@lizard-build/cli 4.0.33 → 4.0.35

package/dist/lib/auth.js

@@ -1,5 +1,5 @@
 import open from "open";
-import chalk from "chalk";
+import { isJSONMode } from "./format.js";
 import { loadConfig, saveConfig, } from "./config.js";
 /**
  * The env var carrying a token or a `liz_` API key. LIZARD_TOKEN is the
@@ -44,6 +44,28 @@ export function clearPendingAuth() {
 export function isLoggedIn() {
     return getToken() !== null;
 }
+/** The token a command would use right now, or null when a sign-in is needed. */
+export function validToken() {
+    const fromEnv = envToken();
+    if (fromEnv)
+        return fromEnv;
+    const creds = loadCredentials();
+    return creds && !isExpired(creds) ? creds.accessToken : null;
+}
+/** Store what an approved CLI session returned, and drop the pending session. */
+export function saveSessionLogin(result) {
+    const expMs = jwtExpiryMs(result.accessToken);
+    saveCredentials({
+        accessToken: result.accessToken,
+        expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
+        userId: result.user.id,
+        username: result.user.username,
+        email: result.user.email,
+        avatarUrl: result.user.avatarUrl,
+    });
+    clearPendingAuth();
+    return loadCredentials();
+}
 function isTTY() {
     return Boolean(process.stdout.isTTY);
 }
@@ -74,14 +96,13 @@ function isExpired(creds) {
 /**
  * Ensure the user is authenticated.
  *
- * On first call with no credentials: creates a CLI auth session, saves it to
- * disk, opens the browser, prints the URL, and exits. The user authenticates
- * in the browser, then re-runs their command.
- *
- * On subsequent calls while a session is pending: checks once (no loop) if
- * the user has completed authentication. If yes, stores credentials and
- * returns them. If still pending, prints the URL and exits. If the session
- * expired, starts a fresh one.
+ * A token from the environment or a saved login that has not expired wins.
+ * Otherwise a session the browser already approved finishes here. Failing
+ * that, a person at a terminal signs in on the spot (pick GitHub or Google,
+ * the browser opens, the CLI waits) and the command carries on. Anything else
+ * (an agent, a pipe, --json) gets a NOT_AUTHENTICATED error whose body holds
+ * the sign-in links; once the user approves, the same command run again
+ * picks the session up.
  */
 export async function requireAuth() {
     const fromEnv = envToken();
@@ -91,65 +112,15 @@ export async function requireAuth() {
     const creds = loadCredentials();
     if (creds && !isExpired(creds))
         return creds;
-    // Check pending session before the TTY guard — completing auth doesn't need interactivity
-    const pending = loadPendingAuth();
-    if (pending) {
-        const { checkSession } = await import("../commands/login.js");
-        try {
-            const result = await checkSession(pending.sessionId, pending.sessionSecret);
-            if (result.status === "complete" && result.accessToken && result.user) {
-                const expMs = jwtExpiryMs(result.accessToken);
-                saveCredentials({
-                    accessToken: result.accessToken,
-                    expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
-                    userId: result.user.id,
-                    username: result.user.username,
-                    email: result.user.email,
-                    avatarUrl: result.user.avatarUrl,
-                });
-                clearPendingAuth();
-                return loadCredentials();
-            }
-            if (result.status === "expired") {
-                clearPendingAuth();
-                // Fall through to start a fresh session below
-            }
-            else {
-                // Still pending — user hasn't authenticated yet
-                printAuthPrompt(pending.authUrl);
-                process.exit(0);
-            }
-        }
-        catch {
-            // Network error — assume still pending, show URL
-            printAuthPrompt(pending.authUrl);
-            process.exit(0);
-        }
-    }
-    // No credentials and no pending session — need to start a new auth flow
-    if (!isTTY()) {
-        const err = new Error(creds
-            ? "Session expired. Run `lizard login` again or set LIZARD_TOKEN / LIZARD_API_KEY."
