@cuna_labs/cli 0.1.0

package/dist/auth/browser.js

@@ -0,0 +1,47 @@
+import { spawn } from "node:child_process";
+import { isBoundedHttpsBrowserUrl } from "../core/browser-url.js";
+export function resolveBrowserCommand(platform, url, _environment = process.env) {
+    assertHttpsBrowserUrl(url);
+    if (platform === "win32") {
+        const systemRoot = _environment.SystemRoot ?? _environment.WINDIR ?? "C:\\Windows";
+        return {
+            executable: `${systemRoot}\\explorer.exe`,
+            args: [url],
+            cwd: systemRoot,
+        };
+    }
+    if (platform === "darwin") {
+        return { executable: "/usr/bin/open", args: [url], cwd: "/" };
+    }
+    if (platform === "linux")
+        return { executable: "/usr/bin/xdg-open", args: [url], cwd: "/" };
+    throw new Error("No browser opener is available for this platform.");
+}
+export function createBrowserOpener(platform = process.platform, environment = process.env) {
+    return Object.freeze({
+        open(url) {
+            assertHttpsBrowserUrl(url);
+            const command = resolveBrowserCommand(platform, url, environment);
+            return new Promise((resolve, reject) => {
+                const child = spawn(command.executable, [...command.args], {
+                    detached: true,
+                    stdio: "ignore",
+                    windowsHide: true,
+                    shell: false,
+                    cwd: command.cwd,
+                });
+                child.once("error", reject);
+                child.once("spawn", () => {
+                    child.unref();
+                    resolve();
+                });
+            });
+        },
+    });
+}
+function assertHttpsBrowserUrl(url) {
+    if (!isBoundedHttpsBrowserUrl(url)) {
+        throw new TypeError("Browser continuation URL must be bounded HTTPS without control characters.");
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/auth/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAYlE,MAAM,UAAU,qBAAqB,CACnC,QAAyB,EACzB,GAAW,EACX,eAAkC,OAAO,CAAC,GAAG;IAE7C,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,IAAI,aAAa,CAAC;QACnF,OAAO;YACL,UAAU,EAAE,GAAG,UAAU,gBAAgB;YACzC,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,GAAG,EAAE,UAAU;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC5F,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,cAAiC,OAAO,CAAC,GAAG;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,GAAW;YACd,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE;oBACzD,QAAQ,EAAE,IAAI;oBACd,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,IAAI;oBACjB,KAAK,EAAE,KAAK;oBACZ,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;IACpG,CAAC;AACH,CAAC"}

package/dist/auth/human-client.d.ts

@@ -0,0 +1,39 @@
+import type { HttpTransport } from "../api/http.js";
+import { type CliAuthBootstrap, type CliSignupCapability, type CliContinuationIssued, type CliIdentityContext, type CliIntentClass, type CliLoginCodeExchangeResult } from "./human-contracts.js";
+export interface HumanAuthClient {
+    bootstrap(signal?: AbortSignal): Promise<CliAuthBootstrap>;
+    signupCapability(signal?: AbortSignal): Promise<CliSignupCapability>;
+    createContinuation(input: {
+        readonly state: string;
+        readonly codeChallenge: string;
+        readonly redirectUri: string;
+        readonly clientInstanceId: string;
+        readonly profile: string;
+        readonly intentClass: CliIntentClass;
+        readonly browserOrigin: string;
+        readonly signal?: AbortSignal;
+    }): Promise<CliContinuationIssued>;
+    exchange(input: {
+        readonly id: string;
+        readonly clientInstanceId: string;
+        readonly profile: string;
+        readonly state: string;
+        readonly codeVerifier: string;
+        readonly redirectUri: string;
+        readonly loginCode: string;
+        /**
+         * A durable-code re-exchange must preserve the server-issued code expiry.
+         * It is optional for the first browser exchange because no local record
+         * exists yet to bind against.
+         */
+        readonly expectedLoginCodeExpiresAt?: string;
+        readonly signal?: AbortSignal;
+    }): Promise<CliLoginCodeExchangeResult>;
+    context(accessToken: string, signal?: AbortSignal): Promise<CliIdentityContext>;
+    logout(accessToken: string, signal?: AbortSignal): Promise<true>;
+}
+export declare function createHumanAuthClient(input: {
+    readonly anonymous: HttpTransport;
+    readonly authenticated: (accessToken: string) => HttpTransport;
+}): HumanAuthClient;
+//# sourceMappingURL=human-client.d.ts.map

