@otto-code/cli 0.7.4 → 0.7.6

package/dist/commands/agent/update.js

@@ -6,8 +6,35 @@ export const updateSchema = {
         { header: "AGENT ID", field: "agentId" },
         { header: "NAME", field: "name" },
         { header: "LABELS", field: "labels" },
+        { header: "THINKING", field: "thinkingOptionId" },
+        { header: "NOTICE", field: "notice" },
     ],
 };
+export function toAgentUpdateResult(agent, appliedChanges) {
+    return {
+        agentId: agent.id,
+        name: agent.title,
+        labels: formatLabels(agent.labels),
+        thinkingOptionId: agent.effectiveThinkingOptionId ?? null,
+        noticeType: appliedChanges.notice?.type ?? null,
+        notice: appliedChanges.notice?.message ?? null,
+    };
+}
+export async function applyAgentChanges(client, agentId, changes) {
+    if (changes.type === "thinking") {
+        // COMPAT(agentThinkingUpdate): added in v0.2.4, remove gate after 2027-01-28.
+        if (client.getLastServerInfoMessage()?.features?.agentThinkingUpdate !== true) {
+            throw {
+                code: "DAEMON_UPDATE_REQUIRED",
+                message: "Update the host to use agent thinking updates.",
+            };
+        }
+        const notice = await client.setAgentThinkingOption(agentId, changes.thinkingOptionId);
+        return { notice };
+    }
+    await client.updateAgent(agentId, changes.updates);
+    return { notice: null };
+}
 function parseLabelOptions(labels) {
     const parsed = {};
     if (!labels) {
@@ -50,35 +77,62 @@ function formatLabels(labels) {
     }
     return entries.map(([key, value]) => `${key}=${value}`).join(",");
 }
-export async function runUpdateCommand(agentIdArg, options, _command) {
-    const host = getDaemonHost({ host: options.host });
-    // Validate arguments
-    if (!agentIdArg || agentIdArg.trim().length === 0) {
-        const error = {
-            code: "MISSING_AGENT_ID",
-            message: "Agent ID is required",
-            details: "Usage: otto agent update <id> [--name <name>] [--label <key=value>]",
-        };
-        throw error;
-    }
+function parseAgentChanges(options) {
     const name = options.name?.trim();
     if (options.name !== undefined && !name) {
-        const error = {
+        throw {
             code: "INVALID_NAME",
             message: "Name cannot be empty",
             details: "Use --name <name> with a non-empty value",
         };
-        throw error;
     }
     const labels = parseLabelOptions(options.label);
-    if (!name && Object.keys(labels).length === 0) {
-        const error = {
+    const thinkingOptionId = options.thinking?.trim();
+    if (options.thinking !== undefined && !thinkingOptionId) {
+        throw {
+            code: "INVALID_THINKING_OPTION",
+            message: "--thinking cannot be empty",
+            details: 'Provide a thinking option ID. Use "otto provider models <provider> --thinking" to list valid IDs.',
+        };
+    }
+    const hasMetadataUpdates = Boolean(name) || Object.keys(labels).length > 0;
+    if (hasMetadataUpdates && thinkingOptionId) {
+        throw {
+            code: "INVALID_OPTIONS",
+            message: "--thinking cannot be combined with --name or --label",
+            details: "Run separate agent update commands for runtime settings and metadata.",
+        };
+    }
+    if (!hasMetadataUpdates && !thinkingOptionId) {
+        throw {
             code: "NO_CHANGES_PROVIDED",
             message: "Nothing to update",
-            details: "Provide at least one of: --name <name>, --label <key=value>",
+            details: "Provide at least one of: --name <name>, --label <key=value>, --thinking <id>",
+        };
+    }
+    if (thinkingOptionId) {
+        return { type: "thinking", thinkingOptionId };
+    }
+    return {
+        type: "metadata",
+        updates: {
+            ...(name ? { name } : {}),
+            ...(Object.keys(labels).length > 0 ? { labels } : {}),
+        },
+    };
+}
+export async function runUpdateCommand(agentIdArg, options, _command) {
+    const host = getDaemonHost({ host: options.host });
+    // Validate arguments
+    if (!agentIdArg || agentIdArg.trim().length === 0) {
+        const error = {
+            code: "MISSING_AGENT_ID",
+            message: "Agent ID is required",
+            details: "Usage: otto agent update <id> [--name <name>] [--label <key=value>]",
         };
         throw error;
     }
+    const changes = parseAgentChanges(options);
     let client;
     try {
         client = await connectToDaemon({ host: options.host });
@@ -103,10 +157,7 @@ export async function runUpdateCommand(agentIdArg, options, _command) {
             throw error;
         }
         const agentId = fetchResult.agent.id;
-        await client.updateAgent(agentId, {
-            ...(name ? { name } : {}),
-            ...(Object.keys(labels).length > 0 ? { labels } : {}),
-        });
+        const appliedChanges = await applyAgentChanges(client, agentId, changes);
         const updatedResult = await client.fetchAgent({ agentId });
         if (!updatedResult) {
             throw new Error(`Agent not found after update: ${agentId}`);
@@ -114,11 +165,7 @@ export async function runUpdateCommand(agentIdArg, options, _command) {
         await client.close();
         return {
             type: "single",
-            data: {
-                agentId,
-                name: updatedResult.agent.title,
-                labels: formatLabels(updatedResult.agent.labels),
-            },
+            data: toAgentUpdateResult(updatedResult.agent, appliedChanges),
             schema: updateSchema,
         };
     }

