@genesiscomputing/genesis-connect 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,62 @@
-# Temporary Holding Version
+# genesis-connect
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign an MCP client in to Genesis with a code, on a machine with no browser — one you
+reach over SSH, a dev box, a container. Like `gh auth login`: the command shows a code,
+you approve it in any browser, and the sign-in finishes on this machine. No SSH tunnel
+and no copy-pasting a redirect address.
+
+```bash
+npx -y @genesiscomputing/genesis-connect https://<your-genesis-host>
+```
+
+1. It starts the client's own sign-in in the background and shows a code and a link,
+   `https://<your-genesis-host>/device`.
+2. Open the link in any browser (your laptop is fine), enter the code, and check what is
+   asking: the client, its server name, and the address it asked from. Choose
+   **Approve**, then sign in to Genesis as usual.
+3. The command hands the sign-in to the client on this machine and prints
+   `Signed in to Genesis`.
+
+The code works once and expires after 10 minutes. Only approve a code you started
+yourself: if someone sends you a link or a code to enter, choose **Deny**.
+
+Works on macOS, Linux and Windows with Node 20 or later. On macOS and Linux,
+`curl -fsSL https://<your-genesis-host>/mcp/connect | sh` does the same without Node.
+
+## Clients
+
+| `--client` | What it runs |
+|---|---|
+| `genie` (Genie Code) | `genie mcp add <name> --url <host>/mcp`, or `genie mcp login <name>` if it is already set up for this Genesis |
+| `codex` | the same with `codex` |
+| `genesis-room` | `genesis-room login -genesis-url <host>` (needs a genesis-room newer than v0.1) |
+
+With no `--client`, the first of those installed is used. `--name` sets the MCP server
+name for genie and codex (default `genesis`).
+
+Any other tool that signs in the same way — it prints a sign-in link for this Genesis's
+`/authorize` and then waits for the browser on `127.0.0.1` — can be signed in by giving
+its command after `--`:
+
+```bash
+npx -y @genesiscomputing/genesis-connect https://<your-genesis-host> -- mytool login
+```
+
+Claude Code, Claude Desktop and Cursor sign in from inside the app (`/mcp`), not with a
+command, so they are not driven by this. Where they run without a browser, connect them
+with a Genesis API key instead.
+
+## Development
+
+```bash
+npm install
+npm test
+npm run build
+node dist/cli.js --help
+```
+
+Publishing (from an npm account with access to the `@genesiscomputing` scope):
+
+```bash
+npm ci && npm test && npm publish
+```

package/dist/cli.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+export declare const CLI_VERSION = "0.1.0";
+export interface CliArguments {
+    genesisUrl: string;
+    client?: string;
+    name?: string;
+    command?: string[];
+}
+/** The parsed command line, or the text to print for --help / --version. */
+export declare function parseCommandLine(argv: string[], env?: NodeJS.ProcessEnv): CliArguments | {
+    print: string;
+};
+export declare function main(argv: string[], signal?: AbortSignal): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// genesis-connect <genesis-url> [--client genie|codex|genesis-room] [--name NAME] [-- command ...]
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { NAMED_CLIENTS, planLaunch } from "./clients.js";
+import { connect, InterruptedError } from "./connect.js";
+import { normalizeGenesisUrl, SignInError } from "./genesis.js";
+export const CLI_VERSION = "0.1.0";
+const USAGE = `Usage: genesis-connect <genesis-url> [--client ${NAMED_CLIENTS.join("|")}] [--name NAME]
+       genesis-connect <genesis-url> [--name NAME] -- <command> [args...]
+
+Signs an MCP client on this machine in to Genesis with a code you approve in any
+browser, so no browser or tunnel is needed here.
+
+  <genesis-url>   Your Genesis, e.g. https://genesis.example.com (or set GENESIS_URL)
+  --client        The client to sign in; default: the first of ${NAMED_CLIENTS.join(", ")} installed
+  --name          Its MCP server name for this Genesis (genie, codex; default: genesis)
+  -- <command>    Any other command that prints a Genesis sign-in link and waits on localhost
+  --version, --help`;
+/** The parsed command line, or the text to print for --help / --version. */
+export function parseCommandLine(argv, env = process.env) {
+    const separator = argv.indexOf("--");
+    const own = separator === -1 ? argv : argv.slice(0, separator);
+    const command = separator === -1 ? undefined : argv.slice(separator + 1);
+    let parsed;
+    try {
+        parsed = parseArgs({
+            args: own,
+            allowPositionals: true,
+            options: {
+                client: { type: "string" },
+                name: { type: "string" },
+                help: { type: "boolean", short: "h" },
+                version: { type: "boolean" },
+            },
+        });
+    }
+    catch (error) {
+        throw new SignInError(`${error.message}\n${USAGE}`);
+    }
+    if (parsed.values.help) {
+        return { print: USAGE };
+    }
+    if (parsed.values.version) {
+        return { print: CLI_VERSION };
+    }
+    if (parsed.positionals.length > 1) {
+        throw new SignInError(`unexpected argument: ${parsed.positionals[1]}\n${USAGE}`);
+    }
+    const rawUrl = parsed.positionals[0] ?? env.GENESIS_URL;
+    if (!rawUrl) {
+        throw new SignInError(`give your Genesis address.\n${USAGE}`);
+    }
+    if (command !== undefined && command.length === 0) {
+        throw new SignInError(`give a command after --.\n${USAGE}`);
+    }
+    return {
+        genesisUrl: normalizeGenesisUrl(rawUrl),
+        client: parsed.values.client,
+        name: parsed.values.name,
+        command,
+    };
+}
+/** Exit status for an interrupted sign-in, as for any command stopped by Ctrl-C. */
+const INTERRUPTED_EXIT_STATUS = 130;
+export async function main(argv, signal) {
+    try {
+        const parsed = parseCommandLine(argv);
+        if ("print" in parsed) {
+            console.log(parsed.print);
+            return 0;
+        }
+        const launch = await planLaunch(parsed, undefined, signal);
+        await connect({ genesisUrl: parsed.genesisUrl, launch, signal });
+        console.log("");
+        console.log(`  Signed in to Genesis. ${launch.next}`);
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof InterruptedError || signal?.aborted) {
+            console.error("genesis-connect: interrupted.");
+            return INTERRUPTED_EXIT_STATUS;
+        }
+        const message = error instanceof SignInError ? error.message : `unexpected error: ${error.message}`;
+        console.error(`genesis-connect: ${message}`);
+        return 1;
+    }
+}
+function invokedDirectly() {
+    try {
+        return realpathSync(process.argv[1] ?? "") === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (invokedDirectly()) {
+    // Ctrl-C cancels the sign-in, which stops the client it started, rather than exiting
+    // with that client still waiting on loopback.
