@catalyst-cloud/cli 0.14.5 → 0.14.7

package/dist/legacy.js

@@ -7,7 +7,7 @@
 // The list is fixed on purpose. A prefix match would one day catch a current job (the housekeeping
 // job, the sandbox credit guard, jobs a person made); this matches names the old runtime installed,
 // read at the source commit below, and nothing else. Shared data folders are always kept. The historical --data flag cannot remove them.
-import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync, } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { flagBool, positionals } from "./args.js";
@@ -44,17 +44,34 @@ export const OLD_LAUNCHD_LABELS = [
 const OLD_ROLE_PREFIX = "com.catalyst.role.";
 /** systemd user units (~/.config/systemd/user) the old runtime's workstation pieces used on Linux. System
  *  units under /etc/systemd/system are a host's, current, and never looked at. */
-export const OLD_USER_UNITS = ["catalyst.service", "catalyst-monitor.service"];
+export const OLD_USER_UNITS = [
+    "catalyst.service",
+    "catalyst-monitor.service",
+];
 /** Command files the old runtime put on the person's PATH. `~/.local/bin/catalyst` is NOT one: that
  *  name belongs to the current CLI wherever npm put it. */
-export const OLD_BINS = [".local/bin/catalyst-events", ".local/bin/catalyst-filter", ".local/bin/catalyst-hud", ".local/bin/catalyst-monitor", ".local/bin/catalyst-myown"];
+export const OLD_BINS = [
+    ".local/bin/catalyst-events",
+    ".local/bin/catalyst-filter",
+    ".local/bin/catalyst-hud",
+    ".local/bin/catalyst-monitor",
+    ".local/bin/catalyst-myown",
+];
 /** Shared roots also hold current skills, logs, hosts and seats. Never remove these directories. */
-export const OLD_DATA_DIRS = [".catalyst", ".config/catalyst", ".local/state/catalyst", ".local/state/catalyst-fleet-runner", ".local/state/catalyst-ledger"];
+export const OLD_DATA_DIRS = [
+    ".catalyst",
+    ".config/catalyst",
+    ".local/state/catalyst",
+    ".local/state/catalyst-fleet-runner",
+    ".local/state/catalyst-ledger",
+];
 const RECOMMEND = "Remove them: the cloud runtime replaced them, and left in place they can start old jobs or shadow current commands.";
 function readJson(path) {
     try {
         const v = JSON.parse(readFileSync(path, "utf8"));
-        return v !== null && typeof v === "object" ? v : null;
+        return v !== null && typeof v === "object"
+            ? v
+            : null;
     }
     catch {
         return null;
@@ -67,7 +84,8 @@ function findPlugins(home) {
     const old = Object.entries(marketplaces)
         .filter(([, v]) => {
         const src = v?.source;
-        return typeof src?.repo === "string" && src.repo.toLowerCase() === OLD_MARKETPLACE_REPO;
+        return (typeof src?.repo === "string" &&
+            src.repo.toLowerCase() === OLD_MARKETPLACE_REPO);
     })
         .map(([name]) => name);
     if (old.length === 0)
@@ -77,10 +95,18 @@ function findPlugins(home) {
     for (const key of Object.keys(installed)) {
         const at = key.lastIndexOf("@");
         if (at > 0 && old.includes(key.slice(at + 1)))
-            items.push({ kind: "plugin", name: key, path: join(dir, "installed_plugins.json") });
+            items.push({
+                kind: "plugin",
+                name: key,
+                path: join(dir, "installed_plugins.json"),
+            });
     }
     for (const name of old)
-        items.push({ kind: "marketplace", name, path: join(dir, "known_marketplaces.json") });
+        items.push({
+            kind: "marketplace",
+            name,
+            path: join(dir, "known_marketplaces.json"),
+        });
     return items;
 }
 function findJobs(home, platform) {
@@ -96,35 +122,63 @@ function findJobs(home, platform) {
         return files
             .filter((f) => f.endsWith(".plist"))
             .map((f) => f.slice(0, -".plist".length))
-            .filter((label) => OLD_LAUNCHD_LABELS.includes(label) || label.startsWith(OLD_ROLE_PREFIX))
+            .filter((label) => OLD_LAUNCHD_LABELS.includes(label) ||
+            label.startsWith(OLD_ROLE_PREFIX))
             .sort()
-            .map((label) => ({ kind: "job", name: label, path: join(dir, `${label}.plist`) }));
+            .map((label) => ({
+            kind: "job",
+            name: label,
+            path: join(dir, `${label}.plist`),
+        }));
     }
     if (platform === "linux") {
