@nocobase/app-cli-client 0.0.0-stage → 0.1.0-beta.0

package/dist/lib/credentials.js

@@ -0,0 +1,330 @@
+// The two identities the CLI acts as:
+//
+// - a run: inside a run's working directory, the token in the run's credentials file, which the runner wrote there
+//   (`AppCliConfig.runCredentialsFile`) and deletes when the run ends, found through `AGENT_RUN_CREDENTIALS` or by
+//   walking up from the working directory;
+// - a person: anywhere else, `<PREFIX>_API_KEY` (with `<PREFIX>_SERVER`) when set, which is how CI acts without
+//   signing in, else the credential of the selected profile, which `<bin> login` stored in the system keychain (or,
+//   where there is none, in `<state dir>/config.json`, 0600): the session token a sign-in through the browser received,
+//   sent as `Authorization: Bearer`, or an API key given with `--api-key-stdin`, sent as `x-api-key`. `config.json`
+//   names each profile's server, what its credential is and where, and which profile is current; `--profile` and
+//   `<PREFIX>_PROFILE` choose another.
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { EXIT_CODES, HEADERS, RUN_CREDENTIALS_ENV, RunCliCredentialSchema, } from '@nocobase/agent-protocol';
+import { z } from 'zod';
+import { appCliConfig, appCliPaths, } from "../config.js";
+import { UsageError } from "./command.js";
+import { readJson, writeJsonAtomic } from "./files.js";
+import { ApiClient } from "./http.js";
+import { defaultSecretStore, describeStorage, keychainAccount, keychainDisabled, keychainLabel, keychainService, } from "./secrets/index.js";
+const CredentialKindSchema = z.enum(['session', 'apiKey']);
+/** What a profile's credential is and where: a keychain, or `config.json` itself. */
+const StoredAuthSchema = z.discriminatedUnion('storage', [
+    z.object({
+        kind: CredentialKindSchema,
+        storage: z.enum(['keychain', 'secret-service', 'credential-manager']),
+    }),
+    z.object({
+        kind: CredentialKindSchema,
+        storage: z.literal('file'),
+        key: z.string().min(1),
+    }),
+]);
+/** One signed-in server: its address, where its key is, and what the server named the key. */
+const StoredProfileSchema = z.object({
+    server: z.string().min(1),
+    auth: StoredAuthSchema,
+    keyId: z.string().optional(),
+    keyName: z.string().optional(),
+});
+/** `config.json`: the profiles by name, and the current one. */
+const StoredConfigSchema = z.object({
+    current: z.string().optional(),
+    profiles: z.record(z.string(), StoredProfileSchema),
+});
+/** The profile a sign-in goes to when none is named. */
+export const DEFAULT_PROFILE = 'default';
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+function resolveOptions(options) {
+    const config = options.config ?? appCliConfig();
+    const env = options.env ?? process.env;
+    return {
+        config,
+        env,
+        paths: options.paths ?? appCliPaths(),
+        store: 'store' in options ? options.store : defaultSecretStore(config, env),
+    };
+}
+/** `<PREFIX>_<name>`, such as `ACME_API_KEY`; undefined when the CLI has no prefix or the variable is empty. */
+export function envValue(config, env, name) {
+    if (config.envPrefix === undefined)
+        return undefined;
+    const value = env[`${config.envPrefix}_${name}`];
+    return value === undefined || value.trim() === '' ? undefined : value.trim();
+}
+/** The keychain account of a profile: the state directory, and the profile's name after `#` beside the default. */
+export function profileAccount(home, profile) {
+    const account = keychainAccount(home);
+    return profile === DEFAULT_PROFILE ? account : `${account}#${profile}`;
+}
+/** Reads `config.json`; a file written before profiles is the default profile. */
+async function readStored(paths) {
+    const raw = await readJson(paths.userConfig);
+    const parsed = StoredConfigSchema.safeParse(raw);
+    if (parsed.success)
+        return parsed.data;
+    const legacy = StoredProfileSchema.safeParse(raw);
+    if (legacy.success)
+        return {
+            current: DEFAULT_PROFILE,
+            profiles: { [DEFAULT_PROFILE]: legacy.data },
+        };
+    return { profiles: {} };
+}
+async function writeStored(paths, stored) {
+    await writeJsonAtomic(paths.userConfig, stored);
+}
+/** The profile a command acts as: `--profile`, `<PREFIX>_PROFILE`, the current one, or `default`. */
+export function selectedProfile(stored, options, config, env) {
+    return (options.profile ??
