@orizm/cli 2.2.7 → 3.0.1

package/dist/list-vbMaOiza.mjs

@@ -0,0 +1,82 @@
+import { r as getOutputState, t as defineCommand } from "./cli/main.mjs";
+import { r as contextArgs } from "./shared-CZZimGxc.mjs";
+import { a as apiErrorFailure, n as runWithContext, u as toResult } from "./run-with-context-CVhmzAFZ.mjs";
+import { t as renderTable } from "./table-MHEfbnWO.mjs";
+import { o as parseIntegerChoice } from "./parse-DA0k5AHa.mjs";
+import { Result } from "@praha/byethrow";
+
+//#region src/cli/commands/bucket/object/list.ts
+async function bucketObjectListHandler(ctx, options) {
+	const objects = toResult(await ctx.client.GET("/projects/{projectName}/buckets/{bucketName}/objects", { params: {
+		path: {
+			projectName: ctx.projectName,
+			bucketName: options.bucket
+		},
+		query: {
+			limit: options.limit,
+			...options.cursor !== void 0 ? { cursor: options.cursor } : {}
+		}
+	} }));
+	if (Result.isFailure(objects)) return apiErrorFailure(objects.error);
+	const value = objects.value;
+	return Result.succeed({
+		json: value,
+		text: () => {
+			const table = renderTable([
+				"KEY",
+				"ORIGINAL FILENAME",
+				"SIZE",
+				"TYPE",
+				"CREATED AT"
+			], value.objects.map((object) => ({ cells: [
+				object.key,
+				object.originalFilename,
+				String(object.size),
+				object.type,
+				object.createdAt
+			] })), getOutputState().color);
+			return value.pagination.nextCursor === null ? table : `${table}\nNext cursor: ${value.pagination.nextCursor}`;
+		}
+	});
+}
+const listArgs = {
+	...contextArgs,
+	bucket: {
+		type: "positional",
+		required: true,
+		description: "Bucket name"
+	},
+	limit: {
+		type: "string",
+		description: "Max number of objects to return (50, 100, or 200)",
+		default: "100"
+	},
+	cursor: {
+		type: "string",
+		description: "Cursor returned by the previous page"
+	}
+};
+var list_default = defineCommand({
+	meta: {
+		name: "list",
+		description: "List objects in a bucket"
+	},
+	args: listArgs,
+	run: async ({ args }) => {
+		const limit = parseIntegerChoice("limit", args.limit, [
+			50,
+			100,
+			200
+		]);
+		if (Result.isFailure(limit)) return limit;
+		return runWithContext(args, (ctx) => bucketObjectListHandler(ctx, {
+			bucket: args.bucket,
+			limit: limit.value,
+			cursor: typeof args.cursor === "string" ? args.cursor : void 0
+		}));
+	}
+});
+
+//#endregion
+export { list_default as default };
+//# sourceMappingURL=list-vbMaOiza.mjs.map

package/dist/list-vbMaOiza.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-vbMaOiza.mjs","names":[],"sources":["../src/cli/commands/bucket/object/list.ts"],"sourcesContent":["import type { ArgsDef } from \"citty\";\nimport { Result } from \"@praha/byethrow\";\nimport {\n  defineCommand,\n  type CommandFailure,\n  type CommandOutput,\n} from \"../../define-command.js\";\nimport { contextArgs } from \"../../shared.js\";\nimport { runWithContext, type CommandContext } from \"../../run-with-context.js\";\nimport { apiErrorFailure } from \"../../api-errors.js\";\nimport { toResult } from \"../../../api/errors.js\";\nimport { getOutputState } from \"../../../ui/output.js\";\nimport { renderTable } from \"../../../ui/table.js\";\nimport { parseIntegerChoice } from \"../../parse.js\";\n\nexport async function bucketObjectListHandler(\n  ctx: CommandContext,\n  options: { bucket: string; limit: number; cursor?: string },\n): Promise<Result.Result<CommandOutput | undefined, CommandFailure>> {\n  const objects = toResult(\n    await ctx.client.GET(\n      \"/projects/{projectName}/buckets/{bucketName}/objects\",\n      {\n        params: {\n          path: { projectName: ctx.projectName, bucketName: options.bucket },\n          query: {\n            limit: options.limit,\n            ...(options.cursor !== undefined ? { cursor: options.cursor } : {}),\n          },\n        },\n      },\n    ),\n  );\n  if (Result.isFailure(objects)) return apiErrorFailure(objects.error);\n\n  const value = objects.value;\n  return Result.succeed({\n    json: value,\n    text: () => {\n      const table = renderTable(\n        [\"KEY\", \"ORIGINAL FILENAME\", \"SIZE\", \"TYPE\", \"CREATED AT\"],\n        value.objects.map((object) => ({\n          cells: [\n            object.key,\n            object.originalFilename,\n            String(object.size),\n            object.type,\n            object.createdAt,\n          ],\n        })),\n        getOutputState().color,\n      );\n      return value.pagination.nextCursor === null\n        ? table\n        : `${table}\\nNext cursor: ${value.pagination.nextCursor}`;\n    },\n  });\n}\n\nconst listArgs = {\n  ...contextArgs,\n  bucket: {\n    type: \"positional\",\n    required: true,\n    description: \"Bucket name\",\n  },\n  limit: {\n    type: \"string\",\n    description: \"Max number of objects to return (50, 100, or 200)\",\n    default: \"100\",\n  },\n  cursor: {\n    type: \"string\",\n    description: \"Cursor returned by the previous page\",\n  },\n} satisfies ArgsDef;\n\nexport default defineCommand({\n  meta: {\n    name: \"list\",\n    description: \"List objects in a bucket\",\n  },\n  args: listArgs,\n  run: async ({ args }) => {\n    const limit = parseIntegerChoice(\"limit\", args.limit, [50, 100, 200]);\n    if (Result.isFailure(limit)) return limit;\n\n    return runWithContext(args, (ctx) =>\n      bucketObjectListHandler(ctx, {\n        bucket: args.bucket,\n        limit: limit.value,\n        cursor: typeof args.cursor === \"string\" ? args.cursor : undefined,\n      }),\n    );\n  },\n});\n"],"mappings":";;;;;;;;AAeA,eAAsB,wBACpB,KACA,SACmE;CACnE,MAAM,UAAU,SACd,MAAM,IAAI,OAAO,IACf,wDACA,EACE,QAAQ;EACN,MAAM;GAAE,aAAa,IAAI;GAAa,YAAY,QAAQ;EAAO;EACjE,OAAO;GACL,OAAO,QAAQ;GACf,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnE;CACF,EACF,CACF,CACF;CACA,IAAI,OAAO,UAAU,OAAO,GAAG,OAAO,gBAAgB,QAAQ,KAAK;CAEnE,MAAM,QAAQ,QAAQ;CACtB,OAAO,OAAO,QAAQ;EACpB,MAAM;EACN,YAAY;GACV,MAAM,QAAQ,YACZ;IAAC;IAAO;IAAqB;IAAQ;IAAQ;GAAY,GACzD,MAAM,QAAQ,KAAK,YAAY,EAC7B,OAAO;IACL,OAAO;IACP,OAAO;IACP,OAAO,OAAO,IAAI;IAClB,OAAO;IACP,OAAO;GACT,EACF,EAAE,GACF,eAAe,CAAC,CAAC,KACnB;GACA,OAAO,MAAM,WAAW,eAAe,OACnC,QACA,GAAG,MAAM,iBAAiB,MAAM,WAAW;EACjD;CACF,CAAC;AACH;AAEA,MAAM,WAAW;CACf,GAAG;CACH,QAAQ;EACN,MAAM;EACN,UAAU;EACV,aAAa;CACf;CACA,OAAO;EACL,MAAM;EACN,aAAa;EACb,SAAS;CACX;CACA,QAAQ;EACN,MAAM;EACN,aAAa;CACf;AACF;AAEA,mBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;CACN,KAAK,OAAO,EAAE,WAAW;EACvB,MAAM,QAAQ,mBAAmB,SAAS,KAAK,OAAO;GAAC;GAAI;GAAK;EAAG,CAAC;EACpE,IAAI,OAAO,UAAU,KAAK,GAAG,OAAO;EAEpC,OAAO,eAAe,OAAO,QAC3B,wBAAwB,KAAK;GAC3B,QAAQ,KAAK;GACb,OAAO,MAAM;GACb,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;EAC1D,CAAC,CACH;CACF;AACF,CAAC"}

package/dist/login-2XcHd4wn.cjs

@@ -0,0 +1,212 @@
+const require_cli_main = require('./cli/main.cjs');
+const require_shared = require('./shared-DHRPzzKl.cjs');
+const require_token_store = require('./token-store--9GYVL7N.cjs');
