@ekanos/cli 0.12.0 → 0.14.0

package/dist/auth/ekanos-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"ekanos-api.js","sourceRoot":"","sources":["../../src/auth/ekanos-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAuBlC,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;KACxC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,GAAG,IAAI,kDAAkD,EACzD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,sDAAsD;IACtD,cAAc,CAAC,MAAM,CAAC,2BAA4B,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IACzE,cAAc,CAAC,MAAM,CAAC,aAAc,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IAE3D,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,gBAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,+BAA+B,EACtC,sEAAsE;YACpE,aAAa,IAAI,mDAAmD;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,CACd,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,uBAAuB,CAAC,EACxD,IAAI,CACL,CAAC;AACJ,CAAC;AAqBD,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,iBAAyB,EACzB,OAAO,GAAmB,EAAE;;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAA,OAAO,CAAC,cAAc,+CAAtB,OAAO,EAAkB,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0BAA0B,IAAI,sBAAsB,EACpD,kEAAkE;YAChE,iEAAiE;YACjE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,YAAY,CAChB,GAAG,IAAI,oEAAoE,EAC3E,qEAAqE;YACnE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,oDAAoD,EAC3D,cAAc,IAAI,kDAAkD;YAClE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,CAChB,GAAG,IAAI,mEAAmE,EAC1E,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,uCAAY,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAE,iBAAiB,EAAE,OAAO,IAAG;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,yDAAyD,EAChE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,6CAA6C,EACpD,cAAc,IAAI,kDAAkD;YAClE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,YAAY,CAChB,GAAG,IAAI,0CAA0C,EACjD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B,EAAE,IAAY;;IAC5D,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,kCACjB,IAAI,KACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAC/C,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,YAAY,CAChB,mBAAmB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,EACnD,4DAA4D;YAC1D,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,IAAY;IAEZ,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;eAAO,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,uBAAuB,EAC9B,sEAAsE;YACpE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,IAAY,EACZ,IAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO;IAEvD,MAAM,iBAAiB,CACrB,GAAG,IAAI,sCAAsC,EAC7C,8DAA8D;QAC5D,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACnE,OAAO,YAAY,CACjB,GAAG,IAAI,GAAG,KAAK,cAAc,MAAM,GAAG,EACtC,MAAM,IAAI,GAAG;QACX,CAAC,CAAC,sEAAsE;YACpE,2CAA2C;QAC/C,CAAC,CAAC,gEAAgE;YAC9D,YAAY,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;eAAO,CAAC;QACP,MAAM,iBAAiB,CACrB,wDAAwD,EACxD,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAC/C,CAAC;QACD,MAAM,iBAAiB,CACrB,sEAAsE;YACpE,WAAW,GAAG,CAAC,IAAI,IAAI,EACzB,6DAA6D;YAC3D,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { authRequiredError, networkError, preconditionError } from '../errors';\n\n/**\n * The CLI's client for the four Ekanos auth routes.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/auth/cli-<verb>` routes, and it ships on\n * a DIFFERENT BRANCH from this file. This block is the single place the shapes\n * are written down on the client side; if you change one side, change the\n * other and update this block. Nothing here imports host code — the two\n * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.\n *\n *   GET /api/auth/cli-config                                   [no auth]\n *     → 200 { auth0_domain, client_id, scope,\n *             device_authorization_endpoint, token_endpoint }   all strings\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *\n *   POST /api/auth/cli-session                                 [no auth]\n *     ← { auth0_access_token: string }\n *     → 200 { access_token, expires_at, user: { id, email } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }      malformed / wrong shape\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      Auth0 said no, OR no\n *                                                   Ekanos account for it\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *\n *   POST /api/auth/cli-refresh                                 [no auth]\n *     ← { auth0_refresh_token: string }\n *     → 200 { access_token, expires_at, user: { id, email },\n *             auth0_refresh_token }   ← ROTATED; the presented one is dead\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      expired or revoked\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\",\n *             auth0_refresh_token }                 no Ekanos account\n *     → 502 { error, code: \"TOKEN_EXCHANGE_FAILED\" } Auth0 returned no\n *                                                   rotated token\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 503 { error, code: \"REFRESH_INCOMPLETE\",\n *             auth0_refresh_token }                 rotated, but /userinfo\n *                                                   did not answer; RETRYABLE\n *     → 500 { error, code: \"INTERNAL_ERROR\",\n *             auth0_refresh_token? }                present iff rotation\n *                                                   completed before the throw\n *\n *   !! cli-refresh MAY RETURN `auth0_refresh_token` ON ERROR RESPONSES, and a\n *      client MUST persist it before surfacing the error. Once the server's\n *      exchange with Auth0 succeeds the presented token is dead and the value\n *      in that body is the ONLY copy in existence; discarding it on a failure\n *      path destroys the session permanently. Note 503 has TWO codes here —\n *      branch on `code`, not on the status alone.\n *\n *   All three routes above read the Fusion CLI Auth0 application config, so all\n *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami cannot — it reads no\n *   Auth0 config, only the caller's bearer token.\n *\n *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]\n *     → 200 { user: { id, email, name } }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        token absent or invalid\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\" }\n *     → 3xx                                         treated as 401, see below\n *\n * `access_token` is an Ekanos HS256 JWT. Every authenticated Ekanos route\n * accepts it as `Authorization: Bearer` — see `resolveRequestSupabaseJwt` in\n * `@kit/supabase`, which both `requireUser` and the RLS server client consume.\n * ---------------------------------------------------------------------------\n *\n * Two rules hold everywhere in this file:\n *\n *  - `redirect: 'manual'`. Ekanos answers an unauthenticated page request with\n *    a 307 to `/auth/sign-in`; Node's fetch follows redirects by default, so\n *    without this a stale token would come back as a 200 full of HTML and be\n *    read as success. A 3xx here is treated as \"not authenticated\", full stop.\n *\n *  - No token is ever interpolated into an error message. The server's error\n *    bodies are `{ error, code }` documents that do not echo credentials, and\n *    the request bodies that DO carry credentials are never included in a\n *    thrown message.\n */\n\nconst REQUEST_TIMEOUT_MS = 15_000;\n\nexport interface CliAuthConfig {\n  auth0Domain: string;\n  clientId: string;\n  scope: string;\n  deviceAuthorizationEndpoint: string;\n  tokenEndpoint: string;\n}\n\nexport interface EkanosSession {\n  accessToken: string;\n  expiresAt: string;\n  userId: string;\n  email: string | null;\n}\n\nexport interface EkanosIdentity {\n  id: string;\n  email: string | null;\n  name: string | null;\n}\n\n/** Fetch the device-flow parameters for a host. */\nexport async function fetchCliAuthConfig(host: string): Promise<CliAuthConfig> {\n  const response = await request(`${host}/api/auth/cli-config`, {\n    method: 'GET',\n    headers: { accept: 'application/json' },\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-config', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-config`);\n\n  const config = {\n    auth0Domain: str(body.auth0_domain),\n    clientId: str(body.client_id),\n    scope: str(body.scope),\n    deviceAuthorizationEndpoint: str(body.device_authorization_endpoint),\n    tokenEndpoint: str(body.token_endpoint),\n  };\n\n  if (Object.values(config).some((value) => value === null)) {\n    throw preconditionError(\n      `${host} returned an incomplete CLI login configuration.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-config route.`,\n    );\n  }\n\n  // The endpoints come from the server, so they are attacker-controlled if the\n  // host is. Pin them to the Auth0 domain the same response declares, so a\n  // compromised or misconfigured Ekanos cannot redirect the device flow — and\n  // the resulting credentials — to an arbitrary origin.