+        envValue(config, env, 'PROFILE') ??
+        stored.current ??
+        DEFAULT_PROFILE);
+}
+/** Refuses a name a profile cannot have. */
+export function checkProfileName(name) {
+    if (!PROFILE_NAME.test(name))
+        throw new UsageError(`Not a profile name: ${name}. Use letters, digits, ".", "_" and "-".`);
+    return name;
+}
+/**
+ * The key the CLI acts with, or undefined when nobody is signed in: `<PREFIX>_API_KEY` (with `<PREFIX>_SERVER`, or the
+ * profile's server), else the selected profile's. Throws a `UsageError` when the key is in a keychain that cannot be
+ * read or no longer has it, and inside an agent run, which never acts as the person.
+ */
+export async function readUserConfig(options = {}) {
+    const { config, env, paths, store } = resolveOptions(options);
+    const named = env[RUN_CREDENTIALS_ENV];
+    if (named !== undefined && named !== '')
+        throw new UsageError(`This is an agent run, and its credentials file (${named}) is gone: the run has ended.`, EXIT_CODES.auth);
+    const stored = await readStored(paths);
+    const profile = selectedProfile(stored, options, config, env);
+    const entry = stored.profiles[profile];
+    const envKey = envValue(config, env, 'API_KEY');
+    if (envKey !== undefined) {
+        const server = envValue(config, env, 'SERVER') ?? entry?.server;
+        if (server === undefined)
+            throw new UsageError(`${config.envPrefix}_API_KEY is set without a server: set ${config.envPrefix}_SERVER too.`, EXIT_CODES.auth);
+        return {
+            server: normalizeServer(server),
+            key: envKey,
+            kind: 'apiKey',
+            storage: 'env',
+        };
+    }
+    if (entry === undefined) {
+        if (options.profile !== undefined &&
+            Object.keys(stored.profiles).length > 0)
+            throw new UsageError(`There is no profile ${profile}. \`${config.bin} profile list\` shows them.`, EXIT_CODES.auth);
+        return undefined;
+    }
+    const server = envValue(config, env, 'SERVER') ?? entry.server;
+    const known = {
+        profile,
+        kind: entry.auth.kind,
+        ...(entry.keyId ? { keyId: entry.keyId } : {}),
+        ...(entry.keyName ? { keyName: entry.keyName } : {}),
+    };
+    if (entry.auth.storage === 'file')
+        return { server, key: entry.auth.key, storage: 'file', ...known };
+    const where = describeStorage(entry.auth.storage, paths.userConfig);
+    const again = `Run \`${config.bin} login${profile === DEFAULT_PROFILE ? '' : ` --profile ${profile}`}\` again.`;
+    if (store?.kind !== entry.auth.storage)
+        throw new UsageError(`The credential is in ${where}, which this process cannot use${config.keychainEnv === undefined ? '' : ` (${config.keychainEnv}=off?)`}. ${again}`, EXIT_CODES.auth);
+    let key;
+    try {
+        key = await store.get(keychainService(config), profileAccount(paths.home, profile));
+    }
+    catch (error) {
+        throw new UsageError(`${error instanceof Error ? error.message : String(error)}. Unlock it, or ${again.toLowerCase()}`, EXIT_CODES.auth);
+    }
+    if (key === undefined)
+        throw new UsageError(`The credential is gone from ${where}. ${again}`, EXIT_CODES.auth);
+    return { server, key, storage: entry.auth.storage, ...known };
+}
+/**
+ * The server and profile a command would act as, read without its key (no keychain is touched): what completion needs
+ * to find the cached manifest. Undefined when nobody is signed in.
