@patchstack/connect 0.3.26 → 0.3.27

package/AGENT-INSTALL.md

@@ -139,14 +139,29 @@ npx @patchstack/connect login
 
 The command asks Patchstack for a short code, prints a link, and polls until the site's **owner approves it in the dashboard**. On approval it writes the new credential into `.patchstackrc.json` and exits. The link opens the approval page with the code already filled in, so the person only has to confirm.
 
-### What you must do, as the agent
+### What you must do, as the agent — two commands, not one
 
-1. **Run the command and surface the link and code to the user verbatim.** They must open it themselves — approval requires their signed-in Patchstack account, which you do not have and must not ask for.
-2. **Leave the command running.** It polls until approved or the code expires (10 minutes). Do not kill it and retry; each run issues a different code and invalidates the one already on screen.
-3. **Report the outcome.** On success, tell them the credential was restored *and* that the previous one no longer works — see the warning below.
+**The command exits immediately when you run it.** It detects that its output is being captured rather than watched by a person, prints the link, and returns. It does **not** block waiting for approval, because you would not see the link until it exited — by which time the code would have expired, and it would look like the command had hung.
+
+```
+1.  npx @patchstack/connect login     → prints the link, exits straight away
+2.  give the user the link, verbatim  → they approve it in the browser
+3.  npx @patchstack/connect login     → the SAME command again, after they confirm.
+                                        It resumes the request and finishes the flow
+```
+
+- **Never wrap step 1 in a timeout or kill it** — it returns on its own. If you find yourself waiting on it, something else is wrong.
+- **Step 3 is the same command.** While a request is still valid it resumes rather than restarting, so running `login` again never invalidates the link the user is looking at. If they have not approved yet it tells you so, with the time remaining, and exits.
+- **Nothing changes until step 3 runs.** Approving only marks the request; the credential is rotated and written when the CLI redeems it. So an abandoned flow is harmless — the site keeps working — but the credential is not restored until you come back.
+- **Surface the link verbatim.** Approval requires the user's signed-in Patchstack account, which you do not have and must never ask for.
+- **Report the outcome.** On success, say the credential was restored *and* that the previous one no longer works — see the warning below.
+
+`login --wait` is the blocking variant: it polls until approved instead of returning. Prefer the plain re-run — it keeps each command short, which is what fits a conversation.
 
 You cannot complete this alone. It is deliberately a human-in-the-loop step: starting the flow proves nothing about who is running it, so the only authorisation is an owner approving in the browser.
 
+(In an interactive terminal the same command prints the link and then waits, since a person can watch it stream. You get the two-step form; a human at a shell gets the one-step form.)
+
 ### Consequences to tell the user about
 
 **Approving rotates the credential — the old one stops working immediately.** Anywhere it was configured needs the new value: CI secrets, hosting-platform env vars, preview environments, other developers' checkouts. Say this before they approve, not after.
@@ -158,7 +173,8 @@ You cannot complete this alone. It is deliberately a human-in-the-loop step: sta
 | Site was never claimed | `409` — no owner exists to approve | Ask the user to claim the site in the dashboard first, or, if the site is disposable, delete `.patchstackrc.json` and `scan` to provision a fresh one |
 | Running in CI | Refuses to start | CI takes its credential from `PATCHSTACK_PULSE_AUTH`; `login` is for a developer machine |
 | No `siteUuid` configured | Refuses to start | There is no site to recover — run `scan` |
-| Code expired | Poll ends after 10 minutes | Run the command again for a new code |
+| Code expired | `--wait` ends after 10 minutes | Start again from step 1 for a new code |
+| `--wait` with nothing pending | "No login is waiting for approval" | Run step 1 first; `--wait` resumes a request, it does not start one |
 
 ## Uninstalling
 

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -931,8 +931,8 @@ function computeManifestChecksum(packages) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1018,8 +1018,8 @@ function buildEndpointUrl(base, siteUuid) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1034,16 +1034,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -2949,17 +2949,40 @@ function renderGuideChecklist(state, useColor) {
 }
 
