@coldtea/pr-lens-cli 0.7.0 → 0.8.0

package/README.md

@@ -80,7 +80,7 @@ The renderer also hands back an atlas of where every lane, node, edge and flow s
 ### `comment`
 
 ```bash
-pr-lens comment --graph .pr-lens/drawn.graph.json --manifest .pr-lens/manifest.json \
+pr-lens comment --graph .pr-lens/<drawing>/drawn.graph.json --manifest .pr-lens/<drawing>/manifest.json \
   --asset-base-url https://raw.githubusercontent.com/owner/repo/pr-lens/42
 ```
 
@@ -112,7 +112,9 @@ pr-lens canvas push
 
 Puts the document on prlens.dev as a canvas: a page anyone you share it with can read, and an SVG a README can embed.
 
-`push` sends the JSON document, never an SVG; the app draws it. The default is `.pr-lens/drawn.graph.json`, the document `render` drew, so what the page shows is what the diagrams show. The first push of a file mints a canvas and every push after that updates the same one, matched by the path it came from. `--canvas <id|name>` picks a different one and `--name` says what to call a new one; the document's title is the default. It prints the view link, the embed, and the way to take it down again:
+`push` sends the JSON document, never an SVG; the app draws it. Give it the `drawn.graph.json` a render wrote, so the page shows what the diagrams show. With one drawing in the checkout a bare `push` finds it; with several it lists them and asks which.
+
+The first push of a document mints a canvas, and every push after that updates the same one. It is matched by the path the document came from, or by the document's title when no recorded path points at a canvas. The title match is what lets `pull`, `render`, `push` land back on the canvas you pulled: the pull writes the source document, the render writes the drawing somewhere else, and only one of them can be the recorded path. So a corrected diagram becomes a new revision of its canvas instead of a near copy. Because `render` gives each drawing a directory named after its title, a second diagram gets its own path and its own canvas without you asking for one. `--canvas <id|name>` picks a canvas for a single push and `--name` says what to call a new one; the document's title is the default. It prints the view link, the embed, and the way to take it down again:
 
 ```
 ✓ https://prlens.dev/c/{id} — rev 1 · 4 diagrams
@@ -125,6 +127,8 @@ The view link is the one to share. The edit link is the same page with the write
 
 A canvas plays the document's walkthrough when it carries one. The app checks that every step resolves against the diagrams it drew, and a push it refuses arrives here as `CANVAS_REJECTED` carrying the app's own words rather than a generic failure.
 
+Changing a canvas takes its write token or a sign-in as its owner. The CLI sends the write token when this checkout has one, since it works signed in or not. A second laptop, a fresh CI runner, or a checkout that never pulled the edit link sends the account token instead. `canvas claim` accepts only the write token, because claiming is how a canvas gets an owner in the first place.
+
 `pull` fetches the document back, by the view link or the bare id, into `.pr-lens/graph.json` unless `-o` says otherwise, and records the revision. Pull the edit link, the one ending in `#w=…`, and its token is recorded too: that is how a fresh checkout, or one that lost `.pr-lens/canvas.json`, gets the canvas back. A push carries the revision it last saw, and one that has been overtaken is refused rather than applied: pull, then push again.
 
 `rotate` mints a new write token and retires the old one. Use it when an edit link has leaked. The CLI saves the new token before it sends the request, so if the connection drops, the next command finishes the rotation instead of losing the token. The token lives in `.pr-lens/canvas.json`, keyed by canvas id, and git ignores it. Lose that file and the canvas is still readable by everyone; pushing to it again needs the token, which the edit link still carries.
@@ -139,6 +143,30 @@ The CLI refuses to write the registry where git could commit it. If a checkout t
 
 `--api` points at another PR Lens app, or set `PR_LENS_API_URL`. The protocol between the CLI and the app is five routes and one error envelope, written up in [the canvas API contract](https://github.com/coldteadotai/pr-lens/blob/main/docs/canvas-api.md) so a private server can answer it and documents stay on your network.
 
+### `auth`
+
+```bash
+pr-lens auth login
+```
+
+Signs this machine in, so the canvases it pushes belong to your account. Signed out, they are unlisted pages that only a link reaches. `push`, `pull` and `render` all work signed out, and always will.
+
+It prints a code and opens the browser. The code travels in the link, so you never type it; check that it matches the one on the page:
+
+```
+  Code WDJB-MJHT · opening https://prlens.dev/device?code=WDJB-MJHT
+  Check the page shows the same code, then approve. The code lasts 15 minutes.
