@coswic/aipay 0.1.0 → 0.2.0

package/dist/commands/test.js

@@ -1,159 +0,0 @@
-/**
- * `aipay test [--model <id>] [--no-open] [--timeout <s>] [--json]`
- *
- * The one check only a CLI can do end to end: a real sign-in through the AI-Pay
- * authorization server on the registered loopback callback, then one chat completion
- * on the user's behalf. The receipt in the response is the proof (and the Console's
- * verify step turns green from the server-side facts). Tokens live in memory only.
- */
-import { AIPayClient, AuthorizationError, ConnectError, createConnectUrl, getUserInfo, handleCallback, InsufficientBalanceError, } from '@coswic/aipay-sdk';
-import { flagBool, flagString } from '../args.js';
-import { openBrowser } from '../browser.js';
-import { GATE_ENV, gatedFetch, looksGated } from '../gate.js';
-import { parseCallback, portIsVariable, redirectUriFor, startLoopback } from '../loopback.js';
-import { CliError, EXIT } from '../output.js';
-import { readProject } from '../project.js';
-import { GATE_HINT } from '../remote.js';
-import { reportSetupEvent } from '../setup-events.js';
-export async function runTest(args, out, deps = {}) {
-    const env = deps.env ?? process.env;
-    const dir = flagString(args.flags, 'dir') ?? '.';
-    const project = readProject(dir);
-    if (!project)
-        throw new CliError('not_linked', 'this directory is not linked to an app — run `aipay init --app <client_id> ...` first', EXIT.problem);
-    const timeoutS = Number(flagString(args.flags, 'timeout') ?? '300');
-    const fetchImpl = gatedFetch(env);
-    const target = parseCallback(project.callback);
-    // 127.0.0.1: the authorization server ignores the port for loopback redirect URIs
-    // (RFC 8252 §7.3), so the CLI takes any free port and your dev server can keep running.
-    // localhost / explicit --port: bind exactly that port.
-    const portFlag = flagString(args.flags, 'port');
-    const bindPort = portFlag ? Number(portFlag) : portIsVariable(target) ? 0 : target.port;
-    const loop = await startLoopback({ ...target, port: bindPort }, { timeoutMs: timeoutS * 1000 }).catch((e) => {
-        if (e.code === 'EADDRINUSE')
-            throw new CliError('port_busy', `port ${bindPort} is in use — stop what is listening there, or pass --port <free port>`, EXIT.problem);
-        throw e;
-    });
-    const redirectUri = redirectUriFor(target, loop.port);
-    const cfg = { hydraPublicUrl: project.auth_origin, clientId: project.app.client_id, redirectUri };
-    const { url, state, codeVerifier } = await createConnectUrl(cfg);
-    const note = redirectUri === project.callback
-        ? ''
-        : ` (registered: ${project.callback}; the port is not compared for 127.0.0.1)`;
-    out.line('info', `listening on ${redirectUri}${note}`);
-    out.line('info', `sign in here (opens in your browser):\n\n  ${url}\n`);
-    deps.onAuthorizeUrl?.(url);
-    if (out.json)
-        out.debug(`authorize_url ${url}`); // --json keeps stdout for the result; drivers read this
-    if (flagBool(args.flags, 'open', true))
-        (deps.open ?? openBrowser)(url);
-    const result = {
-        ok: false,
-        app: project.app,
-        signin: null,
-        completion: null,
-    };
-    try {
-        const cb = await loop.waitForCallback;
-        let tokens;
-        try {
-            tokens = await handleCallback(cfg, cb.url, { state, codeVerifier }, { fetchImpl });
-        }
-        catch (e) {
-            if (e instanceof ConnectError)
-                throw new CliError('signin_failed', `sign-in failed: ${e.message}${e.body ? ` — ${e.body}` : ''}`, EXIT.remote);
-            throw e;
-        }
-        const user = await getUserInfo(cfg, tokens.accessToken, { fetchImpl });
-        result.signin = {
-            sub: user.sub,
-            email: user.email ?? null,
