@nocobase/app-cli-client 0.0.0-stage → 0.1.0-beta.1

package/dist/lib/secrets/macos.js

@@ -0,0 +1,61 @@
+// The macOS Keychain through `/usr/bin/security`, called by its absolute path so nothing on PATH stands in for it.
+import { existsSync } from 'node:fs';
+import { firstValue, runTool, SecretStoreError, toolError, } from "./store.js";
+export const SECURITY = '/usr/bin/security';
+/** `errSecItemNotFound`: how `find-` and `delete-generic-password` exit when there is no item. */
+const NOT_FOUND = 44;
+/** `security -i` splits its input on whitespace and reads double-quoted words; refuse what would need escaping. */
+function quote(value) {
+    if (/["\\\n\r]/u.test(value))
+        throw new SecretStoreError('The value contains characters the macOS Keychain command cannot take.');
+    return `"${value}"`;
+}
+export class MacKeychain {
+    kind = 'keychain';
+    run;
+    platform;
+    constructor(run = runTool, platform = process.platform) {
+        this.run = run;
+        this.platform = platform;
+    }
+    async available() {
+        if (this.platform !== 'darwin' || !existsSync(SECURITY))
+            return false;
+        return (await this.run(SECURITY, ['default-keychain'])).code === 0;
+    }
+    async get(service, account) {
+        const result = await this.run(SECURITY, [
+            'find-generic-password',
+            '-s',
+            service,
+            '-a',
+            account,
+            '-w',
+        ]);
+        if (result.code === NOT_FOUND)
+            return undefined;
+        if (result.code !== 0)
+            throw new SecretStoreError(`Cannot read the macOS Keychain: ${toolError(result)}`);
+        return firstValue(result.stdout);
+    }
+    async set(service, account, secret, label) {
+        // `security -i` reads the command from standard input, so the secret never appears in the process list. It exits 0
+        // even when the command fails, hence the read-back.
+        const line = `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -l ${quote(label)} -w ${quote(secret)}\n`;
+        const result = await this.run(SECURITY, ['-i'], line);
+        if (result.code !== 0 || (await this.get(service, account)) !== secret)
+            throw new SecretStoreError(`Cannot write to the macOS Keychain: ${result.stderr.trim() || 'the item did not stick'}`);
+    }
+    async delete(service, account) {
+        const result = await this.run(SECURITY, [
+            'delete-generic-password',
+            '-s',
+            service,
+            '-a',
+            account,
+        ]);
+        if (result.code !== 0 && result.code !== NOT_FOUND)
+            throw new SecretStoreError(`Cannot delete from the macOS Keychain: ${toolError(result)}`);
+    }
+}
+//# sourceMappingURL=macos.js.map

package/dist/lib/secrets/macos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos.js","sourceRoot":"","sources":["../../../src/lib/secrets/macos.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EACL,UAAU,EACV,OAAO,EACP,gBAAgB,EAChB,SAAS,GAGV,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAC5C,kGAAkG;AAClG,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,mHAAmH;AACnH,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,IAAI,gBAAgB,CACxB,uEAAuE,CACxE,CAAC;IACJ,OAAO,IAAI,KAAK,GAAG,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,WAAW;IACb,IAAI,GAAG,UAAmB,CAAC;IAEnB,GAAG,CAAU;IACb,QAAQ,CAAkB;IAE3C,YACE,MAAe,OAAO,EACtB,WAA4B,OAAO,CAAC,QAAQ;QAE5C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,OAAe;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YACtC,uBAAuB;YACvB,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,SAAS,CAAC,MAAM,CAAC,EAAE,CACvD,CAAC;QACJ,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,OAAe,EACf,OAAe,EACf,MAAc,EACd,KAAa;QAEb,mHAAmH;QACnH,oDAAoD;QACpD,MAAM,IAAI,GAAG,8BAA8B,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM;YACpE,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,EAAE,CAC1F,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YACtC,yBAAyB;YACzB,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAChD,MAAM,IAAI,gBAAgB,CACxB,0CAA0C,SAAS,CAAC,MAAM,CAAC,EAAE,CAC9D,CAAC;IACN,CAAC;CACF"}