+  Waiting for it…
+```
+
+Approving links this machine to your account. Every canvas the machine has already pushed becomes yours, and so does every one it pushes after that. `--no-browser` prints the link instead of opening it, for a machine you reach over SSH.
+
+`status` says which app this machine is signed in to and asks the app whether the sign-in still works. `--json` gives the same answer for scripts. Neither prints the token. When the app can't be reached, `status` says it couldn't check; it does not call the sign-in bad.
+
+`logout` forgets the sign-in kept on this machine. The machine stays linked, so the canvases it pushed stay yours. To remove the machine from your account, use the app's settings; signing in again from a removed machine links it back.
+
+The sign-in lives in `~/.config/pr-lens/auth/`, one file per app and readable by you alone, so one machine can be signed in to prlens.dev and to a private store at the same time. `PR_LENS_TOKEN` overrides it, which is how CI signs in without a browser. [The Action](https://github.com/coldteadotai/pr-lens/tree/main/packages/action) takes it as its `token` input.
+
 ## Corrections
 
 A repository's `.github/pr-lens.yml` is picked up automatically by `render` and applied at draw time: renames, exclusions, lane pins, groupings. It is an overlay: inference never writes back into it, so a correction keeps holding as the code moves and the model renames things between runs, and the document on disk stays the record of what was inferred.
@@ -159,7 +187,7 @@ A lane pin may name a lane the document never declared; the band is created and
 
 ## Failures
 
-Every failure carries a code, so a script can branch on it: `USAGE`, `UNREADABLE_FILE`, `UNKNOWN_DOCUMENT`, `INVALID_DOCUMENT`, `GIT_FAILED`, `EMPTY_DIFF`, `REPOSITORY_UNKNOWN`, `MISSING_API_KEY`, `PROVIDER_FAILED`, `MODEL_OUTPUT_INVALID`, `RENDER_FAILED`, and for `canvas`: `CANVAS_UNREGISTERED`, `CANVAS_UNKNOWN`, `CANVAS_CONFLICT`, `CANVAS_REJECTED`, `CANVAS_RATE_LIMITED`, `CANVAS_UNAVAILABLE`, `CANVAS_REGISTRY_EXPOSED`. Misuse exits 2, everything else exits 1.
+Every failure carries a code, so a script can branch on it: `USAGE`, `UNREADABLE_FILE`, `UNKNOWN_DOCUMENT`, `INVALID_DOCUMENT`, `GIT_FAILED`, `EMPTY_DIFF`, `REPOSITORY_UNKNOWN`, `MISSING_API_KEY`, `PROVIDER_FAILED`, `MODEL_OUTPUT_INVALID`, `RENDER_FAILED`, and for `canvas`: `CANVAS_UNREGISTERED`, `CANVAS_UNKNOWN`, `CANVAS_CONFLICT`, `CANVAS_REJECTED`, `CANVAS_RATE_LIMITED`, `CANVAS_UNAVAILABLE`, `CANVAS_REGISTRY_EXPOSED`, and for `auth`: `AUTH_REQUIRED`, `MACHINE_REVOKED`, `APP_UNAVAILABLE`. Misuse exits 2, everything else exits 1.
 
 ---
 

package/dist/account.d.ts

@@ -0,0 +1,76 @@
+export type StartedSignIn = {
+    deviceCode: string;
+    userCode: string;
+    /** Carries the code, so nobody types it. */
+    approveUrl: string;
+    expiresInSeconds: number;
+    intervalSeconds: number;
+};
+/** RFC 8628 §3.2: the floor, and the default when none is served. */
+export declare const DEFAULT_INTERVAL_SECONDS = 5;
+/** The install id goes with the request: the approving browser may be on a phone and cannot know which machine asked. */
+export declare const startSignIn: (api: string, installId: string, client: string, name: string) => Promise<StartedSignIn>;
+export type PollOutcome = {
+    type: "token";
+    token: string;
+    claimed: number | undefined;
+} | {
+    type: "pending";
+} | {
+    type: "slow_down";
+    intervalSeconds: number | undefined;
+} | {
+    type: "denied";
+} | {
+    type: "expired";
+};
+export declare const pollSignIn: (api: string, deviceCode: string) => Promise<PollOutcome>;
+/**
+ * Must match the app's hash. Duplicated on purpose: asking the app for ours
+ * would put the install id in a URL.
+ */
+export declare const installHash: (installId: string) => string;
+/** `unknown`: this machine has no install id to look up. */
+export type MachineState = "linked" | "revoked" | "unlinked" | "unknown";
+export type SignInCheck = {
+    type: "live";
+    machine: MachineState;
+} | {
+    type: "rejected";
+}
+/** The app could not be asked; says nothing about the credential. */
+ | {
+    type: "unknown";
+    why: string;
+};
+/**
+ * `/api/machines` also answers whether this machine is linked. A store without
+ * accounts reads as `unknown`, never as a revoked credential.
