@idapt/cli 1.8.0

package/dist/bin.js

@@ -0,0 +1,928 @@
+#!/usr/bin/env node
+import { createFetchTransport, execute, autoMode, commandsForResource, findCommand, renderHelp, listResources, renderInstructions, quoteToken } from './chunk-WNQCFPPN.js';
+import { readFileSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'fs';
+import { spawn } from 'child_process';
+import { dirname, join } from 'path';
+import { homedir } from 'os';
+import { createServer } from 'http';
+import { randomBytes, createHash } from 'crypto';
+
+// src/version.ts
+var VERSION = "1.8.0";
+var USER_AGENT = `idapt-cli/${VERSION}`;
+function canOpenBrowser(env, isTty) {
+  if (!isTty) return false;
+  if (env.SSH_CONNECTION || env.SSH_TTY) return false;
+  if (process.platform === "linux") {
+    return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+  }
+  return true;
+}
+function openBrowser(url) {
+  try {
+    const platform = process.platform;
+    const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var APP_DIR = "idapt";
+function configBase() {
+  const home = homedir();
+  if (process.platform === "win32") {
+    return process.env.APPDATA ?? join(home, "AppData", "Roaming");
+  }
+  if (process.platform === "darwin") {
+    return join(home, "Library", "Application Support");
+  }
+  return process.env.XDG_CONFIG_HOME ?? join(home, ".config");
+}
+function cacheBase() {
+  const home = homedir();
+  if (process.platform === "win32") {
+    return process.env.LOCALAPPDATA ?? join(home, "AppData", "Local");
+  }
+  if (process.platform === "darwin") {
+    return join(home, "Library", "Caches");
+  }
+  return process.env.XDG_CACHE_HOME ?? join(home, ".cache");
+}
+function configDir() {
+  return join(configBase(), APP_DIR);
+}
+function cacheDir() {
+  return join(cacheBase(), APP_DIR);
+}
+
+// src/auth/credentials.ts
+function credentialsPath() {
+  return join(configDir(), "cli-auth.json");
+}
+function loadCredentials(path = credentialsPath()) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function saveCredentials(creds, path = credentialsPath()) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearCredentials(path = credentialsPath()) {
+  try {
+    rmSync(path);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function hasOAuth(creds) {
+  return Boolean(creds.refreshToken);
+}
+function base64url(b) {
+  return b.toString("base64url");
+}
+function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function randomState() {
+  return base64url(randomBytes(16));
+}
+
+// src/auth/oauth.ts
+var AUTHORIZE_PATH = "/api/auth/oauth2/authorize";
+var TOKEN_PATH = "/api/auth/oauth2/token";
+var DEVICE_CODE_PATH = "/api/auth/device/code";
+var DEVICE_TOKEN_PATH = "/api/auth/device/token";
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var CLI_CLIENT_ID = "idapt-cli";
+var SCOPE = "openid profile email offline_access";
+var RESOURCE = "idapt-api";
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var AuthError = class extends Error {
+};
+var ERR_ACCESS_DENIED = "the login request was denied";
+var ERR_STATE_MISMATCH = "login state mismatch \u2014 please try again";
+var ERR_TIMED_OUT = "timed out waiting for browser sign-in";
+var ERR_SESSION_EXPIRED = "your session has expired \u2014 run `idapt login` again";
+function trimRight(s) {
+  return s.replace(/\/+$/, "");
+}
+function originOf(baseUrl) {
+  const u = new URL(baseUrl);
+  return `${u.protocol}//${u.host}`;
+}
+async function postToken(baseUrl, form, userAgent) {
+  const base = trimRight(baseUrl);
+  const res = await fetch(base + TOKEN_PATH, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      Origin: originOf(base),
+      "User-Agent": userAgent
+    },
+    body: new URLSearchParams(form).toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token) {
+    if (body.error === "invalid_grant")
+      throw new AuthError(ERR_SESSION_EXPIRED);
+    const msg = body.error_description || body.error || `HTTP ${res.status}`;
+    throw new AuthError(`token request failed (${res.status}): ${msg}`);
+  }
+  return {
+    accessToken: body.access_token,
+    refreshToken: body.refresh_token ?? "",
+    expiresIn: body.expires_in ?? 0
+  };
+}
