@hyper.authio/cli 0.0.0-stage → 0.11.0

package/README.md

@@ -1,3 +1,69 @@
-# Temporary Holding Version
+# @hyper.authio/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Apply an Authio client's integration plan to your project, on your machine, with one command.
+
+In the Authio console, open a client's integration guide, pick **Next.js · Auth.js v5** and press **Generate command**:
+
+```bash
+npx @hyper.authio/cli@latest init --ticket ait_...
+```
+
+The code in the command works once and for ten minutes, and it only reads that client's integration plan: the
+packages, the files and the environment variables, already filled in with the client's issuer, identifier, scopes,
+PKCE, algorithms and session model. The plan never carries the client secret. Authio never sees your repository.
+
+## What `init` does
+
+1. **Reads the project, without the network.** The `next` major (16 and later get `proxy.ts`, earlier ones
+   `middleware.ts`), the App Router (`app/` or `src/app/`), a `src/` folder and the package manager from the lockfile.
+   A project on the pages router or on NextAuth v4 is stopped with an explanation, before the code is used.
+2. **Exchanges the code for the plan** and shows every file in full, every variable and every package.
+3. **Asks before writing.** Files that do not exist are created. **A file you already have is never overwritten**: it
+   is listed as one to merge by hand, with the plan's version printed above.
+4. **Fills in `.env.local`**, adding only the variables it does not have yet. The client secret (and any other secret
+   the plan names) is asked for in a hidden prompt and written only to `.env.local`; leave it empty to fill in later.
+   `AUTH_SECRET` is generated on your machine.
+5. **Checks `.gitignore`** for `.env.local` and `.authio/` and offers to add them.
+6. **Installs the packages** with your package manager, after asking.
+
+It never commits, never runs git and never sends your code anywhere. It warns when the redirect your app will use
+locally (`http://localhost:<dev port>/api/auth/callback/authio`) is not registered on the client, and when the client is
+inactive.
+
+## Confirm the first sign-in
+
+```bash
+npx @hyper.authio/cli verify          # once
+npx @hyper.authio/cli verify --wait   # until the first sign-in arrives
+```
+
+`init` keeps a verification code in `.authio/verification` (valid for 30 minutes). `verify` answers whether the client
+has had a successful sign-in since then; the last step of the client's guide in the console shows the same.
+
+## Options
+
+| Option | Meaning |
+| --- | --- |
+| `--ticket <code>` | The one-time code; or the `AUTHIO_TICKET` environment variable. |
+| `--api <url>` | The Authio API address, for a Dedicated instance or QA. Default `https://authio.api.hyperio.tech`. The console adds it to the command when it is not the default. |
+| `--cwd <dir>` | The project folder. Default: the current folder. |
+| `--dry-run` | Show the plan without writing, installing or asking for secrets. The code is used up all the same. |
+| `--yes`, `-y` | Answer yes to every question. Required without an interactive terminal, where secrets are written empty. |
+| `--verification <code>` | With `verify`: the code to check instead of the saved one. |
+| `--wait` | With `verify`: ask every three seconds until the sign-in arrives or the verification expires. |
+
+Exit codes: `0` done, `1` error (printed as `Error (<code>): <message>`), `2` nothing done (declined, or no sign-in
+yet).
+
+## From code or an agent
+
+The same steps are exported for tests and tools: `detectProject`, `redeemTicket`, `planChanges`, `runInit` and
+`runVerify`, with every effect (network, prompts, process) behind the `CliIo` interface. An agent connected to Authio's
+MCP server can also ask for the plan with the `integration_plan` tool and apply it itself, showing you each change.
+
+## Security
+
+Report a vulnerability privately, by email to **security@hyperio.tech**, and not in an issue or anywhere else in
+public. Authio's [vulnerability disclosure policy](https://authio.hyperio.tech/docs/trust/vulnerability-disclosure)
+says what is in scope and what happens after a report. Only the latest published minor receives security fixes.
+Questions and bugs that are not about security go to [support](https://authio.hyperio.tech/docs/account/support).

