@maxceem/agw 0.4.0 → 0.5.1

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.4.0", wrangler: "4.96.0", upgradeFrom: ["0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.4.0/gateway-0.4.0.tar.gz", sha256: "82e5cea16db3e01d3058bf966c3ea634adf8565658de1f4cddbe02997b2402d9", manifest: "56646f283de6e8683194e48f70a113f69120a35d724b7e0f1b5e4df92473c0cc" } };
+var define_AGW_MANIFEST_default = { version: "0.5.1", wrangler: "4.96.0", upgradeFrom: ["0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.5.1/gateway-0.5.1.tar.gz", sha256: "f4461618d5882d9b32dc44d5d8db048bbb6d6df5ec9899c77c5877491296d77c", manifest: "f08d792d4b9f8b9537075a99583b39c5a355891a20d20632bb5ed957ad6eacf2" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -14561,19 +14561,19 @@ function hasUnsafeCharacter(raw) {
 function reject(message) {
   return { ok: false, message };
 }
-function hostProblem(hostname5) {
-  if (hostname5.startsWith("[")) {
+function hostProblem(hostname6) {
+  if (hostname6.startsWith("[")) {
     return "Base URL must name a host, not an IPv6 address";
   }
-  if (IPV4_PATTERN.test(hostname5) || NUMERIC_HOST_PATTERN.test(hostname5)) {
+  if (IPV4_PATTERN.test(hostname6) || NUMERIC_HOST_PATTERN.test(hostname6)) {
     return "Base URL must name a host, not an IP address";
   }
-  if (hostname5.endsWith(".")) {
+  if (hostname6.endsWith(".")) {
     return "Base URL host must not end with a dot";
   }
-  const labels = hostname5.split(".");
+  const labels = hostname6.split(".");
   if (labels.length < 2) {
-    return `Base URL host must be a public domain name; ${hostname5} has no domain suffix`;
+    return `Base URL host must be a public domain name; ${hostname6} has no domain suffix`;
   }
   for (const label of labels) {
     if (!LABEL_PATTERN.test(label)) {
@@ -14823,7 +14823,7 @@ var PROVIDER_DESCRIPTORS = {
     // reads the older field.
     chatCompletionsCapField: "max_completion_tokens",
     // The two types whose Responses and transcription request shapes the
-    // gateway composes itself for named endpoints.
+    // gateway composes itself for custom endpoints.
     endpointPaths: { responses: "v1/responses", audio_transcription: "v1/audio/transcriptions" },
     modelAuthor: "OpenAI"
   },
@@ -15512,6 +15512,7 @@ var RELEASE = manifest.release ?? null;
 
 // src/common.ts
 var CLOUD = "https://api.appaigateway.com";
+var MANAGEMENT_KEY_ENV = "AGW_MANAGEMENT_KEY";
 var CliError = class extends Error {
   code;
   nextAction;
@@ -15657,7 +15658,7 @@ async function confirm(message, flags) {
 // src/parser.ts
 var secret2 = "key-prompt! key-stdin! browser! no-open!";
 var browser = "no-open!";
-var managementKey = "key-prompt! key-stdin!";
+var managementKey = "key-prompt! key-stdin! no-open!";
 var common = "json! no-input!";
 var commands = {
   "deployment setup": {
@@ -15815,7 +15816,7 @@ function parse3(argv) {
   }
   if (flags["key-prompt"] && flags["no-input"])
     fail("conflicting_flags", "--key-prompt cannot be used with --no-input.");
-  if (flags["no-open"] && !flags.browser && command !== "account claim")
+  if (flags["no-open"] && !flags.browser && command !== "account claim" && command !== "account login" && command !== "deployment connect")
     fail("invalid_input", "--no-open requires --browser.");
   if (flags["no-open"] && (flags["key-prompt"] || flags["key-stdin"]))
     fail(
@@ -15841,8 +15842,10 @@ ${matches.map(
   )}
 
 --json: structured stdout; --no-input: never prompt; --help, -h: this help.
+Login: account login and deployment connect open the browser; check that it shows the pairing code the terminal prints. --no-open prints the URL instead; --key-stdin or --key-prompt takes a management key.
+Credentials: ${MANAGEMENT_KEY_ENV}, when set, is the management key for every command and overrides the saved login. account logout revokes the saved key.
 Secrets: hidden prompt by default; --key-stdin reads one line. Provider --browser submits credentials directly to your gateway.
-Browser operations: --no-open, --json or --no-input returns pending; operation wait resumes.
+Browser operations: --json or --no-input returns pending; operation wait resumes.
 No account is created by help, status, list, validation or dry runs.
 `;
 }
@@ -16985,7 +16988,7 @@ function attestEnvironments(value) {
   return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
 }
 async function remoteValidation(ctx, doc, id) {
-  if (!ctx.active?.credential)
+  if (!ctx.managementKey)
     return {
       local: true,
       remote: false,
@@ -17143,7 +17146,7 @@ ${snippet}`;
     if (flags.endpoint) {
       const endpoint = doc.config.endpoints[flags.endpoint];
       if (!endpoint)
-        fail("endpoint_not_found", "Choose an existing named endpoint.");
+        fail("endpoint_not_found", "Choose an existing custom endpoint.");
       const responses = endpoint.api_style === "responses";
       example = {
         target: { endpoint: flags.endpoint },
@@ -17601,7 +17604,14 @@ var ManagementKeySummarySchema = external_exports.object({
   }),
   expiresAt: external_exports.string().nullable(),
   createdAt: external_exports.string(),
-  revokedAt: external_exports.string().nullable()
+  revokedAt: external_exports.string().nullable(),
+  source: external_exports.string().meta({
+    description: "Where the key was issued: `console`, `cli` for a key a CLI login received, or `bootstrap` for the key a CLI account starts with. Display only.",
+    example: "cli"
+  }),
+  label: external_exports.string().nullable().meta({
+    description: "Who holds it, as the issuing client described itself, e.g. `CLI on mac-studio`. Display only."
+  })
 });
 var ManagementKeyListResponseSchema = external_exports.object({
   keys: external_exports.array(ManagementKeySummarySchema)
@@ -17635,7 +17645,7 @@ var ProviderSummarySchema = external_exports.object({
       description: "The client APIs this instance can be called with on its route. A direct instance lists every style its provider type does not narrow; the provider itself answers for paths it lacks."
     }),
     endpointStyles: external_exports.array(external_exports.enum(ENDPOINT_API_STYLES)).meta({
-      description: "The named-endpoint styles this instance can back on its route."
+      description: "The custom-endpoint styles this instance can back on its route."
     }),
     modelPrefix: external_exports.string().nullable().meta({
       description: "The namespace the route adds to model IDs on the way out. Clients always send the provider's own ID; null means the route sends it unchanged."
@@ -17931,7 +17941,10 @@ var ModelPriceSchema = external_exports.object({
   long_input: external_exports.number().optional(),
   long_output: external_exports.number().optional(),
   long_cached_input: external_exports.number().optional(),
-  long_cache_write: external_exports.number().optional()
+  long_cache_write: external_exports.number().optional(),
+  retirement_date: external_exports.string().optional().meta({
+    description: "The day (YYYY-MM-DD) the provider stops, or stopped, serving this model. The model stays priced after it."