package/dist/lib/secrets/secret-service.d.ts

@@ -0,0 +1,17 @@
+import { type RunTool, type SecretStore } from './store.ts';
+/** `secret-tool` on `searchPath`, or undefined. */
+export declare function findSecretTool(searchPath?: string): string | undefined;
+export declare class SecretService implements SecretStore {
+    readonly kind: "secret-service";
+    private readonly run;
+    private readonly tool;
+    private readonly env;
+    private readonly platform;
+    constructor(run?: RunTool, tool?: string | undefined, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform);
+    available(): Promise<boolean>;
+    get(service: string, account: string): Promise<string | undefined>;
+    set(service: string, account: string, secret: string, label: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+    private requireTool;
+}
+//# sourceMappingURL=secret-service.d.ts.map

package/dist/lib/secrets/secret-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-service.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/secret-service.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,mDAAmD;AACnD,wBAAgB,cAAc,CAC5B,UAAU,GAAE,MAA+B,GAC1C,MAAM,GAAG,SAAS,CAOpB;AAED,qBAAa,aAAc,YAAW,WAAW;IAC/C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAGzC,GAAG,GAAE,OAAiB,EACtB,IAAI,GAAE,MAAM,GAAG,SAA4B,EAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B;IAQxC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAoB7B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAgBlE,GAAG,CACP,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAaV,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7D,OAAO,CAAC,WAAW;CAKpB"}

package/dist/lib/secrets/secret-service.js

@@ -0,0 +1,81 @@
+// The Secret Service (GNOME Keyring, KWallet) through libsecret's `secret-tool`. It needs a desktop session's D-Bus: on
+// a headless server there is usually none, and the CLI falls back to a file.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { firstValue, runTool, SecretStoreError, toolError, } from "./store.js";
+/** `secret-tool` on `searchPath`, or undefined. */
+export function findSecretTool(searchPath = process.env.PATH ?? '') {
+    for (const dir of searchPath.split(path.delimiter)) {
+        if (dir === '')
+            continue;
+        const candidate = path.join(dir, 'secret-tool');
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+export class SecretService {
+    kind = 'secret-service';
+    run;
+    tool;
+    env;
+    platform;
+    constructor(run = runTool, tool = findSecretTool(), env = process.env, platform = process.platform) {
+        this.run = run;
+        this.tool = tool;
+        this.env = env;
+        this.platform = platform;
+    }
+    async available() {
+        if (this.platform !== 'linux' ||
+            this.tool === undefined ||
+            (this.env.DBUS_SESSION_BUS_ADDRESS ?? '') === '')
+            return false;
+        // `lookup` exits 1 with nothing on stderr when there is simply no item; a missing service or bus says why.
+        const result = await this.run(this.tool, [
+            'lookup',
+            'service',
+            'nocobase-cli-probe',
+            'account',
+            'probe',
+        ]);
+        return (result.code === 0 || (result.code === 1 && result.stderr.trim() === ''));
+    }
+    async get(service, account) {
+        const result = await this.run(this.requireTool(), [
+            'lookup',
+            'service',
+            service,
+            'account',
+            account,
+        ]);
+        if (result.code === 1 && result.stderr.trim() === '')
+            return undefined;
+        if (result.code !== 0)
+            throw new SecretStoreError(`Cannot read the Secret Service: ${toolError(result)}`);
+        return firstValue(result.stdout);
+    }
+    async set(service, account, secret, label) {
+        // `store` reads the secret from standard input when it is not a terminal.
+        const result = await this.run(this.requireTool(), ['store', `--label=${label}`, 'service', service, 'account', account], secret);
+        if (result.code !== 0 || (await this.get(service, account)) !== secret)
+            throw new SecretStoreError(`Cannot write to the Secret Service: ${result.stderr.trim() || 'the item did not stick'}`);
+    }
+    async delete(service, account) {
+        const result = await this.run(this.requireTool(), [
+            'clear',
+            'service',
+            service,
+            'account',
+            account,
+        ]);
+        if (result.code !== 0 && result.stderr.trim() !== '')
+            throw new SecretStoreError(`Cannot delete from the Secret Service: ${toolError(result)}`);
+    }
+    requireTool() {
+        if (this.tool === undefined)
+            throw new SecretStoreError('secret-tool is not installed.');
+        return this.tool;
+    }
+}
+//# sourceMappingURL=secret-service.js.map