+    const interrupt = new AbortController();
+    const onSignal = () => interrupt.abort();
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    main(process.argv.slice(2), interrupt.signal).then((code) => {
+        process.off("SIGINT", onSignal);
+        process.off("SIGTERM", onSignal);
+        process.exitCode = code;
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,mGAAmG;AAEnG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,MAAM,KAAK,GAAG,kDAAkD,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;iEAOtB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;;;oBAGrE,CAAC;AASrB,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC;YACjB,IAAI,EAAE,GAAG;YACT,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;gBACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,GAAI,KAAe,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,WAAW,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,MAAoB;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/C,OAAO,uBAAuB,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC;QAC/G,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,eAAe,EAAE,EAAE,CAAC;IACtB,qFAAqF;IACrF,8CAA8C;IAC9C,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1D,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/clients.d.ts

@@ -0,0 +1,58 @@
+import { type ChildProcess } from "node:child_process";
+/** The `client` value Genesis knows; it shows a fixed name for each on its approval page. */
+export type ClientId = "genie" | "codex" | "genesis-room" | "other";
+export declare const NAMED_CLIENTS: readonly ["genie", "codex", "genesis-room"];
+export declare const DEFAULT_SERVER_NAME = "genesis";
+/** How to start one client's sign-in. */
+export interface ClientLaunch {
+    client: ClientId;
+    /** What to call it in messages. */
+    label: string;
+    /** The executable, resolved on PATH. */
+    executable: string;
+    args: string[];
+    /** The name Genesis shows on its approval page. */
+    serverName: string;
+    /** What to do once signed in. */
+    next: string;
+}
+export interface LaunchRequest {
+    genesisUrl: string;
+    /** genie, codex or genesis-room; unset to pick the one installed. */
+    client?: string;
+    /** Any other command that prints a Genesis sign-in URL and waits on loopback. */
+    command?: string[];
+    name?: string;
+}
+/** Runs a short command to completion; swapped out in tests. */
+export interface CommandRunner {
+    which(command: string): string | null;
+    run(executable: string, args: string[], signal?: AbortSignal): Promise<{
+        code: number | null;
+        output: string;
+    }>;
+}
+/**
+ * The launch for the requested client, after checking it is installed and, for genie
+ * and codex, that an MCP server of this name is not already set up for another Genesis.
+ * Runs at most one short command of the client's (`mcp get` or `-version`).
+ */
+export declare function planLaunch(request: LaunchRequest, runner?: CommandRunner, signal?: AbortSignal): Promise<ClientLaunch>;
+/** The real PATH lookup and process runner. */
+export declare const systemRunner: CommandRunner;
+/**
+ * Start a client process that this package owns: aborting `signal` stops it and every
+ * process under it (stopProcessTree). Windows cannot start a .cmd or .bat shim without a
+ * shell; every argument this package builds is a checked name or URL, so none carries a
+ * shell metacharacter.
+ */
+export declare function startOwnedProcess(executable: string, args: string[], env: NodeJS.ProcessEnv, signal?: AbortSignal): ChildProcess;
+/**
+ * Stop a started client and everything it started. On Windows a .cmd shim runs the
+ * client under cmd.exe, so killing the tracked process would stop only the shell and
+ * leave the client waiting on loopback: taskkill /T takes the whole tree. Runs taskkill
+ * to completion there (a short local command).
+ */
+export declare function stopProcessTree(child: ChildProcess, platform?: NodeJS.Platform): void;
+/** The executable PATH resolves `command` to, or null. Honours PATHEXT on Windows. */
+export declare function findExecutable(command: string, pathVariable?: string, platform?: NodeJS.Platform, isExecutable?: (path: string) => boolean): string | null;

package/dist/clients.js

@@ -0,0 +1,197 @@
+// Which MCP client to sign in, and the command that starts its own browser sign-in.
+//
+// Every client here signs in the same way: it prints a sign-in URL for Genesis's
+// /authorize, then waits for the browser to come back to a 127.0.0.1 address on this
+// machine. That wait is what a code sign-in finishes for it.
+import { spawn, spawnSync } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { SignInError } from "./genesis.js";
+export const NAMED_CLIENTS = ["genie", "codex", "genesis-room"];
+export const DEFAULT_SERVER_NAME = "genesis";
+const SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+const PROBE_TIMEOUT_MS = 30_000;
+/**
+ * The launch for the requested client, after checking it is installed and, for genie
+ * and codex, that an MCP server of this name is not already set up for another Genesis.