package/dist/cli.js

@@ -0,0 +1,497 @@
+#!/usr/bin/env node
+import { readFileSync, mkdirSync, writeFileSync, existsSync, appendFileSync, chmodSync, statSync } from 'fs';
+import { spawn } from 'child_process';
+import { createInterface } from 'readline';
+import { join, resolve, dirname, sep, normalize, isAbsolute } from 'path';
+import { randomBytes } from 'crypto';
+
+function ask(question, hidden) {
+  const input = process.stdin;
+  const output = process.stdout;
+  if (!hidden || !input.isTTY) {
+    const lines = createInterface({ input, output });
+    return new Promise(
+      (resolve2) => lines.question(question, (answer) => {
+        lines.close();
+        resolve2(answer);
+      })
+    );
+  }
+  return new Promise((resolve2, reject) => {
+    let value = "";
+    output.write(question);
+    input.setRawMode(true);
+    input.resume();
+    input.setEncoding("utf8");
+    const finish = () => {
+      input.setRawMode(false);
+      input.pause();
+      input.removeListener("data", onData);
+      output.write("\n");
+    };
+    const onData = (chunk) => {
+      for (const character of chunk) {
+        if (character === "\r" || character === "\n") {
+          finish();
+          resolve2(value);
+          return;
+        }
+        if (character === "") {
+          finish();
+          reject(new Error("Cancelled."));
+          return;
+        }
+        if (character === "\x7F" || character === "\b") value = value.slice(0, -1);
+        else if (character >= " ") value += character;
+      }
+    };
+    input.on("data", onData);
+  });
+}
+function windowsCommandLine(command, args) {
+  return [command, ...args.map((arg) => `"${arg.replace(/"/g, '""')}"`)].join(" ");
+}
+function createTerminalIo() {
+  return {
+    fetch: globalThis.fetch.bind(globalThis),
+    print: (line) => process.stdout.write(`${line}
+`),
+    confirm: async (question, defaultYes) => {
+      const answer = (await ask(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `, false)).trim().toLowerCase();
+      return answer === "" ? defaultYes : answer === "y" || answer === "yes";
+    },
+    promptSecret: (question) => ask(question, true),
+    run: (command, args, cwd) => new Promise((resolve2) => {
+      const child = process.platform === "win32" ? spawn(windowsCommandLine(command, args), { cwd, stdio: "inherit", shell: true }) : spawn(command, [...args], { cwd, stdio: "inherit" });
+      child.on("error", () => resolve2(127));
+      child.on("close", (code) => resolve2(code ?? 1));
+    }),
+    isInteractive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    now: () => Date.now(),
+    sleep: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds))
+  };
+}
+
+// src/errors.ts
+var AuthioCliError = class extends Error {
+  /** What went wrong, stable across versions. */
+  code;
+  /** The process exit code the CLI ends with. */
+  exitCode;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "AuthioCliError";
+    this.code = code;
+    this.exitCode = options?.exitCode ?? 1;
+  }
+};
+
+// src/args.ts
+var DEFAULT_API = "https://authio.api.hyperio.tech";
+var VALUE_OPTIONS = /* @__PURE__ */ new Set(["--ticket", "--verification", "--api", "--cwd"]);
+var FLAG_OPTIONS = /* @__PURE__ */ new Set(["--dry-run", "--yes", "-y", "--wait", "--help", "-h", "--version", "-v"]);
+function parseArguments(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const positional = [];
+  for (let index = 0; index < argv.length; index++) {
+    const current = argv[index];
+    if (!current.startsWith("-")) {
+      positional.push(current);
+      continue;