+ */
+export declare const checkSignIn: (api: string, token: string, ourInstallId: string | undefined) => Promise<SignInCheck>;
+/** Undefined on any failure: the sign-in already succeeded and the email is only for the greeting. */
+export declare const whoAmI: (api: string, token: string) => Promise<string | undefined>;
+/**
+ * Unlike `whoAmI`, keeps a dead token (`ended`) apart from an unreachable store
+ * (`unknown`), which the sign-in flow will report itself.
+ */
+export type Session = {
+    type: "active";
+    email: string;
+} | {
+    type: "ended";
+} | {
+    type: "unknown";
+};
+export declare const checkSession: (api: string, token: string) => Promise<Session>;
+export type SignOut = "ended" | "already" | {
+    type: "unreachable";
+    why: string;
+};
+/**
+ * Ends the session and leaves the machine linked (`DELETE /api/machines/{id}`
+ * would unlink it). Unreachable is not thrown: the caller forgets the token
+ * locally either way.
+ */
+export declare const endSession: (api: string, token: string) => Promise<SignOut>;
+//# sourceMappingURL=account.d.ts.map

package/dist/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAsFA,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,yHAAyH;AACzH,eAAO,MAAM,WAAW,QACjB,MAAM,aACA,MAAM,UACT,MAAM,QACR,MAAM,KACX,OAAO,CAAC,aAAa,CAkCvB,CAAC;AAaF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,eAAO,MAAM,UAAU,QAAe,MAAM,cAAc,MAAM,KAAG,OAAO,CAAC,WAAW,CA8BrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAe,MAAM,KAAG,MACc,CAAC;AAM/D,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,qEAAqE;GACnE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,WAAW,QACjB,MAAM,SACJ,MAAM,gBACC,MAAM,GAAG,SAAS,KAC/B,OAAO,CAAC,WAAW,CAwBrB,CAAC;AAIF,sGAAsG;AACtG,eAAO,MAAM,MAAM,QAAe,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAQnF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,eAAO,MAAM,YAAY,QAAe,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAe9E,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,UAAU,QAAe,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAW5E,CAAC"}

package/dist/account.js

@@ -0,0 +1,211 @@
+/**
+ * Sign-in is the OAuth 2.0 device grant (RFC 8628), the one flow that works
+ * over SSH and in containers. Its wire codes are the RFC's, not this CLI's.
+ */
+import { z } from "zod";
+import { createHash } from "node:crypto";
+import { assertNever } from "@coldtea/pr-lens-schema";
+import { CLI_VERSION } from "./version.js";
+import { PrLensCliError } from "./errors.js";
+const REQUEST_TIMEOUT_MS = 30_000;
+const hostOf = (api) => new URL(api).host;
+const unavailable = (api, details, status) => new PrLensCliError("APP_UNAVAILABLE", status === undefined
+    ? `${hostOf(api)} did not answer`
+    : `${hostOf(api)} answered ${status}`, details);
+const parseJson = (text) => {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+const send = async (api, path, init) => {
+    const headers = {
+        accept: "application/json",
+        "user-agent": `pr-lens-cli/${CLI_VERSION}`,
+    };
+    if (init.token !== undefined)
+        headers.authorization = `Bearer ${init.token}`;
+    if (init.body !== undefined)
+        headers["content-type"] = "application/json";
+    const response = await fetch(`${api}${path}`, {
+        method: init.method,
+        headers,
+        body: init.body === undefined ? undefined : JSON.stringify(init.body),
+        // A redirect would carry the token to whatever host answered.
+        redirect: "manual",
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    }).catch(() => {
+        // The runtime's message leaks addresses and internals.