+ * Runs at most one short command of the client's (`mcp get` or `-version`).
+ */
+export async function planLaunch(request, runner = systemRunner, signal) {
+    const name = request.name ?? DEFAULT_SERVER_NAME;
+    if (!SERVER_NAME_PATTERN.test(name)) {
+        throw new SignInError("--name may use only letters, digits, - and _ (at most 64).");
+    }
+    if (request.command && request.command.length > 0) {
+        if (request.client) {
+            throw new SignInError("give either --client or a command after --, not both.");
+        }
+        return planOther(request.command, name, runner);
+    }
+    const client = request.client ?? detectClient(runner);
+    switch (client) {
+        case "genie":
+            return planCodexFamily("genie", "Genie Code", name, request.genesisUrl, runner, signal);
+        case "codex":
+            return planCodexFamily("codex", "Codex", name, request.genesisUrl, runner, signal);
+        case "genesis-room":
+            return planGenesisRoom(request.genesisUrl, runner, signal);
+        default:
+            throw new SignInError(`unsupported client: ${client} (supported: ${NAMED_CLIENTS.join(", ")}, or a command after --)`);
+    }
+}
+function detectClient(runner) {
+    const installed = NAMED_CLIENTS.find((client) => runner.which(client) !== null);
+    if (!installed) {
+        throw new SignInError("no supported MCP client found. Install Genie Code (genie), Codex or genesis-room, or pass --client.");
+    }
+    return installed;
+}
+function requireInstalled(command, runner) {
+    const executable = runner.which(command);
+    if (!executable) {
+        throw new SignInError(`${command} is not installed or not on PATH.`);
+    }
+    return executable;
+}
+// Genie Code is Codex underneath: `mcp add` registers the server and signs in at once,
+// `mcp login` signs an existing one in again.
+async function planCodexFamily(client, label, name, genesisUrl, runner, signal) {
+    const executable = requireInstalled(client, runner);
+    const mcpUrl = `${genesisUrl}/mcp`;
+    const existing = await runner.run(executable, ["mcp", "get", name], signal);
+    let args = ["mcp", "add", name, "--url", mcpUrl];
+    if (existing.code === 0) {
+        const configured = /^\s*url:\s*(\S+)/m.exec(existing.output)?.[1]?.replace(/\/+$/, "");
+        if (configured !== mcpUrl) {
+            throw new SignInError(`${label} already has an MCP server named ${name} for ${configured ?? "another server"}. Pass --name with another name.`);
+        }
+        args = ["mcp", "login", name];
+    }
+    return {
+        client,
+        label,
+        executable,
+        args,
+        serverName: name,
+        next: `Start ${client} and type /mcp to see the ${name} tools.`,
+    };
+}
+async function planGenesisRoom(genesisUrl, runner, signal) {
+    const executable = requireInstalled("genesis-room", runner);
+    // v0.1 has no login command: given one, it starts its MCP server instead and waits on
+    // stdin for a client that never comes.
+    const version = await runner.run(executable, ["-version"], signal);
+    if (/v0\.1\.\d+\b/.test(version.output)) {
+        throw new SignInError(`this genesis-room (${version.output.trim()}) has no login command. Install a newer genesis-room and run this again.`);
+    }
+    return {
+        client: "genesis-room",
+        label: "genesis-room",
+        executable,
+        args: ["login", "-genesis-url", genesisUrl],
+        serverName: "genesis-room",
+        next: "Restart Claude Code (or the MCP client running genesis-room) to use the sign-in.",
+    };
+}
+function planOther(command, name, runner) {
+    const [program, ...args] = command;
+    const executable = requireInstalled(program, runner);
+    return {
+        client: "other",
+        label: program,
+        executable,
+        args,
+        serverName: name,
+        next: `${program} is signed in.`,
+    };
+}
+/** The real PATH lookup and process runner. */
+export const systemRunner = {
+    which: findExecutable,
+    run: (executable, args, signal) => new Promise((resolve, reject) => {
+        const child = startOwnedProcess(executable, args, process.env, signal);
+        let output = "";
+        child.stdout?.on("data", (chunk) => (output += chunk.toString()));
+        child.stderr?.on("data", (chunk) => (output += chunk.toString()));
+        const timer = setTimeout(() => stopProcessTree(child), PROBE_TIMEOUT_MS);
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(new SignInError(`could not run ${executable}: ${error.message}`));
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({ code, output });
+        });
+    }),
+};
+/**
+ * Start a client process that this package owns: aborting `signal` stops it and every
+ * process under it (stopProcessTree). Windows cannot start a .cmd or .bat shim without a
+ * shell; every argument this package builds is a checked name or URL, so none carries a
+ * shell metacharacter.
+ */
+export function startOwnedProcess(executable, args, env, signal) {
+    const child = spawn(executable, args, {
+        env,
+        shell: process.platform === "win32" && /\.(cmd|bat)$/i.test(executable),
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    if (signal) {
+        const stop = () => stopProcessTree(child);
+        if (signal.aborted) {
+            stop();
+        }
+        else {
+            signal.addEventListener("abort", stop, { once: true });
+            child.on("close", () => signal.removeEventListener("abort", stop));
+        }
+    }
+    return child;
+}
+/**
+ * Stop a started client and everything it started. On Windows a .cmd shim runs the
+ * client under cmd.exe, so killing the tracked process would stop only the shell and
+ * leave the client waiting on loopback: taskkill /T takes the whole tree. Runs taskkill
+ * to completion there (a short local command).