 // src/login.ts
+import { mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import path10 from "path";
+import { createHash as createHash2 } from "crypto";
 function baseFrom(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? path11.slice(0, -"/manifest".length) : "/monitor/pulse";
+  const p = url.pathname.replace(/\/$/, "");
+  url.pathname = p.endsWith("/manifest") ? p.slice(0, -"/manifest".length) : "/monitor/pulse";
   url.search = "";
   url.hash = "";
   return url.toString().replace(/\/$/, "");
 }
-async function login(config, onPrompt, deps = {}) {
+function pendingPath(siteUuid) {
+  const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
+  return path10.join(tmpdir(), `patchstack-login-${key}.json`);
+}
+function savePendingLogin(siteUuid, pending) {
+  writeFileSync6(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
+}
+function readPendingLogin(siteUuid) {
+  try {
+    return JSON.parse(readFileSync6(pendingPath(siteUuid), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearPendingLogin(siteUuid) {
+  try {
+    rmSync(pendingPath(siteUuid));
+  } catch {
+  }
+}
+async function startLogin(config, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   if (config.siteUuid === null) {
     return { status: "failed", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
@@ -2982,28 +3005,72 @@ async function login(config, onPrompt, deps = {}) {
   if (!started.ok) {
     return { status: "failed", message: `Could not start the login (HTTP ${started.status}).` };
   }
-  const { device_code: deviceCode, user_code: userCode, expires_in: expiresIn, interval } = await started.json();
-  const verificationUri = `${base}/device?code=${encodeURIComponent(userCode)}`;
-  onPrompt(userCode, verificationUri);
-  const deadline = now() + expiresIn * 1e3;
-  const intervalMs = Math.max(1, interval) * 1e3;
+  const body = await started.json();
+  const pending = {
+    deviceCode: body.device_code,
+    userCode: body.user_code,
+    // Points at the API, which redirects to the dashboard SPA — the CLI only
+    // knows the API origin, and the approval page lives on the app.
+    verificationUri: `${base}/device?code=${encodeURIComponent(body.user_code)}`,
+    expiresAt: now() + body.expires_in * 1e3,
+    intervalMs: Math.max(1, body.interval) * 1e3
+  };
+  savePendingLogin(config.siteUuid, pending);
+  return { status: "started", pending };
+}
+async function redeemIfApproved(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ device_code: pending.deviceCode })
+  });
+  if (polled.status === 428) return "pending";
+  if (!polled.ok) {
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return "expired";
+  }
+  const { api_key: apiKey } = await polled.json();
+  if (typeof apiKey !== "string" || apiKey.length === 0) return "expired";
+  await persistApiKey(process.cwd(), apiKey);
+  if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+  return "approved";
+}
+async function waitForApproval(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const deadline = Math.min(pending.expiresAt, deps.until ?? pending.expiresAt);
+  const expired = { status: "expired", message: "The login request expired. Run the command again." };
   while (now() < deadline) {
-    await sleep(intervalMs);
-    const polled = await fetchImpl(`${base}/device/token`, {
+    await sleep(pending.intervalMs);
+    const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+      body: JSON.stringify({ device_code: pending.deviceCode })
     });
     if (polled.status === 428) continue;
-    if (!polled.ok) return { status: "expired", message: "The login request expired. Run the command again." };
+    if (!polled.ok) {
+      if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+      return expired;
+    }
     const { api_key: apiKey } = await polled.json();
     if (typeof apiKey !== "string" || apiKey.length === 0) {
       return { status: "failed", message: "Patchstack approved the request but returned no credential." };
     }
     await persistApiKey(process.cwd(), apiKey);
-    return { status: "approved", userCode, verificationUri };
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return { status: "approved", userCode: pending.userCode, verificationUri: pending.verificationUri };
   }
-  return { status: "expired", message: "The login request expired. Run the command again." };
+  return expired;
+}
+async function login(config, onPrompt, deps = {}) {
+  const started = await startLogin(config, deps);
+  if (started.status !== "started" || started.pending === void 0) {
+    return { status: started.status === "started" ? "failed" : started.status, message: started.message };
+  }
+  onPrompt(started.pending.userCode, started.pending.verificationUri);
+  return waitForApproval(config, started.pending, deps);
 }
 
 // src/map/ts-loader.ts
@@ -3027,8 +3094,8 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
-import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { createHash as createHash4 } from "crypto";
 import { relative as relative4 } from "path";
 