package/dist/auth/human-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-client.d.ts","sourceRoot":"","sources":["../../src/auth/human-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,gBAAgB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,kBAAkB,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;QACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,aAAa,CAAC;CAChE,GAAG,eAAe,CA8DlB"}

package/dist/auth/human-client.js

@@ -0,0 +1,66 @@
+import { encodePublicId } from "../core/validation.js";
+import { decodeCliAuthBootstrap, decodeCliSignupCapability, decodeCliContinuationIssued, decodeCliIdentityContext, decodeCliLoginCodeExchangeResult, decodeRevocation, } from "./human-contracts.js";
+export function createHumanAuthClient(input) {
+    const client = {
+        async bootstrap(signal) {
+            return decodeCliAuthBootstrap(await input.anonymous.request({
+                method: "GET", path: "/v1/cli-auth/bootstrap", ...(signal === undefined ? {} : { signal }),
+            }));
+        },
+        async signupCapability(signal) {
+            return decodeCliSignupCapability(await input.anonymous.request({
+                method: "GET",
+                path: "/v1/cli-auth/signup-capability",
+                ...(signal === undefined ? {} : { signal }),
+            }));
+        },
+        async createContinuation(request) {
+            const response = await input.anonymous.request({
+                method: "POST",
+                path: "/v1/cli-auth/continuations",
+                body: {
+                    state: request.state,
+                    code_challenge: request.codeChallenge,
+                    redirect_uri: request.redirectUri,
+                    client_instance_id: request.clientInstanceId,
+                    profile: request.profile,
+                    intent_class: request.intentClass,
+                },
+                ...(request.signal === undefined ? {} : { signal: request.signal }),
+            });
+            return decodeCliContinuationIssued(response, { browserOrigin: request.browserOrigin, state: request.state });
+        },
+        async exchange(request) {
+            const id = encodePublicId(request.id, "continuation ID");
+            return decodeCliLoginCodeExchangeResult(await input.anonymous.request({
+                method: "POST",
+                path: `/v1/cli-auth/continuations/${id}/exchange`,
+                body: {
+                    login_code: request.loginCode,
+                    client_instance_id: request.clientInstanceId,
+                    profile: request.profile,
+                    state: request.state,
+                    code_verifier: request.codeVerifier,
+                    redirect_uri: request.redirectUri,
+                },
+                ...(request.signal === undefined ? {} : { signal: request.signal }),
+            }), request.loginCode, request.expectedLoginCodeExpiresAt);
+        },
+        async context(accessToken, signal) {
+            return decodeCliIdentityContext(await input.authenticated(accessToken).request({
+                method: "GET",
+                path: "/v1/cli-auth/context",
+                ...(signal === undefined ? {} : { signal }),
+            }));
+        },
+        async logout(accessToken, signal) {
+            return decodeRevocation(await input.authenticated(accessToken).request({
+                method: "POST",
+                path: "/v1/cli-auth/logout",
+                ...(signal === undefined ? {} : { signal }),
+            }));
+        },
+    };
+    return Object.freeze(client);
+}
+//# sourceMappingURL=human-client.js.map