+  })
 });
 var PricesResponseSchema = external_exports.object({
   prices: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), ModelPriceSchema))
@@ -17940,8 +17953,11 @@ var PricesResponseSchema = external_exports.object({
 // ../src/contracts/cli.ts
 var CliProofSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{32,256}$/);
 var CliBootstrapRequestSchema = external_exports.object({ token: CliProofSchema }).strict();
+var CliUserCodeSchema = external_exports.string().regex(/^[A-Za-z0-9]{4}-?[A-Za-z0-9]{4}$/);
+var CliSubmissionTokenSchema = external_exports.string().regex(/^(?:[A-Za-z0-9_-]{32,256}|[A-Za-z0-9]{4}-?[A-Za-z0-9]{4})$/);
 var CliOperationKindSchema = external_exports.enum([
   "bootstrap",
+  "login",
   "claim",
   "app.add",
   "app.key.add",
@@ -17970,15 +17986,16 @@ var CliOperationRequestSchema = external_exports.discriminatedUnion("kind", [
   ),
   operationRequest("provider-gateway.rotate-key", HandoffRotatePayloadSchema, "always")
 ]);
-var CliBrowserProofSchema = external_exports.object({ submissionToken: CliProofSchema }).strict();
+var CliBrowserProofSchema = external_exports.object({ submissionToken: CliSubmissionTokenSchema }).strict();
 var CliBrowserSubmitRequestSchema = external_exports.object({
-  submissionToken: CliProofSchema,
+  submissionToken: CliSubmissionTokenSchema,
   approve: external_exports.literal(true),
   // Flag-free, because the source is published verbatim as an OpenAPI `pattern`.
-  secret: external_exports.string().max(16384).regex(/\S/, { error: "must not be blank" }).optional()
+  secret: external_exports.string().max(16384).regex(/\S/, { error: "must not be blank" }).optional(),
+  organizationId: external_exports.string().min(1).max(256).optional()
 }).strict();
 var CliBrowserRegisterRequestSchema = external_exports.object({
-  submissionToken: CliProofSchema,
+  submissionToken: CliSubmissionTokenSchema,
   email: external_exports.email(),
   password: external_exports.string().min(8).max(256),
   name: external_exports.string().min(1).max(100)
@@ -17991,35 +18008,89 @@ var CliDeploymentSchema = external_exports.object({
 });
 var CliApprovalRefusalSchema = external_exports.enum([
   "registration_required",
-  "sign_out_required"
+  "sign_out_required",
+  /**
+   * A login's approver belongs to no account they could log the CLI in to, and
+   * this deployment does not give a person one of their own. Nothing on the
+   * page can fix that; an owner has to add them to an account first.
+   */
+  "no_eligible_organization"
 ]);
 var CliViewerSchema = external_exports.object({
   name: external_exports.string().nullable(),
   email: external_exports.string().nullable()
 });
+var CliOperationClientSchema = external_exports.object({
+  /** E.g. `CLI on mac-studio`. */
+  label: external_exports.string().nullable(),
+  os: external_exports.string().nullable(),
+  /** The address the request came from, as the edge saw it. */
+  ip: external_exports.string().nullable(),
+  requestedAt: external_exports.string()
+});
+var CliLoginOrganizationSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  role: external_exports.enum(["owner", "admin", "member"])
+});
 var CliBrowserDetailsResponseSchema = external_exports.object({
   kind: CliOperationKindSchema,
   payload: external_exports.record(external_exports.string(), external_exports.unknown()),
-  account: OrganizationSummarySchema,
+  /** Null only for a login, which lands in whichever account its approver picks. */
+  account: OrganizationSummarySchema.nullable(),
   viewer: CliViewerSchema.nullable(),
   /**
    * What stands between this browser and the Approve button, or null when
-   * nothing does — which is every non-claim kind, since only a claim asks who
-   * is holding the browser. One field decides the whole screen: each value
+   * nothing does — which is every kind but a claim and a login, since only
+   * those two ask who is holding the browser. One field decides the whole screen: each value
    * names the single thing the page may offer, so the page never has to
    * consult the handoff kind to know what to put in front of a person.
    */
   blockedBy: CliApprovalRefusalSchema.nullable(),
   googleEnabled: external_exports.boolean(),
-  expiresAt: external_exports.string()
+  expiresAt: external_exports.string(),
+  /**
+   * The code the terminal shows, however the page was reached, so a person
+   * can check it against their terminal before approving. Null for a kind
+   * that has none — every kind but a login.
+   */
+  userCode: external_exports.string().nullable(),
+  /** Who asked, for a login; null for every other kind. */
+  client: CliOperationClientSchema.nullable(),
+  /** Whether approving hands the browser back to the CLI's local listener (`redirectUrl`). */
+  hasLoopbackRedirect: external_exports.boolean(),
+  /**
+   * For a login only: the accounts the signed-in person may log the CLI in to,
+   * so the page can ask which one when there is more than one.
+   */
+  organizations: external_exports.array(CliLoginOrganizationSchema).optional()
 });
 var CliHandoffContinuationSchema = external_exports.enum(["cli", "console"]);
 var CliBrowserSubmitResponseSchema = external_exports.object({
   state: external_exports.literal("completed"),
   /** The whole of what the page says once it is approved. */
   message: external_exports.string(),
-  continueTo: CliHandoffContinuationSchema
+  continueTo: CliHandoffContinuationSchema,
+  /**
+   * Set when the CLI registered a local listener: the page navigates here, and
+   * the one-time code in it is what the CLI redeems for its credential.
+   */
+  redirectUrl: external_exports.url().optional()
 });
+var CliBrowserDenyResponseSchema = external_exports.object({
+  state: external_exports.literal("denied"),
+  message: external_exports.string()
+});
+var CliBrowserLookupRequestSchema = external_exports.object({ userCode: external_exports.string().min(1).max(32) }).strict();
+var CliBrowserLookupResponseSchema = external_exports.discriminatedUnion("found", [
+  external_exports.object({ found: external_exports.literal(false) }),
+  external_exports.object({
+    found: external_exports.literal(true),
+    id: external_exports.string(),
+    kind: CliOperationKindSchema,
+    expiresAt: external_exports.string()
+  })
+]);
 var CliBrowserRegisterResponseSchema = external_exports.object({
   token: external_exports.string().nullable().optional(),
   redirect: external_exports.boolean().optional()
@@ -18031,16 +18102,43 @@ var CliBrowserGoogleResponseSchema = external_exports.object({
 var CliCredentialSchema = external_exports.object({
   token: external_exports.string()
 });
+var CliLoginRequestSchema = external_exports.object({
+  token: CliProofSchema,
+  client: external_exports.object({
+    label: external_exports.string().trim().min(1).max(200),
+    os: external_exports.string().trim().min(1).max(64).optional()
+  }).strict(),
+  // Ports 1–65535, spelled out because the source is published as an
+  // OpenAPI `pattern` and has no range syntax.
+  loopbackRedirect: external_exports.string().regex(
+    /^http:\/\/127\.0\.0\.1:(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])\/callback$/
+  ).optional()
+}).strict();
+var CliLoginSchema = external_exports.object({
+  id: external_exports.string(),
+  kind: external_exports.literal("login"),
+  /** `completed` when a login already approved is sent again: poll it, or redeem it, for the key. */
+  state: external_exports.enum(["pending", "completed", "denied", "expired"]),
+  url: external_exports.url().nullable(),
+  userCode: external_exports.string().nullable(),
+  expiresAt: external_exports.string()
+});
+var CliLoginRedeemRequestSchema = external_exports.object({ redeemCode: CliProofSchema }).strict();
+var CliLoginRedeemResponseSchema = external_exports.object({
+  credential: CliCredentialSchema,
+  account: OrganizationSummarySchema
+});
+var CliCredentialRevokeResponseSchema = external_exports.object({ revoked: external_exports.literal(true) });
 var UnclaimedAccessSchema = external_exports.object({ endsAt: external_exports.string(), limit: external_exports.number().int().optional() }).nullable();
 var CliOperationResultSchema = external_exports.object({
-  /** A bootstrap's management key. Never print or log it. */
+  /** A bootstrap's or a login's management key. Never print or log it. */
   credential: CliCredentialSchema.optional(),
   /**
    * On a hosted deployment, when a bootstrapped account's free access ends and
    * the request allowance it has until then; null on a self-host.
