@forgecart/cli 2.202610071755.0 → 2.202610082355.0

package/dist/src/authorization/cli-authorization-flow.d.ts

@@ -0,0 +1,55 @@
+import type { CliAuthorizationClient } from './cli-authorization.client.js';
+import { type CliCredentials } from './type/cli-authorization.types.js';
+/**
+ * The browser authorization `forgecart init` runs when its credential check
+ * comes up short (#2772; record `refs/design/cli-improvements`, screen `init`).
+ *
+ * It opens an authorization on the admin API, prints the dashboard URL and the
+ * user code — BEFORE any browser is attempted, for the reader whose browser
+ * never opens — then opens the browser when a person is at a terminal, and
+ * polls at the cadence the request named until the authorization settles or
+ * the wait ends: the window, or `--timeout` when that comes first. The wait is
+ * quiet — no countdown, no interval, no attempt count — so an approval on the
+ * third poll reads exactly as one on the first. The device code is the poll's
+ * secret and is never printed.
+ */
+export declare class CliAuthorizationFlow {
+    private readonly client;
+    constructor(client: CliAuthorizationClient);
+    /**
+     * Authorize this machine and answer the four credentials the approval
+     * delivers. A denial, an expiry or an elapsed wait ends the run on exit 3.
+     *
+     * @param report the credential check's report, printed first.
+     * @param timeoutSec `--timeout`: the most the wait may last — absent, the authorization's window.
+     */
+    authorize(report: readonly string[], timeoutSec: number | undefined): Promise<CliCredentials>;
+    /** Poll until the authorization settles or the deadline passes. */
+    private awaitApproval;
+    /** The credentials an APPROVED answer delivers; null while PENDING. DENIED and EXPIRED end the run. */
+    private settle;
+    /** The window's close — or `--timeout` from now, when that comes first. */
+    private deadlineOf;
+    /** What the run prints once the authorization is open, for a terminal or for a log. */
+    private handOff;
+    /** A person at a terminal: the browser opens, and the comparison is asked for where they stand. */
+    private interactiveHandOff;
+    /** No terminal: no browser, the URL and the code for whoever reads the log, and the bounded wait. */
+    private headlessHandOff;
+    /** The wait, quiet: `--timeout` is the one number it echoes, because the caller passed it. */
+    private waitingLine;
+    /**
+     * Best effort by design: over ssh, in a container or on a locked-down laptop
+     * nothing opens, and the URL and the code are already on the screen for
+     * exactly that reader — so a launcher that cannot start changes nothing about
+     * the run, and the CLI never waits on the browser it started.
+     */
+    private openBrowser;
+    private browserLauncher;
+    /**
+     * A browser is opened only for a person: stdin and stdout both a terminal.
+     * Read through the terminal types the question prompt reads them with — on a
+     * stream that is no terminal `isTTY` is absent, not false.
+     */
+    private isTerminal;
+}

package/dist/src/authorization/cli-authorization-flow.js

@@ -0,0 +1,175 @@
+import { spawn } from 'node:child_process';
+import { hostname } from 'node:os';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { print } from '../output.js';
+import { readPackageVersion } from '../version.js';
+import { CliUnauthorizedReason, CliUnauthorizedRefusal } from './cli-unauthorized-refusal.js';
+import { CliAuthorizationState, } from './type/cli-authorization.types.js';
+/**
+ * The browser authorization `forgecart init` runs when its credential check
+ * comes up short (#2772; record `refs/design/cli-improvements`, screen `init`).
+ *
+ * It opens an authorization on the admin API, prints the dashboard URL and the
+ * user code — BEFORE any browser is attempted, for the reader whose browser
+ * never opens — then opens the browser when a person is at a terminal, and
+ * polls at the cadence the request named until the authorization settles or
+ * the wait ends: the window, or `--timeout` when that comes first. The wait is
+ * quiet — no countdown, no interval, no attempt count — so an approval on the
+ * third poll reads exactly as one on the first. The device code is the poll's
+ * secret and is never printed.
+ */
+export class CliAuthorizationFlow {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Authorize this machine and answer the four credentials the approval
+     * delivers. A denial, an expiry or an elapsed wait ends the run on exit 3.
