@framedash/cli 0.1.2 → 0.1.3

package/dist/lib/oauth/manager.js

@@ -0,0 +1,130 @@
+import { OAuthTokenRequestError, refreshTokenGrant, toStoredEntry } from "./token-endpoint.js";
+import { deleteStoredEntry, readStoredEntry, saveStoredEntry, } from "./token-store.js";
+// In-process lifecycle for one origin's stored OAuth credentials: hands out
+// the access token, refreshes proactively near expiry (and on demand after a
+// 401), and persists rotated refresh tokens atomically via the token store.
+//
+// Concurrency: refreshes are coalesced IN-PROCESS (one request per manager,
+// and create-client shares one manager per origin). Across processes the
+// store is last-writer-wins with no locking; a concurrent same-origin
+// refresh can race rotation, whose worst case is the server's reuse
+// revocation surfacing as the ordinary invalid_grant re-login path below.
+// See token-store.ts for the full concurrency-model note.
+/** Refresh when the access token expires within this window. */
+const EXPIRY_SKEW_MS = 60_000;
+/**
+ * The stored grant is dead (refresh returned invalid_grant: revoked, expired,
+ * or rotated out from under us). The stored entry has already been cleared;
+ * the only recovery is an interactive re-login, so callers must surface the
+ * message and stop -- retrying cannot succeed.
+ */
+export class OAuthLoginRequiredError extends Error {
+    constructor(origin) {
+        super(`Your stored login for ${origin} has expired or been revoked. ` +
+            `Run 'framedash login' to sign in again (CI should use FRAMEDASH_API_KEY instead).`);
+        this.name = "OAuthLoginRequiredError";
+    }
+}
+export class OAuthTokenManager {
+    baseUrl;
+    origin;
+    entry;
+    refreshPromise = null;
+    constructor(baseUrl, origin, entry) {
+        this.baseUrl = baseUrl;
+        this.origin = origin;
+        this.entry = entry;
+    }
+    /** Space-delimited granted scopes (safe to display). */
+    get scope() {
+        return this.entry.scope;
+    }
+    /** Access-token expiry, epoch ms (safe to display). */
+    get expiresAt() {
+        return this.entry.expires_at;
+    }
+    /**
+     * Current access token, refreshing first when it expires within 60s so an
+     * about-to-expire token is not sent only to bounce with a 401.
+     */
+    async getAccessToken() {
+        if (this.entry.expires_at - Date.now() > EXPIRY_SKEW_MS) {
+            return this.entry.access_token;
+        }
+        return this.refresh();
+    }
+    /** Force a refresh (after a 401 despite a locally-unexpired token). */
+    async forceRefresh() {
+        return this.refresh();
+    }
+    /** Coalesce concurrent callers onto a single refresh request. */
+    refresh() {
+        if (this.refreshPromise === null) {
+            this.refreshPromise = this.doRefresh().finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        return this.refreshPromise;
+    }
+    /**
+     * Refresh with the CURRENT stored token, then persist the rotated pair
+     * (atomic write, last-writer-wins).
+     */
+    async doRefresh() {
+        // Re-read first: another process may have rotated since this manager
+        // loaded. Presenting an already-rotated token would trip the server's
+        // reuse detection, so prefer the stored (current) credentials.
+        const stored = readStoredEntry(this.origin);
+        if (!stored) {
+            // The entry is GONE: a logout (or an invalid_grant cleanup) completed
+            // while we held stale in-memory credentials -- demand a re-login
+            // rather than reviving a login the user terminated.
+            throw new OAuthLoginRequiredError(this.origin);
+        }
+        if (stored.access_token !== this.entry.access_token) {
+            this.entry = stored;
+            if (stored.expires_at - Date.now() > EXPIRY_SKEW_MS) {
+                // Another process's access token is still fresh: no refresh needed.
+                return stored.access_token;
+            }
+            // Fall through and refresh with the reloaded (current) refresh token.
+        }
+        let entry;
+        try {
+            entry = toStoredEntry(await refreshTokenGrant(this.baseUrl, this.entry.refresh_token));
+        }
+        catch (err) {
+            if (err instanceof OAuthTokenRequestError && err.code === "invalid_grant") {
+                // Dead grant: revoked, expired, or a concurrent refresh in another
+                // process won the rotation race (reuse revocation). Clear the local
+                // entry and ask for a re-login -- the accepted worst case of the
+                // lock-free store.
+                await deleteStoredEntry(this.origin);
+                throw new OAuthLoginRequiredError(this.origin);
+            }
+            // Transient failure (network, 5xx, rate limit): keep the stored entry
+            // so a later attempt can retry.
+            throw err;
+        }
+        // Persist BEFORE first use: rotation invalidated the old refresh token
+        // server-side, so losing the new one would strand this login.
+        try {
+            await saveStoredEntry(this.origin, entry);
+        }
+        catch (err) {
+            // The rotation could not be persisted, but the OLD refresh token on
+            // disk is already consumed server-side: best-effort remove it so the
+            // next run gets a clean re-login instead of reuse revocation.
+            try {
+                await deleteStoredEntry(this.origin);
+            }
+            catch {
+                // Best effort: the same broken disk likely fails this too.
+            }
+            throw err;
+        }
+        this.entry = entry;
+        return entry.access_token;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/lib/oauth/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/lib/oauth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACN,iBAAiB,EACjB,eAAe,EAEf,eAAe,GACf,MAAM,kBAAkB,CAAC;AAE1B,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,0EAA0E;AAC1E,0DAA0D;AAE1D,gEAAgE;AAChE,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACjD,YAAY,MAAc;QACzB,KAAK,CACJ,yBAAyB,MAAM,gCAAgC;YAC9D,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED,MAAM,OAAO,iBAAiB;IAKX;IACA;IALV,KAAK,CAAmB;IACxB,cAAc,GAA2B,IAAI,CAAC;IAEtD,YACkB,OAAe,EACf,MAAc,EAC/B,KAAuB;QAFN,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,uDAAuD;IACvD,IAAI,SAAS;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QACnB,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,YAAY;QACjB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,iEAAiE;IACzD,OAAO;QACd,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS;QACtB,qEAAqE;QACrE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,sEAAsE;YACtE,iEAAiE;YACjE,oDAAoD;YACpD,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACpB,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;gBACrD,oEAAoE;gBACpE,OAAO,MAAM,CAAC,YAAY,CAAC;YAC5B,CAAC;YACD,sEAAsE;QACvE,CAAC;QAED,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACJ,KAAK,GAAG,aAAa,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,sBAAsB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC3E,mEAAmE;gBACnE,oEAAoE;gBACpE,iEAAiE;gBACjE,mBAAmB;gBACnB,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,sEAAsE;YACtE,gCAAgC;YAChC,MAAM,GAAG,CAAC;QACX,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC;YACJ,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,CAAC;gBACJ,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;YAC5D,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,KAAK,CAAC,YAAY,CAAC;IAC3B,CAAC;CACD"}