         const dir = join(home, ".config", "systemd", "user");
-        return OLD_USER_UNITS.filter((u) => existsSync(join(dir, u))).map((u) => ({ kind: "job", name: u, path: join(dir, u) }));
+        return OLD_USER_UNITS.filter((u) => existsSync(join(dir, u))).map((u) => ({
+            kind: "job",
+            name: u,
+            path: join(dir, u),
+        }));
     }
     return [];
 }
 const tilde = (rel) => `~/${rel}`;
 function findFiles(home) {
-    const bins = OLD_BINS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({ kind: "bin", name: tilde(rel), path: join(home, rel) }));
-    const data = OLD_DATA_DIRS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({ kind: "data", name: tilde(rel), path: join(home, rel), data: true }));
+    const bins = OLD_BINS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({
+        kind: "bin",
+        name: tilde(rel),
+        path: join(home, rel),
+    }));
+    const data = OLD_DATA_DIRS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({
+        kind: "data",
+        name: tilde(rel),
+        path: join(home, rel),
+        data: true,
+    }));
     return [...bins, ...data];
 }
 /** Every old piece on this machine, in removal order: plugins, their marketplace, jobs, bins, data. Never writes. */
 export function findLegacy(home, platform) {
-    return [...findPlugins(home), ...findJobs(home, platform), ...findFiles(home)];
+    return [
+        ...findPlugins(home),
+        ...findJobs(home, platform),
+        ...findFiles(home),
+    ];
 }
 const defaultRun = (cmd, args) => {
     const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 60_000 });
-    return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.error ? r.error.message : (r.stderr ?? "") };
+    return {
+        status: r.status ?? 1,
+        stdout: r.stdout ?? "",
+        stderr: r.error ? r.error.message : (r.stderr ?? ""),
+    };
 };
 /** Remove one item through the tool that owns it. Returns null on success, else the reason it is still there. */
 function remove(item, run, platform, uid) {
     const tool = (cmd, args, what) => {
         const r = run(cmd, args);
-        return r.status === 0 ? null : `${what} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] || `exit ${r.status}`}`;
+        return r.status === 0
+            ? null
+            : `${what} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] || `exit ${r.status}`}`;
     };
     try {
         if (item.kind === "plugin")
@@ -132,7 +186,9 @@ function remove(item, run, platform, uid) {
         if (item.kind === "marketplace")
             return tool("claude", ["plugin", "marketplace", "remove", item.name], "claude plugin marketplace remove");
         if (item.kind === "job") {
-            const why = platform === "darwin" ? tool("launchctl", ["bootout", `gui/${uid}/${item.name}`], "launchctl bootout") : tool("systemctl", ["--user", "disable", "--now", item.name], "systemctl --user disable --now");
+            const why = platform === "darwin"
+                ? tool("launchctl", ["bootout", `gui/${uid}/${item.name}`], "launchctl bootout")
+                : tool("systemctl", ["--user", "disable", "--now", item.name], "systemctl --user disable --now");
             if (why !== null)
                 return why;
             unlinkSync(item.path);
@@ -159,21 +215,51 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
     const run = deps.run ?? defaultRun;
     const found = findLegacy(ctx.home, platform);
-    const emit = (body, lines) => { if (args.json)
-        ctx.stdout(JSON.stringify(body));
-    else
-        for (const l of lines)
-            ctx.stdout(l); };
-    if (found.length === 0) {
-        emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found: [], removed: [], remaining: [] }, ["no leftovers of the old local Catalyst runtime on this machine"]);
+    const legacy = found.filter((item) => !item.data);
+    const shared = found.filter((item) => item.data);
+    const emit = (body, lines) => {
+        if (args.json)
+            ctx.stdout(JSON.stringify(body));
+        else
+            for (const l of lines)
+                ctx.stdout(l);
+    };
+    if (legacy.length === 0) {
+        emit({
+            sourceCommit: LEGACY_SOURCE_COMMIT,
+            found: [],
+            removed: [],
+            remaining: [],
+            kept: shared,
+        }, [
+            "no leftovers of the old local Catalyst runtime on this machine",
