@paradigma-inc/flywheel 0.1.26 → 0.1.51

package/src/runtime/vendor/flywheel-cli-dist/auth/login.js

@@ -0,0 +1,387 @@
+import { readFile } from 'node:fs/promises';
+import { CliUsageError } from '../errors.js';
+import { baseUrlsEqual } from './baseurl.js';
+import { BUILTIN_PROFILES, BUILTIN_PROFILE_NAMES, } from './profiles.js';
+function extractStatusError(error) {
+    if (typeof error !== 'object' || error === null)
+        return null;
+    const candidate = error;
+    if (typeof candidate.status === 'number')
+        return candidate;
+    return null;
+}
+function extractErrorBody(statusError) {
+    const raw = statusError.body ?? statusError.errorBody;
+    if (raw && typeof raw === 'object') {
+        return raw;
+    }
+    return null;
+}
+function normalizePollInterval(raw) {
+    // Defensive: discard non-finite, zero/negative, or non-number values
+    // instead of letting them poison the sleep call. The server contract
+    // is a positive integer-seconds value; anything else is a buggy
+    // response and the CLI should keep its last good interval.
+    if (typeof raw !== 'number')
+        return null;
+    if (!Number.isFinite(raw) || raw <= 0)
+        return null;
+    return raw;
+}
+function extractPollIntervalSeconds(error) {
+    const statusError = extractStatusError(error);
+    if (!statusError)
+        return null;
+    const body = extractErrorBody(statusError);
+    if (!body)
+        return null;
+    const topLevel = normalizePollInterval(body.poll_interval_seconds);
+    if (topLevel !== null)
+        return topLevel;
+    const detail = body.detail;
+    if (detail && typeof detail === 'object') {
+        const nested = detail.poll_interval_seconds;
+        return normalizePollInterval(nested);
+    }
+    return null;
+}
+function extractDeviceFlowError(error) {
+    const statusError = extractStatusError(error);
+    if (!statusError)
+        return null;
+    const body = extractErrorBody(statusError);
+    if (!body)
+        return null;
+    // Server may wrap the OAuth-style payload under FastAPI's `detail` key or
+    // place it at the top level. Check both so the CLI reads the same error
+    // code either way.
+    const topLevel = typeof body.error === 'string' ? body.error : null;
+    if (topLevel)
+        return topLevel;
+    const detail = body.detail;
+    if (detail && typeof detail === 'object') {
+        const nested = detail.error;
+        if (typeof nested === 'string')
+            return nested;
+    }
+    return null;
+}
+function defaultOpenBrowser(url) {
+    // Dynamic import keeps the "open" side-effect out of unit tests that inject
+    // their own openBrowser hook. The native shell-out is only invoked in real
+    // CLI runs.
+    return import('open').then(async (mod) => {
+        await mod.default(url);
+    });
+}
+function defaultSleep(seconds) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, seconds * 1000);
+    });
+}
+function defaultNow() {
+    return Date.now();
+}
+/**
+ * Derive the device-flow verification origin from the CLI's resolved
+ * baseUrl. The server validator accepts an origin only — scheme + host
+ * + optional non-default port — so we strip any path component (most
+ * commonly `/api` for built-in profiles) and return `URL.origin`.
+ * Returns null for unparseable input so the caller can fall back to
+ * omitting the field (server then falls back to request-host inference).
+ */
+function deriveVerificationBaseUrl(baseUrl) {
+    try {
+        return new URL(baseUrl).origin;
+    }
+    catch {
+        return null;
+    }
+}
+// FLY-416 CFG-WIPE: helpers to read the current activeProfile pointer and
+// the existing per-profile key map from config.json without going through
+// the AuthConfig-shaped loader (which normalises/drops fields we want to
+// merge untouched).
+async function readRawConfig(configPath) {
+    try {
+        const raw = await readFile(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object') {
+            return parsed;
+        }
+    }
+    catch {
+        // missing or malformed — callers fall back to legacy path
+    }
+    return {};
+}
+async function readExistingProfileKeys(configPath) {
+    const raw = await readRawConfig(configPath);
+    const candidate = raw.profileKeys;
+    if (!candidate || typeof candidate !== 'object')
+        return {};
+    const normalized = {};
+    for (const [name, value] of Object.entries(candidate)) {
+        if (value && typeof value === 'object') {
+            const entry = value;
+            if (typeof entry.apiKey === 'string') {
+                normalized[name] = { apiKey: entry.apiKey };
+            }
+        }
+    }
+    return normalized;
+}
+function readOptionalInt(params, key) {
+    const value = params[key];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number.parseInt(trimmed, 10);
+    // A non-numeric value must fail loudly, not fall back to the server-side
+    // default: a typo like `--expiry_days abc` would otherwise silently mint
+    // a key with an unintended lifetime.