+    }
+    const [name, inline] = current.includes("=") ? [current.slice(0, current.indexOf("=")), current.slice(current.indexOf("=") + 1)] : [current, void 0];
+    if (VALUE_OPTIONS.has(name)) {
+      const value = inline ?? argv[++index];
+      if (value === void 0 || value.startsWith("--")) throw new AuthioCliError("invalid_arguments", `${name} needs a value.`);
+      values.set(name, value);
+    } else if (FLAG_OPTIONS.has(name) && inline === void 0) {
+      flags.add(name);
+    } else {
+      throw new AuthioCliError("invalid_arguments", `Unknown option ${current}. Run "authio --help" to see the options.`);
+    }
+  }
+  const named = positional[0];
+  const command = flags.has("--help") || flags.has("-h") ? "help" : flags.has("--version") || flags.has("-v") ? "version" : named === void 0 ? "help" : named;
+  if (command !== "init" && command !== "verify" && command !== "help" && command !== "version")
+    throw new AuthioCliError("invalid_arguments", `Unknown command "${command}". Use "init" or "verify".`);
+  return {
+    command,
+    ticket: values.get("--ticket"),
+    verification: values.get("--verification"),
+    api: values.get("--api"),
+    cwd: values.get("--cwd"),
+    dryRun: flags.has("--dry-run"),
+    yes: flags.has("--yes") || flags.has("-y"),
+    wait: flags.has("--wait")
+  };
+}
+function apiAddress(api) {
+  const address = (api ?? DEFAULT_API).trim().replace(/\/+$/, "");
+  if (!/^https?:\/\/[^/\s]+/i.test(address)) throw new AuthioCliError("invalid_arguments", `--api must be an http or https address, not "${api}".`);
+  return address;
+}
+var HELP = `Authio CLI
+
+Usage
+  npx @hyper.authio/cli init --ticket ait_...   Apply a client's integration plan to this project
+  npx @hyper.authio/cli verify [--wait]          Check whether the first sign-in has arrived
+
+Options
+  --ticket <code>        The one-time code from the client's guide in the console (or AUTHIO_TICKET)
+  --api <url>            The Authio API address (default ${DEFAULT_API})
+  --cwd <dir>            The project folder (default: the current folder)
+  --dry-run              Show the plan without writing anything (the code is still used up)
+  --yes, -y              Answer yes to every question; required without an interactive terminal
+  --verification <code>  The verification code (default: the one init saved in .authio/verification)
+  --wait                 With verify: keep checking until the first sign-in arrives
+
+The CLI never overwrites a file, never commits and never sends your code anywhere.`;
+var SUPPORTED_PLAN_VERSIONS = [1];
+function normalizePlan(plan) {
+  const lower = (value, fallback) => value ? String(value).toLowerCase() : fallback;
+  return {
+    ...plan,
+    packages: plan.packages ?? [],
+    redirectUris: plan.redirectUris ?? [],
+    files: (plan.files ?? []).map((file) => ({ ...file, root: lower(file.root, "project"), content: file.content ?? "" })),
+    environment: (plan.environment ?? []).map((variable) => ({
+      ...variable,
+      source: lower(variable.source, "secret")
+    }))
+  };
+}
+function assertPlanVersion(plan) {
+  if (!SUPPORTED_PLAN_VERSIONS.includes(plan.planVersion))
+    throw new AuthioCliError(
+      "plan_version_unsupported",
+      `This plan is version ${plan.planVersion}, which this CLI does not know. Run "npx @hyper.authio/cli@latest" with a new code.`
+    );
+}
+function placePath(project, file) {
+  const relative = normalize(file.path).replace(/\\/g, "/");
+  if (!relative || isAbsolute(file.path) || /^[a-zA-Z]:/.test(file.path) || relative.split("/").includes(".."))