 // src/map/ast.ts
@@ -3283,7 +3350,7 @@ function npmPackageOf(spec) {
 }
 
 // src/map/sources.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync7, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
 import { join as join12, relative as relative2, isAbsolute } from "path";
 
 // src/map/routes.ts
@@ -3368,7 +3435,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync6(join12(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join12(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -3496,10 +3563,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync(boundary);
   } catch {
   }
-  const inProject = (path11) => {
+  const inProject = (path12) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync(path11), boundary);
+      return isInside(realpathSync(path12), boundary);
     } catch {
       return false;
     }
@@ -3565,7 +3632,7 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join13 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
@@ -3604,7 +3671,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync7(join13(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync8(join13(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -3617,7 +3684,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync7(join13(cwd, file), "utf8");
+      text = readFileSync8(join13(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -3745,7 +3812,7 @@ function surfaceNote(surface) {
 }
 
 // src/map/sinks.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
 var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
 var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
@@ -4001,7 +4068,7 @@ function argumentRoleOf(sinkKind, method, index, total = 0) {
   return table?.[index] ?? "unknown";
 }
 function sinkId(s, owner) {
-  return createHash2("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
+  return createHash3("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
 }
 function dedupeSinks(sinks, owner) {
   const seen = /* @__PURE__ */ new Set();
@@ -4017,7 +4084,7 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { dirname as dirname4, join as join14, relative as relative3, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
@@ -4026,7 +4093,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync8(file, "utf8");
+      const text = readFileSync9(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -4125,8 +4192,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path11) {
-  if (/\[\d*\]/.test(path11)) {
+function runtimeCoordinate(source, path12) {
+  if (/\[\d*\]/.test(path12)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -4135,15 +4202,15 @@ function runtimeCoordinate(source, path11) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path11}` };
+      return { runtimeParameter: `post.${path12}` };
     case "query":
-      return { runtimeParameter: `get.${path11}` };
+      return { runtimeParameter: `get.${path12}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path11}` };
+      return { runtimeParameter: `cookie.${path12}` };
     case "file":
-      return { runtimeParameter: `files.${path11}` };
+      return { runtimeParameter: `files.${path12}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path11.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path12.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -4175,8 +4242,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path11) {
-  return `${addressSpaceOf(source)}:${path11}`;
+function inputIdOf(source, path12) {
+  return `${addressSpaceOf(source)}:${path12}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -4375,8 +4442,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path11, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path11, space });
+  const addRoot = (name, path12, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path12, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -4521,8 +4588,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path11) {
-  return path11.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path12) {
+  return path12.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -4768,7 +4835,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { join as join15 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
@@ -4780,7 +4847,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync9(join15(cwd, name), "utf8");
+      const raw = readFileSync10(join15(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -5159,7 +5226,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync10(file, "utf8");
+      const text = readFileSync11(file, "utf8");
       const relFile = relative4(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
@@ -5172,7 +5239,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
       parsed++;
       entryFiles.add(file);
-      const fingerprint = createHash3("sha256").update(text).digest("hex").slice(0, 16);
+      const fingerprint = createHash4("sha256").update(text).digest("hex").slice(0, 16);
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       for (const specifier of bindings.imports) {
@@ -5214,7 +5281,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync10(target, "utf8");
+      const text = readFileSync11(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
       const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
@@ -5345,8 +5412,8 @@ async function buildInputMap(cwd, options = {}) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import path11 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -5364,8 +5431,8 @@ function appendHook(existing, command) {
   return `${existing} && ${command}`;
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path10.join(cwd, "package.json");
-  const raw = readFileSync11(target, "utf8");
+  const target = path11.join(cwd, "package.json");
+  const raw = readFileSync12(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -5414,7 +5481,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync7(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   if (build === void 0 || build.trim().length === 0) {