\n  assertOnDomain(config.deviceAuthorizationEndpoint!, config.auth0Domain!);\n  assertOnDomain(config.tokenEndpoint!, config.auth0Domain!);\n\n  return config as CliAuthConfig;\n}\n\n/** Exchange a verified Auth0 access token for an Ekanos JWT. */\nexport async function createEkanosSession(\n  host: string,\n  auth0AccessToken: string,\n): Promise<EkanosSession> {\n  const response = await request(`${host}/api/auth/cli-session`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_access_token: auth0AccessToken }),\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `${host} rejected the Auth0 identity.`,\n      `Run \"ekanos login\" again. If it keeps failing, confirm your account ` +\n        `exists on ${host} — the browser login can succeed for an identity ` +\n        `that has no Ekanos account.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-session', response.status);\n  }\n\n  return toSession(\n    await readJson(response, `${host}/api/auth/cli-session`),\n    host,\n  );\n}\n\nexport interface RefreshedSession extends EkanosSession {\n  /** The ROTATED refresh token. The presented one is already invalid. */\n  auth0RefreshToken: string;\n}\n\nexport interface RefreshOptions {\n  /**\n   * Called the INSTANT a rotated refresh token is seen in the response — on\n   * success and on failure alike, before anything is thrown.\n   *\n   * Persist-on-learn, not persist-on-success. Once the server's exchange with\n   * Auth0 succeeds the presented token is dead and the replacement in that\n   * body is the only copy in existence, so a client that only saves it on the\n   * happy path destroys the partner's credential the first time /userinfo\n   * blips. The callback runs before any throw so no error path can skip it.\n   */\n  onRotatedToken?: (rotated: string) => void;\n}\n\n/** Re-mint an Ekanos JWT from the stored Auth0 refresh token. */\nexport async function refreshEkanosSession(\n  host: string,\n  auth0RefreshToken: string,\n  options: RefreshOptions = {},\n): Promise<RefreshedSession> {\n  const response = await request(`${host}/api/auth/cli-refresh`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_refresh_token: auth0RefreshToken }),\n  });\n\n  // Read the body FIRST, whatever the status: the rotated token can arrive on\n  // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured\n  // before any branch below throws.\n  const body = await readOptionalJson(response);\n  const rotated = str(body.auth0_refresh_token);\n\n  if (rotated) {\n    options.onRotatedToken?.(rotated);\n  }\n\n  throwIfNotConfigured(response, host, body);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `The stored session for ${host} is no longer valid.`,\n      `Run \"ekanos login\" to sign in again. This is expected after the ` +\n        `refresh token expires, after it is revoked in Auth0, or if two ` +\n        `machines used the same credentials file.`,\n    );\n  }\n\n  if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {\n    // NOT an auth failure. The credential was renewed — and, thanks to the\n    // callback above, already saved. Auth0's /userinfo is simply not answering.\n    throw networkError(\n      `${host} renewed the session but could not verify the identity with Auth0.`,\n      `Retry in a moment — your credentials are still valid and have been ` +\n        `updated. You do NOT need to run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no Ekanos account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then retry.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-refresh', response.status);\n  }\n\n  if (!rotated) {\n    throw networkError(\n      `${host} refreshed the session without returning a rotated refresh token.`,\n      `Run \"ekanos login\" to start a fresh session, and report this — the ` +\n        `deployment's Auth0 CLI application may not have rotation enabled.`,\n    );\n  }\n\n  return { ...toSession(body, host), auth0RefreshToken: rotated };\n}\n\n/**\n * Prove the Ekanos JWT authenticates. Returns null on 401 so the caller can\n * decide whether to refresh and retry — an expired access token is an ordinary\n * event, not an error.\n */\nexport async function fetchIdentity(\n  host: string,\n  accessToken: string,\n): Promise<EkanosIdentity | null> {\n  const response = await request(`${host}/api/auth/cli-whoami`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  // 401, or the 307 that an auth-gated Ekanos route answers with. Both mean\n  // \"this token did not authenticate\".\n  if (response.status === 401 || isRedirect(response.status)) {\n    return null;\n  }\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-whoami', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-whoami`);\n  const user = (body.user ?? {}) as Record<string, unknown>;\n  const id = str(user.id);\n\n  if (!id) {\n    throw networkError(\n      `${host} returned an identity without a user id.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-whoami route.`,\n    );\n  }\n\n  return { id, email: str(user.email), name: str(user.name) };\n}\n\nfunction toSession(body: Record<string, unknown>, host: string): EkanosSession {\n  const user = (body.user ?? {}) as Record<string, unknown>;\n\n  const accessToken = str(body.access_token);\n  const expiresAt = str(body.expires_at);\n  const userId = str(user.id);\n\n  if (!accessToken || !expiresAt || !userId) {\n    throw networkError(\n      `${host} returned an incomplete session.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `CLI auth routes, then retry.`,\n    );\n  }\n\n  return { accessToken, expiresAt, userId, email: str(user.email) };\n}\n\nexport async function request(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  try {\n    return await fetch(url, {\n      ...init,\n      redirect: 'manual',\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n\n    throw networkError(\n      `Could not reach ${new URL(url).origin}: ${reason}`,\n      `Check the host is correct and reachable from this machine ` +\n        `(proxy, VPN, DNS), then retry.`,\n    );\n  }\n}\n\n/**\n * Best-effort body read for a response whose status may be an error. Returns\n * an empty object rather than throwing, because the caller needs to inspect\n * the body BEFORE deciding what the status means — and a 500 from a proxy may\n * carry no JSON at all.\n */\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nasync function readJson(\n  response: Response,\n  what: string,\n): Promise<Record<string, unknown>> {\n  let parsed: unknown;\n\n  try {\n    parsed = await response.json();\n  } catch {\n    throw networkError(\n      `${what} did not return JSON.`,\n      `Confirm the host is an Ekanos deployment and not a proxy or captive ` +\n        `portal sitting in front of one.`,\n    );\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw networkError(\n      `${what} returned an unexpected payload.`,\n      `Confirm the host is an Ekanos deployment, then retry.`,\n    );\n  }\n\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * 503 means the deployment is not provisioned for CLI login — an operator\n * action that has not happened, not a fault in the request.\n *\n * Every route that reads the Fusion CLI Auth0 config can answer this, so every\n * caller has to check for it. Falling through to `unexpectedStatus` would tell\n * a partner \"confirm the host is an Ekanos deployment\" when the host is a\n * perfectly good Ekanos deployment that is simply missing one env var — and\n * would exit 8 (network, retryable) instead of 9 (precondition, not).\n */\nfunction throwIfNotConfigured(\n  response: Response,\n  host: string,\n  body?: Record<string, unknown>,\n): void {\n  if (response.status !== 503) return;\n\n  // 503 carries two meanings on these routes. Only CLI_NOT_CONFIGURED is a\n  // precondition; REFRESH_INCOMPLETE is transient and handled by its caller.\n  if (body && body.code !== 'CLI_NOT_CONFIGURED') return;\n\n  throw preconditionError(\n    `${host} does not have CLI login configured.`,\n    `Ask the Ekanos operator to provision the \"Fusion CLI\" Auth0 ` +\n      `application and set AUTH0_CLI_CLIENT_ID on that deployment.`,\n  );\n}\n\nfunction unexpectedStatus(host: string, route: string, status: number) {\n  return networkError(\n    `${host}${route} responded ${status}.`,\n    status >= 500\n      ? `The Ekanos deployment returned a server error. Retry shortly; if it ` +\n          `persists, report it with the status code.`\n      : `Confirm the host is an Ekanos deployment running a build that ` +\n          `includes ${route}.`,\n  );\n}\n\nfunction assertOnDomain(endpoint: string, domain: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw preconditionError(\n      `The login configuration contains a malformed endpoint.`,\n      `Report this to the operator of the Ekanos deployment.