+    if (Number.isNaN(parsed) || !/^-?\d+$/.test(trimmed)) {
+        throw new CliUsageError(`invalid argument: ${key}=${value}`);
+    }
+    return parsed;
+}
+function readOptionalString(params, key) {
+    const value = params[key];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function readFlag(params, key) {
+    const value = params[key];
+    return value === true || value === 'true';
+}
+function formatDenyStdout() {
+    return [
+        '',
+        '  ✖ Authorization denied.',
+        '',
+        '    Your identity is not authorized for staging access.',
+        '    Staging is limited to Paradigma engineers and approved beta users.',
+        '',
+        '    To request access, see docs/flywheel/CLI_STAGING_ACCESS.md',
+        '    (internal) or contact the staging-access owner listed there.',
+        '',
+    ].join('\n');
+}
+function formatStartPromptInteractive(start) {
+    return [
+        '',
+        `  One-time code: ${start.user_code}`,
+        '',
+        `  Opening ${start.verification_uri} in your browser`,
+        '  (or visit the URL manually and enter the code above).',
+        '',
+        '  Waiting for authorization...',
+    ].join('\n') + '\n';
+}
+function formatStartPromptHeadless(start) {
+    return [
+        '',
+        `  One-time code: ${start.user_code}`,
+        '',
+        '  On another device, visit:',
+        `    ${start.verification_uri}`,
+        '',
+        '  and enter the code above.',
+        '',
+        `  Waiting for authorization (expires in ${Math.round(start.expires_in_seconds / 60)}m)...`,
+    ].join('\n') + '\n';
+}
+export async function runAuthLogin(args) {
+    const openBrowser = args.openBrowser ?? defaultOpenBrowser;
+    const sleep = args.sleep ?? defaultSleep;
+    const now = args.now ?? defaultNow;
+    const write = args.writeStdout ?? ((chunk) => process.stdout.write(chunk));
+    const noBrowser = readFlag(args.params, 'no-browser');
+    const name = readOptionalString(args.params, 'name');
+    const expiryDays = readOptionalInt(args.params, 'expiry_days');
+    const startBody = {};
+    if (name)
+        startBody.name = name;
+    if (expiryDays !== undefined)
+        startBody.expiry_days = expiryDays;
+    // Always send the explicit verification origin so the server does not
+    // have to infer it from the request host. Server-side inference falls
+    // through to whatever the ingress/proxy presents (most often the API
+    // origin), which in API/UI split-origin deployments does not serve
+    // `/auth/mcp/setup/device` and leaves the user with an unusable
+    // browser URL. `URL.origin` is the WHATWG canonical origin (scheme +
+    // host [+ non-default port]); the server validates this exact shape.
+    const verificationBaseUrl = deriveVerificationBaseUrl(args.baseUrl);
+    if (verificationBaseUrl) {
+        startBody.verification_base_url = verificationBaseUrl;
+    }
+    let start;
+    try {
+        start = await args.requestJson('POST', '/auth/mcp-api-keys/setup-device/start', { body: startBody });
+    }
+    catch (error) {
+        // /setup-device/start does NOT carry the staging allowlist gate — that
+        // lives on /setup-device/approve and surfaces to the CLI via
+        // `access_denied` on /poll. A 403 here is therefore a different class
+        // of failure (capacity gate is the common one). Classify by payload
+        // rather than HTTP status so capacity reaches the user as a capacity
+        // error and other 403s are not silently rebranded as staging deny.
+        const deviceFlowError = extractDeviceFlowError(error);
+        if (deviceFlowError === 'capacity_reached') {
+            throw new Error('Flywheel capacity reached. Please try `flywheel auth:login` again ' +
+                'in a few minutes.');
+        }
+        throw error;
+    }
+    if (noBrowser) {
+        write(formatStartPromptHeadless(start));
+    }
+    else {
+        write(formatStartPromptInteractive(start));
+        try {
+            await openBrowser(start.verification_uri_complete);
+        }
+        catch {
+            // Failing to launch the browser is not fatal — the user can still
+            // visit the verification_uri manually. Fall through to polling.
