@automattic/vip 4.0.9 → 4.0.11

package/dist/lib/dev-environment/dev-environment-configuration-file.js

@@ -6,7 +6,6 @@ exports.getConfigurationFileOptions = getConfigurationFileOptions;
 exports.mergeConfigurationFileOptions = mergeConfigurationFileOptions;
 var _chalk = _interopRequireDefault(require("chalk"));
 var _debug = _interopRequireDefault(require("debug"));
-var _ejs = _interopRequireDefault(require("ejs"));
 var _jsYaml = _interopRequireWildcard(require("js-yaml"));
 var _promises = require("node:fs/promises");
 var _nodePath = _interopRequireDefault(require("node:path"));
@@ -17,6 +16,8 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 const debug = (0, _debug.default)('@automattic/vip:bin:dev-environment');
 const CONFIGURATION_FILE_NAME = exports.CONFIGURATION_FILE_NAME = 'vip-dev-env.yml';
 const CONFIGURATION_TEMPLATE_FILE_NAME = exports.CONFIGURATION_TEMPLATE_FILE_NAME = 'vip-dev-env.yml.ejs';
+const ALLOWED_CONFIG_DIR_TEMPLATE = /<%=\s*configDir\s*%>/g;
+const EJS_TEMPLATE_TAG = /<%[\s\S]*?%>/;
 async function getConfigurationFileOptions() {
   const configurationFile = await findConfigurationFile();
   if (configurationFile === false) {
@@ -176,26 +177,30 @@ async function findConfigurationFile() {
     file,
     template
   } of locations) {
+    let contents;
     try {
       // eslint-disable-next-line no-await-in-loop
-      const contents = await (0, _promises.readFile)(file, 'utf8');
-      if (template) {
-        const rendered = _ejs.default.render(contents, {
-          configDir: dir
-        });
-        return {
-          configurationPath: file,
-          configurationContents: rendered
-        };
+      contents = await (0, _promises.readFile)(file, 'utf8');
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error('Unknown error');
+      debug(`Error reading file ${file}: ${err.message}`);
+      continue;
+    }
+    if (template) {
+      const stripped = contents.replace(ALLOWED_CONFIG_DIR_TEMPLATE, '');
+      if (EJS_TEMPLATE_TAG.test(stripped)) {
+        exit.withError(`EJS JavaScript is not supported in dev-env configuration file ${file}. ` + 'Use plain YAML, or only the supported <%= configDir %> placeholder.');
       }
+      const rendered = contents.replace(ALLOWED_CONFIG_DIR_TEMPLATE, () => dir);
       return {
         configurationPath: file,
-        configurationContents: contents
+        configurationContents: rendered
       };
-    } catch (error) {
-      const err = error instanceof Error ? error : new Error('Unknown error');
-      debug(`Error reading or rendering file ${file}: ${err.message}`);
     }
+    return {
+      configurationPath: file,
+      configurationContents: contents
+    };
   }
   return false;
 }

package/dist/lib/keychain/insecure.js

@@ -1,7 +1,7 @@
 "use strict";
 
 exports.__esModule = true;
-exports.default = void 0;
+exports.Insecure = void 0;
 var _configstore = _interopRequireDefault(require("configstore"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 class Insecure {
@@ -40,4 +40,4 @@ class Insecure {
     }
   }
 }
-exports.default = Insecure;
+exports.Insecure = Insecure;

package/dist/lib/keychain/secure.js

@@ -1,7 +1,7 @@
 "use strict";
 
 exports.__esModule = true;
-exports.default = void 0;
+exports.Secure = void 0;
 var _keytar = _interopRequireDefault(require("@github/keytar"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 class Secure {
@@ -16,4 +16,4 @@ class Secure {
     return _keytar.default.deletePassword(service, service);
   }
 }
-exports.default = Secure;
+exports.Secure = Secure;

package/dist/lib/keychain.js

@@ -1,22 +1,27 @@
 "use strict";
 