    */
   unclaimedAccess: UnclaimedAccessSchema.optional(),
-  /** The account a claim acted on. */
+  /** The account a claim acted on, or a login landed in. */
   accountId: external_exports.string().optional(),
   app: AppResponseSchema.shape.app.optional(),
   /**
@@ -18055,6 +18153,8 @@ var CliOperationSchema = external_exports.object({
   id: external_exports.string(),
   kind: CliOperationKindSchema,
   state: external_exports.enum(["pending", "completed", "expired"]),
+  /** Set beside `state: "expired"` when a person declined the browser step rather than letting it lapse. */
+  denied: external_exports.literal(true).optional(),
   expiresAt: external_exports.string(),
   url: external_exports.url().optional(),
   deployment: CliDeploymentSchema,
@@ -18092,7 +18192,12 @@ var CliCapabilitiesResponseSchema = external_exports.object({
       endpointStyles: external_exports.array(external_exports.string())
     })
   ),
-  providerGateways: external_exports.array(external_exports.object({ type: external_exports.string(), name: external_exports.string() }))
+  providerGateways: external_exports.array(external_exports.object({ type: external_exports.string(), name: external_exports.string() })),
+  /** What this deployment supports beyond protocol 1's baseline. Absent on older deployments. */
+  features: external_exports.object({
+    /** `POST /v1/cli/login`: a person approves a CLI in a browser and it receives a key of its own. */
+    browserLogin: external_exports.boolean()
+  }).optional()
 });
 var [SelfHostedAccessSchema, UnavailableAccessSchema, BilledAccessSchema] = GatewayBillingAccessSchema.options;
 var CliBillingAccessSchema = external_exports.discriminatedUnion("state", [
@@ -18131,7 +18236,7 @@ var CLI_ERRORS = {
   410: "The protected credential exchange has expired; no replacement is minted.",
   429: "The durable initiation or submission rate limit was reached."
 };
-var BROWSER_HANDOFF_DESCRIPTION = "First-party browser only: both the request URL origin and exact Origin header must match consoleOrigin; a separate submissionToken is required. Identity approval also requires an interactive human session; registration is limited to a valid pending claim. Provider secret values are write-only.";
+var BROWSER_HANDOFF_DESCRIPTION = "First-party browser only: both the request URL origin and exact Origin header must match consoleOrigin; a separate submissionToken is required \u2014 the proof from the approval URL's fragment, or, for a login, the user code the terminal shows. Identity approval (a claim or a login) also requires an interactive human session; registration is limited to a valid pending claim or login. Provider secret values are write-only.";
 var SignUpRequestSchema = external_exports.object({
   name: external_exports.string(),
   email: external_exports.email(),
@@ -18323,8 +18428,8 @@ var CATALOG = {
   callNamedEndpoint: {
     method: "POST",
     path: "/v1/apps/{app}/endpoints/{slug}",
-    tags: ["Named endpoints"],
-    summary: "Call a server-configured named endpoint",
+    tags: ["Custom endpoints"],
+    summary: "Call a server-configured custom endpoint",
     description: "The endpoint's provider, model, fixed parameters, output cap, and fallback chain come from the application configuration, so you can change models without shipping a client release. Responses-style endpoints accept an OpenAI Responses body; audio_transcription endpoints accept an OpenAI audio transcription multipart body and may omit the model field. The successful response keeps the serving provider's native format and streaming behaviour.",
     security: "gateway",
     params: {
@@ -18954,12 +19059,51 @@ var CATALOG = {
     responseDescription: "Where the operation stands: completed with its result, or pending with the approval URL.",
     errors: CLI_ERRORS
   },
+  openCliLogin: {
+    method: "POST",
+    path: "/v1/cli/login",
+    tags: ["CLI"],
+    summary: "Ask a person to log this CLI in",
+    description: "Persist the random token before sending: its digest is the operation's id, and sending it again answers with where the login stands \u2014 `completed` once approved, when polling or redeeming collects the key \u2014 and never hands the key over itself. Needs no credential. Open `url` in a browser, or show `userCode` for the person to type on the console's code-entry page; once a signed-in person approves, the CLI receives a management key of its own in the account they chose. Without `loopbackRedirect`, poll `pollCliOperation` until it completes: the first completed answer carries the key in `result.credential`, and no later one does. With `loopbackRedirect`, the approval page sends the browser there with a one-time `code`, which `redeemCliLogin` exchanges for the key; polling then never returns it. A login expires after 15 minutes, and its record is kept for a day. Each network address may ask for 20 logins an hour \u2014 sending the same token again is not counted \u2014 and may have 10 waiting at once.",
+    security: "public",
+    request: CliLoginRequestSchema,
+    response: CliLoginSchema,
+    responseDescription: "The pending login, its approval URL and its user code.",
+    errors: CLI_ERRORS
+  },
+  redeemCliLogin: {
+    method: "POST",
+    path: "/v1/cli/login/{id}/redeem",
+    tags: ["CLI"],
+    summary: "Exchange a login's redeem code for its credential",
+    description: "For a login opened with `loopbackRedirect`: send the operation token as the bearer credential and the `code` the approval page delivered to the local listener. Answers once; a second redemption is refused with `already_completed`. Never print or log the credential.",
+    security: "cliPoll",
+    params: { id: {} },
+    request: CliLoginRedeemRequestSchema,
+    response: CliLoginRedeemResponseSchema,
+    responseDescription: "The management key the login issued, and the account it belongs to.",
+    errors: CLI_ERRORS
+  },
+  revokeCliCredential: {
+    method: "DELETE",
+    path: "/v1/cli/credential",
+    tags: ["CLI"],
+    summary: "Revoke the management key this request is sent with",
+    description: "Logging a CLI out. Any management key may end itself, whatever its role and whatever the account's standing; a browser session cannot use this and signs out instead.",
+    security: "management",
+    // Holding a key is authority enough to end it: a member may, and an
+    // account past its free window may.