+    throw new AuthioCliError("plan_path_invalid", `The plan names a path outside the project ("${file.path}"); nothing was written.`);
+  return file.root === "source" && project.srcDir ? `src/${relative}` : relative;
+}
+function readEnvKeys(path) {
+  if (!existsSync(path)) return /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+    if (match) keys.add(match[1]);
+  }
+  return keys;
+}
+var LOCAL_ORIGIN_VARIABLE = "AUTH_URL";
+var LOCAL_ORIGIN_COMMENT = "Where this app runs on this machine; set the public address where it is deployed.";
+function localOrigin(project) {
+  return `http://localhost:${project.devPort}`;
+}
+function planChanges(project, plan) {
+  const files = plan.files.map((file) => {
+    const path = placePath(project, file);
+    const target = join(project.root, ...path.split("/"));
+    if (!target.startsWith(project.root + sep) && target !== project.root)
+      throw new AuthioCliError("plan_path_invalid", `The plan names a path outside the project ("${file.path}"); nothing was written.`);
+    return { path, target, content: file.content, action: existsSync(target) ? "merge" : "create" };
+  });
+  const existing = readEnvKeys(join(project.root, ".env.local"));
+  const localRedirect = `${localOrigin(project)}${plan.callbackPath}`;
+  return {
+    files,
+    environment: plan.environment.filter((variable) => !existing.has(variable.name)).map((variable) => variable.name === LOCAL_ORIGIN_VARIABLE && variable.source === "plan" ? { ...variable, value: localOrigin(project), comment: LOCAL_ORIGIN_COMMENT } : variable),
+    keptEnvironment: plan.environment.filter((variable) => existing.has(variable.name)).map((variable) => variable.name),
+    localRedirect,
+    redirectRegistered: plan.redirectUris.some((uri) => uri.replace(/\/+$/, "") === localRedirect)
+  };
+}
+
+// src/api.ts
+async function post(fetcher, api, path, body, invalidCode) {
+  const url = `${api}${path}`;
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body)
+    });
+  } catch (cause) {
+    throw new AuthioCliError("api_unreachable", `Could not reach Authio at ${api}. Check the address (--api) and your connection.`, { cause });
+  }
+  let envelope = {};
+  try {
+    envelope = await response.json();
+  } catch {
+    envelope = {};
+  }
+  if (response.status === 401)
+    throw new AuthioCliError(
+      invalidCode,
+      invalidCode === "ticket_invalid" ? "This code was already used or has expired. Generate another command in the client's guide in the Authio console." : "This verification has expired. The last step of the client's guide in the console still shows the first sign-in."
+    );
+  if (response.status === 429) throw new AuthioCliError("rate_limited", "Authio is refusing more attempts for now. Wait a minute and try again.");
+  if (!response.ok || envelope.data === void 0) {
+    const detail = envelope.notifications?.map((notification) => notification.message).filter(Boolean).join(" ");
+    throw new AuthioCliError("api_error", `Authio answered ${response.status}${envelope.errorCode ? ` (${envelope.errorCode})` : ""}${detail ? `: ${detail}` : "."}`);
+  }
+  return envelope.data;
+}
+async function redeemTicket(fetcher, api, ticket, nextMajor) {
+  const redemption = await post(fetcher, api, "/api/v1/integration-plans/redeem", { ticket, nextMajor }, "ticket_invalid");
+  return { ...redemption, plan: normalizePlan(redemption.plan) };
+}
+function checkVerification(fetcher, api, verification) {
+  return post(fetcher, api, "/api/v1/integration-plans/verify", { verification }, "verification_invalid");
+}
+var IGNORED_PATHS = [".env.local", ".authio/"];
+function patternCovers(pattern, path) {
+  const trimmed = pattern.trim();
+  if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("!")) return false;
+  const bare = trimmed.replace(/^\//, "");
+  const wantsDirectory = path.endsWith("/");
+  const name = path.replace(/\/$/, "");
+  if (bare.endsWith("/") && !wantsDirectory) return false;
+  const glob = bare.replace(/\/$/, "");
+  if (glob.includes("/")) return false;
+  const expression = new RegExp(`^${glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