+        throw unavailable(api, "check the address and the connection, then try again");
+    });
+    if (response.status >= 300 && response.status < 400)
+        throw unavailable(api, "this address redirects, and the sign-in routes must answer directly", response.status);
+    const text = await response.text().catch(() => {
+        throw unavailable(api, "the answer was cut off; check the connection, then try again", response.status);
+    });
+    return { status: response.status, body: parseJson(text) };
+};
+/** Refusals outside the device flow use the app's own envelope. */
+const Refusal = z.object({
+    error: z.looseObject({ code: z.string(), message: z.string() }),
+});
+const Started = z.object({
+    device_code: z.string().min(1),
+    user_code: z.string().min(1),
+    verification_uri: z.string().min(1),
+    verification_uri_complete: z.string().min(1).optional(),
+    expires_in: z.number().int().positive(),
+    interval: z.number().int().nonnegative().optional(),
+});
+/** RFC 8628 §3.2: the floor, and the default when none is served. */
+export const DEFAULT_INTERVAL_SECONDS = 5;
+/** The install id goes with the request: the approving browser may be on a phone and cannot know which machine asked. */
+export const startSignIn = async (api, installId, client, name) => {
+    const answer = await send(api, "/api/device/code", {
+        method: "POST",
+        body: { install_id: installId, client, name },
+    });
+    if (answer.status !== 200) {
+        const refused = Refusal.safeParse(answer.body);
+        const code = refused.success ? refused.data.error.code : undefined;
+        // Twenty codes an hour per address. Usually a retry after a typo, so say what to do next.
+        throw code === "RATE_LIMITED"
+            ? new PrLensCliError("APP_UNAVAILABLE", `${hostOf(api)} has handed this machine enough sign-in codes for now`, "it goes by the hour, so a short wait clears it; the sign-in you already have is unaffected")
+            : unavailable(api, refused.success ? refused.data.error.message : "the answer was not in the shape the sign-in expects", answer.status);
+    }
+    const started = Started.safeParse(answer.body);
+    if (!started.success)
+        throw unavailable(api, "the answer was not in the shape the sign-in expects", answer.status);
+    return {
+        deviceCode: started.data.device_code,
+        userCode: started.data.user_code,
+        approveUrl: started.data.verification_uri_complete ?? started.data.verification_uri,
+        expiresInSeconds: started.data.expires_in,
+        intervalSeconds: started.data.interval ?? DEFAULT_INTERVAL_SECONDS,
+    };
+};
+/** `claimed` is an app extension (RFC 6749 §5.1 allows it); optional so a sign-in never fails over it. */
+const Granted = z.object({
+    access_token: z.string().min(1),
+    claimed: z.coerce.number().int().min(0).optional(),
+});
+const Pending = z.object({
+    error: z.enum(["authorization_pending", "slow_down", "access_denied", "expired_token"]),
+    interval: z.number().int().nonnegative().optional(),
+});
+export const pollSignIn = async (api, deviceCode) => {
+    const answer = await send(api, "/api/device/token", {
+        method: "POST",
+        body: { device_code: deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" },
+    });
+    if (answer.status === 200) {
+        const granted = Granted.safeParse(answer.body);
+        if (!granted.success)
+            throw unavailable(api, "the sign-in was approved and the answer carried no token", answer.status);
+        return { type: "token", token: granted.data.access_token, claimed: granted.data.claimed };
+    }
+    const pending = Pending.safeParse(answer.body);
+    if (!pending.success)
+        // Includes `invalid_request`, which waiting will not fix.
+        throw unavailable(api, "the answer was not one the device flow defines", answer.status);
+    switch (pending.data.error) {
+        case "authorization_pending":
+            return { type: "pending" };
+        case "slow_down":
+            return { type: "slow_down", intervalSeconds: pending.data.interval };
+        case "access_denied":
+            return { type: "denied" };
+        case "expired_token":
+            return { type: "expired" };
+        default:
+            return assertNever(pending.data.error, "Unhandled device flow answer");
+    }
+};
+/**
+ * Must match the app's hash. Duplicated on purpose: asking the app for ours
+ * would put the install id in a URL.
+ */
+export const installHash = (installId) => createHash("sha256").update(installId, "utf8").digest("hex");
+const Machines = z.object({
+    machines: z.array(z.object({ id: z.string(), revoked: z.boolean() })),
+});
+/**
+ * `/api/machines` also answers whether this machine is linked. A store without
+ * accounts reads as `unknown`, never as a revoked credential.