+var CALLBACK_OK = `<!doctype html><html><head><meta charset="utf-8"><title>Signed in</title></head><body style="font-family:system-ui;text-align:center;padding-top:4rem"><h1>You're signed in</h1><p>Return to your terminal \u2014 you can close this tab.</p></body></html>`;
+var CALLBACK_ERR = `<!doctype html><html><head><meta charset="utf-8"><title>Sign-in failed</title></head><body style="font-family:system-ui;text-align:center;padding-top:4rem"><h1>Sign-in failed</h1><p>Return to your terminal and run <code>idapt login</code> again.</p></body></html>`;
+function loginAuthCode(io) {
+  const base = trimRight(io.baseUrl);
+  const { verifier, challenge } = generatePkce();
+  const state = randomState();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      io.signal?.removeEventListener("abort", onAbort);
+      server.close();
+      fn();
+    };
+    const onAbort = () => finish(() => reject(new AuthError("sign-in cancelled")));
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const q = url.searchParams;
+      const err = q.get("error");
+      if (err) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(CALLBACK_ERR);
+        finish(
+          () => reject(
+            new AuthError(
+              err === "access_denied" ? ERR_ACCESS_DENIED : `sign-in failed: ${err}`
+            )
+          )
+        );
+        return;
+      }
+      if (q.get("state") !== state) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(CALLBACK_ERR);
+        finish(() => reject(new AuthError(ERR_STATE_MISMATCH)));
+        return;
+      }
+      const code = q.get("code");
+      if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(CALLBACK_ERR);
+        finish(
+          () => reject(
+            new AuthError("the sign-in response had no authorization code")
+          )
+        );
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" }).end(CALLBACK_OK);
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      postToken(
+        base,
+        {
+          grant_type: "authorization_code",
+          client_id: CLI_CLIENT_ID,
+          code,
+          code_verifier: verifier,
+          redirect_uri: redirectUri,
+          resource: RESOURCE
+        },
+        io.userAgent
+      ).then(
+        (tok) => finish(() => resolve(tok)),
+        (e) => finish(() => reject(e))
+      );
+    });
+    let port = 0;
+    const timer = setTimeout(
+      () => finish(() => reject(new AuthError(ERR_TIMED_OUT))),
+      LOGIN_TIMEOUT_MS
+    );
+    io.signal?.addEventListener("abort", onAbort);
+    server.on("error", (e) => finish(() => reject(e)));
+    server.listen(0, "127.0.0.1", () => {
+      port = server.address().port;
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+      const authzUrl = `${base}${AUTHORIZE_PATH}?` + new URLSearchParams({
+        response_type: "code",
+        client_id: CLI_CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: SCOPE,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256"
+      }).toString();
+      io.out("");
+      const opened = io.open?.(authzUrl) ?? false;
+      io.out(
+        opened ? `Opening your browser to sign in\u2026
+
+If it doesn't open, visit:
+
+    ${authzUrl}
+` : `To finish signing in, open this URL in your browser:
+
+    ${authzUrl}
+`
+      );
+      io.out("Waiting for sign-in\u2026 (Ctrl-C to cancel)");
+    });
+  });
+}
+var sleep = (ms, signal) => new Promise((resolve, reject) => {
+  const t = setTimeout(resolve, ms);
+  signal?.addEventListener("abort", () => {
+    clearTimeout(t);
+    reject(new AuthError("sign-in cancelled"));
+  });
+});
+async function loginDevice(io) {
+  const base = trimRight(io.baseUrl);
+  const codeRes = await fetch(base + DEVICE_CODE_PATH, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Origin: originOf(base),
+      "User-Agent": io.userAgent
+    },
+    body: JSON.stringify({ client_id: CLI_CLIENT_ID })
+  });
+  if (!codeRes.ok) {
+    throw new AuthError(
+      `could not start device login (HTTP ${codeRes.status})`
+    );
+  }
+  const code = await codeRes.json();
+  if (!code.device_code || !code.user_code) {
+    throw new AuthError(
+      "the server returned an incomplete login-code response"
+    );
+  }