+    policy: { role: "member", access: "read" },
+    response: CliCredentialRevokeResponseSchema,
+    responseDescription: "The key is revoked; the next request made with it is refused.",
+    errors: CLI_ERRORS
+  },
   pollCliOperation: {
     method: "GET",
     path: "/v1/cli/operations/{id}",
     tags: ["CLI"],
     summary: "Poll a CLI operation",
-    description: "Only the operation's token can read it. Completed claims report the account they landed on; the CLI keeps the access it already had. Provider secrets are never returned; a one-time key an operation created is, for 15 minutes.",
+    description: "Only the operation's token can read it. Completed claims report the account they landed on; the CLI keeps the access it already had. Provider secrets are never returned; a one-time key an operation created is, for 15 minutes. A login's key is returned once, by the first completed answer, and never when the login registered a loopback redirect. A step a person declined answers `expired` with `denied: true`.",
     security: "cliPoll",
     params: { id: {} },
     response: CliOperationSchema,
@@ -19020,7 +19164,32 @@ var CATALOG = {
     params: { id: {} },
     request: CliBrowserSubmitRequestSchema,
     response: CliBrowserSubmitResponseSchema,
-    responseDescription: "The handoff is approved and consumed. No submitted secret is ever echoed.",
+    responseDescription: "The handoff is approved and consumed. No submitted secret is ever echoed. For a login with a loopback redirect, `redirectUrl` is where to send the browser next.",
+    errors: CLI_ERRORS
+  },
+  cliBrowserDeny: {
+    method: "POST",
+    path: "/v1/cli/browser/{id}/deny",
+    tags: ["CLI"],
+    summary: "Browser handoff: deny",
+    description: `${BROWSER_HANDOFF_DESCRIPTION} Anyone holding the link or the code may decline, signed in or not.`,
+    security: "public",
+    params: { id: {} },
+    request: CliBrowserProofSchema,
+    response: CliBrowserDenyResponseSchema,
+    responseDescription: "The handoff is declined; the CLI's next poll reports it. Repeating a denial answers the same.",
+    errors: CLI_ERRORS
+  },
+  cliBrowserLookup: {
+    method: "POST",
+    path: "/v1/cli/browser/lookup",
+    tags: ["CLI"],
+    summary: "Browser handoff: find a step by its user code",
+    description: "First-party browser only, like the other handoff steps. Case and dashes are ignored. Continue with the code as `submissionToken` on the step it names. Rate limited per network address, because a code is short enough to guess in bulk.",
+    security: "public",
+    request: CliBrowserLookupRequestSchema,
+    response: CliBrowserLookupResponseSchema,
+    responseDescription: "Whether a pending step answers to the code, and which one.",
     errors: CLI_ERRORS
   },
   cliBrowserRegister: {
@@ -19033,7 +19202,7 @@ var CATALOG = {
     params: { id: {} },
     request: CliBrowserRegisterRequestSchema,
     response: CliBrowserRegisterResponseSchema,
-    responseDescription: "A new human identity for a pending claim, with its session set as a cookie.",
+    responseDescription: "A new human identity for a pending claim or login, with its session set as a cookie.",
     errors: CLI_ERRORS
   },
   cliBrowserGoogle: {
@@ -19046,7 +19215,7 @@ var CATALOG = {
     params: { id: {} },
     request: CliBrowserProofSchema,
     response: CliBrowserGoogleResponseSchema,
-    responseDescription: "Where to send the browser to start Google consent for a pending claim.",
+    responseDescription: "Where to send the browser to start Google consent for a pending claim or login.",
     errors: CLI_ERRORS
   }
 };
@@ -19068,6 +19237,167 @@ function operationPath(name, ...rest) {
   return query === void 0 ? filled : filled + searchSuffix(query);
 }
 
+// src/login.ts
+import { createServer } from "node:http";
+import { hostname as hostname4, platform as platform2, release } from "node:os";
+var REDEEM_CODE_PARAMETER = "code";
+var PAGE_HEADERS = {
+  "content-type": "text/html; charset=utf-8",
+  "cache-control": "no-store",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff",
+  connection: "close"
+};
+function page(title, text2) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.4rem">${title}</h1><p>${text2}</p></body></html>`;
+}
+var CONNECTED_PAGE = page(
+  "Your terminal is connected",
+  "The CLI has its key. You can close this tab."
+);
+var FAILED_PAGE = page(
+  "The login did not complete",
+  "Return to your terminal to see what happened."
+);
+async function listenLoopback() {
+  let deliver;
+  const code = new Promise((resolve3) => {
+    deliver = resolve3;
+  });
+  let waiting = null;
+  let delivered = false;
+  const server = createServer((request, response) => {
+    const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (request.method !== "GET" || url2.pathname !== "/callback") {
+      response.writeHead(404, PAGE_HEADERS).end(page("Not found", "Nothing is served here."));
+      return;
+    }
+    const value = url2.searchParams.get(REDEEM_CODE_PARAMETER) ?? "";
+    if (delivered || !CliProofSchema.safeParse(value).success) {
+      response.writeHead(400, PAGE_HEADERS).end(FAILED_PAGE);
+      return;
+    }
+    delivered = true;
+    waiting = response;
+    deliver(value);
+  });
+  await new Promise((resolve3, reject2) => {
+    server.once("error", reject2);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject2);
+      resolve3();
+    });
+  });
+  const { port } = server.address();
+  let answered = Promise.resolve();
+  const loopback = {
+    redirect: `http://127.0.0.1:${port}/callback`,
+    code,
+    answer(connected) {
+      const response = waiting;
+      if (!response) return;
+      waiting = null;
+      answered = new Promise((resolve3) => {
+        response.once("finish", resolve3);
+        response.once("close", resolve3);
+      });
+      response.writeHead(200, PAGE_HEADERS).end(connected ? CONNECTED_PAGE : FAILED_PAGE);
+    },
+    async close() {
+      loopback.answer(false);
+      await answered;
+      await new Promise((resolve3) => {
+        const force = setTimeout(() => server.closeAllConnections(), 1e3);
+        force.unref();
+        server.close(() => {
+          clearTimeout(force);
+          resolve3();
+        });
+        server.closeIdleConnections();
+      });
+    }
+  };
+  return loopback;
+}
+function clientDescription() {
+  return {
+    label: `CLI on ${hostname4() || "this computer"}`.slice(0, 200),
+    os: `${platform2()} ${release()}`.trim().slice(0, 64)
+  };
+}
+function browserAvailable({
+  env,
+  platform: system,
+  terminal
+} = {
+  env: process.env,
+  platform: platform2(),
+  terminal: Boolean(process.stdin.isTTY && process.stderr.isTTY)
+}) {
+  if (!terminal) return false;
+  if (env["SSH_CONNECTION"] || env["SSH_TTY"]) return false;
+  if (system === "linux" && !env["DISPLAY"] && !env["WAYLAND_DISPLAY"]) return false;
+  return true;
+}
+
+// src/style.ts
+import { Writable } from "node:stream";
+import { styleText } from "node:util";
+var STATES = /* @__PURE__ */ new Map([
+  ["active", "green"],
+  ["ready", "green"],
+  ["completed", "green"],
+  ["yes", "green"],
+  ["pending", "yellow"],
+  ["failed", "red"],
+  ["expired", "red"],
+  ["blocked", "red"],
+  ["inactive", "red"],
+  ["disabled", "red"],
+  ["revoked", "red"],
+  ["no", "red"]
+]);
+function colorEnabled(sink, env = process.env) {
+  if (env["NO_COLOR"]) return false;
+  if (!(sink instanceof Writable)) return false;
+  if (env["FORCE_COLOR"] && env["FORCE_COLOR"] !== "0") return true;
+  if (!("isTTY" in sink && sink.isTTY === true)) return false;
+  return styleText("dim", "?", { stream: sink, validateStream: true }) !== "?";
+}
+var plain = style(false);
+var styleFor = (sink) => style(colorEnabled(sink));
+function style(enabled) {
+  const paint = (format, text2) => enabled ? styleText(format, text2, { validateStream: false }) : text2;
+  const self = {
+    enabled,
+    headline: (text2) => paint("bold", text2),
+    dim: (text2) => paint("dim", text2),
+    alert: (text2) => paint("red", text2),
+    warn: (text2) => paint("yellow", text2),
+    state: (value) => {
+      const tone = STATES.get(value.toLowerCase());
+      return tone ? paint(tone, value) : value;
+    },
+    code: (text2, language) => {
+      const rule = `\u2500\u2500 ${language} \u2500\u2500`;
+      return [
+        self.dim(rule),
+        ...text2.split("\n").map((line) => self.dim(line)),
+        self.dim("\u2500".repeat(rule.length))
+      ];
+    },
+    json: (value) => JSON.stringify(value, null, 2).split("\n").map((line) => jsonLine(line, paint)).join("\n")
+  };
+  return self;
+}
+function jsonLine(line, paint) {
+  const match = /^(\s*)(?:("(?:[^"\\]|\\.)*")(: ))?(.*?)(,?)$/.exec(line);
+  if (!match) return line;
+  const [, indent = "", key, colon, value = "", comma = ""] = match;
+  const painted = value === "" ? "" : /^[[\]{}]+$/.test(value) ? paint("dim", value) : value.startsWith('"') ? value : paint("green", value);
+  return indent + (key && colon ? paint("bold", key) + paint("dim", colon) : "") + painted + (comma ? paint("dim", comma) : "");
+}
+
 // src/context.ts
 var CLI_OPERATIONS = /* @__PURE__ */ new Set([
   "getCliCapabilities",
@@ -19075,8 +19405,21 @@ var CLI_OPERATIONS = /* @__PURE__ */ new Set([
   "createCliOperation",
   "pollCliOperation",
   "getCliAccount",
-  "getCliUsage"
+  "getCliUsage",
+  "openCliLogin",
+  "redeemCliLogin",
+  "revokeCliCredential"
 ]);
+var LOGIN_TIMEOUT_SECONDS = 300;
+var LOGIN_RECORD_MS = 36e5;
+var LOOPBACK_GRACE_MS = 1e4;
+var defaultIo = () => ({
+  stderr: process.stderr,
+  openBrowser,
+  browserAvailable: () => browserAvailable(),
+  listen: listenLoopback,
+  env: process.env
+});
 var KEY_OPERATION_KINDS = /* @__PURE__ */ new Set(["app.add", "app.key.add"]);
 var OPERATION_RETENTION_MS = 90 * 864e5;
 var pathFor = operationPath;
@@ -19106,14 +19449,16 @@ var Context = class {
   state;
   transport;
   flags;
+  io;
   /** Operations whose result this run has printed, released once stdout has taken it. */
   delivered = /* @__PURE__ */ new Set();
   onboarding;
-  constructor(store, state, transport, flags) {
+  constructor(store, state, transport, flags, io = {}) {
     this.store = store;
     this.state = state;
     this.transport = transport;
     this.flags = flags;
+    this.io = { ...defaultIo(), ...io };
   }
   get active() {
     return this.state.active;
@@ -19121,6 +19466,28 @@ var Context = class {
   get url() {
     return this.active?.url || CLOUD;
   }
+  /** `AGW_MANAGEMENT_KEY`, when it is set to anything. */
+  get environmentKey() {
+    const value = this.io.env[MANAGEMENT_KEY_ENV]?.trim();
+    return value ? value : void 0;
+  }
+  /**
+   * The management credential every call is sent with: the environment's, which
+   * always wins, or the one the selected connection stored.