package/dist/lib/oauth/pkce.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generate an RFC 7636 code_verifier: 48 random bytes -> 64 base64url chars
+ * (within the required 43-128 range, alphabet [A-Za-z0-9-_] which is a subset
+ * of the allowed unreserved characters).
+ */
+export declare function generateCodeVerifier(): string;
+/** Compute the S256 code_challenge: base64url(sha256(verifier)), no padding. */
+export declare function computeS256CodeChallenge(codeVerifier: string): string;
+/**
+ * Generate the CSRF `state` parameter: 24 random bytes -> 32 base64url chars.
+ * Compared byte-for-byte against the loopback callback; any mismatch aborts
+ * the login without a token exchange.
+ */
+export declare function generateState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/lib/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/pkce.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/lib/oauth/pkce.js

@@ -0,0 +1,24 @@
+import { createHash, randomBytes } from "node:crypto";
+// PKCE (RFC 7636) + CSRF-state helpers for the `framedash login` flow.
+// Pure node:crypto module (no I/O) so tests exercise it directly.
+/**
+ * Generate an RFC 7636 code_verifier: 48 random bytes -> 64 base64url chars
+ * (within the required 43-128 range, alphabet [A-Za-z0-9-_] which is a subset
+ * of the allowed unreserved characters).
+ */
+export function generateCodeVerifier() {
+    return randomBytes(48).toString("base64url");
+}
+/** Compute the S256 code_challenge: base64url(sha256(verifier)), no padding. */
+export function computeS256CodeChallenge(codeVerifier) {
+    return createHash("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+/**
+ * Generate the CSRF `state` parameter: 24 random bytes -> 32 base64url chars.
+ * Compared byte-for-byte against the loopback callback; any mismatch aborts
+ * the login without a token exchange.
+ */
+export function generateState() {
+    return randomBytes(24).toString("base64url");
+}
+//# sourceMappingURL=pkce.js.map

package/dist/lib/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/lib/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,uEAAuE;AACvE,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/lib/oauth/token-endpoint.d.ts

