@productbrain/cli 0.1.0-beta.27 → 0.1.0-beta.2721

package/dist/commands/connect.js

@@ -0,0 +1,339 @@
+/**
+ * pb connect — redeem a short-lived connect token to save an API key locally.
+ *
+ * Part of FEAT-958 Path C: Onboarding flow. Redeems a connect token, saves API
+ * key locally, runs Ink screens, then prints a tailored chat-handoff instruction
+ * (WP-433 FEAT-1291).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { resolve } from 'path';
+import { resolveAppUrl, resolveConnectRedeemUrl } from '../lib/constants.js';
+import { CONNECT_REDEEM_DEFAULT_API_KEY_NAME, trimClientKeyLabelInput, } from '../lib/connectKeyLabel.js';
+import { CONNECT_TOKEN_PREFIX } from '../lib/tokenConstants.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { createProfile, listProfiles, PROFILES_DIR } from '../lib/profiles.js';
+import { withSpinner } from '../lib/spinner.js';
+import { stripControlChars } from '../lib/strip.js';
+import * as clack from '@clack/prompts';
+import { runConnectScreens, runConnectHeadless } from './connect-screens.js';
+import { detectHandoffMarkers, resolveHandoff, printHandoff } from './connect-handoff.js';
+import { setLocalProfilePin, readLocalProjectConfig } from '../lib/config.js';
+import { discardAllSessions } from '../lib/session.js';
+import { confirm, isInteractive } from '../lib/prompts.js';
+const APP_URL = resolveAppUrl();
+/**
+ * Validate token format — must start with pb_ct_ and be >20 chars.
+ * @returns error message if invalid, undefined if valid.
+ */
+function validateTokenFormat(token) {
+    if (!token.startsWith(CONNECT_TOKEN_PREFIX)) {
+        return `Invalid token format. Token must start with '${CONNECT_TOKEN_PREFIX}'.`;
+    }
+    if (token.length < 30) {
+        return `Token is too short. Got ${token.length} chars, expected >30.`;
+    }
+    return undefined;
+}
+/**
+ * POST /auth/redeem-connect-token with the token.
+ * Returns the API key + workspace info, or throws CLIError on failure.
+ */
+async function redeemToken(token, siteUrl, optionalDisplayName) {
+    return withSpinner('Redeeming token', async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 5000);
+        try {
+            const body = { token };
+            if (optionalDisplayName !== undefined && optionalDisplayName.length > 0) {
+                body.name = optionalDisplayName;
+            }
+            const res = await fetch(`${siteUrl}/auth/redeem-connect-token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (!res.ok) {
+                let errorCode = 'unknown_error';
+                let errorMessage = `Server returned ${res.status}`;
+                try {
+                    const errorData = (await res.json());
+                    if (errorData.error?.code) {
+                        errorCode = errorData.error.code;
+                        errorMessage = errorData.error.message ?? errorMessage;
+                    }
+                }
+                catch {
+                    // Failed to parse error JSON — use default message
+                }
+                // Map error codes to user-friendly messages
+                if (errorCode === 'invalid_token' || res.status === 400) {
+                    throw new CLIError('Token is invalid, expired, or already used. Get a new token from your onboarding link.', {
+                        code: ErrorCode.AUTH_INVALID,
+                        category: 'auth',
+                        guidance: `Tried gateway: ${siteUrl}\nVisit ${APP_URL} to get a new onboarding link, or contact support.\n\nIf your token came from a different Convex deployment, use:\n  pb connect --gateway <your-deployment>.convex.site <token>\nor set CONVEX_SITE_URL in your environment.`,
+                    });
+                }
+                if (errorCode === 'workspace_not_found' || res.status === 404) {
+                    throw new CLIError('Workspace not found. The token may be from a deleted workspace.', {
+                        code: ErrorCode.AUTH_DENIED,
+                        category: 'auth',
+                        guidance: 'Contact support for help.',
+                    });
+                }
+                throw new CLIError(`Token redemption failed: ${errorMessage}`, {
