@meshy-ai/cli 0.1.0

package/dist/internal/make-plan.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Planning for `make` — pure, offline, and computed in full before the first
+ * task is created.
+ *
+ * Planning up front is what lets `--dry-run` and a real run share one code
+ * path: the quote the user approves is the quote the run bills against. A
+ * plan built step-by-step could always disagree with what was shown.
+ *
+ * The input decides the chain and nothing else does. There is no heuristic
+ * that picks a "better" route behind the user's back — a prompt runs the
+ * documented two-stage text flow, an image runs the single-task image flow.
+ * Anything more opinionated belongs in the caller's hands, reachable through
+ * the per-resource commands.
+ */
+export type MakeRoute = "text" | "image";
+export interface MakeStep {
+    /** 1-based position, as reported in progress lines. */
+    index: number;
+    resource: "text-to-3d" | "image-to-3d";
+    /** The step's role in the chain: preview | refine | textured. */
+    action: string;
+    credits: number;
+    /** One line of human progress text. */
+    label: string;
+}
+export interface MakePlan {
+    route: MakeRoute;
+    /** The prompt (text route) or the resolved image source (image route). */
+    input: string;
+    steps: MakeStep[];
+    estimatedCredits: number;
+}
+/**
+ * Decide whether the argument is a prompt or an image.
+ *
+ * A path-shaped argument that does not exist is an error rather than a prompt:
+ * silently generating "./cat.png" as text would spend credits on a typo.
+ */
+export declare function classifyInput(input: string): MakeRoute;
+export declare function planMake(input: string): MakePlan;
+//# sourceMappingURL=make-plan.d.ts.map

package/dist/internal/make-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-plan.d.ts","sourceRoot":"","sources":["../../src/internal/make-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,YAAY,GAAG,aAAa,CAAC;IACvC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAoBtD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAkBhD"}

package/dist/internal/make-plan.js

@@ -0,0 +1,67 @@
+/**
+ * Planning for `make` — pure, offline, and computed in full before the first
+ * task is created.
+ *
+ * Planning up front is what lets `--dry-run` and a real run share one code
+ * path: the quote the user approves is the quote the run bills against. A
+ * plan built step-by-step could always disagree with what was shown.
+ *
+ * The input decides the chain and nothing else does. There is no heuristic
+ * that picks a "better" route behind the user's back — a prompt runs the
+ * documented two-stage text flow, an image runs the single-task image flow.
+ * Anything more opinionated belongs in the caller's hands, reachable through
+ * the per-resource commands.
+ */
+import { existsSync, statSync } from "node:fs";
+import { isAbsolute, resolve as resolvePath } from "node:path";
+import { UsageError } from "./errors.js";
+import { estimateFor } from "./pricing.js";
+/** Extensions that make a bare argument look like an image path. */
+const IMAGE_EXT = /\.(png|jpe?g|webp|gif|bmp)$/i;
+/** Prefixes that make a bare argument look like a filesystem path. */
+const PATH_PREFIX = /^(\.\.?[/\\]|[/\\]|~[/\\]|[A-Za-z]:[/\\])/;
+/**
+ * Decide whether the argument is a prompt or an image.
+ *
+ * A path-shaped argument that does not exist is an error rather than a prompt:
+ * silently generating "./cat.png" as text would spend credits on a typo.