+const require_oauth_client = require('./oauth-client-CdD0evAV.cjs');
+let _praha_byethrow = require("@praha/byethrow");
+let _hono_node_server = require("@hono/node-server");
+let hono = require("hono");
+let open = require("open");
+open = require_cli_main.__toESM(open, 1);
+
+//#region src/cli/util/base64url.ts
+function encodeBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+//#endregion
+//#region src/cli/util/random.ts
+function randomBytes(length) {
+	return globalThis.crypto.getRandomValues(new Uint8Array(length));
+}
+
+//#endregion
+//#region src/cli/util/sha256.ts
+async function sha256(data) {
+	const view = new Uint8Array(data);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", view);
+	return new Uint8Array(digest);
+}
+
+//#endregion
+//#region src/cli/auth/pkce.ts
+async function createPkce() {
+	const codeVerifier = encodeBase64Url(randomBytes(32));
+	return {
+		codeVerifier,
+		codeChallenge: encodeBase64Url(await sha256(new TextEncoder().encode(codeVerifier))),
+		codeChallengeMethod: "S256"
+	};
+}
+
+//#endregion
+//#region src/cli/auth/state.ts
+function createState() {
+	return encodeBase64Url(randomBytes(32));
+}
+function verifyState(expected, received) {
+	return received !== null && received === expected;
+}
+
+//#endregion
+//#region src/cli/auth/authorize.ts
+const DEFAULT_TIMEOUT_MS = 300 * 1e3;
+async function authorize(params) {
+	const { issuerUrl } = params;
+	const pkce = await createPkce();
+	const state = createState();
+	let resolveCallback = () => {};
+	const callbackReceived = new Promise((resolve) => {
+		resolveCallback = resolve;
+	});
+	const app = new hono.Hono();
+	app.get("/callback", (c) => {
+		const query = c.req.query();
+		resolveCallback({
+			code: query.code,
+			state: query.state,
+			error: query.error,
+			errorDescription: query.error_description
+		});
+		return c.html(renderCallbackHtml(query.error == null));
+	});
+	let listened;
+	try {
+		listened = await listen(app);
+	} catch {
+		return _praha_byethrow.Result.fail({ type: "callback_server_failed" });
+	}
+	const { server, port } = listened;
+	try {
+		const redirectUri = `http://127.0.0.1:${port}/callback`;
+		const authorizationUrl = require_oauth_client.buildAuthorizationUrl({
+			issuerUrl,
+			redirectUri,
+			codeChallenge: pkce.codeChallenge,
+			codeChallengeMethod: pkce.codeChallengeMethod,
+			state
+		});
+		await (params.openBrowser ?? open.default)(authorizationUrl).catch(() => {
+			params.onAuthorizationUrl?.(authorizationUrl);
+		});
+		const query = await waitForCallback(callbackReceived, params.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+		if (query == null) return _praha_byethrow.Result.fail({ type: "callback_timeout" });
+		if (!verifyState(state, query.state ?? null)) return _praha_byethrow.Result.fail({ type: "state_mismatch" });
+		if (query.error != null) {
+			if (query.error === "access_denied") return _praha_byethrow.Result.fail({
+				type: "user_denied",
+				description: query.errorDescription
+			});
+			return _praha_byethrow.Result.fail({
+				type: "token_exchange_failed",
+				reason: [query.error, query.errorDescription].filter((part) => part != null).join(": ")
+			});
+		}
+		if (query.code == null) return _praha_byethrow.Result.fail({
+			type: "token_exchange_failed",
+			reason: "Authorization response did not include a code"
+		});
+		const exchanged = await require_oauth_client.exchangeCode({
+			issuerUrl,
+			code: query.code,
+			redirectUri,
+			codeVerifier: pkce.codeVerifier
+		});
+		if (_praha_byethrow.Result.isFailure(exchanged)) return exchanged;
+		const claims = await require_oauth_client.verifyIdToken(issuerUrl, exchanged.value.idToken);
+		return _praha_byethrow.Result.succeed({
+			issuerUrl,
+			tokenSet: exchanged.value,
+			claims
+		});
+	} finally {
+		await closeServer(server);
+	}
+}
+async function listen(app) {
+	return new Promise((resolve, reject) => {
+		const server = (0, _hono_node_server.serve)({
+			fetch: app.fetch,
+			hostname: "127.0.0.1",
+			port: 0
+		}, (info) => resolve({
+			server,
+			port: info.port
+		}));
+		server.on("error", (error) => reject(error));
+	});
+}
+async function waitForCallback(callbackReceived, timeoutMs) {
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(void 0), timeoutMs);
+	});
+	try {
+		return await Promise.race([callbackReceived, timedOut]);
+	} finally {
+		if (timer != null) clearTimeout(timer);
+	}
+}
+async function closeServer(server) {
+	await new Promise((resolve) => server.close(() => resolve()));
+}
+function renderCallbackHtml(success) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>Orizm CLI</title></head><body><p>${success ? "Login successful. You can close this tab and return to the terminal." : "Login failed. You can close this tab and return to the terminal."}</p></body></html>`;
+}
+
+//#endregion
+//#region src/cli/commands/auth/login.ts
+var login_default = require_cli_main.defineCommand({
+	meta: {
+		name: "login",
+		description: "Sign in to Orizm"
+	},
+	args: { ...require_shared.globalArgs },
+	run: async () => {
+		const env = require_token_store.resolveEnv();
+		if (_praha_byethrow.Result.isFailure(env)) return _praha_byethrow.Result.fail({ message: "Invalid Orizm environment configuration." });
+		const { issuerUrl } = env.value;
+		require_cli_main.notice("Opening your browser to complete sign-in. Finish within 5 minutes...");
+		const result = await authorize({
+			issuerUrl,
+			onAuthorizationUrl: (url) => require_cli_main.notice(`Could not open a browser automatically. Open this URL:\n${url}`)
+		});
+		if (_praha_byethrow.Result.isFailure(result)) return authorizeFailure(result.error);
+		const { tokenSet, claims } = result.value;
+		await new require_token_store.FileTokenStore().set(issuerUrl, {
+			accessToken: tokenSet.accessToken,
+			refreshToken: tokenSet.refreshToken,
+			idToken: tokenSet.idToken,
+			expiresAt: tokenSet.expiresAt,
+			scope: tokenSet.scope,
+			subject: claims.subject,
+			profile: {
+				name: claims.name,
+				email: claims.email
+			}
+		});
+		const who = claims.email ?? claims.name ?? claims.subject;
+		return _praha_byethrow.Result.succeed({
+			json: {
+				issuer: issuerUrl,
+				subject: claims.subject,
+				email: claims.email
+			},
+			text: () => `Logged in as ${who}.`
+		});
+	}
+});
+function authorizeFailure(error) {
+	switch (error.type) {
+		case "callback_server_failed": return _praha_byethrow.Result.fail({ message: "Could not start the local sign-in listener. Check that your environment allows local connections, then try again." });
+		case "callback_timeout": return _praha_byethrow.Result.fail({ message: "Timed out before the browser sign-in completed. Run `orizm auth login` again." });
+		case "state_mismatch": return _praha_byethrow.Result.fail({ message: "Sign-in failed due to a security check. Please try again." });