+   */
+  get managementKey() {
+    return this.environmentKey ?? this.active?.credential;
+  }
+  /** Refuses a command that would store a key the environment would then override. */
+  assertNoEnvironmentKey() {
+    if (this.environmentKey)
+      fail(
+        "environment_credential",
+        `${MANAGEMENT_KEY_ENV} is set, so it is the credential for every command and a stored login would never be used.`,
+        `Unset ${MANAGEMENT_KEY_ENV} to log in, or keep using it as is.`,
+        4
+      );
+  }
   async save() {
     await this.store.write(this.state);
   }
@@ -19158,7 +19525,20 @@ var Context = class {
   }
   /** The same call, with the connection's management credential attached. */
   async call(name, options = {}) {
-    return this.publicCall(name, { ...options, key: options.key ?? this.credential(name) });
+    const key = options.key ?? this.credential(name);
+    try {
+      return await this.publicCall(name, { ...options, key });
+    } catch (error51) {
+      if (error51 instanceof CliError && error51.details?.status === 401 && options.key === void 0 && this.environmentKey)
+        throw new CliError(
+          error51.code,
+          error51.message,
+          `Check ${MANAGEMENT_KEY_ENV}: the deployment refused the key it holds.`,
+          error51.exitCode,
+          error51.details
+        );
+      throw error51;
+    }
   }
   /**
    * The current management credential, or the refusal that names the way back.
@@ -19166,12 +19546,12 @@ var Context = class {
    * which is why those get the wider instruction.
    */
   credential(name) {
-    const token = this.active?.credential;
+    const token = this.managementKey;
     if (!token)
       fail(
         "login_required",
         "The selected connection is not authenticated.",
-        CLI_OPERATIONS.has(name) ? "Run agw account login." : "Run agw account login or agw deployment connect.",
+        CLI_OPERATIONS.has(name) ? `Run agw account login, or set ${MANAGEMENT_KEY_ENV}.` : `Run agw account login or agw deployment connect, or set ${MANAGEMENT_KEY_ENV}.`,
         4
       );
     return token;
@@ -19247,11 +19627,11 @@ var Context = class {
    * to, in which case it answers pending with the URL and the id to resume.
    */
   async operation(kind, payload, { browser: browser2 = false, url: url2 = this.url } = {}) {
-    if (!this.active?.credential)
+    if (!this.managementKey)
       fail(
         "login_required",
         "This operation requires account management access.",
-        "Run agw account login.",
+        `Run agw account login, or set ${MANAGEMENT_KEY_ENV}.`,
         4
       );
     const target = origin(url2);
@@ -19262,7 +19642,7 @@ var Context = class {
       // which is the correlation the compiler cannot follow through a generic.
       body: { kind, payload, token: record2.token, ...browser2 ? { browser: true } : {} },
       url: target,
-      key: this.active?.credential
+      key: this.managementKey
     })).data);
     if (data.state === "expired") {
       await this.forget(id);
@@ -19273,15 +19653,11 @@ var Context = class {
       return data;
     }
     const { data: capabilities } = await this.publicCall("getCliCapabilities", { url: target });
-    const browserUrl = new URL(data.url);
-    const trustedOrigin = origin(
-      capabilities.consoleOrigin ?? capabilities.deployment.consoleOrigin ?? target
-    );
-    if (browserUrl.origin !== trustedOrigin || browserUrl.username || browserUrl.password)
-      fail("invalid_response", "The approval URL is not on this deployment\u2019s trusted console origin.");
-    if (!this.flags["no-open"]) await openBrowser(data.url);
+    assertTrustedApprovalUrl(data.url, capabilities, target);
+    if (!this.flags["no-open"] && !await this.io.openBrowser(data.url))
+      this.io.stderr.write("Browser could not open. Use the returned handoff URL.\n");
     if (this.flags["no-open"] || this.flags.json || this.flags["no-input"]) return data;
-    process.stderr.write(`Complete the browser step: ${data.url}
+    this.io.stderr.write(`Complete the browser step: ${data.url}
 Operation: ${data.id}
 `);
     return this.wait(data.id, 300);
@@ -19297,8 +19673,13 @@ Operation: ${data.id}
    * Once the file holds the key, the record keeps only its metadata.
    */
   async keyOperation(kind, payload, requestedPath) {
-    if (!this.active?.credential)
-      fail("login_required", "The selected connection is not authenticated.", "Run agw account login.", 4);
+    if (!this.managementKey)
+      fail(
+        "login_required",
+        "The selected connection is not authenticated.",
+        `Run agw account login, or set ${MANAGEMENT_KEY_ENV}.`,
+        4
+      );
     const target = origin(this.url);
     const [id, record2] = await this.reserveOperation(kind, payload, target);
     const chosen = requestedPath ? resolve2(requestedPath) : record2.output?.path;
@@ -19331,7 +19712,7 @@ Operation: ${data.id}
       const operation2 = await this.send(id, async () => (await this.publicCall("createCliOperation", {
         body: { kind, payload, token: record2.token },
         url: target,
-        key: this.active?.credential
+        key: this.managementKey
       })).data);
       const minted = operation2.result?.api_key;
       const appId = operation2.result?.app?.id ?? payload.app ?? "";
@@ -19375,7 +19756,7 @@ Operation: ${data.id}
     }
   }
   async bootstrap() {
-    if (this.active?.credential) return;
+    if (this.managementKey) return;
     if (this.active)
       fail(
         "login_required",
@@ -19421,7 +19802,9 @@ Operation: ${data.id}
     };
     await this.save();
   }
-  async login(url2 = this.url) {
+  /** `account login --key-stdin` or `--key-prompt`: a management key a person already holds. */
+  async keyLogin(url2 = this.url) {
+    this.assertNoEnvironmentKey();
     const token = await secret(this.flags, "Management API key");
     if (!token)
       fail("input_required", "A management API key is required.", "Supply it with --key-stdin.");
@@ -19429,6 +19812,239 @@ Operation: ${data.id}
     await this.select(url2, { ...data, credential: { token } });
     return { connected: true, ...data };
   }
+  /**
+   * `deployment connect` while `AGW_MANAGEMENT_KEY` is set: selects the
+   * deployment the key is checked against, and stores no key of its own.