`,\n    );\n  }\n\n  if (\n    url.protocol !== 'https:' ||\n    url.host.toLowerCase() !== domain.toLowerCase()\n  ) {\n    throw preconditionError(\n      `The login configuration points at an endpoint outside its own Auth0 ` +\n        `domain (${url.host}).`,\n      `Do not continue. Report this to the operator of the Ekanos ` +\n        `deployment — it may be misconfigured or compromised.`,\n    );\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"ekanos-api.js","sourceRoot":"","sources":["../../src/auth/ekanos-api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAEH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAuBlC,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;KACxC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,GAAG,IAAI,kDAAkD,EACzD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,iBAAiB,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;IACvC,cAAc,CAAC,MAAM,CAAC,2BAA4B,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IACzE,cAAc,CAAC,MAAM,CAAC,aAAc,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IAE3D,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,gBAAwB;;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,+BAA+B,EACtC,sEAAsE;YACpE,aAAa,IAAI,mDAAmD;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,cAAc,OAClB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAI,GAAG,IAAI,0CAA0C,EACpE,IAAI,CAAC,IAAI,KAAK,kBAAkB;YAC9B,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,gEAAgE;gBAC9D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,CACd,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,uBAAuB,CAAC,EACxD,IAAI,CACL,CAAC;AACJ,CAAC;AAqBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,WAA+D,EAC/D,OAAO,GAAmB,EAAE;;;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,mBAAmB,EAAE,WAAW,CAAC,iBAAiB;YAClD,YAAY,EAAE,WAAW,CAAC,WAAW;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAA,OAAO,CAAC,cAAc,+CAAtB,OAAO,EAAkB,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0BAA0B,IAAI,qBAAqB;YACjD,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EACpD,kEAAkE;YAChE,sEAAsE;YACtE,qEAAqE;YACrE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,OAClB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAI,GAAG,IAAI,gCAAgC,EAC1D,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,YAAY,CAChB,GAAG,IAAI,oEAAoE,EAC3E,qEAAqE;YACnE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,oDAAoD,EAC3D,cAAc,IAAI,kDAAkD;YAClE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,CAChB,GAAG,IAAI,mEAAmE,EAC1E,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,uCAAY,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAE,iBAAiB,EAAE,OAAO,IAAG;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,yDAAyD,EAChE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,6CAA6C,EACpD,cAAc,IAAI,kDAAkD;YAClE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,YAAY,CAChB,GAAG,IAAI,0CAA0C,EACjD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B,EAAE,IAAY;;IAC5D,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,kCACjB,IAAI,KACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAC/C,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,YAAY,CAChB,mBAAmB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,EACnD,4DAA4D;YAC1D,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,IAAY;IAEZ,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;eAAO,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,uBAAuB,EAC9B,sEAAsE;YACpE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,IAAY,EACZ,IAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO;IAEvD,MAAM,iBAAiB,CACrB,GAAG,IAAI,sCAAsC,EAC7C,8DAA8D;QAC5D,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,kBAAkB,CAAC,QAAkB,EAAE,IAAY;;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,OAChC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAI,EAAE,EACzC,EAAE,CACH,CAAC;IAEF,MAAM,YAAY,CAChB,GAAG,IAAI,uDAAuD,EAC9D,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAC3C,CAAC,CAAC,YAAY,UAAU,WAAW;QACnC,CAAC,CAAC,yBAAyB,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACnE,OAAO,YAAY,CACjB,GAAG,IAAI,GAAG,KAAK,cAAc,MAAM,GAAG,EACtC,MAAM,IAAI,GAAG;QACX,CAAC,CAAC,sEAAsE;YACpE,2CAA2C;QAC/C,CAAC,CAAC,gEAAgE;YAC9D,YAAY,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEtC,IAAI,yCAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO;IAErE,MAAM,iBAAiB,CACrB,qEAAqE,MAAM,IAAI,EAC/E,6DAA6D;QAC3D,sDAAsD,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;eAAO,CAAC;QACP,MAAM,iBAAiB,CACrB,wDAAwD,EACxD,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAC/C,CAAC;QACD,MAAM,iBAAiB,CACrB,sEAAsE;YACpE,WAAW,GAAG,CAAC,IAAI,IAAI,EACzB,6DAA6D;YAC3D,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import {\n  authRequiredError,\n  forbiddenError,\n  networkError,\n  preconditionError,\n} from '../errors';\n\n/**\n * The CLI's client for the five Ekanos auth routes.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/auth/cli-<verb>` routes, and it ships on\n * a DIFFERENT BRANCH from this file. This block is the single place the shapes\n * are written down on the client side; if you change one side, change the\n * other and update this block. Nothing here imports host code — the two\n * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.\n *\n *   GET /api/auth/cli-config                                   [no auth]\n *     → 200 { auth0_domain, client_id, scope,\n *             device_authorization_endpoint, token_endpoint }   all strings\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *\n *   POST /api/auth/cli-session                                 [no auth]\n *     ← { auth0_access_token: string }\n *     → 200 { access_token, expires_at, user: { id, email } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }      malformed / wrong shape\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      Auth0 said no, OR no\n *                                                   Ekanos account for it\n *     → 403 { error, code: \"NO_DEVELOPER_SEAT\" }    no developer/admin seat\n *     → 403 { error, code: \"EMAIL_UNVERIFIED\" }     Auth0 email unverified\n *     → 429 { error, code: \"RATE_LIMITED\" }         + Retry-After header\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *     `error` on a 403 is a sentence written for the person; show it.\n *\n *   POST /api/auth/cli-refresh                                 [no auth]\n *     ← { auth0_refresh_token: string, access_token: string }\n *       access_token is the PREVIOUS Ekanos JWT (expired is fine): it names\n *       the server-side session this refresh continues. Required: without\n *       it the server answers 401 SESSION_EXPIRED, reason\n *       \"previous_token_missing\" (an older CLI is told to log in again).\n *     → 200 { access_token, expires_at, user: { id, email },\n *             auth0_refresh_token }   ← ROTATED; the presented one is dead\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"SESSION_EXPIRED\", reason? }\n *                                                   expired, revoked, idle\n *                                                   or past the session's\n *                                                   maximum age; checked\n *                                                   BEFORE rotation, so no\n *                                                   rotated token comes back\n *     → 403 { error, code: \"EMAIL_UNVERIFIED\",\n *             auth0_refresh_token }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\",\n *             auth0_refresh_token }                 no Ekanos account\n *     → 429 { error, code: \"RATE_LIMITED\" }         + Retry-After header\n *     → 502 { error, code: \"TOKEN_EXCHANGE_FAILED\" } Auth0 returned no\n *                                                   rotated token\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 503 { error, code: \"REFRESH_INCOMPLETE\",\n *             auth0_refresh_token }                 rotated, but /userinfo\n *                                                   did not answer; RETRYABLE\n *     → 500 { error, code: \"INTERNAL_ERROR\",\n *             auth0_refresh_token? }                present iff rotation\n *                                                   completed before the throw\n *\n *   !! cli-refresh MAY RETURN `auth0_refresh_token` ON ERROR RESPONSES, and a\n *      client MUST persist it before surfacing the error. Once the server's\n *      exchange with Auth0 succeeds the presented token is dead and the value\n *      in that body is the ONLY copy in existence; discarding it on a failure\n *      path destroys the session permanently. Note 503 has TWO codes here —\n *      branch on `code`, not on the status alone.\n *\n *   All three routes above read the Fusion CLI Auth0 application config, so all\n *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami and cli-logout cannot\n *   — they read no Auth0 config, only an Ekanos token.