+  io.out("");
+  if (code.verification_uri_complete) {
+    io.out(
+      `To finish signing in, open this URL in your browser:
+
+    ${code.verification_uri_complete}
+
+(it confirms code ${code.user_code})`
+    );
+  } else {
+    io.out(
+      `To finish signing in, open:
+
+    ${code.verification_uri}
+
+and enter the code:  ${code.user_code}`
+    );
+  }
+  io.out("\nWaiting for approval\u2026 (Ctrl-C to cancel)");
+  let interval = code.interval > 0 ? code.interval : 5;
+  const deadline = Date.now() + (code.expires_in > 0 ? code.expires_in : 900) * 1e3;
+  for (; ; ) {
+    await sleep(interval * 1e3, io.signal);
+    if (Date.now() > deadline) {
+      throw new AuthError("the login code expired before it was approved");
+    }
+    const res = await fetch(base + DEVICE_TOKEN_PATH, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Origin: originOf(base),
+        "User-Agent": io.userAgent
+      },
+      body: JSON.stringify({
+        grant_type: DEVICE_GRANT,
+        device_code: code.device_code,
+        client_id: CLI_CLIENT_ID
+      })
+    });
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body.access_token) return body.access_token;
+    switch (body.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "expired_token":
+        throw new AuthError("the login code expired before it was approved");
+      case "access_denied":
+        throw new AuthError(ERR_ACCESS_DENIED);
+      default:
+        throw new AuthError(`device login failed (HTTP ${res.status})`);
+    }
+  }
+}
+function refreshAccessToken(baseUrl, refreshToken, userAgent) {
+  return postToken(
+    baseUrl,
+    {
+      grant_type: "refresh_token",
+      client_id: CLI_CLIENT_ID,
+      refresh_token: refreshToken,
+      resource: RESOURCE
+    },
+    userAgent
+  );
+}
+
+// src/auth/resolve.ts
+var SKEW_SECONDS = 60;
+async function resolveCredential(opts) {
+  if (opts.apiKeyFlag) {
+    return { token: opts.apiKeyFlag, source: "flag", kind: "api-key" };
+  }
+  const envKey = opts.env.IDAPT_API_KEY;
+  if (envKey) return { token: envKey, source: "env", kind: "api-key" };
+  const creds = loadCredentials();
+  if (hasOAuth(creds)) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (creds.accessToken && creds.expiresAt && creds.expiresAt - now > SKEW_SECONDS) {
+      return { token: creds.accessToken, source: "file", kind: "oauth" };
+    }
+    const tok = await refreshAccessToken(
+      opts.baseUrl,
+      // hasOAuth guarantees refreshToken is set.
+      creds.refreshToken,
+      opts.userAgent
+    );
+    const updated = {
+      accessToken: tok.accessToken,
+      refreshToken: tok.refreshToken || creds.refreshToken,
+      expiresAt: now + (tok.expiresIn || 900)
+    };
+    saveCredentials(updated);
+    return { token: tok.accessToken, source: "file", kind: "oauth" };
+  }
+  if (creds.apiKey)
+    return { token: creds.apiKey, source: "file", kind: "api-key" };
+  return null;
+}
+
+// src/auth/commands.ts
+var AUTH_HINT = `Not signed in.
+
+Sign in in your browser (recommended):
+  idapt login
+
+On a headless machine / over SSH (device code):
+  idapt login --device
+
+Or paste an API key (get one from https://idapt.app/settings/api-keys):
+  printf '%s' "$KEY" | idapt login --api-key-stdin
+  export IDAPT_API_KEY=<key>        # or via env (CI / sudo)`;
+async function fetchIdentity(baseUrl, token) {
+  try {
+    const t = createFetchTransport({ baseUrl, token, userAgent: USER_AGENT });
+    const res = await t.request({ method: "GET", path: "/api/v1/me" });
+    if (res.status !== 200) return null;
+    const data = res.json?.data ?? {};
+    const email = data.userEmail ?? data.email;
+    const name = data.userName ?? data.name;
+    return { email: email ?? void 0, name: name ?? void 0 };
+  } catch {
+    return null;
+  }
+}
+async function announceSignedIn(ctx, token) {
+  const id = await fetchIdentity(ctx.baseUrl, token);
+  if (id?.email) {
+    ctx.out(`
+\u2713 Signed in as ${id.email}${id.name ? ` (${id.name})` : ""}.`);
+  } else {
+    ctx.out("\n\u2713 Signed in.");
+  }
+}
+async function runLogin(ctx, opts) {
+  if (opts.apiKeyStdin) {
+    const key = (ctx.readStdin ?? (() => readFileSync(0, "utf8")))().trim();