+   */
+  async connectWithEnvironment(url2) {
+    const key = this.environmentKey;
+    const target = origin(url2);
+    const { data } = await this.publicCall("getCliAccount", { key, url: target });
+    this.state.active = {
+      url: target,
+      account: data.account,
+      deployment: data.deployment,
+      authenticated: false
+    };
+    await this.save();
+    this.io.stderr.write(
+      `${MANAGEMENT_KEY_ENV} is set, so it stays the credential for every command; no key was stored.
+`
+    );
+    return { connected: true, ...data };
+  }
+  /**
+   * `account login`: a person approves this CLI in a browser, and it receives
+   * a management key of its own, stored exactly as a pasted one is.
+   *
+   * The login is recorded like every other operation before it is opened, so
+   * one left waiting — by `--json`, `--no-input`, a timeout — is finished by
+   * `agw operation wait`. When this process is going to wait and a browser on
+   * this machine is in front of the person, it also listens on `127.0.0.1`,
+   * and the approval page hands the browser back to it with a one-time code;
+   * the key is then released only for that code and never to a poll.
+   * Otherwise — `--no-open`, SSH, no display, nobody at the terminal — the
+   * approval may happen on any device, so nothing listens and the key is
+   * polled for. A browser that turns out not to open is the same case, found
+   * late: that login is abandoned for one that is polled.
+   */
+  async browserLogin(url2 = this.url) {
+    this.assertNoEnvironmentKey();
+    const target = origin(url2);
+    const { data: capabilities } = await this.publicCall("getCliCapabilities", { url: target });
+    if (!capabilities.features?.browserLogin)
+      fail(
+        "browser_login_unsupported",
+        "This deployment does not offer browser login.",
+        "Update the deployment, or pipe a management key to agw account login --key-stdin.",
+        3
+      );
+    const opens = !this.flags["no-open"] && this.io.browserAvailable();
+    const detached = Boolean(this.flags.json || this.flags["no-input"]);
+    if (detached) {
+      const { login } = await this.openLogin(target, capabilities, null);
+      if (opens && !await this.io.openBrowser(login.url))
+        this.io.stderr.write("Browser could not open. Use the returned URL.\n");
+      return login;
+    }
+    let loopback = opens ? await this.io.listen() : null;
+    try {
+      let opened = await this.openLogin(target, capabilities, loopback);
+      if (loopback && !await this.io.openBrowser(opened.login.url)) {
+        await loopback.close();
+        loopback = null;
+        await this.forget(opened.id);
+        this.io.stderr.write(
+          "The browser could not be opened, so the approval will be collected by polling.\n"
+        );
+        opened = await this.openLogin(target, capabilities, null);
+      }
+      const { id, token, login } = opened;
+      const style2 = styleFor(this.io.stderr);
+      this.io.stderr.write(
+        [
+          ...login.userCode ? [
+            `Pairing code: ${style2.headline(login.userCode)}`,
+            "Check that your browser shows this same code before you approve."
+          ] : [],
+          `Approve at: ${login.url}`,
+          ""
+        ].join("\n")
+      );
+      if (loopback) {
+        try {
+          await this.collectLoopbackLogin(id, token, target, capabilities, loopback);
+        } finally {
+          if (this.state.operations[id]) await this.forget(id);
+        }
+      } else await this.wait(id, LOGIN_TIMEOUT_SECONDS);
+      const { data } = await this.call("getCliAccount", { url: target });
+      return { connected: true, ...data };
+    } finally {
+      await loopback?.close();
+    }
+  }
+  /** Records and opens one login, refusing one that is not pending on the trusted console. */
+  async openLogin(target, capabilities, loopback) {
+    const token = randomToken();
+    const id = operationIdFor(token);
+    await this.recordLogin(id, token, target);
+    const { data: login } = await this.send(id, () => this.publicCall("openCliLogin", {
+      body: {
+        token,
+        client: clientDescription(),
+        ...loopback ? { loopbackRedirect: loopback.redirect } : {}
+      },
+      url: target
+    }));
+    if (login.state !== "pending" || !login.url) {
+      await this.forget(id);
+      expired({
+        id,
+        state: "expired",
+        expiresAt: login.expiresAt,
+        ...login.state === "denied" ? { denied: true } : {}
+      });
+    }
+    assertTrustedApprovalUrl(login.url, capabilities, target);
+    return { id, token, login: { ...login, url: login.url } };
+  }
+  /** Writes a login's record before it is opened, and drops logins long since expired. */
+  async recordLogin(id, token, url2) {
+    const now = Date.now();
+    for (const [key, record2] of Object.entries(this.state.operations))
+      if (record2.kind === "login" && now - Date.parse(record2.createdAt) > LOGIN_RECORD_MS)
+        delete this.state.operations[key];
+    this.state.operations[id] = {
+      url: url2,
+      token,
+      kind: "login",
+      // Never matched: every login is a new one, since a listener's port is.
+      requestHash: createHash2("sha256").update(id).digest("hex"),
+      accountId: null,
+      createdAt: new Date(now).toISOString()
+    };
+    await this.save();
+  }
+  /**
+   * Waits for the approval page to send the browser back with the redeem code,
+   * and redeems it. Polls meanwhile, since a declined or expired login never
+   * comes back to the listener.
+   */
+  async collectLoopbackLogin(id, token, url2, capabilities, loopback) {
+    let code;
+    const arrived = loopback.code.then((value) => {
+      code = value;
+    });
+    const end = Date.now() + LOGIN_TIMEOUT_SECONDS * 1e3;
+    let approvedAt;
+    while (code === void 0) {
+      const { data: status2 } = await this.publicCall("pollCliOperation", {
+        params: { id },
+        key: token,
+        url: url2
+      });
+      if (code !== void 0) break;
+      if (status2.state === "expired") {
+        await this.forget(id);
+        expired(status2);
+      }
+      if (status2.state === "completed") {
+        approvedAt ??= Date.now();
+        if (Date.now() - approvedAt > LOOPBACK_GRACE_MS) {
+          await this.forget(id);
+          fail(
+            "login_not_delivered",
+            "The login was approved, but the browser never came back to this terminal.",
+            "Run agw account login --no-open to approve it from another device, or run agw account login again here.",
+            3,
+            { id }
+          );
+        }
+      }
+      if (Date.now() >= end) {
+        await this.forget(id);
+        fail(
+          "wait_timeout",
+          "The login was not approved in time.",
+          "Run agw account login again.",
+          5,
+          { id, state: status2.state, expiresAt: status2.expiresAt }
+        );
+      }
+      await Promise.race([delay2(Math.min(1500, Math.max(0, end - Date.now()))), arrived]);
+    }
+    try {
+      const { data } = await this.publicCall("redeemCliLogin", {
+        params: { id },
+        body: { redeemCode: code },
+        key: token,
+        url: url2
+      });
+      await this.select(url2, { ...data, deployment: capabilities.deployment });
+      delete this.state.operations[id];
+      await this.save();
+      loopback.answer(true);
+    } catch (error51) {
+      loopback.answer(false);
+      throw error51;
+    }
+  }
+  /**
+   * `account logout`: the deployment revokes the stored key, then this machine
+   * forgets it. A key the deployment no longer accepts is already as good as
+   * revoked; any other failure still removes it here, and says so, because a
+   * machine must always be able to sign out.