-            : "Not authenticated. Set LIZARD_TOKEN (or LIZARD_API_KEY) or run `lizard login` first.");
-        err.code = "NOT_AUTHENTICATED";
-        throw err;
+    const signin = await import("./signin.js");
+    const resumed = await signin.resumePending();
+    if (resumed.kind === "complete")
+        return loadCredentials();
+    if (isTTY() && !isJSONMode()) {
+        await signin.signInInteractive();
+        return loadCredentials();
     }
-    const { createSession } = await import("../commands/login.js");
-    const { getBaseURL } = await import("./api.js");
-    const session = await createSession();
-    const authUrl = `${getBaseURL()}/auth/cli?session=${session.sessionId}`;
-    savePendingAuth({
-        sessionId: session.sessionId,
-        sessionSecret: session.sessionSecret,
-        authUrl,
-        createdAt: Date.now(),
-    });
-    await openURL(authUrl);
-    printAuthPrompt(authUrl);
-    process.exit(0);
-}
-function printAuthPrompt(authUrl) {
-    process.stderr.write(`\nAuthenticate with Lizard:\n  ${chalk.cyan(authUrl)}\n\nThen run your command again.\n\n`);
+    throw await signin.loginRequiredError(resumed, Boolean(creds));
 }
 /** Open a URL in the default browser, or print it if headless. */
 export async function openURL(url) {

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,UAAU,GAGX,MAAM,aAAa,CAAC;AAIrB;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;AACxE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,QAAQ;IACtB,OAAO,QAAQ,EAAE,IAAI,eAAe,EAAE,EAAE,WAAW,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,KAAK,GACT,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,aAAa;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,0FAA0F;IAC1F,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC9C,eAAe,CAAC;oBACd,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;oBAC5D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;oBACtB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;oBAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;iBACjC,CAAC,CAAC;gBACH,gBAAgB,EAAE,CAAC;gBACnB,OAAO,eAAe,EAAG,CAAC;YAC5B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,gBAAgB,EAAE,CAAC;gBACnB,8CAA8C;YAChD,CAAC;iBAAM,CAAC;gBACN,gDAAgD;gBAChD,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;YACjD,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,KAAK;YACH,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,sFAAsF,CAC/D,CAAC;QAC9B,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,UAAU,EAAE,qBAAqB,OAAO,CAAC,SAAS,EAAE,CAAC;IACxE,eAAe,CAAC;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,sCAAsC,CAC5F,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,OAAO,CACnB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAC5E,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAE/B,IAAI,KAAK,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,UAAU,GAGX,MAAM,aAAa,CAAC;AAIrB;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;AACxE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,QAAQ;IACtB,OAAO,QAAQ,EAAE,IAAI,eAAe,EAAE,EAAE,WAAW,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1B,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,MAGhC;IACC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,eAAe,CAAC;QACd,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;QACtB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;QACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;KACjC,CAAC,CAAC;IACH,gBAAgB,EAAE,CAAC;IACnB,OAAO,eAAe,EAAG,CAAC;AAC5B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,KAAK,GACT,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,aAAa;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,eAAe,EAAG,CAAC;IAE3D,IAAI,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACjC,OAAO,eAAe,EAAG,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,OAAO,CACnB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAC5E,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAE/B,IAAI,KAAK,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/config.d.ts

@@ -27,6 +27,8 @@ export interface PendingAuth {
     sessionSecret: string;
     authUrl: string;
     createdAt: number;
+    /** When the platform drops the session. Older CLIs did not save it. */
+    expiresAt?: number;
 }
 export interface Config {
     credentials?: Credentials;

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW;QAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAwCD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAW,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACxD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,GAAG,GAAG;QACN,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK;QACrC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IACvB,wCAAwC;IACxC,MAAM,UAAU,GAAgB;QAC9B,GAAG,IAAI;QACP,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK;QACnC,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;KAC9C,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA2B,EAC3B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACzC,yEAAyE;IACzE,mEAAmE;IACnE,8DAA8D;IAC9D,IAAI,WAAW,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IACzD,IAAI,aAAa,IAAI,KAAK;QAAE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAC/D,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAkB;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,gFAAgF;IAChF,uFAAuF;IACvF,mFAAmF;IACnF,8DAA8D;IAC9D,EAAE;IACF,qFAAqF;IACrF,wEAAwE;IACxE,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAAoD,eAAe,CAAC,CAAC;IACnG,sEAAsE;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK;QAC5B,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,KAAK;QAC/B,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,KAAK,CAClC,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,SAAS,cAAc,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW;QAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AA0CD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAW,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACxD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,GAAG,GAAG;QACN,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK;QACrC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IACvB,wCAAwC;IACxC,MAAM,UAAU,GAAgB;QAC9B,GAAG,IAAI;QACP,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK;QACnC,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;KAC9C,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA2B,EAC3B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACzC,yEAAyE;IACzE,mEAAmE;IACnE,8DAA8D;IAC9D,IAAI,WAAW,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IACzD,IAAI,aAAa,IAAI,KAAK;QAAE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAC/D,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAkB;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,gFAAgF;IAChF,uFAAuF;IACvF,mFAAmF;IACnF,8DAA8D;IAC9D,EAAE;IACF,qFAAqF;IACrF,wEAAwE;IACxE,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAAoD,eAAe,CAAC,CAAC;IACnG,sEAAsE;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK;QAC5B,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,KAAK;QAC/B,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,KAAK,CAClC,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,SAAS,cAAc,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC"}

package/dist/lib/signin.d.ts

@@ -0,0 +1,91 @@
+import { APIError } from "./api.js";
+/** The sign-in methods the /auth/cli page can send a person to. */
+export type AuthProvider = "github" | "google";
+export declare const AUTH_PROVIDERS: AuthProvider[];
+interface SessionResponse {
+    sessionId: string;
+    sessionSecret: string;
+    expiresIn: number;
+}
+export interface CheckResponse {
+    status: "pending" | "complete" | "expired";
+    accessToken?: string;
+    user?: {
+        id: string;
+        username: string;
+        email?: string;
+        avatarUrl?: string;
+    };
+}
+export interface Me {
+    id: string;
+    username: string;
+    email?: string | null;
+    scoped?: boolean;
+}
+export interface Pending {
+    sessionId: string;
+    sessionSecret: string;
+    expiresAt: number;
+}
+export type Resumed = {
+    kind: "none";
+} | {
+    kind: "complete";
+} | {
+    kind: "pending";
+    pending: Pending;
+} | {
+    kind: "expired";
+};
+/**
+ * The page that approves a CLI session. With a provider it signs a signed-out
+ * browser in with that method; without one it uses GitHub, as it always has.
+ */
+export declare function authUrlFor(sessionId: string, provider?: AuthProvider): string;
+/** Which sign-in methods the platform offers. Both, if it cannot be asked. */
+export declare function fetchAuthProviders(): Promise<AuthProvider[]>;
+/** `--github` / `--google`, or undefined when neither is given. */
+export declare function providerFlag(opts: {
+    github?: boolean;
+    google?: boolean;
+}): AuthProvider | undefined;
+/** Create a CLI login session on the server */
+export declare function createSession(): Promise<SessionResponse>;
+/** Check once if the user has completed authentication (no polling loop) */
+export declare function checkSession(sessionId: string, sessionSecret: string): Promise<CheckResponse>;
+/** The signed-in user, or null when this machine needs a sign-in. */
+export declare function currentUser(): Promise<Me | null>;
+/** Finish a session an earlier run left on disk, if the browser approved it. */
+export declare function resumePending(): Promise<Resumed>;
+export declare function startSession(provider?: AuthProvider): Promise<Pending>;
+/**
+ * What an agent needs to get the user signed in: the links and what to do
+ * with them. `status` and `authUrl` are what `lizard login --json` has always
+ * printed; `authUrl` without a chosen method is the old link, which opens
+ * GitHub.
+ */
+export declare function pendingPayload(pending: Pending, methods: AuthProvider[], why: "new" | "waiting" | "expired", opts?: {
+    flag?: AuthProvider;
+    nextCommand?: string;
+}, now?: number): {
+    instruction: string;
+    nextCommand?: string | undefined;
+    status: "pending";
+    authUrl: string;
+    authUrls: Partial<Record<AuthProvider, string>>;
+    expiresAt: string;
+};
+/**
+ * The error a command fails with when nobody is signed in and nobody can be
+ * asked. Its body carries the sign-in links, so an agent can hand them to the
+ * user and run the command again, without a separate `lizard login`.
+ */
+export declare function loginRequiredError(resumed: Resumed, hadLogin: boolean): Promise<APIError>;
+/**
+ * Sign in at a terminal: ask the method (when stdin can answer), open the
+ * browser there, wait for the approval, save the login. Throws if the link
+ * expires first.