 exports.__esModule = true;
-exports.default = void 0;
+exports.getKeychain = getKeychain;
 var _debug = _interopRequireDefault(require("debug"));
-var _insecure = _interopRequireDefault(require("./keychain/insecure"));
+var _insecure = require("./keychain/insecure");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 let keychain;
 const debug = (0, _debug.default)('@automattic/vip:keychain');
-try {
-  // Try using Secure keychain ("keytar") first
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const Secure = require('./keychain/secure').default;
-  keychain = new Secure();
-} catch (error) {
-  debug('Cannot use Secure keychain; falling back to Insecure keychain (Details: %o)', error);
-
-  // Fallback to Insecure keychain if we can't
-  keychain = new _insecure.default('vip-go-cli');
-}
-const exportedKeychain = keychain;
-var _default = exports.default = exportedKeychain;
+async function getKeychain() {
+  if (typeof keychain === 'undefined') {
+    try {
+      const {
+        Secure
+      } = await import('./keychain/secure.js');
+      const kc = new Secure();
+      // We don't know if the secure keychain is actually usable until we try to communicate with it.
+      await kc.getPassword('non-existent-password-fraude-perit-virtus');
+      debug('Using Secure keychain');
+      keychain = kc;
+    } catch (error) {
+      debug('Cannot use Secure keychain; falling back to Insecure keychain (Details: %o)', error);
+      keychain = new _insecure.Insecure('vip-go-cli');
+    }
+  }
+  return keychain;
+}

package/dist/lib/logout.js

@@ -3,14 +3,19 @@
 exports.__esModule = true;
 exports.default = void 0;
 var _http = _interopRequireDefault(require("../lib/api/http"));
+var _tokenCache = _interopRequireDefault(require("../lib/rechallenge/token-cache"));
 var _token = _interopRequireDefault(require("../lib/token"));
 var _tracker = require("../lib/tracker");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 var _default = async () => {
-  await (0, _http.default)('/logout', {
-    method: 'post'
-  });
-  await _token.default.purge();
+  try {
+    await (0, _http.default)('/logout', {
+      method: 'post'
+    });
+  } finally {
+    await _token.default.purge();
+    await _tokenCache.default.clearAll();
+  }
   await (0, _tracker.trackEvent)('logout_command_execute');
 };
 exports.default = _default;

package/dist/lib/rechallenge/client.js

@@ -0,0 +1,55 @@
+"use strict";
+
+exports.__esModule = true;
+exports.createSession = createSession;
+exports.exchange = exchange;
+exports.getSessionStatus = getSessionStatus;
+var _debug = _interopRequireDefault(require("debug"));
+var _nodeCrypto = require("node:crypto");
+var _errors = require("./errors");
+var _types = require("./types");
+var _http = _interopRequireDefault(require("../api/http"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+// Derived from http() rather than imported from a fetch library, so this module
+// keeps compiling across the node-fetch -> undici migration (trunk #2837).
+
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:client');
+function fillTemplate(template, challengeId) {
+  return template.replaceAll('{challengeId}', encodeURIComponent(challengeId));
+}
+async function parseOrThrow(response, scope) {
+  if (!response.ok) {
+    const text = await response.text();
+    throw new _errors.RechallengeHttpError(response.status, text, scope);
+  }
+  return await response.json();
+}
+async function createSession(opts) {
+  debug('createSession scope=%s', opts.requestedOperation);
+  const response = await (0, _http.default)(opts.path, {
+    method: 'POST',
+    headers: {
+      // New UUID per call — intent is a fresh session per invocation, not request deduplication.
+      'Idempotency-Key': (0, _nodeCrypto.randomUUID)()
+    },
+    body: {
+      clientType: _types.CLIENT_TYPE,
+      requestedOperation: opts.requestedOperation
+    }
+  });
+  return parseOrThrow(response, opts.requestedOperation);
+}
+async function getSessionStatus(opts) {
+  const path = fillTemplate(opts.template, opts.challengeId);
+  const response = await (0, _http.default)(path, {
+    method: 'GET'
+  });
+  return parseOrThrow(response, opts.scope ?? '');
+}
+async function exchange(opts) {
+  const path = fillTemplate(opts.template, opts.challengeId);
+  const response = await (0, _http.default)(path, {
+    method: 'POST'
+  });
+  return parseOrThrow(response, opts.scope ?? '');
+}

