@paradigma-inc/flywheel 0.1.35 → 0.1.52

package/src/mcp-writer.mjs

@@ -69,7 +69,7 @@ function stripTomlInlineComment(valueText) {
   return valueText.trim();
 }
 
-function parseTomlStringValue(valueText) {
+export function parseTomlStringValue(valueText) {
   const stripped = stripTomlInlineComment(valueText);
   if (!stripped) {
     return null;
@@ -98,7 +98,7 @@ function parseTomlStringValue(valueText) {
   return stripped;
 }
 
-function parseTomlSectionName(lineText) {
+export function parseTomlSectionName(lineText) {
   const withoutComment = stripTomlInlineComment(String(lineText || "").trim());
   const sectionMatch = withoutComment.match(/^\[(.+)\]$/);
   return sectionMatch ? sectionMatch[1] : null;

package/src/runtime/delegate.mjs

@@ -0,0 +1,21 @@
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// import.meta.dirname is only available on Node v20.11.0+. fileURLToPath +
+// path.dirname is portable across the full Node 20 range the package
+// declares (engines.node >= 20).
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const RUNTIME_ENTRY_PATH = path.join(
+  __dirname,
+  "vendor",
+  "flywheel-cli-dist",
+  "runtime-entry.js",
+);
+
+export async function runRuntimeCli(argv) {
+  const runtimeModule = await import(pathToFileURL(RUNTIME_ENTRY_PATH).href);
+  if (typeof runtimeModule.runCli !== "function") {
+    throw new Error("Runtime CLI entrypoint does not export runCli.");
+  }
+  return await runtimeModule.runCli(argv, {});
+}

package/src/runtime/required-runtime-commands.json

@@ -0,0 +1,117 @@
+[
+  "auth:status",
+  "auth:login",
+  "nodes:list",
+  "nodes:get",
+  "nodes:commit-new",
+  "nodes:stage:lease:acquire",
+  "nodes:commit",
+  "nodes:delete",
+  "nodes:render:tree",
+  "artifacts:list",
+  "artifacts:get",
+  "compute:status",
+  "export:subgraph",
+  "profile:list",
+  "profile:show",
+  "profile:set",
+  "profile:unset",
+  "tags:create",
+  "tags:update",
+  "tags:delete",
+  "tags:assign",
+  "nodes:sharing:get",
+  "nodes:sharing:set",
+  "nodes:sharing:set-bulk",
+  "nodes:sharing:summaries",
+  "nodes:resolve-slug",
+  "nodes:audit:list",
+  "nodes:render:ancestry",
+  "nodes:render:summary",
+  "nodes:add-parent",
+  "nodes:remove-parent",
+  "nodes:branch",
+  "nodes:merge",
+  "nodes:delete-bulk",
+  "nodes:files",
+  "nodes:stage:lease:heartbeat",
+  "nodes:stage:lease:release",
+  "campaign:snapshot",
+  "nodes:create",
+  "nodes:stage:backfill:hypothesis",
+  "nodes:stage:backfill:insights",
+  "artifacts:upload:prepare",
+  "artifacts:upload:finalize",
+  "artifacts:upload",
+  "artifacts:delete",
+  "artifacts:note:set",
+  "compute:options",
+  "compute:funding",
+  "compute:connection",
+  "compute:acquire",
+  "compute:release",
+  "compute:release-all",
+  "executions:launch",
+  "executions:list",
+  "executions:terminate",
+  "approval-sessions:heartbeat",
+  "approval-sessions:list",
+  "approval-sessions:expire",
+  "compute-grants:list",
+  "compute-grants:request-approval",
+  "campaign-budgets:list",
+  "campaign-budgets:create",
+  "campaign-budgets:update",
+  "campaign-budgets:revoke",
+  "import:subgraph",
+  "export:summary",
+  "export:summary:stream",
+  "export:summary:pdf",
+  "export:summary:render-pdf",
+  "updates:list",
+  "updates:hide",
+  "updates:hide-all-active",
+  "updates:unhide",
+  "graph:get",
+  "account:get",
+  "account:merge:proof",
+  "account:merge:preview",
+  "account:merge",
+  "account:detach",
+  "account:emails:add",
+  "account:emails:remove",
+  "account:emails:set-primary",
+  "credits:balance",
+  "credits:transactions",
+  "credits:usage",
+  "credits:purchase",
+  "credits:subscribe",
+  "credits:billing-portal",
+  "credits:subscription",
+  "credits:referral",
+  "credits:referral:claim",
+  "github:status",
+  "github:link",
+  "github:refresh-repos",
+  "github:disconnect",
+  "integrations:status",
+  "integrations:wandb:set",
+  "integrations:wandb:remove",
+  "integrations:huggingface:set",
+  "integrations:huggingface:remove",
+  "api-keys:list",
+  "api-keys:create",
+  "api-keys:delete",
+  "api-keys:rotate",
+  "blobs:get",
+  "files:list",
+  "export:history",
+  "compute:policy:get",
+  "compute:policy:set",
+  "compute:budgets",
+  "machines:list",
+  "auth:keychain:set",
+  "auth:keychain:clear",
+  "env:list",
+  "env:switch"
+]