+     *
+     * @param report the credential check's report, printed first.
+     * @param timeoutSec `--timeout`: the most the wait may last — absent, the authorization's window.
+     */
+    async authorize(report, timeoutSec) {
+        for (const line of report)
+            print(line);
+        const authorization = await this.client.request({
+            deviceName: hostname(),
+            cliVersion: readPackageVersion(),
+        });
+        const interactive = this.isTerminal();
+        for (const line of this.handOff(authorization, timeoutSec, interactive))
+            print(line);
+        if (interactive)
+            this.openBrowser(authorization.verificationUrl);
+        const credentials = await this.awaitApproval(authorization, timeoutSec);
+        print('');
+        print('  ✓ Authorized');
+        return credentials;
+    }
+    /** Poll until the authorization settles or the deadline passes. */
+    async awaitApproval(authorization, timeoutSec) {
+        const deadline = this.deadlineOf(authorization, timeoutSec);
+        const intervalMs = authorization.pollIntervalSec * 1000;
+        for (;;) {
+            const remainingMs = deadline.at - Date.now();
+            if (remainingMs <= 0)
+                throw new CliUnauthorizedRefusal(deadline.reason);
+            await sleep(Math.min(intervalMs, remainingMs));
+            const credentials = this.settle(await this.client.status(authorization.deviceCode));
+            if (credentials !== null)
+                return credentials;
+        }
+    }
+    /** The credentials an APPROVED answer delivers; null while PENDING. DENIED and EXPIRED end the run. */
+    settle(status) {
+        if (status.state === CliAuthorizationState.DENIED) {
+            throw new CliUnauthorizedRefusal(CliUnauthorizedReason.DENIED);
+        }
+        if (status.state === CliAuthorizationState.EXPIRED) {
+            throw new CliUnauthorizedRefusal(CliUnauthorizedReason.EXPIRED);
+        }
+        if (status.state === CliAuthorizationState.PENDING)
+            return null;
+        if (status.credentials === null) {
+            throw new Error('The admin API answered APPROVED without the credentials an approval delivers.');
+        }
+        return status.credentials;
+    }
+    /** The window's close — or `--timeout` from now, when that comes first. */
+    deadlineOf(authorization, timeoutSec) {
+        const window = {
+            at: Date.parse(authorization.expiresAt),
+            reason: CliUnauthorizedReason.EXPIRED,
+        };
+        if (timeoutSec === undefined)
+            return window;
+        const timeoutAt = Date.now() + timeoutSec * 1000;
+        if (timeoutAt >= window.at)
+            return window;
+        return { at: timeoutAt, reason: CliUnauthorizedReason.TIMED_OUT };
+    }
+    /** What the run prints once the authorization is open, for a terminal or for a log. */
+    handOff(authorization, timeoutSec, interactive) {
+        if (interactive)
+            return this.interactiveHandOff(authorization, timeoutSec);
+        return this.headlessHandOff(authorization, timeoutSec);
+    }
+    /** A person at a terminal: the browser opens, and the comparison is asked for where they stand. */
+    interactiveHandOff(authorization, timeoutSec) {
+        return [
+            '',
+            '  This machine is not authorized for any store yet.',
+            '',
+            '  Opening your browser to authorize it…',
+            '',
+            `    ${authorization.verificationUrl}`,
+            '',
+            '  If the browser did not open, visit that URL and check the code reads',
+            '',
+            `      ${authorization.userCode}`,
+            '',
+            `  ${this.waitingLine(timeoutSec)} · press Ctrl-C to abort`,
+            '',
+            '  Not you? The code is shown in the browser — approve only if it matches',
+            `  ${authorization.userCode}. Ctrl-C aborts and nothing is written.`,
+        ];
+    }
+    /** No terminal: no browser, the URL and the code for whoever reads the log, and the bounded wait. */
+    headlessHandOff(authorization, timeoutSec) {
+        return [
+            '',
+            '  No TTY — not opening a browser.',
+            '',
+            '  Authorize this machine at',
+            '',
+            `    ${authorization.verificationUrl}`,
+            '',
+            '  and check the code reads',
+            '',
+            `      ${authorization.userCode}`,
+            '',
+            '  — or supply the four keys in the environment and re-run.',
+            '',
+            `  ${this.waitingLine(timeoutSec)}`,
+        ];
+    }
+    /** The wait, quiet: `--timeout` is the one number it echoes, because the caller passed it. */
+    waitingLine(timeoutSec) {
+        if (timeoutSec === undefined)
+            return 'Waiting for approval…';
+        return `Waiting for approval… (--timeout ${String(timeoutSec)}s)`;
+    }
+    /**
+     * Best effort by design: over ssh, in a container or on a locked-down laptop
+     * nothing opens, and the URL and the code are already on the screen for
+     * exactly that reader — so a launcher that cannot start changes nothing about
+     * the run, and the CLI never waits on the browser it started.