package/dist/lib/rechallenge/errors.js

@@ -0,0 +1,55 @@
+"use strict";
+
+exports.__esModule = true;
+exports.RechallengeUnsupportedVersionError = exports.RechallengeTerminalError = exports.RechallengeInteractionRequiredError = exports.RechallengeHttpError = exports.RechallengeError = exports.RechallengeAbortedError = void 0;
+var _types = require("./types");
+class RechallengeError extends Error {
+  scope;
+  constructor(message, scope) {
+    super(message);
+    this.name = 'RechallengeError';
+    this.scope = scope;
+  }
+}
+exports.RechallengeError = RechallengeError;
+class RechallengeUnsupportedVersionError extends RechallengeError {
+  constructor(version, scope) {
+    super(`Server requested rechallenge version "${version}" but this CLI only supports ${_types.RECHALLENGE_VERSION}. Update vip-cli.`, scope);
+    this.name = 'RechallengeUnsupportedVersionError';
+  }
+}
+exports.RechallengeUnsupportedVersionError = RechallengeUnsupportedVersionError;
+class RechallengeTerminalError extends RechallengeError {
+  status;
+  constructor(status, scope, detail) {
+    super(`Step-up verification did not complete (status=${status})${detail ? `: ${detail}` : ''}.`, scope);
+    this.name = 'RechallengeTerminalError';
+    this.status = status;
+  }
+}
+exports.RechallengeTerminalError = RechallengeTerminalError;
+class RechallengeAbortedError extends RechallengeError {
+  constructor(scope) {
+    super('Step-up verification was cancelled.', scope);
+    this.name = 'RechallengeAbortedError';
+  }
+}
+exports.RechallengeAbortedError = RechallengeAbortedError;
+class RechallengeHttpError extends RechallengeError {
+  statusCode;
+  bodyText;
+  constructor(statusCode, bodyText, scope) {
+    super(`Step-up verification request failed (HTTP ${statusCode}): ${bodyText}`, scope);
+    this.name = 'RechallengeHttpError';
+    this.statusCode = statusCode;
+    this.bodyText = bodyText;
+  }
+}
+exports.RechallengeHttpError = RechallengeHttpError;
+class RechallengeInteractionRequiredError extends RechallengeError {
+  constructor(scope) {
+    super(`Step-up verification is required for ${scope}, but this is a non-interactive session. ` + 'Re-run the command interactively, or pass --rechallenge-wait (or set VIP_RECHALLENGE_WAIT=1) ' + 'to print the verification URL and wait for you to complete it on another device.', scope);
+    this.name = 'RechallengeInteractionRequiredError';
+  }
+}
+exports.RechallengeInteractionRequiredError = RechallengeInteractionRequiredError;

