@framedash/cli 0.1.2 → 0.1.4

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWpC,SAAS,oBAAoB,CAAC,MAA+B;IAI5D,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAwB;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,2BAA2B,CAAC;IAE7B,4EAA4E;IAC5E,mFAAmF;IACnF,IAAI,CAAC;QACJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAI,MAAM,CAAC,MAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClG,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC1E,KAAK,CAAC,mBAAmB,SAAS,4BAA4B,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAuB,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,6EAA6E;QAC7E,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,kFAAkF;YAClF,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CACJ,kCAAkC,KAAK,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,CAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClF,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,MAA+B;IAE/B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,KAAK,QAAQ,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,KAAK,QAAQ,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACtC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,GAAY,EAAE;CACvD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,eAAe,EAAyB,MAAM,wBAAwB,CAAC;AAyBhF,MAAM,qBAAqB,GAC1B,8EAA8E;IAC9E,8FAA8F,CAAC;AAEhG,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAInE,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAwB;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,2BAA2B,CAAC;IAE7B,4EAA4E;IAC5E,mFAAmF;IACnF,IAAI,CAAC;QACJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAI,MAAM,CAAC,MAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClG,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC1E,KAAK,CAAC,mBAAmB,SAAS,4BAA4B,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,OAAO,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACtC,MAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAuB,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,6EAA6E;QAC7E,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,kFAAkF;YAClF,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CACJ,kCAAkC,KAAK,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAA+B,EAC/B,OAAe;IAEf,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEnD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,CAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClF,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,MAA+B;IAE/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,KAAK,QAAQ,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,KAAK,QAAQ,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACtC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,GAAY,EAAE;CACvD,CAAC"}

package/dist/lib/create-client.d.ts

@@ -1,11 +1,29 @@
 import { ApiClient } from "@framedash/api-client";
+import type { CliCredential } from "./config.js";
+import { OAuthTokenManager } from "./oauth/manager.js";
+export type CreateClientOptions = {
+    throwOnError?: boolean;
+};
+/** Test-only: drop cached managers so each test starts from its own entry. */
+export declare function resetOAuthManagerCacheForTests(): void;
 /**
- * Create the CLI's API client. By default a request error prints a message and
- * exits the process (the right behavior for one-shot commands). Pass
- * `throwOnError` for a client used inside a retry loop (e.g. the run-profile-test
- * ingest poll), where a transient 429/5xx must be thrown and retried, not exit.
+ * Process-shared token manager for an origin. Also used by non-ApiClient
+ * consumers (the map-capture uploader) so EVERY Bearer credential in the
+ * process rides on the same rotation state.
  */
-export declare function createClient(baseUrl: string, apiKey: string, projectId: string, options?: {
-    throwOnError?: boolean;
-}): ApiClient;
+export declare function getSharedOAuthManager(baseUrl: string, credential: Extract<CliCredential, {
+    kind: "oauth";
+}>): OAuthTokenManager;
+/**
+ * Create the CLI's API client from the resolved credential. By default a
+ * request error prints a message and exits the process (the right behavior
+ * for one-shot commands). Pass `throwOnError` for a client used inside a
+ * retry loop (e.g. the run-profile-test ingest poll), where a transient
+ * 429/5xx must be thrown and retried, not exit.
+ *
+ * API keys go on X-API-Key as before. A stored OAuth login gets a wrapper
+ * that refreshes near expiry, retries exactly once after a 401, and persists
+ * rotated refresh tokens.
+ */
+export declare function createClient(baseUrl: string, credential: CliCredential, projectId: string, options?: CreateClientOptions): ApiClient;
 //# sourceMappingURL=create-client.d.ts.map

package/dist/lib/create-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAiB,MAAM,uBAAuB,CAAC;AAGjE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,SAAS,CAmCX"}
+{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAA2B,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAY7D,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACnD,iBAAiB,CAOnB;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,aAAa,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,SAAS,CAiBX"}