\n *\n *   POST /api/auth/cli-logout                                  [no auth]\n *     ← { access_token: string }   the stored Ekanos JWT; expired is fine\n *     → 200 { revoked: boolean }   false = already revoked / no session row\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        not a valid Ekanos token\n *     → 429 { error, code: \"RATE_LIMITED\" }\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *\n *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]\n *     → 200 { user: { id, email, name } }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        token absent or invalid\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\" }\n *     → 3xx                                         treated as 401, see below\n *\n * `access_token` is an Ekanos HS256 JWT. Every authenticated Ekanos route\n * accepts it as `Authorization: Bearer` — see `resolveRequestSupabaseJwt` in\n * `@kit/supabase`, which both `requireUser` and the RLS server client consume.\n * ---------------------------------------------------------------------------\n *\n * Two rules hold everywhere in this file:\n *\n *  - `redirect: 'manual'`. Ekanos answers an unauthenticated page request with\n *    a 307 to `/auth/sign-in`; Node's fetch follows redirects by default, so\n *    without this a stale token would come back as a 200 full of HTML and be\n *    read as success. A 3xx here is treated as \"not authenticated\", full stop.\n *\n *  - No token is ever interpolated into an error message. The server's error\n *    bodies are `{ error, code }` documents that do not echo credentials, and\n *    the request bodies that DO carry credentials are never included in a\n *    thrown message.\n */\n\nconst REQUEST_TIMEOUT_MS = 15_000;\n\nexport interface CliAuthConfig {\n  auth0Domain: string;\n  clientId: string;\n  scope: string;\n  deviceAuthorizationEndpoint: string;\n  tokenEndpoint: string;\n}\n\nexport interface EkanosSession {\n  accessToken: string;\n  expiresAt: string;\n  userId: string;\n  email: string | null;\n}\n\nexport interface EkanosIdentity {\n  id: string;\n  email: string | null;\n  name: string | null;\n}\n\n/** Fetch the device-flow parameters for a host. */\nexport async function fetchCliAuthConfig(host: string): Promise<CliAuthConfig> {\n  const response = await request(`${host}/api/auth/cli-config`, {\n    method: 'GET',\n    headers: { accept: 'application/json' },\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-config', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-config`);\n\n  const config = {\n    auth0Domain: str(body.auth0_domain),\n    clientId: str(body.client_id),\n    scope: str(body.scope),\n    deviceAuthorizationEndpoint: str(body.device_authorization_endpoint),\n    tokenEndpoint: str(body.token_endpoint),\n  };\n\n  if (Object.values(config).some((value) => value === null)) {\n    throw preconditionError(\n      `${host} returned an incomplete CLI login configuration.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-config route.`,\n    );\n  }\n\n  // The endpoints come from the server, so they are attacker-controlled if the\n  // host is. Pin the declared domain to Auth0 itself, then pin the endpoints\n  // to that domain, so a compromised or misconfigured Ekanos cannot redirect\n  // the device flow — and the resulting credentials — to an arbitrary origin.\n  // This does not prove the host is genuine: any Auth0 tenant passes, and a\n  // hostile host can name Ekanos's own. That is `login`'s new-host question.\n  assertAuth0Domain(config.auth0Domain!);\n  assertOnDomain(config.deviceAuthorizationEndpoint!, config.auth0Domain!);\n  assertOnDomain(config.tokenEndpoint!, config.auth0Domain!);\n\n  return config as CliAuthConfig;\n}\n\n/** Exchange a verified Auth0 access token for an Ekanos JWT. */\nexport async function createEkanosSession(\n  host: string,\n  auth0AccessToken: string,\n): Promise<EkanosSession> {\n  const response = await request(`${host}/api/auth/cli-session`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_access_token: auth0AccessToken }),\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `${host} rejected the Auth0 identity.`,\n      `Run \"ekanos login\" again. If it keeps failing, confirm your account ` +\n        `exists on ${host} — the browser login can succeed for an identity ` +\n        `that has no Ekanos account.`,\n    );\n  }\n\n  if (response.status === 403) {\n    const body = await readOptionalJson(response);\n\n    throw forbiddenError(\n      str(body.error) ?? `${host} refused a CLI session for this account.`,\n      body.code === 'EMAIL_UNVERIFIED'\n        ? `Verify your email address, then run \"ekanos login\" again.`\n        : `The Ekanos CLI needs a developer seat. Ask your administrator ` +\n            `for one, then run \"ekanos login\" again.`,\n    );\n  }\n\n  throwIfRateLimited(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-session', response.status);\n  }\n\n  return toSession(\n    await readJson(response, `${host}/api/auth/cli-session`),\n    host,\n  );\n}\n\nexport interface RefreshedSession extends EkanosSession {\n  /** The ROTATED refresh token. The presented one is already invalid. */\n  auth0RefreshToken: string;\n}\n\nexport interface RefreshOptions {\n  /**\n   * Called the INSTANT a rotated refresh token is seen in the response — on\n   * success and on failure alike, before anything is thrown.\n   *\n   * Persist-on-learn, not persist-on-success. Once the server's exchange with\n   * Auth0 succeeds the presented token is dead and the replacement in that\n   * body is the only copy in existence, so a client that only saves it on the\n   * happy path destroys the partner's credential the first time /userinfo\n   * blips. The callback runs before any throw so no error path can skip it.\n   */\n  onRotatedToken?: (rotated: string) => void;\n}\n\n/**\n * Re-mint an Ekanos JWT from the stored Auth0 refresh token. `accessToken` is\n * the previous Ekanos JWT (usually expired): the server reads the session id\n * from it to enforce that session's idle timeout, maximum age and revocation.\n */\nexport async function refreshEkanosSession(\n  host: string,\n  credentials: { auth0RefreshToken: string; accessToken: string },\n  options: RefreshOptions = {},\n): Promise<RefreshedSession> {\n  const response = await request(`${host}/api/auth/cli-refresh`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({\n      auth0_refresh_token: credentials.auth0RefreshToken,\n      access_token: credentials.accessToken,\n    }),\n  });\n\n  // Read the body FIRST, whatever the status: the rotated token can arrive on\n  // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured\n  // before any branch below throws.\n  const body = await readOptionalJson(response);\n  const rotated = str(body.auth0_refresh_token);\n\n  if (rotated) {\n    options.onRotatedToken?.(rotated);\n  }\n\n  throwIfNotConfigured(response, host, body);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `The stored session for ${host} is no longer valid` +\n        (str(body.error) ? ` (${str(body.error)}).` : '.'),\n      `Run \"ekanos login\" to sign in again. This is expected after the ` +\n        `session's idle timeout or maximum age, after \"ekanos logout\", after ` +\n        `the refresh token is revoked in Auth0, or if two machines used the ` +\n        `same credentials file.`,\n    );\n  }\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      str(body.error) ?? `${host} refused to renew the session.`,\n      `Verify your email address, then run \"ekanos login\" again.`,\n    );\n  }\n\n  throwIfRateLimited(response, host);\n\n  if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {\n    // NOT an auth failure. The credential was renewed — and, thanks to the\n    // callback above, already saved. Auth0's /userinfo is simply not answering.\n    throw networkError(\n      `${host} renewed the session but could not verify the identity with Auth0.`,\n      `Retry in a moment — your credentials are still valid and have been ` +\n        `updated. You do NOT need to run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no Ekanos account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then retry.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-refresh', response.status);\n  }\n\n  if (!rotated) {\n    throw networkError(\n      `${host} refreshed the session without returning a rotated refresh token.`,\n      `Run \"ekanos login\" to start a fresh session, and report this — the ` +\n        `deployment's Auth0 CLI application may not have rotation enabled.`,\n    );\n  }\n\n  return { ...toSession(body, host), auth0RefreshToken: rotated };\n}\n\n/**\n * Prove the Ekanos JWT authenticates. Returns null on 401 so the caller can\n * decide whether to refresh and retry — an expired access token is an ordinary\n * event, not an error.