+ */
+export function stopProcessTree(child, platform = process.platform) {
+    if (child.exitCode !== null || child.signalCode !== null || child.pid === undefined) {
+        return;
+    }
+    if (platform === "win32") {
+        spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+        return;
+    }
+    child.kill();
+}
+/** The executable PATH resolves `command` to, or null. Honours PATHEXT on Windows. */
+export function findExecutable(command, pathVariable = process.env.PATH ?? "", platform = process.platform, isExecutable = canExecute) {
+    // On Windows an extensionless file beside genie.cmd is a POSIX shim it cannot start.
+    const pathExtensions = (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean);
+    const extensions = platform !== "win32" ? [""] : /\.[A-Za-z0-9]+$/.test(command) ? [""] : pathExtensions;
+    const candidates = (base) => extensions.map((extension) => `${base}${extension}`);
+    if (isAbsolute(command) || command.includes("/") || command.includes("\\")) {
+        return candidates(command).find(isExecutable) ?? null;
+    }
+    for (const directory of pathVariable.split(platform === "win32" ? ";" : ":")) {
+        if (!directory) {
+            continue;
+        }
+        const found = candidates(join(directory, command)).find(isExecutable);
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+function canExecute(path) {
+    try {
+        accessSync(path, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=clients.js.map

package/dist/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,iFAAiF;AACjF,qFAAqF;AACrF,6DAA6D;AAE7D,OAAO,EAAqB,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAK3C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAC7C,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AA+BhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,SAAwB,YAAY,EACpC,MAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,4DAA4D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CAAC,uDAAuD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1F,KAAK,OAAO;YACV,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrF,KAAK,cAAc;YACjB,OAAO,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D;YACE,MAAM,IAAI,WAAW,CAAC,uBAAuB,MAAM,gBAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAqB;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,GAAG,OAAO,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uFAAuF;AACvF,8CAA8C;AAC9C,KAAK,UAAU,eAAe,CAC5B,MAAyB,EACzB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,MAAqB,EACrB,MAAoB;IAEpB,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,UAAU,MAAM,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CACnB,GAAG,KAAK,oCAAoC,IAAI,QAAQ,UAAU,IAAI,gBAAgB,kCAAkC,CACzH,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,OAAO;QACL,MAAM;QACN,KAAK;QACL,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS,MAAM,6BAA6B,IAAI,SAAS;KAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,MAAqB,EAAE,MAAoB;IAC5F,MAAM,UAAU,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5D,sFAAsF;IACtF,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CACnB,sBAAsB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,0EAA0E,CACtH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,cAAc;QACrB,UAAU;QACV,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC;QAC3C,UAAU,EAAE,cAAc;QAC1B,IAAI,EAAE,kFAAkF;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAiB,EAAE,IAAY,EAAE,MAAqB;IACvE,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,OAAO;QACd,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,GAAG,OAAO,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,KAAK,EAAE,cAAc;IACrB,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAChC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACzE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,WAAW,CAAC,iBAAiB,UAAU,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAc,EACd,GAAsB,EACtB,MAAoB;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QACpC,GAAG;QACH,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QACvE,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC/F,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,EAAE,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,eAAuB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAC7C,WAA4B,OAAO,CAAC,QAAQ,EAC5C,eAA0C,UAAU;IAEpD,qFAAqF;IACrF,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACzG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;IAC1F,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/connect.d.ts

@@ -0,0 +1,30 @@
+import type { ChildProcess } from "node:child_process";
+import { type ClientLaunch } from "./clients.js";
+import { SignInError } from "./genesis.js";
+export interface ConnectOptions {
+    genesisUrl: string;
+    launch: ClientLaunch;
+    /** Prints one line for the person. */
+    say?: (line: string) => void;
+    /** Waits, ending early when the signal aborts; swapped out in tests. */
+    sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    start?: (executable: string, args: string[], signal: AbortSignal) => ChildProcess;
+    /** Aborting stops the client and rejects with InterruptedError. */
+    signal?: AbortSignal;
+}
+/** The sign-in was interrupted (Ctrl-C); the client has been stopped. */
+export declare class InterruptedError extends SignInError {
+    constructor();
+}
+/**
+ * Run the whole code sign-in. Resolves once the client has saved its sign-in; rejects
+ * with a SignInError saying what to do otherwise. Network calls: one start, one poll
+ * every few seconds until approved (at most the code's lifetime, 10 minutes), and one
+ * loopback request.
+ */
+export declare function connect(options: ConnectOptions): Promise<void>;
+/**
+ * Wait `ms`, or less if `signal` aborts first. The timer is cleared either way, so an
+ * interrupted sign-in exits at once instead of sitting out the current poll interval.
+ */
+export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;

package/dist/connect.js

@@ -0,0 +1,248 @@
+// Sign a client in with a code: start its own sign-in, show a code for Genesis's
+// /device page, and once the person has approved and signed in there, deliver the
+// sign-in to the client on this machine, the one place its loopback callback reaches.
+import { startOwnedProcess, stopProcessTree } from "./clients.js";
+import { deliverCallback, findAuthorizeUrl, pollCodeSignIn, printedForeignAuthorizeUrl, SignInError, startCodeSignIn, } from "./genesis.js";
+const AUTHORIZE_URL_WAIT_MS = 60_000;
+const CLIENT_FINISH_WAIT_MS = 60_000;
+const MAX_POLL_MISSES = 10;
+const MAX_CLIENT_OUTPUT = 64 * 1024;
+/** Backoff ceiling: Genesis asking to slow down never stretches a poll past this. */
+const MAX_POLL_INTERVAL_SECONDS = 30;
+/** The sign-in was interrupted (Ctrl-C); the client has been stopped. */
+export class InterruptedError extends SignInError {
+    constructor() {
+        super("interrupted.");
+    }
+}
+/**
+ * Run the whole code sign-in. Resolves once the client has saved its sign-in; rejects
+ * with a SignInError saying what to do otherwise. Network calls: one start, one poll
+ * every few seconds until approved (at most the code's lifetime, 10 minutes), and one
+ * loopback request.