+		case "user_denied": return _praha_byethrow.Result.fail({ message: "Sign-in was denied." });
+		case "token_exchange_failed": return _praha_byethrow.Result.fail({ message: `Sign-in failed: ${error.reason}. Please try again.` });
+	}
+}
+
+//#endregion
+exports.default = login_default;
+//# sourceMappingURL=login-2XcHd4wn.cjs.map

package/dist/login-2XcHd4wn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-2XcHd4wn.cjs","names":["Hono","Result","buildAuthorizationUrl","openBrowser","exchangeCode","verifyIdToken","defineCommand","globalArgs","resolveEnv","Result","notice","FileTokenStore"],"sources":["../src/cli/util/base64url.ts","../src/cli/util/random.ts","../src/cli/util/sha256.ts","../src/cli/auth/pkce.ts","../src/cli/auth/state.ts","../src/cli/auth/authorize.ts","../src/cli/commands/auth/login.ts"],"sourcesContent":["// Node 固有の Buffer ではなく Web 標準の btoa/atob を使う。特定ランタイムの API に\n// 縛られず、ブラウザ / Deno / Edge でもそのまま動く形にしておくため。\nexport function encodeBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return globalThis\n    .btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport function decodeBase64Url(text: string): Uint8Array {\n  const base64 = text.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = globalThis.atob(base64);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i);\n  }\n  return bytes;\n}\n","export function randomBytes(length: number): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(length));\n}\n","export async function sha256(data: Uint8Array): Promise<Uint8Array> {\n  // 新しい TS lib は Uint8Array を ArrayBufferLike でジェネリックにし digest が ArrayBuffer 裏付けを要求するため、\n  // ArrayBuffer 裏付けの view にコピーしてから渡す。\n  const view = new Uint8Array(data);\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", view);\n  return new Uint8Array(digest);\n}\n","import { encodeBase64Url } from \"../util/base64url.js\";\nimport { randomBytes } from \"../util/random.js\";\nimport { sha256 } from \"../util/sha256.js\";\n\nexport type Pkce = {\n  codeVerifier: string;\n  codeChallenge: string;\n  codeChallengeMethod: \"S256\";\n};\n\nexport async function createPkce(): Promise<Pkce> {\n  const codeVerifier = encodeBase64Url(randomBytes(32));\n  const digest = await sha256(new TextEncoder().encode(codeVerifier));\n  return {\n    codeVerifier,\n    codeChallenge: encodeBase64Url(digest),\n    codeChallengeMethod: \"S256\",\n  };\n}\n","import { encodeBase64Url } from \"../util/base64url.js\";\nimport { randomBytes } from \"../util/random.js\";\n\nexport function createState(): string {\n  return encodeBase64Url(randomBytes(32));\n}\n\nexport function verifyState(\n  expected: string,\n  received: string | null,\n): boolean {\n  return received !== null && received === expected;\n}\n","import { serve, type ServerType } from \"@hono/node-server\";\nimport { Hono } from \"hono\";\nimport openBrowser from \"open\";\nimport { Result } from \"@praha/byethrow\";\nimport { createPkce } from \"./pkce.js\";\nimport { createState, verifyState } from \"./state.js\";\nimport {\n  buildAuthorizationUrl,\n  exchangeCode,\n  verifyIdToken,\n  type IdTokenClaims,\n  type TokenExchangeError,\n  type TokenSet,\n} from \"./oauth-client.js\";\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport type AuthorizeError =\n  | { type: \"callback_server_failed\" }\n  | { type: \"callback_timeout\" }\n  | { type: \"state_mismatch\" }\n  | { type: \"user_denied\"; description?: string }\n  | TokenExchangeError;\n\nexport type AuthorizeSuccess = {\n  issuerUrl: string;\n  tokenSet: TokenSet;\n  claims: IdTokenClaims;\n};\n\ntype CallbackQuery = {\n  code?: string;\n  state?: string;\n  error?: string;\n  errorDescription?: string;\n};\n\nexport type AuthorizeParams = {\n  issuerUrl: string;\n  // ブラウザ起動を差し替え可能にして統合テストで「ブラウザ役」の fetch を流せるようにする。\n  openBrowser?: (url: string) => Promise<void>;\n  // ブラウザ起動に失敗したときに authorization URL を利用者へ手動提示するための通知口。\n  onAuthorizationUrl?: (url: string) => void;\n  timeoutMs?: number;\n};\n\nexport async function authorize(\n  params: AuthorizeParams,\n): Promise<Result.Result<AuthorizeSuccess, AuthorizeError>> {\n  const { issuerUrl } = params;\n  const pkce = await createPkce();\n  const state = createState();\n\n  let resolveCallback: (query: CallbackQuery) => void = () => {};\n  const callbackReceived = new Promise<CallbackQuery>((resolve) => {\n    resolveCallback = resolve;\n  });\n\n  const app = new Hono();\n  app.get(\"/callback\", (c) => {\n    const query = c.req.query();\n    resolveCallback({\n      code: query.code,\n      state: query.state,\n      error: query.error,\n      errorDescription: query.error_description,\n    });\n    return c.html(renderCallbackHtml(query.error == null));\n  });\n\n  let listened: { server: ServerType; port: number };\n  try {\n    listened = await listen(app);\n  } catch {\n    // loopback に bind できない環境ではログインを完遂できないため、待たずに失敗を返す。\n    return Result.fail({ type: \"callback_server_failed\" });\n  }\n  const { server, port } = listened;\n\n  try {\n    const redirectUri = `http://127.0.0.1:${port}/callback`;\n    const authorizationUrl = buildAuthorizationUrl({\n      issuerUrl,\n      redirectUri,\n      codeChallenge: pkce.codeChallenge,\n      codeChallengeMethod: pkce.codeChallengeMethod,\n      state,\n    });\n\n    const openImpl = params.openBrowser ?? openBrowser;\n    await openImpl(authorizationUrl).catch(() => {\n      params.onAuthorizationUrl?.(authorizationUrl);\n    });\n\n    const query = await waitForCallback(\n      callbackReceived,\n      params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    );\n    if (query == null) {\n      return Result.fail({ type: \"callback_timeout\" });\n    }\n\n    // 成功・失敗どちらの応答も Authorization Server は state を返すため、分岐する前に検証する。\n    // 無関係なローカルリクエスト（?error=... 等）で進行中のログインを中断させないため。\n    if (!verifyState(state, query.state ?? null)) {\n      return Result.fail({ type: \"state_mismatch\" });\n    }\n\n    if (query.error != null) {\n      if (query.error === \"access_denied\") {\n        return Result.fail({\n          type: \"user_denied\",\n          description: query.errorDescription,\n        });\n      }\n      return Result.fail({\n        type: \"token_exchange_failed\",\n        reason: [query.error, query.errorDescription]\n          .filter((part) => part != null)\n          .join(\": \"),\n      });\n    }\n\n    if (query.code == null) {\n      return Result.fail({\n        type: \"token_exchange_failed\",\n        reason: \"Authorization response did not include a code\",\n      });\n    }\n\n    const exchanged = await exchangeCode({\n      issuerUrl,\n      code: query.code,\n      redirectUri,\n      codeVerifier: pkce.codeVerifier,\n    });\n    if (Result.isFailure(exchanged)) return exchanged;\n\n    const claims = await verifyIdToken(issuerUrl, exchanged.value.idToken);\n\n    return Result.succeed({ issuerUrl, tokenSet: exchanged.value, claims });\n  } finally {\n    await closeServer(server);\n  }\n}\n\nasync function listen(\n  app: Hono,\n): Promise<{ server: ServerType; port: number }> {\n  return new Promise((resolve, reject) => {\n    const server = serve(\n      { fetch: app.fetch, hostname: \"127.0.0.1\", port: 0 },\n      (info) => resolve({ server, port: info.port }),\n    );\n    server.on(\"error\", (error) => reject(error));\n  });\n}\n\nasync function waitForCallback(\n  callbackReceived: Promise<CallbackQuery>,\n  timeoutMs: number,\n): Promise<CallbackQuery | undefined> {\n  let timer: NodeJS.Timeout | undefined;\n  const timedOut = new Promise<undefined>((resolve) => {\n    timer = setTimeout(() => resolve(undefined), timeoutMs);\n  });\n  try {\n    return await Promise.race([callbackReceived, timedOut]);\n  } finally {\n    if (timer != null) clearTimeout(timer);\n  }\n}\n\nasync function closeServer(server: ServerType): Promise<void> {\n  await new Promise<void>((resolve) => server.close(() => resolve()));\n}\n\nfunction renderCallbackHtml(success: boolean): string {\n  const message = success\n    ? \"Login successful. You can close this tab and return to the terminal.\"\n    : \"Login failed. You can close this tab and return to the terminal.\";\n  return `<!doctype html><html><head><meta charset=\"utf-8\"><title>Orizm CLI</title></head><body><p>${message}</p></body></html>`;\n}\n","import { Result } from \"@praha/byethrow\";\nimport { defineCommand } from \"../define-command.js\";\nimport { globalArgs } from \"../shared.js\";\nimport { CommandFailure } from \"../define-command.js\";\nimport { resolveEnv } from \"../../env.js\";\nimport { authorize, type AuthorizeError } from \"../../auth/authorize.js\";\nimport { FileTokenStore } from \"../../auth/token-store.js\";\nimport { notice } from \"../../ui/output.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"login\",\n    description: \"Sign in to Orizm\",\n  },\n  args: { ...globalArgs },\n  run: async () => {\n    const env = resolveEnv();\n    if (Result.isFailure(env)) {\n      return Result.fail({\n        message: \"Invalid Orizm environment configuration.\",\n      });\n    }\n    const { issuerUrl } = env.value;\n\n    notice(\n      \"Opening your browser to complete sign-in. Finish within 5 minutes...\",\n    );\n\n    const result = await authorize({\n      issuerUrl,\n      onAuthorizationUrl: (url) =>\n        notice(\n          `Could not open a browser automatically. Open this URL:\\n${url}`,\n        ),\n    });\n    if (Result.isFailure(result)) {\n      return authorizeFailure(result.error);\n    }\n\n    const { tokenSet, claims } = result.value;\n    await new FileTokenStore().set(issuerUrl, {\n      accessToken: tokenSet.accessToken,\n      refreshToken: tokenSet.refreshToken,\n      idToken: tokenSet.idToken,\n      expiresAt: tokenSet.expiresAt,\n      scope: tokenSet.scope,\n      subject: claims.subject,\n      profile: { name: claims.name, email: claims.email },\n    });\n\n    const who = claims.email ?? claims.name ?? claims.subject;\n    return Result.succeed({\n      json: { issuer: issuerUrl, subject: claims.subject, email: claims.email },\n      text: () => `Logged in as ${who}.`,\n    });\n  },\n});\n\nfunction authorizeFailure(\n  error: AuthorizeError,\n): Result.Result<never, CommandFailure> {\n  switch (error.type) {\n    case \"callback_server_failed\":\n      return Result.fail({\n        message:\n          \"Could not start the local sign-in listener. Check that your environment allows local connections, then try again.\",\n      });\n    case \"callback_timeout\":\n      return Result.fail({\n        message:\n          \"Timed out before the browser sign-in completed. Run `orizm auth login` again.\",\n      });\n    case \"state_mismatch\":\n      return Result.fail({\n        message: \"Sign-in failed due to a security check. Please try again.\",\n      });\n    case \"user_denied\":\n      return Result.fail({ message: \"Sign-in was denied.\" });\n    case \"token_exchange_failed\":\n      return Result.fail({\n        message: `Sign-in failed: ${error.reason}. Please try again.`,\n      });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAEA,SAAgB,gBAAgB,OAA2B;CACzD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,WACJ,KAAK,MAAM,CAAC,CACZ,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;;;;ACZA,SAAgB,YAAY,QAA4B;CACtD,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AACjE;;;;ACFA,eAAsB,OAAO,MAAuC;CAGlE,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,MAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI;CACpE,OAAO,IAAI,WAAW,MAAM;AAC9B;;;;ACIA,eAAsB,aAA4B;CAChD,MAAM,eAAe,gBAAgB,YAAY,EAAE,CAAC;CAEpD,OAAO;EACL;EACA,eAAe,gBAAgB,MAHZ,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAG3B;EACrC,qBAAqB;CACvB;AACF;;;;ACfA,SAAgB,cAAsB;CACpC,OAAO,gBAAgB,YAAY,EAAE,CAAC;AACxC;AAEA,SAAgB,YACd,UACA,UACS;CACT,OAAO,aAAa,QAAQ,aAAa;AAC3C;;;;ACGA,MAAM,qBAAqB,MAAS;AA+BpC,eAAsB,UACpB,QAC0D;CAC1D,MAAM,EAAE,cAAc;CACtB,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,QAAQ,YAAY;CAE1B,IAAI,wBAAwD,CAAC;CAC7D,MAAM,mBAAmB,IAAI,SAAwB,YAAY;EAC/D,kBAAkB;CACpB,CAAC;CAED,MAAM,MAAM,IAAIA,UAAK;CACrB,IAAI,IAAI,cAAc,MAAM;EAC1B,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,gBAAgB;GACd,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,OAAO,MAAM;GACb,kBAAkB,MAAM;EAC1B,CAAC;EACD,OAAO,EAAE,KAAK,mBAAmB,MAAM,SAAS,IAAI,CAAC;CACvD,CAAC;CAED,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,OAAO,GAAG;CAC7B,QAAQ;EAEN,OAAOC,uBAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;CACvD;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI;EACF,MAAM,cAAc,oBAAoB,KAAK;EAC7C,MAAM,mBAAmBC,2CAAsB;GAC7C;GACA;GACA,eAAe,KAAK;GACpB,qBAAqB,KAAK;GAC1B;EACF,CAAC;EAGD,OADiB,OAAO,eAAeC,aACzB,CAAC,gBAAgB,CAAC,CAAC,YAAY;GAC3C,OAAO,qBAAqB,gBAAgB;EAC9C,CAAC;EAED,MAAM,QAAQ,MAAM,gBAClB,kBACA,OAAO,aAAa,kBACtB;EACA,IAAI,SAAS,MACX,OAAOF,uBAAO,KAAK,EAAE,MAAM,mBAAmB,CAAC;EAKjD,IAAI,CAAC,YAAY,OAAO,MAAM,SAAS,IAAI,GACzC,OAAOA,uBAAO,KAAK,EAAE,MAAM,iBAAiB,CAAC;EAG/C,IAAI,MAAM,SAAS,MAAM;GACvB,IAAI,MAAM,UAAU,iBAClB,OAAOA,uBAAO,KAAK;IACjB,MAAM;IACN,aAAa,MAAM;GACrB,CAAC;GAEH,OAAOA,uBAAO,KAAK;IACjB,MAAM;IACN,QAAQ,CAAC,MAAM,OAAO,MAAM,gBAAgB,CAAC,CAC1C,QAAQ,SAAS,QAAQ,IAAI,CAAC,CAC9B,KAAK,IAAI;GACd,CAAC;EACH;EAEA,IAAI,MAAM,QAAQ,MAChB,OAAOA,uBAAO,KAAK;GACjB,MAAM;GACN,QAAQ;EACV,CAAC;EAGH,MAAM,YAAY,MAAMG,kCAAa;GACnC;GACA,MAAM,MAAM;GACZ;GACA,cAAc,KAAK;EACrB,CAAC;EACD,IAAIH,uBAAO,UAAU,SAAS,GAAG,OAAO;EAExC,MAAM,SAAS,MAAMI,mCAAc,WAAW,UAAU,MAAM,OAAO;EAErE,OAAOJ,uBAAO,QAAQ;GAAE;GAAW,UAAU,UAAU;GAAO;EAAO,CAAC;CACxE,UAAU;EACR,MAAM,YAAY,MAAM;CAC1B;AACF;AAEA,eAAe,OACb,KAC+C;CAC/C,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,sCACJ;GAAE,OAAO,IAAI;GAAO,UAAU;GAAa,MAAM;EAAE,IAClD,SAAS,QAAQ;GAAE;GAAQ,MAAM,KAAK;EAAK,CAAC,CAC/C;EACA,OAAO,GAAG,UAAU,UAAU,OAAO,KAAK,CAAC;CAC7C,CAAC;AACH;AAEA,eAAe,gBACb,kBACA,WACoC;CACpC,IAAI;CACJ,MAAM,WAAW,IAAI,SAAoB,YAAY;EACnD,QAAQ,iBAAiB,QAAQ,MAAS,GAAG,SAAS;CACxD,