@paybond/kit 0.9.8 → 0.10.0

package/dist/cli/ux.js

@@ -0,0 +1,164 @@
+import { access } from "node:fs/promises";
+import path from "node:path";
+import { COMMAND_EXAMPLES, COMPLETION_SCRIPTS, WORKFLOWS } from "./command-spec.js";
+import { resolvedDefaultsForDoctor } from "./credentials.js";
+import { helpForCommand } from "./help.js";
+import { consumeFlag } from "./globals.js";
+import { planMcpInstall, parseMcpInstallFormat, parseMcpInstallHost, parseMcpInstallScope } from "./mcp-install.js";
+import { CliError } from "./types.js";
+import { handleDoctor } from "./commands/setup.js";
+export function resolveHelpPath(argv) {
+    return argv.filter((part) => part !== "--help" && part !== "-h").join(" ");
+}
+export function renderHelpText(path) {
+    return helpForCommand(path);
+}
+export function handleHelpCommand(argv) {
+    const helpPath = resolveHelpPath(argv);
+    return { data: { text: renderHelpText(helpPath), path: helpPath || "paybond" } };
+}
+export function handleExamplesCommand(argv) {
+    const filterPath = argv.filter((part) => part !== "--help" && part !== "-h").join(" ");
+    const lines = [];
+    if (!filterPath) {
+        lines.push("Workflows:");
+        for (const workflow of WORKFLOWS) {
+            lines.push("", workflow.title);
+            if (workflow.description) {
+                lines.push(workflow.description);
+            }
+            for (const example of workflow.examples) {
+                lines.push(`  $ ${example}`);
+            }
+            if (workflow.next) {
+                lines.push(`  Next: ${workflow.next}`);
+            }
+        }
+        lines.push("", "Commands:");
+    }
+    const entries = filterPath
+        ? Object.entries(COMMAND_EXAMPLES).filter(([commandPath]) => commandPath === filterPath || commandPath.startsWith(`${filterPath} `))
+        : Object.entries(COMMAND_EXAMPLES);
+    if (filterPath && entries.length === 0) {
+        throw new CliError(`no examples found for: ${filterPath}`, {
+            category: "usage",
+            code: "cli.usage.unknown_command",
+        });
+    }
+    for (const [commandPath, examples] of entries) {
+        lines.push("", `paybond ${commandPath}`);
+        for (const example of examples) {
+            lines.push(`  $ ${example}`);
+        }
+    }
+    return { data: { text: lines.join("\n").trim(), filter: filterPath || null, count: entries.length } };
+}
+export function handleCompletionCommand(argv) {
+    const shell = argv[0];
+    if (!shell || shell === "--help" || shell === "-h") {
+        throw new CliError("completion requires bash|zsh|fish", {
+            category: "usage",
+            code: "cli.usage.missing_completion_shell",
+        });
+    }
+    const script = COMPLETION_SCRIPTS[shell];
+    if (!script) {
+        throw new CliError(`unsupported completion shell: ${shell} (expected bash|zsh|fish)`, {
+            category: "usage",
+            code: "cli.usage.invalid_completion_shell",
+        });
+    }
+    return { data: { shell, script } };
+}
+export async function handleOnboarding(ctx, argv) {
+    const hostFlag = consumeFlag(argv, "--host");
+    let installHost = "generic";
+    try {
+        if (hostFlag.present) {
+            installHost = parseMcpInstallHost(hostFlag.value);
+        }
+    }
+    catch (err) {
+        throw new CliError(err instanceof Error ? err.message : String(err), {
+            category: "usage",
+            code: "cli.usage.invalid_mcp_install",
+        });
+    }
+    const steps = [];
+    steps.push({
+        name: "runtime",
+        ok: true,
+        message: `node ${process.version}`,
+    });
+    const defaults = resolvedDefaultsForDoctor(ctx.globals);
+    const envPath = path.isAbsolute(defaults.envFile)
+        ? path.resolve(defaults.envFile)
+        : path.resolve(ctx.cwd, defaults.envFile);
+    let loggedIn = false;
+    try {
+        const { resolveApiKey } = await import("./credentials.js");
+        const apiKey = await resolveApiKey(ctx.globals, ctx.cwd);
+        loggedIn = true;