+ */
+export function classifyInput(input) {
+    const value = input.trim();
+    if (!value)
+        throw new UsageError("make requires a prompt or an image");
+    if (/^https?:\/\//i.test(value))
+        return "image";
+    if (value.startsWith("data:")) {
+        throw new UsageError("make does not accept data: URIs — pass a local file path instead");
+    }
+    const looksLikePath = PATH_PREFIX.test(value) || IMAGE_EXT.test(value);
+    if (!looksLikePath)
+        return "text";
+    const abs = isAbsolute(value) ? value : resolvePath(process.cwd(), value);
+    if (!existsSync(abs) || !statSync(abs).isFile()) {
+        throw new UsageError(`no such image: ${value} — pass an existing file, an http(s) URL, or quote it if you meant it as a prompt`);
+    }
+    return "image";
+}
+export function planMake(input) {
+    const route = classifyInput(input);
+    const steps = route === "text"
+        ? [
+            step(1, "text-to-3d", "preview", "text-to-3d:preview", "text-to-3d preview (geometry)"),
+            step(2, "text-to-3d", "refine", "text-to-3d:refine", "text-to-3d refine (textures)"),
+        ]
+        : [
+            step(1, "image-to-3d", "textured", "image-to-3d:textured", "image-to-3d (geometry + textures)"),
+        ];
+    return {
+        route,
+        input: input.trim(),
+        steps,
+        estimatedCredits: steps.reduce((sum, s) => sum + s.credits, 0),
+    };
+}
+function step(index, resource, action, priced, label) {
+    return { index, resource, action, credits: estimateFor(priced), label };
+}
+//# sourceMappingURL=make-plan.js.map

package/dist/internal/make-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-plan.js","sourceRoot":"","sources":["../../src/internal/make-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAwB,MAAM,cAAc,CAAC;AAuBjE,oEAAoE;AACpE,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,sEAAsE;AACtE,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,oCAAoC,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAClB,kBAAkB,KAAK,mFAAmF,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GACT,KAAK,KAAK,MAAM;QACd,CAAC,CAAC;YACE,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,+BAA+B,CAAC;YACvF,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,8BAA8B,CAAC;SACrF;QACH,CAAC,CAAC;YACE,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,sBAAsB,EAAE,mCAAmC,CAAC;SAChG,CAAC;IAER,OAAO;QACL,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;QACnB,KAAK;QACL,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CACX,KAAa,EACb,QAA8B,EAC9B,MAAc,EACd,MAAuB,EACvB,KAAa;IAEb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/internal/oauth.d.ts

@@ -0,0 +1,95 @@
+/**
+ * OAuth 2.0 + PKCE helpers for the browser-based `meshy auth login` flow.
+ *
+ * All I/O uses node: builtins only — no new npm dependencies.
+ *
+ * Flow overview:
+ *   1. generateState() + generateCodeVerifier() → random secrets
+ *   2. codeChallengeS256(verifier) → S256 challenge
+ *   3. buildAuthorizeUrl(...) → URL to open in the browser
+ *   4. startCallbackServer(port, expectedState) → loopback HTTP server
+ *   5. openBrowser(url) → best-effort platform opener
+ *   6. await waitForCallback → { code, state }
+ *   7. exchangeCode(...) → { access_token, refresh_token, expires_in, ... }
+ *   8. refreshTokens(...) → same shape
+ */
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+/** 24 random bytes → 32-char base64url string (state parameter). */
+export declare function generateState(): string;
+/** 32 random bytes → 43-char base64url string (code_verifier). */
+export declare function generateCodeVerifier(): string;
+/** SHA-256 of the verifier, base64url-encoded (code_challenge, S256 method). */
+export declare function codeChallengeS256(verifier: string): string;
+export interface BuildAuthorizeUrlParams {
+    base: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}
+/**
+ * Builds the authorization URL.
+ * Always uses client_id=meshy-cli, response_type=code, code_challenge_method=S256.
+ */
+export declare function buildAuthorizeUrl(params: BuildAuthorizeUrlParams): string;
+export interface CallbackResult {
+    code?: string;
+    state?: string;
+}
+export interface CallbackServer {
+    server: ReturnType<typeof createServer>;
+    port: number;
+    waitForCallback: Promise<CallbackResult>;
+}
+/**
+ * Starts a loopback HTTP server bound to 127.0.0.1 only.
+ *
+ * Handles ONLY GET /callback; everything else → 404.
+ * Falls back to a random port when preferredPort is EADDRINUSE.
+ * Closes itself immediately after the first /callback hit.