+ */
+export const checkSignIn = async (api, token, ourInstallId) => {
+    let answer;
+    try {
+        answer = await send(api, "/api/machines", { method: "GET", token });
+    }
+    catch (error) {
+        if (!(error instanceof PrLensCliError))
+            throw error;
+        return { type: "unknown", why: error.message };
+    }
+    if (answer.status === 401 || answer.status === 403)
+        return { type: "rejected" };
+    const machines = Machines.safeParse(answer.body);
+    if (!machines.success)
+        return { type: "unknown", why: `${hostOf(api)} answered ${answer.status}, which this CLI cannot read` };
+    if (ourInstallId === undefined)
+        return { type: "live", machine: "unknown" };
+    const ours = installHash(ourInstallId);
+    const machine = machines.data.machines.find((entry) => entry.id === ours);
+    return {
+        type: "live",
+        machine: machine === undefined ? "unlinked" : machine.revoked ? "revoked" : "linked",
+    };
+};
+const Account = z.object({ email: z.string().min(3) });
+/** Undefined on any failure: the sign-in already succeeded and the email is only for the greeting. */
+export const whoAmI = async (api, token) => {
+    try {
+        const answer = await send(api, "/api/account", { method: "GET", token });
+        const account = Account.safeParse(answer.body);
+        return answer.status === 200 && account.success ? account.data.email : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const checkSession = async (api, token) => {
+    let answer;
+    try {
+        answer = await send(api, "/api/account", { method: "GET", token });
+    }
+    catch {
+        return { type: "unknown" };
+    }
+    // Any other status is an outage, not evidence about the credential.
+    if (answer.status === 401 || answer.status === 403)
+        return { type: "ended" };
+    const account = Account.safeParse(answer.body);
+    return answer.status === 200 && account.success
+        ? { type: "active", email: account.data.email }
+        : { type: "unknown" };
+};
+/**
+ * Ends the session and leaves the machine linked (`DELETE /api/machines/{id}`
+ * would unlink it). Unreachable is not thrown: the caller forgets the token
+ * locally either way.
+ */
+export const endSession = async (api, token) => {
+    try {
+        const answer = await send(api, "/api/session", { method: "DELETE", token });
+        if (answer.status === 200)
+            return "ended";
+        // No such route, or the token was already dead.
+        if (answer.status === 404 || answer.status === 401)
+            return "already";
+        return { type: "unreachable", why: `${hostOf(api)} answered ${answer.status}` };
+    }
+    catch (error) {
+        if (!(error instanceof PrLensCliError))
+            throw error;
+        return { type: "unreachable", why: error.message };
+    }
+};
+//# sourceMappingURL=account.js.map

package/dist/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAE1D,MAAM,WAAW,GAAG,CAClB,GAAW,EACX,OAAe,EACf,MAAe,EACC,EAAE,CAClB,IAAI,cAAc,CAChB,iBAAiB,EACjB,MAAM,KAAK,SAAS;IAClB,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB;IACjC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,EACvC,OAAO,CACR,CAAC;AAIJ,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,EAChB,GAAW,EACX,IAAY,EACZ,IAA2E,EAC1D,EAAE;IACnB,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,eAAe,WAAW,EAAE;KAC3C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;QAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACrE,8DAA8D;QAC9D,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAChD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACZ,uDAAuD;QACvD,MAAM,WAAW,CAAC,GAAG,EAAE,sDAAsD,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QACjD,MAAM,WAAW,CAAC,GAAG,EAAE,qEAAqE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAC5C,MAAM,WAAW,CAAC,GAAG,EAAE,8DAA8D,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,CAAC;AAEF,mEAAmE;AACnE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAWH,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,yHAAyH;AACzH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,GAAW,EACX,SAAiB,EACjB,MAAc,EACd,IAAY,EACY,EAAE;IAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,0FAA0F;QAC1F,MAAM,IAAI,KAAK,cAAc;YAC3B,CAAC,CAAC,IAAI,cAAc,CAChB,iBAAiB,EACjB,GAAG,MAAM,CAAC,GAAG,CAAC,uDAAuD,EACrE,4FAA4F,CAC7F;YACH,CAAC,CAAC,WAAW,CACT,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,EACpG,MAAM,CAAC,MAAM,CACd,CAAC;IACR,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,OAAO;QAClB,MAAM,WAAW,CAAC,GAAG,EAAE,qDAAqD,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/F,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;QACpC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;QAChC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,gBAAgB;QACnF,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;QACzC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,wBAAwB;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF,0GAA0G;AAC1G,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,UAAkB,EAAwB,EAAE;IACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,8CAA8C,EAAE;KAC9F,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,OAAO;YAClB,MAAM,WAAW,CAAC,GAAG,EAAE,0DAA0D,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,OAAO;QAClB,0DAA0D;QAC1D,MAAM,WAAW,CAAC,GAAG,EAAE,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE1F,QAAQ,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvE,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B;YACE,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAU,EAAE,CACvD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE/D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CACtE,CAAC,CAAC;AAWH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,GAAW,EACX,KAAa,EACb,YAAgC,EACV,EAAE;IACxB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAEhF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,OAAO;QACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,8BAA8B,EAAE,CAAC;IAE1G,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAE1E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;KACrF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEvD,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,KAAa,EAA+B,EAAE;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAE,KAAa,EAAoB,EAAE;IACjF,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAE7E,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO;QAC7C,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;QAC/C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1B,CAAC,CAAC;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,KAAa,EAAoB,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,OAAO,CAAC;QAC1C,gDAAgD;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;AACH,CAAC,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Read with `||`, never `??`: the Action sets it to "" when no token was
+ * given, since Actions cannot omit an `env` key conditionally.