+ */
+export async function peekUserConfig(options = {}) {
+    const { config, env, paths } = resolveOptions(options);
+    const stored = await readStored(paths).catch(() => ({
+        profiles: {},
+    }));
+    const profile = selectedProfile(stored, options, config, env);
+    const entry = stored.profiles[profile];
+    if (envValue(config, env, 'API_KEY') !== undefined) {
+        const server = envValue(config, env, 'SERVER') ?? entry?.server;
+        return server === undefined
+            ? undefined
+            : { server: normalizeServer(server) };
+    }
+    if (entry === undefined)
+        return undefined;
+    return { server: envValue(config, env, 'SERVER') ?? entry.server, profile };
+}
+/**
+ * Stores the credential of `server` as a profile (the selected one, `default` at first) and makes it current: in the
+ * keychain, or in `config.json` (0600) with a warning when there is no usable keychain.
+ */
+export async function saveUserConfig(server, key, options = {}) {
+    const { config, env, paths, store } = resolveOptions(options);
+    const stored = await readStored(paths);
+    const profile = checkProfileName(options.profile ??
+        envValue(config, env, 'PROFILE') ??
+        stored.current ??
+        DEFAULT_PROFILE);
+    const service = keychainService(config);
+    const account = profileAccount(paths.home, profile);
+    const kind = options.kind ?? 'apiKey';
+    const info = {
+        ...(options.keyId ? { keyId: options.keyId } : {}),
+        ...(options.keyName ? { keyName: options.keyName } : {}),
+    };
+    const save = async (entry) => writeStored(paths, {
+        current: profile,
+        profiles: { ...stored.profiles, [profile]: entry },
+    });
+    let reason = keychainDisabled(config, env) && config.keychainEnv !== undefined
+        ? `${config.keychainEnv} turns the system keychain off`
+        : 'There is no usable system keychain here';
+    if (store !== undefined && (await store.available())) {
+        try {
+            await store.set(service, account, key, keychainLabel(config, server));
+            await save({
+                server,
+                auth: { kind, storage: store.kind },
+                ...info,
+            });
+            return { storage: store.kind, profile };
+        }
+        catch (error) {
+            reason = error instanceof Error ? error.message : String(error);
+        }
+    }
+    await save({
+        server,
+        auth: { kind, storage: 'file', key },
+        ...info,
+    });
+    // A key an earlier login kept in the keychain is not the one in use any more.
+    if (store !== undefined)
+        await store.delete(service, account).catch(() => undefined);
+    return {
+        storage: 'file',
+        profile,
+        warning: `${reason.replace(/\.$/u, '')}; the ${kind === 'session' ? 'session token' : 'API key'} is stored in ${describeStorage('file', paths.userConfig)}.`,
+    };
+}
+/** The profiles, current first, without their keys. */
+export async function listProfiles(options = {}) {
+    const { config, env, paths } = resolveOptions(options);
+    const stored = await readStored(paths);
+    const current = selectedProfile(stored, options, config, env);
+    return Object.entries(stored.profiles)
+        .map(([name, entry]) => ({
+        name,
+        server: entry.server,
+        storage: entry.auth.storage,
+        kind: entry.auth.kind,
+        ...(entry.keyName ? { keyName: entry.keyName } : {}),
+        current: name === current,
+    }))
+        .sort((a, b) => a.current === b.current
+        ? a.name.localeCompare(b.name)
+        : a.current
+            ? -1
+            : 1);
+}
+/** Makes `name` the current profile. */
+export async function useProfile(name, options = {}) {
+    const { config, paths } = resolveOptions(options);
+    const stored = await readStored(paths);
+    if (!(name in stored.profiles))
+        throw new UsageError(`There is no profile ${name}. \`${config.bin} profile list\` shows them.`, EXIT_CODES.notFound);
+    await writeStored(paths, { ...stored, current: name });
+}
+/**
+ * Forgets a profile: its key leaves the keychain and `config.json`. The current profile becomes the first one left.
+ * Answers what was forgotten, or undefined when there was no such profile.