package/dist/auth/human-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-client.js","sourceRoot":"","sources":["../../src/auth/human-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,gCAAgC,EAChC,gBAAgB,GAOjB,MAAM,sBAAsB,CAAC;AAmC9B,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,MAAM,MAAM,GAAoB;QAC9B,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,OAAO,sBAAsB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC1D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC3F,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC3B,OAAO,yBAAyB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7D,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gCAAgC;gBACtC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,OAAO;YAC9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE;oBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,cAAc,EAAE,OAAO,CAAC,aAAa;oBACrC,YAAY,EAAE,OAAO,CAAC,WAAW;oBACjC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;oBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,YAAY,EAAE,OAAO,CAAC,WAAW;iBAClC;gBACD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,OAAO,2BAA2B,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;YACzD,OAAO,gCAAgC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;gBACpE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,EAAE,WAAW;gBACjD,IAAI,EAAE;oBACJ,UAAU,EAAE,OAAO,CAAC,SAAS;oBAC7B,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;oBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,YAAY,EAAE,OAAO,CAAC,WAAW;iBAClC;gBACD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACpE,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM;YAC/B,OAAO,wBAAwB,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;gBAC7E,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM;YAC9B,OAAO,gBAAgB,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;gBACrE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/auth/human-contracts.d.ts

@@ -0,0 +1,52 @@
+export type CliIntentClass = "signup" | "login" | "account.read" | "machines.read" | "machines.create" | "agent_sessions.read" | "agent_sessions.create";
+export interface CliIdentityContext {
+    readonly requiredTermsVersion: string;
+    readonly identity: "unknown" | "signup_required" | "verification_required" | "active" | "disabled";
+    readonly admission: "not_requested" | "waitlisted" | "admitted";
+    readonly workspace: {
+        readonly state: "assigned" | "unavailable";
+        readonly id?: string;
+    };
+    readonly waitlistPosition?: number;
+}
+export interface CliAuthBootstrap {
+    readonly enabled: boolean;
+    readonly completionMode: "paste_login_code";
+    readonly pkceMethod: "S256";
+    readonly continuationTtlSeconds: 600;
+    readonly accessTokenTtlSeconds: 600;
+    readonly browserOrigin: string | null;
+}
+export interface CliSignupCapability {
+    readonly enabled: boolean;
+    readonly enrollment: "waitlist_only";
+    readonly identityMethods: readonly [] | readonly ["email_password", "oauth"];
+    readonly reasonCode?: "remote_signup_abuse_controls_unverified";
+}
+export interface CliContinuationIssued {
+    readonly id: string;
+    readonly browserUrl: string;
+    readonly expiresAt: string;
+    readonly completionMode: "paste_login_code";
+}
+export interface CliLoginCodeExchangeResult {
+    readonly accessToken: string;
+    readonly tokenType: "Bearer";
+    readonly expiresIn: 600;
+    readonly accessExpiresAt: string;
+    readonly loginCodeExpiresAt: string;
+    readonly sessionId: string;
+    readonly context: CliIdentityContext;
+}
+export declare function decodeCliIdentityContext(value: unknown): CliIdentityContext;
+export declare function decodeCliAuthBootstrap(value: unknown): CliAuthBootstrap;
+export declare function decodeCliSignupCapability(value: unknown): CliSignupCapability;
+export declare function decodeCliContinuationIssued(value: unknown, expected: {
+    readonly browserOrigin: string;
+    readonly state: string;
+}): CliContinuationIssued;
+export declare function decodeCliLoginCodeExchangeResult(value: unknown, loginCode: string, expectedLoginCodeExpiresAt?: string): CliLoginCodeExchangeResult;
+export declare function decodeRevocation(value: unknown): true;
+export declare function assertUuid(value: string, label: string): string;
+export declare function assertProfile(value: string): string;
+//# sourceMappingURL=human-contracts.d.ts.map

package/dist/auth/human-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-contracts.d.ts","sourceRoot":"","sources":["../../src/auth/human-contracts.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,OAAO,GACP,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,QAAQ,GAAG,UAAU,CAAC;IACnG,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,yCAAyC,CAAC;CACjE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;CAC7C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAiDD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA6B3E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CA6BvE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CA8B7E;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnE,qBAAqB,CAmCvB;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,0BAA0B,CAAC,EAAE,MAAM,GAClC,0BAA0B,CAwB5B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIrD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD"}