package/dist/lib/secrets/secret-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-service.js","sourceRoot":"","sources":["../../../src/lib/secrets/secret-service.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,OAAO,EACP,gBAAgB,EAChB,SAAS,GAGV,MAAM,YAAY,CAAC;AAEpB,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAC5B,aAAqB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;IAE3C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,gBAAyB,CAAC;IAEzB,GAAG,CAAU;IACb,IAAI,CAAqB;IACzB,GAAG,CAAoB;IACvB,QAAQ,CAAkB;IAE3C,YACE,MAAe,OAAO,EACtB,OAA2B,cAAc,EAAE,EAC3C,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;QAE5C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IACE,IAAI,CAAC,QAAQ,KAAK,OAAO;YACzB,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,KAAK,EAAE;YAEhD,OAAO,KAAK,CAAC;QACf,2GAA2G;QAC3G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YACvC,QAAQ;YACR,SAAS;YACT,oBAAoB;YACpB,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,OAAe;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE;YAChD,QAAQ;YACR,SAAS;YACT,OAAO;YACP,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,SAAS,CAAC,MAAM,CAAC,EAAE,CACvD,CAAC;QACJ,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,OAAe,EACf,OAAe,EACf,MAAc,EACd,KAAa;QAEb,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAC3B,IAAI,CAAC,WAAW,EAAE,EAClB,CAAC,OAAO,EAAE,WAAW,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EACrE,MAAM,CACP,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM;YACpE,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,EAAE,CAC1F,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE;YAChD,OAAO;YACP,SAAS;YACT,OAAO;YACP,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,MAAM,IAAI,gBAAgB,CACxB,0CAA0C,SAAS,CAAC,MAAM,CAAC,EAAE,CAC9D,CAAC;IACN,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/lib/secrets/store.d.ts

@@ -0,0 +1,28 @@
+export type SecretStoreKind = 'keychain' | 'secret-service' | 'credential-manager';
+export interface SecretStore {
+    readonly kind: SecretStoreKind;
+    /** False when there is no usable keychain here (no tool, no session bus, no default keychain). */
+    available(): Promise<boolean>;
+    /** The stored secret, or undefined when there is no item. Throws `SecretStoreError` when the keychain cannot be read. */
+    get(service: string, account: string): Promise<string | undefined>;
+    /** Stores or replaces the secret and reads it back; throws `SecretStoreError` when it did not stick. */
+    set(service: string, account: string, secret: string, label: string): Promise<void>;
+    /** Removes the item; a missing item is not an error. */
+    delete(service: string, account: string): Promise<void>;
+}
+export declare class SecretStoreError extends Error {
+    name: string;
+}
+export interface ToolResult {
+    readonly code: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** Runs a keychain tool; tests replace it. */
+export type RunTool = (command: string, args: readonly string[], input?: string) => Promise<ToolResult>;
+export declare const runTool: RunTool;
+/** What a failed tool said, for an error message. */
+export declare function toolError(result: ToolResult): string;
+/** The tool's answer without the line break it ends with. */
+export declare function firstValue(stdout: string): string | undefined;
+//# sourceMappingURL=store.d.ts.map

package/dist/lib/secrets/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/store.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,kGAAkG;IAClG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,yHAAyH;IACzH,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnE,wGAAwG;IACxG,GAAG,CACD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,wDAAwD;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,SAAsB;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;AAKzB,eAAO,MAAM,OAAO,EAAE,OAqBlB,CAAC;AAEL,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D"}

package/dist/lib/secrets/store.js

@@ -0,0 +1,41 @@
+// The system keychain behind one small interface: the macOS Keychain through `/usr/bin/security`, the Secret Service
+// (GNOME Keyring, KWallet) through `secret-tool`, and the Windows Credential Manager through PowerShell. Calling the
+// operating system's own tools keeps the CLI free of native modules, so its standalone tarball stays the same on every
+// platform. A secret always travels on standard input, never in a process argument another user could read in `ps`.
+import { spawn } from 'node:child_process';
+export class SecretStoreError extends Error {
+    name = 'SecretStoreError';
+}
+/** A locked keychain may wait on an unlock dialog; give up after a minute rather than hang. */
+const TOOL_TIMEOUT_MS = 60_000;
+export const runTool = (command, args, input) => new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    const child = spawn(command, [...args], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    const timer = setTimeout(() => child.kill('SIGKILL'), TOOL_TIMEOUT_MS);
+    child.stdout.on('data', (chunk) => (stdout += chunk.toString()));
+    child.stderr.on('data', (chunk) => (stderr += chunk.toString()));
+    child.on('error', (error) => {
+        clearTimeout(timer);
+        resolve({ code: null, stdout, stderr: stderr || error.message });
+    });
+    child.on('close', (code) => {
+        clearTimeout(timer);
+        resolve({ code, stdout, stderr });
+    });
+    child.stdin.on('error', () => undefined);
+    child.stdin.end(input ?? '');
+});
+/** What a failed tool said, for an error message. */
+export function toolError(result) {
+    return result.stderr.trim() || `exit ${String(result.code)}`;
+}
+/** The tool's answer without the line break it ends with. */
+export function firstValue(stdout) {
+    const value = stdout.replace(/\r?\n$/u, '');
+    return value === '' ? undefined : value;
+}
+//# sourceMappingURL=store.js.map

