@detergent-software/atk 7.10.1-dev.1 → 7.11.0-dev.2

package/build/lib/entra.js

@@ -0,0 +1,209 @@
+/**
+ * Microsoft Entra ID sign-in for the ATK CLI (`atk login` / `atk logout`).
+ *
+ * Wraps `@azure/msal-node`'s public-client device-code flow against the
+ * `ES ATK CLI` app registration and persists MSAL's token cache to
+ * `~/.atk/auth/msal-cache.json` through an `ICachePlugin`. The file holds a
+ * refresh token, so it is created with mode 0600 (best effort on Windows) and
+ * lives outside `~/.atk/cache/`, which `atk cache clear` deletes wholesale.
+ *
+ * MSAL is imported lazily, and only once a cache file exists or a sign-in is
+ * requested, so GitHub-token users pay no startup cost for it.
+ *
+ * The tenant, client id and scope are constants: one set of registrations
+ * serves dev and prod, so a single sign-in works against both APIs.
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/** The Emergent Software tenant. */
+export const ENTRA_TENANT_ID = '25ee13ae-a8a5-4bc2-bb23-aea90536fb0c';
+export const ENTRA_AUTHORITY = `https://login.microsoftonline.com/${ENTRA_TENANT_ID}`;
+/** `ES ATK CLI`: a public client allowed to use the device-code flow. */
+export const ENTRA_CLIENT_ID = '488be9fb-eb4d-464c-8045-a5e4783658c6';
+/** The `ES ATK API` scope every ATK access token must carry. MSAL adds `openid profile offline_access` itself. */
+export const ENTRA_SCOPES = ['api://8da5aa72-0565-4ae8-bf5a-db89d8bd3186/access_as_user'];
+let clientPromise;
+/** Path of the persisted MSAL cache: `~/.atk/auth/msal-cache.json`. */
+export function getEntraCachePath() {
+    return join(homedir(), '.atk', 'auth', 'msal-cache.json');
+}
+/**
+ * Silently obtain an access token for the cached Entra account.
+ *
+ * Short-circuits without importing MSAL when no cache file exists. An
+ * interaction-required or invalid-grant failure means the session has expired.
+ */
+export async function getEntraSession() {
+    if (!existsSync(getEntraCachePath())) {
+        return { ok: false, reason: 'none' };
+    }
+    try {
+        const client = await getClient();
+        const accounts = await client.getTokenCache().getAllAccounts();
+        const account = accounts[0];
+        if (!account) {
+            return { ok: false, reason: 'none' };
+        }
+        const result = await client.acquireTokenSilent({ account, scopes: ENTRA_SCOPES });
+        return { account: toEntraAccount(result.account ?? account), ok: true, token: result.accessToken };
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        return { detail, ok: false, reason: isSessionExpiredError(err) ? 'expired' : 'error' };
+    }
+}
+/**
+ * Run the device-code flow. `onCode` receives the verification URL and user
+ * code as soon as Entra issues them; the promise resolves once the user has
+ * completed sign-in in their browser.
+ */
+export async function loginWithDeviceCode(onCode) {
+    const client = await getClient();
+    let result;
+    try {
+        result = await client.acquireTokenByDeviceCode({
+            deviceCodeCallback: (response) => {
+                onCode({
+                    expiresIn: response.expiresIn,
+                    message: response.message,
+                    userCode: response.userCode,
+                    verificationUri: response.verificationUri,
+                });
+            },
+            scopes: ENTRA_SCOPES,
+        });
+    }
+    catch (err) {
+        throw new Error(describeLoginFailure(err));
+    }
+    if (!result?.account) {
+        throw new Error('Sign-in did not complete. Run `atk login` again.');
+    }
+    return { account: toEntraAccount(result.account), token: result.accessToken };
+}
+/**
+ * Remove every account from the MSAL cache and delete the cache file.
+ * Returns whether a signed-in account was actually removed.
+ */
+export async function logoutEntra() {
+    const cachePath = getEntraCachePath();
+    if (!existsSync(cachePath)) {
+        return false;
+    }
+    let removed = false;
+    try {
+        const client = await getClient();
+        const cache = client.getTokenCache();
+        const accounts = await cache.getAllAccounts();
+        for (const account of accounts) {
+            await cache.removeAccount(account);
+        }
+        removed = accounts.length > 0;
+    }
+    catch {
+        // A corrupt cache still counts as a session file worth deleting.
+        removed = true;
+    }
+    await rm(cachePath, { force: true });
+    return removed;
+}
+/**
+ * Remove one account (and its tokens) from the cache. Used by `atk login`
+ * when the API refuses a freshly acquired token (e.g. a guest account) so a
+ * useless session is not left behind.
+ */
+export async function removeEntraAccount(account) {
+    const client = await getClient();
+    const cache = client.getTokenCache();
+    const stored = await cache.getAccountByHomeId(account.homeAccountId);
+    if (stored) {
+        await cache.removeAccount(stored);
+    }
+}
+/** Forget the memoised MSAL client. Intended for tests. */
+export function resetEntraClient() {
+    clientPromise = undefined;
+}
+async function buildClient() {
+    const msal = await import('@azure/msal-node');
+    return new msal.PublicClientApplication({
+        auth: { authority: ENTRA_AUTHORITY, clientId: ENTRA_CLIENT_ID },
+        cache: { cachePlugin: createFileCachePlugin(getEntraCachePath()) },
+        system: {
+            loggerOptions: {
+                loggerCallback: () => undefined,
+                logLevel: msal.LogLevel.Error,
+                piiLoggingEnabled: false,
+            },
+        },
+    });
+}
+/**
+ * `ICachePlugin` that mirrors MSAL's in-memory cache to {@link getEntraCachePath}.
+ * Reads before every cache access; writes only when MSAL reports a change.
+ */
+function createFileCachePlugin(cachePath) {
+    return {
+        async afterCacheAccess(context) {
+            if (!context.cacheHasChanged) {
+                return;
+            }
+            await mkdir(dirname(cachePath), { mode: 0o700, recursive: true });
+            await writeFile(cachePath, context.tokenCache.serialize(), { encoding: 'utf-8', mode: 0o600 });
+        },
+        async beforeCacheAccess(context) {
+            let raw;
+            try {
+                raw = await readFile(cachePath, 'utf-8');
+            }
+            catch {
+                return; // No cache yet: MSAL starts empty.
+            }
+            context.tokenCache.deserialize(raw);
+        },
+    };
+}
+function describeLoginFailure(err) {
+    const code = errorCodeOf(err);
+    if (code === 'device_code_expired') {
+        return 'The sign-in code expired before it was used. Run `atk login` again.';
+    }
+    if (code === 'device_code_polling_cancelled') {
+        return 'Sign-in was cancelled.';
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return `Sign-in failed: ${message}`;
+}
+function errorCodeOf(err) {
+    const code = err?.errorCode;
+    return typeof code === 'string' ? code : undefined;
+}
+async function getClient() {
+    clientPromise ??= buildClient();
+    return clientPromise;
+}
+/**
+ * Whether an MSAL failure means the user must sign in again (as opposed to a
+ * transient or environmental problem). Checked by error name and code rather
+ * than `instanceof` so it holds when MSAL is module-mocked in tests.
+ */
+function isSessionExpiredError(err) {
+    if (!(err instanceof Error)) {
+        return false;
+    }
+    if (err.name === 'InteractionRequiredAuthError') {
+        return true;
+    }
+    const code = errorCodeOf(err);
+    return code === 'invalid_grant' || code === 'refresh_token_expired' || code === 'no_tokens_found';
+}
+function toEntraAccount(account) {
+    return {
+        homeAccountId: account.homeAccountId,
+        ...(account.name ? { name: account.name } : {}),
+        username: account.username,
+    };
+}
+//# sourceMappingURL=entra.js.map

