@extenshi/cli 0.9.0 → 0.10.0

package/dist/cli.js

@@ -23,11 +23,15 @@
  */
 import { readFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
+import os from 'node:os';
 import * as readline from 'node:readline/promises';
 import { program } from 'commander';
 import { checkAutoUpdate } from './auto-update.js';
 import { loadConfig, saveConfig } from './config.js';
 import { runIconPreview } from './icon.js';
+import { makeLoginBff } from './login-bff.js';
+import { runBrowserLogin } from './login-flow.js';
+import { openBrowser, openLoopback, sleep } from './login-runtime.js';
 import { runPublish } from './publish.js';
 import { runReviewRisk } from './review-risk.js';
 import { parseRefs, parseStore, runRisk } from './risk.js';
@@ -39,12 +43,11 @@ const MISSING_KEY_HELP = "Looks like you don't have an Extenshi API key set up y
     'one-time free allowance (10 catalog reads + 3 scans), so you can try things out\n' +
     'before paying for anything.\n' +
     '\n' +
-    '1. Create a free account at https://auth.extenshi.io/signup\n' +
-    '2. Grab a key at https://dojo.extenshi.io/api-keys\n' +
-    '3. Then give it to the CLI any of these ways:\n' +
-    '   • run: extenshi login\n' +
-    '   • set the EXTENSHI_API_KEY environment variable\n' +
-    '   • add EXTENSHI_API_KEY=... to a .env file in this directory';
+    '  Run: extenshi login\n' +
+    '\n' +
+    'That opens your browser, where you can sign in or create an account, and connects\n' +
+    'this terminal automatically. In CI, set EXTENSHI_API_KEY from your secrets instead\n' +
+    '(or add EXTENSHI_API_KEY=... to a .env file in this directory).';
 const _require = createRequire(import.meta.url);
 const pkg = _require('../package.json');
 initTelemetry({ surface: 'cli', version: pkg.version });
@@ -296,27 +299,98 @@ icon
         await runIconPreview(iconPath, opts, pkg.version);
     });
 });
+/**
+ * Ask for a key by hand. Kept as the escape hatch for `--paste`, for servers
+ * whose BFF predates the browser handshake, and for anyone who would simply
+ * rather paste one.
+ */
+async function promptForKey(apiUrl) {
+    console.error('Get a key at https://dojo.extenshi.io/api-keys (sign up at https://auth.extenshi.io/signup).');
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    let apiKey;
+    try {
+        apiKey = (await rl.question('Extenshi API key: ')).trim();
+    }
+    finally {
+        rl.close();
+    }
+    if (!apiKey)
+        throw new Error('no API key provided.');
+    const savedPath = saveConfig({ apiKey, apiUrl });
+    console.error(`✓ API key saved to ${savedPath}`);
+}
+/**
+ * Browser login: open extenshi.io, sign in or sign up there, and let this
+ * process pick the key up. See `login-flow.ts` for the handshake.
+ */
+async function loginViaBrowser(apiUrl) {
+    const { bffUrl } = await loadConfig(apiUrl);
+    const bff = makeLoginBff(bffUrl);
+    const outcome = await runBrowserLogin({
+        startAuth: (input) => bff.startAuth(input),
+        pollAuth: (deviceCode) => bff.pollAuth(deviceCode),
+        openLoopback,
+        openBrowser,
+        sleep,
+        now: () => Date.now(),
+        // stderr throughout: `login` keeps stdout free so it composes in a pipeline.
+        log: (message) => console.error(message),
+    }, {
+        tool: 'extenshi-cli',
+        version: pkg.version,
+        platform: process.platform,
+        hostname: os.hostname(),
+    });
+    switch (outcome.kind) {
+        case 'success': {
+            const savedPath = saveConfig({ apiKey: outcome.apiKey, apiUrl });
+            console.error(`\n✓ Connected${outcome.email ? ` as ${outcome.email}` : ''}. Key saved to ${savedPath}.`);
+            return;
+        }
+        case 'denied':
+            throw new Error('login declined in the browser — nothing was connected.');
+        case 'expired':
+            throw new Error('the login timed out before it was approved. Run `extenshi login` again.');
+        case 'key_limit':
+            throw new Error('your account already has the maximum number of API keys. ' +
+                'Revoke one at https://dojo.extenshi.io/api-keys, then run `extenshi login` again.');
+        case 'unsupported':
+            // Older BFF: no handshake to speak. Ask for a key rather than fail.
+            console.error('Browser login is not available on this server yet — using a key instead.\n');
+            await promptForKey(apiUrl);
+            return;
+        default:
+            throw new Error(`${outcome.message} (you can use \`extenshi login --paste\` instead)`);
+    }
+}
 program
     .command('login')
-    .description('Save your Extenshi API key to ~/.extenshi/config.json')
-    .option('--api-key <key>', 'API key (skips the interactive prompt)')
+    .summary('sign in through your browser and connect this terminal')
+    .description('Opens extenshi.io in your browser to sign in (or create a free account), then connects this ' +
+    'terminal automatically. The key is stored in ~/.extenshi/config.json, shared with @extenshi/guard.')
+    .option('--api-key <key>', 'API key (skips the browser entirely)')
+    .option('--paste', 'skip the browser and paste an API key instead')
     .option('--api-url <url>', 'Override the scan API base URL')
     .action(async (opts) => {
     await runCommand('login', async () => {
-        let apiKey = opts.apiKey?.trim();
-        if (!apiKey) {
-            const rl = readline.createInterface({
-                input: process.stdin,
-                output: process.stderr,
-            });
-            apiKey = (await rl.question('Extenshi API key: ')).trim();
-            rl.close();
+        // An explicitly supplied key is the caller telling us not to open anything.
+        const provided = opts.apiKey?.trim();
+        if (provided) {
+            const savedPath = saveConfig({ apiKey: provided, apiUrl: opts.apiUrl });
+            console.error(`✓ API key saved to ${savedPath}`);
+            return;
+        }
+        if (opts.paste) {
+            await promptForKey(opts.apiUrl);
+            return;
         }
-        if (!apiKey) {
-            throw new Error('no API key provided.');
+        // Nobody is watching a non-interactive session, so waiting on a browser
+        // approval there would just hang until the login expired.
+        if (!process.stdin.isTTY) {
+            throw new Error('browser login needs an interactive terminal. In CI, set EXTENSHI_API_KEY from your ' +
+                'secrets instead (create a key at https://dojo.extenshi.io/api-keys).');
         }
-        const savedPath = saveConfig({ apiKey, apiUrl: opts.apiUrl });
-        console.error(`✓ API key saved to ${savedPath}`);
+        await loginViaBrowser(opts.apiUrl);
     });
 });
 program.parse();

