renderer whose output depends on token state";
+            readonly unique: {
+                readonly contract: "SeriesCode (ERC-721)";
+                readonly inputs: readonly ["--script", "--code-dir", "--image-renderer", "--attributes-renderer"];
+            };
+            readonly edition: {
+                readonly contract: "EditionCode (ERC-1155)";
+                readonly selector: "--copies <n|open>";
+                readonly summary: "N generated ids × copies per id; supports scripts, directory builds, dependencies, deterministic per-id off-chain stills, and Solidity image/trait renderers";
+                readonly supported: readonly ["--script", "--code-dir", "--dep", "--dep-registry", "--image-renderer", "--attributes-renderer", "--image-base", "--onchain-uri", "--public-base-url"];
+                readonly unsupported: readonly ["--no-delegation"];
+            };
+        };
+    };
+    readonly extensionRoutes: readonly [{
+        readonly route: "custom minter";
+        readonly command: "abx set-minter";
+        readonly availableOn: "Series and editions";
+        readonly useFor: readonly ["auctions", "allowlists", "raffles", "free claims", "ERC-20 pricing"];
+    }, {
+        readonly route: "configure hook";
+        readonly command: "abx set-param-hooks --configure";
+        readonly availableOn: "SeriesCode and EditionCode";
+        readonly useFor: readonly ["validated writes", "monotonic values", "structured collector input"];
+    }, {
+        readonly route: "transfer hook";
+        readonly command: "abx set-param-hooks --transfer";
+        readonly availableOn: "SeriesCode and EditionCode";
+        readonly useFor: readonly ["transfer restrictions", "soulbinding", "vesting", "redemption", "escrow"];
+    }, {
+        readonly route: "augment hook";
+        readonly command: "abx set-param-hooks --augment";
+        readonly availableOn: "SeriesCode and EditionCode";
+        readonly useFor: readonly ["live derived data", "oracle-fed state", "read-time metadata"];
+    }, {
+        readonly route: "field renderer";
+        readonly command: "abx deploy-code --image-renderer/--attributes-renderer";
+        readonly availableOn: "SeriesCode and EditionCode";
+        readonly useFor: readonly ["on-chain SVG images", "on-chain computed traits"];
+    }, {
+        readonly route: "replace an unlocked script";
+        readonly command: "abx replace-script";
+        readonly availableOn: "SeriesCode and EditionCode, before `abx lock-script`";
+        readonly useFor: readonly ["shipping a fix to a live generative program", "iterating pre-lock without a full redeploy"];
+    }];
+    readonly deployTimeChoices: readonly ["contract shape and token standard (--copies)", "code-capable versus static contract type", "burnability (--burnable)", "ERC-721C/ERC-1155C enrollment (--721c)"];
+    readonly unsupportedToday: readonly ["chains whose support level is disabled", "unsupported chains", "secondary-market listings or an order book", "compiling or deploying custom Solidity through abx", "retrofitting a deploy-time choice on an existing collection"];
+    readonly interpretation: {
+        readonly native: "A documented command/flag combination performs the request directly.";
+        readonly extension: "A canonical extension seam performs it while the token remains a factory clone.";
+        readonly unsupported: "The request is listed under unsupportedToday or is blocked by an irreversible choice already made.";
+        readonly unknown: "Do not infer support from absence. Inspect command help, contract type, and this contract; report uncertainty if no route is proven.";
+    };
+};
+export declare function cmdCapabilities(flags: Flags): void;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AAEtC;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;IAI3B,8EAA8E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuHtE,CAAC;AAEX,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAoClD"}

package/dist/capabilities.js

@@ -0,0 +1,168 @@
+import { CHAIN_SUPPORT, DEFAULT_CHAIN_KEY, KNOWN_CHAIN_KEYS } from '@artblocks/abx-sdk';
+/**
+ * The machine-readable ABX capability contract.
+ *
+ * Keep this deliberately smaller than command help: it records product boundaries and the
+ * supported combinations agents routinely get wrong. Command-specific syntax still belongs to
+ * `abx help <command>`, while deploy planning belongs to `<deploy-command> --dry-run --json`.
+ * Human help, the shipped skill, and tests consume this object instead of maintaining competing
+ * matrices in prose.