+ */
+export declare function signInInteractive(flag?: AuthProvider): Promise<Me>;
+export {};

package/dist/lib/signin.js

@@ -0,0 +1,249 @@
+import chalk from "chalk";
+import * as p from "@clack/prompts";
+import { api, APIError, clientHeaders, getBaseURL } from "./api.js";
+import { clearCredentials, clearPendingAuth, envToken, loadPendingAuth, openURL, savePendingAuth, saveSessionLogin, validToken, } from "./auth.js";
+export const AUTH_PROVIDERS = ["github", "google"];
+const PROVIDER_LABEL = { github: "GitHub", google: "Google" };
+/** How long the platform keeps a CLI session, for sessions saved without `expiresAt`. */
+const SESSION_TTL_MS = 300_000;
+/** The platform allows 60 polls per session over its 5 minutes: one every 5 s. */
+const POLL_MS = 5_000;
+/**
+ * The page that approves a CLI session. With a provider it signs a signed-out
+ * browser in with that method; without one it uses GitHub, as it always has.
+ */
+export function authUrlFor(sessionId, provider) {
+    const url = `${getBaseURL()}/auth/cli?session=${sessionId}`;
+    return provider ? `${url}&provider=${provider}` : url;
+}
+/** Which sign-in methods the platform offers. Both, if it cannot be asked. */
+export async function fetchAuthProviders() {
+    try {
+        const res = await fetch(`${getBaseURL()}/api/auth/providers`, { headers: clientHeaders() });
+        if (!res.ok)
+            return AUTH_PROVIDERS;
+        const body = (await res.json());
+        const on = AUTH_PROVIDERS.filter((m) => body[m]);
+        return on.length ? on : AUTH_PROVIDERS;
+    }
+    catch {
+        return AUTH_PROVIDERS;
+    }
+}
+/** `--github` / `--google`, or undefined when neither is given. */
+export function providerFlag(opts) {
+    if (opts.github && opts.google)
+        throw new Error("Pass --github or --google, not both.");
+    return opts.google ? "google" : opts.github ? "github" : undefined;
+}
+/** Create a CLI login session on the server */
+export async function createSession() {
+    const res = await fetch(`${getBaseURL()}/api/auth/cli/session`, {
+        method: "POST",
+        headers: { ...clientHeaders(), "Content-Type": "application/json" },
+    });
+    if (!res.ok)
+        throw new Error(`Failed to create login session: ${res.statusText}`);
+    return res.json();
+}
+/** Check once if the user has completed authentication (no polling loop) */
+export async function checkSession(sessionId, sessionSecret) {
+    const res = await fetch(`${getBaseURL()}/api/auth/cli/poll`, {
+        method: "POST",
+        // The platform records the login from this request; its User-Agent is
+        // what files it under the CLI and the agent running it.
+        headers: { ...clientHeaders(), "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionId, sessionSecret }),
+    });
+    if (!res.ok)
+        throw new Error(`Auth check failed: ${res.statusText}`);
+    return res.json();
+}
+/** The signed-in user, or null when this machine needs a sign-in. */
+export async function currentUser() {
+    if (!validToken())
+        return null;
+    try {
+        return await api.get("/api/auth/me");
+    }
+    catch (err) {
+        // A saved token the platform no longer accepts is as good as none. A token
+        // from the environment is the caller's to fix, so that error stands.
+        if (err instanceof APIError && err.status === 401 && !envToken()) {
+            clearCredentials();
+            return null;
+        }
+        throw err;
+    }
+}
+/** Finish a session an earlier run left on disk, if the browser approved it. */
+export async function resumePending() {
+    const saved = loadPendingAuth();
+    if (!saved)
+        return { kind: "none" };
+    const pending = {
+        sessionId: saved.sessionId,
+        sessionSecret: saved.sessionSecret,
+        expiresAt: saved.expiresAt ?? saved.createdAt + SESSION_TTL_MS,
+    };
+    let result;
+    try {
+        result = await checkSession(pending.sessionId, pending.sessionSecret);
+    }
+    catch {
+        // A dropped request or the poll limit says nothing about the session.
+        if (Date.now() < pending.expiresAt)
+            return { kind: "pending", pending };
+        clearPendingAuth();
+        return { kind: "expired" };
+    }
+    if (result.status === "complete" && result.accessToken && result.user) {
+        saveSessionLogin({ accessToken: result.accessToken, user: result.user });
+        return { kind: "complete" };
+    }
+    if (result.status === "expired") {
+        clearPendingAuth();
+        return { kind: "expired" };
+    }
+    return { kind: "pending", pending };
+}
+export async function startSession(provider) {
+    const session = await createSession();
+    const now = Date.now();
+    const pending = {
+        sessionId: session.sessionId,
+        sessionSecret: session.sessionSecret,
+        expiresAt: now + session.expiresIn * 1000,
+    };
+    savePendingAuth({ ...pending, authUrl: authUrlFor(session.sessionId, provider), createdAt: now });
+    return pending;
+}
+/** Poll until the browser approves the session. Null if it expires first. */
+async function waitForApproval(pending) {
+    while (Date.now() < pending.expiresAt) {
+        await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+        try {
+            const result = await checkSession(pending.sessionId, pending.sessionSecret);
+            if (result.status === "complete")
+                return result;
+            if (result.status === "expired")
+                return null;
+        }
+        catch {
+            // A dropped request or the poll limit: try again on the next tick.