     return {
       changed: true,
@@ -5492,10 +5559,17 @@ Usage:
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
                                                      guide even when setup is complete
-  patchstack-connect login  [options]                Recover this site's credential when
+  patchstack-connect login  [--wait]                 Recover this site's credential when
                                                      .patchstackrc.json has been lost. Prints a link
-                                                     for the site's OWNER to approve in the dashboard,
-                                                     then waits (10 min). Use this instead of deleting
+                                                     for the site's OWNER to approve in the dashboard.
+                                                     In a terminal it then waits. When the output is
+                                                     piped or captured \u2014 an assistant running it \u2014 it
+                                                     prints the link and EXITS, so the link is visible
+                                                     immediately. Run it AGAIN once the user confirms
+                                                     they approved: it resumes the same request rather
+                                                     than starting a new one, and finishes the flow.
+                                                     --wait blocks instead of returning. Use this
+                                                     instead of deleting
                                                      .patchstackrc.json and re-scanning, which would
                                                      provision a second site. Approving ROTATES the
                                                      credential: CI, deploys and other machines using
@@ -5600,7 +5674,26 @@ async function runLogin(args) {
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
-  const result = await login(config, (userCode, verificationUri) => {
+  const approved = () => {
+    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.");
+    console.log("    The previous credential no longer works. Update it anywhere else it was set:");
+    console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
+    return 0;
+  };
+  if (args.flags.has("wait")) {
+    const pending = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (pending === null) {
+      console.error("\n  No login is waiting for approval. Run `patchstack-connect login` first.\n");
+      return 1;
+    }
+    const resumed = await waitForApproval(config, pending);
+    if (resumed.status === "approved") return approved();
+    console.error(`
+  ${resumed.message ?? "Login failed."}
+`);
+    return 1;
+  }
+  const prompt = (userCode, verificationUri) => {
     console.log(`
   Your code:  ${userCode}`);
     console.log(`  Approve at: ${verificationUri}
@@ -5608,14 +5701,39 @@ async function runLogin(args) {
     console.log("  Open that link and approve it as the site's owner. Approving issues a new");
     console.log("  credential and stops the current one working \u2014 CI, deploys and any other");
     console.log("  machine using it will need the new value.\n");
-    console.log("  Waiting for approval (the code expires in 10 minutes)\u2026");
-  });
-  if (result.status === "approved") {
-    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.");
-    console.log("    The previous credential no longer works. Update it anywhere else it was set:");
-    console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
+  };
+  if (process.stdout.isTTY !== true) {
+    const existing = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (existing !== null && Date.now() < existing.expiresAt) {
+      const outcome = await redeemIfApproved(config, existing);
+      if (outcome === "approved") return approved();
+      if (outcome === "pending") {
+        const secondsLeft = Math.round((existing.expiresAt - Date.now()) / 1e3);
+        console.log(`
+  Still waiting for approval of code ${existing.userCode}.`);
+        console.log(`  Approve at: ${existing.verificationUri}`);
+        console.log(`  (valid for another ${secondsLeft}s \u2014 run this again once the user confirms)
+`);
+        return 0;
+      }
+    }
+    const started = await startLogin(config);
+    if (started.status !== "started" || started.pending === void 0) {
+      console.error(`
+  ${started.message ?? "Login failed."}
+`);
+      return 1;
+    }
+    prompt(started.pending.userCode, started.pending.verificationUri);
+    console.log("  Give that link to the user. When they confirm they have approved it, run");
+    console.log("  this same command again (or `login --wait` to block until they do).\n");
     return 0;
   }
+  const result = await login(config, (userCode, verificationUri) => {
+    prompt(userCode, verificationUri);
+    console.log("  Waiting for approval (the code expires in 10 minutes)\u2026");
+  });
+  if (result.status === "approved") return approved();
   console.error(`
   ${result.message ?? "Login failed."}
 `);
@@ -5664,7 +5782,7 @@ async function runMap(args) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(args.flags, "out");
   if (out) {
-    writeFileSync7(out, json);
+    writeFileSync8(out, json);
     console.error(`patchstack: wrote ${out}`);
   } else if (args.flags.get("upload") !== true) {
     console.log(json);
@@ -5950,7 +6068,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync12(guidePath, "utf8"));
+  console.log(readFileSync13(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -6131,7 +6249,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync12(file, "utf8");
+    const before = readFileSync13(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -6141,7 +6259,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync7(file, after);
+      writeFileSync8(file, after);
       marked += 1;
     }
   }