+        }
+    }
+    const startedAtSeconds = now() / 1000;
+    let pollIntervalSeconds = start.poll_interval_seconds;
+    // RFC 8628 §3.5: once the server emits `slow_down`, the interval MUST
+    // be increased by 5 seconds "for this and all subsequent requests".
+    // Track that floor so a later pending response with a narrower
+    // server-advertised interval cannot drop us back below the RFC-
+    // mandated backoff.
+    let slowDownFloorSeconds = 0;
+    for (;;) {
+        if ((now() / 1000) - startedAtSeconds >= start.expires_in_seconds) {
+            write('  ✖ Device code expired before authorization was received.\n');
+            write('    Run `flywheel auth:login` again to start a new flow.\n');
+            return { key_id: null, exit_code: 1 };
+        }
+        await sleep(pollIntervalSeconds);
+        let poll;
+        try {
+            poll = await args.requestJson('POST', '/auth/mcp-api-keys/setup-device/poll', { body: { user_code: start.user_code, device_code: start.device_code } });
+        }
+        catch (error) {
+            const deviceFlowError = extractDeviceFlowError(error);
+            if (deviceFlowError === 'slow_down') {
+                pollIntervalSeconds += 5;
+                slowDownFloorSeconds = pollIntervalSeconds;
+                write(`  (poll interval increased to ${pollIntervalSeconds}s per server request)\n`);
+                continue;
+            }
+            if (deviceFlowError === 'authorization_pending') {
+                // The server can ride an updated `poll_interval_seconds` along
+                // with the pending signal (dynamic throttling, runtime config
+                // change). Honour it so the CLI doesn't keep polling too
+                // aggressively (or unnecessarily slowly) against the server's
+                // wishes — while respecting the slow_down floor.
+                const updated = extractPollIntervalSeconds(error);
+                if (updated !== null) {
+                    pollIntervalSeconds = Math.max(updated, slowDownFloorSeconds);
+                }
+                continue;
+            }
+            if (deviceFlowError === 'expired_token') {
+                write('  ✖ Device code expired before authorization was received.\n');
+                write('    Run `flywheel auth:login` again to start a new flow.\n');
+                return { key_id: null, exit_code: 1 };
+            }
+            // RFC 8628 §3.5 access_denied: the authorization request was denied
+            // (e.g. a staging-allowlist rejection at /approve). The server
+            // surfaces this via /poll so the CLI can stop polling immediately
+            // instead of waiting for `expires_in` to elapse.
+            if (deviceFlowError === 'access_denied') {
+                write(formatDenyStdout());
+                return { key_id: null, exit_code: 3 };
+            }
+            if (deviceFlowError === 'capacity_reached') {
+                throw new Error('Flywheel capacity reached. Please try `flywheel auth:login` ' +
+                    'again in a few minutes.');
+            }
+            // Server returns 404 when the session row is missing — most
+            // commonly because `expires_at` has just elapsed (the SELECT
+            // filters on `expires_at > NOW()`) but the CLI's local
+            // `expires_in_seconds` timer hasn't fired yet. Treat 404 as the
+            // server-side variant of `expired_token` so the user gets the
+            // actionable "device code expired, run again" guidance and exit
+            // code 1, instead of a misleading transport error and exit 2.
+            const statusError = extractStatusError(error);
+            if (statusError?.status === 404) {
+                write('  ✖ Device code expired before authorization was received.\n');
+                write('    Run `flywheel auth:login` again to start a new flow.\n');
+                return { key_id: null, exit_code: 1 };
+            }
+            throw error;
+        }
+        if (poll.status === 'pending') {
+            // Same contract as the `authorization_pending` error variant above:
+            // if the server advertises a new interval, pick it up so this loop
+            // paces itself as the server instructed on every pending response,
+            // not just on `slow_down`. The slow_down floor still wins so the
+            // RFC-mandated backoff can't be silently undone by a lower value.
+            const updated = normalizePollInterval(poll.poll_interval_seconds);
+            if (updated !== null) {
+                pollIntervalSeconds = Math.max(updated, slowDownFloorSeconds);
+            }
+            continue;
+        }
+        if (poll.status === 'approved') {
+            // The minted key is scoped to the origin it was issued against.