+                    code: ErrorCode.AUTH_INVALID,
+                    category: 'auth',
+                    guidance: `Visit ${APP_URL} to get a new onboarding link.`,
+                });
+            }
+            const json = (await res.json());
+            // Check for error response (has error field)
+            if ('error' in json && json.error) {
+                const errorCode = json.error.code || 'unknown_error';
+                const errorMessage = json.error.message || 'Token redemption failed';
+                throw new CLIError(errorCode === 'invalid_token' ? 'Token is invalid, expired, or already used.' : errorMessage, {
+                    code: ErrorCode.AUTH_INVALID,
+                    category: 'auth',
+                    guidance: `Visit ${APP_URL} to get a new onboarding link.`,
+                });
+            }
+            return json;
+        }
+        catch (err) {
+            clearTimeout(timer);
+            // Re-throw CLIErrors (validation failures)
+            if (err instanceof CLIError)
+                throw err;
+            // Network/timeout error
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg === 'fetch failed' || msg.includes('ECONNREFUSED') || msg.includes('ENOTFOUND')) {
+                throw new CLIError('Could not reach ProductBrain. Check your internet connection.', {
+                    code: ErrorCode.NETWORK_UNREACHABLE,
+                    category: 'network',
+                    guidance: 'Check your connection, then try again: pb connect <token>',
+                });
+            }
+            // Unknown error
+            throw new CLIError(`Network error: ${msg}`, {
+                code: ErrorCode.NETWORK_UNREACHABLE,
+                category: 'network',
+                guidance: 'Check your internet connection and try again.',
+            });
+        }
+    });
+}
+/**
+ * Slugify workspace name for profile naming.
+ * Lowercase, replace spaces/special chars with hyphens, max 32 chars.
+ */
+function slugify(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, 32) || 'default';
+}
+/**
+ * Save API key as a named profile. Creates or updates the profile.
+ * Does NOT activate the profile globally — project config (.productbrain/config.json)
+ * handles per-project resolution. User can switch manually with `pb use <profile>`.
+ * Sets process.env for the current process only (so handshake works).
+ */
+function saveKeyAsProfile(apiKey, siteUrl, profileName) {
+    const existing = listProfiles();
+    if (existing.includes(profileName)) {
+        // Overwrite existing profile with fresh credentials (re-connect scenario)
+        const lines = [
+            `# Product Brain CLI profile: ${profileName}`,
+            `PRODUCTBRAIN_API_KEY=${apiKey}`,
+            ...(siteUrl ? [`CONVEX_SITE_URL=${siteUrl}`] : []),
+            '',
+        ];
+        mkdirSync(PROFILES_DIR, { recursive: true });
+        writeFileSync(resolve(PROFILES_DIR, `${profileName}.env`), lines.join('\n'), { mode: 0o600 });
+    }
+    else {
+        createProfile(profileName, apiKey, siteUrl);
+    }
+    // Don't call useProfile() — that hijacks the global active profile.
+    // Project config pins the workspace per-project instead.
+    process.env.PRODUCTBRAIN_API_KEY = apiKey;
+    process.env.CONVEX_SITE_URL = siteUrl;
+}
+/**
+ * Write project config files to pin this project to the workspace.
+ * Returns the prior repo profile pin so the caller can detect a workspace redirect.
+ *
+ * Split design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ *   Strips any legacy `profile` field that may be present from earlier pb versions.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed.
+ *   Written via the shared setLocalProfilePin() writer (used by `pb profile use --local`
+ *   and `pb connect`).
+ *
+ * Does NOT include the API key anywhere — that stays in profiles, never committed.
+ */
+export function saveProjectConfig(siteUrl, profileName) {
+    const configDir = resolve(process.cwd(), '.productbrain');
+    const configPath = resolve(configDir, 'config.json');
+    mkdirSync(configDir, { recursive: true });
+    // Capture the prior repo pin BEFORE we overwrite it (redirect detection).