+        const { maskApiKey } = await import("./redact.js");
+        steps.push({
+            name: "login",
+            ok: true,
+            message: `credentials found (${maskApiKey(apiKey)})`,
+        });
+    }
+    catch (err) {
+        steps.push({
+            name: "login",
+            ok: false,
+            message: err instanceof Error ? err.message : String(err),
+            command: "paybond login",
+        });
+    }
+    const guardrailPath = path.resolve(ctx.cwd, "paybond-paid-tool-guard.ts");
+    let guardrailExists = false;
+    try {
+        await access(guardrailPath);
+        guardrailExists = true;
+    }
+    catch {
+        guardrailExists = false;
+    }
+    steps.push({
+        name: "guardrail",
+        ok: guardrailExists,
+        message: guardrailExists ? `found ${guardrailPath}` : `guardrail file not found (${guardrailPath})`,
+        command: guardrailExists ? undefined : "paybond init guardrail",
+    });
+    const plan = planMcpInstall({
+        host: installHost,
+        scope: parseMcpInstallScope("local"),
+        format: parseMcpInstallFormat(undefined, installHost),
+        envFile: defaults.envFile,
+        cwd: ctx.cwd,
+        home: process.env.HOME ?? process.env.USERPROFILE ?? ctx.cwd,
+    });
+    steps.push({
+        name: "mcp_config",
+        ok: true,
+        message: `preview ready for host=${plan.host} (non-destructive --scope local)`,
+        command: `paybond mcp install --host ${plan.host} --scope local`,
+    });
+    const doctor = await handleDoctor(ctx, loggedIn ? ["--agent"] : []);
+    const doctorOk = String(doctor.data.summary) === "pass";
+    steps.push({
+        name: "doctor",
+        ok: doctorOk,
+        message: `doctor ${doctor.data.summary}`,
+        command: doctorOk ? undefined : "paybond doctor --agent",
+    });
+    const summary = steps.every((step) => step.ok) ? "pass" : "fail";
+    return {
+        data: {
+            steps,
+            summary,
+            env_file: envPath,
+            mcp_preview: plan.printed ? plan.payload : undefined,
+            doctor_checks: doctor.data.checks,
+        },
+    };
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { runCli } from "./cli/router.js";

package/dist/cli.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { runCli } from "./cli/router.js";
+async function invokedFromCLI() {
+    const scriptPath = process.argv[1];
+    if (!scriptPath) {
+        return false;
+    }
+    async function realFileURL(filePath) {
+        let resolved = path.resolve(filePath);
+        try {
+            resolved = await fs.realpath(resolved);
+        }
+        catch {
+            // keep absolute path
+        }
+        const href = pathToFileURL(resolved).href;
+        return href.startsWith("file:///var/") ? href.replace("file:///var/", "file:///private/var/") : href;
+    }
+    return (await realFileURL(scriptPath)) === (await realFileURL(fileURLToPath(import.meta.url)));
+}
+invokedFromCLI().then((invoked) => {
+    if (!invoked) {
+        return;
+    }
+    runCli(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    }, (err) => {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exitCode = 1;
+    });
+}, (err) => {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exitCode = 1;
+});
+export { runCli } from "./cli/router.js";

package/dist/init.js

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { runCli } from "./cli/router.js";
 const FRAMEWORKS = new Set([
     "generic",
     "provider-agnostic",
@@ -79,7 +83,8 @@ function parseArgs(argv) {
     return { preset, framework, out, force };
 }
 function template(framework) {
-    return `import {
+    return `import fs from "node:fs/promises";
+import {
   Paybond,
   type SandboxGuardrailBootstrapResult,
   type SandboxGuardrailEvidenceResult,
@@ -139,8 +144,6 @@ function readEnvValue(body: string, key: string): string | undefined {
 }
 
 async function readTextFile(envFile: string): Promise<string | undefined> {
-  // @ts-ignore Node builtins are available in agent and CLI Node runtimes.