+            // Routing therefore depends on `args.baseUrl`, NOT on which
+            // profile happens to be active: `auth:login --env=staging` while
+            // `activeProfile=prod` still mints a staging-scoped key and must
+            // populate `profileKeys.staging` (not the flat fields), otherwise
+            // the next `env:switch --name staging` resolves to whatever
+            // `profileKeys.staging` previously held (stale key) and the
+            // login "silently succeeds" while commands keep failing auth.
+            //
+            // Algorithm: if `args.baseUrl` is canonically equal to any
+            // built-in profile's baseUrl, write into `profileKeys[that
+            // built-in]`. Otherwise (local dev, ad-hoc origin, custom TOML
+            // profile), fall through to the legacy flat `{baseUrl, apiKey}`
+            // shape so the key records its actual origin.
+            let targetBuiltin = null;
+            for (const name of BUILTIN_PROFILE_NAMES) {
+                if (baseUrlsEqual(BUILTIN_PROFILES[name].baseUrl, args.baseUrl)) {
+                    targetBuiltin = name;
+                    break;
+                }
+            }
+            if (targetBuiltin !== null) {
+                const existing = await readExistingProfileKeys(args.configPath);
+                const updated = {
+                    ...existing,
+                    [targetBuiltin]: { apiKey: poll.key },
+                };
+                // Built-in baseUrls are runtime constants (never serialised
+                // into config.json) and the flat `apiKey` has no meaning under
+                // an active built-in profile. Writing a delta with only
+                // `profileKeys` preserves that invariant without passing
+                // `undefined` through a type cast that would break injected
+                // `saveConfig` implementations relying on the declared
+                // `AuthConfig` field types.
+                await args.saveConfig(args.configPath, {
+                    profileKeys: updated,
+                });
+            }
+            else {
+                await args.saveConfig(args.configPath, {
+                    baseUrl: args.baseUrl,
+                    apiKey: poll.key,
+                });
+            }
+            write('  ✓ Authorization received.\n');
+            write(`  ✓ API key saved to ${args.configPath}\n`);
+            return { key_id: poll.key_id, exit_code: 0 };
+        }
+    }
+}
+//# sourceMappingURL=login.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AA6CvB,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAsB,CAAC;IACzC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,WAA0B;IAE1B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC;IACtD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,GAA8B,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,2DAA2D;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAI,MAA8C,CAAC,qBAAqB,CAAC;QACrF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,0EAA0E;IAC1E,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAI,MAA8B,CAAC,KAAK,CAAC;QACrD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY;IACZ,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,OAAe;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,oBAAoB;AACpB,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,UAAU,GAA+C,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;QACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAA6B,CAAC;YAC5C,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAwBD,SAAS,eAAe,CACtB,MAAwC,EACxC,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,yEAAyE;IACzE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,aAAa,CAAC,qBAAqB,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAwC,EACxC,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CACf,MAAwC,EACxC,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,EAAE;QACF,2BAA2B;QAC3B,EAAE;QACF,yDAAyD;QACzD,wEAAwE;QACxE,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CAAC,KAA+B;IACnE,OAAO;QACL,EAAE;QACF,oBAAoB,KAAK,CAAC,SAAS,EAAE;QACrC,EAAE;QACF,aAAa,KAAK,CAAC,gBAAgB,kBAAkB;QACrD,yDAAyD;QACzD,EAAE;QACF,gCAAgC;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA+B;IAChE,OAAO;QACL,EAAE;QACF,oBAAoB,KAAK,CAAC,SAAS,EAAE;QACrC,EAAE;QACF,6BAA6B;QAC7B,OAAO,KAAK,CAAC,gBAAgB,EAAE;QAC/B,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,2CAA2C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,OAAO;KAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE/D,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,IAAI;QAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;IAChC,IAAI,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