-            scope: tokens.scope,
-            expires_in: tokens.expiresInSeconds,
-        };
-        out.line('ok', `signed in: ${user.email ?? user.sub} (scope: ${tokens.scope || '—'})`);
-        const client = new AIPayClient({
-            baseUrl: project.api_base,
-            accessToken: tokens.accessToken,
-            fetchImpl,
-        });
-        let model = flagString(args.flags, 'model');
-        if (!model) {
-            const models = await client.models.list().catch((e) => {
-                throw new CliError('models', `cannot list models: ${e.message}`, EXIT.remote);
-            });
-            model = pickModel(models.map((m) => m.id));
-            if (!model)
-                throw new CliError('models', 'no sellable model right now — pass --model <id>', EXIT.remote);
-        }
-        out.line('info', `calling ${model} …`);
-        try {
-            const res = await client.chat.completions.create({
-                model,
-                messages: [{ role: 'user', content: 'Reply with exactly one word: pong' }],
-                max_tokens: 8,
-            });
-            const r = res.aipay;
-            const charged = r.total_charged_uusd ?? r.cost_uusd;
-            result.completion = {
-                model: res.model,
-                text: res.choices[0]?.message.content ?? '',
-                request_id: r.request_id,
-                usage_event_id: r.usage_event_id,
-                charged_uusd: charged,
-                currency: r.currency,
-                usage: res.usage,
-            };
-            result.ok = true;
-            out.line('ok', `receipt: request_id ${r.request_id}, charged ${formatUusd(charged)} ${r.currency}`);
-            // C2 setup session：登入狀態下回報 test 通過（伺服器本來就看得到回執；這條是給 Console 的時間戳）
-            await reportSetupEvent(project.app.client_id, 'cli.test', { request_id: r.request_id, model: res.model, ok: true }, out, env);
-            out.line('ok', "done — the Console's verify step reads this from the server side");
-        }
-        catch (e) {
-            if (e instanceof InsufficientBalanceError) {
-                result.completion = { error: 'insufficient_balance' };
-                out.line('warn', 'signed in fine, but this account has no balance for a completion — top up in the Console and rerun');
-                out.result(result);
-                return EXIT.problem;
-            }
-            if (e instanceof AuthorizationError)
-                throw new CliError('unauthorized', `the API rejected the token: ${e.message}`, EXIT.remote);
-            throw e;
-        }
-        out.result(result);
-        return EXIT.ok;
-    }
-    catch (e) {
-        if (e instanceof CliError) {
-            result.error = { code: e.code, message: e.message };
-            out.line('bad', e.message);
-            out.result(result);
-            return e.exitCode;
-        }
-        const msg = e.message ?? String(e);
-        const gated = /404/.test(msg) && looksGated(404, '');
-        result.error = { code: 'failed', message: msg };
-        out.line('bad', gated ? `${msg}\n${GATE_HINT}` : msg);
-        if (!env[GATE_ENV])
-            out.line('info', `pilot: if this was a 404 with an empty body, export ${GATE_ENV} and retry`);
-        out.result(result);
-        return EXIT.remote;
-    }
-    finally {
-        await loop.close();
-    }
-}
-/** Cheapest sensible default: prefer a small/cheap model id if present, else the first. */
-export function pickModel(ids) {
-    if (!ids.length)
-        return null;
-    const cheap = ids.find((id) => /mini|flash|haiku|nano|small|8b|7b/i.test(id));
-    return cheap ?? ids[0];
-}
-export function formatUusd(uusd) {
-    const n = Number(uusd);
-    if (!Number.isFinite(n))
-        return `${uusd} µUSD`;
-    return `$${(n / 1_000_000).toFixed(6)}`;
-}