+  return expression.test(name);
+}
+function uncoveredPaths(path) {
+  const patterns = existsSync(path) ? readFileSync(path, "utf8").split(/\r?\n/) : [];
+  return IGNORED_PATHS.filter((ignored) => !patterns.some((pattern) => patternCovers(pattern, ignored)));
+}
+var isDirectory = (path) => existsSync(path) && statSync(path).isDirectory();
+function majorOf(range) {
+  const match = /(\d+)/.exec(range ?? "");
+  return match ? Number(match[1]) : void 0;
+}
+function detectProject(root) {
+  const manifestPath = join(root, "package.json");
+  if (!existsSync(manifestPath))
+    throw new AuthioCliError("project_not_found", `No package.json in ${root}. Run the command in your Next.js project folder, or pass --cwd.`);
+  let manifest2;
+  try {
+    manifest2 = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (cause) {
+    throw new AuthioCliError("project_not_found", `${manifestPath} could not be read as JSON.`, { cause });
+  }
+  const dependencies = { ...manifest2.devDependencies, ...manifest2.dependencies };
+  const nextMajor = majorOf(dependencies.next);
+  if (nextMajor === void 0)
+    throw new AuthioCliError("stack_not_detected", "This project does not depend on next. The plan this CLI applies is for Next.js with the App Router and Auth.js v5; for another stack, follow the client's guide in the console.");
+  const nextAuthMajor = majorOf(dependencies["next-auth"]);
+  if (nextAuthMajor !== void 0 && nextAuthMajor < 5)
+    throw new AuthioCliError("nextauth_v4_unsupported", `This project uses next-auth ${dependencies["next-auth"]}. The plan is written for Auth.js v5; follow the NextAuth v4 recipe in the client's guide instead.`);
+  const srcDir = isDirectory(join(root, "src", "app"));
+  const appDir = srcDir || isDirectory(join(root, "app"));
+  if (!appDir) {
+    const pages = isDirectory(join(root, "pages")) || isDirectory(join(root, "src", "pages"));
+    throw new AuthioCliError(
+      pages ? "pages_router_unsupported" : "stack_not_detected",
+      pages ? "This project uses the pages router. The plan is written for the App Router; follow the client's guide in the console instead." : "No app/ or src/app/ folder was found. Create the App Router folder first, or run the command in the app's folder."
+    );
+  }
+  const packageManager = existsSync(join(root, "pnpm-lock.yaml")) ? "pnpm" : existsSync(join(root, "yarn.lock")) ? "yarn" : existsSync(join(root, "bun.lockb")) || existsSync(join(root, "bun.lock")) ? "bun" : "npm";
+  const port = /(?:^|\s)(?:-p|--port)(?:\s+|=)(\d{2,5})(?:\s|$)/.exec(manifest2.scripts?.dev ?? "");
+  return { root, nextMajor, srcDir, packageManager, devPort: port ? Number(port[1]) : 3e3 };
+}
+
+// src/init.ts
+var VERIFICATION_FILE = join(".authio", "verification");
+function installCommand(manager, specs) {
+  return manager === "npm" ? ["npm", ["install", ...specs]] : [manager, ["add", ...specs]];
+}
+function envLine(name, value) {
+  return value.includes('"') ? `${name}='${value}'` : `${name}="${value}"`;
+}
+function describe(io, project, plan, changes) {
+  io.print("");
+  io.print(`Authio plan for client "${plan.client}" in realm "${plan.realm}" (${plan.stack})`);
+  io.print(`Project: Next.js ${project.nextMajor}${project.srcDir ? ", src/ folder" : ""}, ${project.packageManager}`);
+  io.print("");
+  for (const file of changes.files) {
+    io.print(file.action === "create" ? `  + ${file.path}` : `  ! ${file.path} already exists: left as it is, merge it by hand`);
+    for (const line of file.content.split(/\r?\n/)) io.print(`      ${line}`);
+  }
+  io.print("");
+  io.print("  .env.local");
+  for (const variable of changes.environment) {
+    const how = variable.source === "secret" ? "asked for, hidden" : variable.source === "generate" ? "generated on this machine" : variable.value ?? "";
+    io.print(`      + ${variable.name}  ${variable.source === "plan" ? `= ${how}` : `(${how})`}`);
+  }
+  for (const name of changes.keptEnvironment) io.print(`      = ${name}  (already set, kept)`);
+  if (plan.packages.length > 0) io.print(`