,UAAU,CAAC;IACjE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,gEAAgE;IAChE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,mBAAmB,EAAE,CAAC;QACxB,SAAS,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;IACxD,CAAC;IAED,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAC5B,MAAM,EACN,uCAAuC,EACvC,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,6DAA6D;QAC7D,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,oEAAoE;gBAClE,mBAAmB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACtD,sEAAsE;IACtE,oEAAoE;IACpE,+DAA+D;IAC/D,gEAAgE;IAChE,oBAAoB;IACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,SAAS,CAAC;QACR,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAClE,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACtE,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAEjC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAC3B,MAAM,EACN,sCAAsC,EACtC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;gBACpC,mBAAmB,IAAI,CAAC,CAAC;gBACzB,oBAAoB,GAAG,mBAAmB,CAAC;gBAC3C,KAAK,CAAC,iCAAiC,mBAAmB,yBAAyB,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,IAAI,eAAe,KAAK,uBAAuB,EAAE,CAAC;gBAChD,+DAA+D;gBAC/D,8DAA8D;gBAC9D,yDAAyD;gBACzD,8DAA8D;gBAC9D,iDAAiD;gBACjD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;gBAChE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBACxC,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBACtE,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YACxC,CAAC;YACD,oEAAoE;YACpE,+DAA+D;YAC/D,kEAAkE;YAClE,iDAAiD;YACjD,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBACxC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YACxC,CAAC;YACD,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,8DAA8D;oBAC5D,yBAAyB,CAC5B,CAAC;YACJ,CAAC;YACD,4DAA4D;YAC5D,6DAA6D;YAC7D,uDAAuD;YACvD,gEAAgE;YAChE,8DAA8D;YAC9D,gEAAgE;YAChE,8DAA8D;YAC9D,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,WAAW,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChC,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBACtE,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAClE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAChE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,gEAAgE;YAChE,4DAA4D;YAC5D,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,4DAA4D;YAC5D,4DAA4D;YAC5D,8DAA8D;YAC9D,EAAE;YACF,2DAA2D;YAC3D,2DAA2D;YAC3D,+DAA+D;YAC/D,gEAAgE;YAChE,8CAA8C;YAC9C,IAAI,aAAa,GAA8B,IAAI,CAAC;YACpD,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;gBACzC,IAAI,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChE,aAAa,GAAG,IAAI,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,OAAO,GAA+C;oBAC1D,GAAG,QAAQ;oBACX,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtC,CAAC;gBACF,4DAA4D;gBAC5D,+DAA+D;gBAC/D,wDAAwD;gBACxD,yDAAyD;gBACzD,4DAA4D;gBAC5D,uDAAuD;gBACvD,4BAA4B;gBAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;oBACrC,WAAW,EAAE,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,GAAG;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACvC,KAAK,CAAC,wBAAwB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/profile.d.ts

@@ -0,0 +1,15 @@
+import type { OutputFormat } from '../grammar/parse.js';
+export interface Profile {
+    name: string;
+    baseUrl: string;
+    apiKeyEnv?: string;
+    apiKeyKeychain?: boolean;
+    defaultFormat?: OutputFormat;
+    defaultTimeoutS?: number;
+}
+export declare function resolveProfilesDir(): string;
+export declare function parseProfileToml(input: string): Record<string, string | number | boolean>;
+export declare function loadProfile(name: string, dir?: string): Promise<Profile | null>;
+export declare function listProfiles(dir?: string): Promise<string[]>;
+export declare function saveProfile(profile: Profile, dir?: string): Promise<void>;
+export declare function deleteProfile(name: string, dir?: string): Promise<boolean>;

package/src/runtime/vendor/flywheel-cli-dist/auth/profile.js

@@ -0,0 +1,150 @@
+import { readdir, readFile, unlink, writeFile, mkdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { CliUsageError } from '../errors.js';
+export function resolveProfilesDir() {
+    const fromEnv = process.env.FLYWHEEL_CLI_PROFILES_DIR?.trim();
+    if (fromEnv) {
+        return fromEnv;
+    }
+    return path.join(os.homedir(), '.config', 'flywheel-cli', 'profiles');
+}
+function assertProfileNameSafe(name, dir) {
+    // Profile names arrive directly from user input (--name on profile:set /
+    // profile:unset / --env global). A plain Error would be classified as a
+    // runtime/transport failure in main.ts's catch ladder (exit 2). Use
+    // CliUsageError so invalid names like `../bad` exit 1 (usage) and stay
+    // distinguishable from connectivity/runtime failures in script exit codes.