@@ -0,0 +1,39 @@
+import type { StoredTokenEntry } from "./token-store.js";
+/** Well-known client_id of the seeded first-party CLI client. */
+export declare const CLI_OAUTH_CLIENT_ID = "fdc_framedash_cli";
+/** Per-request timeout for token/revocation calls. */
+export declare const TOKEN_REQUEST_TIMEOUT_MS = 30000;
+/** Structured OAuth error (RFC 6749 section 5.2) from the token endpoint. */
+export declare class OAuthTokenRequestError extends Error {
+    /** Machine-readable error code, e.g. "invalid_grant". */
+    readonly code: string;
+    readonly status: number;
+    constructor(
+    /** Machine-readable error code, e.g. "invalid_grant". */
+    code: string, description: string, status: number);
+}
+export type TokenResponse = {
+    access_token: string;
+    refresh_token: string;
+    /** Access token lifetime in seconds. */
+    expires_in: number;
+    /** Space-delimited granted scopes. */
+    scope: string;
+};
+/** RFC 6749 section 4.1.3 authorization-code exchange with the PKCE verifier. */
+export declare function exchangeAuthorizationCode(baseUrl: string, options: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}): Promise<TokenResponse>;
+/** RFC 6749 section 6 refresh grant (the server rotates the refresh token). */
+export declare function refreshTokenGrant(baseUrl: string, refreshToken: string): Promise<TokenResponse>;
+/**
+ * RFC 7009 revocation. Revoking the refresh token disconnects the whole
+ * grant server-side. Throws on transport errors; callers treat revocation
+ * as best effort (local credentials are removed regardless).
+ */
+export declare function revokeToken(baseUrl: string, token: string): Promise<void>;
+/** Convert a token response into the persisted entry shape. */
+export declare function toStoredEntry(response: TokenResponse, now?: number): StoredTokenEntry;
+//# sourceMappingURL=token-endpoint.d.ts.map

package/dist/lib/oauth/token-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-endpoint.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAWzD,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,KAAK;IAE/C,yDAAyD;aACzC,IAAI,EAAE,MAAM;aAEZ,MAAM,EAAE,MAAM;;IAH9B,yDAAyD;IACzC,IAAI,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACH,MAAM,EAAE,MAAM;CAK/B;AAED,MAAM,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACd,CAAC;AA6DF,iFAAiF;AACjF,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED,+EAA+E;AAC/E,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,CAMxB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/E;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,SAAa,GAAG,gBAAgB,CAOzF"}