package/build/lib/entra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entra.js","sourceRoot":"","sources":["../../src/lib/entra.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,oCAAoC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,eAAe,EAAE,CAAC;AACtF,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AACtE,kHAAkH;AAClH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,2DAA2D,CAAC,CAAC;AA+B1F,IAAI,aAA2D,CAAC;AAEhE,uEAAuE;AACvE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,cAAc,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;YAC7C,kBAAkB,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC/B,MAAM,CAAC;oBACL,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAqB;IAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9C,OAAO,IAAI,IAAI,CAAC,uBAAuB,CAAC;QACtC,IAAI,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC/D,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,CAAC,EAAE;QAClE,MAAM,EAAE;YACN,aAAa,EAAE;gBACb,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAC7B,iBAAiB,EAAE,KAAK;aACzB;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,OAA0B;YAC/C,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;YAChD,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,mCAAmC;YAC7C,CAAC;YACD,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,KAAK,+BAA+B,EAAE,CAAC;QAC7C,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,mBAAmB,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAA2C,EAAE,SAAS,CAAC;IACrE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,aAAa,KAAK,WAAW,EAAE,CAAC;IAChC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iBAAiB,CAAC;AACpG,CAAC;AAED,SAAS,cAAc,CAAC,OAAoB;IAC1C,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC"}