package/dist/commands/unlink.d.ts

@@ -1,5 +0,0 @@
-import { type ParsedArgs } from '../args.js';
-import { type Reporter } from '../output.js';
-export declare function runUnlink(args: ParsedArgs, out: Reporter): number;
-/** Drop our keys and the marker comment; keep everything else byte-for-byte. */
-export declare function stripEnvKeys(content: string, keys: string[]): string;

package/dist/commands/unlink.js

@@ -1,70 +0,0 @@
-/**
- * `aipay unlink [--dir] [--dry-run] [--json]` — forgets the link: removes
- * .aipay/project.json and our four keys from .env.local. Scaffolded code and the agent
- * guide are the developer's files now; they are listed, not deleted.
- */
-import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { flagBool, flagString } from '../args.js';
-import { EXIT } from '../output.js';
-import { ENV_FILE, ENV_KEYS, PROJECT_DIR, projectPath, readProject } from '../project.js';
-export function runUnlink(args, out) {
-    const dir = resolve(flagString(args.flags, 'dir') ?? '.');
-    const dryRun = flagBool(args.flags, 'dry-run');
-    const project = readProject(dir);
-    if (!project) {
-        out.line('info', 'nothing to unlink here');
-        out.result({ ok: true, unlinked: false, dir });
-        return EXIT.ok;
-    }
-    const removed = [];
-    const envPath = join(dir, ENV_FILE);
-    let envChanged = false;
-    if (existsSync(envPath)) {
-        const before = readFileSync(envPath, 'utf8');
-        const after = stripEnvKeys(before, Object.values(ENV_KEYS));
-        envChanged = after !== before;
-        if (envChanged && !dryRun)
-            writeFileSync(envPath, after);
-    }
-    if (!dryRun) {
-        rmSync(projectPath(dir));
-        try {
-            rmSync(join(dir, PROJECT_DIR), { recursive: false });
-        }
-        catch {
-            /* not empty (e.g. .aipay/local/) — leave it */
-        }
-    }
-    removed.push('.aipay/project.json');
-    out.line('ok', `${dryRun ? 'would remove' : 'removed'} .aipay/project.json`);
-    if (envChanged)
-        out.line('ok', `${dryRun ? 'would strip' : 'stripped'} AIPAY_* from ${ENV_FILE}`);
-    if (project.scaffold.files.length)
-        out.line('info', `kept your files: ${project.scaffold.files.join(', ')}, aipay-agent.md`);
-    out.result({
-        ok: true,
-        unlinked: !dryRun,
-        dry_run: dryRun,
-        dir,
-        removed,
-        env_stripped: envChanged,
-        kept: project.scaffold.files,
-    });
-    return EXIT.ok;
-}
-/** Drop our keys and the marker comment; keep everything else byte-for-byte. */
-export function stripEnvKeys(content, keys) {
-    const set = new Set(keys);
-    const lines = content.split(/\r?\n/);
-    const kept = lines.filter((line) => {
-        if (line.startsWith('# AI-Pay (written by `aipay init`'))
-            return false;
-        const m = /^\s*(?:export\s+)?([A-Z0-9_]+)\s*=/.exec(line);
-        return !(m && set.has(m[1]));
-    });
-    // collapse a trailing blank run left behind by the removed block
-    while (kept.length > 1 && kept[kept.length - 1] === '' && kept[kept.length - 2] === '')
-        kept.pop();
-    return kept.join('\n');
-}

package/dist/detect.d.ts

@@ -1,27 +0,0 @@
-import type { Framework } from './project.js';
-export type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
-export interface Detection {
-    packageManager: PackageManager | null;
-    framework: Framework | null;
-    hasPackageJson: boolean;
-    typescript: boolean;
-    /** Whether @coswic/aipay-sdk is already a dependency. */
-    sdkInstalled: boolean;
-    /** `src/` exists → scaffold under it, else project root. */
-    srcDir: string;
-}
-export interface PackageJsonLike {
-    packageManager?: string;
-    dependencies?: Record<string, string>;
-    devDependencies?: Record<string, string>;
-}
-export declare function detectPackageManager(pkg: PackageJsonLike | null, lockfiles: {
-    pnpm: boolean;
-    yarn: boolean;
-    bun: boolean;
-    npm: boolean;
-}): PackageManager | null;
-export declare function detectFramework(pkg: PackageJsonLike | null): Framework | null;
-export declare function detectProject(dir: string): Detection;
-/** The install command for the detected manager (printed in --dry-run, run otherwise). */
-export declare function installCommand(pm: PackageManager, pkgName: string): string[];