+     */
+    openBrowser(url) {
+        const { command, args } = this.browserLauncher(url);
+        const launcher = spawn(command, args, { stdio: 'ignore', detached: true });
+        launcher.once('error', () => {
+            // The hand-off printed above is the fallback for a launcher that cannot start.
+        });
+        launcher.unref();
+    }
+    browserLauncher(url) {
+        if (process.platform === 'darwin')
+            return { command: 'open', args: [url] };
+        if (process.platform === 'win32')
+            return { command: 'explorer.exe', args: [url] };
+        return { command: 'xdg-open', args: [url] };
+    }
+    /**
+     * A browser is opened only for a person: stdin and stdout both a terminal.
+     * Read through the terminal types the question prompt reads them with — on a
+     * stream that is no terminal `isTTY` is absent, not false.
+     */
+    isTerminal() {
+        const keyboard = process.stdin;
+        const display = process.stdout;
+        return keyboard.isTTY === true && display.isTTY === true;
+    }
+}
+//# sourceMappingURL=cli-authorization-flow.js.map

package/dist/src/authorization/cli-authorization-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-authorization-flow.js","sourceRoot":"","sources":["../../../src/authorization/cli-authorization-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACL,qBAAqB,GAItB,MAAM,mCAAmC,CAAC;AAc3C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,MAA8B;QAA9B,WAAM,GAAN,MAAM,CAAwB;IAAG,CAAC;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CACb,MAAyB,EACzB,UAA8B;QAE9B,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC9C,UAAU,EAAE,QAAQ,EAAE;YACtB,UAAU,EAAE,kBAAkB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,WAAW;YAAE,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,aAAa,CACzB,aAA4C,EAC5C,UAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,GAAG,IAAI,CAAC;QACxD,SAAS,CAAC;YACR,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7C,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;YACpF,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,WAAW,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,uGAAuG;IAC/F,MAAM,CAAC,MAAoC;QACjD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAChE,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,2EAA2E;IACnE,UAAU,CAChB,aAA4C,EAC5C,UAA8B;QAE9B,MAAM,MAAM,GAA6B;YACvC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;YACvC,MAAM,EAAE,qBAAqB,CAAC,OAAO;SACtC,CAAC;QACF,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,SAAS,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAC;IACpE,CAAC;IAED,uFAAuF;IAC/E,OAAO,CACb,aAA4C,EAC5C,UAA8B,EAC9B,WAAoB;QAEpB,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,mGAAmG;IAC3F,kBAAkB,CACxB,aAA4C,EAC5C,UAA8B;QAE9B,OAAO;YACL,EAAE;YACF,qDAAqD;YACrD,EAAE;YACF,yCAAyC;YACzC,EAAE;YACF,OAAO,aAAa,CAAC,eAAe,EAAE;YACtC,EAAE;YACF,wEAAwE;YACxE,EAAE;YACF,SAAS,aAAa,CAAC,QAAQ,EAAE;YACjC,EAAE;YACF,KAAK,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,0BAA0B;YAC3D,EAAE;YACF,0EAA0E;YAC1E,KAAK,aAAa,CAAC,QAAQ,yCAAyC;SACrE,CAAC;IACJ,CAAC;IAED,qGAAqG;IAC7F,eAAe,CACrB,aAA4C,EAC5C,UAA8B;QAE9B,OAAO;YACL,EAAE;YACF,mCAAmC;YACnC,EAAE;YACF,6BAA6B;YAC7B,EAAE;YACF,OAAO,aAAa,CAAC,eAAe,EAAE;YACtC,EAAE;YACF,4BAA4B;YAC5B,EAAE;YACF,SAAS,aAAa,CAAC,QAAQ,EAAE;YACjC,EAAE;YACF,4DAA4D;YAC5D,EAAE;YACF,KAAK,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,8FAA8F;IACtF,WAAW,CAAC,UAA8B;QAChD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,uBAAuB,CAAC;QAC7D,OAAO,oCAAoC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,GAAW;QAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAS,EAAE;YAChC,+EAA+E;QACjF,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,UAAU;QAChB,MAAM,QAAQ,GAAqB,OAAO,CAAC,KAAK,CAAC;QACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,MAAM,CAAC;QAChD,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IAC3D,CAAC;CACF"}