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACb,MAAM,gBAAgB,CAAA;AAEvB,MAAM,gBAAgB,GACrB,8EAA8E;IAC9E,IAAI;IACJ,8EAA8E;IAC9E,mFAAmF;IACnF,+BAA+B;IAC/B,IAAI;IACJ,+DAA+D;IAC/D,sDAAsD;IACtD,iDAAiD;IACjD,4BAA4B;IAC5B,sDAAsD;IACtD,gEAAgE,CAAA;AAEjE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,iBAAiB,CAAwB,CAAA;AAE9D,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AAEvD;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,MAA2B;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,YAAY,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACJ,MAAM,MAAM,EAAE,CAAA;QACd,YAAY,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAA;QACvF,MAAM,cAAc,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,YAAY,CAAC,oBAAoB,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC;YAC9B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC,CAAA;QACF,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,sEAAsE;QACtE,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,cAAc,EAAE,CAAA;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;AACF,CAAC;AAED,OAAO;KACL,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,qDAAqD,CAAC;KAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAEtB,OAAO;KACL,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CACN,6BAA6B,EAC7B,2LAA2L,CAC3L;KACA,MAAM,CACN,iBAAiB,EACjB,uHAAuH,CACvH;KACA,MAAM,CAAC,WAAW,EAAE,gEAAgE,CAAC;KACrF,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;KACnE,MAAM,CACN,qBAAqB,EACrB,yIAAyI,CACzI;KACA,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;KACrF,MAAM,CAAC,aAAa,EAAE,wEAAwE,CAAC;KAC/F,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;KAC/F,MAAM,CACN,iBAAiB,EACjB,oHAAoH,CACpH;KACA,MAAM,CACN,2BAA2B,EAC3B,6EAA6E,CAC7E;KACA,MAAM,CACN,6BAA6B,EAC7B,gIAAgI,CAChI;KACA,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAYC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE5C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClC,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,EAAE,CAAA;QAEvB,IAAI,YAAuC,CAAA;QAC3C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAClD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC3D,CAAC;YACD,YAAY,GAAG,GAAG,CAAA;QACnB,CAAC;QAED,gEAAgE;QAChE,4DAA4D;QAC5D,IAAI,MAAkC,CAAA;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,yBAAyB,CAAC,CAAA;YAC9E,CAAC;YACD,MAAM,GAAG,CAAC,CAAA;QACX,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QACrC,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,UAAU,GAAG,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAE9E,MAAM,OAAO,CAAC;YACb,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,UAAU;YACV,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;YAC1C,mEAAmE;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,YAAY;YACZ,UAAU,EAAE,GAAG,CAAC,OAAO;YACvB,iFAAiF;YACjF,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,IAAI,KAAK;YAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,oBAAoB,CAAC;KAC7B,WAAW,CACX,kFAAkF;IACjF,2FAA2F;IAC3F,4FAA4F;IAC5F,iDAAiD,CAClD;KACA,MAAM,CACN,iBAAiB,EACjB,8FAA8F,CAC9F;KACA,MAAM,CAAC,2BAA2B,EAAE,wDAAwD,CAAC;KAC7F,MAAM,CAAC,wBAAwB,EAAE,iDAAiD,CAAC;KACnF,MAAM,CAAC,YAAY,EAAE,kDAAkD,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,8EAA8E,CAAC;KACnG,MAAM,CACN,qBAAqB,EACrB,iFAAiF,CACjF;KACA,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAQC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACtC,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACzB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;QACpD,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,WAA+B,CAAA;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,UAAU,CAAC;YAChB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,MAAuD;YAC/D,mBAAmB,EAAE,IAAI,CAAC,eAAe;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW;SACX,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CACX,qFAAqF;IACpF,gFAAgF;IAChF,4FAA4F,CAC7F;KACA,MAAM,CACN,qBAAqB,EACrB,gHAAgH,CAChH;KACA,MAAM,CAAC,qBAAqB,EAAE,sEAAsE,CAAC;KACrG,MAAM,CACN,iBAAiB,EACjB,kHAAkH,CAClH;KACA,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC;KAC5C,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAKC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;QAC1C,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GAAkD;YAC/D,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,MAAM;SACZ,CAAA;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACjE,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,aAAa,CAAC;YACnB,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;YAClC,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;SAC9B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,qBAAqB,CAAC;KAC9B,WAAW,CACX,8FAA8F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,sCAAsC,CACvC;KACA,MAAM,CACN,iBAAiB,EACjB,uHAAuH,CACvH;KACA,MAAM,CACN,eAAe,EACf,iJAAiJ,CACjJ;KACA,MAAM,CAAC,qBAAqB,EAAE,sEAAsE,CAAC;KACrG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;KACnC,MAAM,CACN,KAAK,EACJ,QAA8B,EAC9B,IAA4E,EAC3E,EAAE;IACH,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAA;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,OAAO,CAAC;YACb,IAAI;YACJ,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1F,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;SAC9B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,MAAM,IAAI,GAAG,OAAO;KAClB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6DAA6D,CAAC,CAAA;AAE5E,IAAI;KACF,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CACX,mFAAmF;IAClF,iFAAiF;IACjF,yFAAyF,CAC1F;KACA,MAAM,CACN,eAAe,EACf,mFAAmF,CACnF;KACA,MAAM,CACN,iBAAiB,EACjB,kGAAkG,CAClG;KACA,MAAM,CAAC,WAAW,EAAE,4DAA4D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAwD,EAAE,EAAE;IAC5F,MAAM,UAAU,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEH,OAAO;KACL,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;KACnE,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,IAA0C,EAAE,EAAE;IAC5D,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACpC,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;QAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;gBACnC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAA;YACF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACzD,EAAE,CAAC,KAAK,EAAE,CAAA;QACX,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7D,OAAO,CAAC,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEH,OAAO,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACb,MAAM,gBAAgB,CAAA;AAEvB,MAAM,gBAAgB,GACrB,8EAA8E;IAC9E,IAAI;IACJ,8EAA8E;IAC9E,mFAAmF;IACnF,+BAA+B;IAC/B,IAAI;IACJ,yBAAyB;IACzB,IAAI;IACJ,qFAAqF;IACrF,sFAAsF;IACtF,iEAAiE,CAAA;AAElE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,iBAAiB,CAAwB,CAAA;AAE9D,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AAEvD;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,MAA2B;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,YAAY,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACJ,MAAM,MAAM,EAAE,CAAA;QACd,YAAY,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAA;QACvF,MAAM,cAAc,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,YAAY,CAAC,oBAAoB,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC;YAC9B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC,CAAA;QACF,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,sEAAsE;QACtE,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,cAAc,EAAE,CAAA;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;AACF,CAAC;AAED,OAAO;KACL,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,qDAAqD,CAAC;KAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAEtB,OAAO;KACL,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CACN,6BAA6B,EAC7B,2LAA2L,CAC3L;KACA,MAAM,CACN,iBAAiB,EACjB,uHAAuH,CACvH;KACA,MAAM,CAAC,WAAW,EAAE,gEAAgE,CAAC;KACrF,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;KACnE,MAAM,CACN,qBAAqB,EACrB,yIAAyI,CACzI;KACA,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;KACrF,MAAM,CAAC,aAAa,EAAE,wEAAwE,CAAC;KAC/F,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;KAC/F,MAAM,CACN,iBAAiB,EACjB,oHAAoH,CACpH;KACA,MAAM,CACN,2BAA2B,EAC3B,6EAA6E,CAC7E;KACA,MAAM,CACN,6BAA6B,EAC7B,gIAAgI,CAChI;KACA,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAYC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE5C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClC,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,EAAE,CAAA;QAEvB,IAAI,YAAuC,CAAA;QAC3C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAClD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC3D,CAAC;YACD,YAAY,GAAG,GAAG,CAAA;QACnB,CAAC;QAED,gEAAgE;QAChE,4DAA4D;QAC5D,IAAI,MAAkC,CAAA;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,yBAAyB,CAAC,CAAA;YAC9E,CAAC;YACD,MAAM,GAAG,CAAC,CAAA;QACX,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QACrC,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,UAAU,GAAG,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAE9E,MAAM,OAAO,CAAC;YACb,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,UAAU;YACV,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;YAC1C,mEAAmE;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,YAAY;YACZ,UAAU,EAAE,GAAG,CAAC,OAAO;YACvB,iFAAiF;YACjF,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,IAAI,KAAK;YAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,oBAAoB,CAAC;KAC7B,WAAW,CACX,kFAAkF;IACjF,2FAA2F;IAC3F,4FAA4F;IAC5F,iDAAiD,CAClD;KACA,MAAM,CACN,iBAAiB,EACjB,8FAA8F,CAC9F;KACA,MAAM,CAAC,2BAA2B,EAAE,wDAAwD,CAAC;KAC7F,MAAM,CAAC,wBAAwB,EAAE,iDAAiD,CAAC;KACnF,MAAM,CAAC,YAAY,EAAE,kDAAkD,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,8EAA8E,CAAC;KACnG,MAAM,CACN,qBAAqB,EACrB,iFAAiF,CACjF;KACA,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAQC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACtC,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACzB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;QACpD,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,WAA+B,CAAA;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,UAAU,CAAC;YAChB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,MAAuD;YAC/D,mBAAmB,EAAE,IAAI,CAAC,eAAe;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW;SACX,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CACX,qFAAqF;IACpF,gFAAgF;IAChF,4FAA4F,CAC7F;KACA,MAAM,CACN,qBAAqB,EACrB,gHAAgH,CAChH;KACA,MAAM,CAAC,qBAAqB,EAAE,sEAAsE,CAAC;KACrG,MAAM,CACN,iBAAiB,EACjB,kHAAkH,CAClH;KACA,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC;KAC5C,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAKC,EACA,EAAE;IACH,MAAM,UAAU,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;QAC1C,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GAAkD;YAC/D,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,MAAM;SACZ,CAAA;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACjE,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,aAAa,CAAC;YACnB,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;YAClC,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;SAC9B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,OAAO;KACL,OAAO,CAAC,qBAAqB,CAAC;KAC9B,WAAW,CACX,8FAA8F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,sCAAsC,CACvC;KACA,MAAM,CACN,iBAAiB,EACjB,uHAAuH,CACvH;KACA,MAAM,CACN,eAAe,EACf,iJAAiJ,CACjJ;KACA,MAAM,CAAC,qBAAqB,EAAE,sEAAsE,CAAC;KACrG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;KACnC,MAAM,CACN,KAAK,EACJ,QAA8B,EAC9B,IAA4E,EAC3E,EAAE;IACH,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAA;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,OAAO,CAAC;YACb,IAAI;YACJ,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1F,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;SAC9B,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA;AAEF,MAAM,IAAI,GAAG,OAAO;KAClB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6DAA6D,CAAC,CAAA;AAE5E,IAAI;KACF,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CACX,mFAAmF;IAClF,iFAAiF;IACjF,yFAAyF,CAC1F;KACA,MAAM,CACN,eAAe,EACf,mFAAmF,CACnF;KACA,MAAM,CACN,iBAAiB,EACjB,kGAAkG,CAClG;KACA,MAAM,CAAC,WAAW,EAAE,4DAA4D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAwD,EAAE,EAAE;IAC5F,MAAM,UAAU,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEH;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,CAAC,KAAK,CACZ,8FAA8F,CAC9F,CAAA;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACrF,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1D,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,KAAK,EAAE,CAAA;IACX,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,OAAO,GAAG,MAAM,eAAe,CACpC;QACC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1C,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;QAClD,YAAY;QACZ,WAAW;QACX,KAAK;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,6EAA6E;QAC7E,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;KACxC,EACD;QACC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;KACvB,CACD,CAAA;IAED,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YAChE,OAAO,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,SAAS,GAAG,CAAC,CAAA;YACxG,OAAM;QACP,CAAC;QACD,KAAK,QAAQ;YACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC1E,KAAK,SAAS;YACb,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;QAC3F,KAAK,WAAW;YACf,MAAM,IAAI,KAAK,CACd,2DAA2D;gBAC1D,mFAAmF,CACpF,CAAA;QACF,KAAK,aAAa;YACjB,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAC3F,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;YAC1B,OAAM;QACP;YACC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,mDAAmD,CAAC,CAAA;IACxF,CAAC;AACF,CAAC;AAED,OAAO;KACL,OAAO,CAAC,OAAO,CAAC;KAChB,OAAO,CAAC,wDAAwD,CAAC;KACjE,WAAW,CACX,8FAA8F;IAC7F,oGAAoG,CACrG;KACA,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,SAAS,EAAE,+CAA+C,CAAC;KAClE,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,IAA2D,EAAE,EAAE;IAC7E,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACpC,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;QACpC,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,OAAO,CAAC,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAA;YAChD,OAAM;QACP,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAM;QACP,CAAC;QAED,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACd,qFAAqF;gBACpF,sEAAsE,CACvE,CAAA;QACF,CAAC;QAED,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEH,OAAO,CAAC,KAAK,EAAE,CAAA"}