+ */
+export async function removeProfile(name, options = {}) {
+    const { config, paths, store } = resolveOptions(options);
+    const stored = await readStored(paths);
+    const entry = stored.profiles[name];
+    if (entry === undefined)
+        return undefined;
+    const profiles = { ...stored.profiles };
+    delete profiles[name];
+    if (store !== undefined)
+        await store
+            .delete(keychainService(config), profileAccount(paths.home, name))
+            .catch(() => undefined);
+    const left = Object.keys(profiles).sort();
+    const current = stored.current === name ? left[0] : stored.current;
+    await writeStored(paths, {
+        ...(current === undefined ? {} : { current }),
+        profiles,
+    });
+    return { server: entry.server };
+}
+/** The headers a credential authenticates with: `Authorization: Bearer` for a session token, `x-api-key` for a key. */
+export function credentialHeaders(credential) {
+    return credential.kind === 'session'
+        ? { authorization: `Bearer ${credential.key}` }
+        : { [HEADERS.apiKey]: credential.key };
+}
+export function userClient(config) {
+    return new ApiClient({
+        server: config.server,
+        headers: credentialHeaders(config),
+    });
+}
+export function runClient(credential) {
+    return new ApiClient({
+        server: credential.server,
+        headers: { [HEADERS.runToken]: credential.token },
+    });
+}
+/** Accepts `https://host/path` and `host:port`; drops a trailing slash. */
+export function normalizeServer(server) {
+    const withScheme = /^https?:\/\//.test(server) ? server : `http://${server}`;
+    const url = new URL(withScheme);
+    return url.href.replace(/\/+$/, '');
+}
+/**
+ * The run's credentials file: the one the runner names for this process (`AGENT_RUN_CREDENTIALS`, set only for the CLI
+ * by the command the runner puts on the agent's PATH, so it works from a directory outside the run's own), else the
+ * nearest one at or above `from`.
+ */
+export function findRunCredentials(from, config = appCliConfig(), env = process.env) {
+    const named = env[RUN_CREDENTIALS_ENV];
+    if (named !== undefined && named !== '' && existsSync(named))
+        return path.resolve(named);
+    let current = path.resolve(from);
+    for (;;) {
+        const candidate = path.join(current, config.runCredentialsFile);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+export async function readRunCredentials(file) {
+    return RunCliCredentialSchema.parse(JSON.parse(await readFile(file, 'utf8')));
+}
+//# sourceMappingURL=credentials.js.map

package/dist/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,mHAAmH;AACnH,mHAAmH;AACnH,2CAA2C;AAC3C,gHAAgH;AAChH,oHAAoH;AACpH,wHAAwH;AACxH,oHAAoH;AACpH,iHAAiH;AACjH,uCAAuC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,OAAO,EACP,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,WAAW,GAGZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAK5B,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3D,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACvD,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;KACtE,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACvB,CAAC;CACH,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC;CACpD,CAAC,CAAC;AAKH,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AA2C1D,SAAS,cAAc,CAAC,OAA0B;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,OAAO;QACL,MAAM;QACN,GAAG;QACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE;QACrC,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,QAAQ,CACtB,MAAoB,EACpB,GAAsB,EACtB,IAAsC;IAEtC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,KAAK,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO;QAChB,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE;SAC7C,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAkB,EAClB,MAAoB;IAEpB,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,eAAe,CAC7B,MAAiD,EACjD,OAA2C,EAC3C,MAAoB,EACpB,GAAsB;IAEtB,OAAO,CACL,OAAO,CAAC,OAAO;QACf,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC;QAChC,MAAM,CAAC,OAAO;QACd,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,MAAM,IAAI,UAAU,CAClB,uBAAuB,IAAI,0CAA0C,CACtE,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA6B,EAAE;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QACrC,MAAM,IAAI,UAAU,CAClB,mDAAmD,KAAK,+BAA+B,EACvF,UAAU,CAAC,IAAI,CAChB,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,MAAM,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,UAAU,CAClB,GAAG,MAAM,CAAC,SAAS,yCAAyC,MAAM,CAAC,SAAS,cAAc,EAC1F,UAAU,CAAC,IAAI,CAChB,CAAC;QACJ,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;YAC/B,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IACE,OAAO,CAAC,OAAO,KAAK,SAAS;YAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAEvC,MAAM,IAAI,UAAU,CAClB,uBAAuB,OAAO,OAAO,MAAM,CAAC,GAAG,6BAA6B,EAC5E,UAAU,CAAC,IAAI,CAChB,CAAC;QACJ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;IAC/D,MAAM,KAAK,GAAG;QACZ,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM;QAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,SAAS,MAAM,CAAC,GAAG,SAAS,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,WAAW,CAAC;IAChH,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO;QACpC,MAAM,IAAI,UAAU,CAClB,wBAAwB,KAAK,kCAAkC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,WAAW,QAAQ,KAAK,KAAK,EAAE,EAClJ,UAAU,CAAC,IAAI,CAChB,CAAC;IACJ,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CACnB,eAAe,CAAC,MAAM,CAAC,EACvB,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,WAAW,EAAE,EAAE,EACjG,UAAU,CAAC,IAAI,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QACnB,MAAM,IAAI,UAAU,CAClB,+BAA+B,KAAK,KAAK,KAAK,EAAE,EAChD,UAAU,CAAC,IAAI,CAChB,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA6B,EAAE;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAiB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,MAAM,CAAC;QAChE,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAC9E,CAAC;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,GAAW,EACX,UAA4C,EAAE;IAE9C,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,OAAO;QACb,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC;QAChC,MAAM,CAAC,OAAO;QACd,eAAe,CAClB,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAmB,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,KAAoB,EAAE,EAAE,CAC1C,WAAW,CAAC,KAAK,EAAE;QACjB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;KACnD,CAAC,CAAC;IACL,IAAI,MAAM,GACR,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAC/D,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,gCAAgC;QACvD,CAAC,CAAC,yCAAyC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC;gBACT,MAAM;gBACN,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnC,GAAG,IAAI;aACR,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,CAAC;QACT,MAAM;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;QACpC,GAAG,IAAI;KACR,CAAC,CAAC;IACH,8EAA8E;IAC9E,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO;QACL,OAAO,EAAE,MAAM;QACf,OAAO;QACP,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,iBAAiB,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;KAC7J,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAA6B,EAAE;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,KAAK,OAAO;KAC1B,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACrB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CACR,CAAC;AACN,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,UAA6B,EAAE;IAE/B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;QAC5B,MAAM,IAAI,UAAU,CAClB,uBAAuB,IAAI,OAAO,MAAM,CAAC,GAAG,6BAA6B,EACzE,UAAU,CAAC,QAAQ,CACpB,CAAC;IACJ,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,UAA6B,EAAE;IAE/B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,KAAK;aACR,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACjE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACnE,MAAM,WAAW,CAAC,KAAK,EAAE;QACvB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,iBAAiB,CAC/B,UAAwE;IAExE,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS;QAClC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,GAAG,EAAE,EAAE;QAC/C,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAEC;IAED,OAAO,IAAI,SAAS,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B;IACpD,OAAO,IAAI,SAAS,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE;KAClD,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,SAAuB,YAAY,EAAE,EACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY;IAEZ,OAAO,sBAAsB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CACpD,CAAC;AACJ,CAAC"}

package/dist/lib/device.d.ts

@@ -0,0 +1,48 @@
+import { type AppCliAuth } from '../config.ts';
+/** What the server answers a new authorization: the codes, where to approve, and how often to ask. */
+export interface DeviceAuthorization {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly verificationUriComplete: string;
+    /** Seconds. */
+    readonly expiresIn: number;
+    /** Seconds between polls. */
+    readonly interval: number;
+}
+/** What the server answers once the person approved: the session token, and seconds until it expires. */
+export interface IssuedSession {
+    readonly token: string;
+    readonly expiresIn?: number | undefined;
+}
+/** What a CLI's requests say of it, which the server keeps with the session: the CLI, its version, the machine. */
+export declare function cliUserAgent(client: {
+    readonly bin: string;
+    readonly version?: string | undefined;
+}, host?: string): string;
+export interface DeviceRequestOptions {
+    readonly fetch?: typeof fetch;
+    readonly userAgent?: string;
+}
+export declare function startDeviceAuthorization(server: string, auth: AppCliAuth, options?: DeviceRequestOptions): Promise<DeviceAuthorization>;
+export interface PollOptions extends DeviceRequestOptions {
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+}
+/**
+ * Polls until the server answers the session token; an `AppApiError` when the person declined (`ACCESS_DENIED`), the
+ * code expired (`EXPIRED_TOKEN`), or the server refused it (`INVALID_GRANT`). `SLOW_DOWN` adds five seconds to the
+ * interval, as RFC 8628 asks.