-  const fs: { readFile(path: string, encoding: "utf8"): Promise<string> } = await import("node:fs/promises");
   try {
     return await fs.readFile(envFile, "utf8");
   } catch (err) {
@@ -239,8 +242,6 @@ export async function submitSandboxEvidence(
 `;
 }
 async function writeScaffold(out, body, force) {
-    // @ts-expect-error Node builtins are available in the published CLI runtime.
-    const fs = await import("node:fs/promises");
     try {
         await fs.stat(out);
         if (!force) {
@@ -286,12 +287,6 @@ async function invokedFromCLI() {
     if (!scriptPath) {
         return false;
     }
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const fs = (await import("node:fs/promises"));
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const path = (await import("node:path"));
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const url = (await import("node:url"));
     async function realFileURL(filePath) {
         let resolved = path.resolve(filePath);
         try {
@@ -301,15 +296,15 @@ async function invokedFromCLI() {
             // If realpath fails, compare the absolute path. This keeps direct execution
             // working even when the script path disappears during process startup.
         }
-        return normalizeFileURL(url.pathToFileURL(resolved).href);
+        return normalizeFileURL(pathToFileURL(resolved).href);
     }
-    return (await realFileURL(scriptPath)) === (await realFileURL(url.fileURLToPath(import.meta.url)));
+    return (await realFileURL(scriptPath)) === (await realFileURL(fileURLToPath(import.meta.url)));
 }
 invokedFromCLI().then((invoked) => {
     if (!invoked) {
         return;
     }
-    main().then((code) => {
+    runCli(["init", "guardrail", ...process.argv.slice(2)]).then((code) => {
         process.exitCode = code;
     }, (err) => {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);

package/dist/login.d.ts

@@ -10,6 +10,17 @@ export type LoginOptions = {
     noOpen: boolean;
     force: boolean;
 };
+export type LoginResult = {
+    envPath: string;
+    keyMasked: string;
+    keyWritten: true;
+    environment: DeviceEnvironment;
+    tenantId: string;
+    tenantUuid: string;
+    expiresAt?: string;
+    verificationUri: string;
+    userCode: string;
+};
 type FetchInput = string | URL;
 type FetchInit = {
     method?: string;
@@ -25,11 +36,13 @@ export type LoginDependencies = {
     stdout?: Writable;
     stderr?: Writable;
     now?: () => number;
+    /** When false, suppress human-readable progress lines (for JSON CLI output). */
+    humanOutput?: boolean;
 };
 export declare function parseArgs(argv: string[]): LoginOptions | "help";
 export declare function assertGitIgnored(envPath: string, cwd: string): Promise<void>;
 export declare function assertCanWriteEnvFile(envPath: string, force: boolean): Promise<void>;
 export declare function writeEnvFile(envPath: string, rawKey: string, force: boolean): Promise<void>;
-export declare function runLogin(options: LoginOptions, deps?: LoginDependencies): Promise<number>;
+export declare function runLogin(options: LoginOptions, deps?: LoginDependencies): Promise<LoginResult>;
 export declare function main(argv?: string[], deps?: LoginDependencies): Promise<number>;
 export {};

package/dist/login.js

@@ -1,10 +1,30 @@
 #!/usr/bin/env node
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { runCli } from "./cli/router.js";
 const DEFAULT_GATEWAY = "https://api.paybond.ai";
 const DEFAULT_ENV_FILE = ".env.local";
 const CLIENT_ID = "paybond-kit-cli";
 const CLIENT_NAME = "Paybond CLI";
 const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 const MIN_POLL_INTERVAL_SECONDS = 1;
+const DEFAULT_DEVICE_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
+const MS_PER_SECOND = 1_000;
+const DEVICE_EXPIRY_GRACE_MS = MS_PER_SECOND;
+const PROCESS_EXIT_SUCCESS = 0;
+const SPAWN_COMMAND_NOT_FOUND_EXIT_CODE = 127;
+const GIT_CHECK_IGNORE_MATCHED = PROCESS_EXIT_SUCCESS;
+const GIT_CHECK_IGNORE_NOT_MATCHED = 1;
+const MAX_GIT_WORKTREE_WALK_DEPTH = 256;
+const ENV_FILE_MODE = 0o600;
+const GITIGNORE_FILE_MODE = 0o644;
+const API_KEY_MASK_MIN_PARTS = 5;
+const API_KEY_MASK_MIN_ID_LENGTH = 12;
+const API_KEY_MASK_ID_PREFIX_LENGTH = 8;
+const API_KEY_MASK_ID_SUFFIX_LENGTH = 4;
 class PaybondLoginError extends Error {
     constructor(message) {
         super(message);
@@ -127,19 +147,9 @@ function replaceOrAppendEnvValue(existing, rawKey, force) {
     const suffix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
     return `${existing}${suffix}${line}\n`;
 }
-async function pathModule() {
-    // @ts-expect-error Node builtins are available in the published CLI runtime.