package/dist/login-bff.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The two BFF calls the browser login needs, over plain `fetch`.
+ *
+ * @extenshi/guard talks to the same endpoints through `@trpc/client`; this
+ * package deliberately doesn't carry that dependency (it reaches the BFF with
+ * `fetch` everywhere else — see `publish-access.ts`), and adding a client
+ * library to a published CLI for two calls would be a poor trade for anyone
+ * running it through `npx`.
+ *
+ * Wire format: tRPC v11, un-batched, no data transformer. A mutation is
+ * `POST /api/trpc/<path>` with the input as the raw JSON body, answering
+ * `{"result":{"data":…}}` or `{"error":{…}}`.
+ *
+ * Neither call sends an Authorization header — the caller has no key yet, which
+ * is the entire point of the handshake.
+ */
+import type { LoginPollResponse, LoginStartResponse } from './login-flow.js';
+export interface LoginBff {
+    startAuth(input: {
+        tool: string;
+        version: string;
+        platform: string;
+        hostname?: string;
+        redirectUri?: string;
+    }): Promise<LoginStartResponse>;
+    pollAuth(deviceCode: string): Promise<LoginPollResponse>;
+}
+export declare function makeLoginBff(bffUrl: string): LoginBff;
+//# sourceMappingURL=login-bff.d.ts.map