+    if (!key) {
+      ctx.out("idapt login: no API key on stdin.");
+      return 1;
+    }
+    saveCredentials({ apiKey: key });
+    await announceSignedIn(ctx, key);
+    return 0;
+  }
+  const useDevice = opts.device || !opts.web && !canOpenBrowser(ctx.env, ctx.isTty);
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  try {
+    if (useDevice) {
+      const sessionToken = await loginDevice({
+        out: ctx.out,
+        baseUrl: ctx.baseUrl,
+        userAgent: USER_AGENT,
+        signal: controller.signal
+      });
+      saveCredentials({ apiKey: sessionToken });
+      await announceSignedIn(ctx, sessionToken);
+      return 0;
+    }
+    const tokens = await loginAuthCode({
+      out: ctx.out,
+      baseUrl: ctx.baseUrl,
+      userAgent: USER_AGENT,
+      open: openBrowser,
+      signal: controller.signal
+    });
+    const creds = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Math.floor(Date.now() / 1e3) + (tokens.expiresIn || 900)
+    };
+    saveCredentials(creds);
+    await announceSignedIn(ctx, tokens.accessToken);
+    return 0;
+  } catch (err) {
+    ctx.out(`
+\u2717 ${err.message}`);
+    return 1;
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+function runLogout(ctx) {
+  clearCredentials();
+  ctx.out("Signed out \u2014 cleared the stored credential.");
+  return 0;
+}
+async function runStatus(ctx) {
+  const resolved = await resolveCredential({
+    apiKeyFlag: ctx.apiKeyFlag,
+    env: ctx.env,
+    baseUrl: ctx.baseUrl,
+    userAgent: USER_AGENT
+  }).catch(() => null);
+  if (!resolved) {
+    ctx.print(AUTH_HINT);
+    return 1;
+  }
+  const lines = [
+    `API URL:  ${ctx.baseUrl}`,
+    `Source:   ${resolved.source}`,
+    `Kind:     ${resolved.kind}`
+  ];
+  if (resolved.kind === "oauth") {
+    const creds = loadCredentials();
+    if (creds.expiresAt) {
+      const secs = creds.expiresAt - Math.floor(Date.now() / 1e3);
+      lines.push(
+        `Token:    ${secs > 0 ? `valid (${Math.max(0, Math.round(secs / 60))} min left)` : "expired (auto-refreshes on next call)"}`
+      );
+    }
+  }
+  const id = await fetchIdentity(ctx.baseUrl, resolved.token);
+  if (!id) {
+    ctx.print(lines.join("\n"));
+    ctx.out("\n\u2717 Credential is invalid or expired \u2014 run `idapt login`.");
+    return 1;
+  }
+  lines.unshift(
+    `Signed in as ${id.email ?? "(unknown)"}${id.name ? ` (${id.name})` : ""}`,
+    ""
+  );
+  ctx.print(lines.join("\n"));
+  return 0;
+}
+
+// src/doc.ts
+function helpIndex() {
+  const resources = listResources().sort().join(", ");
+  return [
+    `idapt ${VERSION} \u2014 your AI workspace, from the terminal`,
+    "",
+    "Usage:",
+    "  idapt <resource> <verb> [args]     Run a command (e.g. idapt drive list)",
+    "  idapt help [resource [verb]]       Show a command's contract",
+    "  idapt instructions [resource]      Show a resource's playbook",
+    "  idapt login | logout | whoami      Authenticate",
+    "  idapt upgrade                      Update to the latest version",
+    "",
+    "Global flags:",
+    "  -o, --output <table|json|jsonl|quiet>   Output format (TTY\u2192table, pipe\u2192json)",
+    "  --api-key <key>                          Bearer token (or IDAPT_API_KEY env)",
+    "  --api-url <url>                           API base URL (or IDAPT_API_URL env)",
+    "",
+    "Resources:",
+    `  ${resources}`,
+    "",
+    "Auth: browser sign-in (`idapt login`) or paste a key (IDAPT_API_KEY).",
+    "Docs: https://idapt.app/cli"
+  ].join("\n");
+}
+function resourceHelp(resource, cmds) {
+  const rows = cmds.map((c) => `  ${c.verb.padEnd(16)} ${c.summary ?? ""}`.trimEnd()).join("\n");
+  return [
+    `idapt ${resource} \u2014 commands`,
+    "",
+    rows,
+    "",
+    `Run \`idapt help ${resource} <verb>\` for a command's full contract,`,
+    `or \`idapt instructions ${resource}\` for the playbook.`
+  ].join("\n");
+}
+function renderHelpDoc(tokens) {
+  if (tokens.length === 0) return helpIndex();
+  if (tokens.length === 1) {
+    const resource = tokens[0];
+    const cmds2 = commandsForResource(resource);
+    if (cmds2.length === 0) {
+      return `Unknown resource "${resource}".