package/dist/commands/clone.d.ts

@@ -0,0 +1,17 @@
+import type { Command } from "commander";
+import type { OutputSchema, SingleResult } from "../output/index.js";
+import type { CommandOptions } from "../output/with-output.js";
+type CloneProtocol = "https" | "ssh";
+interface CloneCommandOptions extends CommandOptions {
+    protocol?: CloneProtocol;
+}
+export interface CloneResult {
+    repo: string;
+    checkoutPath: string;
+    projectId: string;
+    projectName: string;
+}
+export declare const cloneSchema: OutputSchema<CloneResult>;
+export declare function runCloneCommand(repo: string, options: CloneCommandOptions, _command: Command): Promise<SingleResult<CloneResult>>;
+export {};
+//# sourceMappingURL=clone.d.ts.map

package/dist/commands/clone.js

@@ -0,0 +1,65 @@
+import { isCompleteGitRemote } from "@otto-code/protocol/git-remote";
+import { buildDaemonConnectionCommandError, connectToDaemon } from "../utils/client.js";
+export const cloneSchema = {
+    idField: "projectId",
+    columns: [
+        { header: "REPO", field: "repo", width: 28 },
+        { header: "PROJECT", field: "projectName", width: 28 },
+        { header: "PATH", field: "checkoutPath", width: 56 },
+    ],
+};
+function cmdError(code, message, details) {
+    return details ? { code, message, details } : { code, message };
+}
+export async function runCloneCommand(repo, options, _command) {
+    const targetDirectory = typeof options.dir === "string" ? options.dir.trim() : "";
+    if (!targetDirectory) {
+        throw cmdError("INVALID_ARGUMENT", "--dir is required");
+    }
+    const repoIsCompleteRemote = isCompleteGitRemote(repo);
+    if (!repoIsCompleteRemote && !options.protocol) {
+        throw cmdError("INVALID_ARGUMENT", "--protocol is required for owner/repo repository names");
+    }
+    let client;
+    try {
+        client = await connectToDaemon({ host: options.host });
+    }
+    catch (err) {
+        throw buildDaemonConnectionCommandError({ host: options.host, error: err });
+    }
+    if (client.getLastServerInfoMessage()?.features?.projectGithubClone !== true) {
+        await client.close().catch(() => { });
+        throw cmdError("UNSUPPORTED_BY_HOST", "This daemon does not support cloning GitHub repos.", "Update the host to a newer Otto version.");
+    }
+    try {
+        const response = await client.cloneGithubProject({
+            repo,
+            targetDirectory,
+            ...(repoIsCompleteRemote ? {} : { cloneProtocol: options.protocol }),
+        });
+        if (response.error || !response.project || !response.checkoutPath) {
+            throw cmdError("CLONE_FAILED", `Failed to clone GitHub repo: ${response.error ?? "no project returned"}`);
+        }
+        return {
+            type: "single",
+            data: {
+                repo: response.repo,
+                checkoutPath: response.checkoutPath,
+                projectId: response.project.projectId,
+                projectName: response.project.projectDisplayName,
+            },
+            schema: cloneSchema,
+        };
+    }
+    catch (err) {
+        if (err && typeof err === "object" && "code" in err) {
+            throw err;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        throw cmdError("CLONE_FAILED", `Failed to clone GitHub repo: ${message}`);
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+}
+//# sourceMappingURL=clone.js.map