package/dist/src/authorization/cli-authorization.client.d.ts

@@ -0,0 +1,36 @@
+import { type CliAuthorizationRequestInput, type CliAuthorizationRequestResult, type CliAuthorizationStatusResult } from './type/cli-authorization.types.js';
+/**
+ * The admin API's two Public CLI authorization operations, over GraphQL on
+ * HTTP — the CLI ships no WebSocket client, and both operations are single
+ * request/response exchanges. Every answer is read field by field: a result
+ * the CLI cannot read is an error naming the endpoint, never a guess.
+ */
+export declare class CliAuthorizationClient {
+    private readonly endpoint;
+    /** @param endpoint the admin API's GraphQL URL. */
+    constructor(endpoint: string);
+    /** Open an authorization for this machine. */
+    request(input: CliAuthorizationRequestInput): Promise<CliAuthorizationRequestResult>;
+    /**
+     * Poll the authorization the device code names. A typed refusal the server
+     * answers instead — denied, expired, unknown — ends the run on exit 3.
+     */
+    status(deviceCode: string): Promise<CliAuthorizationStatusResult>;
+    /** POST one operation and answer its root field's object. */
+    private send;
+    private post;
+    /** The response's GraphQL body — an answer that is not one names its HTTP status. */
+    private readBody;
+    /** A GraphQL error ends the call: a CLI authorization refusal on exit 3, anything else as an error. */
+    private assertNoErrors;
+    /** The `ErrorCode` a GraphQL error carries in its extensions. */
+    private errorCode;
+    /** The credentials an answer carries — null on every answer but APPROVED. */
+    private readCredentials;
+    private readString;
+    private isState;
+    private unreadable;
+    private notGraphQlMessage;
+    /** What failed to connect: fetch's own message names nothing, its cause names the socket error. */
+    private failureDetail;
+}

package/dist/src/authorization/cli-authorization.client.js

@@ -0,0 +1,169 @@
+import { isJsonObject } from '../json.js';
+import { CliUnauthorizedReason, CliUnauthorizedRefusal } from './cli-unauthorized-refusal.js';
+import { CliAuthorizationState, } from './type/cli-authorization.types.js';
+/** The SDK's `CliAuthorizationRequest` operation, verbatim — `forgecart init` holds no credential yet. */
+const REQUEST_DOCUMENT = `mutation CliAuthorizationRequest($input: CliAuthorizationRequestInput!) {
+  cliAuthorizationRequest(input: $input) {
+    deviceCode
+    userCode
+    verificationUrl
+    expiresAt
+    pollIntervalSec
+  }
+}`;
+/** The SDK's `CliAuthorizationStatus` operation, verbatim — the poll, keyed on the device code. */
+const STATUS_DOCUMENT = `mutation CliAuthorizationStatus($deviceCode: String!) {
+  cliAuthorizationStatus(deviceCode: $deviceCode) {
+    state
+    credentials {
+      channelToken
+      adminSecret
+      shopApiUrl
+      adminApiUrl
+    }
+  }
+}`;
+/**
+ * The typed refusals a poll can answer, by the end each one means for the CLI.
+ * An unknown code is an authorization the server no longer holds — its window
+ * closed and the sweep took it — so it ends exactly as an expired one does.