+
+${helpIndex()}`;
+    }
+    return resourceHelp(resource, cmds2);
+  }
+  const command = `${tokens[0]} ${tokens[1]}`;
+  const spec = findCommand(command);
+  if (spec) return renderHelp(spec);
+  const cmds = commandsForResource(tokens[0]);
+  if (cmds.length > 0) {
+    return `Unknown command "${command}".
+
+${resourceHelp(tokens[0], cmds)}`;
+  }
+  return `Unknown command "${command}".
+
+${helpIndex()}`;
+}
+function renderInstructionsDoc(tokens) {
+  if (tokens.length === 0) {
+    return [
+      "idapt instructions \u2014 resource playbooks",
+      "",
+      "Instructions are RESOURCE-SCOPED. Run `idapt instructions <resource>`:",
+      `  ${listResources().sort().join(", ")}`
+    ].join("\n");
+  }
+  return renderInstructions(tokens[0]);
+}
+var PACKAGE_NAME = "@idapt/cli";
+var REGISTRY = "https://registry.npmjs.org";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function statePath() {
+  return join(cacheDir(), "cli-update-check.json");
+}
+function loadState() {
+  try {
+    return JSON.parse(readFileSync(statePath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveState(s) {
+  try {
+    mkdirSync(cacheDir(), { recursive: true });
+    writeFileSync(statePath(), JSON.stringify(s));
+  } catch {
+  }
+}
+function isNewer(latest, current) {
+  const norm = (v) => v.replace(/^v/, "").split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const a = norm(latest);
+  const b = norm(current);
+  for (let i = 0; i < 3; i++) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    if (x > y) return true;
+    if (x < y) return false;
+  }
+  return false;
+}
+async function fetchDistTag(tag = "latest", timeoutMs = 1500) {
+  try {
+    const res = await fetch(`${REGISTRY}/${encodeURIComponent(PACKAGE_NAME)}`, {
+      headers: { Accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return body["dist-tags"]?.[tag] ?? null;
+  } catch {
+    return null;
+  }
+}
+function disabled(env) {
+  return Boolean(env.CI || env.NO_UPDATE_NOTIFIER || env.IDAPT_NO_UPDATE_NUDGE);
+}
+async function maybeNotify(io) {
+  try {
+    if (!io.isTty || disabled(io.env)) return;
+    if (VERSION.includes("-dev")) return;
+    const now = Date.now();
+    const state = loadState();
+    if (!state.lastCheckAt || now - state.lastCheckAt > DAY_MS) {
+      const latest = await fetchDistTag("latest");
+      state.lastCheckAt = now;
+      if (latest) state.latest = latest;
+      saveState(state);
+    }
+    if (!state.latest || !isNewer(state.latest, VERSION)) return;
+    if (state.lastShownAt && now - state.lastShownAt < DAY_MS) return;
+    state.lastShownAt = now;
+    saveState(state);
+    io.stderr(
+      `
+  \u25C6 Update available: idapt ${VERSION} \u2192 ${state.latest}. Run \`idapt upgrade\`.