+  Packages: ${plan.packages.map((item) => `${item.name}@${item.version}`).join(" ")}`);
+  if (!changes.redirectRegistered)
+    io.print(`
+  Warning: the client does not register ${changes.localRedirect}. Sign-in will fail until you add it as a redirect URI on the client in the Authio console.`);
+  if (!plan.clientActive) io.print("\n  Warning: this client is inactive or in quarantine in Authio, so sign-in is refused until it is active again.");
+  io.print("");
+}
+async function valueOf(io, variable, emptySecrets) {
+  if (variable.source === "plan") return variable.value ?? "";
+  if (variable.source === "generate") return randomBytes(32).toString("base64");
+  if (!io.isInteractive) {
+    emptySecrets.push(variable.name);
+    return "";
+  }
+  const typed = (await io.promptSecret(`${variable.name}${variable.comment ? ` (${variable.comment})` : ""}, hidden, Enter to leave empty: `)).trim();
+  if (!typed) emptySecrets.push(variable.name);
+  return typed;
+}
+async function runInit(options, io) {
+  const result = { exitCode: 0, created: [], toMerge: [], addedEnvironment: [], emptySecrets: [], plan: void 0 };
+  const ticket = options.ticket?.trim();
+  if (!ticket)
+    throw new AuthioCliError("ticket_missing", "No code given. Open the client's guide in the Authio console, choose Next.js \xB7 Auth.js v5 and press Generate command.");
+  const project = detectProject(options.cwd);
+  if (!options.dryRun && !options.yes && !io.isInteractive)
+    throw new AuthioCliError("confirmation_required", "There is no terminal to confirm in. Run with --yes to apply the plan, or --dry-run to see it first.");
+  const redemption = await redeemTicket(io.fetch, options.api, ticket, project.nextMajor);
+  const plan = redemption.plan;
+  result.plan = plan;
+  assertPlanVersion(plan);
+  const changes = planChanges(project, plan);
+  result.toMerge = changes.files.filter((file) => file.action === "merge").map((file) => file.path);
+  describe(io, project, plan, changes);
+  if (options.dryRun) {
+    io.print("Dry run: nothing was written. The code is used up; generate another command to apply the plan.");
+    return result;
+  }
+  const creating = changes.files.filter((file) => file.action === "create");
+  const agreed = options.yes || await io.confirm(`Create ${creating.length} file(s) and add ${changes.environment.length} variable(s) to .env.local?`, true);
+  if (!agreed) {
+    io.print("Nothing was written.");
+    result.exitCode = 2;
+    return result;
+  }
+  const lines = [];
+  for (const variable of changes.environment) {
+    const value = await valueOf(io, variable, result.emptySecrets);
+    if (variable.comment) lines.push(`# ${variable.comment}`);
+    lines.push(envLine(variable.name, value));
+    result.addedEnvironment.push(variable.name);
+  }
+  for (const file of creating) {
+    mkdirSync(dirname(file.target), { recursive: true });
+    writeFileSync(file.target, file.content.endsWith("\n") ? file.content : `${file.content}
+`, { flag: "wx" });
+    result.created.push(file.path);
+  }
+  if (lines.length > 0) {
+    const envPath = join(project.root, ".env.local");
+    const current = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+    const separator = current && !current.endsWith("\n") ? "\n" : "";
+    appendFileSync(envPath, `${separator}${current ? "\n" : ""}# Added by @hyper.authio/cli for the Authio client "${plan.client}"
+${lines.join("\n")}
+`);
+  }
+  const gitignorePath = join(project.root, ".gitignore");
+  const missing = uncoveredPaths(gitignorePath);
+  if (missing.length > 0 && (options.yes || await io.confirm(`Add ${missing.join(" and ")} to .gitignore so they are never committed?`, true))) {
+    const current = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf8") : "";
+    appendFileSync(gitignorePath, `${current && !current.endsWith("\n") ? "\n" : ""}${missing.join("\n")}
+`);
+  } else if (missing.length > 0) {
+    io.print(`Warning: ${missing.join(" and ")} ${missing.length > 1 ? "are" : "is"} not in .gitignore. Never commit ${IGNORED_PATHS.join(" or ")}.`);
+  }