+ */
+const REFUSAL_REASONS = {
+    CLI_AUTHORIZATION_DENIED: CliUnauthorizedReason.DENIED,
+    CLI_AUTHORIZATION_EXPIRED: CliUnauthorizedReason.EXPIRED,
+    CLI_AUTHORIZATION_CODE_UNKNOWN: CliUnauthorizedReason.EXPIRED,
+};
+/**
+ * The admin API's two Public CLI authorization operations, over GraphQL on
+ * HTTP — the CLI ships no WebSocket client, and both operations are single
+ * request/response exchanges. Every answer is read field by field: a result
+ * the CLI cannot read is an error naming the endpoint, never a guess.
+ */
+export class CliAuthorizationClient {
+    endpoint;
+    /** @param endpoint the admin API's GraphQL URL. */
+    constructor(endpoint) {
+        this.endpoint = endpoint;
+    }
+    /** Open an authorization for this machine. */
+    async request(input) {
+        const result = await this.send(REQUEST_DOCUMENT, { input }, 'cliAuthorizationRequest');
+        const expiresAt = this.readString(result, 'expiresAt', 'cliAuthorizationRequest');
+        const pollIntervalSec = result.pollIntervalSec;
+        if (Number.isNaN(Date.parse(expiresAt)))
+            throw this.unreadable('cliAuthorizationRequest');
+        if (typeof pollIntervalSec !== 'number' || pollIntervalSec <= 0) {
+            throw this.unreadable('cliAuthorizationRequest');
+        }
+        return {
+            deviceCode: this.readString(result, 'deviceCode', 'cliAuthorizationRequest'),
+            userCode: this.readString(result, 'userCode', 'cliAuthorizationRequest'),
+            verificationUrl: this.readString(result, 'verificationUrl', 'cliAuthorizationRequest'),
+            expiresAt,
+            pollIntervalSec,
+        };
+    }
+    /**
+     * Poll the authorization the device code names. A typed refusal the server
+     * answers instead — denied, expired, unknown — ends the run on exit 3.
+     */
+    async status(deviceCode) {
+        const result = await this.send(STATUS_DOCUMENT, { deviceCode }, 'cliAuthorizationStatus');
+        const state = result.state;
+        if (!this.isState(state))
+            throw this.unreadable('cliAuthorizationStatus');
+        return { state, credentials: this.readCredentials(result.credentials) };
+    }
+    /** POST one operation and answer its root field's object. */
+    async send(document, variables, field) {
+        const response = await this.post(document, variables);
+        const body = await this.readBody(response);
+        this.assertNoErrors(body.errors, field);
+        const data = body.data;
+        const result = isJsonObject(data) ? data[field] : undefined;
+        if (!isJsonObject(result))
+            throw this.unreadable(field);
+        return result;
+    }
+    async post(document, variables) {
+        try {
+            return await fetch(this.endpoint, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', accept: 'application/json' },
+                body: JSON.stringify({ query: document, variables }),
+            });
+        }
+        catch (error) {
+            throw new Error(`Could not reach the admin API at ${this.endpoint}: ${this.failureDetail(error)}.`, { cause: error });
+        }
+    }
+    /** The response's GraphQL body — an answer that is not one names its HTTP status. */
+    async readBody(response) {
+        const text = await response.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (error) {
+            throw new Error(this.notGraphQlMessage(response.status), { cause: error });
+        }
+        if (!isJsonObject(parsed))
+            throw new Error(this.notGraphQlMessage(response.status));
+        return parsed;
+    }
+    /** A GraphQL error ends the call: a CLI authorization refusal on exit 3, anything else as an error. */
+    assertNoErrors(errors, field) {
+        if (!Array.isArray(errors) || errors.length === 0)
+            return;
+        const first = errors[0];
+        const code = this.errorCode(first);
+        const reason = code === undefined ? undefined : REFUSAL_REASONS[code];
+        if (reason !== undefined)
+            throw new CliUnauthorizedRefusal(reason);
+        const message = isJsonObject(first) && typeof first.message === 'string' ? first.message : '';
+        throw new Error(`The admin API at ${this.endpoint} refused ${field}: ${code ?? message}.`);
+    }
+    /** The `ErrorCode` a GraphQL error carries in its extensions. */
+    errorCode(error) {
+        if (!isJsonObject(error) || !isJsonObject(error.extensions))
+            return undefined;
+        const code = error.extensions.code;
+        return typeof code === 'string' ? code : undefined;
+    }
+    /** The credentials an answer carries — null on every answer but APPROVED. */
+    readCredentials(value) {
+        if (value === null || value === undefined)
+            return null;
+        if (!isJsonObject(value))