+            ...(shared.length
+                ? ["shared current Catalyst data folders are present and kept"]
+                : []),
+        ]);
         return 0;
     }
     const listLines = [
-        `Leftovers of the old local Catalyst runtime on this machine (${found.length}):`,
-        ...found.map((f) => `  ${f.kind}: ${f.name}${f.kind === "job" ? ` — ${f.path}` : f.data ? " (kept: shared current state)" : ""}`),
+        `Leftovers of the old local Catalyst runtime on this machine (${legacy.length}):`,
+        ...legacy.map((f) => `  ${f.kind}: ${f.name}${f.kind === "job" ? ` — ${f.path}` : ""}`),
+        ...(shared.length
+            ? [
+                "Shared current data folders (kept):",
+                ...shared.map((f) => `  ${f.kind}: ${f.name} (kept: shared current state)`),
+            ]
+            : []),
     ];
     if (!wantRemove) {
-        emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found }, [...listLines, RECOMMEND, "Run: catalyst legacy --remove (all data folders are kept)"]);
+        emit({
+            sourceCommit: LEGACY_SOURCE_COMMIT,
+            found,
+            removed: [],
+            remaining: found,
+        }, [
+            ...listLines,
+            RECOMMEND,
+            "Run: catalyst legacy --remove (all data folders are kept)",
+        ]);
         return 1;
     }
     // the one question, only on a terminal; --yes answers it without asking
@@ -181,16 +267,34 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     if (!go) {
         const tty = (deps.isTty ?? stdinIsTty)();
         if (!tty) {
-            emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found, asked: false }, [...listLines, RECOMMEND, "nothing removed: no terminal to ask on; run catalyst legacy --remove --yes to remove these without a question (all data folders are kept)"]);
+            emit({
+                sourceCommit: LEGACY_SOURCE_COMMIT,
+                found,
+                removed: [],
+                remaining: found,
+                asked: false,
+            }, [
+                ...listLines,
+                RECOMMEND,
+                "nothing removed: no terminal to ask on; run catalyst legacy --remove --yes to remove these without a question (all data folders are kept)",
+            ]);
             return 1;
         }
         for (const l of listLines)
             ctx.stdout(l);
         ctx.stdout(RECOMMEND);
-        const answer = (await (deps.prompt ?? ((q) => promptSecret(q)))(`Remove ${found.length} item${found.length === 1 ? "" : "s"}, keeping all data folders? [y/N] `)).trim().toLowerCase();
+        const answer = (await (deps.prompt ?? ((q) => promptSecret(q)))(`Remove ${legacy.length} item${legacy.length === 1 ? "" : "s"}, keeping all data folders? [y/N] `))
+            .trim()
+            .toLowerCase();
         go = answer === "y" || answer === "yes";
         if (!go) {
-            emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found, asked: true }, ["nothing removed; run catalyst legacy --remove again when ready"]);
+            emit({
+                sourceCommit: LEGACY_SOURCE_COMMIT,
+                found,
+                removed: [],
+                remaining: found,
+                asked: true,
+            }, ["nothing removed; run catalyst legacy --remove again when ready"]);
             return 1;
         }
     }
@@ -217,7 +321,16 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     // re-check from the same list, so the report says what the machine holds now, not what was attempted
     const remaining = findLegacy(ctx.home, platform).filter((f) => !f.data);
     const keptNote = kept.length > 0 ? "; all shared data folders were kept" : "";
-    lines.push(remaining.length === 0 ? `re-checked: nothing of the old runtime remains${keptNote}` : `re-checked: ${remaining.length} item${remaining.length === 1 ? "" : "s"} of the old runtime remain${remaining.length === 1 ? "s" : ""}${keptNote}: ${remaining.map((r) => `${r.kind} ${r.name}`).join(", ")}`);
-    emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed, remaining: [...remaining, ...kept], kept, failed }, lines);
+    lines.push(remaining.length === 0
+        ? `re-checked: nothing of the old runtime remains${keptNote}`
+        : `re-checked: ${remaining.length} item${remaining.length === 1 ? "" : "s"} of the old runtime remain${remaining.length === 1 ? "s" : ""}${keptNote}: ${remaining.map((r) => `${r.kind} ${r.name}`).join(", ")}`);