package/dist/commands/daemon/local-daemon.d.ts

@@ -22,7 +22,21 @@ export interface LocalDaemonPidInfo {
 }
 export interface LocalDaemonState {
     home: string;
+    /**
+     * Where a daemon for this home *would* listen: the pid file's address when one
+     * exists, otherwise the configured default. Safe for display and for deciding
+     * where to start, but NOT for deciding what to shut down -- on a home that owns
+     * no daemon this falls back to the global default (127.0.0.1:6868), which
+     * belongs to whatever daemon happens to be running there.
+     */
     listen: string;
+    /**
+     * Where the daemon *this home actually owns* is listening, or null when this
+     * home owns no daemon. Lifecycle operations that stop a daemon must use this:
+     * a home with no pid file has nothing to stop, and must never inherit the
+     * default port and reach into another home's daemon.
+     */
+    ownedListen: string | null;
     relayEnabled: boolean;
     relayEndpoint: string;
     relayUseTls: boolean;
@@ -67,7 +81,7 @@ export interface DaemonLaunchRuntime {
 export declare const DEFAULT_STOP_TIMEOUT_MS = 15000;
 export declare const DEFAULT_KILL_TIMEOUT_MS = 3000;
 export declare function resolveLocalOttoHome(home?: string): string;
-export declare function resolveTcpHostFromListen(listen: string): string | null;
+export declare function resolveTcpHostFromListen(listen: string | null | undefined): string | null;
 export declare function resolveLocalDaemonState(options?: {
     home?: string;
 }): LocalDaemonState;

package/dist/commands/daemon/local-daemon.js

@@ -298,7 +298,7 @@ async function waitForPidExit(pid, timeoutMs) {
     return poll();
 }
 async function waitForDaemonUnreachable(state, timeoutMs) {
-    const host = resolveTcpHostFromListen(state.listen);
+    const host = resolveTcpHostFromListen(state.ownedListen);
     if (!host) {
         return true;
     }
@@ -350,7 +350,7 @@ function createNotRunningStopResult(state, pid, message) {
 }
 function createStopTimeoutError(state, pid, timeoutMs) {
     if (!state.running) {
-        const host = resolveTcpHostFromListen(state.listen);
+        const host = resolveTcpHostFromListen(state.ownedListen);
         return new Error(`Timed out waiting for daemon${host ? ` at ${host}` : ""} to stop after ${Math.ceil(timeoutMs / 1000)}s`);
     }
     return new Error(`Timed out waiting for daemon PID ${pid} to stop after ${Math.ceil(timeoutMs / 1000)}s`);
@@ -384,7 +384,7 @@ export function resolveLocalOttoHome(home) {
     return resolveOttoHome(envWithHome(home));
 }
 export function resolveTcpHostFromListen(listen) {
-    const normalized = listen.trim();
+    const normalized = listen?.trim() ?? "";
     if (!normalized) {
         return null;
     }
@@ -424,9 +424,14 @@ export function resolveLocalDaemonState(options = {}) {
     const pidInfo = existsSync(pidPath) ? readPidFile(pidPath) : null;
     const running = pidInfo ? isProcessRunning(pidInfo.pid) : false;
     const listen = pidInfo?.listen ?? config.listen;
+    // Only a home that owns a pid file owns a daemon. Older pid files predate the
+    // `listen` field, so fall back to the configured address -- but only when a pid
+    // file proves this home owns something to talk to.
+    const ownedListen = pidInfo ? (pidInfo.listen ?? config.listen) : null;
     return {
         home,
         listen,
+        ownedListen,
         relayEnabled: config.relayEnabled ?? true,
         relayEndpoint: config.relayPublicEndpoint ?? config.relayEndpoint ?? "relay.otto-code.me:443",
         relayUseTls: config.relayUseTls ?? false,
@@ -510,11 +515,13 @@ export function startLocalDaemonForeground(options, runtime = defaultDaemonLaunc
     return result.status ?? 1;
 }
 async function requestLifecycleShutdown(state, timeoutMs) {
-    const host = resolveTcpHostFromListen(state.listen);
+    const host = resolveTcpHostFromListen(state.ownedListen);
     if (!host) {
         return {
             requested: false,
-            reason: "daemon listen target is not TCP, falling back to owner PID signal",
+            reason: state.pidInfo
+                ? "daemon listen target is not TCP, falling back to owner PID signal"
+                : "this home owns no daemon, skipping lifecycle shutdown",
         };
     }
     const deadline = Date.now() + timeoutMs;