+   */
+  async logout() {
+    const active = this.active;
+    const key = active?.credential;
+    let revoked = false;
+    if (active && key) {
+      try {
+        await this.publicCall("revokeCliCredential", { key, url: active.url });
+        revoked = true;
+      } catch (error51) {
+        const status2 = error51 instanceof CliError ? error51.details?.status : void 0;
+        if (status2 !== 401)
+          this.io.stderr.write(
+            `The key could not be revoked (${error51 instanceof Error ? error51.message : "unknown error"}). It was removed from this machine; revoke it on the console's keys page.
+`
+          );
+      }
+    }
+    if (active) {
+      delete active.credential;
+      active.authenticated = false;
+      await this.save();
+    }
+    if (this.environmentKey)
+      this.io.stderr.write(
+        `${MANAGEMENT_KEY_ENV} is still set, so it stays the credential for every command; unset it to sign out completely.
+`
+      );
+    return { loggedOut: true, revoked };
+  }
   async poll(id) {
     const record2 = this.state.operations[id];
     if (!record2)
@@ -19438,7 +20054,7 @@ Operation: ${data.id}
         "Resume it from the machine that initiated the operation.",
         4
       );
-    if (this.active && this.active.url !== record2.url)
+    if (this.active && this.active.url !== record2.url && record2.kind !== "login")
       fail(
         "operation_context",
         "This operation belongs to another selected deployment.",
@@ -19458,6 +20074,7 @@ Operation: ${data.id}
       url: record2.url
     });
     if (data.state === "expired") await this.forget(id);
+    if (data.state === "completed" && record2.kind === "login") return this.polledLogin(id, record2, data);
     if (data.state === "completed") {
       if (record2.kind === "claim" && data.account && this.active?.account?.id === record2.accountId && data.account.id === record2.accountId) {
         this.active.account = data.account;
@@ -19467,6 +20084,36 @@ Operation: ${data.id}
     }
     return data;
   }
+  /**
+   * A completed login, as a poll first sees it: its key is stored the way a
+   * pasted one is, and taken out of what the command prints. A login whose key
+   * was already handed to another poll, or is only ever redeemed, cannot be
+   * collected here.
+   */
+  async polledLogin(id, record2, data) {
+    const { credential, ...result } = data.result ?? {};
+    if (credential) {
+      if (!data.account)
+        fail(
+          "invalid_response",
+          "The login did not say which account it was approved into.",
+          "Run agw account login again.",
+          3
+        );
+      await this.select(record2.url, { credential, account: data.account, deployment: data.deployment });
+    } else if (!(this.active?.credential && this.active.url === record2.url && data.account && this.active.account?.id === data.account.id)) {
+      await this.forget(id);
+      fail(
+        "login_not_delivered",
+        "This login was approved, but its key can no longer be collected here.",
+        "Run agw account login again.",
+        3,
+        { id }
+      );
+    }
+    this.delivered.add(id);
+    return { ...data, result };
+  }
   async wait(id, timeout) {
     const end = Date.now() + timeout * 1e3;
     for (; ; ) {
@@ -19488,6 +20135,14 @@ Operation: ${data.id}
   }
 };
 function expired(operation2) {
+  if (operation2.denied)
+    fail(
+      "operation_denied",
+      "The browser step was declined.",
+      "Run the same command again to start a new one.",
+      3,
+      { id: operation2.id, state: "denied", expiresAt: operation2.expiresAt }
+    );
   fail(
     "operation_expired",
     "The browser step expired before it was approved.",
@@ -19517,20 +20172,23 @@ async function storeKey(minted, output, appId) {
     contentHash: createHash2("sha256").update(minted.key + "\n").digest("hex")
   };
 }
+function assertTrustedApprovalUrl(url2, capabilities, target) {
+  const browserUrl = new URL(url2);
+  const trustedOrigin = origin(
+    capabilities.consoleOrigin ?? capabilities.deployment.consoleOrigin ?? target
+  );
+  if (browserUrl.origin !== trustedOrigin || browserUrl.username || browserUrl.password)
+    fail("invalid_response", "The approval URL is not on this deployment\u2019s trusted console origin.");
+}
 async function openBrowser(url2) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url2] : [url2];
-  await new Promise((resolve3) => {
+  return new Promise((resolve3) => {
     const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.once("error", () => {
-      process.stderr.write(
-        "Browser could not open. Use the returned handoff URL.\n"
-      );
-      resolve3();
-    });
+    child.once("error", () => resolve3(false));
     child.once("spawn", () => {
       child.unref();
-      resolve3();
+      resolve3(true);
     });
   });
 }
@@ -19721,7 +20379,7 @@ async function cachedRelease(version2, integrity, source) {
   }
   return directory;
 }
-async function release(requested = VERSION, base = dirname(fileURLToPath(import.meta.url)), source = {}) {
+async function release2(requested = VERSION, base = dirname(fileURLToPath(import.meta.url)), source = {}) {
   if (requested !== VERSION)
     fail(
       "unsupported_release",
@@ -19976,14 +20634,14 @@ var Cloudflare = class {
   }
   async all(path) {
     const result = [];
-    for (let page = 1; page <= 1e4; page++) {
+    for (let page2 = 1; page2 <= 1e4; page2++) {
       const data = await this.request(
-        path + (path.includes("?") ? "&" : "?") + "page=" + page + "&per_page=50"
+        path + (path.includes("?") ? "&" : "?") + "page=" + page2 + "&per_page=50"
       );
       if (!data || !Array.isArray(data.result))
         fail("cloudflare_error", "Expected a Cloudflare resource list.");
       result.push(...data.result);
-      if (data.result_info?.total_pages ? page >= data.result_info.total_pages : data.result.length < 50)
+      if (data.result_info?.total_pages ? page2 >= data.result_info.total_pages : data.result.length < 50)
         return result;
     }
     fail("cloudflare_error", "Cloudflare pagination exceeded its safety bound.");
@@ -20304,7 +20962,7 @@ async function matchExisting(ctx, cf, flags, target) {
 }
 
 // src/deployment.ts
-function hostname4(value) {
+function hostname5(value) {
   const u = origin("https://" + value);
   if (new URL(u).hostname !== value || !value.includes(".") || value.includes(":"))
     fail("invalid_input", "Supply a hostname without protocol, path or port.");
@@ -20317,10 +20975,10 @@ async function authorized(flags, cf, loadRelease) {
   await cf.authenticate(flags);
   return artifact;
 }
-async function deploymentDomain(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+async function deploymentDomain(ctx, flags, cf = new Cloudflare(), loadRelease = release2) {
   const artifact = await authorized(flags, cf, loadRelease);
   const journal = await matchExisting(ctx, cf, flags, selectedInstallation(ctx));
-  const domain2 = hostname4(flags.hostname ?? await prompt("Custom hostname", flags));
+  const domain2 = hostname5(flags.hostname ?? await prompt("Custom hostname", flags));
   if (!flags["dry-run"])
     await confirm(
       `Attach ${domain2} to ${journal.name} in Cloudflare account ${journal.accountId}?`,
@@ -20328,7 +20986,7 @@ async function deploymentDomain(ctx, flags, cf = new Cloudflare(), loadRelease =
     );
   return attachDomain(ctx, cf, journal, domain2, artifact, Boolean(flags["dry-run"]));
 }
-async function deploymentUpdate(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+async function deploymentUpdate(ctx, flags, cf = new Cloudflare(), loadRelease = release2) {
   const artifact = await authorized(flags, cf, loadRelease);