\n */\nexport async function fetchIdentity(\n  host: string,\n  accessToken: string,\n): Promise<EkanosIdentity | null> {\n  const response = await request(`${host}/api/auth/cli-whoami`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  // 401, or the 307 that an auth-gated Ekanos route answers with. Both mean\n  // \"this token did not authenticate\".\n  if (response.status === 401 || isRedirect(response.status)) {\n    return null;\n  }\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-whoami', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-whoami`);\n  const user = (body.user ?? {}) as Record<string, unknown>;\n  const id = str(user.id);\n\n  if (!id) {\n    throw networkError(\n      `${host} returned an identity without a user id.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-whoami route.`,\n    );\n  }\n\n  return { id, email: str(user.email), name: str(user.name) };\n}\n\n/**\n * End the server-side session behind an Ekanos JWT (`ekanos logout`). Returns\n * whether the server answered — `true` also when the session was already\n * revoked, since either way it can no longer be refreshed. Never throws for\n * an HTTP status: logout must always reach the local delete.\n */\nexport async function revokeEkanosSession(\n  host: string,\n  accessToken: string,\n): Promise<boolean> {\n  const response = await request(`${host}/api/auth/cli-logout`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ access_token: accessToken }),\n  });\n\n  return response.ok;\n}\n\nfunction toSession(body: Record<string, unknown>, host: string): EkanosSession {\n  const user = (body.user ?? {}) as Record<string, unknown>;\n\n  const accessToken = str(body.access_token);\n  const expiresAt = str(body.expires_at);\n  const userId = str(user.id);\n\n  if (!accessToken || !expiresAt || !userId) {\n    throw networkError(\n      `${host} returned an incomplete session.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `CLI auth routes, then retry.`,\n    );\n  }\n\n  return { accessToken, expiresAt, userId, email: str(user.email) };\n}\n\nexport async function request(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  try {\n    return await fetch(url, {\n      ...init,\n      redirect: 'manual',\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n\n    throw networkError(\n      `Could not reach ${new URL(url).origin}: ${reason}`,\n      `Check the host is correct and reachable from this machine ` +\n        `(proxy, VPN, DNS), then retry.`,\n    );\n  }\n}\n\n/**\n * Best-effort body read for a response whose status may be an error. Returns\n * an empty object rather than throwing, because the caller needs to inspect\n * the body BEFORE deciding what the status means — and a 500 from a proxy may\n * carry no JSON at all.\n */\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nasync function readJson(\n  response: Response,\n  what: string,\n): Promise<Record<string, unknown>> {\n  let parsed: unknown;\n\n  try {\n    parsed = await response.json();\n  } catch {\n    throw networkError(\n      `${what} did not return JSON.`,\n      `Confirm the host is an Ekanos deployment and not a proxy or captive ` +\n        `portal sitting in front of one.`,\n    );\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw networkError(\n      `${what} returned an unexpected payload.`,\n      `Confirm the host is an Ekanos deployment, then retry.`,\n    );\n  }\n\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * 503 means the deployment is not provisioned for CLI login — an operator\n * action that has not happened, not a fault in the request.\n *\n * Every route that reads the Fusion CLI Auth0 config can answer this, so every\n * caller has to check for it. Falling through to `unexpectedStatus` would tell\n * a partner \"confirm the host is an Ekanos deployment\" when the host is a\n * perfectly good Ekanos deployment that is simply missing one env var — and\n * would exit 8 (network, retryable) instead of 9 (precondition, not).\n */\nfunction throwIfNotConfigured(\n  response: Response,\n  host: string,\n  body?: Record<string, unknown>,\n): void {\n  if (response.status !== 503) return;\n\n  // 503 carries two meanings on these routes. Only CLI_NOT_CONFIGURED is a\n  // precondition; REFRESH_INCOMPLETE is transient and handled by its caller.\n  if (body && body.code !== 'CLI_NOT_CONFIGURED') return;\n\n  throw preconditionError(\n    `${host} does not have CLI login configured.`,\n    `Ask the Ekanos operator to provision the \"Fusion CLI\" Auth0 ` +\n      `application and set AUTH0_CLI_CLIENT_ID on that deployment.`,\n  );\n}\n\n/** 429: the deployment is throttling this machine's address. Retryable. */\nfunction throwIfRateLimited(response: Response, host: string): void {\n  if (response.status !== 429) return;\n\n  const retryAfter = Number.parseInt(\n    response.headers.get('retry-after') ?? '',\n    10,\n  );\n\n  throw networkError(\n    `${host} is rate-limiting sign-in requests from this address.`,\n    Number.isFinite(retryAfter) && retryAfter > 0\n      ? `Retry in ${retryAfter} seconds.`\n      : `Retry in a few minutes.`,\n  );\n}\n\nfunction unexpectedStatus(host: string, route: string, status: number) {\n  return networkError(\n    `${host}${route} responded ${status}.`,\n    status >= 500\n      ? `The Ekanos deployment returned a server error. Retry shortly; if it ` +\n          `persists, report it with the status code.`\n      : `Confirm the host is an Ekanos deployment running a build that ` +\n          `includes ${route}.`,\n  );\n}\n\n/**\n * Every Ekanos tenant signs in on an `*.auth0.com` domain today\n * (`fusion-{dev,stage,prod}.us.auth0.com`). If one moves to an Auth0 custom\n * domain, add that domain here.\n */\nfunction assertAuth0Domain(domain: string): void {\n  const hostname = domain.toLowerCase();\n\n  if (/^[a-z0-9-]+(\\.[a-z0-9-]+)*\\.auth0\\.com$/.test(hostname)) return;\n\n  throw preconditionError(\n    `The login configuration names a sign-in domain that is not Auth0 (${domain}).`,\n    `Do not continue. Report this to the operator of the Ekanos ` +\n      `deployment — it may be misconfigured or compromised.`,\n  );\n}\n\nfunction assertOnDomain(endpoint: string, domain: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw preconditionError(\n      `The login configuration contains a malformed endpoint.`,\n      `Report this to the operator of the Ekanos deployment.`,\n    );\n  }\n\n  if (\n    url.protocol !== 'https:' ||\n    url.host.toLowerCase() !== domain.toLowerCase()\n  ) {\n    throw preconditionError(\n      `The login configuration points at an endpoint outside its own Auth0 ` +\n        `domain (${url.host}).`,\n      `Do not continue. Report this to the operator of the Ekanos ` +\n        `deployment — it may be misconfigured or compromised.`,\n    );\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/auth/host-trust.d.ts

@@ -0,0 +1,46 @@
+import type { CredentialStore } from './credential-store.js';
+/**
+ * Which hosts the CLI may send a login, or a token, to without asking.
+ *
+ * A host the CLI resolved is not a host the developer chose: `ekanos.json`
+ * is a committed file, so its `host` can be set by anyone who can land a
+ * change in the repo. Three rules follow, and this file holds all three:
+ *
+ *  - a hint never tells anyone to log in to a host that is neither stored
+ *    nor a known Ekanos host (`loginHint`);
+ *  - credentials never cross plaintext HTTP to a remote host
+ *    (`assertSecureTransport`);
+ *  - `ekanos login` to a host that is not known asks first (`isKnownHost`,
+ *    used by `commands/login.ts`).
+ *
+ * "Known" is a stored host, a loopback host, or one under Vastly's own root
+ * domains. A Source can serve Ekanos on its own custom domain
+ * (`source_configs.custom_domains`), which no static list can name, so a
+ * custom domain is known only once you have logged in to it.
+ */
+/** Vastly's own root domains; every Source slug is a subdomain of one. */
+export declare const EKANOS_ROOT_DOMAINS: readonly ['vastlyfusion.site', 'vastlyfusion-stage.site', 'vastlyfusion-dev.site'];
+/** Where a resolved host came from, in `resolveHost`'s order. */
+export type HostOrigin = 'flag' | 'env' | 'project' | 'stored';
+export declare function isLoopbackHost(host: string): boolean;
+/** An https host under one of `EKANOS_ROOT_DOMAINS`, or a loopback host. */
+export declare function isEkanosHost(host: string): boolean;
+export declare function isKnownHost(store: CredentialStore, host: string): boolean;
+export declare function isPlaintextRemoteHost(host: string): boolean;
+/**
+ * Refuse to send credentials to a remote host over plaintext HTTP. Loopback
+ * stays allowed, because local development needs `http://localhost:3000`.
+ */
+export declare function assertSecureTransport(host: string): void;
+/**
+ * The hint for "log in to this host", the one place it is written.