+    if (!name || path.basename(name) !== name) {
+        throw new CliUsageError(`invalid profile name: ${name}`);
+    }
+    const resolvedDir = path.resolve(dir);
+    const resolvedFile = path.resolve(resolvedDir, `${name}.toml`);
+    if (resolvedFile !== path.join(resolvedDir, `${name}.toml`) ||
+        !resolvedFile.startsWith(resolvedDir + path.sep)) {
+        throw new CliUsageError(`invalid profile name: ${name}`);
+    }
+}
+function profilePath(dir, name) {
+    assertProfileNameSafe(name, dir);
+    return path.join(dir, `${name}.toml`);
+}
+// Minimal TOML parser for our narrow schema: top-level `key = value` lines.
+// Supports strings (quoted), integers, and booleans. No nested tables.
+export function parseProfileToml(input) {
+    const out = {};
+    const lines = input.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const eq = trimmed.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        const rawValue = trimmed.slice(eq + 1).trim().replace(/\s+#.*$/, '');
+        if (!key)
+            continue;
+        if (rawValue.startsWith('"') && rawValue.endsWith('"')) {
+            out[key] = rawValue.slice(1, -1);
+        }
+        else if (rawValue === 'true' || rawValue === 'false') {
+            out[key] = rawValue === 'true';
+        }
+        else if (/^-?\d+$/.test(rawValue)) {
+            out[key] = Number.parseInt(rawValue, 10);
+        }
+        else {
+            out[key] = rawValue;
+        }
+    }
+    return out;
+}
+function serializeProfileToml(profile) {
+    const lines = [];
+    lines.push(`base_url = ${JSON.stringify(profile.baseUrl)}`);
+    if (profile.apiKeyEnv) {
+        lines.push(`api_key_env = ${JSON.stringify(profile.apiKeyEnv)}`);
+    }
+    if (profile.apiKeyKeychain) {
+        lines.push(`api_key_keychain = true`);
+    }
+    if (profile.defaultFormat) {
+        lines.push(`default_format = ${JSON.stringify(profile.defaultFormat)}`);
+    }
+    if (typeof profile.defaultTimeoutS === 'number') {
+        lines.push(`default_timeout_s = ${profile.defaultTimeoutS}`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+export async function loadProfile(name, dir = resolveProfilesDir()) {
+    assertProfileNameSafe(name, dir);
+    try {
+        const raw = await readFile(profilePath(dir, name), 'utf8');
+        const parsed = parseProfileToml(raw);
+        const baseUrl = typeof parsed.base_url === 'string' ? parsed.base_url : null;
+        if (!baseUrl) {
+            return null;
+        }
+        const profile = {
+            name,
+            baseUrl,
+        };
+        if (typeof parsed.api_key_env === 'string') {
+            profile.apiKeyEnv = parsed.api_key_env;
+        }
+        if (parsed.api_key_keychain === true) {
+            profile.apiKeyKeychain = true;
+        }
+        if (parsed.default_format === 'json' ||
+            parsed.default_format === 'tsv' ||
+            parsed.default_format === 'csv' ||
+            parsed.default_format === 'table') {
+            profile.defaultFormat = parsed.default_format;
+        }
+        if (typeof parsed.default_timeout_s === 'number' &&
+            Number.isFinite(parsed.default_timeout_s) &&
+            parsed.default_timeout_s >= 1 &&
+            parsed.default_timeout_s <= 86_400) {
+            // Clamp to the same bounds profile:set enforces; silently ignore
+            // out-of-range values from hand-edited TOML rather than let a
+            // zero/negative timeout brick every command.