+    const previous = readLocalProjectConfig()?.profile ?? null;
+    // --- config.json: siteUrl only (committed). Strip legacy `profile` field. ---
+    let existingCommitted = {};
+    if (existsSync(configPath)) {
+        try {
+            existingCommitted = JSON.parse(readFileSync(configPath, 'utf8'));
+        }
+        catch { /* ignore */ }
+    }
+    delete existingCommitted['profile'];
+    writeFileSync(configPath, JSON.stringify({ ...existingCommitted, siteUrl }, null, 2) + '\n');
+    // --- config.local.json: profile pin (gitignored) via the shared writer ---
+    setLocalProfilePin(process.cwd(), profileName);
+    return { previousProfile: previous && previous !== profileName ? previous : null };
+}
+/**
+ * Refuse a connect that can never run the confirm gate — BEFORE the one-time token is
+ * redeemed (WP-2 / TEN-2561). A non-interactive shell (no TTY / --quiet / --json) without
+ * `--yes` can never see or confirm the workspace, so fail closed here rather than redeeming
+ * first and burning the token on a gate we were always going to fail. Because this runs
+ * pre-redeem, the token is untouched — the same token still works once the caller adds
+ * `--yes` (or moves to an interactive terminal). `assumeYes` (`--yes`) is the explicit
+ * headless opt-in for scripted/CI connects.
+ */
+function assertConnectableNonInteractively(assumeYes) {
+    if (isInteractive() || assumeYes)
+        return;
+    throw new CLIError('Refusing to connect without confirmation — this is not an interactive terminal.', {
+        code: ErrorCode.NON_INTERACTIVE,
+        category: 'config',
+        guidance: 'Run `pb connect <token>` in an interactive terminal to confirm the workspace, or pass ' +
+            '--yes to confirm non-interactively (e.g. in CI). Your token has not been used — the same ' +
+            'token still works.',
+    });
+}
+/**
+ * Confirm-first gate (WP-2 / TEN-2561): bind this folder to the redeemed workspace
+ * only after the operator confirms WHICH workspace they're connecting to — before any
+ * local write (key-as-profile, project pin, context sync). A wrong-Chain bind must never
+ * happen silently; the user only used to learn the workspace *after* it was written.
+ *
+ * The gate sits *after* redeemToken: the workspace name comes from the redeem result, so
+ * the one-time token is already consumed by the time we ask. A decline therefore cannot be
+ * retried with the same token — guidance tells the user to request a fresh onboarding link.
+ *
+ * Non-interactive callers are refused earlier, before the token is redeemed
+ * (assertConnectableNonInteractively), so by here we are interactive — or `assumeYes`
+ * opted out of the prompt. confirm()'s own assertInteractive() remains the fail-closed
+ * backstop.
+ *
+ * @returns true to proceed with local writes, false if the operator declined interactively.
+ */
+async function confirmWorkspaceBinding(workspaceName, assumeYes) {
+    if (assumeYes)
+        return true;
+    return confirm({
+        message: `Connect this folder to "${workspaceName}"?`,
+        initialValue: true,
+    });
+}
+/**
+ * Optional label to send with redeem — omit when empty or default so server applies `Product Brain CLI`.
+ */
+async function resolveOptionalRedeemDisplayName(options) {
+    const fromFlag = options.name !== undefined ? trimClientKeyLabelInput(options.name) : '';
+    if (fromFlag.length > 0) {
+        return fromFlag;
+    }
+    // Honor the same interactivity gate as the confirm prompt (isInteractive: TTY + not
+    // --quiet/--json). Raw isatty() would prompt for a key label in a TTY even under
+    // --quiet/--json — blocking scripted use right before the gate fails (TEN-2561).
+    if (!isInteractive()) {
+        return undefined;
+    }
+    const entered = await clack.text({
+        message: 'Name this key (optional — shown in workspace settings)',
+        placeholder: CONNECT_REDEEM_DEFAULT_API_KEY_NAME,
+        initialValue: CONNECT_REDEEM_DEFAULT_API_KEY_NAME,
+    });
+    if (clack.isCancel(entered)) {
+        process.exit(130);
+    }
+    const trimmed = typeof entered === 'string' ? trimClientKeyLabelInput(entered) : '';
+    if (trimmed.length === 0 || trimmed === CONNECT_REDEEM_DEFAULT_API_KEY_NAME) {
+        return undefined;
+    }
+    return trimmed;
+}
+/**
+ * Main entrypoint for `pb connect <token>`.