+ *
+ * To a known host it names the command. To any other host it does not: a
+ * coding agent follows a hint, and following this one would sign the
+ * developer in to whatever a committed file named.
+ */
+export declare function loginHint(env: {
+    host: string;
+    store: CredentialStore;
+    hostOrigin: HostOrigin;
+}, then?: string): string;

package/dist/auth/host-trust.js

@@ -0,0 +1,79 @@
+import { preconditionError } from '../errors.js';
+/**
+ * Which hosts the CLI may send a login, or a token, to without asking.
+ *
+ * A host the CLI resolved is not a host the developer chose: `ekanos.json`
+ * is a committed file, so its `host` can be set by anyone who can land a
+ * change in the repo. Three rules follow, and this file holds all three:
+ *
+ *  - a hint never tells anyone to log in to a host that is neither stored
+ *    nor a known Ekanos host (`loginHint`);
+ *  - credentials never cross plaintext HTTP to a remote host
+ *    (`assertSecureTransport`);
+ *  - `ekanos login` to a host that is not known asks first (`isKnownHost`,
+ *    used by `commands/login.ts`).
+ *
+ * "Known" is a stored host, a loopback host, or one under Vastly's own root
+ * domains. A Source can serve Ekanos on its own custom domain
+ * (`source_configs.custom_domains`), which no static list can name, so a
+ * custom domain is known only once you have logged in to it.
+ */
+/** Vastly's own root domains; every Source slug is a subdomain of one. */
+export const EKANOS_ROOT_DOMAINS = [
+    'vastlyfusion.site',
+    'vastlyfusion-stage.site',
+    'vastlyfusion-dev.site',
+];
+const ORIGIN_LABEL = {
+    flag: '--host',
+    env: 'EKANOS_HOST',
+    project: 'the "host" field in ekanos.json',
+    stored: 'your stored login',
+};
+export function isLoopbackHost(host) {
+    const { hostname } = new URL(host);
+    return (['localhost', '127.0.0.1', '[::1]', '0.0.0.0'].includes(hostname) ||
+        hostname.endsWith('.localhost'));
+}
+/** An https host under one of `EKANOS_ROOT_DOMAINS`, or a loopback host. */
+export function isEkanosHost(host) {
+    if (isLoopbackHost(host))
+        return true;
+    const url = new URL(host);
+    return (url.protocol === 'https:' &&
+        EKANOS_ROOT_DOMAINS.some((root) => url.hostname === root || url.hostname.endsWith(`.${root}`)));
+}
+export function isKnownHost(store, host) {
+    return isEkanosHost(host) || store.hosts().includes(host);
+}
+export function isPlaintextRemoteHost(host) {
+    return new URL(host).protocol === 'http:' && !isLoopbackHost(host);
+}
+/**
+ * Refuse to send credentials to a remote host over plaintext HTTP. Loopback
+ * stays allowed, because local development needs `http://localhost:3000`.
+ */
+export function assertSecureTransport(host) {
+    if (!isPlaintextRemoteHost(host))
+        return;
+    throw preconditionError(`${host} is plaintext HTTP, and your credentials would cross the network unencrypted.`, `Use the https:// URL of the host. Plain http:// is allowed only for ` +
+        `localhost, 127.0.0.1, [::1] and *.localhost.`);
+}
+/**
+ * The hint for "log in to this host", the one place it is written.
+ *
+ * To a known host it names the command. To any other host it does not: a
+ * coding agent follows a hint, and following this one would sign the
+ * developer in to whatever a committed file named.
+ */
+export function loginHint(env, then = 'and retry.') {
+    const { host } = env;
+    if (isKnownHost(env.store, host)) {
+        return `Run "ekanos login --host ${host}" ${then}`;
+    }
+    return (`${host} came from ${ORIGIN_LABEL[env.hostOrigin]}, and you have never ` +
+        `logged in to it. Check it is the Ekanos deployment you meant to use ` +
+        `before you run "ekanos login --host ${host}" yourself. An agent should ` +
+        `ask the person it works for rather than log in to it.`);
+}
+//# sourceMappingURL=host-trust.js.map

package/dist/auth/host-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-trust.js","sourceRoot":"","sources":["../../src/auth/host-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAG9C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,mBAAmB;IACnB,yBAAyB;IACzB,uBAAuB;CACf,CAAC;AAKX,MAAM,YAAY,GAA+B;IAC/C,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,aAAa;IAClB,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,mBAAmB;CAC5B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,CACL,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,mBAAmB,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CACrE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAsB,EAAE,IAAY;IAC9D,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO;IAEzC,MAAM,iBAAiB,CACrB,GAAG,IAAI,+EAA+E,EACtF,sEAAsE;QACpE,8CAA8C,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,GAAqE,EACrE,IAAI,GAAG,YAAY;IAEnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAErB,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,4BAA4B,IAAI,KAAK,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,CACL,GAAG,IAAI,cAAc,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB;QACxE,sEAAsE;QACtE,uCAAuC,IAAI,8BAA8B;QACzE,uDAAuD,CACxD,CAAC;AACJ,CAAC","sourcesContent":["import { preconditionError } from '../errors';\nimport type { CredentialStore } from './credential-store';\n\n/**\n * Which hosts the CLI may send a login, or a token, to without asking.\n *\n * A host the CLI resolved is not a host the developer chose: `ekanos.json`\n * is a committed file, so its `host` can be set by anyone who can land a\n * change in the repo. Three rules follow, and this file holds all three:\n *\n *  - a hint never tells anyone to log in to a host that is neither stored\n *    nor a known Ekanos host (`loginHint`);\n *  - credentials never cross plaintext HTTP to a remote host\n *    (`assertSecureTransport`);\n *  - `ekanos login` to a host that is not known asks first (`isKnownHost`,\n *    used by `commands/login.ts`).\n *\n * \"Known\" is a stored host, a loopback host, or one under Vastly's own root\n * domains. A Source can serve Ekanos on its own custom domain\n * (`source_configs.custom_domains`), which no static list can name, so a\n * custom domain is known only once you have logged in to it.\n */\n\n/** Vastly's own root domains; every Source slug is a subdomain of one. */\nexport const EKANOS_ROOT_DOMAINS = [\n  'vastlyfusion.site',\n  'vastlyfusion-stage.site',\n  'vastlyfusion-dev.site',\n] as const;\n\n/** Where a resolved host came from, in `resolveHost`'s order. */\nexport type HostOrigin = 'flag' | 'env' | 'project' | 'stored';\n\nconst ORIGIN_LABEL: Record<HostOrigin, string> = {\n  flag: '--host',\n  env: 'EKANOS_HOST',\n  project: 'the \"host\" field in ekanos.json',\n  stored: 'your stored login',\n};\n\nexport function isLoopbackHost(host: string): boolean {\n  const { hostname } = new URL(host);\n\n  return (\n    ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'].includes(hostname) ||\n    hostname.endsWith('.localhost')\n  );\n}\n\n/** An https host under one of `EKANOS_ROOT_DOMAINS`, or a loopback host. */\nexport function isEkanosHost(host: string): boolean {\n  if (isLoopbackHost(host)) return true;\n\n  const url = new URL(host);\n\n  return (\n    url.protocol === 'https:' &&\n    EKANOS_ROOT_DOMAINS.some(\n      (root) => url.hostname === root || url.hostname.endsWith(`.${root}`),\n    )\n  );\n}\n\nexport function isKnownHost(store: CredentialStore, host: string): boolean {\n  return isEkanosHost(host) || store.hosts().includes(host);\n}\n\nexport function isPlaintextRemoteHost(host: string): boolean {\n  return new URL(host).protocol === 'http:' && !isLoopbackHost(host);\n}\n\n/**\n * Refuse to send credentials to a remote host over plaintext HTTP. Loopback\n * stays allowed, because local development needs `http://localhost:3000`.\n */\nexport function assertSecureTransport(host: string): void {\n  if (!isPlaintextRemoteHost(host)) return;\n\n  throw preconditionError(\n    `${host} is plaintext HTTP, and your credentials would cross the network unencrypted.`,\n    `Use the https:// URL of the host. Plain http:// is allowed only for ` +\n      `localhost, 127.0.0.1, [::1] and *.localhost.`,\n  );\n}\n\n/**\n * The hint for \"log in to this host\", the one place it is written.\n *\n * To a known host it names the command. To any other host it does not: a\n * coding agent follows a hint, and following this one would sign the\n * developer in to whatever a committed file named.\n */\nexport function loginHint(\n  env: { host: string; store: CredentialStore; hostOrigin: HostOrigin },\n  then = 'and retry.',\n): string {\n  const { host } = env;\n\n  if (isKnownHost(env.store, host)) {\n    return `Run \"ekanos login --host ${host}\" ${then}`;\n  }\n\n  return (\n    `${host} came from ${ORIGIN_LABEL[env.hostOrigin]}, and you have never ` +\n    `logged in to it. Check it is the Ekanos deployment you meant to use ` +\n    `before you run \"ekanos login --host ${host}\" yourself. An agent should ` +\n    `ask the person it works for rather than log in to it.`\n  );\n}\n"]}

package/dist/auth/session.d.ts

@@ -1,6 +1,7 @@
 import type { CliContext } from '../context.js';
 import { CredentialStore, type StoredSession } from './credential-store.js';
 import { type EkanosIdentity } from './ekanos-api.js';
+import { type HostOrigin } from './host-trust.js';
 /**
  * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos
  * host comes from, where credentials live, and how a stale access token is
@@ -9,6 +10,8 @@ import { type EkanosIdentity } from './ekanos-api.js';
 export interface AuthEnvironment {
     store: CredentialStore;
     host: string;
+    /** Where `host` came from — what `loginHint` names for an unknown host. */
+    hostOrigin: HostOrigin;
 }
 /**
  * Resolve the Ekanos host, in this order:
@@ -36,11 +39,17 @@ export declare function resolveHost(ctx: CliContext, flag: string | undefined, e
 export interface ResolveAuthOptions {
     /** Directory whose ekanos.json may carry a `host` field. */
     projectDir?: string;
+    /**
+     * Let a remote `http://` host through with a warning instead of refusing
+     * it. Only `logout` sets this: deleting local credentials must still work
+     * for a host stored before plaintext remote hosts were refused.