-    return await import("node:path");
-}
-async function fsModule() {
-    // @ts-expect-error Node builtins are available in the published CLI runtime.
-    return await import("node:fs/promises");
-}
 async function spawnCommand(command, args, cwd) {
-    // @ts-expect-error Node builtins are available in the published CLI runtime.
-    const childProcess = await import("node:child_process");
     return await new Promise((resolve) => {
-        const child = childProcess.spawn(command, args, {
+        const child = spawn(command, args, {
             cwd,
             stdio: ["ignore", "pipe", "pipe"],
         });
@@ -152,7 +162,7 @@ async function spawnCommand(command, args, cwd) {
             stderr += String(chunk);
         });
         child.on("error", (err) => {
-            resolve({ code: 127, stdout: "", stderr: err.message });
+            resolve({ code: SPAWN_COMMAND_NOT_FOUND_EXIT_CODE, stdout: "", stderr: err.message });
         });
         child.on("close", (code) => {
             resolve({ code, stdout, stderr });
@@ -160,31 +170,55 @@ async function spawnCommand(command, args, cwd) {
     });
 }
 async function resolveEnvFile(envFile, cwd) {
-    const path = await pathModule();
     return path.isAbsolute(envFile) ? path.resolve(envFile) : path.resolve(cwd, envFile);
 }
 export async function assertGitIgnored(envPath, cwd) {
     await ensureGitIgnored(envPath, cwd, false);
 }
+async function inGitWorkTree(start) {
+    let current = path.resolve(start);
+    for (let depth = 0; depth < MAX_GIT_WORKTREE_WALK_DEPTH; depth += 1) {
+        try {
+            await fs.access(path.join(current, ".git"));
+            return true;
+        }
+        catch {
+            // continue walking parents
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return false;
+        }
+        current = parent;
+    }
+    return false;
+}
+function gitMissingForSecretWriteError() {
+    return new PaybondLoginError("git is required to verify the env file is ignored before writing secrets; install git or pass --env-file outside the repository");
+}
 async function ensureGitIgnored(envPath, cwd, autoAddDefaultEnvFile) {
-    const path = await pathModule();
-    const fs = await fsModule();
     const rootResult = await spawnCommand("git", ["rev-parse", "--show-toplevel"], cwd);
     if (rootResult.code !== 0) {
+        if (rootResult.code === SPAWN_COMMAND_NOT_FOUND_EXIT_CODE || /ENOENT/i.test(rootResult.stderr)) {
+            if (await inGitWorkTree(cwd)) {
+                throw gitMissingForSecretWriteError();
+            }
+        }
         return;
     }
     const repoRoot = await fs.realpath(path.resolve(rootResult.stdout.trim()));
     const targetDir = await fs.realpath(path.dirname(path.resolve(envPath)));
     const target = path.resolve(targetDir, path.basename(envPath));
     const relativeTarget = path.relative(repoRoot, target);
-    if (relativeTarget !== "" && (relativeTarget.startsWith("..") || path.isAbsolute(relativeTarget))) {
+    if (relativeTarget !== "" &&
+        (relativeTarget.startsWith("..") || path.isAbsolute(relativeTarget))) {
         return;
     }
     const ignoreResult = await spawnCommand("git", ["-C", repoRoot, "check-ignore", "--quiet", "--", relativeTarget], cwd);
-    if (ignoreResult.code === 0) {
+    if (ignoreResult.code === GIT_CHECK_IGNORE_MATCHED) {
         return;
     }
-    if (ignoreResult.code === 1) {
+    if (ignoreResult.code === GIT_CHECK_IGNORE_NOT_MATCHED) {
         if (autoAddDefaultEnvFile && relativeTarget === DEFAULT_ENV_FILE) {
             const gitignorePath = path.resolve(repoRoot, ".gitignore");
             let existing = "";
@@ -192,14 +226,17 @@ async function ensureGitIgnored(envPath, cwd, autoAddDefaultEnvFile) {
                 existing = await fs.readFile(gitignorePath, "utf8");