+ * Times out after 5 minutes.
+ *
+ * State verification happens INSIDE the server: a mismatched state param
+ * returns a 400 error page to the browser and rejects waitForCallback, so
+ * no success page is ever shown on a state mismatch.
+ */
+export declare function startCallbackServer(preferredPort: number, expectedState: string): Promise<CallbackServer>;
+/**
+ * Best-effort platform browser opener. Never throws.
+ *
+ * Env MESHY_CLI_NO_BROWSER=1 forces false (for tests / headless).
+ *
+ * IMPORTANT — Windows: we do NOT use `cmd /c start "" <url>` because cmd.exe
+ * interprets `&` in the OAuth query string as a command separator, breaking
+ * the URL and potentially executing arbitrary commands. Instead we spawn
+ * rundll32 url.dll,FileProtocolHandler directly with the URL as a plain argv
+ * element — no shell involved, no metacharacter risk. The same argv-array
+ * approach is used on all platforms (open/xdg-open also receive the URL as a
+ * direct argument, never through a shell string).
+ *
+ * The `_spawnOverride` parameter is a test hook — production callers omit it.
+ */
+export declare function openBrowser(url: string, _spawnOverride?: (cmd: string, args: string[]) => ReturnType<typeof spawn>): Promise<boolean>;
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token: string;
+    scope?: string;
+    user_id?: string;
+}
+export interface ExchangeCodeParams {
+    baseUrlV1: string;
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+/** Exchange an authorization code for tokens. */
+export declare function exchangeCode(params: ExchangeCodeParams): Promise<TokenResponse>;
+export interface RefreshTokensParams {
+    baseUrlV1: string;
+    refreshToken: string;
+}
+/** Exchange a refresh token for new tokens. */
+export declare function refreshTokens(params: RefreshTokensParams): Promise<TokenResponse>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/internal/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/internal/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAQ3C,oEAAoE;AACpE,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAMD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CASzE;AAoBD,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1C;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,CAAC,CAmHzB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,CAAC,GACzE,OAAO,CAAC,OAAO,CAAC,CAuClB;AAMD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA2GD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,wBAAsB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAQrF;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+CAA+C;AAC/C,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAMvF"}

package/dist/internal/oauth.js

@@ -0,0 +1,365 @@
+/**
+ * OAuth 2.0 + PKCE helpers for the browser-based `meshy auth login` flow.
+ *
+ * All I/O uses node: builtins only — no new npm dependencies.
+ *
+ * Flow overview:
+ *   1. generateState() + generateCodeVerifier() → random secrets
+ *   2. codeChallengeS256(verifier) → S256 challenge
+ *   3. buildAuthorizeUrl(...) → URL to open in the browser
+ *   4. startCallbackServer(port, expectedState) → loopback HTTP server
+ *   5. openBrowser(url) → best-effort platform opener
+ *   6. await waitForCallback → { code, state }
+ *   7. exchangeCode(...) → { access_token, refresh_token, expires_in, ... }
+ *   8. refreshTokens(...) → same shape
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { HintedError } from "./errors.js";
+import { USER_AGENT } from "./user-agent.js";
+// ---------------------------------------------------------------------------
+// PKCE helpers
+// ---------------------------------------------------------------------------
+/** 24 random bytes → 32-char base64url string (state parameter). */
+export function generateState() {
+    return randomBytes(24).toString("base64url");
+}
+/** 32 random bytes → 43-char base64url string (code_verifier). */
+export function generateCodeVerifier() {
+    return randomBytes(32).toString("base64url");
+}
+/** SHA-256 of the verifier, base64url-encoded (code_challenge, S256 method). */
+export function codeChallengeS256(verifier) {
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+/**
+ * Builds the authorization URL.
+ * Always uses client_id=meshy-cli, response_type=code, code_challenge_method=S256.