+     */
+    allowPlaintext?: boolean;
 }
 export declare function resolveAuthEnvironment(ctx: CliContext, hostFlag: string | undefined, env: Record<string, string | undefined>, options?: ResolveAuthOptions): AuthEnvironment;
 /** A store with no host attached — for `logout --all`. */
 export declare function newStore(ctx: CliContext, env: Record<string, string | undefined>): CredentialStore;
-export declare function requireSession(store: CredentialStore, host: string): StoredSession;
+export declare function requireSession(env: AuthEnvironment): StoredSession;
 /**
  * Resolve the caller's identity, refreshing the access token once if the
  * stored one no longer authenticates.

package/dist/auth/session.js

@@ -4,6 +4,7 @@ import { authRequiredError, usageError } from '../errors.js';
 import { shortHost } from '../ui.js';
 import { CredentialStore, normalizeHost, resolveEkanosHome, } from './credential-store.js';
 import { fetchIdentity, refreshEkanosSession, } from './ekanos-api.js';
+import { assertSecureTransport, isPlaintextRemoteHost, loginHint, } from './host-trust.js';
 /**
  * Resolve the Ekanos host, in this order:
  *
@@ -22,11 +23,17 @@ import { fetchIdentity, refreshEkanosSession, } from './ekanos-api.js';
  * ambiguity, so it stays a usage error that LISTS them rather than a guess.
  */
 export function resolveHost(ctx, flag, env, options = {}) {
+    return resolveHostWithOrigin(ctx, flag, env, options).host;
+}
+function resolveHostWithOrigin(ctx, flag, env, options) {
     var _a;
     var _b;
     const raw = flag !== null && flag !== void 0 ? flag : env.EKANOS_HOST;
     if (raw && raw.trim().length > 0) {
-        return normalizeHost(raw.trim());
+        return {
+            host: normalizeHost(raw.trim()),
+            origin: flag === undefined ? 'env' : 'flag',
+        };
     }
     if (options.projectDir) {
         const declared = readProjectHost(options.projectDir);
@@ -45,7 +52,7 @@ export function resolveHost(ctx, flag, env, options = {}) {
                     `Pass --host to override for one command.`
                 : ctx.ui.dim(`Using ${shortHost(host)} from ekanos.json. ` +
                     `Pass --host to override for one command.`));
-            return host;
+            return { host, origin: 'project' };
         }
     }
     const stored = (_b = (_a = options.store) === null || _a === void 0 ? void 0 : _a.hosts()) !== null && _b !== void 0 ? _b : [];
@@ -58,7 +65,7 @@ export function resolveHost(ctx, flag, env, options = {}) {
             ctx.log(`ekanos: using ${host} — the only host you are logged in to. ` +
                 `Pass --host to target a different one.`);
         }
-        return host;
+        return { host, origin: 'stored' };
     }
     throw usageError('No Ekanos host given.', stored.length > 1
         ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +
@@ -100,12 +107,18 @@ function readProjectHost(projectDir) {
 }
 export function resolveAuthEnvironment(ctx, hostFlag, env, options = {}) {
     const store = newStore(ctx, env);
-    const host = resolveHost(ctx, hostFlag, env, {
+    const { host, origin } = resolveHostWithOrigin(ctx, hostFlag, env, {
         projectDir: options.projectDir,
         store,
     });
-    warnOnPlaintextHost(ctx, host);
-    return { host, store };
+    if (!options.allowPlaintext) {
+        assertSecureTransport(host);
+    }
+    else if (isPlaintextRemoteHost(host)) {
+        ctx.warn(`ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +
+            `network unencrypted. Use https:// unless this is a local host.`);
+    }
+    return { host, store, hostOrigin: origin };
 }
 /** A store with no host attached — for `logout --all`. */
 export function newStore(ctx, env) {
@@ -115,27 +128,10 @@ export function newStore(ctx, env) {
         warn: (message) => ctx.warn(message),
     });
 }
-/**
- * `http://` is allowed because local development needs it, but sending a
- * bearer token to a plaintext REMOTE host puts it on the wire in the clear.
- * Warn rather than refuse: refusing would break `--host http://localhost:3000`
- * for anyone whose loopback resolves to something other than the names below.