+ */
+export const ABX_CAPABILITIES = {
+    schemaVersion: 3,
+    defaultChain: DEFAULT_CHAIN_KEY,
+    chains: CHAIN_SUPPORT,
+    /** Compatibility field for consumers that only need selectable chain keys. */
+    supportedChains: [...KNOWN_CHAIN_KEYS],
+    signingLanes: {
+        send: { flag: '--send', summary: 'local environment key pays gas', supportLevel: 'supported' },
+        sign: { flag: '--sign', summary: 'connected browser wallet pays gas', supportLevel: 'supported' },
+        sponsor: {
+            flag: '--sponsor',
+            summary: 'account-bound ABX creator wallet; ABX Services pays eligible gas',
+            supportLevel: 'beta',
+            chainIds: [8_453, 84_532],
+            limits: ['zero value', 'network and provider gas policy', 'no direct CREATE', 'no staged --onchain-image'],
+        },
+        unsigned: { flag: '--unsigned', summary: 'print for an external signer', supportLevel: 'supported' },
+    },
+    deploymentCommands: {
+        deploy: {
+            artifact: 'one static work',
+            unique: {
+                contract: 'OneOfOneImage (ERC-721)',
+                inputs: ['--image'],
+            },
+            edition: {
+                contract: 'OneOfOneEdition (ERC-1155)',
+                selector: '--copies <n|open>',
+                summary: 'one work × copies; supports on-chain bytes, on-chain JSON with external media, or a resolver',
+                supported: ['--onchain-image (hot or wallet signing)', '--onchain-uri', '--backend', '--public-base-url'],
+                unsupported: ['--onchain-image with --unsigned'],
+            },
+        },
+        deploySeries: {
+            artifact: 'a folder of distinct static works',
+            unique: {
+                contract: 'SeriesImage (ERC-721)',
+                inputs: ['--dir'],
+            },
+            edition: {
+                contract: 'EditionImage (ERC-1155)',
+                selector: '--copies <n|open>',
+                summary: 'N folder items × copies per id; supports on-chain bytes, on-chain JSON with external media, or a resolver',
+                supported: ['--onchain-image (hot or wallet signing)', '--onchain-uri', '--backend', '--public-base-url'],
+                unsupported: ['--onchain-image with --unsigned'],
+            },
+        },
+        deployCode: {
+            artifact: 'a program or field renderer whose output depends on token state',
+            unique: {
+                contract: 'SeriesCode (ERC-721)',
+                inputs: ['--script', '--code-dir', '--image-renderer', '--attributes-renderer'],
+            },
+            edition: {
+                contract: 'EditionCode (ERC-1155)',
+                selector: '--copies <n|open>',
+                summary: 'N generated ids × copies per id; supports scripts, directory builds, dependencies, deterministic per-id off-chain stills, and Solidity image/trait renderers',
+                supported: ['--script', '--code-dir', '--dep', '--dep-registry', '--image-renderer', '--attributes-renderer', '--image-base', '--onchain-uri', '--public-base-url'],
+                // `--resume` isn't listed in `supported`/`unsupported` at all (neither lane lists it — it's a
+                // REPAIR verb against an EXISTING contract, not a deploy-time flag): `abx deploy-code --resume
+                // <address>` now diffs an EditionCode target's per-id mint shortfall exactly as it always has
+                // for a 721 SeriesCode target (see resume.ts's `planEditionResume`).
+                unsupported: ['--no-delegation'],
+            },
+        },
+    },
+    extensionRoutes: [
+        {
+            route: 'custom minter',
+            command: 'abx set-minter',
+            availableOn: 'Series and editions',
+            useFor: ['auctions', 'allowlists', 'raffles', 'free claims', 'ERC-20 pricing'],
+        },
+        {
+            route: 'configure hook',
+            command: 'abx set-param-hooks --configure',
+            availableOn: 'SeriesCode and EditionCode',
+            useFor: ['validated writes', 'monotonic values', 'structured collector input'],
+        },
+        {
+            route: 'transfer hook',
+            command: 'abx set-param-hooks --transfer',
+            availableOn: 'SeriesCode and EditionCode',
+            useFor: ['transfer restrictions', 'soulbinding', 'vesting', 'redemption', 'escrow'],
+        },
+        {
+            route: 'augment hook',
+            command: 'abx set-param-hooks --augment',
+            availableOn: 'SeriesCode and EditionCode',
+            useFor: ['live derived data', 'oracle-fed state', 'read-time metadata'],
+        },
+        {
+            route: 'field renderer',
+            command: 'abx deploy-code --image-renderer/--attributes-renderer',
+            availableOn: 'SeriesCode and EditionCode',
+            useFor: ['on-chain SVG images', 'on-chain computed traits'],