+ */
+export function buildAuthorizeUrl(params) {
+    const url = new URL(params.base);
+    url.searchParams.set("client_id", "meshy-cli");
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.toString();
+}
+// ---------------------------------------------------------------------------
+// HTML helpers
+// ---------------------------------------------------------------------------
+/** Escape characters that are special in HTML to prevent reflected XSS. */
+function escapeHtml(text) {
+    return text
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Meshy — Login successful</title></head>
+<body>
+<h1>Login successful</h1>
+<p>You can close this tab and return to the terminal.</p>
+</body>
+</html>`;
+function errorHtml(msg) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Meshy — Login failed</title></head>
+<body>
+<h1>Login failed</h1>
+<p>${escapeHtml(msg)}</p>
+<p>Return to the terminal for details.</p>
+</body>
+</html>`;
+}
+/**
+ * Starts a loopback HTTP server bound to 127.0.0.1 only.
+ *
+ * Handles ONLY GET /callback; everything else → 404.
+ * Falls back to a random port when preferredPort is EADDRINUSE.
+ * Closes itself immediately after the first /callback hit.
+ * Times out after 5 minutes.
+ *
+ * State verification happens INSIDE the server: a mismatched state param
+ * returns a 400 error page to the browser and rejects waitForCallback, so
+ * no success page is ever shown on a state mismatch.
+ */
+export function startCallbackServer(preferredPort, expectedState) {
+    return new Promise((resolveServer, rejectServer) => {
+        let settled = false;
+        let timeoutHandle;
+        let resolveCallback;
+        let rejectCallback;
+        const waitForCallback = new Promise((res, rej) => {
+            resolveCallback = res;
+            rejectCallback = rej;
+        });
+        function settle(result) {
+            if (settled)
+                return;
+            settled = true;
+            if (timeoutHandle !== undefined)
+                clearTimeout(timeoutHandle);
+            server.close();
+            if (result instanceof Error) {
+                rejectCallback(result);
+            }
+            else {
+                resolveCallback(result);
+            }
+        }
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            if (url.pathname !== "/callback") {
+                res.writeHead(404, { "Content-Type": "text/plain" });
+                res.end("Not found");
+                return;
+            }
+            const code = url.searchParams.get("code") ?? undefined;
+            const state = url.searchParams.get("state") ?? undefined;
+            const error = url.searchParams.get("error") ?? undefined;
+            const errorDescription = url.searchParams.get("error_description") ?? undefined;
+            if (error) {
+                const msg = errorDescription ?? error;
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(errorHtml(msg));
+                settle(new HintedError({
+                    message: `Authorization denied: ${msg}`,
+                    code: "oauth_denied",
+                    hint: "Run: meshy auth login",
+                }));
+                return;
+            }
+            // State verification: reject mismatches before showing any success page.
+            if (state !== expectedState) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(errorHtml("Login failed: state mismatch — you can close this tab and retry."));
+                settle(new HintedError({
+                    message: "OAuth state mismatch — possible CSRF attack. Run: meshy auth login",
+                    code: "oauth_state_mismatch",
+                    hint: "Run: meshy auth login",
+                }));
+                return;
+            }
+            // C2: Require a non-empty code. A missing or empty code with no error
+            // param means the authorization server sent a malformed response; show
+            // the error page (not the success page) so the browser doesn't mislead
+            // the user while the terminal fails with oauth_no_code.
+            if (!code) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(errorHtml("Login failed: no authorization code received — you can close this tab and retry."));
+                settle(new HintedError({
+                    message: "No authorization code received from the callback.",
+                    code: "oauth_no_code",
+                    hint: "Run: meshy auth login",
+                }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(SUCCESS_HTML);
+            settle({ code, state });
+        });
+        function tryListen(port, fallback) {
+            server.listen(port, "127.0.0.1", () => {
+                const addr = server.address();
+                const actualPort = typeof addr === "object" && addr ? addr.port : port;
+                // Set up the 5-minute timeout now that the server is up.