package/dist/login-bff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-bff.d.ts","sourceRoot":"","sources":["../src/login-bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAkE5E,MAAM,WAAW,QAAQ;IACxB,SAAS,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACxD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAMrD"}

package/dist/login-bff.js

@@ -0,0 +1,78 @@
+/**
+ * The two BFF calls the browser login needs, over plain `fetch`.
+ *
+ * @extenshi/guard talks to the same endpoints through `@trpc/client`; this
+ * package deliberately doesn't carry that dependency (it reaches the BFF with
+ * `fetch` everywhere else — see `publish-access.ts`), and adding a client
+ * library to a published CLI for two calls would be a poor trade for anyone
+ * running it through `npx`.
+ *
+ * Wire format: tRPC v11, un-batched, no data transformer. A mutation is
+ * `POST /api/trpc/<path>` with the input as the raw JSON body, answering
+ * `{"result":{"data":…}}` or `{"error":{…}}`.
+ *
+ * Neither call sends an Authorization header — the caller has no key yet, which
+ * is the entire point of the handshake.
+ */
+/** Long enough for a cold BFF, short enough not to stall the poll cadence. */
+const REQUEST_TIMEOUT_MS = 15_000;
+/**
+ * A tRPC error surfaced with the shape `isUnsupportedByServer` reads.
+ *
+ * The `data.code` matters: `NOT_FOUND` is how a BFF that predates this router
+ * answers, and the CLI turns that into "paste a key instead" rather than an
+ * error the user can do nothing about.
+ */
+class TrpcHttpError extends Error {
+    data;
+    constructor(message, data) {
+        super(message);
+        this.data = data;
+        this.name = 'TrpcHttpError';
+    }
+}
+async function trpcMutation(bffUrl, path, input) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${bffUrl}/api/trpc/${path}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(input),
+            signal: controller.signal,
+        });
+        // Parse before checking `res.ok`: tRPC returns its error envelope WITH a
+        // non-2xx status, and that envelope carries the code the caller branches on.
+        const body = (await res.json().catch(() => null));
+        if (body?.error) {
+            throw new TrpcHttpError(body.error.message ?? `Request failed (${res.status})`, {
+                code: body.error.data?.code,
+                httpStatus: body.error.data?.httpStatus ?? res.status,
+            });
+        }
+        if (!res.ok) {
+            // A non-tRPC failure (proxy error page, 502 from the load balancer).
+            // A bare 404 here means the same thing as tRPC's NOT_FOUND: this
+            // deployment doesn't have the router.
+            throw new TrpcHttpError(`Request failed (${res.status})`, {
+                code: res.status === 404 ? 'NOT_FOUND' : undefined,
+                httpStatus: res.status,
+            });
+        }
+        if (!body?.result || body.result.data === undefined) {
+            throw new TrpcHttpError('Malformed response from the server', { httpStatus: res.status });
+        }
+        return body.result.data;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function makeLoginBff(bffUrl) {
+    const base = bffUrl.replace(/\/$/, '');
+    return {
+        startAuth: (input) => trpcMutation(base, 'cliAuth.start', input),
+        pollAuth: (deviceCode) => trpcMutation(base, 'cliAuth.poll', { deviceCode }),
+    };
+}
+//# sourceMappingURL=login-bff.js.map