+ */
+export async function connect(options) {
+    const { genesisUrl, launch } = options;
+    const say = options.say ?? ((line) => console.log(line));
+    const sleep = options.sleep ?? abortableSleep;
+    const signal = options.signal ?? new AbortController().signal;
+    const client = new RunningClient((options.start ?? startClient)(launch.executable, launch.args, signal), launch.label);
+    try {
+        const authorizeUrl = await client.waitForAuthorizeUrl(genesisUrl, sleep, signal);
+        if (authorizeUrl === null) {
+            // It finished without asking: its sign-in was still good.
+            return;
+        }
+        const started = await startCodeSignIn(genesisUrl, { authorizeUrl, client: launch.client, name: launch.serverName }, signal);
+        say("");
+        say(`  To sign ${launch.label} in to Genesis, open this page in any browser:`);
+        say("");
+        say(`      ${started.verificationUri}`);
+        say("");
+        say(`  and enter the code   ${started.userCode}`);
+        say("");
+        say(`  Or open ${started.verificationUriComplete}`);
+        say("");
+        say(`  Waiting for you to approve (the code expires in ${Math.round(started.expiresInSeconds / 60)} minutes)...`);
+        const callbackUrl = await waitForApproval(genesisUrl, started.deviceCode, started.intervalSeconds, client, say, sleep, signal);
+        if (callbackUrl === null) {
+            // Signed in on its own, through a browser on this machine.
+            return;
+        }
+        if (signal.aborted) {
+            throw new InterruptedError();
+        }
+        try {
+            await deliverCallback(callbackUrl, signal);
+        }
+        catch (error) {
+            if (error instanceof SignInError) {
+                throw error;
+            }
+            throw new SignInError(`could not hand the sign-in to ${launch.label} on this machine.`);
+        }
+        await client.waitForSuccess(signal);
+    }
+    catch (error) {
+        if (signal.aborted) {
+            throw new InterruptedError();
+        }
+        throw error;
+    }
+    finally {
+        client.stop();
+    }
+}
+async function waitForApproval(genesisUrl, deviceCode, intervalSeconds, client, say, sleep, signal) {
+    let interval = intervalSeconds;
+    let misses = 0;
+    let announced = false;
+    for (;;) {
+        await sleep(interval * 1000, signal);
+        if (signal.aborted) {
+            throw new InterruptedError();
+        }
+        if (client.exitCode !== null) {
+            if (client.exitCode === 0) {
+                return null;
+            }
+            throw client.failure("stopped waiting for the sign-in. Run the command again.");
+        }
+        const polled = await pollCodeSignIn(genesisUrl, deviceCode, signal);
+        if (polled === null) {
+            misses += 1;
+            if (misses > MAX_POLL_MISSES) {
+                throw new SignInError(`lost contact with ${genesisUrl}.`);
+            }
+            continue;
+        }
+        misses = 0;
+        switch (polled.status) {
+            case "authorization_pending":
+                break;
+            case "slow_down":
+                interval = Math.min(interval + 2, MAX_POLL_INTERVAL_SECONDS);
+                break;
+            case "rate_limited":
+                interval = Math.min(Math.max(interval * 2, 1), MAX_POLL_INTERVAL_SECONDS);
+                break;
+            case "signing_in":
+                if (!announced) {
+                    say("  Approved. Finish signing in to Genesis in the browser...");
+                    announced = true;
+                }
+                break;
+            case "complete":
+                return polled.callbackUrl;
+            case "denied":
+                throw new SignInError("the sign-in was denied in the browser.");
+            case "expired":
+                throw new SignInError("the code expired before it was approved. Run the command again.");
+            case "failed":
+                throw new SignInError(`the sign-in did not complete: ${polled.failure}`);
+        }
+    }
+}
+/**
+ * Wait `ms`, or less if `signal` aborts first. The timer is cleared either way, so an
+ * interrupted sign-in exits at once instead of sitting out the current poll interval.
+ */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function startClient(executable, args, signal) {
+    // BROWSER=true stops genie and codex opening a browser on this machine (macOS and
+    // Linux); the person signs in from whichever browser they open the code in.
+    return startOwnedProcess(executable, args, { ...process.env, BROWSER: "true" }, signal);
+}
+/** The client's process: its output so far and how it ended. */
+class RunningClient {
+    child;
+    label;
+    output = "";
+    exitCode = null;
+    exited;
+    startError = null;
+    constructor(child, label) {
+        this.child = child;
+        this.label = label;
+        const collect = (chunk) => {
+            if (this.output.length < MAX_CLIENT_OUTPUT) {
+                this.output += chunk.toString();
+            }
+        };
+        child.stdout?.on("data", collect);
+        child.stderr?.on("data", collect);
+        // Kept open and never written: genesis-room login reads a pasted address from stdin,
+        // and stops waiting if it closes.