package/dist/lib/secrets/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/lib/secrets/store.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,qHAAqH;AACrH,uHAAuH;AACvH,oHAAoH;AACpH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAsB3C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,GAAG,kBAAkB,CAAC;CACpC;AAeD,+FAA+F;AAC/F,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,MAAM,OAAO,GAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACvD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QACtC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC;IACvE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,MAAkB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC"}

package/dist/lib/secrets/windows.d.ts

@@ -0,0 +1,20 @@
+import { type RunTool, type SecretStore } from './store.ts';
+/** Windows PowerShell by its absolute path, so nothing on PATH stands in for it. */
+export declare function windowsPowerShell(env?: NodeJS.ProcessEnv): string;
+/** The arguments PowerShell runs the script with. */
+export declare const POWERSHELL_ARGS: readonly string[];
+/** The credential's target name: one generic credential per service and account. */
+export declare function credentialTarget(service: string, account: string): string;
+export declare class CredentialManager implements SecretStore {
+    readonly kind: "credential-manager";
+    private readonly run;
+    private readonly powershell;
+    private readonly platform;
+    constructor(run?: RunTool, powershell?: string, platform?: NodeJS.Platform);
+    available(): Promise<boolean>;
+    get(service: string, account: string): Promise<string | undefined>;
+    set(service: string, account: string, secret: string, label: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+    private call;
+}
+//# sourceMappingURL=windows.d.ts.map

package/dist/lib/secrets/windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/windows.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAoFpB,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAQR;AAED,qDAAqD;AACrD,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAO5C,CAAC;AAEF,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAUD,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAGzC,GAAG,GAAE,OAAiB,EACtB,UAAU,GAAE,MAA4B,EACxC,QAAQ,GAAE,MAAM,CAAC,QAA2B;IAOxC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAM7B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAclE,GAAG,CACP,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAcV,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D,OAAO,CAAC,IAAI;CAGb"}