+        }
+    }
+    return null;
+}
+// ── For agents ──────────────────────────────────────────────────────────
+/**
+ * What an agent needs to get the user signed in: the links and what to do
+ * with them. `status` and `authUrl` are what `lizard login --json` has always
+ * printed; `authUrl` without a chosen method is the old link, which opens
+ * GitHub.
+ */
+export function pendingPayload(pending, methods, why, opts = {}, now = Date.now()) {
+    const authUrls = Object.fromEntries(methods.map((m) => [m, authUrlFor(pending.sessionId, m)]));
+    const single = methods.length === 1 ? methods[0] : undefined;
+    const minutes = Math.max(1, Math.round((pending.expiresAt - now) / 60_000));
+    const window = minutes === 1 ? "1 more minute" : `${minutes} more minutes`;
+    const then = opts.nextCommand ? "run nextCommand" : "run the same command again";
+    const lead = why === "waiting"
+        ? "The user has not finished signing in yet. "
+        : why === "expired"
+            ? "The last sign-in link expired; this is a new one. "
+            : "";
+    const instruction = single
+        ? `${lead}Sign-in is needed. Give the user authUrl to open. Once the browser says "CLI authorized", ${then}. ` +
+            `The link works for ${window}; after that a new one is printed.`
+        : `${lead}Sign-in is needed. Ask the user how they sign in to Lizard and give them that link from authUrls. ` +
+            "Someone who already has an account must use the same method as before: another method opens a second, empty account " +
+            "unless both share a verified email. A new user can pick either. " +
+            `Once the browser says "CLI authorized", ${then}. The links work for ${window}; after that new ones are printed.`;
+    return {
+        status: "pending",
+        authUrl: single ? authUrls[single] : authUrlFor(pending.sessionId, opts.flag),
+        authUrls,
+        expiresAt: new Date(pending.expiresAt).toISOString(),
+        ...(opts.nextCommand ? { nextCommand: opts.nextCommand } : {}),
+        instruction,
+    };
+}
+/**
+ * The error a command fails with when nobody is signed in and nobody can be
+ * asked. Its body carries the sign-in links, so an agent can hand them to the
+ * user and run the command again, without a separate `lizard login`.
+ */
+export async function loginRequiredError(resumed, hadLogin) {
+    const base = hadLogin ? "The Lizard sign-in on this machine expired." : "Not signed in to Lizard.";
+    const plain = new APIError(401, `${base} Run \`lizard login\`, or set LIZARD_TOKEN (or LIZARD_API_KEY).`, "NOT_AUTHENTICATED");
+    // CI has nobody to open a link: say what to set and stop there.
+    if (process.env.CI)
+        return plain;
+    try {
+        const pending = resumed.kind === "pending" ? resumed.pending : await startSession();
+        const why = resumed.kind === "pending" ? "waiting" : resumed.kind === "expired" ? "expired" : "new";
+        const login = pendingPayload(pending, await fetchAuthProviders(), why);
+        return new APIError(401, `${base} ${login.instruction}`, "NOT_AUTHENTICATED", { login });
+    }
+    catch {
+        return plain;
+    }
+}
+// ── For people ──────────────────────────────────────────────────────────
+function cancelled() {
+    p.cancel("Cancelled.");
+    process.exit(5);
+}
+async function askProvider() {
+    const methods = await fetchAuthProviders();
+    if (methods.length === 1)
+        return methods[0];
+    p.log.message(chalk.dim("Already have an account? Pick the method you signed up with."));
+    const choice = await p.select({
+        message: "How do you sign in to Lizard?",
+        options: methods.map((m) => ({ value: m, label: PROVIDER_LABEL[m] })),
+    });
+    if (p.isCancel(choice))
+        cancelled();
+    return choice;
+}
+/**
+ * Sign in at a terminal: ask the method (when stdin can answer), open the
+ * browser there, wait for the approval, save the login. Throws if the link
+ * expires first.