+  const verificationPath = join(project.root, VERIFICATION_FILE);
+  mkdirSync(dirname(verificationPath), { recursive: true });
+  writeFileSync(verificationPath, JSON.stringify({ api: options.api, verification: redemption.verification, expiresAt: redemption.verificationExpiresAt }), {
+    mode: 384
+  });
+  try {
+    chmodSync(verificationPath, 384);
+  } catch {
+  }
+  if (plan.packages.length > 0) {
+    const [command, args] = installCommand(project.packageManager, plan.packages.map((item) => `${item.name}@${item.version}`));
+    const install = options.yes || await io.confirm(`Install ${plan.packages.map((item) => item.name).join(", ")} with ${command}?`, true);
+    if (install) {
+      const code = await io.run(command, args, project.root);
+      if (code !== 0) io.print(`The install failed (exit ${code}). Run it yourself: ${command} ${args.join(" ")}`);
+    } else {
+      io.print(`Install them when you are ready: ${command} ${args.join(" ")}`);
+    }
+  }
+  io.print("");
+  io.print(`Created: ${result.created.length > 0 ? result.created.join(", ") : "nothing"}`);
+  if (result.toMerge.length > 0) io.print(`Merge by hand: ${result.toMerge.join(", ")} (the plan's version is printed above)`);
+  if (result.emptySecrets.length > 0) io.print(`Fill in .env.local: ${result.emptySecrets.join(", ")}`);
+  io.print(`Next: start the app, sign in, then run "npx @hyper.authio/cli verify".`);
+  return result;
+}
+var VERIFY_INTERVAL_MS = 3e3;
+function readSaved(cwd) {
+  const path = join(cwd, VERIFICATION_FILE);
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function runVerify(options, io) {
+  const saved = readSaved(options.cwd);
+  const verification = options.verification ?? saved.verification;
+  const api = options.api ?? saved.api ?? options.defaultApi;
+  if (!verification)
+    throw new AuthioCliError("verification_missing", `No verification found. Run "authio init" first, or pass --verification.`);
+  const expiresAt = saved.expiresAt && !options.verification ? Date.parse(saved.expiresAt) : Number.NaN;
+  if (options.wait) io.print("Waiting for the first sign-in through the app (Ctrl+C to stop)\u2026");
+  for (; ; ) {
+    const answer = await checkVerification(io.fetch, api, verification);
+    if (answer.signedIn) {
+      io.print(`Signed in: the first sign-in arrived${answer.firstSignInAt ? ` at ${answer.firstSignInAt}` : ""}. The integration works.`);
+      return { exitCode: 0, firstSignInAt: answer.firstSignInAt };
+    }
+    if (!options.wait || !Number.isNaN(expiresAt) && io.now() + VERIFY_INTERVAL_MS >= expiresAt) {
+      io.print("No sign-in has arrived yet. Start the app, sign in, and run this again (or add --wait).");
+      return { exitCode: 2, firstSignInAt: null };
+    }
+    await io.sleep(VERIFY_INTERVAL_MS);
+  }
+}
+
+// src/main.ts
+async function main(argv, io, environment, version) {
+  try {
+    const args = parseArguments(argv);
+    const cwd = resolve(args.cwd ?? ".");
+    if (args.command === "help") {
+      io.print(HELP);
+      return 0;
+    }
+    if (args.command === "version") {
+      io.print(version);
+      return 0;
+    }
+    if (args.command === "init") {
+      const result2 = await runInit(
+        { ticket: args.ticket ?? environment.AUTHIO_TICKET, api: apiAddress(args.api), cwd, dryRun: args.dryRun, yes: args.yes },
+        io
+      );
+      return result2.exitCode;
+    }
+    const result = await runVerify(
+      { verification: args.verification, api: args.api ? apiAddress(args.api) : void 0, defaultApi: DEFAULT_API, cwd, wait: args.wait },
+      io
+    );
+    return result.exitCode;
+  } catch (error) {
+    if (error instanceof AuthioCliError) {
+      io.print(`Error (${error.code}): ${error.message}`);
+      return error.exitCode;
+    }
+    io.print(error instanceof Error ? error.stack ?? error.message : String(error));
+    return 1;
+  }
+}
+
+// src/cli.ts
+var manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+process.exitCode = await main(process.argv.slice(2), createTerminalIo(), process.env, manifest.version);
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map