+                // unref() so the timer doesn't prevent process exit when the test
+                // suite finishes (or when the caller abandons the flow).
+                timeoutHandle = setTimeout(() => {
+                    settle(new HintedError({
+                        message: "Timed out waiting for the browser callback (5 minutes). Run: meshy auth login",
+                        code: "oauth_timeout",
+                        hint: "Run: meshy auth login",
+                    }));
+                }, CALLBACK_TIMEOUT_MS);
+                timeoutHandle.unref();
+                resolveServer({ server, port: actualPort, waitForCallback });
+            });
+            server.once("error", (err) => {
+                if (!fallback && err.code === "EADDRINUSE") {
+                    // Port busy — fall back to a random port.
+                    server.removeAllListeners("error");
+                    tryListen(0, true);
+                }
+                else {
+                    rejectServer(err);
+                }
+            });
+        }
+        tryListen(preferredPort, false);
+    });
+}
+// ---------------------------------------------------------------------------
+// Browser opener
+// ---------------------------------------------------------------------------
+/**
+ * Best-effort platform browser opener. Never throws.
+ *
+ * Env MESHY_CLI_NO_BROWSER=1 forces false (for tests / headless).
+ *
+ * IMPORTANT — Windows: we do NOT use `cmd /c start "" <url>` because cmd.exe
+ * interprets `&` in the OAuth query string as a command separator, breaking
+ * the URL and potentially executing arbitrary commands. Instead we spawn
+ * rundll32 url.dll,FileProtocolHandler directly with the URL as a plain argv
+ * element — no shell involved, no metacharacter risk. The same argv-array
+ * approach is used on all platforms (open/xdg-open also receive the URL as a
+ * direct argument, never through a shell string).
+ *
+ * The `_spawnOverride` parameter is a test hook — production callers omit it.
+ */
+export function openBrowser(url, _spawnOverride) {
+    if (process.env["MESHY_CLI_NO_BROWSER"])
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        try {
+            let cmd;
+            let args;
+            switch (process.platform) {
+                case "darwin":
+                    cmd = "open";
+                    args = [url];
+                    break;
+                case "win32":
+                    // rundll32 url.dll,FileProtocolHandler <url> — spawned directly (no
+                    // shell), so & and other metacharacters in the URL are safe.
+                    cmd = "rundll32";
+                    args = ["url.dll,FileProtocolHandler", url];
+                    break;
+                default:
+                    cmd = "xdg-open";
+                    args = [url];
+            }
+            const spawnFn = _spawnOverride ?? ((c, a) => spawn(c, a, { detached: true, stdio: "ignore" }));
+            const child = spawnFn(cmd, args);
+            // B2: Attach an error handler so a missing binary (ENOENT) or other
+            // spawn failure resolves false instead of crashing the process with an
+            // unhandled 'error' event.
+            child.on("error", () => resolve(false));
+            child.unref();
+            // Defer the optimistic resolve(true) by one microtask tick so the
+            // synchronous ENOENT 'error' event (which fires before the next tick)
+            // can call resolve(false) first. Once the promise is settled, the
+            // deferred resolve(true) is a no-op.
+            setImmediate(() => resolve(true));
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+const TOKEN_TIMEOUT_MS = 30_000;
+async function postToken(baseUrlV1, body) {
+    const url = `${baseUrlV1}/oauth/token`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": USER_AGENT },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        throw new HintedError({
+            message: `Network error contacting token endpoint: ${err instanceof Error ? err.message : String(err)}`,
+            code: "oauth_network",
+            hint: "Run: meshy auth login",
+        });
+    }
+    let parsed;
+    try {
+        parsed = await res.json();
+    }
+    catch {
+        throw new HintedError({
+            message: `Token endpoint returned non-JSON (status ${res.status})`,
+            code: "oauth_bad_response",
+            hint: "Run: meshy auth login",
+        });
+    }
+    if (!res.ok) {
+        const obj = parsed;
+        const msg = (typeof obj["error_description"] === "string" ? obj["error_description"] : undefined) ??