+ */
+export declare function pollDeviceAuthorization(server: string, auth: AppCliAuth, started: DeviceAuthorization, options?: PollOptions): Promise<IssuedSession>;
+/**
+ * The command that opens a page in this machine's browser, or undefined where there is none to see it: a session over
+ * SSH, or a Linux machine with no display. The sign-in page is then opened on another device.
+ */
+export declare function browserOpener(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): {
+    file: string;
+    args: (url: string) => string[];
+} | undefined;
+/** Opens `url` in the default browser; false when this machine has none to open it in. */
+export declare function openBrowser(url: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=device.d.ts.map

package/dist/lib/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/lib/device.ts"],"names":[],"mappings":"AAYA,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAa3E,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,eAAe;IACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAQD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAOD,mHAAmH;AACnH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACvE,IAAI,GAAE,MAAsB,GAC3B,MAAM,CAER;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAsDD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;AAMD,MAAM,WAAW,WAAY,SAAQ,oBAAoB;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAoCxB;AAwBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAiB/D;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAcT"}

package/dist/lib/device.js

@@ -0,0 +1,189 @@
+// Signing in through the browser (`AppCliConfig.auth`), RFC 8628 as Better Auth's `deviceAuthorization()` serves it:
+// the CLI asks for a device code and a short user code, shows the code and opens the page where the signed-in person
+// approves it, and polls until the server answers a session token, the person declines, or the code expires. The
+// endpoints answer RFC 8628's bodies (`{ device_code, ... }`, `{ error, error_description }`), not the application's
+// standard ones, so they are read here rather than through `ApiClient`.
+import { spawn } from 'node:child_process';
+import { accessSync, constants } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+import { authRouteOf, cliClientIdOf } from "../config.js";
+import { serverPath, urlFor } from "../dynamic/session.js";
+import { AppApiError } from "./http.js";
+const StartedSchema = z.object({
+    device_code: z.string().min(1),
+    user_code: z.string().min(1),
+    verification_uri: z.string().min(1),
+    verification_uri_complete: z.string().min(1).optional(),
+    expires_in: z.number().positive(),
+    interval: z.number().positive().optional(),
+});
+const IssuedSchema = z.object({
+    access_token: z.string().min(1),
+    token_type: z.string().optional(),
+    expires_in: z.number().optional(),
+});
+const ErrorSchema = z.object({
+    error: z.string(),
+    error_description: z.string().optional(),
+});
+/** What a CLI's requests say of it, which the server keeps with the session: the CLI, its version, the machine. */
+export function cliUserAgent(client, host = os.hostname()) {
+    return `${client.bin}/${client.version ?? '0'} (${host}; ${process.platform} ${process.arch}) node/${process.versions.node}`;
+}
+/**
+ * POSTs to a device endpoint. A failure is an `AppApiError` whose `reason` is the RFC 8628 `error` in capitals,
+ * such as `AUTHORIZATION_PENDING` or `ACCESS_DENIED`.
+ */
+async function postDevice(server, route, body, options) {
+    const url = urlFor(server, route);
+    let response;
+    try {
+        response = await (options.fetch ?? fetch)(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+                ...(options.userAgent ? { 'user-agent': options.userAgent } : {}),
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch (error) {
+        throw new AppApiError(0, 'NETWORK', `Could not reach ${url.origin}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const text = await response.text().catch(() => '');
+    let parsed;
+    try {
+        parsed = text === '' ? undefined : JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (response.ok)
+        return parsed;
+    const failure = ErrorSchema.safeParse(parsed);
+    if (failure.success)
+        throw new AppApiError(response.status, failure.data.error.toUpperCase(), failure.data.error_description ?? failure.data.error);
+    throw new AppApiError(response.status, `HTTP_${response.status}`, `POST ${url.pathname} answered ${response.status}`);
+}
+export async function startDeviceAuthorization(server, auth, options = {}) {
+    const started = StartedSchema.parse(await postDevice(server, serverPath(server, authRouteOf(auth, '/device/code')), { client_id: cliClientIdOf(auth) }, options));
+    // The server may answer the page below its origin, not knowing the address it is reached at.