package/dist/lib/oauth/token-endpoint.js

@@ -0,0 +1,117 @@
+import { assertSafeBaseUrl } from "@framedash/api-client";
+// HTTP client for the authorization server's token and revocation endpoints
+// (RFC 6749 / RFC 7009). The CLI is the seeded first-party PUBLIC client
+// (migration 0058): no client secret; possession of the PKCE verifier or the
+// rotating refresh token is the proof.
+//
+// SECURITY: token values pass through here in memory only. Error paths must
+// never include request parameters (which contain tokens) -- only the
+// server's error code/description and the HTTP status.
+/** Well-known client_id of the seeded first-party CLI client. */
+export const CLI_OAUTH_CLIENT_ID = "fdc_framedash_cli";
+/** Per-request timeout for token/revocation calls. */
+export const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+/** Structured OAuth error (RFC 6749 section 5.2) from the token endpoint. */
+export class OAuthTokenRequestError extends Error {
+    code;
+    status;
+    constructor(
+    /** Machine-readable error code, e.g. "invalid_grant". */
+    code, description, status) {
+        super(`Token request failed (${code}): ${description}`);
+        this.code = code;
+        this.status = status;
+        this.name = "OAuthTokenRequestError";
+    }
+}
+function endpointUrl(baseUrl, path) {
+    // Origin-rooted: the AS serves its endpoints at the app origin regardless
+    // of any path on the configured base URL.
+    assertSafeBaseUrl(baseUrl);
+    return new URL(path, baseUrl).toString();
+}
+async function postForm(url, params) {
+    return fetch(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: params.toString(),
+        // Never follow a redirect: it would re-send the form body (which
+        // contains token material) to the redirect target.
+        redirect: "manual",
+        signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+    });
+}
+async function requestToken(baseUrl, params) {
+    params.set("client_id", CLI_OAUTH_CLIENT_ID);
+    const response = await postForm(endpointUrl(baseUrl, "/api/oauth/token"), params);
+    let json;
+    try {
+        json = JSON.parse(await response.text());
+    }
+    catch {
+        throw new Error(`Token endpoint returned a non-JSON response (HTTP ${response.status})`);
+    }
+    const obj = typeof json === "object" && json !== null ? json : {};
+    if (!response.ok) {
+        const code = typeof obj.error === "string" ? obj.error : "unknown_error";
+        const description = typeof obj.error_description === "string" ? obj.error_description : `HTTP ${response.status}`;
+        throw new OAuthTokenRequestError(code, description, response.status);
+    }
+    if (typeof obj.access_token !== "string" ||
+        obj.access_token === "" ||
+        typeof obj.refresh_token !== "string" ||
+        obj.refresh_token === "" ||
+        typeof obj.expires_in !== "number" ||
+        !Number.isFinite(obj.expires_in)) {
+        throw new Error("Token endpoint returned an unexpected response shape");
+    }
+    return {
+        access_token: obj.access_token,
+        refresh_token: obj.refresh_token,
+        expires_in: obj.expires_in,
+        scope: typeof obj.scope === "string" ? obj.scope : "",
+    };
+}
+/** RFC 6749 section 4.1.3 authorization-code exchange with the PKCE verifier. */
+export async function exchangeAuthorizationCode(baseUrl, options) {
+    const params = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        code_verifier: options.codeVerifier,
+    });
+    return requestToken(baseUrl, params);
+}
+/** RFC 6749 section 6 refresh grant (the server rotates the refresh token). */
+export async function refreshTokenGrant(baseUrl, refreshToken) {
+    const params = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+    });
+    return requestToken(baseUrl, params);
+}
+/**
+ * RFC 7009 revocation. Revoking the refresh token disconnects the whole
+ * grant server-side. Throws on transport errors; callers treat revocation
+ * as best effort (local credentials are removed regardless).
+ */
+export async function revokeToken(baseUrl, token) {
+    const params = new URLSearchParams({ token, client_id: CLI_OAUTH_CLIENT_ID });
+    const response = await postForm(endpointUrl(baseUrl, "/api/oauth/revoke"), params);
+    if (!response.ok) {
+        throw new Error(`Revocation endpoint returned HTTP ${response.status}`);
+    }
+}
+/** Convert a token response into the persisted entry shape. */
+export function toStoredEntry(response, now = Date.now()) {
+    return {
+        access_token: response.access_token,
+        refresh_token: response.refresh_token,
+        expires_at: now + response.expires_in * 1000,
+        scope: response.scope,
+    };
+}
+//# sourceMappingURL=token-endpoint.js.map

package/dist/lib/oauth/token-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-endpoint.js","sourceRoot":"","sources":["../../../src/lib/oauth/token-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,4EAA4E;AAC5E,yEAAyE;AACzE,6EAA6E;AAC7E,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,uDAAuD;AAEvD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG/B;IAEA;IAJjB;IACC,yDAAyD;IACzC,IAAY,EAC5B,WAAmB,EACH,MAAc;QAE9B,KAAK,CAAC,yBAAyB,IAAI,MAAM,WAAW,EAAE,CAAC,CAAC;QAJxC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACtC,CAAC;CACD;AAWD,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,0EAA0E;IAC1E,0CAA0C;IAC1C,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAuB;IAC3D,OAAO,KAAK,CAAC,GAAG,EAAE;QACjB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;QACvB,iEAAiE;QACjE,mDAAmD;QACnD,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;KACrD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,MAAuB;IACnE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;IAElF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,WAAW,GAChB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/F,MAAM,IAAI,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,IACC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,GAAG,CAAC,YAAY,KAAK,EAAE;QACvB,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,GAAG,CAAC,aAAa,KAAK,EAAE;QACxB,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAC/B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACN,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAe,EACf,OAAoE;IAEpE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;KAC3B,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtE,OAAO;QACN,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAC5C,KAAK,EAAE,QAAQ,CAAC,KAAK;KACrB,CAAC;AACH,CAAC"}