- */
-function warnOnPlaintextHost(ctx, host) {
-    const url = new URL(host);
-    if (url.protocol !== 'http:')
-        return;
-    const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];
-    if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {
-        return;
-    }
-    ctx.warn(`ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +
-        `network unencrypted. Use https:// unless this is a local host.`);
-}
-export function requireSession(store, host) {
-    const session = store.read(host);
+export function requireSession(env) {
+    const session = env.store.read(env.host);
     if (!session) {
-        throw authRequiredError(`Not logged in to ${host}.`, `Run "ekanos login --host ${host}".`);
+        throw authRequiredError(`Not logged in to ${env.host}.`, loginHint(env, 'to sign in.'));
     }
     return session;
 }
@@ -157,7 +153,8 @@ export async function resolveIdentity(env, session) {
     const refreshed = await refreshStoredSession(env, session);
     const retried = await fetchIdentity(env.host, refreshed.accessToken);
     if (!retried) {
-        throw authRequiredError(`The session for ${env.host} could not be renewed.`, `Run "ekanos logout --host ${env.host}" then "ekanos login --host ${env.host}".`);
+        throw authRequiredError(`The session for ${env.host} could not be renewed.`, `Run "ekanos logout --host ${env.host}" first. ` +
+            loginHint(env, 'to sign in again.'));
     }
     return { identity: retried, session: refreshed };
 }
@@ -182,7 +179,10 @@ export async function refreshStoredSession(env, session) {
     const persistRotated = (rotated) => {
         env.store.write(env.host, Object.assign(Object.assign({}, session), { auth0RefreshToken: rotated, updatedAt: new Date().toISOString() }));
     };
-    const refreshed = await refreshEkanosSession(env.host, session.auth0RefreshToken, { onRotatedToken: persistRotated });
+    const refreshed = await refreshEkanosSession(env.host, {
+        auth0RefreshToken: session.auth0RefreshToken,
+        accessToken: session.accessToken,
+    }, { onRotatedToken: persistRotated });
     const next = {
         auth0RefreshToken: refreshed.auth0RefreshToken,
         accessToken: refreshed.accessToken,

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAatB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAO,GAKH,EAAE;;;IAEN,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,iBAAiB,IAAI,oCAAoC;oBACvD,0CAA0C;gBAC9C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,SAAS,SAAS,CAAC,IAAI,CAAC,qBAAqB;oBAC3C,0CAA0C,CAC7C,CACN,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,SAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;gBAC5D,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,OAAO,GAAuB,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;QACnE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,IAAI,GAAG,EAC3B,4BAA4B,IAAI,IAAI,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,+BAA+B,GAAG,CAAC,IAAI,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,iBAAiB,EACzB,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport { shortHost } from '../ui';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type EkanosIdentity,\n  fetchIdentity,\n  refreshEkanosSession,\n} from './ekanos-api';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n}\n\n/**\n * Resolve the Ekanos host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return normalizeHost(raw.trim());\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        ctx.jsonMode\n          ? `ekanos: using ${host} — the host saved in ekanos.json. ` +\n              `Pass --host to override for one command.`\n          : ctx.ui.dim(\n              `Using ${shortHost(host)} from ekanos.json. ` +\n                `Pass --host to override for one command.`,\n            ),\n      );\n\n      return host;\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    // A person at a terminal sees this host in the result block of every\n    // verb, and it is the only one they are signed in to, so naming it\n    // again is noise. JSON callers get no result block, so they keep it.\n    if (ctx.jsonMode) {\n      ctx.log(\n        `ekanos: using ${host} — the only host you are logged in to. ` +\n          `Pass --host to target a different one.`,\n      );\n    }\n\n    return host;\n  }\n\n  throw usageError(\n    'No Ekanos host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-ekanos-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const host = resolveHost(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  warnOnPlaintextHost(ctx, host);\n\n  return { host, store };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\n/**\n * `http://` is allowed because local development needs it, but sending a\n * bearer token to a plaintext REMOTE host puts it on the wire in the clear.\n * Warn rather than refuse: refusing would break `--host http://localhost:3000`\n * for anyone whose loopback resolves to something other than the names below.\n */\nfunction warnOnPlaintextHost(ctx: CliContext, host: string): void {\n  const url = new URL(host);\n\n  if (url.protocol !== 'http:') return;\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];\n\n  if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {\n    return;\n  }\n\n  ctx.warn(\n    `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n      `network unencrypted. Use https:// unless this is a local host.`,\n  );\n}\n\nexport function requireSession(\n  store: CredentialStore,\n  host: string,\n): StoredSession {\n  const session = store.read(host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${host}.`,\n      `Run \"ekanos login --host ${host}\".`,\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: EkanosIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" then \"ekanos login --host ${env.host}\".`,\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshEkanosSession(\n    env.host,\n    session.auth0RefreshToken,\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,qBAAqB,EACrB,qBAAqB,EACrB,SAAS,GACV,MAAM,cAAc,CAAC;AAetB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAO,GAKH,EAAE;IAEN,OAAO,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAyD;;;IAEzD,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,iBAAiB,IAAI,oCAAoC;oBACvD,0CAA0C;gBAC9C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,SAAS,SAAS,CAAC,IAAI,CAAC,qBAAqB;oBAC3C,0CAA0C,CAC7C,CACN,CAAC;YAEF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,SAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;gBAC5D,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAaD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,OAAO,GAAuB,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QACjE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;YACnE,gEAAgE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,GAAG,CAAC,IAAI,GAAG,EAC/B,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,WAAW;YAC9C,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR;QACE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,EACD,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport { shortHost } from '../ui';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type EkanosIdentity,\n  fetchIdentity,\n  refreshEkanosSession,\n} from './ekanos-api';\nimport {\n  type HostOrigin,\n  assertSecureTransport,\n  isPlaintextRemoteHost,\n  loginHint,\n} from './host-trust';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n  /** Where `host` came from — what `loginHint` names for an unknown host. */\n  hostOrigin: HostOrigin;\n}\n\n/**\n * Resolve the Ekanos host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  return resolveHostWithOrigin(ctx, flag, env, options).host;\n}\n\nfunction resolveHostWithOrigin(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: { projectDir?: string; store?: CredentialStore },\n): { host: string; origin: HostOrigin } {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return {\n      host: normalizeHost(raw.trim()),\n      origin: flag === undefined ? 'env' : 'flag',\n    };\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        ctx.jsonMode\n          ? `ekanos: using ${host} — the host saved in ekanos.json. ` +\n              `Pass --host to override for one command.`\n          : ctx.ui.dim(\n              `Using ${shortHost(host)} from ekanos.json. ` +\n                `Pass --host to override for one command.`,\n            ),\n      );\n\n      return { host, origin: 'project' };\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    // A person at a terminal sees this host in the result block of every\n    // verb, and it is the only one they are signed in to, so naming it\n    // again is noise. JSON callers get no result block, so they keep it.\n    if (ctx.jsonMode) {\n      ctx.log(\n        `ekanos: using ${host} — the only host you are logged in to. ` +\n          `Pass --host to target a different one.`,\n      );\n    }\n\n    return { host, origin: 'stored' };\n  }\n\n  throw usageError(\n    'No Ekanos host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-ekanos-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n  /**\n   * Let a remote `http://` host through with a warning instead of refusing\n   * it. Only `logout` sets this: deleting local credentials must still work\n   * for a host stored before plaintext remote hosts were refused.\n   */\n  allowPlaintext?: boolean;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const { host, origin } = resolveHostWithOrigin(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  if (!options.allowPlaintext) {\n    assertSecureTransport(host);\n  } else if (isPlaintextRemoteHost(host)) {\n    ctx.warn(\n      `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n        `network unencrypted. Use https:// unless this is a local host.`,\n    );\n  }\n\n  return { host, store, hostOrigin: origin };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\nexport function requireSession(env: AuthEnvironment): StoredSession {\n  const session = env.store.read(env.host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${env.host}.`,\n      loginHint(env, 'to sign in.'),\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: EkanosIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" first. ` +\n        loginHint(env, 'to sign in again.'),\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshEkanosSession(\n    env.host,\n    {\n      auth0RefreshToken: session.auth0RefreshToken,\n      accessToken: session.accessToken,\n    },\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}

package/dist/commands/agents-edit.d.ts

@@ -42,8 +42,12 @@ export declare function areaRows(subcommand: TemplateEditSubcommand, body: Agent
 export declare function describeTrigger(trigger: AgentTemplateTrigger): string;
 export declare function describeLink(link: AgentTemplateLink): string;
 /**
- * `--filter field=value`, repeatable. A value with a comma is a list
- * (`tags=vip,urgent`), `true`/`false` a switch, anything else text.
+ * `--filter`, the same at the template and the team level. Repeatable
+ * `field=value`: a value with a comma is a list (`tags=vip,urgent`),
+ * `true`/`false` a switch, anything else text. Or one JSON object, the team
+ * level's older form. Both are accepted at both levels, and may be mixed
+ * (a later field wins).
  */
 export declare function parseFilters(raw: readonly string[]): Record<string, string | boolean | string[]>;
+export declare const TEMPLATE_EDIT_HELP: Record<TemplateEditSubcommand, string>;
 export declare function isTemplateEditSubcommand(value: string): value is TemplateEditSubcommand;