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CAAC,kBAAkB,QAAQ,CAAC;CACxD,UAAU;EACR,IAAI,SAAS,MAAM,aAAa,KAAK;CACvC;AACF;AAEA,eAAe,YAAY,QAAmC;CAC5D,MAAM,IAAI,SAAe,YAAY,OAAO,YAAY,QAAQ,CAAC,CAAC;AACpE;AAEA,SAAS,mBAAmB,SAA0B;CAIpD,OAAO,4FAHS,UACZ,yEACA,mEACuG;AAC7G;;;;AC7KA,oBAAeK,+BAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM,EAAE,GAAGC,0BAAW;CACtB,KAAK,YAAY;EACf,MAAM,MAAMC,+BAAW;EACvB,IAAIC,uBAAO,UAAU,GAAG,GACtB,OAAOA,uBAAO,KAAK,EACjB,SAAS,2CACX,CAAC;EAEH,MAAM,EAAE,cAAc,IAAI;EAE1B,wBACE,sEACF;EAEA,MAAM,SAAS,MAAM,UAAU;GAC7B;GACA,qBAAqB,QACnBC,wBACE,2DAA2D,KAC7D;EACJ,CAAC;EACD,IAAID,uBAAO,UAAU,MAAM,GACzB,OAAO,iBAAiB,OAAO,KAAK;EAGtC,MAAM,EAAE,UAAU,WAAW,OAAO;EACpC,MAAM,IAAIE,mCAAe,CAAC,CAAC,IAAI,WAAW;GACxC,aAAa,SAAS;GACtB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,WAAW,SAAS;GACpB,OAAO,SAAS;GAChB,SAAS,OAAO;GAChB,SAAS;IAAE,MAAM,OAAO;IAAM,OAAO,OAAO;GAAM;EACpD,CAAC;EAED,MAAM,MAAM,OAAO,SAAS,OAAO,QAAQ,OAAO;EAClD,OAAOF,uBAAO,QAAQ;GACpB,MAAM;IAAE,QAAQ;IAAW,SAAS,OAAO;IAAS,OAAO,OAAO;GAAM;GACxE,YAAY,gBAAgB,IAAI;EAClC,CAAC;CACH;AACF,CAAC;AAED,SAAS,iBACP,OACsC;CACtC,QAAQ,MAAM,MAAd;EACE,KAAK,0BACH,OAAOA,uBAAO,KAAK,EACjB,SACE,oHACJ,CAAC;EACH,KAAK,oBACH,OAAOA,uBAAO,KAAK,EACjB,SACE,gFACJ,CAAC;EACH,KAAK,kBACH,OAAOA,uBAAO,KAAK,EACjB,SAAS,4DACX,CAAC;EACH,KAAK,eACH,OAAOA,uBAAO,KAAK,EAAE,SAAS,sBAAsB,CAAC;EACvD,KAAK,yBACH,OAAOA,uBAAO,KAAK,EACjB,SAAS,mBAAmB,MAAM,OAAO,qBAC3C,CAAC;CACL;AACF"}

package/dist/login-FE_dbWMo.mjs

@@ -0,0 +1,211 @@
+import { a as notice, t as defineCommand } from "./cli/main.mjs";
+import { i as globalArgs } from "./shared-CZZimGxc.mjs";
+import { n as resolveEnv, t as FileTokenStore } from "./token-store-reCGF86F.mjs";
+import { a as verifyIdToken, n as exchangeCode, t as buildAuthorizationUrl } from "./oauth-client-QHuDa4fW.mjs";
+import { Result } from "@praha/byethrow";
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import openBrowser from "open";
+
+//#region src/cli/util/base64url.ts
+function encodeBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+//#endregion
+//#region src/cli/util/random.ts
+function randomBytes(length) {
+	return globalThis.crypto.getRandomValues(new Uint8Array(length));
+}
+
+//#endregion
+//#region src/cli/util/sha256.ts
+async function sha256(data) {
+	const view = new Uint8Array(data);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", view);
+	return new Uint8Array(digest);
+}
+
+//#endregion
+//#region src/cli/auth/pkce.ts
+async function createPkce() {
+	const codeVerifier = encodeBase64Url(randomBytes(32));
+	return {
+		codeVerifier,
+		codeChallenge: encodeBase64Url(await sha256(new TextEncoder().encode(codeVerifier))),
+		codeChallengeMethod: "S256"
+	};
+}
+
+//#endregion
+//#region src/cli/auth/state.ts
+function createState() {
+	return encodeBase64Url(randomBytes(32));
+}
+function verifyState(expected, received) {
+	return received !== null && received === expected;
+}
+
+//#endregion
+//#region src/cli/auth/authorize.ts
+const DEFAULT_TIMEOUT_MS = 300 * 1e3;
+async function authorize(params) {
+	const { issuerUrl } = params;
+	const pkce = await createPkce();
+	const state = createState();
+	let resolveCallback = () => {};
+	const callbackReceived = new Promise((resolve) => {
+		resolveCallback = resolve;
+	});
+	const app = new Hono();
+	app.get("/callback", (c) => {
+		const query = c.req.query();
+		resolveCallback({
+			code: query.code,
+			state: query.state,
+			error: query.error,
+			errorDescription: query.error_description
+		});
+		return c.html(renderCallbackHtml(query.error == null));
+	});
+	let listened;
+	try {
+		listened = await listen(app);
+	} catch {
+		return Result.fail({ type: "callback_server_failed" });
+	}
+	const { server, port } = listened;
+	try {
+		const redirectUri = `http://127.0.0.1:${port}/callback`;
+		const authorizationUrl = buildAuthorizationUrl({
+			issuerUrl,
+			redirectUri,
+			codeChallenge: pkce.codeChallenge,
+			codeChallengeMethod: pkce.codeChallengeMethod,
+			state
+		});
+		await (params.openBrowser ?? openBrowser)(authorizationUrl).catch(() => {
+			params.onAuthorizationUrl?.(authorizationUrl);
+		});
+		const query = await waitForCallback(callbackReceived, params.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+		if (query == null) return Result.fail({ type: "callback_timeout" });
+		if (!verifyState(state, query.state ?? null)) return Result.fail({ type: "state_mismatch" });
+		if (query.error != null) {
+			if (query.error === "access_denied") return Result.fail({
+				type: "user_denied",
+				description: query.errorDescription
+			});
+			return Result.fail({
+				type: "token_exchange_failed",
+				reason: [query.error, query.errorDescription].filter((part) => part != null).join(": ")
+			});
+		}
+		if (query.code == null) return Result.fail({
+			type: "token_exchange_failed",
+			reason: "Authorization response did not include a code"
+		});
+		const exchanged = await exchangeCode({
+			issuerUrl,
+			code: query.code,
+			redirectUri,
+			codeVerifier: pkce.codeVerifier
+		});
+		if (Result.isFailure(exchanged)) return exchanged;
+		const claims = await verifyIdToken(issuerUrl, exchanged.value.idToken);
+		return Result.succeed({
+			issuerUrl,
+			tokenSet: exchanged.value,
+			claims
+		});
+	} finally {
+		await closeServer(server);
+	}
+}
+async function listen(app) {
+	return new Promise((resolve, reject) => {
+		const server = serve({
+			fetch: app.fetch,
+			hostname: "127.0.0.1",
+			port: 0
+		}, (info) => resolve({
+			server,
+			port: info.port
+		}));
+		server.on("error", (error) => reject(error));
+	});
+}
+async function waitForCallback(callbackReceived, timeoutMs) {
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(void 0), timeoutMs);
+	});
+	try {
+		return await Promise.race([callbackReceived, timedOut]);
+	} finally {
+		if (timer != null) clearTimeout(timer);
+	}
+}
+async function closeServer(server) {
+	await new Promise((resolve) => server.close(() => resolve()));
+}
+function renderCallbackHtml(success) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>Orizm CLI</title></head><body><p>${success ? "Login successful. You can close this tab and return to the terminal." : "Login failed. You can close this tab and return to the terminal."}</p></body></html>`;
+}
+
+//#endregion
+//#region src/cli/commands/auth/login.ts
+var login_default = defineCommand({
+	meta: {
+		name: "login",
+		description: "Sign in to Orizm"
+	},
+	args: { ...globalArgs },
+	run: async () => {
+		const env = resolveEnv();
+		if (Result.isFailure(env)) return Result.fail({ message: "Invalid Orizm environment configuration." });
+		const { issuerUrl } = env.value;
+		notice("Opening your browser to complete sign-in. Finish within 5 minutes...");
+		const result = await authorize({
+			issuerUrl,
+			onAuthorizationUrl: (url) => notice(`Could not open a browser automatically. Open this URL:\n${url}`)
+		});
+		if (Result.isFailure(result)) return authorizeFailure(result.error);