package/dist/commands/daemon/pair.js

@@ -4,6 +4,7 @@ import { generateLocalPairingOffer, loadConfig, resolveOttoHome } from "@otto-co
 import { tryConnectToDaemon } from "../../utils/client.js";
 import { resolveLocalDaemonState, resolveTcpHostFromListen } from "./local-daemon.js";
 import { addJsonOption } from "../../utils/command-options.js";
+import { formatPairingInstructions } from "../../output/pairing.js";
 const PAIRING_DAEMON_RPC_TIMEOUT_MS = 1500;
 export function pairCommand() {
     return addJsonOption(new Command("pair").description("Print the daemon pairing QR code and link"))
@@ -70,7 +71,10 @@ function outputPairingResult(pairing, options) {
         }, null, 2)}\n`);
         return;
     }
-    const qrBlock = pairing.qr ? `${pairing.qr}\n` : "";
-    process.stdout.write(`\nScan to pair:\n${qrBlock}${pairing.url}\n`);
+    process.stdout.write(formatPairingInstructions({
+        url: pairing.url,
+        qr: pairing.qr,
+        columns: process.stdout.columns,
+    }));
 }
 //# sourceMappingURL=pair.js.map

package/dist/commands/heartbeat/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function createHeartbeatCommand(): Command;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/heartbeat/index.js

@@ -0,0 +1,139 @@
+import { Command } from "commander";
+import { withOutput } from "../../output/index.js";
+import { addJsonAndDaemonHostOptions } from "../../utils/command-options.js";
+import { parseDuration } from "../../utils/duration.js";
+import { connectScheduleClient, toScheduleCommandError, toScheduleRow, } from "../schedule/shared.js";
+import { scheduleSchema } from "../schedule/schema.js";
+const heartbeatDeleteSchema = {
+    idField: "id",
+    columns: [
+        { header: "ID", field: "id" },
+        { header: "STATUS", field: "status" },
+    ],
+};
+function requireCallerAgentId() {
+    const agentId = process.env.OTTO_AGENT_ID?.trim();
+    if (!agentId) {
+        throw new Error("Heartbeat commands must run inside a Otto agent");
+    }
+    return agentId;
+}
+async function requireOwnedHeartbeat(client, id, agentId) {
+    const payload = await client.scheduleInspect({ id });
+    if (payload.error || !payload.schedule) {
+        throw new Error(payload.error ?? `Heartbeat not found: ${id}`);
+    }
+    if (payload.schedule.target.type !== "agent" || payload.schedule.target.agentId !== agentId) {
+        throw new Error(`Heartbeat ${id} does not belong to agent ${agentId}`);
+    }
+}
+async function runCreateHeartbeat(prompt, options, _command) {
+    const agentId = requireCallerAgentId();
+    const cron = options.cron?.trim();
+    if (!cron) {
+        throw new Error("--cron is required");
+    }
+    const { client } = await connectScheduleClient(options.host);
+    try {
+        const maxRuns = options.maxRuns ? Number.parseInt(options.maxRuns, 10) : undefined;
+        if (maxRuns !== undefined && (!Number.isSafeInteger(maxRuns) || maxRuns <= 0)) {
+            throw new Error("--max-runs must be a positive integer");
+        }
+        const payload = await client.scheduleCreate({
+            prompt: prompt.trim(),
+            cadence: {
+                type: "cron",
+                expression: cron,
+                ...(options.timezone?.trim() ? { timezone: options.timezone.trim() } : {}),
+            },
+            target: { type: "agent", agentId },
+            ...(options.name?.trim() ? { name: options.name.trim() } : {}),
+            ...(maxRuns ? { maxRuns } : {}),
+            ...(options.expiresIn
+                ? { expiresAt: new Date(Date.now() + parseDuration(options.expiresIn)).toISOString() }
+                : {}),
+        });
+        if (payload.error || !payload.schedule) {
+            throw new Error(payload.error ?? "Heartbeat creation failed");
+        }
+        return { type: "single", data: toScheduleRow(payload.schedule), schema: scheduleSchema };
+    }
+    catch (error) {
+        throw toScheduleCommandError("HEARTBEAT_CREATE_FAILED", "create heartbeat", error);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+async function runUpdateHeartbeat(id, options, _command) {
+    const agentId = requireCallerAgentId();
+    const cron = options.cron?.trim();
+    if (!cron) {
+        throw new Error("--cron is required");
+    }
+    const { client } = await connectScheduleClient(options.host);
+    try {
+        await requireOwnedHeartbeat(client, id, agentId);
+        const payload = await client.scheduleUpdate({
+            id,
+            cadence: {
+                type: "cron",
+                expression: cron,
+                ...(options.timezone?.trim() ? { timezone: options.timezone.trim() } : {}),
+            },
+        });
+        if (payload.error || !payload.schedule) {
+            throw new Error(payload.error ?? `Heartbeat update failed: ${id}`);
+        }
+        return { type: "single", data: toScheduleRow(payload.schedule), schema: scheduleSchema };
+    }
+    catch (error) {
+        throw toScheduleCommandError("HEARTBEAT_UPDATE_FAILED", "update heartbeat", error);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+async function runDeleteHeartbeat(id, options, _command) {
+    const agentId = requireCallerAgentId();
+    const { client } = await connectScheduleClient(options.host);
+    try {
+        await requireOwnedHeartbeat(client, id, agentId);
+        const payload = await client.scheduleDelete({ id });
+        if (payload.error) {
+            throw new Error(payload.error);
+        }
+        return {
+            type: "single",
+            data: { id: payload.scheduleId, status: "deleted" },
+            schema: heartbeatDeleteSchema,
+        };
+    }
+    catch (error) {
+        throw toScheduleCommandError("HEARTBEAT_DELETE_FAILED", "delete heartbeat", error);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+export function createHeartbeatCommand() {
+    const heartbeat = new Command("heartbeat").description("Manage this agent's heartbeats");
+    addJsonAndDaemonHostOptions(heartbeat
+        .command("create")
+        .description("Create a recurring prompt for this agent")
+        .argument("<prompt>", "Prompt to send")
+        .requiredOption("--cron <expr>", "Five-field cron cadence")
+        .option("--timezone <iana>", "IANA time zone")
+        .option("--name <name>", "Heartbeat name")
+        .option("--max-runs <n>", "Maximum number of runs")
+        .option("--expires-in <duration>", "Time to live")).action(withOutput(runCreateHeartbeat));
+    addJsonAndDaemonHostOptions(heartbeat
+        .command("update")
+        .description("Change a heartbeat cron cadence")
+        .argument("<id>", "Heartbeat ID")
+        .requiredOption("--cron <expr>", "Five-field cron cadence")
+        .option("--timezone <iana>", "IANA time zone")).action(withOutput(runUpdateHeartbeat));
+    addJsonAndDaemonHostOptions(heartbeat.command("delete").description("Delete a heartbeat").argument("<id>", "Heartbeat ID")).action(withOutput(runDeleteHeartbeat));
+    return heartbeat;
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/hub/cloud-device-authorization.d.ts