package/dist/lib/secrets/windows.js

@@ -0,0 +1,155 @@
+// The Windows Credential Manager through Windows PowerShell, which compiles a few lines of C# calling `CredReadW`,
+// `CredWriteW` and `CredDeleteW` (advapi32) when it runs: no native module to ship. The script goes in
+// `-EncodedCommand`; the request, the secret among it, goes on standard input as JSON, base64 where it is binary.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { runTool, SecretStoreError, toolError, } from "./store.js";
+/** How the script exits when there is no such credential. */
+const NOT_FOUND = 44;
+const SCRIPT = String.raw `$ErrorActionPreference = 'Stop'
+if (-not ('AppCli.Credentials' -as [type])) {
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+namespace AppCli {
+  public static class Credentials {
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    struct CREDENTIAL {
+      public uint Flags; public uint Type; public string TargetName; public string Comment;
+      public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+      public uint CredentialBlobSize; public IntPtr CredentialBlob; public uint Persist;
+      public uint AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName;
+    }
+    [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+    static extern bool CredRead(string target, uint type, uint flags, out IntPtr credential);
+    [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    static extern bool CredWrite(ref CREDENTIAL credential, uint flags);
+    [DllImport("advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    static extern bool CredDelete(string target, uint type, uint flags);
+    [DllImport("advapi32.dll")]
+    static extern void CredFree(IntPtr buffer);
+    const int ERROR_NOT_FOUND = 1168;
+    const uint CRED_TYPE_GENERIC = 1;
+    const uint CRED_PERSIST_LOCAL_MACHINE = 2;
+    public static byte[] Read(string target) {
+      IntPtr pointer;
+      if (!CredRead(target, CRED_TYPE_GENERIC, 0, out pointer)) {
+        int error = Marshal.GetLastWin32Error();
+        if (error == ERROR_NOT_FOUND) return null;
+        throw new Win32Exception(error);
+      }
+      try {
+        CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+        byte[] bytes = new byte[credential.CredentialBlobSize];
+        if (bytes.Length > 0) Marshal.Copy(credential.CredentialBlob, bytes, 0, bytes.Length);
+        return bytes;
+      } finally { CredFree(pointer); }
+    }
+    public static void Write(string target, string user, string comment, byte[] secret) {
+      CREDENTIAL credential = new CREDENTIAL();
+      credential.Type = CRED_TYPE_GENERIC; credential.TargetName = target; credential.UserName = user;
+      credential.Comment = comment; credential.Persist = CRED_PERSIST_LOCAL_MACHINE;
+      credential.CredentialBlobSize = (uint)secret.Length;
+      credential.CredentialBlob = Marshal.AllocHGlobal(secret.Length);
+      try {
+        Marshal.Copy(secret, 0, credential.CredentialBlob, secret.Length);
+        if (!CredWrite(ref credential, 0)) throw new Win32Exception(Marshal.GetLastWin32Error());
+      } finally { Marshal.FreeHGlobal(credential.CredentialBlob); }
+    }
+    public static void Delete(string target) {
+      if (!CredDelete(target, CRED_TYPE_GENERIC, 0)) {
+        int error = Marshal.GetLastWin32Error();
+        if (error != ERROR_NOT_FOUND) throw new Win32Exception(error);
+      }
+    }
+  }
+}
+'@
+}
+try {
+  $request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+  switch ($request.op) {
+    'get' {
+      $bytes = [AppCli.Credentials]::Read($request.target)
+      if ($null -eq $bytes) { exit ${NOT_FOUND} }
+      [Console]::Out.Write([Convert]::ToBase64String($bytes))
+    }
+    'set' { [AppCli.Credentials]::Write($request.target, $request.account, $request.label, [Convert]::FromBase64String($request.secret)) }
+    'delete' { [AppCli.Credentials]::Delete($request.target) }
+  }
+} catch {
+  [Console]::Error.WriteLine($_.Exception.Message)
+  exit 1
+}
+exit 0
+`;
+/** Windows PowerShell by its absolute path, so nothing on PATH stands in for it. */
+export function windowsPowerShell(env = process.env) {
+    return path.join(env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+/** The arguments PowerShell runs the script with. */
+export const POWERSHELL_ARGS = [
+    '-NoProfile',
+    '-NonInteractive',
+    '-ExecutionPolicy',
+    'Bypass',
+    '-EncodedCommand',
+    Buffer.from(SCRIPT, 'utf16le').toString('base64'),
+];
+/** The credential's target name: one generic credential per service and account. */
+export function credentialTarget(service, account) {
+    return `${service}:${account}`;
+}
+export class CredentialManager {
+    kind = 'credential-manager';
+    run;
+    powershell;
+    platform;
+    constructor(run = runTool, powershell = windowsPowerShell(), platform = process.platform) {
+        this.run = run;
+        this.powershell = powershell;
+        this.platform = platform;
+    }
+    async available() {
+        if (this.platform !== 'win32' || !existsSync(this.powershell))
+            return false;
+        // Compiling the helper is what fails where scripts or Add-Type are locked down.
+        return (await this.call({ op: 'probe', target: '' })).code === 0;
+    }
+    async get(service, account) {
+        const result = await this.call({
+            op: 'get',
+            target: credentialTarget(service, account),
+        });
+        if (result.code === NOT_FOUND)
+            return undefined;
+        if (result.code !== 0)
+            throw new SecretStoreError(`Cannot read the Windows Credential Manager: ${toolError(result)}`);
+        const value = Buffer.from(result.stdout.trim(), 'base64').toString('utf8');
+        return value === '' ? undefined : value;
+    }
+    async set(service, account, secret, label) {
+        const result = await this.call({
+            op: 'set',
+            target: credentialTarget(service, account),
+            account,
+            label,
+            secret: Buffer.from(secret, 'utf8').toString('base64'),
+        });
+        if (result.code !== 0 || (await this.get(service, account)) !== secret)
+            throw new SecretStoreError(`Cannot write to the Windows Credential Manager: ${result.stderr.trim() || 'the credential did not stick'}`);
+    }
+    async delete(service, account) {
+        const result = await this.call({
+            op: 'delete',
+            target: credentialTarget(service, account),
+        });
+        if (result.code !== 0)
+            throw new SecretStoreError(`Cannot delete from the Windows Credential Manager: ${toolError(result)}`);
+    }
+    call(request) {
+        return this.run(this.powershell, POWERSHELL_ARGS, JSON.stringify(request));
+    }
+}
+//# sourceMappingURL=windows.js.map