package/dist/lib/oauth/token-store.d.ts

@@ -0,0 +1,34 @@
+export type StoredTokenEntry = {
+    access_token: string;
+    refresh_token: string;
+    /** Absolute expiry of the access token, Unix epoch milliseconds. */
+    expires_at: number;
+    /** Space-delimited granted scopes (display + status output). */
+    scope: string;
+};
+export type TokenStore = Record<string, StoredTokenEntry>;
+/** Resolve the credentials file path (honors XDG_CONFIG_HOME at call time). */
+export declare function credentialsFilePath(): string;
+/**
+ * Read the whole token store. Missing, unreadable, or corrupt files -- and
+ * individual malformed entries -- degrade to "absent" rather than throwing:
+ * the caller then falls back to other credential sources or asks the user to
+ * log in again.
+ */
+export declare function readTokenStore(): TokenStore;
+/** Read the stored entry for one base-URL origin, if any. */
+export declare function readStoredEntry(origin: string): StoredTokenEntry | undefined;
+/**
+ * Insert or replace the entry for an origin (atomic write). Async signature
+ * kept for call-site stability even though the body is synchronous.
+ */
+export declare function saveStoredEntry(origin: string, entry: StoredTokenEntry): Promise<void>;
+/** Remove the entry for an origin. Returns true if an entry was removed. */
+export declare function deleteStoredEntry(origin: string): Promise<boolean>;
+/**
+ * Delete the whole credentials file (logout --all), including any orphaned
+ * credentials.json.*.tmp files a crashed write left behind -- those hold the
+ * same token material as the store itself.
+ */
+export declare function clearTokenStore(): Promise<void>;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/lib/oauth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-store.ts"],"names":[],"mappings":"AAmCA,MAAM,MAAM,gBAAgB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE1D,+EAA+E;AAC/E,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAgBD;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAuB3C;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAK5E;AAqED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5F;AAED,4EAA4E;AAC5E,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/lib/oauth/token-store.js