+ */
+export declare const TOKEN_ENV = "PR_LENS_TOKEN";
+export declare const authPath: (env: Record<string, string | undefined>, api: string) => string | undefined;
+export type Credential = {
+    token: string;
+    signedInAt: string | undefined;
+};
+/**
+ * An unreadable file is kept apart from a missing one and never deleted here:
+ * it may hold a working token. Only `auth logout` removes it.
+ */
+export type CredentialRead = {
+    type: "credential";
+    path: string;
+    credential: Credential;
+} | {
+    type: "none";
+} | {
+    type: "unreadable";
+    path: string;
+    why: string;
+};
+export declare const readCredential: (env: Record<string, string | undefined>, api: string) => Promise<CredentialRead>;
+/** Every failure answers undefined, so a push never starts failing over an account. */
+export declare const readToken: (env: Record<string, string | undefined>, api: string) => Promise<string | undefined>;
+/**
+ * For account commands, which must tell an unreadable file apart from being
+ * signed out rather than advise signing in again.
+ */
+export declare const requireToken: (env: Record<string, string | undefined>, api: string) => Promise<string>;
+export declare const writeCredential: (env: Record<string, string | undefined>, api: string, token: string, now: string) => Promise<string>;
+/**
+ * The only place that removes the file, readable or not. No read first: a
+ * sign-in from another shell in between would be thrown away unseen.
+ */
+export declare const forgetCredential: (env: Record<string, string | undefined>, api: string) => Promise<boolean>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAIzC,eAAO,MAAM,QAAQ,QACd,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,KACV,MAAM,GAAG,SAA8C,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAiCtD,eAAO,MAAM,cAAc,QACpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,KACV,OAAO,CAAC,cAAc,CAiBxB,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,SAAS,QACf,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAM5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAClB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,KACV,OAAO,CAAC,MAAM,CA2BhB,CAAC;AAEF,eAAO,MAAM,eAAe,QACrB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,SACJ,MAAM,OACR,MAAM,KACV,OAAO,CAAC,MAAM,CAWhB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QACtB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,OAClC,MAAM,KACV,OAAO,CAAC,OAAO,CAejB,CAAC"}

package/dist/auth.js

@@ -0,0 +1,121 @@
+/**
+ * The sign-in credential on disk, one file per store so a token never reaches
+ * the wrong one. A file per origin also means two shells signing in at once
+ * can only race on the same origin, where the last write wins correctly.
+ * `0600` on the file, `0700` on the directory: the file names reveal which
+ * stores this person signs in to.
+ */
+import { dirname } from "node:path";
+import { mkdir, readFile, rm } from "node:fs/promises";
+import { assertNever } from "@coldtea/pr-lens-schema";
+import { PrLensCliError } from "./errors.js";
+import { writeSecretJsonFile } from "./io.js";
+import { originPath } from "./config-home.js";
+const CREDENTIALS = "auth";
+/**
+ * Read with `||`, never `??`: the Action sets it to "" when no token was
+ * given, since Actions cannot omit an `env` key conditionally.
+ */
+export const TOKEN_ENV = "PR_LENS_TOKEN";
+const ACCOUNT_TOKEN = /^prl_u_[A-Za-z0-9_-]{22}$/;
+export const authPath = (env, api) => originPath(env, CREDENTIALS, api);
+const describe = (error) => error instanceof Error ? error.message : String(error);
+const missing = (error) => typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    error.code === "ENOENT";
+const credentialIn = (text) => {
+    const contents = (() => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (typeof contents !== "object" || contents === null)
+        return undefined;
+    const { token, signedInAt } = contents;
+    if (typeof token !== "string" || !ACCOUNT_TOKEN.test(token))
+        return undefined;
+    return {
+        token,
+        signedInAt: typeof signedInAt === "string" ? signedInAt : undefined,
+    };
+};
+export const readCredential = async (env, api) => {
+    const path = authPath(env, api);
+    if (path === undefined)
+        return { type: "none" };
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch (error) {
+        return missing(error)
+            ? { type: "none" }
+            : { type: "unreadable", path, why: describe(error) };
+    }
+    const credential = credentialIn(text);
+    return credential === undefined
+        ? { type: "unreadable", path, why: "it holds no token this CLI can read" }
+        : { type: "credential", path, credential };
+};
+/** Every failure answers undefined, so a push never starts failing over an account. */
+export const readToken = async (env, api) => {
+    const given = env[TOKEN_ENV];
+    if (given)
+        return given;
+    const stored = await readCredential(env, api);
+    return stored.type === "credential" ? stored.credential.token : undefined;
+};
+/**
+ * For account commands, which must tell an unreadable file apart from being
+ * signed out rather than advise signing in again.