+`
+    );
+  } catch {
+  }
+}
+function detectManager(scriptPath, env, channel) {
+  const p = (scriptPath || "").replace(/\\/g, "/");
+  const tag = channel === "next" ? "@next" : "@latest";
+  const spec = `@idapt/cli${tag}`;
+  if (p.includes("/_npx/")) {
+    return {
+      kind: "manual",
+      command: `npm install -g ${spec}`,
+      reason: "you're running via npx"
+    };
+  }
+  if (process.versions.bun || p.includes("/.bun/")) {
+    return {
+      kind: "run",
+      name: "bun",
+      argv: ["bun", "add", "-g"],
+      pkgSpec: spec
+    };
+  }
+  const voltaHome = env.VOLTA_HOME?.replace(/\\/g, "/");
+  if (voltaHome && p.startsWith(voltaHome)) {
+    return {
+      kind: "run",
+      name: "volta",
+      argv: ["volta", "install"],
+      pkgSpec: channel === "next" ? "@idapt/cli@next" : "@idapt/cli"
+    };
+  }
+  if (p.includes("/pnpm/") || p.includes("/.pnpm/")) {
+    return {
+      kind: "run",
+      name: "pnpm",
+      argv: ["pnpm", "add", "-g"],
+      pkgSpec: spec
+    };
+  }
+  return {
+    kind: "run",
+    name: "npm",
+    argv: ["npm", "install", "-g"],
+    pkgSpec: spec
+  };
+}
+function spawnInherit(cmd, args) {
+  return new Promise((resolve) => {
+    const child = process.platform === "win32" ? spawn(process.env.ComSpec || "cmd.exe", ["/c", cmd, ...args], {
+      stdio: "inherit"
+    }) : spawn(cmd, args, { stdio: "inherit" });
+    child.on("error", () => resolve(127));
+    child.on("close", (code) => resolve(code ?? 0));
+  });
+}
+async function runUpgrade(io, opts) {
+  const channel = opts.next ? "next" : "latest";
+  const latest = await fetchDistTag(channel, 5e3);
+  if (opts.check) {
+    if (!latest) {
+      io.stderr("idapt: could not reach the npm registry.\n");
+      return 1;
+    }
+    io.stdout(
+      isNewer(latest, VERSION) ? `Update available: idapt ${VERSION} \u2192 ${latest}. Run \`idapt upgrade\`.
+` : `idapt ${VERSION} is up to date (${channel}).
+`
+    );
+    return 0;
+  }
+  if (latest && channel === "latest" && !isNewer(latest, VERSION)) {
+    io.stdout(`idapt ${VERSION} is already up to date.
+`);
+    return 0;
+  }
+  const det = detectManager(process.argv[1] ?? "", io.env, channel);
+  if (det.kind === "manual") {
+    io.stdout(`To update (${det.reason}), run:
+  ${det.command}
+`);
+    return 0;
+  }
+  const args = [...det.argv.slice(1), det.pkgSpec];
+  const cmdline = [det.argv[0], ...args].join(" ");
+  io.stderr(`Updating idapt via ${det.name}\u2026  (${cmdline})
+`);
+  const code = await spawnInherit(det.argv[0], args);
+  if (code !== 0) {
+    io.stderr(
+      `
+Automatic update failed (exit ${code}). Run it manually:
+  ${cmdline}
+`
+    );
+    return code;
+  }
+  io.stdout("\n\u2713 Updated. Run `idapt version` to confirm.\n");
+  return 0;
+}
+
+// src/bin.ts
+var DEFAULT_BASE_URL = "https://idapt.app";
+var OUTPUT_MODES = /* @__PURE__ */ new Set(["json", "jsonl", "table", "quiet"]);
+function extractOutputMode(argv) {
+  const rest = [];
+  let mode;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--output" || a === "-o") {
+      const v = argv[++i];
+      if (v && OUTPUT_MODES.has(v)) mode = v;
+      continue;
+    }
+    const inline = a.startsWith("--output=") ? a.slice("--output=".length) : null;
+    if (inline && OUTPUT_MODES.has(inline)) {
+      mode = inline;
+      continue;
+    }
+    rest.push(a);
+  }
+  return { mode, rest };
+}
+function extractValueFlag(argv, name) {
+  const rest = [];
+  let value;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === name) {
+      value = argv[++i];
+      continue;
+    }
+    if (a.startsWith(`${name}=`)) {
+      value = a.slice(name.length + 1);
+      continue;
+    }
+    rest.push(a);
+  }
+  return { value, rest };
+}