+		const { tokenSet, claims } = result.value;
+		await new FileTokenStore().set(issuerUrl, {
+			accessToken: tokenSet.accessToken,
+			refreshToken: tokenSet.refreshToken,
+			idToken: tokenSet.idToken,
+			expiresAt: tokenSet.expiresAt,
+			scope: tokenSet.scope,
+			subject: claims.subject,
+			profile: {
+				name: claims.name,
+				email: claims.email
+			}
+		});
+		const who = claims.email ?? claims.name ?? claims.subject;
+		return Result.succeed({
+			json: {
+				issuer: issuerUrl,
+				subject: claims.subject,
+				email: claims.email
+			},
+			text: () => `Logged in as ${who}.`
+		});
+	}
+});
+function authorizeFailure(error) {
+	switch (error.type) {
+		case "callback_server_failed": return Result.fail({ message: "Could not start the local sign-in listener. Check that your environment allows local connections, then try again." });
+		case "callback_timeout": return Result.fail({ message: "Timed out before the browser sign-in completed. Run `orizm auth login` again." });
+		case "state_mismatch": return Result.fail({ message: "Sign-in failed due to a security check. Please try again." });
+		case "user_denied": return Result.fail({ message: "Sign-in was denied." });
+		case "token_exchange_failed": return Result.fail({ message: `Sign-in failed: ${error.reason}. Please try again.` });
+	}
+}
+
+//#endregion
+export { login_default as default };
+//# sourceMappingURL=login-FE_dbWMo.mjs.map

package/dist/login-FE_dbWMo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-FE_dbWMo.mjs","names":[],"sources":["../src/cli/util/base64url.ts","../src/cli/util/random.ts","../src/cli/util/sha256.ts","../src/cli/auth/pkce.ts","../src/cli/auth/state.ts","../src/cli/auth/authorize.ts","../src/cli/commands/auth/login.ts"],"sourcesContent":["// Node 固有の Buffer ではなく Web 標準の btoa/atob を使う。特定ランタイムの API に\n// 縛られず、ブラウザ / Deno / Edge でもそのまま動く形にしておくため。\nexport function encodeBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return globalThis\n    .btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport function decodeBase64Url(text: string): Uint8Array {\n  const base64 = text.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = globalThis.atob(base64);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i);\n  }\n  return bytes;\n}\n","export function randomBytes(length: number): Uint8Array {\n  return globalThis.crypto.getRandomValues(new Uint8Array(length));\n}\n","export async function sha256(data: Uint8Array): Promise<Uint8Array> {\n  // 新しい TS lib は Uint8Array を ArrayBufferLike でジェネリックにし digest が ArrayBuffer 裏付けを要求するため、\n  // ArrayBuffer 裏付けの view にコピーしてから渡す。\n  const view = new Uint8Array(data);\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", view);\n  return new Uint8Array(digest);\n}\n","import { encodeBase64Url } from \"../util/base64url.js\";\nimport { randomBytes } from \"../util/random.js\";\nimport { sha256 } from \"../util/sha256.js\";\n\nexport type Pkce = {\n  codeVerifier: string;\n  codeChallenge: string;\n  codeChallengeMethod: \"S256\";\n};\n\nexport async function createPkce(): Promise<Pkce> {\n  const codeVerifier = encodeBase64Url(randomBytes(32));\n  const digest = await sha256(new TextEncoder().encode(codeVerifier));\n  return {\n    codeVerifier,\n    codeChallenge: encodeBase64Url(digest),\n    codeChallengeMethod: \"S256\",\n  };\n}\n","import { encodeBase64Url } from \"../util/base64url.js\";\nimport { randomBytes } from \"../util/random.js\";\n\nexport function createState(): string {\n  return encodeBase64Url(randomBytes(32));\n}\n\nexport function verifyState(\n  expected: string,\n  received: string | null,\n): boolean {\n  return received !== null && received === expected;\n}\n","import { serve, type ServerType } from \"@hono/node-server\";\nimport { Hono } from \"hono\";\nimport openBrowser from \"open\";\nimport { Result } from \"@praha/byethrow\";\nimport { createPkce } from \"./pkce.js\";\nimport { createState, verifyState } from \"./state.js\";\nimport {\n  buildAuthorizationUrl,\n  exchangeCode,\n  verifyIdToken,\n  type IdTokenClaims,\n  type TokenExchangeError,\n  type TokenSet,\n} from \"./oauth-client.js\";\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport type AuthorizeError =\n  | { type: \"callback_server_failed\" }\n  | { type: \"callback_timeout\" }\n  | { type: \"state_mismatch\" }\n  | { type: \"user_denied\"; description?: string }\n  | TokenExchangeError;\n\nexport type AuthorizeSuccess = {\n  issuerUrl: string;\n  tokenSet: TokenSet;\n  claims: IdTokenClaims;\n};\n\ntype CallbackQuery = {\n  code?: string;\n  state?: string;\n  error?: string;\n  errorDescription?: string;\n};\n\nexport type AuthorizeParams = {\n  issuerUrl: string;\n  // ブラウザ起動を差し替え可能にして統合テストで「ブラウザ役」の fetch を流せるようにする。\n  openBrowser?: (url: string) => Promise<void>;\n  // ブラウザ起動に失敗したときに authorization URL を利用者へ手動提示するための通知口。\n  onAuthorizationUrl?: (url: string) => void;\n  timeoutMs?: number;\n};\n\nexport async function authorize(\n  params: AuthorizeParams,\n): Promise<Result.Result<AuthorizeSuccess, AuthorizeError>> {\n  const { issuerUrl } = params;\n  const pkce = await createPkce();\n  const state = createState();\n\n  let resolveCallback: (query: CallbackQuery) => void = () => {};\n  const callbackReceived = new Promise<CallbackQuery>((resolve) => {\n    resolveCallback = resolve;\n  });\n\n  const app = new Hono();\n  app.get(\"/callback\", (c) => {\n    const query = c.req.query();\n    resolveCallback({\n      code: query.code,\n      state: query.state,\n      error: query.error,\n      errorDescription: query.error_description,\n    });\n    return c.html(renderCallbackHtml(query.error == null));\n  });\n\n  let listened: { server: ServerType; port: number };\n  try {\n    listened = await listen(app);\n  } catch {\n    // loopback に bind できない環境ではログインを完遂できないため、待たずに失敗を返す。\n    return Result.fail({ type: \"callback_server_failed\" });\n  }\n  const { server, port } = listened;\n\n  try {\n    const redirectUri = `http://127.0.0.1:${port}/callback`;\n    const authorizationUrl = buildAuthorizationUrl({\n      issuerUrl,\n      redirectUri,\n      codeChallenge: pkce.codeChallenge,\n      codeChallengeMethod: pkce.codeChallengeMethod,\n      state,\n    });\n\n    const openImpl = params.openBrowser ?? openBrowser;\n    await openImpl(authorizationUrl).catch(() => {\n      params.onAuthorizationUrl?.(authorizationUrl);\n    });\n\n    const query = await waitForCallback(\n      callbackReceived,\n      params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    );\n    if (query == null) {\n      return Result.fail({ type: \"callback_timeout\" });\n    }\n\n    // 成功・失敗どちらの応答も Authorization Server は state を返すため、分岐する前に検証する。\n    // 無関係なローカルリクエスト（?error=... 等）で進行中のログインを中断させないため。