             }
             catch (err) {
-                if (!(err && typeof err === "object" && "code" in err && err.code === "ENOENT")) {
+                if (!(err &&
+                    typeof err === "object" &&
+                    "code" in err &&
+                    err.code === "ENOENT")) {
                     throw err;
                 }
             }
             const suffix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-            await fs.writeFile(gitignorePath, `${existing}${suffix}${DEFAULT_ENV_FILE}\n`, { encoding: "utf8", mode: 0o644 });
+            await fs.writeFile(gitignorePath, `${existing}${suffix}${DEFAULT_ENV_FILE}\n`, { encoding: "utf8", mode: GITIGNORE_FILE_MODE });
             const recheck = await spawnCommand("git", ["-C", repoRoot, "check-ignore", "--quiet", "--", relativeTarget], cwd);
-            if (recheck.code === 0) {
+            if (recheck.code === GIT_CHECK_IGNORE_MATCHED) {
                 return;
             }
         }
@@ -208,7 +245,6 @@ async function ensureGitIgnored(envPath, cwd, autoAddDefaultEnvFile) {
     throw new PaybondLoginError(`Unable to verify git ignore status for ${target}: ${ignoreResult.stderr.trim() || "git check-ignore failed"}`);
 }
 export async function assertCanWriteEnvFile(envPath, force) {
-    const fs = await fsModule();
     try {
         const existing = await fs.readFile(envPath, "utf8");
         if (envKeyPattern().test(existing) && !force) {
@@ -216,26 +252,31 @@ export async function assertCanWriteEnvFile(envPath, force) {
         }
     }
     catch (err) {
-        if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+        if (err &&
+            typeof err === "object" &&
+            "code" in err &&
+            err.code === "ENOENT") {
             return;
         }
         throw err;
     }
 }
 export async function writeEnvFile(envPath, rawKey, force) {
-    const fs = await fsModule();
     let existing = "";
     try {
         existing = await fs.readFile(envPath, "utf8");
     }
     catch (err) {
-        if (!(err && typeof err === "object" && "code" in err && err.code === "ENOENT")) {
+        if (!(err &&
+            typeof err === "object" &&
+            "code" in err &&
+            err.code === "ENOENT")) {
             throw err;
         }
     }
     const next = replaceOrAppendEnvValue(existing, rawKey, force);
-    await fs.writeFile(envPath, next, { encoding: "utf8", mode: 0o600 });
-    await fs.chmod(envPath, 0o600);
+    await fs.writeFile(envPath, next, { encoding: "utf8", mode: ENV_FILE_MODE });
+    await fs.chmod(envPath, ENV_FILE_MODE);
 }
 function gatewayUrl(base, path) {
     return `${base.trim().replace(/\/+$/, "")}${path}`;
@@ -278,7 +319,8 @@ async function postGatewayJson(fetchFn, gateway, path, body) {
     if (error) {
         throw new OAuthPollError({
             error,
-            error_description: stringField(parsed, "error_description") || stringField(parsed, "message"),
+            error_description: stringField(parsed, "error_description") ||
+                stringField(parsed, "message"),
             interval: numberField(parsed, "interval", 0) || undefined,
         });
     }
@@ -290,10 +332,12 @@ function toDeviceStartResponse(body) {
         user_code: stringField(body, "user_code"),
         verification_uri: stringField(body, "verification_uri"),
         verification_uri_complete: stringField(body, "verification_uri_complete") || undefined,
-        expires_in: numberField(body, "expires_in", 600),
-        interval: numberField(body, "interval", 5),
+        expires_in: numberField(body, "expires_in", DEFAULT_DEVICE_EXPIRES_IN_SECONDS),
+        interval: numberField(body, "interval", DEFAULT_DEVICE_POLL_INTERVAL_SECONDS),
     };
-    if (!response.device_code || !response.user_code || !response.verification_uri) {