package/src/runtime/runtime-config.mjs

@@ -0,0 +1,84 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+const RUNTIME_BASE_URL_SUFFIX = "/api";
+
+export function resolveRuntimeConfigPath({
+  env = process.env,
+  homeDir = os.homedir(),
+} = {}) {
+  const override = env.FLYWHEEL_CLI_CONFIG_PATH?.trim();
+  if (override) {
+    return override;
+  }
+  return path.join(homeDir, ".config", "flywheel-cli", "config.json");
+}
+
+export function normalizeRuntimeBaseUrl(origin) {
+  const trimmed = String(origin || "").trim();
+  if (!trimmed) {
+    throw new Error("Runtime base URL origin cannot be empty.");
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(
+      `Runtime base URL must be a valid absolute URL: ${trimmed}`,
+    );
+  }
+
+  const cleanPath = parsed.pathname.replace(/\/+$/, "");
+  if (cleanPath === "" || cleanPath === RUNTIME_BASE_URL_SUFFIX) {
+    return `${parsed.origin}${RUNTIME_BASE_URL_SUFFIX}`;
+  }
+  return `${parsed.origin}${cleanPath}${RUNTIME_BASE_URL_SUFFIX}`;
+}
+
+/**
+ * Read the existing runtime-config JSON, returning an empty object if
+ * the file is missing or malformed. `setup --mode cli` is the recovery
+ * path — throwing on a corrupted file would be a worse user experience
+ * than overwriting it with a fresh valid write.
+ */
+async function readExistingRuntimeConfig(configPath) {
+  try {
+    const raw = await readFile(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? parsed
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Merge-write the runtime config.
+ *
+ * The writer owns only `baseUrl` and `apiKey` — every other top-level
+ * key (`activeProfile`, `profileKeys`, user-authored notes) is merged
+ * from the existing file so re-running `flywheel setup --mode cli`
+ * after a user has configured profile-based auth does not silently
+ * clobber that state. Mirrors the merge-write semantics of the CLI's
+ * own `saveAuthConfig`.
+ */
+export async function writeRuntimeConfig({
+  origin,
+  apiKey,
+  configPath = resolveRuntimeConfigPath(),
+}) {
+  const trimmedKey = String(apiKey || "").trim();
+  if (trimmedKey.length === 0) {
+    throw new Error("Runtime config requires a non-empty API key.");
+  }
+
+  const baseUrl = normalizeRuntimeBaseUrl(origin);
+  await mkdir(path.dirname(configPath), { recursive: true });
+  const existing = await readExistingRuntimeConfig(configPath);
+  const merged = { ...existing, baseUrl, apiKey: trimmedKey };
+  await writeFile(configPath, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
+  return { configPath, baseUrl };
+}