+            throw this.unreadable('cliAuthorizationStatus');
+        return {
+            channelToken: this.readString(value, 'channelToken', 'cliAuthorizationStatus'),
+            adminSecret: this.readString(value, 'adminSecret', 'cliAuthorizationStatus'),
+            shopApiUrl: this.readString(value, 'shopApiUrl', 'cliAuthorizationStatus'),
+            adminApiUrl: this.readString(value, 'adminApiUrl', 'cliAuthorizationStatus'),
+        };
+    }
+    readString(record, key, field) {
+        const value = record[key];
+        if (typeof value !== 'string' || value === '')
+            throw this.unreadable(field);
+        return value;
+    }
+    isState(value) {
+        return Object.values(CliAuthorizationState).includes(value);
+    }
+    unreadable(field) {
+        return new Error(`The admin API at ${this.endpoint} answered a ${field} result the CLI cannot read.`);
+    }
+    notGraphQlMessage(status) {
+        return `The admin API at ${this.endpoint} answered HTTP ${String(status)} without a GraphQL response.`;
+    }
+    /** What failed to connect: fetch's own message names nothing, its cause names the socket error. */
+    failureDetail(error) {
+        const cause = error instanceof Error ? error.cause : undefined;
+        if (cause instanceof Error)
+            return cause.message;
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+//# sourceMappingURL=cli-authorization.client.js.map

package/dist/src/authorization/cli-authorization.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-authorization.client.js","sourceRoot":"","sources":["../../../src/authorization/cli-authorization.client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACL,qBAAqB,GAKtB,MAAM,mCAAmC,CAAC;AAE3C,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG;;;;;;;;EAQvB,CAAC;AAEH,mGAAmG;AACnG,MAAM,eAAe,GAAG;;;;;;;;;;EAUtB,CAAC;AAEH;;;;GAIG;AACH,MAAM,eAAe,GAA6D;IAChF,wBAAwB,EAAE,qBAAqB,CAAC,MAAM;IACtD,yBAAyB,EAAE,qBAAqB,CAAC,OAAO;IACxD,8BAA8B,EAAE,qBAAqB,CAAC,OAAO;CAC9D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAEJ;IAD7B,mDAAmD;IACnD,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,8CAA8C;IAC9C,KAAK,CAAC,OAAO,CAAC,KAAmC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAClF,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAC1F,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,yBAAyB,CAAC;YAC5E,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC;YACxE,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,CAAC;YACtF,SAAS;YACT,eAAe;SAChB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,6DAA6D;IACrD,KAAK,CAAC,IAAI,CAChB,QAAgB,EAChB,SAAkC,EAClC,KAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,SAAkC;QACrE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAClF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,QAAQ,CAAC,QAAkB;QACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,MAAe,EAAE,KAAa;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC1D,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,YAAY,KAAK,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,iEAAiE;IACzD,SAAS,CAAC,KAAc;QAC9B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,6EAA6E;IACrE,eAAe,CAAC,KAAc;QACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;QAC1E,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,wBAAwB,CAAC;YAC9E,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,wBAAwB,CAAC;YAC5E,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,wBAAwB,CAAC;YAC1E,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,wBAAwB,CAAC;SAC7E,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,MAA+B,EAAE,GAAW,EAAE,KAAa;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,KAAc;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAU,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAEO,UAAU,CAAC,KAAa;QAC9B,OAAO,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,eAAe,KAAK,8BAA8B,CAAC,CAAC;IACxG,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,OAAO,oBAAoB,IAAI,CAAC,QAAQ,kBAAkB,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC;IACzG,CAAC;IAED,mGAAmG;IAC3F,aAAa,CAAC,KAAc;QAClC,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,IAAI,KAAK,YAAY,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QACjD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/src/authorization/cli-credential-check.d.ts

@@ -0,0 +1,42 @@
+import { CliCredentialKey, type CliCredentials } from './type/cli-authorization.types.js';
+/**
+ * `forgecart init`'s credential check (#2772): each of the four keys from the
+ * environment, then the target's `.env`, then its `.forgecart/config.json`
+ * (`channelToken`, `apiUrl`) — the first non-empty value wins. With all four
+ * found, init asks nothing; with any absent, it authorizes in the browser, and
+ * the check's {@link report} is the first thing that run prints.