package/dist/login-bff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-bff.js","sourceRoot":"","sources":["../src/login-bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC;;;;;;GAMG;AACH,MAAM,aAAc,SAAQ,KAAK;IAGtB;IAFV,YACC,OAAe,EACN,IAA4C;QAErD,KAAK,CAAC,OAAO,CAAC,CAAA;QAFL,SAAI,GAAJ,IAAI,CAAwC;QAGrD,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC5B,CAAC;CACD;AAOD,KAAK,UAAU,YAAY,CAAI,MAAc,EAAE,IAAY,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAA;IACtE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,aAAa,IAAI,EAAE,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAA;QAEF,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA2B,CAAA;QAE3E,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE;gBAC/E,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI;gBAC3B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,GAAG,CAAC,MAAM;aACrD,CAAC,CAAA;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,qEAAqE;YACrE,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE;gBACzD,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBAClD,UAAU,EAAE,GAAG,CAAC,MAAM;aACtB,CAAC,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,aAAa,CAAC,oCAAoC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACxB,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,OAAO;QACN,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAqB,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC;QACpF,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAoB,IAAI,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,CAAC;KAC/F,CAAA;AACF,CAAC"}

package/dist/login-flow.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Browser login, terminal side.
+ *
+ * `login` opens a browser at extenshi.io, the user signs in (or SIGNS UP — a
+ * terminal cannot host a signup form, which is the whole reason this exists),
+ * approves the pairing code, and the terminal picks the key up on its own.
+ *
+ * Two things carry the result back, and only one of them is load-bearing:
+ *
+ *   poll     — the source of truth. The key is minted server-side during the
+ *              claiming poll and returned over TLS, exactly once.
+ *   loopback — a local one-shot listener the browser is redirected to. It
+ *              carries NO key: it only wakes the poll loop early so the tab can
+ *              close itself and the terminal reacts instantly instead of on the
+ *              next tick. Everything still works when it can't bind a port
+ *              (locked-down machine, SSH session, a port already taken) — that
+ *              is the designed fallback, not an error path.
+ *
+ * Everything here takes its I/O as arguments so the whole state machine is
+ * testable without a browser, a socket or a server. That is also what lets one
+ * copy serve two published packages with different HTTP stacks: @extenshi/guard
+ * speaks tRPC, @extenshi/cli speaks plain fetch, and both hand this the same
+ * two functions.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-flow.ts`.
+ * Neither package can import the other at runtime (both are published to npm and
+ * built with plain `tsc`), and the repo already duplicates `config.ts` between
+ * them for the same reason. Drift is what makes duplication dangerous, so the
+ * copies are pinned equal by `login-twin-sync.test.ts` — edit one, copy it over,
+ * or the test fails.
+ */
+export interface LoginStartResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUrl: string;
+    verificationUrlComplete: string;
+    expiresInSec: number;
+    intervalSec: number;
+    loopbackAccepted: boolean;
+}
+export type LoginPollStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'claimed' | 'key_limit';
+export interface LoginPollResponse {
+    status: LoginPollStatus;
+    apiKey?: string;
+    email?: string | null;
+}
+/** A bound local listener waiting for the browser to come back. */
+export interface LoopbackListener {
+    /** `http://127.0.0.1:<port>/callback` — handed to the server, never composed elsewhere. */
+    redirectUri: string;
+    /** Resolves when the browser hits it (or never, if it doesn't). */
+    hit: Promise<void>;
+    close(): void;
+}
+export interface LoginDeps {
+    startAuth(input: {
+        tool: string;
+        version: string;
+        platform: string;
+        hostname?: string;
+        redirectUri?: string;
+    }): Promise<LoginStartResponse>;
+    pollAuth(deviceCode: string): Promise<LoginPollResponse>;
+    /** Bind a loopback listener, or null when this machine won't allow one. */
+    openLoopback(): Promise<LoopbackListener | null>;
+    /** Launch the user's browser. Returns false when there's nothing to launch. */
+    openBrowser(url: string): Promise<boolean>;
+    /** Resolve after `ms`, or as soon as `wakeup` settles — whichever is first. */
+    sleep(ms: number, wakeup?: Promise<unknown>): Promise<void>;
+    now(): number;
+    /** Progress lines. Everything user-facing goes to stderr so `--json` stays clean. */
+    log(message: string): void;
+}
+export type LoginOutcome = {
+    kind: 'success';
+    apiKey: string;
+    email: string | null;
+} | {
+    kind: 'denied';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'key_limit';
+} | {
+    kind: 'unsupported';
+} | {
+    kind: 'failed';
+    message: string;
+};
+export interface LoginClient {
+    tool: string;
+    version: string;
+    platform: string;
+    hostname?: string;
+}
+/**
+ * An older BFF has no `cliAuth` router and answers NOT_FOUND. That is not a
+ * failure the user can act on — it means "this deployment predates browser
+ * login", and the caller should fall back to asking for a pasted key. Matched on
+ * the tRPC error code AND the shape of the 404 body, because the two BFF
+ * versions can be live at once during a rollout.
+ */
+export declare function isUnsupportedByServer(err: unknown): boolean;
+/**
+ * Run the whole login. Returns an outcome rather than throwing, so the CLI
+ * decides how each case is worded (and every case has a next step).
+ */
+export declare function runBrowserLogin(deps: LoginDeps, client: LoginClient): Promise<LoginOutcome>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../src/login-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;AAErG,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAChC,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAClB,KAAK,IAAI,IAAI,CAAA;CACb;AAED,MAAM,WAAW,SAAS;IACzB,SAAS,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxD,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAChD,+EAA+E;IAC/E,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,GAAG,IAAI,MAAM,CAAA;IACb,qFAAqF;IACrF,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,MAAM,YAAY,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAO3D;AAaD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAuFjG"}