package/dist/detect.js

@@ -1,79 +0,0 @@
-/**
- * Project detection: package manager (from lockfile / packageManager field) and web
- * framework (from dependencies). Pure functions over the file contents so they are
- * unit-testable without a filesystem.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-export function detectPackageManager(pkg, lockfiles) {
-    const pm = pkg?.packageManager;
-    if (typeof pm === 'string') {
-        const name = pm.split('@')[0];
-        if (name === 'pnpm' || name === 'npm' || name === 'yarn' || name === 'bun')
-            return name;
-    }
-    if (lockfiles.pnpm)
-        return 'pnpm';
-    if (lockfiles.bun)
-        return 'bun';
-    if (lockfiles.yarn)
-        return 'yarn';
-    if (lockfiles.npm)
-        return 'npm';
-    return pkg ? 'npm' : null;
-}
-export function detectFramework(pkg) {
-    if (!pkg)
-        return null;
-    const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
-    if ('next' in deps)
-        return 'next';
-    if ('hono' in deps)
-        return 'hono';
-    if ('fastify' in deps)
-        return 'fastify';
-    if ('express' in deps)
-        return 'express';
-    return 'node';
-}
-export function detectProject(dir) {
-    const pkgPath = join(dir, 'package.json');
-    const hasPackageJson = existsSync(pkgPath);
-    let pkg = null;
-    if (hasPackageJson) {
-        try {
-            pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-        }
-        catch {
-            pkg = null;
-        }
-    }
-    const lockfiles = {
-        pnpm: existsSync(join(dir, 'pnpm-lock.yaml')),
-        yarn: existsSync(join(dir, 'yarn.lock')),
-        bun: existsSync(join(dir, 'bun.lockb')) || existsSync(join(dir, 'bun.lock')),
-        npm: existsSync(join(dir, 'package-lock.json')),
-    };
-    const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
-    return {
-        packageManager: detectPackageManager(pkg, lockfiles),
-        framework: detectFramework(pkg),
-        hasPackageJson,
-        typescript: 'typescript' in deps || existsSync(join(dir, 'tsconfig.json')),
-        sdkInstalled: '@coswic/aipay-sdk' in deps,
-        srcDir: existsSync(join(dir, 'src')) ? 'src' : '.',
-    };
-}
-/** The install command for the detected manager (printed in --dry-run, run otherwise). */
-export function installCommand(pm, pkgName) {
-    switch (pm) {
-        case 'pnpm':
-            return ['pnpm', 'add', pkgName];
-        case 'yarn':
-            return ['yarn', 'add', pkgName];
-        case 'bun':
-            return ['bun', 'add', pkgName];
-        default:
-            return ['npm', 'install', pkgName];
-    }
-}

package/dist/developer-api.d.ts

@@ -1,14 +0,0 @@
-import type { AuthStore, StoredAuth } from './auth-store.js';
-export interface ApiResult<T> {
-    status: number;
-    body: T;
-}
-export interface DeveloperApi {
-    auth: StoredAuth;
-    request<T = Record<string, unknown>>(method: string, path: string, opts?: {
-        body?: unknown;
-        headers?: Record<string, string>;
-    }): Promise<ApiResult<T>>;
-}
-export declare function openDeveloperApi(store: AuthStore, env?: NodeJS.ProcessEnv): Promise<DeveloperApi>;
-export declare function errorMessage(body: unknown, status: number): string;

package/dist/developer-api.js

@@ -1,74 +0,0 @@
-/**
- * Calls to the developer management API with the developer's own token (audience
- * aipay-developer-api). Refreshes once on 401 when a refresh token exists; the gate header
- * comes from the environment like everywhere else.
- */
-import { refreshAccessToken } from '@coswic/aipay-sdk';
-import { gatedFetch, looksGated } from './gate.js';
-import { CliError, EXIT } from './output.js';
-import { GATE_HINT } from './remote.js';
-export async function openDeveloperApi(store, env = process.env) {
-    let auth = store.load();
-    if (!auth)
-        throw new CliError('not_logged_in', 'not signed in — run `aipay login` first', EXIT.problem);
-    const f = gatedFetch(env);
-    if (auth.expires_at - 30_000 < Date.now())
-        auth = await refresh(store, auth, f);
-    const api = {
-        auth,
-        async request(method, path, opts = {}) {
-            const call = async (a) => f(new URL(path, a.api_base), {
-                method,
-                headers: {
-                    authorization: `Bearer ${a.access_token}`,
-                    ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
-                    ...(opts.headers ?? {}),
-                },
-                ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
-            });
-            let res = await call(api.auth);
-            if (res.status === 401 && api.auth.refresh_token) {
-                api.auth = await refresh(store, api.auth, f);
-                res = await call(api.auth);
-            }
-            const text = await res.text();
-            if (looksGated(res.status, text))
-                throw new CliError('gated', GATE_HINT, EXIT.remote);
-            if (res.status === 401)
-                throw new CliError('unauthorized', 'the API rejected the developer token — run `aipay login` again', EXIT.remote);
-            let body = null;
-            try {
-                body = text ? JSON.parse(text) : null;
-            }
-            catch {
-                body = { raw: text.slice(0, 500) };
-            }
-            return { status: res.status, body: body };
-        },
-    };
-    return api;
-}
-async function refresh(store, auth, fetchImpl) {
-    if (!auth.refresh_token)
-        throw new CliError('expired', 'the developer token expired — run `aipay login` again', EXIT.problem);
-    const t = await refreshAccessToken({
-        hydraPublicUrl: auth.auth_origin,
-        clientId: auth.client_id,
-    }, auth.refresh_token, { fetchImpl }).catch(() => {
-        throw new CliError('expired', 'could not renew the developer token — run `aipay login` again', EXIT.problem);
-    });
-    const next = {
-        ...auth,
-        access_token: t.accessToken,
-        refresh_token: t.refreshToken ?? auth.refresh_token,
-        expires_at: Date.now() + t.expiresInSeconds * 1000,
-        scope: t.scope || auth.scope,
-    };
-    store.save(next);
-    return next;
-}
-export function errorMessage(body, status) {
-    const b = (body ?? {});
-    const msg = typeof b.message === 'string' ? b.message : typeof b.error === 'string' ? b.error : '';
-    return msg ? `${msg} (HTTP ${status})` : `HTTP ${status}`;
-}