package/dist/lib/create-client.js

@@ -1,46 +1,173 @@
-import { ApiClient } from "@framedash/api-client";
+import { ApiClient, ApiError } from "@framedash/api-client";
 import { error } from "./logger.js";
+import { OAuthLoginRequiredError, OAuthTokenManager } from "./oauth/manager.js";
 /**
- * Create the CLI's API client. By default a request error prints a message and
- * exits the process (the right behavior for one-shot commands). Pass
- * `throwOnError` for a client used inside a retry loop (e.g. the run-profile-test
- * ingest poll), where a transient 429/5xx must be thrown and retried, not exit.
+ * ONE token manager per origin per process. Refresh tokens are single-use
+ * (rotation), so two independent managers over the same stored login would
+ * race: the second to refresh presents an already-consumed token, which the
+ * server treats as theft and answers by revoking the whole grant. Commands
+ * that build several clients (e.g. run-profile-test's exit-on-error client
+ * plus its throwing poll client) must therefore share rotation state.
  */
-export function createClient(baseUrl, apiKey, projectId, options) {
-    if (options?.throwOnError) {
+const managerCache = new Map();
+/** Test-only: drop cached managers so each test starts from its own entry. */
+export function resetOAuthManagerCacheForTests() {
+    managerCache.clear();
+}
+/**
+ * Process-shared token manager for an origin. Also used by non-ApiClient
+ * consumers (the map-capture uploader) so EVERY Bearer credential in the
+ * process rides on the same rotation state.
+ */
+export function getSharedOAuthManager(baseUrl, credential) {
+    let manager = managerCache.get(credential.origin);
+    if (!manager) {
+        manager = new OAuthTokenManager(baseUrl, credential.origin, credential.entry);
+        managerCache.set(credential.origin, manager);
+    }
+    return manager;
+}
+/** Print an ApiError (with 429 rate-limit detail) and exit -- the default for one-shot commands. */
+function printAndExit(err) {
+    if (err.status === 429) {
+        const retryAfter = err.retryAfter;
+        if (retryAfter !== undefined) {
+            error(`Rate limit exceeded (429). Retry after ${retryAfter}s.`);
+        }
+        else {
+            const reset = err.headers.get("X-RateLimit-Reset");
+            const resetNum = reset ? Number(reset) : Number.NaN;
+            const resetStr = !Number.isNaN(resetNum) && resetNum > 0
+                ? new Date(resetNum * 1000).toLocaleTimeString()
+                : "unknown";
+            error(`Rate limit exceeded (429). Resets at ${resetStr}.`);
+        }
+    }
+    else {
+        error(err.message);
+    }
+    process.exit(1);
+}
+/**
+ * Create the CLI's API client from the resolved credential. By default a
+ * request error prints a message and exits the process (the right behavior
+ * for one-shot commands). Pass `throwOnError` for a client used inside a
+ * retry loop (e.g. the run-profile-test ingest poll), where a transient
+ * 429/5xx must be thrown and retried, not exit.
+ *
+ * API keys go on X-API-Key as before. A stored OAuth login gets a wrapper
+ * that refreshes near expiry, retries exactly once after a 401, and persists
+ * rotated refresh tokens.
+ */
+export function createClient(baseUrl, credential, projectId, options) {
+    const onError = options?.throwOnError
+        ? (err) => {
+            throw err;
+        }
+        : printAndExit;
+    if (credential.kind === "api-key") {
+        return new ApiClient({ baseUrl, apiKey: credential.apiKey, projectId, onError });
+    }
+    return new OAuthApiClient(baseUrl, projectId, getSharedOAuthManager(baseUrl, credential), options);
+}
+/**
+ * ApiClient facade for the OAuth path. Extends ApiClient so the rest of the
+ * CLI (typed against ApiClient) needs no changes, but every verb delegates
+ * to a short-lived inner client carrying the CURRENT access token from the
+ * token manager; the superclass instance itself never sends a request.
+ *
+ * 401 handling: refresh once, retry once. A second failure surfaces like any
+ * other API error. A dead grant (refresh -> invalid_grant) always prints the