package/dist/lib/rechallenge/flow.js

@@ -0,0 +1,145 @@
+"use strict";
+
+exports.__esModule = true;
+exports.isInteractiveContext = isInteractiveContext;
+exports.runRechallenge = runRechallenge;
+exports.shouldWaitForRechallenge = shouldWaitForRechallenge;
+var _chalk = _interopRequireDefault(require("chalk"));
+var _debug = _interopRequireDefault(require("debug"));
+var _promises = require("node:timers/promises");
+var _tracker = require("../tracker");
+var client = _interopRequireWildcard(require("./client"));
+var _errors = require("./errors");
+var _openBrowser = require("./open-browser");
+var _tokenCache = _interopRequireDefault(require("./token-cache"));
+var _types = require("./types");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:flow');
+
+// Floor for the server-provided poll interval. Guards against a missing/0/NaN
+// value (which would otherwise produce a tight status-poll loop) and clamps
+// implausibly small values so a misbehaving server cannot make us hammer the API.
+const MIN_POLL_INTERVAL_SECONDS = 2;
+const TERMINAL = new Set(['verified', 'expired', 'failed', 'cancelled']);
+async function runRechallenge(opts) {
+  const {
+    requestedOperation,
+    rechallenge,
+    interactive,
+    wait,
+    signal
+  } = opts;
+  if (rechallenge.version !== _types.RECHALLENGE_VERSION) {
+    throw new _errors.RechallengeUnsupportedVersionError(rechallenge.version, requestedOperation);
+  }
+  await (0, _tracker.trackEvent)('rechallenge_required', {
+    scope: requestedOperation,
+    clientType: _types.CLIENT_TYPE
+  });
+
+  // In a non-interactive session with no opt-in to wait, fail fast instead of
+  // creating a verification session no human can complete — automation would
+  // otherwise block until the session expires.
+  if (!interactive && !wait) {
+    await (0, _tracker.trackEvent)('rechallenge_interaction_required', {
+      scope: requestedOperation
+    });
+    throw new _errors.RechallengeInteractionRequiredError(requestedOperation);
+  }
+  const session = await client.createSession({
+    path: rechallenge.createSessionPath,
+    requestedOperation
+  });
+  await (0, _tracker.trackEvent)('rechallenge_session_created', {
+    scope: requestedOperation
+  });
+  const verificationUrl = session.verificationUrl;
+  const expiresIso = session.expiresAt;
+  if (interactive) {
+    await (0, _openBrowser.openBrowser)(verificationUrl);
+    console.warn(_chalk.default.yellow('⚠'), `Step-up verification required for ${_chalk.default.bold(requestedOperation)}.`);
+    console.warn(`  Open ${_chalk.default.cyan(verificationUrl)}`);
+    console.warn(`  If your browser did not open, copy and paste the URL above. Expires at ${expiresIso}.`);
+  } else {
+    console.warn(`Step-up verification required for ${requestedOperation}. ` + `Complete it at: ${verificationUrl} (expires at ${expiresIso}).`);
+  }
+  const requestedInterval = Number(session.pollIntervalSeconds);
+  const interval = Math.max(Number.isFinite(requestedInterval) ? requestedInterval : MIN_POLL_INTERVAL_SECONDS, MIN_POLL_INTERVAL_SECONDS) * 1000;
+  const deadline = Date.parse(session.expiresAt);
+  if (Number.isNaN(deadline)) {
+    throw new _errors.RechallengeTerminalError('expired', requestedOperation, 'server returned unparseable expiresAt');
+  }
+
+  /* eslint-disable no-await-in-loop -- polling loop; each iteration must complete before the next */
+  while (true) {
+    if (signal?.aborted) {
+      throw new _errors.RechallengeAbortedError(requestedOperation);
+    }
+    try {
+      await (0, _promises.setTimeout)(interval, undefined, {
+        signal
+      });
+    } catch {
+      throw new _errors.RechallengeAbortedError(requestedOperation);
+    }
+    if (!Number.isNaN(deadline) && Date.now() > deadline) {
+      throw new _errors.RechallengeTerminalError('expired', requestedOperation, 'session window elapsed before completion');
+    }
+    const status = await client.getSessionStatus({
+      template: rechallenge.statusPathTemplate,
+      challengeId: session.challengeId,
+      scope: requestedOperation
+    });
+    if (!TERMINAL.has(status.status)) {
+      debug('still %s; polling again', status.status);
+      continue;
+    }
+    if (status.status === 'verified') {
+      await (0, _tracker.trackEvent)('rechallenge_verified', {
+        scope: requestedOperation,
+        provider: status.provider ?? 'unknown'
+      });
+      const {
+        elevatedToken
+      } = await client.exchange({
+        template: rechallenge.exchangePathTemplate,
+        challengeId: session.challengeId,
+        scope: requestedOperation
+      });
+      await (0, _tracker.trackEvent)('rechallenge_exchanged', {
+        scope: requestedOperation
+      });
+      await _tokenCache.default.set(requestedOperation, {
+        ...elevatedToken,
+        headerName: rechallenge.elevatedHeaderName
+      });
+      return elevatedToken;
+    }
+    await (0, _tracker.trackEvent)(`rechallenge_${status.status}`, {
+      scope: requestedOperation
+    });
+    throw new _errors.RechallengeTerminalError(status.status, requestedOperation, status.statusReason?.message);
+  }
+  /* eslint-enable no-await-in-loop */
+}
+function isInteractiveContext(argvOrFlags = process.argv) {
+  if (process.env.VIP_NON_INTERACTIVE === '1') {
+    return false;
+  }
+  if (argvOrFlags.some(item => item === '--non-interactive' || item.startsWith('--non-interactive=') && !/^--non-interactive=(0|false|no|off)$/i.test(item))) {
+    return false;
+  }
+  return Boolean(process.stdout.isTTY);
+}
+
+// Opt-in for waiting on step-up in a non-interactive session: the operator can
+// complete browser verification on another device while the command polls.
+// Mirrors isInteractiveContext's argv/env detection because the rechallenge link
+// is instantiated globally and cannot read a command's parsed options.
+function shouldWaitForRechallenge(argvOrFlags = process.argv) {
+  if (process.env.VIP_RECHALLENGE_WAIT === '1') {
+    return true;
+  }
+  return argvOrFlags.some(item => item === '--rechallenge-wait' || item.startsWith('--rechallenge-wait=') && !/^--rechallenge-wait=(0|false|no|off)$/i.test(item));
+}