+        child.stdin?.on("error", () => undefined);
+        this.exited = new Promise((resolve) => {
+            child.on("error", (error) => {
+                this.startError = error;
+                this.exitCode = -1;
+                resolve();
+            });
+            child.on("close", (code) => {
+                this.exitCode = code ?? -1;
+                resolve();
+            });
+        });
+    }
+    /** The sign-in URL it printed, or null if it finished at once without needing one. */
+    async waitForAuthorizeUrl(genesisUrl, sleep, signal) {
+        const deadline = Date.now() + AUTHORIZE_URL_WAIT_MS;
+        for (;;) {
+            if (signal.aborted) {
+                throw new InterruptedError();
+            }
+            const url = findAuthorizeUrl(this.output, genesisUrl);
+            if (url !== null) {
+                return url;
+            }
+            if (printedForeignAuthorizeUrl(this.output)) {
+                throw new SignInError(`${this.label} is signing in somewhere other than ${genesisUrl}.`);
+            }
+            if (this.exitCode !== null) {
+                if (this.exitCode === 0) {
+                    return null;
+                }
+                throw this.failure("stopped before it started signing in.");
+            }
+            if (Date.now() > deadline) {
+                throw this.failure("printed no sign-in link within a minute.");
+            }
+            await sleep(200, signal);
+        }
+    }
+    async waitForSuccess(signal) {
+        // An owned timer, cleared however the wait ends: a timer left running would keep the
+        // command alive for a minute after it printed "Signed in".
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(false), CLIENT_FINISH_WAIT_MS);
+        });
+        const finished = await Promise.race([this.exited.then(() => true), timedOut]);
+        clearTimeout(timer);
+        if (signal.aborted) {
+            throw new InterruptedError();
+        }
+        if (!finished) {
+            throw this.failure("did not finish signing in.");
+        }
+        if (this.exitCode !== 0) {
+            throw this.failure("could not finish signing in.");
+        }
+    }
+    failure(what) {
+        if (this.startError) {
+            return new SignInError(`could not start ${this.label}: ${this.startError.message}`);
+        }
+        const shown = this.output
+            .replace(/[^\x20-\x7e\n]/g, "")
+            .trim()
+            .split("\n")
+            .map((line) => `  ${line}`)
+            .join("\n");
+        return new SignInError(`${this.label} ${what}${shown ? `\n${shown}` : ""}`);
+    }
+    stop() {
+        if (this.exitCode === null) {
+            stopProcessTree(this.child);
+        }
+    }
+}
+//# sourceMappingURL=connect.js.map

package/dist/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,kFAAkF;AAClF,sFAAsF;AAItF,OAAO,EAAqB,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,WAAW,EACX,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAcrC,yEAAyE;AACzE,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IAC/C;QACE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,aAAa,CAC9B,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EACtE,MAAM,CAAC,KAAK,CACb,CAAC;IACF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,0DAA0D;YAC1D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,UAAU,EACV,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,EAChE,MAAM,CACP,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,gDAAgD,CAAC,CAAC;QAC/E,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,SAAS,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,0BAA0B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,aAAa,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,qDAAqD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QAElH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/H,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,2DAA2D;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,iCAAiC,MAAM,CAAC,KAAK,mBAAmB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,UAAkB,EAClB,eAAuB,EACvB,MAAqB,EACrB,GAA2B,EAC3B,KAAyD,EACzD,MAAmB;IAEnB,IAAI,QAAQ,GAAG,eAAe,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,MAAM,GAAG,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,CAAC,CAAC;QACX,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,uBAAuB;gBAC1B,MAAM;YACR,KAAK,WAAW;gBACd,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBAC7D,MAAM;YACR,KAAK,cAAc;gBACjB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBAC1E,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,GAAG,CAAC,4DAA4D,CAAC,CAAC;oBAClE,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;gBACD,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,MAAM,CAAC,WAAW,CAAC;YAC5B,KAAK,QAAQ;gBACX,MAAM,IAAI,WAAW,CAAC,wCAAwC,CAAC,CAAC;YAClE,KAAK,SAAS;gBACZ,MAAM,IAAI,WAAW,CAAC,iEAAiE,CAAC,CAAC;YAC3F,KAAK,QAAQ;gBACX,MAAM,IAAI,WAAW,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAmB;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAc,EAAE,MAAmB;IAC1E,kFAAkF;IAClF,4EAA4E;IAC5E,OAAO,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,gEAAgE;AAChE,MAAM,aAAa;IAOE;IACA;IAPnB,MAAM,GAAG,EAAE,CAAC;IACZ,QAAQ,GAAkB,IAAI,CAAC;IACvB,MAAM,CAAgB;IACtB,UAAU,GAAiB,IAAI,CAAC;IAExC,YACmB,KAAmB,EACnB,KAAa;QADb,UAAK,GAAL,KAAK,CAAc;QACnB,UAAK,GAAL,KAAK,CAAQ;QAE9B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,qFAAqF;QACrF,kCAAkC;QAClC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBACnB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,mBAAmB,CACvB,UAAkB,EAClB,KAAyD,EACzD,MAAmB;QAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;QACpD,SAAS,CAAC;YACR,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACtD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,uCAAuC,UAAU,GAAG,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAmB;QACtC,qFAAqF;QACrF,2DAA2D;QAC3D,IAAI,KAAiC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,WAAW,CAAC,mBAAmB,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;aACtB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;CACF"}

package/dist/genesis.d.ts

@@ -0,0 +1,56 @@
+export declare const DEVICE_START_PATH = "/mcp/device/start";
+export declare const DEVICE_POLL_PATH = "/mcp/device/poll";
+/** What /mcp/device/start answers: the code to show and the secret to poll with. */
+export interface StartedSignIn {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    intervalSeconds: number;
+    expiresInSeconds: number;
+}
+/** Where a code sign-in stands, from /mcp/device/poll. */
+export type PollResult = {
+    status: "authorization_pending" | "slow_down" | "rate_limited" | "signing_in";
+} | {
+    status: "complete";
+    callbackUrl: string;
+} | {
+    status: "denied" | "expired";
+} | {
+    status: "failed";
+    failure: string;
+};
+export declare class SignInError extends Error {
+}
+/**
+ * The Genesis base URL (scheme and host) from what a person typed: the base itself, the
+ * MCP URL ending in /mcp, or either with a trailing slash.