@@ -0,0 +1,164 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/** Resolve the credentials file path (honors XDG_CONFIG_HOME at call time). */
+export function credentialsFilePath() {
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const configHome = xdg && xdg.trim() !== "" ? xdg : join(homedir(), ".config");
+    return join(configHome, "framedash", "credentials.json");
+}
+function isStoredTokenEntry(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const entry = value;
+    return (typeof entry.access_token === "string" &&
+        entry.access_token !== "" &&
+        typeof entry.refresh_token === "string" &&
+        entry.refresh_token !== "" &&
+        typeof entry.expires_at === "number" &&
+        Number.isFinite(entry.expires_at) &&
+        typeof entry.scope === "string");
+}
+/**
+ * Read the whole token store. Missing, unreadable, or corrupt files -- and
+ * individual malformed entries -- degrade to "absent" rather than throwing:
+ * the caller then falls back to other credential sources or asks the user to
+ * log in again.
+ */
+export function readTokenStore() {
+    let raw;
+    try {
+        raw = readFileSync(credentialsFilePath(), "utf8");
+    }
+    catch {
+        return {};
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return {};
+    }
+    const store = {};
+    for (const [origin, entry] of Object.entries(parsed)) {
+        if (isStoredTokenEntry(entry)) {
+            store[origin] = entry;
+        }
+    }
+    return store;
+}
+/** Read the stored entry for one base-URL origin, if any. */
+export function readStoredEntry(origin) {
+    const store = readTokenStore();
+    // Own-property guard: a prototype-chain key (e.g. "toString") must never
+    // masquerade as a stored entry.
+    return Object.hasOwn(store, origin) ? store[origin] : undefined;
+}
+/**
+ * Reap orphaned credentials.json.*.tmp files left by crashed writes -- they
+ * hold the same token material as the store itself. Called from every write
+ * and from clearTokenStore, so any mutation heals a previous crash.
+ */
+function reapOrphanTmps() {
+    const filePath = credentialsFilePath();
+    const base = `${filePath}.`;
+    let names;
+    try {
+        names = readdirSync(dirname(filePath));
+    }
+    catch {
+        return; // Config dir itself is gone: nothing to reap.
+    }
+    for (const name of names) {
+        const full = join(dirname(filePath), name);
+        if (full.startsWith(base) && full.endsWith(".tmp")) {
+            // Best-effort: reaping runs AFTER the atomic rename has already
+            // committed the real write, so a cleanup failure (locked file on
+            // Windows, odd FS state) must never propagate and make a successful
+            // saveStoredEntry look failed. recursive covers a dir-shaped orphan.
+            try {
+                rmSync(full, { force: true, recursive: true });
+            }
+            catch {
+                // Leave the orphan; the next mutation will retry the reap.
+            }
+        }
+    }
+}
+/**
+ * Persist the whole store atomically: write a temp file in the target
+ * directory, then rename over the destination (rename replaces existing
+ * files on both POSIX and Windows), so readers always see a complete JSON
+ * document. Concurrent writers are last-writer-wins by design (see the
+ * concurrency model note above).
+ */
+function writeTokenStore(store) {
+    const filePath = credentialsFilePath();
+    const dir = dirname(filePath);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try {
+        // mkdirSync's mode only applies on creation; tighten a pre-existing
+        // directory too so credentials.json never sits in a world-readable dir.
+        // Best-effort no-op on Windows.
+        chmodSync(dir, 0o700);
+    }
+    catch {
+        // Best effort only.
+    }
+    const tmpPath = `${filePath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        writeFileSync(tmpPath, `${JSON.stringify(store, null, "\t")}\n`, { mode: 0o600 });
+        renameSync(tmpPath, filePath);
+    }
+    catch (err) {
+        rmSync(tmpPath, { force: true });
+        throw err;
+    }
+    try {
+        // Re-assert the mode in case the file pre-existed with wider permissions;
+        // best-effort no-op on Windows.
+        chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Best effort only.
+    }
+    reapOrphanTmps();
+}
+/**
+ * Insert or replace the entry for an origin (atomic write). Async signature
+ * kept for call-site stability even though the body is synchronous.
+ */
+export async function saveStoredEntry(origin, entry) {
+    const store = readTokenStore();
+    store[origin] = entry;
+    writeTokenStore(store);
+}
+/** Remove the entry for an origin. Returns true if an entry was removed. */
+export async function deleteStoredEntry(origin) {
+    const store = readTokenStore();
+    // Object.hasOwn (not `in`): prototype-chain keys are not stored entries
+    // and must not trigger a rewrite.
+    if (!Object.hasOwn(store, origin))
+        return false;
+    delete store[origin];
+    writeTokenStore(store);
+    return true;
+}
+/**
+ * Delete the whole credentials file (logout --all), including any orphaned
+ * credentials.json.*.tmp files a crashed write left behind -- those hold the
+ * same token material as the store itself.
+ */
+export async function clearTokenStore() {
+    // recursive so a credentials path that is unexpectedly a directory
+    // (corruption / manual tampering) is still removed rather than throwing
+    // and blocking logout --all from clearing on-disk token material.
+    rmSync(credentialsFilePath(), { force: true, recursive: true });
+    reapOrphanTmps();
+}
+//# sourceMappingURL=token-store.js.map

package/dist/lib/oauth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../../src/lib/oauth/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACN,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmC1C,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACN,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,KAAK,EAAE;QACzB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,KAAK,CAAC,aAAa,KAAK,EAAE;QAC1B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACjC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC7B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,yEAAyE;IACzE,gCAAgC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc;IACtB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC5B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACJ,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,8CAA8C;IACvD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,gEAAgE;YAChE,iEAAiE;YACjE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC;gBACJ,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAiB;IACzC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACJ,oEAAoE;QACpE,wEAAwE;QACxE,gCAAgC;QAChC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,oBAAoB;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACnF,IAAI,CAAC;QACJ,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACJ,0EAA0E;QAC1E,gCAAgC;QAChC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,oBAAoB;IACrB,CAAC;IACD,cAAc,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,KAAuB;IAC5E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACtB,eAAe,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IACrD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,wEAAwE;IACxE,kCAAkC;IAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACpC,mEAAmE;IACnE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC;AAClB,CAAC"}