+ * re-login instruction and exits, even in throwOnError mode -- retry loops
+ * (which swallow thrown errors) must not spin on an unrecoverable credential.
+ */
+class OAuthApiClient extends ApiClient {
+    oauthBaseUrl;
+    oauthProjectId;
+    manager;
+    options;
+    constructor(oauthBaseUrl, oauthProjectId, manager, options) {
+        super({
+            baseUrl: oauthBaseUrl,
+            projectId: oauthProjectId,
+            // Never sent: all verbs are overridden to use the inner client.
+            accessToken: "oauth-managed-placeholder",
+            onError: (err) => {
+                throw err;
+            },
+        });
+        this.oauthBaseUrl = oauthBaseUrl;
+        this.oauthProjectId = oauthProjectId;
+        this.manager = manager;
+        this.options = options;
+    }
+    async get(path) {
+        return this.execute((client) => client.get(path));
+    }
+    async post(path, body) {
+        return this.execute((client) => client.post(path, body));
+    }
+    async patch(path, body) {
+        return this.execute((client) => client.patch(path, body));
+    }
+    async delete(path) {
+        return this.execute((client) => client.delete(path));
+    }
+    withProject(projectId) {
+        return new OAuthApiClient(this.oauthBaseUrl, projectId, this.manager, this.options);
+    }
+    buildInner(accessToken) {
         return new ApiClient({
-            baseUrl,
-            apiKey,
-            projectId,
-            onError(err) {
+            baseUrl: this.oauthBaseUrl,
+            projectId: this.oauthProjectId,
+            accessToken,
+            onError: (err) => {
                 throw err;
             },
         });
     }
-    return new ApiClient({
-        baseUrl,
-        apiKey,
-        projectId,
-        onError(err) {
-            if (err.status === 429) {
-                const retryAfter = err.retryAfter;
-                if (retryAfter !== undefined) {
-                    error(`Rate limit exceeded (429). Retry after ${retryAfter}s.`);
+    async token(forceRefresh) {
+        try {
+            return forceRefresh ? await this.manager.forceRefresh() : await this.manager.getAccessToken();
+        }
+        catch (err) {
+            if (err instanceof OAuthLoginRequiredError) {
+                error(err.message);
+                process.exit(1);
+            }
+            throw err;
+        }
+    }
+    async execute(fn) {
+        const accessToken = await this.token(false);
+        try {
+            return await fn(this.buildInner(accessToken));
+        }
+        catch (err) {
+            if (isApiError(err) && err.status === 401) {
+                // The server rejected a token we believed valid (revoked access
+                // token, clock skew): refresh and retry exactly once.
+                const freshToken = await this.token(true);
+                try {
+                    return await fn(this.buildInner(freshToken));
                 }
-                else {
-                    const reset = err.headers.get("X-RateLimit-Reset");
-                    const resetNum = reset ? Number(reset) : Number.NaN;
-                    const resetStr = !Number.isNaN(resetNum) && resetNum > 0
-                        ? new Date(resetNum * 1000).toLocaleTimeString()
-                        : "unknown";
-                    error(`Rate limit exceeded (429). Resets at ${resetStr}.`);
+                catch (retryErr) {
+                    return this.reportError(retryErr);
                 }
             }
-            else {
-                error(err.message);
-            }
-            process.exit(1);
-        },
-    });
+            return this.reportError(err);
+        }
+    }
+    reportError(err) {
+        if (isApiError(err) && !this.options?.throwOnError) {
+            printAndExit(err);
+        }
+        // throwOnError mode, or a non-API failure (network error): propagate,
+        // matching the api-key client (index.ts prints and exits).
+        throw err;
+    }
+}
+function isApiError(err) {
+    return err instanceof ApiError;
 }
 //# sourceMappingURL=create-client.js.map