+            (typeof obj["message"] === "string" ? obj["message"] : undefined) ??
+            (typeof obj["error"] === "string" ? obj["error"] : undefined) ??
+            `Token endpoint error (status ${res.status})`;
+        throw new HintedError({
+            message: msg,
+            code: "oauth_token_error",
+            hint: "Run: meshy auth login",
+        });
+    }
+    const tok = parsed;
+    // Validate access_token.
+    if (typeof tok["access_token"] !== "string" || !tok["access_token"]) {
+        throw new HintedError({
+            message: "Token endpoint response missing access_token",
+            code: "oauth_bad_response",
+            hint: "Run: meshy auth login",
+        });
+    }
+    // Validate token_type (must be "Bearer", case-insensitive).
+    if (typeof tok["token_type"] !== "string" ||
+        tok["token_type"].toLowerCase() !== "bearer") {
+        throw new HintedError({
+            message: `Token endpoint returned unexpected token_type: ${JSON.stringify(tok["token_type"])}`,
+            code: "oauth_bad_response",
+            hint: "Run: meshy auth login",
+        });
+    }
+    // Validate expires_in (must be a finite positive number — guards against
+    // infinite-refresh-loop vectors where a server returns 0 or negative).
+    const expiresIn = tok["expires_in"];
+    if (typeof expiresIn !== "number" ||
+        !Number.isFinite(expiresIn) ||
+        expiresIn <= 0) {
+        throw new HintedError({
+            message: `Token endpoint returned invalid expires_in: ${JSON.stringify(expiresIn)}`,
+            code: "oauth_bad_response",
+            hint: "Run: meshy auth login",
+        });
+    }
+    // Validate refresh_token.
+    if (typeof tok["refresh_token"] !== "string" || !tok["refresh_token"]) {
+        throw new HintedError({
+            message: "Token endpoint response missing refresh_token",
+            code: "oauth_bad_response",
+            hint: "Run: meshy auth login",
+        });
+    }
+    return {
+        access_token: tok["access_token"],
+        token_type: tok["token_type"],
+        expires_in: expiresIn,
+        refresh_token: tok["refresh_token"],
+        scope: typeof tok["scope"] === "string" ? tok["scope"] : undefined,
+        user_id: typeof tok["user_id"] === "string" ? tok["user_id"] : undefined,
+    };
+}
+/** Exchange an authorization code for tokens. */
+export async function exchangeCode(params) {
+    return postToken(params.baseUrlV1, {
+        grant_type: "authorization_code",
+        code: params.code,
+        code_verifier: params.codeVerifier,
+        client_id: "meshy-cli",
+        redirect_uri: params.redirectUri,
+    });
+}
+/** Exchange a refresh token for new tokens. */
+export async function refreshTokens(params) {
+    return postToken(params.baseUrlV1, {
+        grant_type: "refresh_token",
+        refresh_token: params.refreshToken,
+        client_id: "meshy-cli",
+    });
+}
+//# sourceMappingURL=oauth.js.map

package/dist/internal/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/internal/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,2EAA2E;AAC3E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAiBD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEvD,MAAM,YAAY,GAAG;;;;;;;QAOb,CAAC;AAET,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;;;;;KAKJ,UAAU,CAAC,GAAG,CAAC;;;QAGZ,CAAC;AACT,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAqB,EACrB,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,aAAwD,CAAC;QAE7D,IAAI,eAAkD,CAAC;QACvD,IAAI,cAAqC,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAI,OAAO,CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/D,eAAe,GAAG,GAAG,CAAC;YACtB,cAAc,GAAG,GAAG,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,SAAS,MAAM,CAAC,MAA8B;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,aAAa,KAAK,SAAS;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,YAAY,KAAK,EAAE,CAAC;gBAC5B,cAAc,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YACzD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YACzD,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;YAEhF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,gBAAgB,IAAI,KAAK,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,yBAAyB,GAAG,EAAE;oBACvC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,yEAAyE;YACzE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAC,CAAC;gBACvF,MAAM,CAAC,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