+            profile.defaultTimeoutS = parsed.default_timeout_s;
+        }
+        return profile;
+    }
+    catch {
+        return null;
+    }
+}
+export async function listProfiles(dir = resolveProfilesDir()) {
+    try {
+        const entries = await readdir(dir);
+        return entries
+            .filter((entry) => entry.endsWith('.toml'))
+            .map((entry) => entry.replace(/\.toml$/, ''))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+export async function saveProfile(profile, dir = resolveProfilesDir()) {
+    await mkdir(dir, { recursive: true });
+    await writeFile(profilePath(dir, profile.name), serializeProfileToml(profile), {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+}
+export async function deleteProfile(name, dir = resolveProfilesDir()) {
+    assertProfileNameSafe(name, dir);
+    try {
+        await unlink(profilePath(dir, name));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=profile.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/auth/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAY7C,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,GAAW;IACtD,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,aAAa,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC/D,IACE,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,OAAO,CAAC;QACvD,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC5C,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC;QACjC,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,MAAc,kBAAkB,EAAE;IAElC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAY;YACvB,IAAI;YACJ,OAAO;SACR,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IACE,MAAM,CAAC,cAAc,KAAK,MAAM;YAChC,MAAM,CAAC,cAAc,KAAK,KAAK;YAC/B,MAAM,CAAC,cAAc,KAAK,KAAK;YAC/B,MAAM,CAAC,cAAc,KAAK,OAAO,EACjC,CAAC;YACD,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;QAChD,CAAC;QACD,IACE,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzC,MAAM,CAAC,iBAAiB,IAAI,CAAC;YAC7B,MAAM,CAAC,iBAAiB,IAAI,MAAM,EAClC,CAAC;YACD,iEAAiE;YACjE,8DAA8D;YAC9D,6CAA6C;YAC7C,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,kBAAkB,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aAC5C,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,MAAc,kBAAkB,EAAE;IAElC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE;QAC7E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,MAAc,kBAAkB,EAAE;IAElC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/profiles.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Built-in CLI profiles. Values here are the runtime source of truth for
+ * prod/staging baseUrls — per the CLI's auth contract they are NEVER
+ * written into the user's config.json. That way upstream URL changes flow
+ * through to every installed CLI without a config migration.
+ *
+ * NOTE on the `/api` suffix: the CLI targets the JSON API root, which
+ * lives under `/api` on both prod and staging (see `help.ts` and the
+ * `README` — "FLYWHEEL_BASE_URL must be the full API base, including
+ * /api"). The browser-facing device-flow page (`/auth/mcp/setup/device`)
+ * is rendered by the server off the origin root and does not require the
+ * suffix, but every request the CLI's HTTP client makes is concatenated
+ * onto `baseUrl`, so origin-root URLs would land on the web app instead
+ * of the API.
+ */
+export interface BuiltinProfile {
+    baseUrl: string;
+}
+export declare const BUILTIN_PROFILES: {
+    readonly prod: BuiltinProfile;
+    readonly staging: BuiltinProfile;
+};
+export type BuiltinProfileName = keyof typeof BUILTIN_PROFILES;
+export declare const BUILTIN_PROFILE_NAMES: readonly BuiltinProfileName[];
+export declare function isBuiltinProfileName(name: string): name is BuiltinProfileName;
+export declare function resolveBuiltinBaseUrl(name: string): string | undefined;

package/src/runtime/vendor/flywheel-cli-dist/auth/profiles.js

@@ -0,0 +1,27 @@
+/**
+ * Built-in CLI profiles. Values here are the runtime source of truth for
+ * prod/staging baseUrls — per the CLI's auth contract they are NEVER
+ * written into the user's config.json. That way upstream URL changes flow
+ * through to every installed CLI without a config migration.
+ *
+ * NOTE on the `/api` suffix: the CLI targets the JSON API root, which
+ * lives under `/api` on both prod and staging (see `help.ts` and the
+ * `README` — "FLYWHEEL_BASE_URL must be the full API base, including
+ * /api"). The browser-facing device-flow page (`/auth/mcp/setup/device`)
+ * is rendered by the server off the origin root and does not require the
+ * suffix, but every request the CLI's HTTP client makes is concatenated
+ * onto `baseUrl`, so origin-root URLs would land on the web app instead
+ * of the API.
+ */
+export const BUILTIN_PROFILES = {
+    prod: { baseUrl: 'https://flywheel.paradigma.inc/api' },
+    staging: { baseUrl: 'https://flywheel-staging.paradigma.inc/api' },
+};
+export const BUILTIN_PROFILE_NAMES = Object.freeze(Object.keys(BUILTIN_PROFILES));
+export function isBuiltinProfileName(name) {
+    return Object.prototype.hasOwnProperty.call(BUILTIN_PROFILES, name);
+}
+export function resolveBuiltinBaseUrl(name) {
+    return isBuiltinProfileName(name) ? BUILTIN_PROFILES[name].baseUrl : undefined;
+}
+//# sourceMappingURL=profiles.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/auth/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,MAAM,CAAC,MAAM,gBAAgB,GAGzB;IACF,IAAI,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACvD,OAAO,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE;CACnE,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAkC,MAAM,CAAC,MAAM,CAC/E,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAyB,CACtD,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC"}