package/dist/gate.d.ts

@@ -1,13 +0,0 @@
-/**
- * Pilot gate: during the closed pilot, non-public paths answer 404 with an empty body
- * unless the request carries `X-AIPay-Gate: <token>` (or the browser cookie set by
- * `/__gate/<token>`). The CLI only ever reads the token from the environment — it is
- * never written to any file and never printed.
- */
-export declare const GATE_ENV = "AIPAY_GATE_TOKEN";
-export declare function gateHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
-/** fetch wrapper that adds the gate header; passed to the SDK as `fetchImpl`. */
-export declare function gatedFetch(env?: NodeJS.ProcessEnv): typeof fetch;
-/** Explain a 404-with-empty-body in gate terms (the SDK/API otherwise say "not found"). */
-export declare function looksGated(status: number, bodyText: string): boolean;
-export declare const GATE_HINT = "AI-Pay answered 404 with an empty body \u2014 that is the pilot gate, not a missing route. Set AIPAY_GATE_TOKEN in your environment (the value is in the Console next to the app) and retry. Do not put it in code or version control.";

package/dist/gate.js

@@ -1,29 +0,0 @@
-/**
- * Pilot gate: during the closed pilot, non-public paths answer 404 with an empty body
- * unless the request carries `X-AIPay-Gate: <token>` (or the browser cookie set by
- * `/__gate/<token>`). The CLI only ever reads the token from the environment — it is
- * never written to any file and never printed.
- */
-export const GATE_ENV = 'AIPAY_GATE_TOKEN';
-export function gateHeaders(env = process.env) {
-    const token = env[GATE_ENV];
-    return token ? { 'X-AIPay-Gate': token } : {};
-}
-/** fetch wrapper that adds the gate header; passed to the SDK as `fetchImpl`. */
-export function gatedFetch(env = process.env) {
-    const extra = gateHeaders(env);
-    if (!Object.keys(extra).length)
-        return fetch;
-    return (input, init) => {
-        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
-        for (const [k, v] of Object.entries(extra))
-            if (!headers.has(k))
-                headers.set(k, v);
-        return fetch(input, { ...init, headers });
-    };
-}
-/** Explain a 404-with-empty-body in gate terms (the SDK/API otherwise say "not found"). */
-export function looksGated(status, bodyText) {
-    return status === 404 && bodyText.trim() === '';
-}
-export const GATE_HINT = `AI-Pay answered 404 with an empty body — that is the pilot gate, not a missing route. Set ${GATE_ENV} in your environment (the value is in the Console next to the app) and retry. Do not put it in code or version control.`;