package/dist/login-flow.js

@@ -0,0 +1,144 @@
+/**
+ * Browser login, terminal side.
+ *
+ * `login` opens a browser at extenshi.io, the user signs in (or SIGNS UP — a
+ * terminal cannot host a signup form, which is the whole reason this exists),
+ * approves the pairing code, and the terminal picks the key up on its own.
+ *
+ * Two things carry the result back, and only one of them is load-bearing:
+ *
+ *   poll     — the source of truth. The key is minted server-side during the
+ *              claiming poll and returned over TLS, exactly once.
+ *   loopback — a local one-shot listener the browser is redirected to. It
+ *              carries NO key: it only wakes the poll loop early so the tab can
+ *              close itself and the terminal reacts instantly instead of on the
+ *              next tick. Everything still works when it can't bind a port
+ *              (locked-down machine, SSH session, a port already taken) — that
+ *              is the designed fallback, not an error path.
+ *
+ * Everything here takes its I/O as arguments so the whole state machine is
+ * testable without a browser, a socket or a server. That is also what lets one
+ * copy serve two published packages with different HTTP stacks: @extenshi/guard
+ * speaks tRPC, @extenshi/cli speaks plain fetch, and both hand this the same
+ * two functions.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-flow.ts`.
+ * Neither package can import the other at runtime (both are published to npm and
+ * built with plain `tsc`), and the repo already duplicates `config.ts` between
+ * them for the same reason. Drift is what makes duplication dangerous, so the
+ * copies are pinned equal by `login-twin-sync.test.ts` — edit one, copy it over,
+ * or the test fails.
+ */
+/**
+ * An older BFF has no `cliAuth` router and answers NOT_FOUND. That is not a
+ * failure the user can act on — it means "this deployment predates browser
+ * login", and the caller should fall back to asking for a pasted key. Matched on
+ * the tRPC error code AND the shape of the 404 body, because the two BFF
+ * versions can be live at once during a rollout.
+ */
+export function isUnsupportedByServer(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const code = err?.data?.code;
+    if (code === 'NOT_FOUND')
+        return true;
+    return (/No "?mutation"? procedure found|cliAuth|404/i.test(message) && /not found|no procedure/i.test(message));
+}
+/**
+ * How many consecutive poll failures to absorb before giving up.
+ *
+ * A poll loop that dies on the first dropped packet would strand a user who has
+ * ALREADY approved in the browser — the worst moment to fail, because the key
+ * exists and only the terminal doesn't know. Wifi handoffs and laptop sleep both
+ * produce short bursts of errors, so transient failures are retried and only a
+ * sustained outage aborts.
+ */
+const MAX_CONSECUTIVE_POLL_ERRORS = 5;
+/**
+ * Run the whole login. Returns an outcome rather than throwing, so the CLI
+ * decides how each case is worded (and every case has a next step).
+ */
+export async function runBrowserLogin(deps, client) {
+    // Bind the listener BEFORE starting the session: the redirect URI has to be
+    // part of the session the server creates, and binding can fail.
+    const loopback = await deps.openLoopback();
+    try {
+        let started;
+        try {
+            started = await deps.startAuth({
+                tool: client.tool,
+                version: client.version,
+                platform: client.platform,
+                hostname: client.hostname,
+                redirectUri: loopback?.redirectUri,
+            });
+        }
+        catch (err) {
+            if (isUnsupportedByServer(err))
+                return { kind: 'unsupported' };
+            return { kind: 'failed', message: err instanceof Error ? err.message : String(err) };
+        }
+        // The server decides whether it accepted the loopback URL. If it didn't,
+        // stop waiting on a callback that will never come.
+        const wakeup = loopback && started.loopbackAccepted ? loopback.hit : undefined;
+        const opened = await deps.openBrowser(started.verificationUrlComplete);
+        deps.log(opened
+            ? 'Opened your browser to finish signing in.'
+            : 'Open this URL in a browser to finish signing in:');
+        deps.log(`  ${started.verificationUrlComplete}`);
+        deps.log('');
+        deps.log(`  Pairing code: ${started.userCode}`);
+        deps.log('');
+        deps.log('Check that the code matches, then approve. Waiting… (Ctrl-C to cancel)');
+        const deadline = deps.now() + started.expiresInSec * 1000;
+        const intervalMs = Math.max(1, started.intervalSec) * 1000;
+        let consecutiveErrors = 0;
+        while (deps.now() < deadline) {
+            let res;
+            try {
+                res = await deps.pollAuth(started.deviceCode);
+                consecutiveErrors = 0;
+            }
+            catch (err) {
+                if (isUnsupportedByServer(err))
+                    return { kind: 'unsupported' };
+                consecutiveErrors += 1;
+                if (consecutiveErrors >= MAX_CONSECUTIVE_POLL_ERRORS) {
+                    return {
+                        kind: 'failed',
+                        message: err instanceof Error ? err.message : String(err),
+                    };
+                }
+                await deps.sleep(intervalMs);
+                continue;
+            }
+            switch (res.status) {
+                case 'approved':
+                    if (!res.apiKey) {
+                        return { kind: 'failed', message: 'Server approved the login but returned no key.' };
+                    }
+                    return { kind: 'success', apiKey: res.apiKey, email: res.email ?? null };
+                case 'denied':
+                    return { kind: 'denied' };
+                case 'expired':
+                    return { kind: 'expired' };
+                case 'key_limit':
+                    return { kind: 'key_limit' };
+                case 'claimed':
+                    // Someone already exchanged this session's code. Not ours to use.
+                    return {
+                        kind: 'failed',
+                        message: 'This login was already completed elsewhere. Run login again.',
+                    };
+                default:
+                    // Still pending: wait out the interval, but cut it short the moment
+                    // the browser calls back.
+                    await deps.sleep(intervalMs, wakeup);
+            }
+        }
+        return { kind: 'expired' };
+    }
+    finally {
+        loopback?.close();
+    }
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../src/login-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAgEH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IACjD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,EAAE,IAAI,CAAA;IAC9D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,CACN,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvG,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAA;AAErC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAe,EAAE,MAAmB;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;IAE1C,IAAI,CAAC;QACJ,IAAI,OAA2B,CAAA;QAC/B,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,QAAQ,EAAE,WAAW;aAClC,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACrF,CAAC;QAED,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QAE9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QACtE,IAAI,CAAC,GAAG,CACP,MAAM;YACL,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,kDAAkD,CACrD,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;QAElF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAA;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;QAC1D,IAAI,iBAAiB,GAAG,CAAC,CAAA;QAEzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAsB,CAAA;YAC1B,IAAI,CAAC;gBACJ,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAC7C,iBAAiB,GAAG,CAAC,CAAA;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,qBAAqB,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;gBAC9D,iBAAiB,IAAI,CAAC,CAAA;gBACtB,IAAI,iBAAiB,IAAI,2BAA2B,EAAE,CAAC;oBACtD,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACzD,CAAA;gBACF,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC5B,SAAQ;YACT,CAAC;YAED,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU;oBACd,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAA;oBACrF,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAA;gBACzE,KAAK,QAAQ;oBACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;gBAC1B,KAAK,SAAS;oBACb,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;gBAC3B,KAAK,WAAW;oBACf,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAC7B,KAAK,SAAS;oBACb,kEAAkE;oBAClE,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,8DAA8D;qBACvE,CAAA;gBACF;oBACC,oEAAoE;oBACpE,0BAA0B;oBAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YACtC,CAAC;QACF,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;YAAS,CAAC;QACV,QAAQ,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;AACF,CAAC"}