package/dist/lib/run-command.js

@@ -20,12 +20,12 @@ export async function runCommand(opts, handler) {
     if (opts.noProject) {
         const baseConfig = resolveConfigWithoutProject(typedValues);
         const config = { ...baseConfig, projectId: "" };
-        const client = createClient(config.baseUrl, config.apiKey, "");
+        const client = createClient(config.baseUrl, config.credential, "");
         await handler({ config, client, values: typedValues, positionals });
     }
     else {
         const config = resolveConfig(typedValues);
-        const client = createClient(config.baseUrl, config.apiKey, config.projectId);
+        const client = createClient(config.baseUrl, config.credential, config.projectId);
         await handler({ config, client, values: typedValues, positionals });
     }
 }

package/dist/lib/run-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/lib/run-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,SAAS,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAEN,cAAc,EACd,aAAa,EACb,2BAA2B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAiBzC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,IAAoB,EACpB,OAA+C;IAE/C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK;KAChD,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACR,CAAC;IAED,MAAM,WAAW,GAAG,MAAsD,CAAC;IAE3E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAc,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,IAAY,EACZ,WAA0B;IAE1B,OAAO,KAAK,EAAE,IAAc,EAAiB,EAAE;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAE3B,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,WAAW,IAAI,gBAAgB,UAAU,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACR,CAAC;QAED,+EAA+E;QAC/E,MAAM,WAAW,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/lib/run-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,SAAS,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAEN,cAAc,EACd,aAAa,EACb,2BAA2B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAiBzC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,IAAoB,EACpB,OAA+C;IAE/C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK;KAChD,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACR,CAAC;IAED,MAAM,WAAW,GAAG,MAAsD,CAAC;IAE3E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAc,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,IAAY,EACZ,WAA0B;IAE1B,OAAO,KAAK,EAAE,IAAc,EAAiB,EAAE;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAE3B,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,WAAW,IAAI,gBAAgB,UAAU,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACR,CAAC;QAED,+EAA+E;QAC/E,MAAM,WAAW,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;AACH,CAAC"}

package/dist/lib/run-profile-test-lib.d.ts

@@ -58,6 +58,45 @@ export declare function resolveProfileIdentity(flags: IdentityInputs, git: GitFa
  * branch/commit/scenario and stamps an empty ci.* tag.
  */
 export declare function buildSessionEnv(identity: ProfileIdentity): Record<string, string>;
+/** Result of validating a "seconds" CLI option value. */
+export type SecondsValidation = {
+    value: number;
+} | {
+    error: string;
+};
+/**
+ * Validate a seconds-valued option. Returns the parsed number, or an error
+ * message describing why it is invalid (the caller adds the --flag prefix and
+ * decides how to surface it). A non-string value (unset, or the boolean parseArgs
+ * yields for a value-less flag) falls back to `fallback`. With `allowZero` the
+ * value may be 0 (used by --command-timeout, where 0 disables the bound);
+ * otherwise it must be strictly positive (as --ingest-timeout / --poll-interval
+ * require).
+ */
+export declare function validateSeconds(value: string | boolean | undefined, fallback: number, opts?: {
+    allowZero?: boolean;
+    max?: number;
+}): SecondsValidation;
+/**
+ * Platform-specific plan for terminating a launched process TREE by pid. A plain
+ * kill of the direct child orphans its grandchildren (a Unity/UE5 player launched
+ * via the shell spawns helper processes that survive), so on win32 we shell out
+ * to `taskkill /T /F` (whole tree, forced) and on POSIX we signal the child's
+ * process GROUP (the negative pid, valid because the child is spawned detached
+ * into its own group). Pure so the argv/decision is unit-testable without
+ * spawning anything.
+ */
+export type TreeKillPlan = {
+    platform: "win32";
+    command: "taskkill";
+    args: string[];
+} | {
+    platform: "posix";
+    groupPid: number;
+} | {
+    platform: "noop";
+};
+export declare function planTreeKill(platform: NodeJS.Platform, pid: number | undefined): TreeKillPlan;
 /** Minimal shape of a builds-list row (mirrors apps/web BuildInfo). */
 export interface BuildListEntry {
     build_id: string;