package/dist/auth/human-contracts.js

@@ -0,0 +1,229 @@
+import { EXIT_CODES, CunaError } from "../core/errors.js";
+import { OFF_CONTRACT_RESPONSE_HINT } from "../core/product-web.js";
+import { isAccessToken, isBrowserCallbackNonce, isLoginCode, } from "../core/namespace.js";
+import { isObject } from "../core/validation.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+const PROFILE = /^[^\p{Cc}\p{Cf}]{1,80}$/u;
+const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/u;
+function malformed(reason) {
+    throw new CunaError({
+        code: "cuna.remote.malformed_response",
+        message: "Cuna returned a response that does not match the CLI authentication contract.",
+        exitCode: EXIT_CODES.remote,
+        hint: OFF_CONTRACT_RESPONSE_HINT,
+        // `operation` is absent on purpose: this decoder is reached from several
+        // sign-in exchanges and does not receive the request, so naming one would
+        // be a guess. `reason` is the predicate under the same key the API path
+        // uses, so both halves of this error class read alike.
+        details: { predicate: reason },
+    });
+}
+function exact(value, required, optional = []) {
+    if (!isObject(value))
+        return malformed("invalid_object");
+    const allowed = new Set([...required, ...optional]);
+    const keys = Object.keys(value);
+    if (keys.some((key) => !allowed.has(key)) || required.some((key) => !Object.hasOwn(value, key))) {
+        return malformed("invalid_shape");
+    }
+    return value;
+}
+function string(value, pattern, reason) {
+    if (typeof value !== "string" || !pattern.test(value))
+        return malformed(reason);
+    return value;
+}
+function date(value, reason) {
+    if (typeof value !== "string" || !RFC3339.test(value) || Number.isNaN(Date.parse(value))) {
+        return malformed(reason);
+    }
+    return new Date(value).toISOString();
+}
+function uuid(value, reason) {
+    return string(value, UUID, reason);
+}
+function boundedInteger(value, minimum, maximum, reason) {
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        return malformed(reason);
+    }
+    return value;
+}
+export function decodeCliIdentityContext(value) {
+    const record = exact(value, ["required_terms_version", "identity", "admission", "workspace"], ["waitlist_position"]);
+    const identity = record.identity;
+    if (!new Set(["unknown", "signup_required", "verification_required", "active", "disabled"]).has(identity)) {
+        return malformed("invalid_identity");
+    }
+    const admission = record.admission;
+    if (!new Set(["not_requested", "waitlisted", "admitted"]).has(admission)) {
+        return malformed("invalid_admission");
+    }
+    const workspace = exact(record.workspace, ["state"], ["id"]);
+    if (workspace.state !== "assigned" && workspace.state !== "unavailable")
+        return malformed("invalid_workspace_state");
+    const workspaceId = workspace.id === undefined ? undefined : uuid(workspace.id, "invalid_workspace_id");
+    if (workspace.state === "assigned" && workspaceId === undefined)
+        return malformed("assigned_workspace_missing_id");
+    if (workspace.state === "unavailable" && workspaceId !== undefined)
+        return malformed("unavailable_workspace_has_id");
+    const waitlistPosition = record.waitlist_position === undefined
+        ? undefined
+        : boundedInteger(record.waitlist_position, 0, Number.MAX_SAFE_INTEGER, "invalid_waitlist_position");
+    return Object.freeze({
+        requiredTermsVersion: string(record.required_terms_version, PROFILE, "invalid_terms_version"),
+        identity: identity,
+        admission: admission,
+        workspace: Object.freeze({ state: workspace.state, ...(workspaceId === undefined ? {} : { id: workspaceId }) }),
+        ...(waitlistPosition === undefined ? {} : { waitlistPosition }),
+    });
+}
+export function decodeCliAuthBootstrap(value) {
+    const record = exact(value, [
+        "enabled", "completion_mode", "pkce_method", "continuation_ttl_seconds",
+        "access_token_ttl_seconds", "browser_origin",
+    ]);
+    if (typeof record.enabled !== "boolean" || record.completion_mode !== "paste_login_code" || record.pkce_method !== "S256" ||
+        record.continuation_ttl_seconds !== 600 ||
+        record.access_token_ttl_seconds !== 600)
+        return malformed("unsupported_bootstrap");
+    let browserOrigin = null;
+    if (record.browser_origin !== null) {
+        if (typeof record.browser_origin !== "string")
+            return malformed("invalid_browser_origin");
+        let parsed;
+        try {
+            parsed = new URL(record.browser_origin);
+        }
+        catch {
+            return malformed("invalid_browser_origin");
+        }
+        if (parsed.protocol !== "https:" || parsed.origin !== record.browser_origin || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+            return malformed("invalid_browser_origin");
+        }
+        browserOrigin = parsed.origin;
+    }
+    if (record.enabled !== (browserOrigin !== null))
+        return malformed("bootstrap_authority_inconsistent");
+    return Object.freeze({
+        enabled: record.enabled,