+    emit({
+        sourceCommit: LEGACY_SOURCE_COMMIT,
+        found,
+        removed,
+        remaining: [...remaining, ...kept],
+        kept,
+        failed,
+    }, lines);
     return remaining.length === 0 ? 0 : 1;
 }

package/dist/oauth.js

@@ -1,4 +1,4 @@
-import { discoveryCachePathFor, loadConfig, normalizeBaseUrl, writeConfig } from "./config.js";
+import { discoveryCachePathFor, loadConfig, normalizeBaseUrl, writeConfig, } from "./config.js";
 import { CliError } from "./errors.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 const DISCOVERY_TTL_MS = 60 * 60_000;
@@ -20,7 +20,9 @@ function readDiscoveryDisk(home) {
         return null;
     try {
         const parsed = JSON.parse(readFileSync(path, "utf8"));
-        if (isDiscovery(parsed.doc) && typeof parsed.fetchedAt === "number" && typeof parsed.baseUrl === "string")
+        if (isDiscovery(parsed.doc) &&
+            typeof parsed.fetchedAt === "number" &&
+            typeof parsed.baseUrl === "string")
             return parsed;
     }
     catch {
@@ -32,16 +34,24 @@ function isDiscovery(v) {
     if (typeof v !== "object" || v === null)
         return false;
     const d = v;
-    return ["clientId", "issuer", "deviceAuthorizationUrl", "tokenUrl", "jwksUrl"].every((k) => typeof d[k] === "string");
+    return [
+        "clientId",
+        "issuer",
+        "deviceAuthorizationUrl",
+        "tokenUrl",
+        "jwksUrl",
+    ].every((k) => typeof d[k] === "string");
 }
 export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
-    const cancelled = () => { if (opts.signal?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (opts.signal?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     cancelled();
     const base = normalizeBaseUrl(baseUrl);
     const nowMs = ctx.now().getTime();
     const fresh = (e) => e !== null && e.baseUrl === base && nowMs - e.fetchedAt < DISCOVERY_TTL_MS;
-    if (!opts.refresh) {
+    if (!opts.refresh && opts.cache !== false) {
         if (fresh(memo))
             return memo.doc;
         const disk = readDiscoveryDisk(ctx.home);
@@ -51,7 +61,9 @@ export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
         }
     }
     const url = `${base}/api/v1/auth/cli`;
-    const res = await safeFetch(ctx, url, { headers: { accept: "application/json" } });
+    const res = await safeFetch(ctx, url, {
+        headers: { accept: "application/json" },
+    });
     if (!res.ok) {
         throw new CliError(`could not read the login discovery document (${res.status}) at ${url} — is this a Catalyst Cloud origin?`, "discovery-failed");
     }
@@ -60,6 +72,8 @@ export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
     if (!isDiscovery(doc))
         throw new CliError(`the login discovery document at ${url} is not the expected shape`, "discovery-shape");
     const entry = { baseUrl: base, fetchedAt: nowMs, doc };
+    if (opts.cache === false)
+        return doc;
     memo = entry;
     try {
         writeFileSync(discoveryCachePathFor(ctx.home), JSON.stringify(entry, null, 2) + "\n");
@@ -83,17 +97,28 @@ export const MAX_DEVICE_CODES = 3;
  * expires, a fresh one is minted and printed, up to MAX_DEVICE_CODES in all.
  */
 export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
-    const cancelled = () => { if (deps.signal?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (deps.signal?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     cancelled();
     if (deps.signal) {
         const fetchImpl = ctx.fetch;
         const signal = deps.signal;
-        ctx = { ...ctx, fetch: ((input, init) => fetchImpl(input, {
-                ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
-            })) };
+        ctx = {
+            ...ctx,
+            fetch: ((input, init) => fetchImpl(input, {
+                ...init,
+                signal: init?.signal
+                    ? AbortSignal.any([signal, init.signal])
+                    : signal,
+            })),
+        };
     }
-    const discovery = await fetchDiscovery(ctx, baseUrl, { signal: deps.signal });
+    const discovery = await fetchDiscovery(ctx, baseUrl, {
+        signal: deps.signal,
+        cache: deps.discoveryCache,
+    });
     cancelled();
     // The browser rule is decided on the first code; a later code re-opens it only when the first did.