\n    if (!verifyState(state, query.state ?? null)) {\n      return Result.fail({ type: \"state_mismatch\" });\n    }\n\n    if (query.error != null) {\n      if (query.error === \"access_denied\") {\n        return Result.fail({\n          type: \"user_denied\",\n          description: query.errorDescription,\n        });\n      }\n      return Result.fail({\n        type: \"token_exchange_failed\",\n        reason: [query.error, query.errorDescription]\n          .filter((part) => part != null)\n          .join(\": \"),\n      });\n    }\n\n    if (query.code == null) {\n      return Result.fail({\n        type: \"token_exchange_failed\",\n        reason: \"Authorization response did not include a code\",\n      });\n    }\n\n    const exchanged = await exchangeCode({\n      issuerUrl,\n      code: query.code,\n      redirectUri,\n      codeVerifier: pkce.codeVerifier,\n    });\n    if (Result.isFailure(exchanged)) return exchanged;\n\n    const claims = await verifyIdToken(issuerUrl, exchanged.value.idToken);\n\n    return Result.succeed({ issuerUrl, tokenSet: exchanged.value, claims });\n  } finally {\n    await closeServer(server);\n  }\n}\n\nasync function listen(\n  app: Hono,\n): Promise<{ server: ServerType; port: number }> {\n  return new Promise((resolve, reject) => {\n    const server = serve(\n      { fetch: app.fetch, hostname: \"127.0.0.1\", port: 0 },\n      (info) => resolve({ server, port: info.port }),\n    );\n    server.on(\"error\", (error) => reject(error));\n  });\n}\n\nasync function waitForCallback(\n  callbackReceived: Promise<CallbackQuery>,\n  timeoutMs: number,\n): Promise<CallbackQuery | undefined> {\n  let timer: NodeJS.Timeout | undefined;\n  const timedOut = new Promise<undefined>((resolve) => {\n    timer = setTimeout(() => resolve(undefined), timeoutMs);\n  });\n  try {\n    return await Promise.race([callbackReceived, timedOut]);\n  } finally {\n    if (timer != null) clearTimeout(timer);\n  }\n}\n\nasync function closeServer(server: ServerType): Promise<void> {\n  await new Promise<void>((resolve) => server.close(() => resolve()));\n}\n\nfunction renderCallbackHtml(success: boolean): string {\n  const message = success\n    ? \"Login successful. You can close this tab and return to the terminal.\"\n    : \"Login failed. You can close this tab and return to the terminal.\";\n  return `<!doctype html><html><head><meta charset=\"utf-8\"><title>Orizm CLI</title></head><body><p>${message}</p></body></html>`;\n}\n","import { Result } from \"@praha/byethrow\";\nimport { defineCommand } from \"../define-command.js\";\nimport { globalArgs } from \"../shared.js\";\nimport { CommandFailure } from \"../define-command.js\";\nimport { resolveEnv } from \"../../env.js\";\nimport { authorize, type AuthorizeError } from \"../../auth/authorize.js\";\nimport { FileTokenStore } from \"../../auth/token-store.js\";\nimport { notice } from \"../../ui/output.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"login\",\n    description: \"Sign in to Orizm\",\n  },\n  args: { ...globalArgs },\n  run: async () => {\n    const env = resolveEnv();\n    if (Result.isFailure(env)) {\n      return Result.fail({\n        message: \"Invalid Orizm environment configuration.\",\n      });\n    }\n    const { issuerUrl } = env.value;\n\n    notice(\n      \"Opening your browser to complete sign-in. Finish within 5 minutes...\",\n    );\n\n    const result = await authorize({\n      issuerUrl,\n      onAuthorizationUrl: (url) =>\n        notice(\n          `Could not open a browser automatically. Open this URL:\\n${url}`,\n        ),\n    });\n    if (Result.isFailure(result)) {\n      return authorizeFailure(result.error);\n    }\n\n    const { tokenSet, claims } = result.value;\n    await new FileTokenStore().set(issuerUrl, {\n      accessToken: tokenSet.accessToken,\n      refreshToken: tokenSet.refreshToken,\n      idToken: tokenSet.idToken,\n      expiresAt: tokenSet.expiresAt,\n      scope: tokenSet.scope,\n      subject: claims.subject,\n      profile: { name: claims.name, email: claims.email },\n    });\n\n    const who = claims.email ?? claims.name ?? claims.subject;\n    return Result.succeed({\n      json: { issuer: issuerUrl, subject: claims.subject, email: claims.email },\n      text: () => `Logged in as ${who}.`,\n    });\n  },\n});\n\nfunction authorizeFailure(\n  error: AuthorizeError,\n): Result.Result<never, CommandFailure> {\n  switch (error.type) {\n    case \"callback_server_failed\":\n      return Result.fail({\n        message:\n          \"Could not start the local sign-in listener. Check that your environment allows local connections, then try again.\",\n      });\n    case \"callback_timeout\":\n      return Result.fail({\n        message:\n          \"Timed out before the browser sign-in completed. Run `orizm auth login` again.\",\n      });\n    case \"state_mismatch\":\n      return Result.fail({\n        message: \"Sign-in failed due to a security check. Please try again.\",\n      });\n    case \"user_denied\":\n      return Result.fail({ message: \"Sign-in was denied.\" });\n    case \"token_exchange_failed\":\n      return Result.fail({\n        message: `Sign-in failed: ${error.reason}. Please try again.`,\n      });\n  }\n}\n"],"mappings":";;;;;;;;;;AAEA,SAAgB,gBAAgB,OAA2B;CACzD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,WACJ,KAAK,MAAM,CAAC,CACZ,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;;;;ACZA,SAAgB,YAAY,QAA4B;CACtD,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AACjE;;;;ACFA,eAAsB,OAAO,MAAuC;CAGlE,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,MAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI;CACpE,OAAO,IAAI,WAAW,MAAM;AAC9B;;;;ACIA,eAAsB,aAA4B;CAChD,MAAM,eAAe,gBAAgB,YAAY,EAAE,CAAC;CAEpD,OAAO;EACL;EACA,eAAe,gBAAgB,MAHZ,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAG3B;EACrC,qBAAqB;CACvB;AACF;;;;ACfA,SAAgB,cAAsB;CACpC,OAAO,gBAAgB,YAAY,EAAE,CAAC;AACxC;AAEA,SAAgB,YACd,UACA,UACS;CACT,OAAO,aAAa,QAAQ,aAAa;AAC3C;;;;ACGA,MAAM,qBAAqB,MAAS;AA+BpC,eAAsB,UACpB,QAC0D;CAC1D,MAAM,EAAE,cAAc;CACtB,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,QAAQ,YAAY;CAE1B,IAAI,wBAAwD,CAAC;CAC7D,MAAM,mBAAmB,IAAI,SAAwB,YAAY;EAC/D,kBAAkB;CACpB,CAAC;CAED,MAAM,MAAM,IAAI,KAAK;CACrB,IAAI,IAAI,cAAc,MAAM;EAC1B,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,gBAAgB;GACd,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,OAAO,MAAM;GACb,kBAAkB,MAAM;EAC1B,CAAC;EACD,OAAO,EAAE,KAAK,mBAAmB,MAAM,SAAS,IAAI,CAAC;CACvD,CAAC;CAED,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,OAAO,GAAG;CAC7B,QAAQ;EAEN,OAAO,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;CACvD;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI;EACF,MAAM,cAAc,oBAAoB,KAAK;EAC7C,MAAM,mBAAmB,sBAAsB;GAC7C;GACA;GACA,eAAe,KAAK;GACpB,qBAAqB,KAAK;GAC1B;EACF,CAAC;EAGD,OADiB,OAAO,eAAe,YACzB,CAAC,gBAAgB,CAAC,CAAC,YAAY;GAC3C,OAAO,qBAAqB,gBAAgB;EAC9C,CAAC;EAED,MAAM,QAAQ,MAAM,gBAClB,kBACA,OAAO,aAAa,kBACtB;EACA,IAAI,SAAS,MACX,OAAO,OAAO,KAAK,EAAE,MAAM,mBAAmB,CAAC;EAKjD,IAAI,CAAC,YAAY,OAAO,MAAM,SAAS,IAAI,GACzC,OAAO,OAAO,KAAK,EAAE,MAAM,iBAAiB,CAAC;EAG/C,IAAI,MAAM,SAAS,MAAM;GACvB,IAAI,MAAM,UAAU,iBAClB,OAAO,OAAO,KAAK;IACjB,MAAM;IACN,aAAa,MAAM;GACrB,CAAC;GAEH,OAAO,OAAO,KAAK;IACjB,MAAM;IACN,QAAQ,CAAC,MAAM,OAAO,MAAM,gBAAgB,CAAC,CAC1C,QAAQ,SAAS,QAAQ,IAAI,CAAC,CAC9B,KAAK,IAAI;GACd,CAAC;EACH;EAEA,IAAI,MAAM,QAAQ,MAChB,OAAO,OAAO,KAAK;GACjB,MAAM;GACN,QAAQ;EACV,CAAC;EAGH,MAAM,YAAY,MAAM,aAAa;GACnC;GACA,MAAM,MAAM;GACZ;GACA,cAAc,KAAK;EACrB,CAAC;EACD,IAAI,OAAO,UAAU,SAAS,GAAG,OAAO;EAExC,MAAM,SAAS,MAAM,cAAc,WAAW,UAAU,MAAM,OAAO;EAErE,OAAO,OAAO,QAAQ;GAAE;GAAW,UAAU,UAAU;GAAO;EAAO,CAAC;CACxE,UAAU;EACR,MAAM,YAAY,MAAM;CAC1B;AACF;AAEA,eAAe,OACb,KAC+C;CAC/C,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAS,MACb;GAAE,OAAO,IAAI;GAAO,UAAU;GAAa,MAAM;EAAE,IAClD,SAAS,QAAQ;GAAE;GAAQ,MAAM,KAAK;EAAK,CAAC,CAC/C;EACA,OAAO,GAAG,UAAU,UAAU,OAAO,KAAK,CAAC;CAC7C,CAAC;AACH;AAEA,eAAe,gBACb,kBACA,WACoC;CACpC,IAAI;CACJ,MAAM,WAAW,IAAI,SAAoB,YAAY;EACnD,QAAQ,iBAAiB,QAAQ,MAAS,GAAG,SAAS;CACxD,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CAAC,kBAAkB,QAAQ,CAAC;CACxD,UAAU;EACR,IAAI,SAAS,MAAM,aAAa,KAAK;CACvC;AACF;AAEA,eAAe,YAAY,QAAmC;CAC5D,MAAM,IAAI,SAAe,YAAY,OAAO,YAAY,QAAQ,CAAC,CAAC;AACpE;AAEA,SAAS,mBAAmB,SAA0B;CAIpD,OAAO,4FAHS,UACZ,yEACA,mEACuG;AAC7G;;;;AC7KA,oBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM,EAAE,GAAG,WAAW;CACtB,KAAK,YAAY;EACf,MAAM,MAAM,WAAW;EACvB,IAAI,OAAO,UAAU,GAAG,GACtB,OAAO,OAAO,KAAK,EACjB,SAAS,2CACX,CAAC;EAEH,MAAM,EAAE,cAAc,IAAI;EAE1B,OACE,sEACF;EAEA,MAAM,SAAS,MAAM,UAAU;GAC7B;GACA,qBAAqB,QACnB,OACE,2DAA2D,KAC7D;EACJ,CAAC;EACD,IAAI,OAAO,UAAU,MAAM,GACzB,OAAO,iBAAiB,OAAO,KAAK;EAGtC,MAAM,EAAE,UAAU,WAAW,OAAO;EACpC,MAAM,IAAI,eAAe,CAAC,CAAC,IAAI,WAAW;GACxC,aAAa,SAAS;GACtB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,WAAW,SAAS;GACpB,OAAO,SAAS;GAChB,SAAS,OAAO;GAChB,SAAS;IAAE,MAAM,OAAO;IAAM,OAAO,OAAO;GAAM;EACpD,CAAC;EAED,MAAM,MAAM,OAAO,SAAS,OAAO,QAAQ,OAAO;EAClD,OAAO,OAAO,QAAQ;GACpB,MAAM;IAAE,QAAQ;IAAW,SAAS,OAAO;IAAS,OAAO,OAAO;GAAM;GACxE,YAAY,gBAAgB,IAAI;EAClC,CAAC;CACH;AACF,CAAC;AAED,SAAS,iBACP,OACsC;CACtC,QAAQ,MAAM,MAAd;EACE,KAAK,0BACH,OAAO,OAAO,KAAK,EACjB,SACE,oHACJ,CAAC;EACH,KAAK,oBACH,OAAO,OAAO,KAAK,EACjB,SACE,gFACJ,CAAC;EACH,KAAK,kBACH,OAAO,OAAO,KAAK,EACjB,SAAS,4DACX,CAAC;EACH,KAAK,eACH,OAAO,OAAO,KAAK,EAAE,SAAS,sBAAsB,CAAC;EACvD,KAAK,yBACH,OAAO,OAAO,KAAK,EACjB,SAAS,mBAAmB,MAAM,OAAO,qBAC3C,CAAC;CACL;AACF"}

package/dist/logout-BDbWrGBm.mjs

@@ -0,0 +1,35 @@
+import { t as defineCommand } from "./cli/main.mjs";
+import { i as globalArgs } from "./shared-CZZimGxc.mjs";
+import { n as resolveEnv, t as FileTokenStore } from "./token-store-reCGF86F.mjs";
+import { i as revokeToken } from "./oauth-client-QHuDa4fW.mjs";
+import { Result } from "@praha/byethrow";
+
+//#region src/cli/commands/auth/logout.ts
+var logout_default = defineCommand({
+	meta: {
+		name: "logout",
+		description: "Sign out of Orizm"
+	},
+	args: { ...globalArgs },
+	run: async () => {
+		const env = resolveEnv();
+		if (Result.isFailure(env)) return Result.fail({ message: "Invalid Orizm environment configuration." });
+		const { issuerUrl } = env.value;
+		const store = new FileTokenStore();
+		const entry = await store.get(issuerUrl);
+		if (entry === void 0) return Result.succeed({
+			json: { loggedOut: false },
+			text: () => "You are not logged in."
+		});
+		await revokeToken(issuerUrl, entry.refreshToken).catch(() => void 0);
+		await store.remove(issuerUrl);
+		return Result.succeed({
+			json: { loggedOut: true },
+			text: () => "Logged out."
+		});
+	}
+});
+
+//#endregion
+export { logout_default as default };
+//# sourceMappingURL=logout-BDbWrGBm.mjs.map

package/dist/logout-BDbWrGBm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-BDbWrGBm.mjs","names":[],"sources":["../src/cli/commands/auth/logout.ts"],"sourcesContent":["import { Result } from \"@praha/byethrow\";\nimport { defineCommand } from \"../define-command.js\";\nimport { globalArgs } from \"../shared.js\";\nimport { resolveEnv } from \"../../env.js\";\nimport { FileTokenStore } from \"../../auth/token-store.js\";\nimport { revokeToken } from \"../../auth/oauth-client.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"logout\",\n    description: \"Sign out of Orizm\",\n  },\n  args: { ...globalArgs },\n  run: async () => {\n    const env = resolveEnv();\n    if (Result.isFailure(env)) {\n      return Result.fail({\n        message: \"Invalid Orizm environment configuration.\",\n      });\n    }\n    const { issuerUrl } = env.value;\n\n    const store = new FileTokenStore();\n    const entry = await store.get(issuerUrl);\n    if (entry === undefined) {\n      return Result.succeed({\n        json: { loggedOut: false },\n        text: () => \"You are not logged in.\",\n      });\n    }\n\n    // Hydra 側 revoke は best-effort。失敗してもローカル破棄でログアウトは成立させる。\n    await revokeToken(issuerUrl, entry.refreshToken).catch(() => undefined);\n    await store.remove(issuerUrl);\n\n    return Result.succeed({\n      json: { loggedOut: true },\n      text: () => \"Logged out.\",\n    });\n  },\n});\n"],"mappings":";;;;;;;AAOA,qBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM,EAAE,GAAG,WAAW;CACtB,KAAK,YAAY;EACf,MAAM,MAAM,WAAW;EACvB,IAAI,OAAO,UAAU,GAAG,GACtB,OAAO,OAAO,KAAK,EACjB,SAAS,2CACX,CAAC;EAEH,MAAM,EAAE,cAAc,IAAI;EAE1B,MAAM,QAAQ,IAAI,eAAe;EACjC,MAAM,QAAQ,MAAM,MAAM,IAAI,SAAS;EACvC,IAAI,UAAU,QACZ,OAAO,OAAO,QAAQ;GACpB,MAAM,EAAE,WAAW,MAAM;GACzB,YAAY;EACd,CAAC;EAIH,MAAM,YAAY,WAAW,MAAM,YAAY,CAAC,CAAC,YAAY,MAAS;EACtE,MAAM,MAAM,OAAO,SAAS;EAE5B,OAAO,OAAO,QAAQ;GACpB,MAAM,EAAE,WAAW,KAAK;GACxB,YAAY;EACd,CAAC;CACH;AACF,CAAC"}

package/dist/logout-DC5TMJ5_.cjs

@@ -0,0 +1,35 @@
+const require_cli_main = require('./cli/main.cjs');
+const require_shared = require('./shared-DHRPzzKl.cjs');
+const require_token_store = require('./token-store--9GYVL7N.cjs');
+const require_oauth_client = require('./oauth-client-CdD0evAV.cjs');
+let _praha_byethrow = require("@praha/byethrow");
+
+//#region src/cli/commands/auth/logout.ts
+var logout_default = require_cli_main.defineCommand({
+	meta: {
+		name: "logout",
+		description: "Sign out of Orizm"
+	},
+	args: { ...require_shared.globalArgs },
+	run: async () => {
+		const env = require_token_store.resolveEnv();
+		if (_praha_byethrow.Result.isFailure(env)) return _praha_byethrow.Result.fail({ message: "Invalid Orizm environment configuration." });
+		const { issuerUrl } = env.value;
+		const store = new require_token_store.FileTokenStore();
+		const entry = await store.get(issuerUrl);
+		if (entry === void 0) return _praha_byethrow.Result.succeed({
+			json: { loggedOut: false },
+			text: () => "You are not logged in."
+		});
+		await require_oauth_client.revokeToken(issuerUrl, entry.refreshToken).catch(() => void 0);
+		await store.remove(issuerUrl);
+		return _praha_byethrow.Result.succeed({
+			json: { loggedOut: true },
+			text: () => "Logged out."
+		});
+	}
+});
+
+//#endregion
+exports.default = logout_default;
+//# sourceMappingURL=logout-DC5TMJ5_.cjs.map