+        completionMode: "paste_login_code",
+        pkceMethod: "S256",
+        continuationTtlSeconds: 600,
+        accessTokenTtlSeconds: 600,
+        browserOrigin,
+    });
+}
+export function decodeCliSignupCapability(value) {
+    const record = exact(value, ["enabled", "enrollment", "identity_methods"], ["reason_code"]);
+    const methods = record.identity_methods;
+    if (typeof record.enabled !== "boolean" ||
+        record.enrollment !== "waitlist_only" ||
+        !Array.isArray(methods) ||
+        !(methods.length === 0 ||
+            (methods.length === 2 &&
+                methods[0] === "email_password" &&
+                methods[1] === "oauth")) ||
+        (record.reason_code !== undefined &&
+            record.reason_code !== "remote_signup_abuse_controls_unverified") ||
+        (record.enabled &&
+            (record.reason_code !== undefined || methods.length !== 2)) ||
+        (!record.enabled && methods.length !== 0) ||
+        (!record.enabled && record.reason_code === undefined)) {
+        return malformed("invalid_signup_capability");
+    }
+    return Object.freeze({
+        enabled: record.enabled,
+        enrollment: "waitlist_only",
+        identityMethods: record.enabled
+            ? ["email_password", "oauth"]
+            : [],
+        ...(record.reason_code === undefined
+            ? {}
+            : { reasonCode: record.reason_code }),
+    });
+}
+export function decodeCliContinuationIssued(value, expected) {
+    const record = exact(value, [
+        "id", "browser_url", "expires_at", "completion_mode",
+    ]);
+    if (record.completion_mode !== "paste_login_code")
+        return malformed("invalid_completion_mode");
+    const id = uuid(record.id, "invalid_continuation_id");
+    const browserUrl = typeof record.browser_url === "string" ? record.browser_url : malformed("invalid_browser_url");
+    let parsed;
+    try {
+        parsed = new URL(browserUrl);
+    }
+    catch {
+        return malformed("invalid_browser_url");
+    }
+    if (parsed.origin !== expected.browserOrigin ||
+        parsed.username !== "" ||
+        parsed.password !== "" ||
+        parsed.pathname !== "/cli/continue" ||
+        parsed.search !== "" ||
+        parsed.hash.length < 2 ||
+        parsed.hash.slice(1).includes("?")) {
+        return malformed("invalid_browser_url");
+    }
+    const fragment = new URLSearchParams(parsed.hash.slice(1));
+    const fragmentKeys = [...fragment.keys()].sort();
+    if (fragmentKeys.join(",") !== "continuation,nonce,state" || fragment.get("continuation") !== id || fragment.get("state") !== expected.state) {
+        return malformed("browser_binding_mismatch");
+    }
+    const browserNonce = fragment.get("nonce");
+    if (browserNonce === null || !isBrowserCallbackNonce(browserNonce) || !browserNonce.startsWith("cuna_cb_")) {
+        return malformed("invalid_browser_nonce");
+    }
+    return Object.freeze({
+        id,
+        browserUrl,
+        expiresAt: date(record.expires_at, "invalid_continuation_expiry"),
+        completionMode: "paste_login_code",
+    });
+}
+export function decodeCliLoginCodeExchangeResult(value, loginCode, expectedLoginCodeExpiresAt) {
+    const record = exact(value, [
+        "access_token", "token_type", "expires_in", "access_expires_at", "login_code_expires_at", "session_id", "context",
+    ]);
+    if (record.token_type !== "Bearer" || record.expires_in !== 600)
+        return malformed("invalid_token_type_or_ttl");
+    const accessToken = typeof record.access_token === "string" && isAccessToken(record.access_token)
+        ? record.access_token : malformed("invalid_access_token");
+    if (!isLoginCode(loginCode))
+        return malformed("invalid_login_code");
+    const accessExpiresAt = date(record.access_expires_at, "invalid_access_expiry");
+    const loginCodeExpiresAt = date(record.login_code_expires_at, "invalid_login_code_expiry");
+    if (expectedLoginCodeExpiresAt !== undefined &&
+        Date.parse(loginCodeExpiresAt) !== Date.parse(date(expectedLoginCodeExpiresAt, "invalid_expected_login_code_expiry"))) {
+        return malformed("login_code_expiry_mismatch");
+    }
+    if (Date.parse(loginCodeExpiresAt) <= Date.parse(accessExpiresAt))
+        return malformed("invalid_login_code_expiry_order");
+    return Object.freeze({
+        accessToken,
+        tokenType: "Bearer",
+        expiresIn: 600,
+        accessExpiresAt,
+        loginCodeExpiresAt,
+        sessionId: uuid(record.session_id, "invalid_session_id"),
+        context: decodeCliIdentityContext(record.context),
+    });
+}
+export function decodeRevocation(value) {
+    const record = exact(value, ["revoked"]);
+    if (record.revoked !== true)
+        return malformed("invalid_revocation_receipt");
+    return true;
+}
+export function assertUuid(value, label) {
+    if (!UUID.test(value))
+        throw new TypeError(`Invalid ${label}.`);
+    return value;
+}
+export function assertProfile(value) {
+    if (!PROFILE.test(value) || value.trim() !== value)
+        throw new TypeError("Invalid profile.");
+    return value;
+}
+//# sourceMappingURL=human-contracts.js.map