   const journal = await matchExisting(ctx, cf, flags, selectedInstallation(ctx));
   if (!artifact.manifest.upgradeFrom.includes(journal.version))
@@ -20459,12 +21117,12 @@ async function install(ctx, cf, journal, artifact, url2, domain2) {
     await advance(ctx, journal, journal.phase, { pendingDomain: void 0 });
   }
 }
-async function deploymentSetup(ctx, flags, cf = new Cloudflare(), loadRelease = release) {
+async function deploymentSetup(ctx, flags, cf = new Cloudflare(), loadRelease = release2) {
   const artifact = await authorized(flags, cf, loadRelease);
   const name = flags.name ?? await prompt("Worker name", flags, { defaultValue: "app-ai-gateway" });
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(name))
     fail("invalid_input", "Worker name must be a lowercase slug of at most 63 characters.");
-  const domain2 = flags.domain ? hostname4(flags.domain) : void 0;
+  const domain2 = flags.domain ? hostname5(flags.domain) : void 0;
   const accountId = await cf.account(flags);
   const workers = await cf.all("/accounts/" + accountId + "/workers/scripts");
   const installations = ctx.state.installations ??= {};
@@ -20537,7 +21195,7 @@ async function deploymentSetup(ctx, flags, cf = new Cloudflare(), loadRelease =
     throw error51;
   }
 }
-async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loadRelease = release) {
+async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loadRelease = release2) {
   if (command === "deployment setup") return deploymentSetup(ctx, flags, cf, loadRelease);
   if (command === "deployment domain") return deploymentDomain(ctx, flags, cf, loadRelease);
   if (command === "deployment update") return deploymentUpdate(ctx, flags, cf, loadRelease);
@@ -20576,64 +21234,6 @@ var CliErrorDetailsSchema = external_exports.object({
   apiErrors: external_exports.string().optional()
 });
 
-// src/style.ts
-import { Writable } from "node:stream";
-import { styleText } from "node:util";
-var STATES = /* @__PURE__ */ new Map([
-  ["active", "green"],
-  ["ready", "green"],
-  ["completed", "green"],
-  ["yes", "green"],
-  ["pending", "yellow"],
-  ["failed", "red"],
-  ["expired", "red"],
-  ["blocked", "red"],
-  ["inactive", "red"],
-  ["disabled", "red"],
-  ["revoked", "red"],
-  ["no", "red"]
-]);
-function colorEnabled(sink, env = process.env) {
-  if (env["NO_COLOR"]) return false;
-  if (!(sink instanceof Writable)) return false;
-  if (env["FORCE_COLOR"] && env["FORCE_COLOR"] !== "0") return true;
-  if (!("isTTY" in sink && sink.isTTY === true)) return false;
-  return styleText("dim", "?", { stream: sink, validateStream: true }) !== "?";
-}
-var plain = style(false);
-var styleFor = (sink) => style(colorEnabled(sink));
-function style(enabled) {
-  const paint = (format, text2) => enabled ? styleText(format, text2, { validateStream: false }) : text2;
-  const self = {
-    enabled,
-    headline: (text2) => paint("bold", text2),
-    dim: (text2) => paint("dim", text2),
-    alert: (text2) => paint("red", text2),
-    warn: (text2) => paint("yellow", text2),
-    state: (value) => {
-      const tone = STATES.get(value.toLowerCase());
-      return tone ? paint(tone, value) : value;
-    },
-    code: (text2, language) => {
-      const rule = `\u2500\u2500 ${language} \u2500\u2500`;
-      return [
-        self.dim(rule),
-        ...text2.split("\n").map((line) => self.dim(line)),
-        self.dim("\u2500".repeat(rule.length))
-      ];
-    },
-    json: (value) => JSON.stringify(value, null, 2).split("\n").map((line) => jsonLine(line, paint)).join("\n")
-  };
-  return self;
-}
-function jsonLine(line, paint) {
-  const match = /^(\s*)(?:("(?:[^"\\]|\\.)*")(: ))?(.*?)(,?)$/.exec(line);
-  if (!match) return line;
-  const [, indent = "", key, colon, value = "", comma = ""] = match;
-  const painted = value === "" ? "" : /^[[\]{}]+$/.test(value) ? paint("dim", value) : value.startsWith('"') ? value : paint("green", value);
-  return indent + (key && colon ? paint("bold", key) + paint("dim", colon) : "") + painted + (comma ? paint("dim", comma) : "");
-}
-
 // src/human.ts
 function kv(entries, style2) {
   const rows = [];
@@ -20675,8 +21275,13 @@ function render(command, result, context, style2) {
     return [
       style2.headline(`Waiting for browser approval (${result.id}).`),
       result.url,
+      // A login's page shows the same code; checking it is what tells a person
+      // the request they are approving is this one.
+      ..."userCode" in result && result.userCode ? [`Pairing code: ${result.userCode} (check that the browser shows the same code)`] : [],
       `Resume: agw operation wait ${result.id}`
     ];
+  if ((command === "operation wait" || command === "operation status") && "kind" in result && result.kind === "login" && result.state === "completed")
+    return [style2.headline(`Signed in to ${context.url}.`), ...operation(result, style2)];
   switch (command) {
     case "account status":
     case "account login":
@@ -20858,7 +21463,7 @@ function show(command, result, style2) {
 function mutation(command, result, context, style2) {
   if ("loggedOut" in result)
     return [
-      style2.headline(`Signed out of ${context.url}.`) + " The stored credential was removed."
+      style2.headline(`Signed out of ${context.url}.`) + (result.revoked ? " The key was revoked and removed from this machine." : " The stored credential was removed.")
     ];
   if ("deleted" in result) {
     if ("provider_id" in result)
@@ -21315,27 +21920,23 @@ async function execute(parsed, ctx) {
   if (command.startsWith("operation "))
     return command === "operation wait" ? ctx.wait(args[0] ?? "", positive(flags.timeout ?? 300)) : ctx.poll(args[0] ?? "");
   if (command === "account status") return (await ctx.call("getCliAccount")).data;
-  if (command === "account login") return ctx.login();
+  if (command === "account login")
+    return flags["key-stdin"] || flags["key-prompt"] ? ctx.keyLogin() : ctx.browserLogin();
   if (command === "account claim") return ctx.operation("claim", {});
-  if (command === "account logout") {
-    if (ctx.active) {
-      delete ctx.active.credential;
-      ctx.active.authenticated = false;
-      await ctx.save();
-    }
-    return { loggedOut: true };
-  }
+  if (command === "account logout") return ctx.logout();
   if (command === "deployment connect") {
     const url2 = flags.cloud ? CLOUD : origin(
       flags.url ?? await required2(flags, "url", "Deployment HTTPS URL")
     );
-    return ctx.login(url2);
+    if (flags["key-stdin"] || flags["key-prompt"]) return ctx.keyLogin(url2);
+    if (ctx.environmentKey) return ctx.connectWithEnvironment(url2);
+    return ctx.browserLogin(url2);
   }
   if (command === "deployment status") {
     const { data } = await ctx.publicCall("getCliCapabilities");
     return {
       url: ctx.url,
-      authenticated: Boolean(ctx.active?.credential),
+      authenticated: Boolean(ctx.managementKey),
       ...data,
       connected: true
     };
@@ -21346,7 +21947,8 @@ async function main(argv = process.argv.slice(2), {
   store = new StateStore(),
   transport = new Transport(),
   stdout = process.stdout,
-  stderr: stderr2 = process.stderr
+  stderr: stderr2 = process.stderr,
+  io = {}
 } = {}) {
   const json2 = argv.includes("--json");
   try {
@@ -21361,7 +21963,7 @@ async function main(argv = process.argv.slice(2), {
     }
     const run = async () => {
       const state = await store.read((line) => stderr2.write(line + "\n"));
-      const ctx = new Context(store, state, transport, parsed.flags);
+      const ctx = new Context(store, state, transport, parsed.flags, { ...io, stderr: stderr2 });
       const result = await execute(parsed, ctx);
       const context = {
         url: ctx.url,