package/build/lib/notices.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Once-per-run notices that the App shell renders above a command's output.
+ *
+ * Library code (the API client, the credential chain) records a notice when it
+ * learns something the user should see once per invocation, e.g. that GitHub
+ * sign-in is being retired, or that the cached Emergent session has expired
+ * and a GitHub token was used instead. `_app.tsx` subscribes and renders one
+ * line per notice in non-JSON mode; JSON mode never shows them.
+ *
+ * Notices are deduplicated by `kind`, so recording the same one from every
+ * API response still yields a single banner.
+ */
+export type Notice = 
+/** The cached Entra session could not be refreshed and a GitHub token was used instead. */
+{
+    date: string;
+    kind: 'github-sunset';
+}
+/** The API announced (via `Sunset`) the date GitHub sign-in ends. `date` is `YYYY-MM-DD`. */
+ | {
+    kind: 'entra-expired';
+};
+type Listener = () => void;
+/** Record a notice unless one of the same kind is already queued. */
+export declare function addNotice(notice: Notice): void;
+/** Drop every queued notice. Intended for tests. */
+export declare function clearNotices(): void;
+/** Current notices, as a stable array reference (safe for `useSyncExternalStore`). */
+export declare function getNotices(): readonly Notice[];
+/** Subscribe to changes; returns the unsubscribe function. */
+export declare function subscribeNotices(listener: Listener): () => void;
+export {};
+//# sourceMappingURL=notices.d.ts.map

package/build/lib/notices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.d.ts","sourceRoot":"","sources":["../../src/lib/notices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,MAAM;AAChB,2FAA2F;AACzF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE;AACzC,6FAA6F;GAC3F;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAK3B,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ9C;AAED,oDAAoD;AACpD,wBAAgB,YAAY,IAAI,IAAI,CAKnC;AAED,sFAAsF;AACtF,wBAAgB,UAAU,IAAI,SAAS,MAAM,EAAE,CAE9C;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,IAAI,CAK/D"}

package/build/lib/notices.js

@@ -0,0 +1,43 @@
+/**
+ * Once-per-run notices that the App shell renders above a command's output.
+ *
+ * Library code (the API client, the credential chain) records a notice when it
+ * learns something the user should see once per invocation, e.g. that GitHub
+ * sign-in is being retired, or that the cached Emergent session has expired
+ * and a GitHub token was used instead. `_app.tsx` subscribes and renders one
+ * line per notice in non-JSON mode; JSON mode never shows them.
+ *
+ * Notices are deduplicated by `kind`, so recording the same one from every
+ * API response still yields a single banner.
+ */
+let notices = [];
+const listeners = new Set();
+/** Record a notice unless one of the same kind is already queued. */
+export function addNotice(notice) {
+    if (notices.some((n) => n.kind === notice.kind)) {
+        return;
+    }
+    notices = [...notices, notice];
+    for (const listener of listeners) {
+        listener();
+    }
+}
+/** Drop every queued notice. Intended for tests. */
+export function clearNotices() {
+    notices = [];
+    for (const listener of listeners) {
+        listener();
+    }
+}
+/** Current notices, as a stable array reference (safe for `useSyncExternalStore`). */
+export function getNotices() {
+    return notices;
+}
+/** Subscribe to changes; returns the unsubscribe function. */
+export function subscribeNotices(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+//# sourceMappingURL=notices.js.map

package/build/lib/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../src/lib/notices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,IAAI,OAAO,GAAsB,EAAE,CAAC;AACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAY,CAAC;AAEtC,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY;IAC1B,OAAO,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@detergent-software/atk",
-	"version": "7.10.1-dev.1",
+	"version": "7.11.0-dev.2",
 	"description": "Agentic Tool Kit — CLI for managing AI coding tool assets.",
 	"type": "module",
 	"bin": {
@@ -44,6 +44,7 @@
 		}
 	},
 	"dependencies": {
+		"@azure/msal-node": "^6.0.0",
 		"chalk": "^5.4.0",
 		"diff": "8.0.3",
 		"ink": "^6.0.0",