package/dist/auth/human-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-contracts.js","sourceRoot":"","sources":["../../src/auth/human-contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAC3C,MAAM,OAAO,GAAG,uEAAuE,CAAC;AAoDxF,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,IAAI,SAAS,CAAC;QAClB,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,+EAA+E;QACxF,QAAQ,EAAE,UAAU,CAAC,MAAM;QAC3B,IAAI,EAAE,0BAA0B;QAChC,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,uDAAuD;QACvD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,QAA2B,EAAE,WAA8B,EAAE;IAC1F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,SAAS,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe,EAAE,MAAc;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAc;IAC1C,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe,EAAE,OAAe,EAAE,MAAc;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,OAAO,IAAK,KAAgB,GAAG,OAAO,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,EACL,CAAC,wBAAwB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,EAChE,CAAC,mBAAmB,CAAC,CACtB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAkB,CAAC,EAAE,CAAC;QACpH,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAmB,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACrH,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;IACxG,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACnH,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrH,MAAM,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,OAAO,EAAE,uBAAuB,CAAC;QAC7F,QAAQ,EAAE,QAA0C;QACpD,SAAS,EAAE,SAA4C;QACvD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC/G,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,0BAA0B;QACvE,0BAA0B,EAAE,gBAAgB;KAC7C,CAAC,CAAC;IACH,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,kBAAkB,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM;QACrH,MAAM,CAAC,wBAAwB,KAAK,GAAG;QACvC,MAAM,CAAC,wBAAwB,KAAK,GAAG;QACvC,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC1F,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAAC,CAAC;QACtG,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACvI,OAAO,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC7C,CAAC;QACD,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,MAAM;QAClB,sBAAsB,EAAE,GAAG;QAC3B,qBAAqB,EAAE,GAAG;QAC1B,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS;QACnC,MAAM,CAAC,UAAU,KAAK,eAAe;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACnB,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;gBAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QAC5B,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;YAC/B,MAAM,CAAC,WAAW,KAAK,yCAAyC,CAAC;QACnE,CAAC,MAAM,CAAC,OAAO;YACb,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,OAAO,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,eAAe;QAC3B,eAAe,EAAE,MAAM,CAAC,OAAO;YAC7B,CAAC,CAAE,CAAC,gBAAgB,EAAE,OAAO,CAAW;YACxC,CAAC,CAAE,EAAY;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc,EACd,QAAoE;IAEpE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE;QAC1B,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB;KACrD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC/F,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAClH,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAAC,CAAC;IACxF,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa;QACxC,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,eAAe;QACnC,MAAM,CAAC,MAAM,KAAK,EAAE;QACpB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClC,CAAC;QACD,OAAO,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0BAA0B,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC7I,OAAO,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3G,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,UAAU;QACV,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,6BAA6B,CAAC;QACjE,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAc,EACd,SAAiB,EACjB,0BAAmC;IAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE;QAC1B,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,YAAY,EAAE,SAAS;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC/G,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;IAC3F,IAAI,0BAA0B,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,oCAAoC,CAAC,CAAC,EAAE,CAAC;QAC1H,OAAO,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAAE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACvH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,GAAG;QACd,eAAe;QACf,kBAAkB;QAClB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC;QACxD,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC,4BAA4B,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/human-session.d.ts