+function buildCommandFromArgv(argv) {
+  return ["idapt", ...argv.map(quoteToken)].join(" ");
+}
+function isDocCommand(rest) {
+  if (rest[0] === "help" || rest[0] === "instructions") return true;
+  return rest.some(
+    (a) => a === "--help" || a === "-h" || a === "--instructions"
+  );
+}
+function authCtx(io, baseUrl, apiKeyFlag) {
+  return {
+    out: io.stderr,
+    print: io.stdout,
+    env: io.env,
+    isTty: io.isTty,
+    baseUrl,
+    apiKeyFlag
+  };
+}
+async function run(io) {
+  const { mode: requested, rest: r1 } = extractOutputMode(io.argv);
+  const { value: apiKeyFlag, rest: r2 } = extractValueFlag(r1, "--api-key");
+  const { value: apiUrlFlag, rest } = extractValueFlag(r2, "--api-url");
+  const baseUrl = apiUrlFlag ?? io.env.IDAPT_API_URL ?? DEFAULT_BASE_URL;
+  const cmd = rest[0];
+  if (cmd === "version" || cmd === "--version") {
+    io.stdout(`idapt ${VERSION}
+`);
+    return 0;
+  }
+  if (rest.length === 0) {
+    io.stderr("idapt: missing command. Try `idapt help`.\n");
+    return 1;
+  }
+  if (cmd === "help") {
+    io.stdout(`${renderHelpDoc(rest.slice(1))}
+`);
+    return 0;
+  }
+  if (cmd === "instructions") {
+    io.stdout(`${renderInstructionsDoc(rest.slice(1))}
+`);
+    return 0;
+  }
+  if (cmd === "upgrade" || cmd === "update") {
+    return runUpgrade(
+      { stdout: io.stdout, stderr: io.stderr, env: io.env },
+      { check: rest.includes("--check"), next: rest.includes("--next") }
+    );
+  }
+  const ctx = authCtx(io, baseUrl, apiKeyFlag);
+  if (cmd === "login") {
+    return runLogin(ctx, parseLoginOpts(rest.slice(1)));
+  }
+  if (cmd === "logout") {
+    return runLogout(ctx);
+  }
+  if (cmd === "whoami") {
+    return runStatus(ctx);
+  }
+  if (cmd === "auth") {
+    const sub = rest[1];
+    if (sub === "login") return runLogin(ctx, parseLoginOpts(rest.slice(2)));
+    if (sub === "logout") return runLogout(ctx);
+    if (sub === "status") return runStatus(ctx);
+    io.stderr(
+      "idapt auth: use `login`, `logout`, or `status` (alias: `idapt whoami`).\n"
+    );
+    return 1;
+  }
+  const doc = isDocCommand(rest);
+  let token;
+  const resolved = await resolveCredential({
+    apiKeyFlag,
+    env: io.env,
+    baseUrl,
+    userAgent: USER_AGENT
+  }).catch(() => null);
+  if (resolved) {
+    token = resolved.token;
+  } else if (doc) {
+    token = "";
+  } else {
+    io.stderr(`${AUTH_HINT}
+`);
+    return 1;
+  }
+  const transport = createFetchTransport({
+    baseUrl,
+    token,
+    userAgent: USER_AGENT
+  });
+  const result = await execute(buildCommandFromArgv(rest), {
+    transport,
+    mode: autoMode(io.isTty, requested)
+  });
+  if (result.ok) io.stdout(`${result.rendered}
+`);
+  else io.stderr(`${result.error ?? result.rendered}
+`);
+  await maybeNotify({ stderr: io.stderr, env: io.env, isTty: io.isTty });
+  return result.ok ? 0 : 1;
+}
+function parseLoginOpts(args) {
+  return {
+    device: args.includes("--device"),
+    web: args.includes("--web"),
+    apiKeyStdin: args.includes("--api-key-stdin")
+  };
+}
+function isCliEntrypoint(entryPath) {
+  if (!entryPath) return false;
+  return /bin(\.[cm]?[jt]s)?$/.test(entryPath) || /(?:^|[\\/])idapt$/.test(entryPath);
+}
+async function main() {
+  const code = await run({
+    argv: process.argv.slice(2),
+    env: process.env,
+    stdout: (s) => process.stdout.write(s),
+    stderr: (s) => process.stderr.write(s),
+    isTty: Boolean(process.stdout.isTTY)
+  });
+  process.exit(code);
+}
+if (typeof process !== "undefined" && isCliEntrypoint(process.argv[1])) {
+  void main();
+}
+
+export { buildCommandFromArgv, extractOutputMode, extractValueFlag, isCliEntrypoint, isDocCommand, run };
+//# sourceMappingURL=bin.js.map
+//# sourceMappingURL=bin.js.map