package/src/runtime/vendor/.gitkeep

@@ -0,0 +1 @@
+

package/src/runtime/vendor/flywheel-cli-dist/auth/active-key-id.d.ts

@@ -0,0 +1 @@
+export declare function activeKeyIdFromToken(token: string | undefined): string | null;

package/src/runtime/vendor/flywheel-cli-dist/auth/active-key-id.js

@@ -0,0 +1,22 @@
+// Parse the active MCP API key's key_id from the bearer token held by the
+// CLI. Server token format is `fwk_<uuid_hex_no_dashes>.<secret>` (see
+// project/flywheel-server/server/mcp_api_keys.py::_parse_api_key_token).
+// Returning the canonical UUID string (with dashes) matches the `key_id`
+// field on listing and rotate/delete responses, so the CLI can compare
+// directly without an extra server round-trip.
+const API_KEY_PREFIX = 'fwk_';
+export function activeKeyIdFromToken(token) {
+    if (!token || !token.startsWith(API_KEY_PREFIX))
+        return null;
+    const body = token.slice(API_KEY_PREFIX.length);
+    const dot = body.indexOf('.');
+    if (dot <= 0)
+        return null;
+    const hex = body.slice(0, dot);
+    if (!/^[0-9a-fA-F]{32}$/.test(hex))
+        return null;
+    // Canonical UUID layout: 8-4-4-4-12.
+    return (`${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-` +
+        `${hex.slice(16, 20)}-${hex.slice(20, 32)}`).toLowerCase();
+}
+//# sourceMappingURL=active-key-id.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/active-key-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-key-id.js","sourceRoot":"","sources":["../../src/auth/active-key-id.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,+CAA+C;AAE/C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,qCAAqC;IACrC,OAAO,CACL,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG;QAC9D,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAC5C,CAAC,WAAW,EAAE,CAAC;AAClB,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/baseurl.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Canonical equality for CLI baseUrls.
+ *
+ * Several CLI paths compare a "resolved" baseUrl (env override, profile
+ * pointer, etc.) against a "stored" baseUrl (built-in profile constant,
+ * `config.baseUrl`) to decide credential routing — both at write time
+ * (`auth:login` choosing the per-profile bucket vs. the legacy flat
+ * fields) and at read time (the runtime resolver deciding which stored
+ * key, if any, applies to the resolved origin).
+ *
+ * Raw `===` makes those checks fragile under semantically equivalent URL
+ * variants — most commonly a trailing slash, but also default-port and
+ * scheme/host casing — and the failure mode is silent: tokens land in
+ * the wrong slot or are dropped at runtime, and requests go out
+ * unauthenticated against the same server. The HTTP client at
+ * `src/http/client.ts` already strips trailing slashes from `baseUrl`
+ * before issuing requests, so two variants that the routing layer
+ * treated as different origins would still hit the same server — making
+ * the mismatch impossible for the user to diagnose.
+ *
+ * The normalisation rules below match RFC 3986 §6.2.2 (Syntax-Based
+ * Normalisation): scheme + host are case-insensitive, default ports are
+ * dropped, and a trailing-slash-only path is treated as equivalent to
+ * the bare origin. Path beyond the bare root remains case-sensitive
+ * (RFC 3986 §6.2.2.3); we only strip trailing slashes there. Query and
+ * fragment are not part of a CLI baseUrl in this codebase, so we do not
+ * preserve them.
+ */
+export declare function canonicalizeBaseUrl(raw: string | null | undefined): string | null;
+/**
+ * Returns true iff both inputs canonicalise to the same baseUrl. Returns
+ * false for any input the canonicaliser rejects (null/undefined/garbage),
+ * because an unparseable URL has no provable identity to compare against.
+ */
+export declare function baseUrlsEqual(a: string | null | undefined, b: string | null | undefined): boolean;