+ */
+export declare function normalizeGenesisUrl(raw: string): string;
+/**
+ * The first sign-in URL for this Genesis in what a client printed, or null.
+ *
+ * Only this Genesis's own /authorize is accepted: a client signing in anywhere else is
+ * not one a Genesis code can finish.
+ */
+export declare function findAuthorizeUrl(output: string, genesisUrl: string): string | null;
+/** True if the client printed a sign-in URL for some other server. */
+export declare function printedForeignAuthorizeUrl(output: string): boolean;
+/** Open a code sign-in for the authorize URL a client printed. One HTTP request. */
+export declare function startCodeSignIn(genesisUrl: string, form: {
+    authorizeUrl: string;
+    client: string;
+    name: string;
+}, signal?: AbortSignal): Promise<StartedSignIn>;
+/**
+ * Where the sign-in stands. One HTTP request; null when Genesis could not be reached or
+ * answered with an error status, which the caller retries a few times. Aborting
+ * `signal` cancels the request and rejects, never counting as a miss.
+ */
+export declare function pollCodeSignIn(genesisUrl: string, deviceCode: string, signal?: AbortSignal): Promise<PollResult | null>;
+/**
+ * Hand the sign-in to the client listening on this machine. One HTTP request, to
+ * loopback only, never through a proxy and never following a redirect.
+ */
+export declare function deliverCallback(callbackUrl: string, signal?: AbortSignal): Promise<void>;

package/dist/genesis.js

@@ -0,0 +1,164 @@
+// The Genesis side of a code sign-in: /mcp/device/start, /mcp/device/poll, and the
+// loopback callback Genesis hands back once the person has approved and signed in.
+// Same protocol as the `curl <host>/mcp/connect | sh` script Genesis serves.
+export const DEVICE_START_PATH = "/mcp/device/start";
+export const DEVICE_POLL_PATH = "/mcp/device/poll";
+export class SignInError extends Error {
+}
+const DEFAULT_INTERVAL_SECONDS = 3;
+const DEFAULT_EXPIRES_IN_SECONDS = 600;
+const DEVICE_CODE_PATTERN = /^[A-Za-z0-9_-]+$/;
+const USER_CODE_PATTERN = /^[A-Z-]+$/;
+const CALLBACK_CHARACTERS = /^[A-Za-z0-9:/?=&%._~+-]+$/;
+const CALLBACK_DELIVERY_TIMEOUT_MS = 30_000;
+/**
+ * The Genesis base URL (scheme and host) from what a person typed: the base itself, the
+ * MCP URL ending in /mcp, or either with a trailing slash.
+ */
+export function normalizeGenesisUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw.trim());
+    }
+    catch {
+        throw new SignInError(`not a URL: ${raw}`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new SignInError(`the Genesis URL must start with https:// (got ${raw})`);
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new SignInError(`give the Genesis address only, e.g. https://genesis.example.com (got ${raw})`);
+    }
+    const path = parsed.pathname.replace(/\/+$/, "");
+    if (path !== "" && path !== "/mcp") {
+        throw new SignInError(`give the Genesis address only, e.g. https://genesis.example.com (got ${raw})`);
+    }
+    return parsed.origin;
+}
+/**
+ * The first sign-in URL for this Genesis in what a client printed, or null.
+ *
+ * Only this Genesis's own /authorize is accepted: a client signing in anywhere else is
+ * not one a Genesis code can finish.
+ */
+export function findAuthorizeUrl(output, genesisUrl) {
+    for (const match of output.matchAll(/https?:\/\/[^\s"'<>`]+\/authorize\?[^\s"'<>`]+/g)) {
+        const url = match[0].replace(/[).,;]+$/, "");
+        if (url.startsWith(`${genesisUrl}/authorize?`)) {
+            return url;
+        }
+    }
+    return null;
+}
+/** True if the client printed a sign-in URL for some other server. */
+export function printedForeignAuthorizeUrl(output) {
+    return /https?:\/\/[^\s"'<>`]+\/authorize\?/.test(output);
+}
+/** Open a code sign-in for the authorize URL a client printed. One HTTP request. */
+export async function startCodeSignIn(genesisUrl, form, signal) {
+    const answer = await postForm(`${genesisUrl}${DEVICE_START_PATH}`, { authorize_url: form.authorizeUrl, client: form.client, name: form.name }, signal);
+    if (answer.status !== 200) {
+        throw new SignInError(`Genesis refused the sign-in (${answer.status}): ${errorText(answer.body)}`);
+    }
+    const body = answer.body;
+    const deviceCode = stringField(body, "device_code");
+    const userCode = stringField(body, "user_code");
+    if (!DEVICE_CODE_PATTERN.test(deviceCode) || !USER_CODE_PATTERN.test(userCode)) {
+        throw new SignInError("Genesis sent an unreadable answer.");
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri: `${genesisUrl}/device`,
+        verificationUriComplete: `${genesisUrl}/device?code=${userCode}`,
+        intervalSeconds: numberField(body, "interval") ?? DEFAULT_INTERVAL_SECONDS,
+        expiresInSeconds: numberField(body, "expires_in") ?? DEFAULT_EXPIRES_IN_SECONDS,
+    };
+}
+/**
+ * Where the sign-in stands. One HTTP request; null when Genesis could not be reached or
+ * answered with an error status, which the caller retries a few times. Aborting
+ * `signal` cancels the request and rejects, never counting as a miss.