,oEAAoE;oBAC7E,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,kFAAkF,CAAC,CAAC,CAAC;gBACvG,MAAM,CAAC,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,mDAAmD;oBAC5D,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,SAAS,SAAS,CAAC,IAAY,EAAE,QAAiB;YAChD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAEvE,yDAAyD;gBACzD,kEAAkE;gBAClE,yDAAyD;gBACzD,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,MAAM,CAAC,IAAI,WAAW,CAAC;wBACrB,OAAO,EAAE,+EAA+E;wBACxF,IAAI,EAAE,eAAe;wBACrB,IAAI,EAAE,uBAAuB;qBAC9B,CAAC,CAAC,CAAC;gBACN,CAAC,EAAE,mBAAmB,CAAC,CAAC;gBACxB,aAAa,CAAC,KAAK,EAAE,CAAC;gBAEtB,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC3C,0CAA0C;oBAC1C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;oBACnC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,cAA0E;IAE1E,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,IAAI,GAAW,CAAC;YAChB,IAAI,IAAc,CAAC;YACnB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,QAAQ;oBACX,GAAG,GAAG,MAAM,CAAC;oBACb,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACb,MAAM;gBACR,KAAK,OAAO;oBACV,oEAAoE;oBACpE,6DAA6D;oBAC7D,GAAG,GAAG,UAAU,CAAC;oBACjB,IAAI,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBAC5C,MAAM;gBACR;oBACE,GAAG,GAAG,UAAU,CAAC;oBACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,IAAI,CAAC,CAAC,CAAS,EAAE,CAAW,EAAE,EAAE,CAC5D,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CACjD,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,oEAAoE;YACpE,uEAAuE;YACvE,2BAA2B;YAC3B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,qCAAqC;YACrC,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,KAAK,UAAU,SAAS,CACtB,SAAiB,EACjB,IAA4B;IAE5B,MAAM,GAAG,GAAG,GAAG,SAAS,cAAc,CAAC;IACvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE;YACrG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvG,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,4CAA4C,GAAG,CAAC,MAAM,GAAG;YAClE,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,GAAG,GACP,CAAC,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,gCAAgC,GAAG,CAAC,MAAM,GAAG,CAAC;QAChD,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,yBAAyB;IACzB,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,8CAA8C;YACvD,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IACE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrC,GAAG,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAC5C,CAAC;QACD,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,kDAAkD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE;YAC9F,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,CAAC,EACd,CAAC;QACD,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,+CAA+C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;YACnF,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC;YACpB,OAAO,EAAE,+CAA+C;YACxD,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,cAAc,CAAW;QAC3C,UAAU,EAAE,GAAG,CAAC,YAAY,CAAW;QACvC,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,GAAG,CAAC,eAAe,CAAW;QAC7C,KAAK,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAClE,OAAO,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACJ,CAAC;AASD,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA0B;IAC3D,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;QACjC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,WAAW;QACtB,YAAY,EAAE,MAAM,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC;AAOD,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA2B;IAC7D,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;QACjC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,WAAW;KACvB,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/output.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Output rendering. Keep stdout machine-parseable by default; `pretty` is
+ * opt-in for human eyes.
+ *
+ * Note: stdout JSON may carry `_notice.update` when a newer meshy-cli version
+ * is available. See update-notifier.ts for the two-channel design.
+ */
+export type OutputFormat = "json" | "pretty" | "ndjson";
+export interface OutputOptions {
+    format: OutputFormat;
+    file?: string;
+}
+export declare function emit(value: unknown, opts: OutputOptions): void;
+export declare function parseOutputFormat(raw: string | undefined): OutputFormat;
+//# sourceMappingURL=output.d.ts.map

package/dist/internal/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/internal/output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAa9D;AAkCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAIvE"}