package/dist/lib/rechallenge/index.js

@@ -0,0 +1,27 @@
+"use strict";
+
+exports.__esModule = true;
+var _exportNames = {
+  rechallengeLink: true,
+  tokenCache: true
+};
+exports.tokenCache = exports.rechallengeLink = void 0;
+var _link = _interopRequireDefault(require("./link"));
+exports.rechallengeLink = _link.default;
+var _tokenCache = _interopRequireDefault(require("./token-cache"));
+exports.tokenCache = _tokenCache.default;
+var _types = require("./types");
+Object.keys(_types).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _types[key]) return;
+  exports[key] = _types[key];
+});
+var _errors = require("./errors");
+Object.keys(_errors).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _errors[key]) return;
+  exports[key] = _errors[key];
+});
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }

package/dist/lib/rechallenge/link.js

@@ -0,0 +1,167 @@
+"use strict";
+
+exports.__esModule = true;
+exports.default = createRechallengeLink;
+var _core = require("@apollo/client/core");
+var _debug = _interopRequireDefault(require("debug"));
+var _graphql = require("graphql");
+var _flow = require("./flow");
+var _tokenCache = _interopRequireDefault(require("./token-cache"));
+var _types = require("./types");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:link');
+function operationDefinition(doc) {
+  return doc.definitions.find(def => def.kind === _graphql.Kind.OPERATION_DEFINITION);
+}
+function isMutation(doc) {
+  return operationDefinition(doc)?.operation === _graphql.OperationTypeNode.MUTATION;
+}
+function primaryMutationFieldName(doc) {
+  const op = operationDefinition(doc);
+  if (!op || op.operation !== _graphql.OperationTypeNode.MUTATION) {
+    return null;
+  }
+  const first = op.selectionSet.selections.find(sel => sel.kind === _graphql.Kind.FIELD);
+  return first?.name.value ?? null;
+}
+function extractElevatedPermission(result) {
+  const errors = result.errors ?? [];
+  for (const err of errors) {
+    const ext = err.extensions ?? {};
+    if (ext.code !== _types.ELEVATED_PERMISSION_ERROR_CODE) {
+      continue;
+    }
+    const rechallenge = ext.rechallenge;
+    if (rechallenge && typeof rechallenge.createSessionPath === 'string' && typeof rechallenge.statusPathTemplate === 'string' && typeof rechallenge.exchangePathTemplate === 'string' && typeof rechallenge.elevatedHeaderName === 'string') {
+      return {
+        rechallenge
+      };
+    }
+  }
+  return null;
+}
+function attachElevatedHeader(operation, headerName, token) {
+  const ctx = operation.getContext();
+  const headers = {
+    ...ctx.headers
+  };
+  headers[headerName] = token.token;
+  operation.setContext({
+    ...ctx,
+    headers
+  });
+}
+const DEFAULT_HEADER = 'x-elevated-token';
+function createRechallengeLink() {
+  return new _core.ApolloLink((operation, forward) => {
+    const scope = primaryMutationFieldName(operation.query);
+    const eligible = isMutation(operation.query) && Boolean(scope);
+    return new _core.Observable(observer => {
+      let retrying = false;
+      let cancelled = false;
+      let firstSub = null;
+      let retrySub = null;
+      const abortController = new AbortController();
+      const preflight = async () => {
+        if (!eligible || !scope) {
+          return;
+        }
+        const cached = await _tokenCache.default.get(scope);
+        if (cached) {
+          attachElevatedHeader(operation, cached.headerName || DEFAULT_HEADER, cached);
+        }
+      };
+      const handleRetry = async (result, elevated) => {