package/dist/index.d.ts

@@ -1,22 +0,0 @@
-/** Programmatic surface (used by tests and by anyone embedding the commands). */
-export { AGENT_GUIDE_FILE, agentGuide } from './agent-guide.js';
-export { type ParsedArgs, parseArgs } from './args.js';
-export { configDir, createAuthStore, fileStore, type StoredAuth } from './auth-store.js';
-export { createApp, runApps } from './commands/apps.js';
-export { collectChecks, runDoctor } from './commands/doctor.js';
-export { DEFAULT_CALLBACK, runInit, SDK_PACKAGE } from './commands/init.js';
-export { fetchCliConfig, managementAuthorizeUrl, resolveApiBase, runLogin, } from './commands/login.js';
-export { runLogout, runWhoami } from './commands/session.js';
-export { runStatus } from './commands/status.js';
-export { formatUusd, pickModel, runTest } from './commands/test.js';
-export { runUnlink, stripEnvKeys } from './commands/unlink.js';
-export { detectFramework, detectPackageManager, detectProject, installCommand } from './detect.js';
-export { openDeveloperApi } from './developer-api.js';
-export { GATE_ENV, gatedFetch, gateHeaders, looksGated } from './gate.js';
-export { parseCallback, startLoopback } from './loopback.js';
-export { main } from './main.js';
-export { CliError, createReporter, EXIT, type Reporter } from './output.js';
-export { ENV_KEYS, isProjectConfig, mergeEnvFile, mergeGitignore, type ProjectConfig, readProject, writeProject, } from './project.js';
-export { createRemote, docsUrl, type Remote } from './remote.js';
-export { scaffoldFiles, startPathFor } from './templates.js';
-export { cliVersion } from './version.js';

package/dist/index.js

@@ -1,22 +0,0 @@
-/** Programmatic surface (used by tests and by anyone embedding the commands). */
-export { AGENT_GUIDE_FILE, agentGuide } from './agent-guide.js';
-export { parseArgs } from './args.js';
-export { configDir, createAuthStore, fileStore } from './auth-store.js';
-export { createApp, runApps } from './commands/apps.js';
-export { collectChecks, runDoctor } from './commands/doctor.js';
-export { DEFAULT_CALLBACK, runInit, SDK_PACKAGE } from './commands/init.js';
-export { fetchCliConfig, managementAuthorizeUrl, resolveApiBase, runLogin, } from './commands/login.js';
-export { runLogout, runWhoami } from './commands/session.js';
-export { runStatus } from './commands/status.js';
-export { formatUusd, pickModel, runTest } from './commands/test.js';
-export { runUnlink, stripEnvKeys } from './commands/unlink.js';
-export { detectFramework, detectPackageManager, detectProject, installCommand } from './detect.js';
-export { openDeveloperApi } from './developer-api.js';
-export { GATE_ENV, gatedFetch, gateHeaders, looksGated } from './gate.js';
-export { parseCallback, startLoopback } from './loopback.js';
-export { main } from './main.js';
-export { CliError, createReporter, EXIT } from './output.js';
-export { ENV_KEYS, isProjectConfig, mergeEnvFile, mergeGitignore, readProject, writeProject, } from './project.js';
-export { createRemote, docsUrl } from './remote.js';
-export { scaffoldFiles, startPathFor } from './templates.js';
-export { cliVersion } from './version.js';

package/dist/loopback.d.ts

@@ -1,37 +0,0 @@
-/**
- * Loopback redirect receiver (RFC 8252 §7.3) for `aipay test`: listens on the exact
- * registered callback URI (host + port + path), captures ONE redirect, answers the
- * browser with a small HTML page, then closes. The authorization code never touches
- * disk; the token exchange happens in the caller's memory.
- */
-import { type Server } from 'node:http';
-export interface LoopbackTarget {
-    host: string;
-    port: number;
-    path: string;
-}
-/**
- * Hydra compares loopback redirect URIs per RFC 8252 §7.3: for 127.0.0.1 / [::1] the port
- * is ignored, so the CLI may receive the callback on any free port while the app keeps
- * its registered URI. `localhost` is NOT treated as loopback by the server — exact port.
- */
-export declare function portIsVariable(target: LoopbackTarget): boolean;
-/** The redirect_uri to send for a receiver bound to `port` (same host + path). */
-export declare function redirectUriFor(target: LoopbackTarget, port: number): string;
-export declare function parseCallback(callback: string): LoopbackTarget;
-export interface LoopbackResult {
-    /** Full callback URL as received (query included) — hand it to the SDK's handleCallback. */
-    url: string;
-}
-export interface LoopbackHandle {
-    /** Resolves with the first request on the callback path; rejects on timeout. */
-    waitForCallback: Promise<LoopbackResult>;
-    close(): Promise<void>;
-    server: Server;
-    /** Port actually bound (differs from target.port when target.port is 0 = ephemeral). */
-    port: number;
-}
-export declare function startLoopback(target: LoopbackTarget, opts?: {
-    timeoutMs?: number;
-    pageHtml?: (ok: boolean) => string;
-}): Promise<LoopbackHandle>;