@@ -0,0 +1,45 @@
+import { z } from "zod";
+declare const authorizationSchema: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodURL;
+    verificationUriComplete: z.ZodURL;
+    expiresAt: z.ZodString;
+    interval: z.ZodNumber;
+}, z.core.$strip>;
+declare const pollSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+    interval: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"slow_down">;
+    interval: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    interval: z.ZodNumber;
+    enrollmentToken: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"denied">;
+    interval: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"expired">;
+    interval: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"enrolled">;
+    interval: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"retry_later">;
+}, z.core.$strip>], "status">;
+export type DeviceAuthorization = z.infer<typeof authorizationSchema>;
+export type DeviceAuthorizationPoll = z.infer<typeof pollSchema>;
+export interface CloudDeviceAuthorization {
+    start(hubUrl: string, displayName: string): Promise<DeviceAuthorization>;
+    poll(hubUrl: string, deviceCode: string, timeoutMilliseconds: number): Promise<DeviceAuthorizationPoll>;
+}
+export declare class CloudDeviceAuthorizationClient implements CloudDeviceAuthorization {
+    private readonly startTimeoutMilliseconds;
+    constructor(startTimeoutMilliseconds?: number);
+    start(hubUrl: string, displayName: string): Promise<DeviceAuthorization>;
+    poll(hubUrl: string, deviceCode: string, timeoutMilliseconds: number): Promise<DeviceAuthorizationPoll>;
+}
+export {};
+//# sourceMappingURL=cloud-device-authorization.d.ts.map