+        },
+        {
+            route: 'replace an unlocked script',
+            command: 'abx replace-script',
+            availableOn: 'SeriesCode and EditionCode, before `abx lock-script`',
+            useFor: ['shipping a fix to a live generative program', 'iterating pre-lock without a full redeploy'],
+        },
+    ],
+    deployTimeChoices: [
+        'contract shape and token standard (--copies)',
+        'code-capable versus static contract type',
+        'burnability (--burnable)',
+        'ERC-721C/ERC-1155C enrollment (--721c)',
+    ],
+    unsupportedToday: [
+        'chains whose support level is disabled',
+        'unsupported chains',
+        'secondary-market listings or an order book',
+        'compiling or deploying custom Solidity through abx',
+        'retrofitting a deploy-time choice on an existing collection',
+    ],
+    interpretation: {
+        native: 'A documented command/flag combination performs the request directly.',
+        extension: 'A canonical extension seam performs it while the token remains a factory clone.',
+        unsupported: 'The request is listed under unsupportedToday or is blocked by an irreversible choice already made.',
+        unknown: 'Do not infer support from absence. Inspect command help, contract type, and this contract; report uncertainty if no route is proven.',
+    },
+};
+export function cmdCapabilities(flags) {
+    if (flags.json !== undefined) {
+        console.log(JSON.stringify(ABX_CAPABILITIES, null, 2));
+        return;
+    }
+    console.log(`ABX capability contract v${ABX_CAPABILITIES.schemaVersion}\n`);
+    console.log(`Default chain: ${ABX_CAPABILITIES.defaultChain}`);
+    console.log('Networks:');
+    for (const chain of ABX_CAPABILITIES.chains) {
+        console.log(`  ${chain.key} (${chain.chainId}): ${chain.environment} · ${chain.supportLevel} · contracts ${chain.contractStatus}`);
+    }
+    console.log('Signing lanes:');
+    for (const lane of Object.values(ABX_CAPABILITIES.signingLanes)) {
+        console.log(`  ${lane.flag}: ${lane.summary} · ${lane.supportLevel}`);
+    }
+    console.log('Native deployment lanes:');
+    for (const [name, lane] of Object.entries(ABX_CAPABILITIES.deploymentCommands)) {
+        console.log(`  ${name}: ${lane.artifact}`);
+        console.log(`    unique  ${lane.unique.contract} — ${lane.unique.inputs.join(' | ')}`);
+        console.log(`    edition ${lane.edition.contract} — ${lane.edition.summary}`);
+        if (lane.edition.unsupported.length)
+            console.log(`    limits  ${lane.edition.unsupported.join(' · ')}`);
+    }
+    console.log('\nCanonical extension routes:');
+    for (const seam of ABX_CAPABILITIES.extensionRoutes) {
+        console.log(`  ${seam.route}: ${seam.availableOn} — ${seam.useFor.join(', ')}`);
+    }
+    console.log('\nUnsupported today:');
+    for (const item of ABX_CAPABILITIES.unsupportedToday)
+        console.log(`  - ${item}`);
+    console.log('\nUse `abx capabilities --json` for the stable machine-readable form,');
+    console.log('`abx help <command>` for current flags, and `<deploy-command> --dry-run --json` for a concrete plan.');
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa,EAAE,CAAC;IAChB,YAAY,EAAE,iBAAiB;IAC/B,MAAM,EAAE,aAAa;IACrB,8EAA8E;IAC9E,eAAe,EAAE,CAAC,GAAG,gBAAgB,CAAC;IACtC,YAAY,EAAE;QACZ,IAAI,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,WAAW,EAAC;QAC5F,IAAI,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,YAAY,EAAE,WAAW,EAAC;QAC/F,OAAO,EAAE;YACP,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,kEAAkE;YAC3E,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACzB,MAAM,EAAE,CAAC,YAAY,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,2BAA2B,CAAC;SAC3G;QACD,QAAQ,EAAE,EAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,8BAA8B,EAAE,YAAY,EAAE,WAAW,EAAC;KACnG;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE;YACN,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE;gBACN,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,CAAC,SAAS,CAAC;aACpB;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,4BAA4B;gBACtC,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,8FAA8F;gBACvG,SAAS,EAAE,CAAC,yCAAyC,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,CAAC;gBACzG,WAAW,EAAE,CAAC,iCAAiC,CAAC;aACjD;SACF;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,mCAAmC;YAC7C,MAAM,EAAE;gBACN,QAAQ,EAAE,uBAAuB;gBACjC,MAAM,EAAE,CAAC,OAAO,CAAC;aAClB;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,yBAAyB;gBACnC,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,2GAA2G;gBACpH,SAAS,EAAE,CAAC,yCAAyC,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,CAAC;gBACzG,WAAW,EAAE,CAAC,iCAAiC,CAAC;aACjD;SACF;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,iEAAiE;YAC3E,MAAM,EAAE;gBACN,QAAQ,EAAE,sBAAsB;gBAChC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,CAAC;aAChF;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,wBAAwB;gBAClC