+    if (!response.device_code ||
+        !response.user_code ||
+        !response.verification_uri) {
         throw new PaybondLoginError("Gateway device start response was missing required fields.");
     }
     return response;
@@ -332,11 +376,11 @@ async function startDeviceFlow(fetchFn, gateway, environment) {
     return toDeviceStartResponse(body);
 }
 async function pollDeviceToken(fetchFn, gateway, environment, start, deps) {
-    let intervalSeconds = Math.max(MIN_POLL_INTERVAL_SECONDS, Math.trunc(start.interval || 5));
-    const expiresAtMs = deps.now() + Math.max(1, start.expires_in) * 1000;
+    let intervalSeconds = Math.max(MIN_POLL_INTERVAL_SECONDS, Math.trunc(start.interval || DEFAULT_DEVICE_POLL_INTERVAL_SECONDS));
+    const expiresAtMs = deps.now() + Math.max(1, start.expires_in) * MS_PER_SECOND;
     for (;;) {
-        await deps.sleep(intervalSeconds * 1000);
-        if (deps.now() > expiresAtMs + 1000) {
+        await deps.sleep(intervalSeconds * MS_PER_SECOND);
+        if (deps.now() > expiresAtMs + DEVICE_EXPIRY_GRACE_MS) {
             throw new PaybondLoginError("Device authorization expired before approval.");
         }
         try {
@@ -372,10 +416,12 @@ async function pollDeviceToken(fetchFn, gateway, environment, start, deps) {
 function maskAPIKey(rawKey) {
     const trimmed = rawKey.trim();
     const parts = trimmed.split("_");
-    if (parts.length >= 5 && parts[0] === "paybond" && parts[1] === "sk") {
+    if (parts.length >= API_KEY_MASK_MIN_PARTS && parts[0] === "paybond" && parts[1] === "sk") {
         const environment = parts[2];
         const keyID = parts[3];
-        const redactedKeyID = keyID.length > 12 ? `${keyID.slice(0, 8)}...${keyID.slice(-4)}` : "redacted";
+        const redactedKeyID = keyID.length > API_KEY_MASK_MIN_ID_LENGTH
+            ? `${keyID.slice(0, API_KEY_MASK_ID_PREFIX_LENGTH)}...${keyID.slice(-API_KEY_MASK_ID_SUFFIX_LENGTH)}`
+            : "redacted";
         return `paybond_sk_${environment}_${redactedKeyID}`;
     }
     return "paybond_sk_...";
@@ -388,11 +434,12 @@ async function defaultOpenBrowser(url) {
     const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
     const args = platform === "win32" ? ["/c", "start", "", url] : [url];
     const result = await spawnCommand(command, args, process.cwd());
-    return result.code === 0;
+    return result.code === PROCESS_EXIT_SUCCESS;
 }
 export async function runLogin(options, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const stdout = deps.stdout ?? process.stdout;
+    const humanOutput = deps.humanOutput ?? true;
     const fetchFn = deps.fetch ?? fetch;
     const sleep = deps.sleep ?? defaultSleep;
     const now = deps.now ?? Date.now;
@@ -402,25 +449,40 @@ export async function runLogin(options, deps = {}) {
     await ensureGitIgnored(envPath, cwd, options.envFile === DEFAULT_ENV_FILE);
     const start = await startDeviceFlow(fetchFn, options.gateway, options.environment);
     const verificationUrl = start.verification_uri_complete || start.verification_uri;
-    stdout.write(`Paybond ${options.environment} login\n`);
-    stdout.write(`Verification URL: ${verificationUrl}\n`);
-    stdout.write(`Code: ${start.user_code}\n`);
-    if (!options.noOpen) {
-        const opened = await openBrowser(verificationUrl);
-        if (!opened) {
-            stdout.write(`Open the verification URL in a browser to approve this login.\n`);
+    if (humanOutput) {
+        stdout.write(`Paybond ${options.environment} login\n`);
+        stdout.write(`Verification URL: ${verificationUrl}\n`);
+        stdout.write(`Code: ${start.user_code}\n`);
+        if (!options.noOpen) {
+            const opened = await openBrowser(verificationUrl);
+            if (!opened) {