+ */
+export declare class CliCredentialCheck {
+    private readonly environment;
+    private readonly dotenv;
+    private readonly config;
+    private constructor();
+    /** Look for the four keys for the storefront at `targetDir`. */
+    static read(targetDir: string, env?: NodeJS.ProcessEnv): Promise<CliCredentialCheck>;
+    /** The value the check found for `key`: the environment's, then `.env`'s, then `config.json`'s. */
+    value(key: CliCredentialKey): string | undefined;
+    /** All four credentials — undefined while any one is absent. */
+    credentials(): CliCredentials | undefined;
+    /**
+     * The check as a failed run prints it (record `refs/design/cli-improvements`,
+     * `init?case=missing`): one row per place it looked, each naming what that
+     * place does not carry. Values are never printed — only key names.
+     */
+    report(): string[];
+    private row;
+    /** The unset keys, two to a line, the last line closed by `— unset`. */
+    private unsetLines;
+    /**
+     * The four keys `.env` assigns. The FIRST assignment of a key is the one read
+     * — the line `init`'s merge refreshes — and an empty value is no value.
+     */
+    private static readDotenv;
+    /** The channel token and shop API URL `.forgecart/config.json` records. */
+    private static readConfig;
+    private static parseConfig;
+    private static unreadableConfigMessage;
+    /** A file that may legitimately not exist; any other failure propagates. */
+    private static readIfPresent;
+    private static unquote;
+    private static isCredentialKey;
+}

package/dist/src/authorization/cli-credential-check.js

@@ -0,0 +1,157 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isJsonObject } from '../json.js';
+import { CliCredentialKey } from './type/cli-authorization.types.js';
+/** The report's source column: `.forgecart/config.json`, and the gutter after it. */
+const SOURCE_COLUMN_WIDTH = 26;
+/** One `.env` assignment — the key shape `init`'s merge manages. */
+const DOTENV_ASSIGNMENT = /^([A-Z][A-Z0-9_]*)=(.*)$/;
+/** A value wrapped in one pair of matching quotes, as `.env` files may write it. */
+const QUOTED_VALUE = /^(["'])(.*)\1$/;
+/** The `.forgecart/config.json` field each credential it carries is read from. */
+const CONFIG_FIELDS = [
+    [CliCredentialKey.CHANNEL_TOKEN, 'channelToken'],
+    [CliCredentialKey.SHOP_API_URL, 'apiUrl'],
+];
+/**
+ * `forgecart init`'s credential check (#2772): each of the four keys from the
+ * environment, then the target's `.env`, then its `.forgecart/config.json`
+ * (`channelToken`, `apiUrl`) — the first non-empty value wins. With all four
+ * found, init asks nothing; with any absent, it authorizes in the browser, and
+ * the check's {@link report} is the first thing that run prints.