package/src/runtime/vendor/flywheel-cli-dist/auth/baseurl.js

@@ -0,0 +1,64 @@
+/**
+ * Canonical equality for CLI baseUrls.
+ *
+ * Several CLI paths compare a "resolved" baseUrl (env override, profile
+ * pointer, etc.) against a "stored" baseUrl (built-in profile constant,
+ * `config.baseUrl`) to decide credential routing — both at write time
+ * (`auth:login` choosing the per-profile bucket vs. the legacy flat
+ * fields) and at read time (the runtime resolver deciding which stored
+ * key, if any, applies to the resolved origin).
+ *
+ * Raw `===` makes those checks fragile under semantically equivalent URL
+ * variants — most commonly a trailing slash, but also default-port and
+ * scheme/host casing — and the failure mode is silent: tokens land in
+ * the wrong slot or are dropped at runtime, and requests go out
+ * unauthenticated against the same server. The HTTP client at
+ * `src/http/client.ts` already strips trailing slashes from `baseUrl`
+ * before issuing requests, so two variants that the routing layer
+ * treated as different origins would still hit the same server — making
+ * the mismatch impossible for the user to diagnose.
+ *
+ * The normalisation rules below match RFC 3986 §6.2.2 (Syntax-Based
+ * Normalisation): scheme + host are case-insensitive, default ports are
+ * dropped, and a trailing-slash-only path is treated as equivalent to
+ * the bare origin. Path beyond the bare root remains case-sensitive
+ * (RFC 3986 §6.2.2.3); we only strip trailing slashes there. Query and
+ * fragment are not part of a CLI baseUrl in this codebase, so we do not
+ * preserve them.
+ */
+export function canonicalizeBaseUrl(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    // `URL.host` already normalises host case and drops default ports for
+    // well-known schemes (https:443, http:80, etc.) per WHATWG URL.
+    const host = parsed.host;
+    const protocol = parsed.protocol; // e.g. "https:"
+    // Strip trailing slashes so `/api` and `/api/` collapse to the same key.
+    const path = parsed.pathname.replace(/\/+$/, '');
+    return `${protocol}//${host}${path}`;
+}
+/**
+ * Returns true iff both inputs canonicalise to the same baseUrl. Returns
+ * false for any input the canonicaliser rejects (null/undefined/garbage),
+ * because an unparseable URL has no provable identity to compare against.
+ */
+export function baseUrlsEqual(a, b) {
+    const ca = canonicalizeBaseUrl(a);
+    if (ca === null)
+        return false;
+    const cb = canonicalizeBaseUrl(b);
+    if (cb === null)
+        return false;
+    return ca === cb;
+}
+//# sourceMappingURL=baseurl.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/baseurl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseurl.js","sourceRoot":"","sources":["../../src/auth/baseurl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA8B;IAE9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,gBAAgB;IAClD,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,QAAQ,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,CAA4B,EAC5B,CAA4B;IAE5B,MAAM,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/config.d.ts

@@ -0,0 +1,34 @@
+export interface ProfileKeyRecord {
+    apiKey?: string | null;
+}
+export interface AuthConfig {
+    baseUrl: string;
+    apiKey: string | null;
+    activeProfile?: string | null;
+    profileKeys?: Record<string, ProfileKeyRecord>;
+}
+/**
+ * Delta shape accepted by `saveAuthConfig`. Every field is optional —
+ * only the provided keys are merged into the on-disk config, so callers
+ * writing per-profile state (e.g. `auth:login` under an active built-in
+ * profile) can omit `baseUrl` / `apiKey` instead of passing `undefined`
+ * through an `as unknown as string` cast that lies about the contract
+ * to injected `saveConfig` implementations.
+ */
+export type AuthConfigDelta = Partial<AuthConfig>;
+export declare const DEFAULT_BASE_URL = "http://localhost:8000";
+export declare function resolveConfigPath(): string;
+export declare function loadAuthConfig(filePath?: string): Promise<AuthConfig>;
+/**
+ * Merge-write the on-disk config.
+ *
+ * FLY-416: previously `saveAuthConfig` serialised the `{ baseUrl, apiKey }`
+ * AuthConfig shape verbatim, which wiped `activeProfile`, `profileKeys`, and
+ * every other top-level key the user might have added. That made
+ * `env:switch staging; auth:login` ephemeral: the login erased the pointer.
+ *
+ * The new behaviour reads the existing file, merges the provided delta onto
+ * the parsed object (per-key overwrite for AuthConfig-owned fields), and
+ * writes the merged result. Unknown keys are preserved untouched.
+ */
+export declare function saveAuthConfig(filePath: string, delta: AuthConfigDelta): Promise<void>;