+    const origin = new URL(server).origin;
+    const verificationUri = new URL(started.verification_uri, origin).href;
+    return {
+        deviceCode: started.device_code,
+        userCode: started.user_code,
+        verificationUri,
+        verificationUriComplete: started.verification_uri_complete
+            ? new URL(started.verification_uri_complete, origin).href
+            : verificationUri,
+        expiresIn: started.expires_in,
+        interval: started.interval ?? 5,
+    };
+}
+/** Reasons the token endpoint answers while the person has not approved yet. */
+const PENDING = 'AUTHORIZATION_PENDING';
+const SLOW_DOWN = 'SLOW_DOWN';
+/**
+ * Polls until the server answers the session token; an `AppApiError` when the person declined (`ACCESS_DENIED`), the
+ * code expired (`EXPIRED_TOKEN`), or the server refused it (`INVALID_GRANT`). `SLOW_DOWN` adds five seconds to the
+ * interval, as RFC 8628 asks.
+ */
+export async function pollDeviceAuthorization(server, auth, started, options = {}) {
+    const sleep = options.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = options.now ?? Date.now;
+    const deadline = now() + started.expiresIn * 1000;
+    let interval = started.interval * 1000;
+    const route = serverPath(server, authRouteOf(auth, '/device/token'));
+    for (;;) {
+        await sleep(interval);
+        try {
+            const issued = IssuedSchema.parse(await postDevice(server, route, {
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: started.deviceCode,
+                client_id: cliClientIdOf(auth),
+            }, options));
+            return { token: issued.access_token, expiresIn: issued.expires_in };
+        }
+        catch (error) {
+            if (!(error instanceof AppApiError))
+                throw error;
+            if (error.reason === SLOW_DOWN)
+                interval += 5000;
+            else if (error.reason !== PENDING && !error.transient)
+                throw error;
+            if (now() >= deadline)
+                throw new AppApiError(400, 'EXPIRED_TOKEN', 'The code expired before it was approved. Sign in again.');
+        }
+    }
+}
+/** Linux and BSD openers, tried in order as GitHub CLI does: the desktop's own, Debian's alternatives, then WSL's. */
+const UNIX_OPENERS = [
+    'xdg-open',
+    'x-www-browser',
+    'www-browser',
+    'wslview',
+];
+function onPath(name, env) {
+    for (const dir of (env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const file = path.join(dir, name);
+        try {
+            accessSync(file, constants.X_OK);
+            return file;
+        }
+        catch {
+            // Not here.
+        }
+    }
+    return undefined;
+}
+/**
+ * The command that opens a page in this machine's browser, or undefined where there is none to see it: a session over
+ * SSH, or a Linux machine with no display. The sign-in page is then opened on another device.