+        retrying = true;
+        const headerName = elevated.rechallenge.elevatedHeaderName || DEFAULT_HEADER;
+        let token;
+        try {
+          token = await (0, _flow.runRechallenge)({
+            requestedOperation: scope,
+            rechallenge: elevated.rechallenge,
+            interactive: (0, _flow.isInteractiveContext)(),
+            wait: (0, _flow.shouldWaitForRechallenge)(),
+            signal: abortController.signal
+          });
+        } catch (err) {
+          debug('rechallenge flow failed: %o', err);
+          if (cancelled || observer.closed) {
+            return;
+          }
+          // Surface the original elevated-permission error to upstream
+          // so errorLink and consumers see it.
+          observer.next(result);
+          observer.complete();
+          return;
+        }
+        if (cancelled || observer.closed) {
+          return;
+        }
+        attachElevatedHeader(operation, headerName, token);
+        try {
+          retrySub = forward(operation).subscribe({
+            next: res => observer.next(res),
+            error: err => observer.error(err),
+            complete: () => observer.complete()
+          });
+        } catch (err) {
+          if (cancelled || observer.closed) {
+            return;
+          }
+          observer.error(err);
+        }
+      };
+      const start = async () => {
+        try {
+          await preflight();
+        } catch (err) {
+          debug('preflight error: %o', err);
+        }
+        if (cancelled || observer.closed) {
+          return;
+        }
+        try {
+          firstSub = forward(operation).subscribe({
+            next: result => {
+              if (retrying || !eligible || !scope) {
+                observer.next(result);
+                return;
+              }
+              const elevated = extractElevatedPermission(result);
+              if (!elevated) {
+                observer.next(result);
+                return;
+              }
+              void handleRetry(result, elevated);
+            },
+            error: err => observer.error(err),
+            complete: () => {
+              if (!retrying) {
+                observer.complete();
+              }
+            }
+          });
+        } catch (err) {
+          if (cancelled || observer.closed) {
+            return;
+          }
+          observer.error(err);
+        }
+      };
+      void start().catch(err => {
+        if (cancelled || observer.closed) {
+          return;
+        }
+        observer.error(err);
+      });
+      return () => {
+        cancelled = true;
+        // Abort any in-flight rechallenge polling so the loop, its tracking
+        // events, and the token-cache write stop instead of running to expiry.
+        abortController.abort();
+        firstSub?.unsubscribe();
+        retrySub?.unsubscribe();
+      };
+    });
+  });
+}

package/dist/lib/rechallenge/open-browser.js

@@ -0,0 +1,21 @@
+"use strict";
+
+exports.__esModule = true;
+exports.openBrowser = openBrowser;
+var _debug = _interopRequireDefault(require("debug"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:open-browser');
+
+/** Opens a URL in the default browser. Wraps the ESM-only `open` package. */
+async function openBrowser(url) {
+  try {
+    const {
+      default: open
+    } = await import('open');
+    await open(url, {
+      wait: false
+    });
+  } catch (err) {
+    debug('Failed to open(%s): %o', url, err);
+  }
+}