package/src/runtime/vendor/flywheel-cli-dist/auth/config.js

@@ -0,0 +1,92 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+export const DEFAULT_BASE_URL = 'http://localhost:8000';
+export function resolveConfigPath() {
+    const fromEnv = process.env.FLYWHEEL_CLI_CONFIG_PATH?.trim();
+    if (fromEnv) {
+        return fromEnv;
+    }
+    return path.join(os.homedir(), '.config', 'flywheel-cli', 'config.json');
+}
+export async function loadAuthConfig(filePath = resolveConfigPath()) {
+    try {
+        const contents = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(contents);
+        const config = {
+            baseUrl: typeof parsed.baseUrl === 'string' && parsed.baseUrl.trim()
+                ? parsed.baseUrl
+                : DEFAULT_BASE_URL,
+            apiKey: typeof parsed.apiKey === 'string' && parsed.apiKey.trim() ? parsed.apiKey : null,
+        };
+        if (typeof parsed.activeProfile === 'string' && parsed.activeProfile.trim()) {
+            config.activeProfile = parsed.activeProfile.trim();
+        }
+        if (parsed.profileKeys && typeof parsed.profileKeys === 'object') {
+            const raw = parsed.profileKeys;
+            const normalized = {};
+            for (const [name, value] of Object.entries(raw)) {
+                if (value && typeof value === 'object') {
+                    const entry = value;
+                    if (typeof entry.apiKey === 'string' && entry.apiKey.trim()) {
+                        normalized[name] = { apiKey: entry.apiKey };
+                    }
+                }
+            }
+            if (Object.keys(normalized).length > 0) {
+                config.profileKeys = normalized;
+            }
+        }
+        return config;
+    }
+    catch {
+        return {
+            baseUrl: DEFAULT_BASE_URL,
+            apiKey: null,
+        };
+    }
+}
+async function readRawConfigObject(filePath) {
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Merge-write the on-disk config.
+ *
+ * FLY-416: previously `saveAuthConfig` serialised the `{ baseUrl, apiKey }`
+ * AuthConfig shape verbatim, which wiped `activeProfile`, `profileKeys`, and
+ * every other top-level key the user might have added. That made
+ * `env:switch staging; auth:login` ephemeral: the login erased the pointer.
+ *
+ * The new behaviour reads the existing file, merges the provided delta onto
+ * the parsed object (per-key overwrite for AuthConfig-owned fields), and
+ * writes the merged result. Unknown keys are preserved untouched.
+ */
+export async function saveAuthConfig(filePath, delta) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const existing = await readRawConfigObject(filePath);
+    const merged = { ...existing };
+    // AuthConfig-owned fields overwrite whatever was there, but undefined
+    // fields leave the existing value alone so per-profile callers can pass
+    // the shape they want to mutate without specifying defaults.
+    if (delta.baseUrl !== undefined) {
+        merged.baseUrl = delta.baseUrl;
+    }
+    if (delta.apiKey !== undefined) {
+        merged.apiKey = delta.apiKey;
+    }
+    if (delta.activeProfile !== undefined) {
+        merged.activeProfile = delta.activeProfile;
+    }
+    if (delta.profileKeys !== undefined) {
+        merged.profileKeys = delta.profileKeys;
+    }
+    await writeFile(filePath, `${JSON.stringify(merged, null, 2)}\n`, 'utf8');
+}
+//# sourceMappingURL=config.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA4B7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAQ,GAAG,iBAAiB,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkD,CAAC;QACrF,MAAM,MAAM,GAAe;YACzB,OAAO,EACL,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;gBACzD,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,gBAAgB;YACtB,MAAM,EACJ,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACnF,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5E,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAsC,CAAC;YAC1D,MAAM,UAAU,GAAqC,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvC,MAAM,KAAK,GAAG,KAA6B,CAAC;oBAC5C,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBAC5D,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,KAAsB;IAEtB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IAExD,sEAAsE;IACtE,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/fingerprint.d.ts