+ */
+export function browserOpener(platform = process.platform, env = process.env) {
+    if (platform === 'darwin')
+        return env.SSH_CONNECTION || env.SSH_TTY
+            ? undefined
+            : { file: 'open', args: (url) => [url] };
+    if (platform === 'win32')
+        return {
+            file: 'cmd',
+            args: (url) => ['/c', 'start', '""', url.replaceAll('&', '^&')],
+        };
+    const wsl = Boolean(env.WSL_DISTRO_NAME);
+    if (!wsl && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+        return undefined;
+    for (const name of UNIX_OPENERS) {
+        const file = onPath(name, env);
+        if (file)
+            return { file, args: (url) => [url] };
+    }
+    return undefined;
+}
+/** Opens `url` in the default browser; false when this machine has none to open it in. */
+export function openBrowser(url, platform = process.platform, env = process.env) {
+    const opener = browserOpener(platform, env);
+    if (!opener)
+        return false;
+    try {
+        const child = spawn(opener.file, opener.args(url), {
+            stdio: 'ignore',
+            detached: true,
+        });
+        child.on('error', () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=device.js.map

package/dist/lib/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../src/lib/device.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,qHAAqH;AACrH,iHAAiH;AACjH,qHAAqH;AACrH,wEAAwE;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAcH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAQH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAC1B,MAAuE,EACvE,OAAe,EAAE,CAAC,QAAQ,EAAE;IAE5B,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,KAAK,IAAI,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,UAAU,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/H,CAAC;AAOD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,KAAa,EACb,IAA4B,EAC5B,OAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,CAAC,EACD,SAAS,EACT,mBAAmB,GAAG,CAAC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,OAAO;QACjB,MAAM,IAAI,WAAW,CACnB,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAChC,OAAO,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CACrD,CAAC;IACJ,MAAM,IAAI,WAAW,CACnB,QAAQ,CAAC,MAAM,EACf,QAAQ,QAAQ,CAAC,MAAM,EAAE,EACzB,QAAQ,GAAG,CAAC,QAAQ,aAAa,QAAQ,CAAC,MAAM,EAAE,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,IAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CACjC,MAAM,UAAU,CACd,MAAM,EACN,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EACrD,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,EAClC,OAAO,CACR,CACF,CAAC;IACF,6FAA6F;IAC7F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;IACvE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,WAAW;QAC/B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,eAAe;QACf,uBAAuB,EAAE,OAAO,CAAC,yBAAyB;YACxD,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,IAAI;YACzD,CAAC,CAAC,eAAe;QACnB,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,MAAM,SAAS,GAAG,WAAW,CAAC;AAO9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,IAAgB,EAChB,OAA4B,EAC5B,UAAuB,EAAE;IAEzB,MAAM,KAAK,GACT,OAAO,CAAC,KAAK;QACb,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAClD,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAC/B,MAAM,UAAU,CACd,MAAM,EACN,KAAK,EACL;gBACE,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU;gBAC/B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC;aAC/B,EACD,OAAO,CACR,CACF,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,IAAI,IAAI,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC;YACnE,IAAI,GAAG,EAAE,IAAI,QAAQ;gBACnB,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,eAAe,EACf,yDAAyD,CAC1D,CAAC;QACN,CAAC;IACH,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,YAAY,GAAsB;IACtC,UAAU;IACV,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC;AAEF,SAAS,MAAM,CAAC,IAAY,EAAE,GAAsB;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAQ,KAAK,QAAQ;QACvB,OAAO,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,OAAO;YACtC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,IAAI,QAAQ,KAAK,OAAO;QACtB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;SAChE,CAAC;IACJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACjD,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/envelope.d.ts

@@ -0,0 +1,21 @@
+import { type CommandErrorJson, type CommandJson, type CommandSuggestion } from '@nocobase/cli-envelope';
+import { type ExitCode } from '@nocobase/agent-protocol';
+export type Envelope = CommandJson;
+/** A failure the CLI raises itself, with what the envelope says of it. */
+export declare class CliCommandError extends Error {
+    readonly code: string;
+    readonly suggestions: readonly CommandSuggestion[];
+    readonly details: unknown;
+    /** The exit code; 1 when not given. */
+    readonly exit: ExitCode;
+    constructor(code: string, message: string, options?: {
+        readonly suggestions?: readonly CommandSuggestion[];
+        readonly details?: unknown;
+        readonly exit?: ExitCode;
+    });
+}
+/** A failure as the envelope's `error`. */
+export declare function errorJsonOf(error: unknown, bin?: string): CommandErrorJson;
+export declare function successEnvelope(command: string, result: unknown, warnings?: readonly string[], status?: 'success' | 'success-noop'): Envelope;
+export declare function failureEnvelope(command: string, error: unknown, warnings?: readonly string[], bin?: string): Envelope;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/lib/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/lib/envelope.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAMrE,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AAEnC,0EAA0E;AAC1E,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAGtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACP,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;QACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;KACrB;CAST;AAsBD,2CAA2C;AAC3C,wBAAgB,WAAW,CACzB,KAAK,EAAE,OAAO,EACd,GAAG,SAAiB,GACnB,gBAAgB,CAkClB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,EACf,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,MAAM,GAAE,SAAS,GAAG,cAA0B,GAC7C,QAAQ,CAEV;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,CAAC,EAAE,MAAM,GACX,QAAQ,CAEV"}