+                stdout.write(`Open the verification URL in a browser to approve this login.\n`);
+            }
         }
+        stdout.write(`Waiting for approval...\n`);
     }
-    stdout.write(`Waiting for approval...\n`);
     const token = await pollDeviceToken(fetchFn, options.gateway, options.environment, start, { sleep, now });
     await writeEnvFile(envPath, token.access_token, options.force);
-    stdout.write(`Wrote PAYBOND_API_KEY to ${envPath}\n`);
-    stdout.write(`Key: ${maskAPIKey(token.access_token)}\n`);
-    stdout.write(`Target ${token.environment} tenant: ${token.tenant_id} (${token.tenant_uuid})\n`);
-    if (token.expires_at) {
-        stdout.write(`This key auto-expires at ${token.expires_at}; re-run paybond login to mint a new one.\n`);
+    const keyMasked = maskAPIKey(token.access_token);
+    if (humanOutput) {
+        stdout.write(`Wrote PAYBOND_API_KEY to ${envPath}\n`);
+        stdout.write(`Key: ${keyMasked}\n`);
+        stdout.write(`Target ${token.environment} tenant: ${token.tenant_id} (${token.tenant_uuid})\n`);
+        if (token.expires_at) {
+            stdout.write(`This key auto-expires at ${token.expires_at}; re-run paybond login to mint a new one.\n`);
+        }
     }
-    return 0;
+    return {
+        envPath,
+        keyMasked,
+        keyWritten: true,
+        environment: options.environment,
+        tenantId: token.tenant_id,
+        tenantUuid: token.tenant_uuid,
+        expiresAt: token.expires_at || undefined,
+        verificationUri: verificationUrl,
+        userCode: start.user_code,
+    };
 }
 export async function main(argv = process.argv.slice(2), deps = {}) {
     let parsed;
@@ -430,7 +492,8 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
             (deps.stdout ?? process.stdout).write(`${usage()}\n`);
             return 0;
         }
-        return await runLogin(parsed, deps);
+        await runLogin(parsed, deps);
+        return 0;
     }
     catch (err) {
         (deps.stderr ?? process.stderr).write(`${err instanceof Error ? err.message : String(err)}\n`);
@@ -438,19 +501,15 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
     }
 }
 function normalizeFileURL(url) {
-    return url.startsWith("file:///var/") ? url.replace("file:///var/", "file:///private/var/") : url;
+    return url.startsWith("file:///var/")
+        ? url.replace("file:///var/", "file:///private/var/")
+        : url;
 }
 async function invokedFromCLI() {
     const scriptPath = process.argv[1];
     if (!scriptPath) {
         return false;
     }
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const fs = (await import("node:fs/promises"));
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const path = (await import("node:path"));
-    // @ts-ignore Node builtins are available in the published CLI runtime.
-    const url = (await import("node:url"));
     async function realFileURL(filePath) {
         let resolved = path.resolve(filePath);
         try {
@@ -460,15 +519,16 @@ async function invokedFromCLI() {
             // If realpath fails, compare the absolute path. This keeps direct execution
             // working even when the script path disappears during process startup.
         }
-        return normalizeFileURL(url.pathToFileURL(resolved).href);
+        return normalizeFileURL(pathToFileURL(resolved).href);
     }
-    return (await realFileURL(scriptPath)) === (await realFileURL(url.fileURLToPath(import.meta.url)));
+    return ((await realFileURL(scriptPath)) ===
+        (await realFileURL(fileURLToPath(import.meta.url))));
 }
 invokedFromCLI().then((invoked) => {
     if (!invoked) {
         return;
     }
-    main().then((code) => {
+    runCli(["login", ...process.argv.slice(2)]).then((code) => {
         process.exitCode = code;
     }, (err) => {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);