package/dist/lib/secrets/windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../../src/lib/secrets/windows.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,uGAAuG;AACvG,kHAAkH;AAClH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,SAAS,GAGV,MAAM,YAAY,CAAC;AAEpB,6DAA6D;AAC7D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAkEY,SAAS;;;;;;;;;;;CAW7C,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,CAAC,UAAU,IAAI,aAAa,EAC/B,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,QAAQ;IACR,iBAAiB;IACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;CAClD,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACjC,CAAC;AAUD,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,oBAA6B,CAAC;IAE7B,GAAG,CAAU;IACb,UAAU,CAAS;IACnB,QAAQ,CAAkB;IAE3C,YACE,MAAe,OAAO,EACtB,aAAqB,iBAAiB,EAAE,EACxC,WAA4B,OAAO,CAAC,QAAQ;QAE5C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,gFAAgF;QAChF,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,OAAe;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,SAAS,CAAC,MAAM,CAAC,EAAE,CACnE,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3E,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CACP,OAAe,EACf,OAAe,EACf,MAAc,EACd,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1C,OAAO;YACP,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM;YACpE,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,8BAA8B,EAAE,CAC5G,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,SAAS,CAAC,MAAM,CAAC,EAAE,CAC1E,CAAC;IACN,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/lib/update-hint.d.ts

@@ -0,0 +1,5 @@
+import { type AppCliSession } from '../config.ts';
+/** Starts asking; the answer is printed by `printUpdateHint`. */
+export declare function askUpdateHint(session: AppCliSession): Promise<string | undefined>;
+export declare function printUpdateHint(pending: Promise<string | undefined>, write?: (line: string) => void): Promise<void>;
+//# sourceMappingURL=update-hint.d.ts.map

package/dist/lib/update-hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-hint.d.ts","sourceRoot":"","sources":["../../src/lib/update-hint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAKhE,iEAAiE;AACjE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,EACpC,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAkD,GAC1E,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/lib/update-hint.js

@@ -0,0 +1,26 @@
+// The application's update hint (`AppCliConfig.updateHint`, or the built-in one of `selfUpdate`): asked as the
+// signed-in person, printed on stderr at most once per process, so `--json` keeps stdout to its one document. A hint
+// that fails says nothing.
+import { appCliConfig } from "../config.js";
+import { updateEnvironment, updateHint } from "../update.js";
+let printed = false;
+/** Starts asking; the answer is printed by `printUpdateHint`. */
+export function askUpdateHint(session) {
+    if (printed)
+        return Promise.resolve(undefined);
+    const config = appCliConfig();
+    if (config.updateHint !== undefined)
+        return config.updateHint(session).catch(() => undefined);
+    const environment = updateEnvironment(config);
+    if (environment === undefined)
+        return Promise.resolve(undefined);
+    return updateHint(session, environment).catch(() => undefined);
+}
+export async function printUpdateHint(pending, write = (line) => process.stderr.write(`${line}\n`)) {
+    const line = await pending;
+    if (line === undefined || line === '' || printed)
+        return;
+    printed = true;
+    write(line);
+}
+//# sourceMappingURL=update-hint.js.map

package/dist/lib/update-hint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-hint.js","sourceRoot":"","sources":["../../src/lib/update-hint.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,qHAAqH;AACrH,2BAA2B;AAC3B,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE7D,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAC3B,OAAsB;IAEtB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QACjC,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoC,EACpC,QAAgC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC;IAE3E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,OAAO;QAAE,OAAO;IACzD,OAAO,GAAG,IAAI,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,CAAC;AACd,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,15 @@
+import { type Command } from '@oclif/core';
+import { type AppCliConfig } from './config.ts';
+import { type KeyStorage } from './lib/secrets/index.ts';
+/** What `login` answers. */
+export interface LoginResult {
+    readonly server: string;
+    readonly profile: string;
+    readonly storage: KeyStorage;
+    readonly method: 'browser' | 'api-key';
+    readonly userId?: string;
+    readonly displayName?: string;
+}
+/** `<bin> login`: signs in through the browser, or stores an API key given on standard input. */
+export declare function loginCommand(app: AppCliConfig): Command.Class;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAIlD,OAAO,EAA+B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAyB7E,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA4B1E,4BAA4B;AAC5B,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAiP7D"}