+ */
+export async function pollCodeSignIn(genesisUrl, deviceCode, signal) {
+    let answer;
+    try {
+        answer = await postForm(`${genesisUrl}${DEVICE_POLL_PATH}`, { device_code: deviceCode }, signal);
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw error;
+        }
+        return null;
+    }
+    if (answer.status !== 200) {
+        return null;
+    }
+    const status = stringField(answer.body, "status");
+    switch (status) {
+        case "authorization_pending":
+        case "slow_down":
+        case "rate_limited":
+        case "signing_in":
+        case "denied":
+        case "expired":
+            return { status };
+        case "complete":
+            return { status, callbackUrl: stringField(answer.body, "callback_url") };
+        case "failed":
+            return { status, failure: printable(stringField(answer.body, "failure")) };
+        default:
+            throw new SignInError("Genesis sent an unreadable answer.");
+    }
+}
+/**
+ * Hand the sign-in to the client listening on this machine. One HTTP request, to
+ * loopback only, never through a proxy and never following a redirect.
+ */
+export async function deliverCallback(callbackUrl, signal) {
+    if (!/^http:\/\/(127\.0\.0\.1|localhost):\d+\//.test(callbackUrl)) {
+        throw new SignInError("Genesis sent a callback that is not on this machine.");
+    }
+    if (!CALLBACK_CHARACTERS.test(callbackUrl)) {
+        throw new SignInError("Genesis sent an unreadable callback.");
+    }
+    // Node's fetch reads no proxy variables, so this request stays on this machine.
+    await fetch(callbackUrl, {
+        redirect: "manual",
+        signal: signal
+            ? AbortSignal.any([signal, AbortSignal.timeout(CALLBACK_DELIVERY_TIMEOUT_MS)])
+            : AbortSignal.timeout(CALLBACK_DELIVERY_TIMEOUT_MS),
+    });
+}
+async function postForm(url, fields, signal) {
+    const response = await fetch(url, {
+        method: "POST",
+        signal,
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(fields).toString(),
+        redirect: "error",
+    });
+    let body = null;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = null;
+    }
+    return { status: response.status, body };
+}
+function stringField(body, key) {
+    const value = body?.[key];
+    return typeof value === "string" ? value : "";
+}
+function numberField(body, key) {
+    const value = body?.[key];
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function errorText(body) {
+    return printable(stringField(body, "error")) || "no reason given";
+}
+function printable(text) {
+    return text.replace(/[^\x20-\x7e]/g, "");
+}
+//# sourceMappingURL=genesis.js.map

package/dist/genesis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"genesis.js","sourceRoot":"","sources":["../src/genesis.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,mFAAmF;AACnF,6EAA6E;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAmBnD,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,iDAAiD,GAAG,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,WAAW,CAAC,wEAAwE,GAAG,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CAAC,wEAAwE,GAAG,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAkB;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,UAAU,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,OAAO,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,IAA4D,EAC5D,MAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,GAAG,UAAU,GAAG,iBAAiB,EAAE,EACnC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAC1E,MAAM,CACP,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,gCAAgC,MAAM,CAAC,MAAM,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe,EAAE,GAAG,UAAU,SAAS;QACvC,uBAAuB,EAAE,GAAG,UAAU,gBAAgB,QAAQ,EAAE;QAChE,eAAe,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,wBAAwB;QAC1E,gBAAgB,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,0BAA0B;KAChF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,UAAkB,EAClB,MAAoB;IAEpB,IAAI,MAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,UAAU,GAAG,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW,CAAC;QACjB,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3E,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC7E;YACE,MAAM,IAAI,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,MAAoB;IAC7E,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAChE,CAAC;IACD,gFAAgF;IAChF,MAAM,KAAK,CAAC,WAAW,EAAE;QACvB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC9E,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,MAA8B,EAC9B,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QAC5C,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,GAAW;IAC7C,MAAM,KAAK,GAAI,IAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,GAAW;IAC7C,MAAM,KAAK,GAAI,IAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,iBAAiB,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { type ClientLaunch, type LaunchRequest, planLaunch } from "./clients.js";
+export { connect, type ConnectOptions, InterruptedError } from "./connect.js";
+export { deliverCallback, normalizeGenesisUrl, pollCodeSignIn, type PollResult, SignInError, startCodeSignIn, type StartedSignIn, } from "./genesis.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { planLaunch } from "./clients.js";
+export { connect, InterruptedError } from "./connect.js";
+export { deliverCallback, normalizeGenesisUrl, pollCodeSignIn, SignInError, startCodeSignIn, } from "./genesis.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,UAAU,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,OAAO,EAAuB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,cAAc,EAEd,WAAW,EACX,eAAe,GAEhB,MAAM,cAAc,CAAC"}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@genesiscomputing/genesis-connect",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Sign Genie Code, Codex or genesis-room in to Genesis with a code: no browser or tunnel needed on the machine they run on.",
+  "type": "module",
+  "keywords": [
+    "genesis",
+    "mcp",
+    "oauth",
+    "device-code",
+    "genie",
+    "codex"
+  ],
+  "bin": {
+    "genesis-connect": "dist/cli.js"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepack": "npm run build"
+  },
+  "engines": {
+    "node": ">=20.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "^25.6.2",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.5"
+  }
+}