,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,8JAA8J;gBACvK,SAAS,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,CAAC;gBACnK,8FAA8F;gBAC9F,+FAA+F;gBAC/F,8FAA8F;gBAC9F,qEAAqE;gBACrE,WAAW,EAAE,CAAC,iBAAiB,CAAC;aACjC;SACF;KACF;IACD,eAAe,EAAE;QACf;YACE,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC;SAC/E;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,4BAA4B;YACzC,MAAM,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,4BAA4B,CAAC;SAC/E;QACD;YACE,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,gCAAgC;YACzC,WAAW,EAAE,4BAA4B;YACzC,MAAM,EAAE,CAAC,uBAAuB,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC;SACpF;QACD;YACE,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,+BAA+B;YACxC,WAAW,EAAE,4BAA4B;YACzC,MAAM,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;SACxE;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,wDAAwD;YACjE,WAAW,EAAE,4BAA4B;YACzC,MAAM,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;SAC5D;QACD;YACE,KAAK,EAAE,4BAA4B;YACnC,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,sDAAsD;YACnE,MAAM,EAAE,CAAC,6CAA6C,EAAE,4CAA4C,CAAC;SACtG;KACF;IACD,iBAAiB,EAAE;QACjB,8CAA8C;QAC9C,0CAA0C;QAC1C,0BAA0B;QAC1B,wCAAwC;KACzC;IACD,gBAAgB,EAAE;QAChB,wCAAwC;QACxC,oBAAoB;QACpB,4CAA4C;QAC5C,oDAAoD;QACpD,6DAA6D;KAC9D;IACD,cAAc,EAAE;QACd,MAAM,EAAE,sEAAsE;QAC9E,SAAS,EAAE,iFAAiF;QAC5F,WAAW,EAAE,oGAAoG;QACjH,OAAO,EAAE,sIAAsI;KAChJ;CACO,CAAC;AAEX,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,4BAA4B,gBAAgB,CAAC,aAAa,IAAI,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,kBAAkB,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,YAAY,gBAAgB,KAAK,CAAC,cAAc,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,eAAe,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,WAAW,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,gBAAgB;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,sGAAsG,CAAC,CAAC;AACtH,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,54 @@
+import { type Flags } from '../flags.js';
+export interface DeviceLoginDeps {
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    openBrowser?: (url: string) => boolean;
+    line?: (message: string) => void;
+    warning?: (message: string) => void;
+}
+export interface DeviceLoginOptions {
+    baseUrl: string;
+    envVar: string;
+    envPath: string;
+    force?: boolean;
+    noOpen?: boolean;
+}
+export interface OAuthLogoutOptions {
+    baseUrl: string;
+    envVar: string;
+    envPath: string;
+    token?: string;
+}
+export interface OAuthLogoutDeps {
+    fetchImpl?: typeof fetch;
+}
+export type OAuthLogoutResult = {
+    status: 'absent';
+} | {
+    status: 'revoked';
+    local: 'removed' | 'external' | 'different';
+};
+/** Refuse the two silent secret-exposure modes: replacing a tracked file, or creating an unignored
+ * .env inside a Git worktree. A non-Git directory is fine. */
+export declare function assertPrivateEnvPath(envPath: string): void;
+/** Bearer-token grammar (RFC 6750) — the default value shape {@link saveEnvSecret} accepts. Exported
+ *  so a caller writing something differently-shaped (a URL, say) can pass its own `valuePattern`
+ *  instead of fighting this one. */
+export declare const BEARER_TOKEN_PATTERN: RegExp;
+export declare function saveEnvSecret(envPath: string, key: string, value: string, valuePattern?: RegExp): void;
+/** Validate and replace several env values with one atomic rename. A credential pair must never
+ * land half-updated because the process stopped between two individually-atomic writes. */
+export declare function saveEnvSecrets(envPath: string, entries: Array<{
+    key: string;
+    value: string;
+    valuePattern?: RegExp;
+}>): void;
+/** Standards-only core, dependency-injected for a no-secret-output regression test. */
+export declare function deviceLogin(options: DeviceLoginOptions, deps?: DeviceLoginDeps): Promise<void>;
+/** RFC 7009 logout: revoke remotely first, then remove the matching local assignment. Keeping the
+ * credential when discovery or revocation fails preserves the user's ability to retry safely. */
+export declare function oauthLogout(options: OAuthLogoutOptions, deps?: OAuthLogoutDeps): Promise<OAuthLogoutResult>;
+export declare function cmdAuth(args: string[], flags: Flags): Promise<void>;
+export declare const AUTH_HELP: string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,aAAa,CAAA;AA4BxD,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAA;CAAE,CAAA;AAqGtE;8DAC8D;AAC9D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAc1D;AAED;;oCAEoC;AACpC,eAAO,MAAM,oBAAoB,QAA8B,CAAA;AAE/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAE5H;AAED;2FAC2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,GAClE,IAAI,CA+CN;AA4DD,uFAAuF;AACvF,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGxG;AAED;iGACiG;AACjG,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAaD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDzE;AAED,eAAO,MAAM,SAAS,QAegH,CAAA"}