package/dist/commands/hub/cloud-device-authorization.js

@@ -0,0 +1,92 @@
+import { z } from "zod";
+const START_TIMEOUT_MS = 15000;
+const activationUrlSchema = z.url({ protocol: /^https?$/u });
+const authorizationSchema = z.object({
+    deviceCode: z.string().min(32),
+    userCode: z.string().min(1),
+    verificationUri: activationUrlSchema,
+    verificationUriComplete: activationUrlSchema,
+    expiresAt: z.string().datetime(),
+    interval: z.number().int().min(5),
+});
+const pollSchema = z.discriminatedUnion("status", [
+    z.object({ status: z.literal("pending"), interval: z.number().int().min(5) }),
+    z.object({ status: z.literal("slow_down"), interval: z.number().int().min(5) }),
+    z.object({
+        status: z.literal("approved"),
+        interval: z.number().int().min(5),
+        enrollmentToken: z.string().min(32),
+    }),
+    z.object({ status: z.literal("denied"), interval: z.number().int().min(5) }),
+    z.object({ status: z.literal("expired"), interval: z.number().int().min(5) }),
+    z.object({ status: z.literal("enrolled"), interval: z.number().int().min(5) }),
+    z.object({ status: z.literal("retry_later") }),
+]);
+export class CloudDeviceAuthorizationClient {
+    constructor(startTimeoutMilliseconds = START_TIMEOUT_MS) {
+        this.startTimeoutMilliseconds = startTimeoutMilliseconds;
+    }
+    async start(hubUrl, displayName) {
+        const signal = AbortSignal.timeout(this.startTimeoutMilliseconds);
+        try {
+            const response = await fetch(endpoint(hubUrl, "/api/device-authorizations/"), {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ displayName }),
+                signal,
+            });
+            if (!response.ok)
+                throw new Error(`Cloud registration failed (${response.status})`);
+            return authorizationSchema.parse(await response.json());
+        }
+        catch (error) {
+            if (signal.aborted) {
+                throw new Error("Cloud registration start timed out", { cause: error });
+            }
+            throw error;
+        }
+    }
+    async poll(hubUrl, deviceCode, timeoutMilliseconds) {
+        const signal = AbortSignal.timeout(timeoutMilliseconds);
+        let response;
+        try {
+            response = await fetch(endpoint(hubUrl, "/api/device-authorizations/poll"), {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ deviceCode }),
+                signal,
+            });
+        }
+        catch {
+            return { status: "retry_later" };
+        }
+        if ([408, 425, 429].includes(response.status) || response.status >= 500) {
+            return { status: "retry_later" };
+        }
+        if (!response.ok)
+            throw new Error(`Cloud registration poll failed (${response.status})`);
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch (error) {
+            if (signal.aborted || error instanceof TypeError)
+                return { status: "retry_later" };
+            throw error;
+        }
+        return pollSchema.parse(body);
+    }
+}
+function endpoint(hubUrl, pathname) {
+    const url = new URL(hubUrl);
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash) {
+        throw new Error("Hub URL must be an HTTP or HTTPS origin without credentials or a query");
+    }
+    url.pathname = `${url.pathname.replace(/\/$/u, "")}${pathname}`;
+    return url.toString();
+}
+//# sourceMappingURL=cloud-device-authorization.js.map

package/dist/commands/hub/device-authorization.d.ts

@@ -0,0 +1,37 @@
+import { type CloudDeviceAuthorization } from "./cloud-device-authorization.js";
+export interface AuthorizationWaiter {
+    wait(milliseconds: number): Promise<void>;
+    now(): number;
+}
+export interface BrowserOpener {
+    open(url: string): Promise<void>;
+}
+type BrowserLaunch = (command: string, args: string[]) => Promise<void>;
+interface SystemBrowserOptions {
+    hostPlatform?: NodeJS.Platform;
+    launch?: BrowserLaunch;
+}
+export declare class SystemBrowser implements BrowserOpener {
+    private readonly hostPlatform;
+    private readonly launch;
+    constructor(options?: SystemBrowserOptions);
+    open(url: string): Promise<void>;
+}
+export interface AuthorizationReporter {
+    instructions(verificationUri: string, userCode: string): void;
+}
+interface DeviceAuthorizationWorkflowOptions {
+    cloud: CloudDeviceAuthorization;
+    waiter: AuthorizationWaiter;
+    browser: BrowserOpener;
+    reporter: AuthorizationReporter;
+    openBrowser?: boolean;
+}
+export declare class DeviceAuthorizationWorkflow {
+    private readonly options;
+    constructor(options: DeviceAuthorizationWorkflowOptions);
+    authorize(hubUrl: string, displayName: string): Promise<string>;
+}
+export declare function createDeviceAuthorizationWorkflow(): DeviceAuthorizationWorkflow;
+export {};
+//# sourceMappingURL=device-authorization.d.ts.map