     let browserOpened = false;
@@ -120,7 +145,9 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
         }
         ctx.stdout("Waiting for you to approve… (Ctrl-C to cancel)");
         const poll = () => pollDeviceCode(ctx, discovery, auth, deps.sleep, deps.signal);
-        const tokens = deps.waitForApproval ? await deps.waitForApproval(poll) : await poll();
+        const tokens = deps.waitForApproval
+            ? await deps.waitForApproval(poll)
+            : await poll();
         cancelled();
         if (tokens !== "expired")
             return tokensToAuth(ctx, tokens.access_token, tokens.refresh_token);
@@ -137,8 +164,10 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
 async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
     const deadline = AbortSignal.timeout(auth.expires_in * 1_000);
     const signal = external ? AbortSignal.any([external, deadline]) : deadline;
-    const cancelled = () => { if (external?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (external?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     let intervalMs = Math.max(1, auth.interval) * 1_000;
     for (;;) {
         cancelled();
@@ -158,7 +187,15 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
             return "expired";
         let res;
         try {
-            res = await safeFetch(ctx, discovery.tokenUrl, { method: "POST", headers: formHeaders(), body: form({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: auth.device_code, client_id: discovery.clientId }) }, signal);
+            res = await safeFetch(ctx, discovery.tokenUrl, {
+                method: "POST",
+                headers: formHeaders(),
+                body: form({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: auth.device_code,
+                    client_id: discovery.clientId,
+                }),
+            }, signal);
             cancelled();
         }
         catch (err) {
@@ -172,10 +209,14 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
         }
         if (res.ok) {
             const pair = (await parseJson(res, discovery.tokenUrl));
-            if (typeof pair.access_token !== "string" || typeof pair.refresh_token !== "string") {
+            if (typeof pair.access_token !== "string" ||
+                typeof pair.refresh_token !== "string") {
                 throw new CliError("the login token response was missing a token", "login-shape");
             }
-            return { access_token: pair.access_token, refresh_token: pair.refresh_token };
+            return {
+                access_token: pair.access_token,
+                refresh_token: pair.refresh_token,
+            };
         }
         const err = await oauthError(res, discovery.tokenUrl);
         if (err === "authorization_pending")
@@ -192,7 +233,10 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
         // Retry-After for a 429; only a genuine, non-transient refusal ends the loop.
         if (res.status === 408 || res.status === 429 || res.status >= 500) {
             const retryAfter = Number(res.headers.get("retry-after"));
-            intervalMs = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1_000 : backoff(intervalMs);
+            intervalMs =
+                Number.isFinite(retryAfter) && retryAfter > 0
+                    ? retryAfter * 1_000
+                    : backoff(intervalMs);
             continue;
         }
         throw new CliError(`login failed (${res.status}): ${err}`, "login-failed");
@@ -202,18 +246,35 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
 function devicePollDelay(ms, signal, sleep) {
     return new Promise((resolve, reject) => {
         let timer;
-        const clean = () => { clearTimeout(timer); signal.removeEventListener("abort", abort); };
-        const abort = () => { clean(); reject(new Error("device_poll_stopped")); };
+        const clean = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+        };
+        const abort = () => {
+            clean();
+            reject(new Error("device_poll_stopped"));
+        };
         if (signal.aborted) {
             abort();
             return;
         }
         signal.addEventListener("abort", abort, { once: true });
         if (sleep) {
-            Promise.resolve().then(() => sleep(ms)).then(() => { clean(); resolve(); }, error => { clean(); reject(error); });
+            Promise.resolve()
+                .then(() => sleep(ms))
+                .then(() => {
+                clean();
+                resolve();
+            }, (error) => {
+                clean();
+                reject(error);
+            });
         }
         else
-            timer = setTimeout(() => { clean(); resolve(); }, ms);
+            timer = setTimeout(() => {
+                clean();
+                resolve();
+            }, ms);
     });
 }