+ */
+export const requireToken = async (env, api) => {
+    const given = env[TOKEN_ENV];
+    if (given)
+        return given;
+    const host = new URL(api).host;
+    const stored = await readCredential(env, api);
+    switch (stored.type) {
+        case "credential":
+            return stored.credential.token;
+        case "unreadable":
+            throw new PrLensCliError("UNREADABLE_FILE", `the sign-in for ${host} cannot be read`, [
+                `${stored.path}: ${stored.why}`,
+                "pr-lens auth logout clears it, and then auth login writes a fresh one",
+            ].join("\n"));
+        case "none":
+            throw new PrLensCliError("AUTH_REQUIRED", `not signed in to ${host}`, "pr-lens auth login");
+        default:
+            return assertNever(stored, "Unhandled credential read");
+    }
+};
+export const writeCredential = async (env, api, token, now) => {
+    const path = authPath(env, api);
+    if (path === undefined)
+        throw new PrLensCliError("UNREADABLE_FILE", "there is no home directory to keep this sign-in in", "set HOME, or XDG_CONFIG_HOME, to somewhere this machine can write");
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    return writeSecretJsonFile(path, { api, token, signedInAt: now });
+};
+/**
+ * The only place that removes the file, readable or not. No read first: a
+ * sign-in from another shell in between would be thrown away unseen.
+ */
+export const forgetCredential = async (env, api) => {
+    const path = authPath(env, api);
+    if (path === undefined)
+        return false;
+    try {
+        await rm(path);
+        return true;
+    }
+    catch (error) {
+        if (missing(error))
+            return false;
+        throw new PrLensCliError("UNREADABLE_FILE", `cannot remove ${path}`, describe(error));
+    }
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,GAAuC,EACvC,GAAW,EACS,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAa3D,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE,CAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE,CAC1C,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,MAAM,IAAI,KAAK;IACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,IAAY,EAA0B,EAAE;IAC5D,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAExE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,QAG7B,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,OAAO;QACL,KAAK;QACL,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,GAAuC,EACvC,GAAW,EACc,EAAE;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEhD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,KAAK,CAAC;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,qCAAqC,EAAE;QAC1E,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,GAAuC,EACvC,GAAW,EACkB,EAAE;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAuC,EACvC,GAAW,EACM,EAAE;IACnB,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QACjC,KAAK,YAAY;YACf,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,mBAAmB,IAAI,iBAAiB,EACxC;gBACE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,EAAE;gBAC/B,uEAAuE;aACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,KAAK,MAAM;YACT,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,oBAAoB,IAAI,EAAE,EAC1B,oBAAoB,CACrB,CAAC;QACJ;YACE,OAAO,WAAW,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,GAAuC,EACvC,GAAW,EACX,KAAa,EACb,GAAW,EACM,EAAE;IACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,oDAAoD,EACpD,mEAAmE,CACpE,CAAC;IAEJ,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAuC,EACvC,GAAW,EACO,EAAE;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,iBAAiB,IAAI,EAAE,EACvB,QAAQ,CAAC,KAAK,CAAC,CAChB,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/canvas/api.d.ts

@@ -54,7 +54,8 @@ export type Rotated = z.infer<typeof Rotated>;
 export type Fetched = Omit<z.infer<typeof Fetched>, "document"> & {
     document: GraphDoc;
 };
-export declare const mintCanvas: (api: string) => Promise<Minted>;
+/** The bearer is how CI attributes a mint: a runner's install id is never linked. */
+export declare const mintCanvas: (api: string, install: string | undefined, token: string | undefined) => Promise<Minted>;
 export declare const fetchCanvas: (api: string, id: string) => Promise<Fetched>;
 export declare const pushCanvas: (api: string, id: string, token: string, rev: number, document: GraphDoc) => Promise<Pushed>;
 /** A rotation onto itself changes nothing and is answered "rotated" only for the current token. */
@@ -65,5 +66,38 @@ export declare const deleteCanvas: (api: string, id: string, token: string) => P
     id: string;
     deleted: true;
 }>;
+/** An unreadable revision must not read as an empty canvas. */
+declare const Preview: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"drawn">;
+    title: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"not_drawn">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"unreadable">;
+}, z.core.$strip>], "type">;
+declare const Owned: z.ZodObject<{
+    id: z.ZodString;
+    rev: z.ZodNumber;
+    preview: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"drawn">;
+        title: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"not_drawn">;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"unreadable">;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>;
+export type CanvasPreview = z.infer<typeof Preview>;
+export type OwnedCanvas = z.infer<typeof Owned>;
+/**
+ * Carries no write tokens: the app keeps only their hashes. A store without
+ * accounts 404s here, which reads as unavailable, not as a missing canvas.