package/dist/lib/create-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-client.js","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAiB,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,OAAoC;IAEpC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC3B,OAAO,IAAI,SAAS,CAAC;YACpB,OAAO;YACP,MAAM;YACN,SAAS;YACT,OAAO,CAAC,GAAa;gBACpB,MAAM,GAAG,CAAC;YACX,CAAC;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,SAAS,CAAC;QACpB,OAAO;QACP,MAAM;QACN,SAAS;QACT,OAAO,CAAC,GAAa;YACpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;gBAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,0CAA0C,UAAU,IAAI,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACP,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpD,MAAM,QAAQ,GACb,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;wBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE;wBAChD,CAAC,CAAC,SAAS,CAAC;oBACd,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;gBAC5D,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;KACD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-client.js","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAIhF;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B;IAC7C,YAAY,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACpC,OAAe,EACf,UAAqD;IAErD,IAAI,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9E,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,YAAY,CAAC,GAAa;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,0CAA0C,UAAU,IAAI,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACP,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACpD,MAAM,QAAQ,GACb,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE;gBAChD,CAAC,CAAC,SAAS,CAAC;YACd,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,UAAyB,EACzB,SAAiB,EACjB,OAA6B;IAE7B,MAAM,OAAO,GAA6B,OAAO,EAAE,YAAY;QAC9D,CAAC,CAAC,CAAC,GAAG,EAAS,EAAE;YACf,MAAM,GAAG,CAAC;QACX,CAAC;QACF,CAAC,CAAC,YAAY,CAAC;IAEhB,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,cAAc,CACxB,OAAO,EACP,SAAS,EACT,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,EAC1C,OAAO,CACP,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,cAAe,SAAQ,SAAS;IAEnB;IACA;IACA;IACA;IAJlB,YACkB,YAAoB,EACpB,cAAsB,EACtB,OAA0B,EAC1B,OAA6B;QAE9C,KAAK,CAAC;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,cAAc;YACzB,gEAAgE;YAChE,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,CAAC,GAAG,EAAS,EAAE;gBACvB,MAAM,GAAG,CAAC;YACX,CAAC;SACD,CAAC,CAAC;QAbc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QACtB,YAAO,GAAP,OAAO,CAAmB;QAC1B,YAAO,GAAP,OAAO,CAAsB;IAW/C,CAAC;IAEQ,KAAK,CAAC,GAAG,CAAc,IAAY;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAa;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAc,IAAY;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAI,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAEQ,WAAW,CAAC,SAAiB;QACrC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrF,CAAC;IAEO,UAAU,CAAC,WAAmB;QACrC,OAAO,IAAI,SAAS,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,WAAW;YACX,OAAO,EAAE,CAAC,GAAG,EAAS,EAAE;gBACvB,MAAM,GAAG,CAAC;YACX,CAAC;SACD,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,YAAqB;QACxC,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,EAAqC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3C,gEAAgE;gBAChE,sDAAsD;gBACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC;oBACJ,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAEO,WAAW,CAAC,GAAY;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,YAAY,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,CAAC;IACX,CAAC;CACD;AAED,SAAS,UAAU,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC"}