+ */
+export class CliCredentialCheck {
+    environment;
+    dotenv;
+    config;
+    constructor(environment, dotenv, config) {
+        this.environment = environment;
+        this.dotenv = dotenv;
+        this.config = config;
+    }
+    /** Look for the four keys for the storefront at `targetDir`. */
+    static async read(targetDir, env = process.env) {
+        const environment = new Map();
+        for (const key of Object.values(CliCredentialKey)) {
+            const value = env[key]?.trim();
+            if (value)
+                environment.set(key, value);
+        }
+        return new CliCredentialCheck(environment, await CliCredentialCheck.readDotenv(join(targetDir, '.env')), await CliCredentialCheck.readConfig(join(targetDir, '.forgecart', 'config.json')));
+    }
+    /** The value the check found for `key`: the environment's, then `.env`'s, then `config.json`'s. */
+    value(key) {
+        return this.environment.get(key) ?? this.dotenv?.get(key) ?? this.config?.get(key);
+    }
+    /** All four credentials — undefined while any one is absent. */
+    credentials() {
+        const channelToken = this.value(CliCredentialKey.CHANNEL_TOKEN);
+        const adminSecret = this.value(CliCredentialKey.ADMIN_SECRET);
+        const shopApiUrl = this.value(CliCredentialKey.SHOP_API_URL);
+        const adminApiUrl = this.value(CliCredentialKey.ADMIN_API_URL);
+        if (!channelToken || !adminSecret || !shopApiUrl || !adminApiUrl)
+            return undefined;
+        return { channelToken, adminSecret, shopApiUrl, adminApiUrl };
+    }
+    /**
+     * The check as a failed run prints it (record `refs/design/cli-improvements`,
+     * `init?case=missing`): one row per place it looked, each naming what that
+     * place does not carry. Values are never printed — only key names.
+     */
+    report() {
+        return [
+            '',
+            '  Checking credentials…',
+            '',
+            ...this.row('.env', this.dotenv),
+            ...this.row('environment', this.environment),
+            ...this.row('.forgecart/config.json', this.config),
+        ];
+    }
+    row(label, source) {
+        const gutter = `    ${label.padEnd(SOURCE_COLUMN_WIDTH)}`;
+        if (source === null)
+            return [`${gutter}no such file`];
+        const unset = Object.values(CliCredentialKey).filter((key) => !source.has(key));
+        const continuation = ' '.repeat(gutter.length);
+        return this.unsetLines(unset).map((line, index) => `${index === 0 ? gutter : continuation}${line}`);
+    }
+    /** The unset keys, two to a line, the last line closed by `— unset`. */
+    unsetLines(keys) {
+        const lines = [];
+        for (let start = 0; start < keys.length; start += 2) {
+            lines.push(keys.slice(start, start + 2).join(', '));
+        }
+        return lines.map((line, index) => index === lines.length - 1 ? `${line} — unset` : `${line},`);
+    }
+    /**
+     * The four keys `.env` assigns. The FIRST assignment of a key is the one read
+     * — the line `init`'s merge refreshes — and an empty value is no value.
+     */
+    static async readDotenv(path) {
+        const raw = await CliCredentialCheck.readIfPresent(path);
+        if (raw === null)
+            return null;
+        const found = new Map();
+        for (const line of raw.split('\n')) {
+            const assignment = DOTENV_ASSIGNMENT.exec(line);
+            if (assignment === null)
+                continue;
+            const [, key, rawValue] = assignment;
+            if (!CliCredentialCheck.isCredentialKey(key) || found.has(key))
+                continue;
+            const value = CliCredentialCheck.unquote(rawValue.trim());
+            if (value)
+                found.set(key, value);
+        }
+        return found;
+    }
+    /** The channel token and shop API URL `.forgecart/config.json` records. */
+    static async readConfig(path) {
+        const raw = await CliCredentialCheck.readIfPresent(path);
+        if (raw === null)
+            return null;
+        const config = CliCredentialCheck.parseConfig(raw, path);
+        const found = new Map();
+        for (const [key, field] of CONFIG_FIELDS) {
+            const value = config[field];
+            if (typeof value === 'string' && value.trim())
+                found.set(key, value.trim());
+        }
+        return found;
+    }
+    static parseConfig(raw, path) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new Error(CliCredentialCheck.unreadableConfigMessage(path), { cause: error });
+        }
+        if (!isJsonObject(parsed))
+            throw new Error(CliCredentialCheck.unreadableConfigMessage(path));
+        return parsed;
+    }
+    static unreadableConfigMessage(path) {
+        return `${path} is not a JSON object, so the credentials it records cannot be read.`;
+    }
+    /** A file that may legitimately not exist; any other failure propagates. */
+    static async readIfPresent(path) {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+    }
+    static unquote(value) {
+        const quoted = QUOTED_VALUE.exec(value);
+        return quoted === null ? value : quoted[2];
+    }
+    static isCredentialKey(key) {
+        return Object.values(CliCredentialKey).includes(key);
+    }
+}
+//# sourceMappingURL=cli-credential-check.js.map