@@ -0,0 +1,48 @@
+import type { EffectiveConfig } from "../config/config.js";
+import { CredentialVault } from "../credentials/vault.js";
+import type { BrowserOpener } from "./browser.js";
+import { type BrowserHandoffReporter } from "./browser-handoff.js";
+import type { HumanAuthClient } from "./human-client.js";
+import { type CliIdentityContext, type CliIntentClass } from "./human-contracts.js";
+export interface HumanAuthResult {
+    readonly profile: string;
+    readonly sessionId: string;
+    readonly context: CliIdentityContext;
+    readonly storageMode?: "encrypted-local";
+}
+export interface HumanAuthService {
+    login(input?: {
+        readonly intentClass?: CliIntentClass;
+        readonly signal?: AbortSignal;
+    }): Promise<HumanAuthResult>;
+    signup(input?: {
+        readonly signal?: AbortSignal;
+    }): Promise<HumanAuthResult>;
+    acquireAccessToken(signal?: AbortSignal): Promise<string>;
+    refreshRejectedAccessToken(rejectedAccessToken: string, signal?: AbortSignal): Promise<string>;
+    whoami(signal?: AbortSignal): Promise<HumanAuthResult>;
+    logout(signal?: AbortSignal): Promise<{
+        readonly revoked: true;
+    }>;
+}
+type RandomSource = (size: number) => Uint8Array;
+export declare function createHumanAuthService(input: {
+    readonly config: EffectiveConfig;
+    readonly client: HumanAuthClient;
+    readonly vault: CredentialVault;
+    readonly browser: BrowserOpener;
+    /**
+     * Required, never defaulted. A default would make "the user was never sent
+     * anywhere" the silent behaviour of a caller that forgot one field, which is
+     * the exact defect this seam exists to close.
+     */
+    readonly browserHandoff: BrowserHandoffReporter;
+    readonly readLoginCode: (signal?: AbortSignal) => Promise<string>;
+    /** Local input passed validation; this does not attest remote sign-in or storage. */
+    readonly onLoginCodeAccepted?: () => void;
+    readonly clock?: () => number;
+    readonly random?: RandomSource;
+    readonly uuid?: () => string;
+}): HumanAuthService;
+export {};
+//# sourceMappingURL=human-session.d.ts.map

package/dist/auth/human-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-session.d.ts","sourceRoot":"","sources":["../../src/auth/human-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAO3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEpB,MAAM,sBAAsB,CAAC;AAoD9B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5E,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,0BAA0B,CAAC,mBAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC;AAwUjD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B,GAAG,gBAAgB,CAuqBnB"}