package/dist/lib/formatters.js

@@ -10,13 +10,121 @@ export function formatOutput(data, format) {
     }
 }
 function formatTable(data) {
+    // The /api/v1/query endpoint returns { rows: [...], rowCount: N }. Tabulate
+    // the rows themselves rather than dumping the whole array into one JSON cell.
+    if (isQueryResult(data)) {
+        return formatTable(data.rows);
+    }
+    // A single object whose values contain nested arrays/objects (e.g. the
+    // dashboard's { kpis, dailyActiveUsers, topEvents }) renders one titled
+    // section per key rather than a single blob-cell row. Flat arrays-of-objects
+    // (maps list, alerts list, builds) fall through to the plain table renderer
+    // unchanged.
+    if (isSectionedPayload(data)) {
+        return formatSections(data);
+    }
     const rows = toRows(data);
     if (rows.length === 0)
         return "(no data)";
     const firstRow = rows[0];
     if (!firstRow)
         return "(no data)";
-    const keys = Object.keys(firstRow);
+    return renderRows(rows, Object.keys(firstRow));
+}
+/**
+ * True for the /api/v1/query result envelope { rows: [...], rowCount: number }.
+ * Only that endpoint returns this shape, so table format can safely unwrap it to
+ * tabulate the individual records instead of rendering one giant JSON cell.
+ */
+function isQueryResult(data) {
+    if (typeof data !== "object" || data === null || Array.isArray(data))
+        return false;
+    const obj = data;
+    return Array.isArray(obj.rows) && typeof obj.rowCount === "number";
+}
+/**
+ * True for an envelope-style object whose every field is a nested array/object
+ * (e.g. the dashboard's { kpis, dailyActiveUsers, topEvents } or status's
+ * { project, kpis }). Records that mix scalar fields with a nested one -- such as
+ * an alert row's scalars plus channelIds: [] -- stay on the plain one-row table
+ * path, so `alerts create/update --format table` output does not regress.
+ */
+function isSectionedPayload(data) {
+    if (Array.isArray(data))
+        return false;
+    if (typeof data !== "object" || data === null)
+        return false;
+    const values = Object.values(data);
+    if (values.length === 0)
+        return false;
+    return values.every((v) => v !== null && typeof v === "object");
+}
+/** Render each top-level key of a sectioned payload as a titled sub-table. */
+function formatSections(obj) {
+    const sections = Object.entries(obj).map(([key, value]) => {
+        let table;
+        if (Array.isArray(value)) {
+            table = formatArraySection(value);
+        }
+        else if (value !== null && typeof value === "object") {
+            table = formatObjectSection(value);
+        }
+        else {
+            table = cellString(value);
+        }
+        return `## ${key}\n${table}`;
+    });
+    return sections.join("\n\n");
+}
+/** An array-of-objects section: normal table, nested objects flattened to dot-paths. */
+function formatArraySection(arr) {
+    if (arr.length === 0)
+        return "(no data)";
+    const rows = arr.map((item) => typeof item === "object" && item !== null && !Array.isArray(item)
+        ? flattenOneLevel(item)
+        : { value: item });
+    return renderRows(rows, unionKeys(rows));
+}
+/** An object section: two-column key/value rows. */
+function formatObjectSection(obj) {
+    const rows = Object.entries(obj).map(([key, value]) => ({ key, value }));
+    if (rows.length === 0)
+        return "(no data)";
+    return renderRows(rows, ["key", "value"]);
+}
+/** Flatten one level of nested objects into dot-path keys; deeper nesting stays JSON. */
+function flattenOneLevel(row) {
+    const out = {};
+    for (const [key, value] of Object.entries(row)) {
+        if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+            for (const [subKey, subValue] of Object.entries(value)) {
+                out[`${key}.${subKey}`] = subValue;
+            }
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/** Union of row keys in first-seen order. */
+function unionKeys(rows) {
+    const seen = new Set();
+    const keys = [];
+    for (const row of rows) {
+        for (const key of Object.keys(row)) {
+            if (!seen.has(key)) {
+                seen.add(key);
+                keys.push(key);
+            }
+        }
+    }
+    return keys;
+}
+/** Render aligned columns for the given rows/keys using cellString for each cell. */
+function renderRows(rows, keys) {
+    if (rows.length === 0 || keys.length === 0)
+        return "(no data)";
     const widths = keys.map((k) => Math.max(k.length, ...rows.map((r) => cellString(r[k]).length)));
     const header = keys.map((k, i) => k.padEnd(widths[i] ?? k.length)).join("  ");
     const separator = widths.map((w) => "-".repeat(w)).join("  ");