@@ -0,0 +1,5 @@
+export interface Fingerprint {
+    short: string;
+    full: string;
+}
+export declare function fingerprint(token: string): Fingerprint;

package/src/runtime/vendor/flywheel-cli-dist/auth/fingerprint.js

@@ -0,0 +1,12 @@
+import { createHash } from 'node:crypto';
+export function fingerprint(token) {
+    if (!token) {
+        throw new Error('cannot fingerprint empty token');
+    }
+    const full = createHash('sha256').update(token, 'utf8').digest('hex');
+    return {
+        full,
+        short: full.slice(0, 12),
+    };
+}
+//# sourceMappingURL=fingerprint.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/auth/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACzB,CAAC;AACJ,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/keychain.d.ts

@@ -0,0 +1,4 @@
+export declare function getKey(service: string, account: string): Promise<string | null>;
+export declare function setKey(service: string, account: string, value: string): Promise<void>;
+export declare function deleteKey(service: string, account: string): Promise<boolean>;
+export declare function resetKeychainCache(): void;

package/src/runtime/vendor/flywheel-cli-dist/auth/keychain.js

@@ -0,0 +1,31 @@
+let cached;
+async function loadKeytar() {
+    if (cached !== undefined && cached !== null) {
+        return cached;
+    }
+    try {
+        const mod = (await import('keytar'));
+        cached = 'default' in mod ? mod.default : mod;
+        return cached;
+    }
+    catch (err) {
+        cached = null;
+        throw new Error(`keytar could not be loaded; native module likely failed to build on this platform. Original error: ${err.message}`);
+    }
+}
+export async function getKey(service, account) {
+    const mod = await loadKeytar();
+    return mod.getPassword(service, account);
+}
+export async function setKey(service, account, value) {
+    const mod = await loadKeytar();
+    await mod.setPassword(service, account, value);
+}
+export async function deleteKey(service, account) {
+    const mod = await loadKeytar();
+    return mod.deletePassword(service, account);
+}
+export function resetKeychainCache() {
+    cached = undefined;
+}
+//# sourceMappingURL=keychain.js.map

package/src/runtime/vendor/flywheel-cli-dist/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAMA,IAAI,MAAuC,CAAC;AAE5C,KAAK,UAAU,UAAU;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAkB,CAAC,CAEhB,CAAC;QAC9B,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAE,GAAiC,CAAC,OAAO,CAAC,CAAC,CAAE,GAAoB,CAAC;QAC/F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,IAAI,KAAK,CACb,sGAAuG,GAAa,CAAC,OAAO,EAAE,CAC/H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAe,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;IAC1E,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/src/runtime/vendor/flywheel-cli-dist/auth/login.d.ts

@@ -0,0 +1,23 @@
+import type { HttpMethod } from '../http/client.js';
+import type { AuthConfigDelta } from './config.js';
+interface RequestOptions {
+    body?: unknown;
+}
+type RequestJson = <T>(method: HttpMethod, path: string, options?: RequestOptions) => Promise<T>;
+export interface AuthLoginArgs {
+    baseUrl: string;
+    params: Record<string, string | boolean>;
+    requestJson: RequestJson;
+    saveConfig: (filePath: string, config: AuthConfigDelta) => Promise<void>;
+    configPath: string;
+    openBrowser?: (url: string) => Promise<void>;
+    sleep?: (seconds: number) => Promise<void>;
+    now?: () => number;
+    writeStdout?: (chunk: string) => void;
+}
+export interface AuthLoginResult {
+    key_id: string | null;
+    exit_code: 0 | 1 | 3;
+}
+export declare function runAuthLogin(args: AuthLoginArgs): Promise<AuthLoginResult>;
+export {};