package/dist/loopback.js

@@ -1,95 +0,0 @@
-/**
- * Loopback redirect receiver (RFC 8252 §7.3) for `aipay test`: listens on the exact
- * registered callback URI (host + port + path), captures ONE redirect, answers the
- * browser with a small HTML page, then closes. The authorization code never touches
- * disk; the token exchange happens in the caller's memory.
- */
-import { createServer } from 'node:http';
-/**
- * Hydra compares loopback redirect URIs per RFC 8252 §7.3: for 127.0.0.1 / [::1] the port
- * is ignored, so the CLI may receive the callback on any free port while the app keeps
- * its registered URI. `localhost` is NOT treated as loopback by the server — exact port.
- */
-export function portIsVariable(target) {
-    return target.host === '127.0.0.1' || target.host === '::1';
-}
-/** The redirect_uri to send for a receiver bound to `port` (same host + path). */
-export function redirectUriFor(target, port) {
-    const host = target.host === '::1' ? '[::1]' : target.host;
-    return `http://${host}:${port}${target.path}`;
-}
-export function parseCallback(callback) {
-    const u = new URL(callback);
-    if (u.protocol !== 'http:')
-        throw new Error(`callback must be http:// on a loopback host (got ${callback})`);
-    const host = u.hostname;
-    if (host !== '127.0.0.1' && host !== 'localhost' && host !== '[::1]' && host !== '::1')
-        throw new Error(`callback host must be a loopback address (got ${host})`);
-    const port = u.port ? Number(u.port) : 80;
-    return { host: host === '[::1]' ? '::1' : host, port, path: u.pathname || '/' };
-}
-export function startLoopback(target, opts = {}) {
-    const timeoutMs = opts.timeoutMs ?? 5 * 60_000;
-    const page = opts.pageHtml ?? defaultPage;
-    return new Promise((resolve, reject) => {
-        let settle = null;
-        let fail = null;
-        const waitForCallback = new Promise((res, rej) => {
-            settle = res;
-            fail = rej;
-        });
-        const server = createServer((req, res) => {
-            const addr = server.address();
-            const boundPort = typeof addr === 'object' && addr ? addr.port : target.port;
-            const url = new URL(req.url ?? '/', redirectUriFor(target, boundPort));
-            if (url.pathname !== target.path) {
-                res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
-                res.end('not the callback path');
-                return;
-            }
-            const ok = !url.searchParams.get('error');
-            res.writeHead(200, {
-                'content-type': 'text/html; charset=utf-8',
-                'cache-control': 'no-store',
-                'referrer-policy': 'no-referrer',
-            });
-            res.end(page(ok));
-            settle?.({ url: url.toString() });
-            settle = null;
-        });
-        const timer = setTimeout(() => {
-            fail?.(new Error(`no callback received within ${Math.round(timeoutMs / 1000)}s`));
-            fail = null;
-        }, timeoutMs);
-        server.on('error', (err) => {
-            clearTimeout(timer);
-            reject(err);
-        });
-        server.listen(target.port, target.host, () => {
-            const addr = server.address();
-            const port = typeof addr === 'object' && addr ? addr.port : target.port;
-            resolve({
-                waitForCallback,
-                server,
-                port,
-                close: () => new Promise((done) => {
-                    clearTimeout(timer);
-                    server.close(() => done());
-                    // Keep-alive connections would otherwise hold the process open.
-                    server.closeAllConnections?.();
-                }),
-            });
-        });
-    });
-}
-function defaultPage(ok) {
-    const title = ok ? 'AI-Pay: signed in' : 'AI-Pay: authorization failed';
-    const body = ok
-        ? 'You can close this tab and return to the terminal.'
-        : 'The terminal shows the error. You can close this tab.';
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title>
-<style>body{font:16px/1.5 system-ui,sans-serif;margin:0;display:grid;place-items:center;min-height:100vh;background:#f6f7f9;color:#1b1f24}
-main{padding:32px 40px;border-radius:12px;background:#fff;box-shadow:0 2px 12px rgba(0,0,0,.08);text-align:center}
-h1{font-size:20px;margin:0 0 8px}</style></head>
-<body><main><h1>${title}</h1><p>${body}</p></main></body></html>`;
-}