package/dist/lib/formatters.js.map

@@ -1 +1 @@
-{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,MAAoB;IAC/D,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,OAAO;YACX,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,KAAK;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IAElC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,kFAAkF;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACxC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,MAAoB;IAC/D,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,OAAO;YACX,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,KAAK;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IACjC,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,aAAa;IACb,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,IAA+B,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IAElC,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,GAA4B;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACzD,IAAI,KAAa,CAAC;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxD,KAAK,GAAG,mBAAmB,CAAC,KAAgC,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,GAAc;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC,eAAe,CAAC,IAA+B,CAAC;QAClD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,oDAAoD;AACpD,SAAS,mBAAmB,CAAC,GAA4B;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,GAA4B;IACpD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC;YACpC,CAAC;QACF,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6CAA6C;AAC7C,SAAS,SAAS,CAAC,IAA+B;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAA+B,EAAE,IAAc;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,kFAAkF;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACxC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/oauth/loopback-server.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The authorization server bounced back an OAuth error (e.g. the user hit
+ * Deny -> access_denied). Distinguished from local failures so the CLI can
+ * present it as a normal outcome rather than a bug.
+ */
+export declare class OAuthCallbackError extends Error {
+    readonly code: string;
+    constructor(code: string, description: string | null);
+}
+export type LoopbackServer = {
+    /** The ephemeral port actually bound on 127.0.0.1. */
+    port: number;
+    /** The exact redirect URI to register in the authorize request. */
+    redirectUri: string;
+    /** Resolve with the authorization code, or reject on error/timeout. */
+    waitForCallback: (timeoutMs: number) => Promise<{
+        code: string;
+    }>;
+    close: () => Promise<void>;
+};
+/**
+ * Start the loopback callback receiver. `expectedState` is the CSRF state
+ * minted for this login attempt; only a /callback request carrying exactly
+ * that state can complete the flow.
+ */
+export declare function startLoopbackServer(expectedState: string): Promise<LoopbackServer>;
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/lib/oauth/loopback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/loopback-server.ts"],"names":[],"mappings":"AAiCA;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAE3B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,GAAG,IAAI;CAK3B;AAWD,MAAM,MAAM,cAAc,GAAG;IAC5B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA+HlF"}