package/dist/login-runtime.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The real I/O behind `runBrowserLogin`: a one-shot loopback listener, a
+ * browser launcher, and an interruptible sleep.
+ *
+ * Kept apart from `login-flow.ts` so the state machine can be tested without
+ * binding sockets or launching applications.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-runtime.ts`, and
+ * pinned equal by `login-twin-sync.test.ts`. See the note in `login-flow.ts`
+ * for why the two published packages duplicate rather than share.
+ */
+import type { LoopbackListener } from './login-flow.js';
+/**
+ * Bind a loopback listener for the browser to come back to.
+ *
+ * Returns null — never throws — when binding is not possible: a sandbox that
+ * forbids listening, an SSH session with no browser on this machine, an
+ * exhausted port range. The login then completes by polling alone, so a null
+ * here costs the user a tab they have to close by hand and nothing else.
+ *
+ * Binds to 127.0.0.1 explicitly rather than all interfaces: it must not become
+ * a socket anything off-box can reach, and on macOS binding to 0.0.0.0 is what
+ * triggers the "accept incoming connections?" firewall prompt.
+ */
+export declare function openLoopback(): Promise<LoopbackListener | null>;
+/**
+ * Launch the browser, reporting whether it plausibly worked.
+ *
+ * A false return is not an error: SSH sessions, containers and bare servers
+ * legitimately have nothing to launch, and the caller prints the URL for the
+ * user to open elsewhere. Env vars that mean "no browser here" are honoured
+ * before trying, because launching under `CI` would hang a pipeline on a
+ * spawned process nobody can see.
+ */
+export declare function openBrowser(url: string): Promise<boolean>;
+/** Sleep, cut short if `wakeup` settles first. */
+export declare function sleep(ms: number, wakeup?: Promise<unknown>): Promise<void>;
+//# sourceMappingURL=login-runtime.d.ts.map

package/dist/login-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runtime.d.ts","sourceRoot":"","sources":["../src/login-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAsCvD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkErE;AAcD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6B/D;AAED,kDAAkD;AAClD,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1E"}