 /** Grow the poll interval on a transient failure, capped, so retries never hammer the endpoint. */
@@ -243,18 +304,27 @@ function persistRotation(ctx, cfg, sessionId, rotated) {
     writeConfig(ctx.home, target); // atomic; the rotated pair survives a crash
 }
 async function deviceAuthorize(ctx, discovery) {
-    const res = await safeFetch(ctx, discovery.deviceAuthorizationUrl, { method: "POST", headers: formHeaders(), body: form({ client_id: discovery.clientId }) });
+    const res = await safeFetch(ctx, discovery.deviceAuthorizationUrl, {
+        method: "POST",
+        headers: formHeaders(),
+        body: form({ client_id: discovery.clientId }),
+    });
     if (!res.ok)
         throw new CliError(`could not start login (${res.status}) at ${discovery.deviceAuthorizationUrl}`, "login-failed");
     const d = (await parseJson(res, discovery.deviceAuthorizationUrl));
-    if (typeof d.device_code !== "string" || typeof d.user_code !== "string" || typeof d.verification_uri !== "string") {
+    if (typeof d.device_code !== "string" ||
+        typeof d.user_code !== "string" ||
+        typeof d.verification_uri !== "string") {
         throw new CliError("the login authorization response was not the expected shape", "login-shape");
     }
     return {
         device_code: d.device_code,
         user_code: d.user_code,
         verification_uri: d.verification_uri,
-        ...(typeof d.verification_uri_complete === "string" && d.verification_uri_complete !== "" ? { verification_uri_complete: d.verification_uri_complete } : {}),
+        ...(typeof d.verification_uri_complete === "string" &&
+            d.verification_uri_complete !== ""
+            ? { verification_uri_complete: d.verification_uri_complete }
+            : {}),
         expires_in: typeof d.expires_in === "number" ? d.expires_in : 300,
         interval: typeof d.interval === "number" ? d.interval : 5,
     };
@@ -293,10 +363,19 @@ async function refreshAndPersist(ctx, cfg, deps) {
     for (let attempt = 0; attempt < REFRESH_MAX_ATTEMPTS; attempt++) {
         if (attempt > 0)
             await sleep(REFRESH_BASE_BACKOFF_MS * 2 ** (attempt - 1));
-        const res = await safeFetch(ctx, discovery.tokenUrl, { method: "POST", headers: formHeaders(), body: form({ grant_type: "refresh_token", refresh_token: current.refreshToken, client_id: discovery.clientId }) });
+        const res = await safeFetch(ctx, discovery.tokenUrl, {
+            method: "POST",
+            headers: formHeaders(),
+            body: form({
+                grant_type: "refresh_token",
+                refresh_token: current.refreshToken,
+                client_id: discovery.clientId,
+            }),
+        });
         if (res.ok) {
             const pair = (await parseJson(res, discovery.tokenUrl));
-            if (typeof pair.access_token !== "string" || typeof pair.refresh_token !== "string")
+            if (typeof pair.access_token !== "string" ||
+                typeof pair.refresh_token !== "string")
                 throw new CliError("the refresh response was missing a token", "session-refresh-shape");
             const rotated = tokensToAuth(ctx, pair.access_token, pair.refresh_token, current.sessionId);
             cfg.auth = rotated; // this process keeps using its own refreshed token
@@ -326,9 +405,17 @@ export function authStrategyFor(ctx, cfg) {
 // ── helpers ──────────────────────────────────────────────────────────────────────────────────────
 function tokensToAuth(ctx, accessToken, refreshToken, fallbackSid) {
     const claims = decodeJwtClaims(accessToken);
-    const exp = typeof claims.exp === "number" ? claims.exp * 1_000 : ctx.now().getTime() + 15 * 60_000;
+    const exp = typeof claims.exp === "number"
+        ? claims.exp * 1_000
+        : ctx.now().getTime() + 15 * 60_000;
     const sid = typeof claims.sid === "string" ? claims.sid : (fallbackSid ?? "");
-    return { kind: "oauth", accessToken, refreshToken, expiresAt: new Date(exp).toISOString(), sessionId: sid };
+    return {
+        kind: "oauth",
+        accessToken,
+        refreshToken,
+        expiresAt: new Date(exp).toISOString(),
+        sessionId: sid,
+    };
 }
 function decodeJwtClaims(token) {
     const parts = token.split(".");
@@ -342,13 +429,18 @@ function decodeJwtClaims(token) {
     }
 }
 function formHeaders() {
-    return { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+    return {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json",
+    };
 }
 function form(fields) {
     return new URLSearchParams(fields).toString();
 }
 async function safeFetch(ctx, url, init, signal) {
-    const sig = signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const sig = signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+        : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
     try {
         return await ctx.fetch(url, { ...init, signal: sig });
     }