+ */
+export async function signInInteractive(flag) {
+    const provider = flag ?? (process.stdin.isTTY ? await askProvider() : undefined);
+    const pending = await startSession(provider);
+    if (provider) {
+        const url = authUrlFor(pending.sessionId, provider);
+        const opened = await openURL(url);
+        p.log.info(`${opened ? "Opened your browser. If it did not open, use this link" : "Open this link to sign in"}:\n${chalk.cyan(url)}`);
+    }
+    else {
+        const methods = await fetchAuthProviders();
+        p.log.info(["Open one of these links to sign in:", ...methods.map((m) => `${PROVIDER_LABEL[m]}: ${chalk.cyan(authUrlFor(pending.sessionId, m))}`)].join("\n"));
+    }
+    // Ctrl+C at a terminal never reaches onCancel: clack holds stdin raw while it
+    // spins and exits on the keypress itself, printing cancelMessage on the way
+    // out. So the message carries the hint, and the session stays on disk for
+    // whichever lizard command runs next.
+    const spin = p.spinner({
+        cancelMessage: "Stopped waiting. The link works for a few more minutes: finish in the browser, then run the command again",
+        onCancel: () => process.exit(5),
+    });
+    spin.start("Waiting for you to authorize Lizard CLI in the browser");
+    const result = await waitForApproval(pending);
+    if (!result?.accessToken || !result.user) {
+        spin.error("The sign-in link expired");
+        clearPendingAuth();
+        throw new Error("The sign-in link expired. Run the command again for a new one.");
+    }
+    saveSessionLogin({ accessToken: result.accessToken, user: result.user });
+    spin.stop("Authorized");
+    const me = await api.get("/api/auth/me");
+    p.log.success(`Signed in as ${chalk.bold(me.username)}`);
+    return me;
+}
+//# sourceMappingURL=signin.js.map

package/dist/lib/signin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.js","sourceRoot":"","sources":["../../src/lib/signin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,OAAO,EACP,eAAe,EACf,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AAanB,MAAM,CAAC,MAAM,cAAc,GAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnE,MAAM,cAAc,GAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAE5F,yFAAyF;AACzF,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,kFAAkF;AAClF,MAAM,OAAO,GAAG,KAAK,CAAC;AAsCtB;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,QAAuB;IACnE,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,qBAAqB,SAAS,EAAE,CAAC;IAC5D,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,cAAc,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QAC1E,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,IAA4C;IACvE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,uBAAuB,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KACpE,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,aAAqB;IACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,oBAAoB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,sEAAsE;QACtE,wDAAwD;QACxD,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACnE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,IAAI,EAA4B,CAAC;AAC9C,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,GAAG,CAAK,cAAc,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjE,gBAAgB,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,MAAM,OAAO,GAAY;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,cAAc;KAC/D,CAAC;IACF,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACtE,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB;IACxD,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAY;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;KAC1C,CAAC;IACF,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,OAAgB;IAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,MAAM,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgB,EAChB,OAAuB,EACvB,GAAkC,EAClC,OAAsD,EAAE,EACxD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,OAAO,eAAe,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4BAA4B,CAAC;IACjF,MAAM,IAAI,GACR,GAAG,KAAK,SAAS;QACf,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,GAAG,KAAK,SAAS;YACjB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC,GAAG,IAAI,6FAA6F,IAAI,IAAI;YAC5G,sBAAsB,MAAM,oCAAoC;QAClE,CAAC,CAAC,GAAG,IAAI,oGAAoG;YAC3G,sHAAsH;YACtH,kEAAkE;YAClE,2CAA2C,IAAI,wBAAwB,MAAM,oCAAoC,CAAC;IACtH,OAAO;QACL,MAAM,EAAE,SAAkB;QAC1B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9E,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,QAAiB;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,QAAQ,CACxB,GAAG,EACH,GAAG,IAAI,iEAAiE,EACxE,mBAAmB,CACpB,CAAC;IACF,gEAAgE;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACpG,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2EAA2E;AAE3E,SAAS,SAAS;IAChB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,EAAE,CAAC;IACpC,OAAO,MAAsB,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAmB;IACzD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,2BAA2B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,CAAC,qCAAqC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnJ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;QACrB,aAAa,EAAE,2GAA2G;QAC1H,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACvC,gBAAgB,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAK,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC"}