+ */
+export declare const listOwnedCanvases: (api: string, token: string) => Promise<OwnedCanvas[]>;
+/**
+ * The account token takes the header, so the write tokens go in the body.
+ * The caller mints the next token so a lost answer can be replayed.
+ */
+export declare const claimCanvas: (api: string, id: string, accountToken: string, writeToken: string, nextWriteToken: string) => Promise<Rotated>;
 export {};
 //# sourceMappingURL=api.d.ts.map

package/dist/canvas/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/canvas/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAmBjC,QAAA,MAAM,MAAM;;;;;;;iBAOV,CAAC;AAEH,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;iBAOX,CAAC;AAEH,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;iBAOV,CAAC;AAEH,QAAA,MAAM,OAAO;;;iBAAoD,CAAC;AAElE,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,EAAE,UAAU,CAAC,GAAG;IAChE,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC;AAkLF,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CACwB,CAAC;AAEhF,eAAO,MAAM,WAAW,QACjB,MAAM,MACP,MAAM,KACT,OAAO,CAAC,OAAO,CAgBjB,CAAC;AAEF,eAAO,MAAM,UAAU,QAChB,MAAM,MACP,MAAM,SACH,MAAM,OACR,MAAM,YACD,QAAQ,KACjB,OAAO,CAAC,MAAM,CAYd,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,QACtB,MAAM,MACP,MAAM,SACH,MAAM,KACZ,OAAO,CAAC,OAAO,CAQf,CAAC;AAEJ,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAClB,MAAM,MACP,MAAM,SACH,MAAM,aACF,MAAM,KAChB,OAAO,CAAC,OAAO,CAWf,CAAC;AAEJ,eAAO,MAAM,YAAY,QAClB,MAAM,MACP,MAAM,SACH,MAAM,KACZ,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAKrC,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/canvas/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAmBjC,QAAA,MAAM,MAAM;;;;;;;iBAOV,CAAC;AAEH,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;iBAOX,CAAC;AAEH,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;iBAOV,CAAC;AAEH,QAAA,MAAM,OAAO;;;iBAAoD,CAAC;AAElE,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,EAAE,UAAU,CAAC,GAAG;IAChE,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC;AAkOF,qFAAqF;AACrF,eAAO,MAAM,UAAU,QAChB,MAAM,WACF,MAAM,GAAG,SAAS,SACpB,MAAM,GAAG,SAAS,KACxB,OAAO,CAAC,MAAM,CAKd,CAAC;AAEJ,eAAO,MAAM,WAAW,QACjB,MAAM,MACP,MAAM,KACT,OAAO,CAAC,OAAO,CAgBjB,CAAC;AAEF,eAAO,MAAM,UAAU,QAChB,MAAM,MACP,MAAM,SACH,MAAM,OACR,MAAM,YACD,QAAQ,KACjB,OAAO,CAAC,MAAM,CAYd,CAAC;AAEJ,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,QACtB,MAAM,MACP,MAAM,SACH,MAAM,KACZ,OAAO,CAAC,OAAO,CAQf,CAAC;AAEJ,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAClB,MAAM,MACP,MAAM,SACH,MAAM,aACF,MAAM,KAChB,OAAO,CAAC,OAAO,CAWf,CAAC;AAEJ,eAAO,MAAM,YAAY,QAClB,MAAM,MACP,MAAM,SACH,MAAM,KACZ,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAKrC,CAAC;AAEJ,+DAA+D;AAC/D,QAAA,MAAM,OAAO;;;;;;;2BAIX,CAAC;AAEH,QAAA,MAAM,KAAK;;;;;;;;;;;iBAIT,CAAC;AAIH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AACpD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QACvB,MAAM,SACJ,MAAM,KACZ,OAAO,CAAC,WAAW,EAAE,CAKY,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,WAAW,QACjB,MAAM,MACP,MAAM,gBACI,MAAM,cACR,MAAM,kBACF,MAAM,KACrB,OAAO,CAAC,OAAO,CAWf,CAAC"}