package/dist/login-runtime.js

@@ -0,0 +1,186 @@
+/**
+ * The real I/O behind `runBrowserLogin`: a one-shot loopback listener, a
+ * browser launcher, and an interruptible sleep.
+ *
+ * Kept apart from `login-flow.ts` so the state machine can be tested without
+ * binding sockets or launching applications.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-runtime.ts`, and
+ * pinned equal by `login-twin-sync.test.ts`. See the note in `login-flow.ts`
+ * for why the two published packages duplicate rather than share.
+ */
+import { spawn } from 'node:child_process';
+import http from 'node:http';
+/** Give up on binding rather than hang a login on a firewall prompt. */
+const BIND_TIMEOUT_MS = 2_000;
+const CALLBACK_PATH = '/callback';
+/**
+ * The page the browser lands on after approving.
+ *
+ * Self-contained (no network, no fonts): it is served from a throwaway local
+ * server that is about to close, so anything it references would fail to load.
+ * `window.close()` only works for script-opened tabs, so the text has to stand
+ * on its own when the tab stays put.
+ */
+function resultPage(result) {
+    const approved = result !== 'denied';
+    const title = approved ? 'Terminal connected' : 'Login declined';
+    const body = approved
+        ? 'You can close this tab and go back to your terminal.'
+        : 'Nothing was connected. You can close this tab.';
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${title} · Extenshi</title>
+<style>
+ :root { color-scheme: light dark }
+ body { font: 16px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; display: grid;
+        place-items: center; min-height: 100vh; margin: 0; text-align: center; padding: 24px }
+ .card { max-width: 26rem }
+ h1 { font-size: 1.25rem; margin: 0 0 .5rem }
+ p { margin: 0; opacity: .75 }
+ .mark { font-size: 2.5rem; line-height: 1; margin-bottom: .75rem }
+</style></head>
+<body><div class="card">
+ <div class="mark">${approved ? '✓' : '✕'}</div>
+ <h1>${title}</h1><p>${body}</p>
+</div><script>setTimeout(function(){window.close()},1200)</script></body></html>`;
+}
+/**
+ * Bind a loopback listener for the browser to come back to.
+ *
+ * Returns null — never throws — when binding is not possible: a sandbox that
+ * forbids listening, an SSH session with no browser on this machine, an
+ * exhausted port range. The login then completes by polling alone, so a null
+ * here costs the user a tab they have to close by hand and nothing else.
+ *
+ * Binds to 127.0.0.1 explicitly rather than all interfaces: it must not become
+ * a socket anything off-box can reach, and on macOS binding to 0.0.0.0 is what
+ * triggers the "accept incoming connections?" firewall prompt.
+ */
+export async function openLoopback() {
+    let resolveHit = () => { };
+    const hit = new Promise((resolve) => {
+        resolveHit = resolve;
+    });
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404, { 'content-type': 'text/plain' });
+            res.end('Not found');
+            return;
+        }
+        // `result` is display-only: what actually happened is decided by the poll
+        // that follows, so a hand-crafted request to this port can change the page
+        // wording and nothing else.
+        const result = url.searchParams.get('result') ?? 'approved';
+        res.writeHead(200, {
+            'content-type': 'text/html; charset=utf-8',
+            // The page states the outcome of a one-time login; caching it would
+            // show a stale verdict on the next one.
+            'cache-control': 'no-store',
+        });
+        res.end(resultPage(result));
+        resolveHit();
+    });
+    const bound = await new Promise((resolve) => {
+        const settle = (ok) => {
+            clearTimeout(timer);
+            server.removeAllListeners('error');
+            resolve(ok);
+        };
+        const timer = setTimeout(() => settle(false), BIND_TIMEOUT_MS);
+        server.once('error', () => settle(false));
+        try {
+            server.listen(0, '127.0.0.1', () => settle(true));
+        }
+        catch {
+            settle(false);
+        }
+    });
+    if (!bound) {
+        server.close();
+        return null;
+    }
+    const address = server.address();
+    if (!address || typeof address.port !== 'number') {
+        server.close();
+        return null;
+    }
+    // Don't hold the process open: if the browser never comes back, the poll loop
+    // (and Ctrl-C) must still be what ends the command.
+    server.unref();
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}${CALLBACK_PATH}`,
+        hit,
+        close: () => {
+            server.close();
+            // A tab kept alive by keep-alive would otherwise delay the close.
+            server.closeAllConnections?.();
+        },
+    };
+}
+/** Per-platform "open this URL in whatever the user uses". */
+function openCommand(url) {
+    if (process.platform === 'darwin')
+        return { command: 'open', args: [url] };
+    if (process.platform === 'win32') {
+        // `start` is a cmd builtin, and its first quoted argument is the WINDOW
+        // TITLE — hence the empty "" before the URL, without which a quoted URL
+        // silently becomes a title and no browser opens.
+        return { command: 'cmd', args: ['/c', 'start', '""', url] };
+    }
+    return { command: 'xdg-open', args: [url] };
+}
+/**
+ * Launch the browser, reporting whether it plausibly worked.
+ *
+ * A false return is not an error: SSH sessions, containers and bare servers
+ * legitimately have nothing to launch, and the caller prints the URL for the
+ * user to open elsewhere. Env vars that mean "no browser here" are honoured
+ * before trying, because launching under `CI` would hang a pipeline on a
+ * spawned process nobody can see.
+ */
+export async function openBrowser(url) {
+    if (process.env.EXTENSHI_NO_BROWSER || process.env.CI)
+        return false;
+    // A Linux box with no display has no browser to open — but WSL does, via the
+    // Windows host, so don't treat "no DISPLAY" as decisive there.
+    if (process.platform === 'linux' &&
+        !process.env.DISPLAY &&
+        !process.env.WAYLAND_DISPLAY &&
+        !process.env.WSL_DISTRO_NAME) {
+        return false;
+    }
+    const { command, args } = openCommand(url);
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(command, args, { stdio: 'ignore', detached: true });
+            // An ENOENT (`xdg-open` not installed) arrives asynchronously, so resolve
+            // on whichever comes first: the error, or the process getting far enough
+            // to be disowned.
+            child.once('error', () => resolve(false));
+            child.once('spawn', () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/** Sleep, cut short if `wakeup` settles first. */
+export function sleep(ms, wakeup) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        // Never let a pending sleep be the reason the CLI won't exit.
+        timer.unref?.();
+        void wakeup?.then(() => {
+            clearTimeout(timer);
+            resolve();
+        }, () => {
+            clearTimeout(timer);
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=login-runtime.js.map

package/dist/login-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runtime.js","sourceRoot":"","sources":["../src/login-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAA;AAI5B,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,MAAM,aAAa,GAAG,WAAW,CAAA;AAEjC;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAc;IACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAA;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAChE,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,sDAAsD;QACxD,CAAC,CAAC,gDAAgD,CAAA;IACnD,OAAO;qDAC6C,KAAK;;;;;;;;;;;qBAWrC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;OAClC,KAAK,WAAW,IAAI;iFACsD,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,UAAU,GAAG,OAAO,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACP,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAA;QAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,0BAA0B;YAC1C,oEAAoE;YACpE,wCAAwC;YACxC,eAAe,EAAE,UAAU;SAC3B,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,UAAU,EAAE,CAAA;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,EAAW,EAAE,EAAE;YAC9B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAClC,OAAO,CAAC,EAAE,CAAC,CAAA;QACZ,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC;YACJ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,KAAK,CAAC,CAAA;QACd,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAwB,CAAA;IACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,MAAM,CAAC,KAAK,EAAE,CAAA;IAEd,OAAO;QACN,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,GAAG,aAAa,EAAE;QAC/D,GAAG;QACH,KAAK,EAAE,GAAG,EAAE;YACX,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,kEAAkE;YAClE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;QAC/B,CAAC;KACD,CAAA;AACF,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,wEAAwE;QACxE,wEAAwE;QACxE,iDAAiD;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IACnE,6EAA6E;IAC7E,+DAA+D;IAC/D,IACC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAC3B,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,kBAAkB;YAClB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,KAAK,CAAC,KAAK,EAAE,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAyB;IAC1D,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACrC,8DAA8D;QAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,KAAK,MAAM,EAAE,IAAI,CAChB,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,EAAE,CAAA;QACV,CAAC,EACD,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,EAAE,CAAA;QACV,CAAC,CACD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@extenshi/cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Pre-publish security scanner for browser extensions",
   "type": "module",
   "publishConfig": {
@@ -28,13 +28,13 @@
     "ora": "^8.1.1",
     "posthog-node": "^5.35.1",
     "semver": "^7.6.3",
-    "undici": "^7.28.0"
+    "undici": "^7.29.0"
   },
   "devDependencies": {
     "@types/node": "^22.16.5",
     "@types/semver": "^7.5.8",
     "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.7"
   },
   "engines": {
     "node": ">=20"