package/dist/lib/oauth/loopback-server.js

@@ -0,0 +1,164 @@
+import { createServer } from "node:http";
+// RFC 8252 section 7.3 loopback redirect receiver for `framedash login`.
+//
+// SECURITY invariants:
+//  - Binds STRICTLY to 127.0.0.1 (never 0.0.0.0 / ::) on an ephemeral port,
+//    so nothing off-host can reach the callback.
+//  - The `state` parameter is validated FIRST, for success AND error
+//    callbacks alike, BEFORE the caller ever sees a code. A mismatched or
+//    missing state does NOT settle the login: the request gets a generic
+//    400 and the flow keeps waiting for the legitimate callback -- a forged
+//    local request can neither abort nor complete a pending sign-in, and
+//    any accompanying code is discarded (no token exchange happens).
+//  - Responses to the browser are static HTML with no token/code material,
+//    and nothing from the callback URL is reflected into the page.
+const HTML_HEADERS = {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+};
+function page(title, body) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family: system-ui, sans-serif; margin: 4rem auto; max-width: 32rem;"><h1 style="font-size: 1.2rem;">${title}</h1><p>${body}</p></body></html>`;
+}
+const SUCCESS_PAGE = page("Login complete", "You can close this tab and return to the terminal.");
+const FAILURE_PAGE = page("Login failed", "The sign-in did not complete. Close this tab and check the terminal for details.");
+const DONE_PAGE = page("Login already completed", "You can close this tab.");
+/**
+ * The authorization server bounced back an OAuth error (e.g. the user hit
+ * Deny -> access_denied). Distinguished from local failures so the CLI can
+ * present it as a normal outcome rather than a bug.
+ */
+export class OAuthCallbackError extends Error {
+    code;
+    constructor(code, description) {
+        super(`Authorization was not granted (${code})${description ? `: ${description}` : ""}`);
+        this.code = code;
+        this.name = "OAuthCallbackError";
+    }
+}
+/**
+ * Keep attacker-influenced callback values printable before they reach the
+ * terminal: strip everything outside a conservative ASCII subset (kills
+ * control characters / ANSI escapes) and cap the length.
+ */
+function sanitizeForTerminal(value) {
+    return value.replace(/[^a-zA-Z0-9 _.,:;/'()-]/g, "").slice(0, 200);
+}
+/**
+ * Start the loopback callback receiver. `expectedState` is the CSRF state
+ * minted for this login attempt; only a /callback request carrying exactly
+ * that state can complete the flow.
+ */
+export function startLoopbackServer(expectedState) {
+    let settled = false;
+    let resolveCallback = () => { };
+    let rejectCallback = () => { };
+    const callbackPromise = new Promise((resolve, reject) => {
+        resolveCallback = resolve;
+        rejectCallback = reject;
+    });
+    // A rejection that nobody has awaited yet (e.g. state mismatch arriving
+    // before waitForCallback is called) must not crash the process.
+    callbackPromise.catch(() => { });
+    const settle = (outcome) => {
+        if (settled)
+            return;
+        settled = true;
+        if (outcome instanceof Error) {
+            rejectCallback(outcome);
+        }
+        else {
+            resolveCallback(outcome);
+        }
+    };
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (req.method !== "GET" || url.pathname !== "/callback") {
+            res.writeHead(404, HTML_HEADERS);
+            res.end(page("Not found", "Nothing to see here."));
+            return;
+        }
+        if (settled) {
+            res.writeHead(200, HTML_HEADERS);
+            res.end(DONE_PAGE);
+            return;
+        }
+        // STRICT state validation FIRST, for success AND error callbacks alike
+        // (RFC 6749 section 4.1.2.1 requires `state` in error redirects too).
+        // A mismatched/missing state is treated as an unexpected request and
+        // deliberately does NOT settle: neither a forged error= callback nor a
+        // forged code may abort or complete someone's pending login, and the
+        // accompanying code (if any) is never handed to the caller, so no
+        // token exchange can happen for a forged/replayed callback.
+        const state = url.searchParams.get("state");
+        if (state !== expectedState) {
+            res.writeHead(400, HTML_HEADERS);
+            res.end(page("Unexpected request", "This request did not match a pending sign-in."));
+            return;
+        }
+        const errorParam = url.searchParams.get("error");
+        if (errorParam !== null) {
+            res.writeHead(200, HTML_HEADERS);
+            res.end(FAILURE_PAGE);
+            const description = url.searchParams.get("error_description");
+            settle(new OAuthCallbackError(sanitizeForTerminal(errorParam) || "unknown_error", description ? sanitizeForTerminal(description) : null));
+            return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+            res.writeHead(400, HTML_HEADERS);
+            res.end(FAILURE_PAGE);
+            settle(new Error("Login callback carried no authorization code."));
+            return;
+        }
+        res.writeHead(200, HTML_HEADERS);
+        res.end(SUCCESS_PAGE);
+        settle({ code });
+    });
+    // Refuse to linger: once the single callback settles the login, keep-alive
+    // sockets must not hold the process open.
+    server.keepAliveTimeout = 1000;
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        // STRICT loopback bind: 127.0.0.1 only (never 0.0.0.0/::), ephemeral port.
+        server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                reject(new Error("Loopback server failed to report a bound port"));
+                server.close();
+                return;
+            }
+            const port = address.port;
+            resolve({
+                port,
+                redirectUri: `http://127.0.0.1:${port}/callback`,
+                waitForCallback: (timeoutMs) => {
+                    return new Promise((resolveWait, rejectWait) => {
+                        const timer = setTimeout(() => {
+                            settle(new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s waiting for the browser login callback.`));
+                        }, timeoutMs);
+                        timer.unref();
+                        callbackPromise
+                            .then((value) => {
+                            clearTimeout(timer);
+                            resolveWait(value);
+                        })
+                            .catch((err) => {
+                            clearTimeout(timer);
+                            rejectWait(err);
+                        });
+                    });
+                },
+                close: () => new Promise((resolveClose) => {
+                    server.close(() => resolveClose());
+                    // Node >= 18.2 only; on older 18.x the short keepAliveTimeout
+                    // set above still lets close() finish promptly.
+                    if (typeof server.closeAllConnections === "function") {
+                        server.closeAllConnections();
+                    }
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=loopback-server.js.map