+ * Validates token format, redeems it via /auth/redeem-connect-token,
+ * saves the key, and runs the wizard (S3).
+ */
+export async function runConnect(token, options = {}) {
+    // 1. Validate token format
+    const formatError = validateTokenFormat(token);
+    if (formatError) {
+        throw new CLIError(formatError, {
+            code: ErrorCode.AUTH_INVALID,
+            category: 'auth',
+            guidance: `Usage: pb connect <token>\nToken must start with '${CONNECT_TOKEN_PREFIX}' and be at least 30 characters long.`,
+        });
+    }
+    // 2. Resolve cloud Convex gateway (--gateway → env → CONVEX_SITE_URL → production)
+    const siteUrl = resolveConnectRedeemUrl(options.gateway);
+    // 3. Confirm-first gate, part 1 (WP-2): refuse a non-interactive connect that can't run
+    //    the workspace-confirm BEFORE redeeming, so the one-time token is never burned on a
+    //    gate we were always going to fail. --yes is the explicit headless opt-in.
+    assertConnectableNonInteractively(options.assumeYes === true);
+    const redeemLabel = await resolveOptionalRedeemDisplayName(options);
+    const result = await redeemToken(token, siteUrl, redeemLabel);
+    // workspaceName is server-controlled — strip ANSI/control chars before it reaches any
+    // terminal output (prompt, errors, the wizard) to prevent terminal escape injection
+    // (BET-269 C3 baseline). slugify() below independently sanitizes the profile/file name.
+    const workspaceName = stripControlChars(result.workspaceName);
+    // 4. Confirm-first gate, part 2 (WP-2): name the workspace and bind only after the
+    //    operator confirms — BEFORE any local write. Decline ⇒ nothing written; machine untouched.
+    const confirmed = await confirmWorkspaceBinding(workspaceName, options.assumeYes === true);
+    if (!confirmed) {
+        process.stderr.write(`Cancelled — nothing saved. This folder is not connected to "${workspaceName}".\n` +
+            `Note: the one-time token was already used; request a fresh onboarding link to connect.\n`);
+        return;
+    }
+    // 5. Save API key as named profile + pin project config
+    const profileName = slugify(result.workspaceName);
+    saveKeyAsProfile(result.apiKey, siteUrl, profileName);
+    const { previousProfile } = saveProjectConfig(siteUrl, profileName);
+    if (previousProfile) {
+        process.stderr.write(`⚠ This repo was connected to "${previousProfile}"; now redirecting to "${profileName}" (${workspaceName}). Previous session was reset — run \`pb session start\` to begin a new one.\n`);
+        // The repo's effective workspace changed — drop ALL stale session markers (Codex review fix:
+        // not just the current conversation's) so the next `pb session start` on ANY conversation
+        // doesn't auto-resume against the old workspace.
+        discardAllSessions();
+    }
+    // 6. Post-connect context + summary. Interactive: the Ink wizard (ConnectedScreen +
+    //    ProfileScreen) waits on keypresses via useInput, which needs raw-mode stdin. A
+    //    headless `--yes` connect (no TTY, e.g. CI) can't provide that — rendering Ink there
+    //    throws AFTER the key/config were written — so it gets a plain-text summary instead
+    //    (TEN-2561 / WP-2). Both prepare the same workspace context first.
+    if (isInteractive()) {
+        await runConnectScreens(workspaceName, profileName);
+    }
+    else {
+        await runConnectHeadless(workspaceName, profileName);
+    }
+    // 8. Tailored chat handoff — detect AI tool and print one-line instruction (FEAT-1291).
+    //    Replaces the 4-option clack.select menu that exited on cancel (TEN-1992).
+    const cwd = process.cwd();
+    const markers = detectHandoffMarkers(cwd);
+    const handoff = resolveHandoff(markers);
+    process.stdout.write('\n');
+    printHandoff(process.stdout, handoff);
+    process.stdout.write('\n');
+}
+//# sourceMappingURL=connect.js.map

package/dist/commands/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACN,mCAAmC,EACnC,uBAAuB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;AAiBhC;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5C,OAAO,gDAAgD,oBAAoB,IAAI,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,OAAO,2BAA2B,KAAK,CAAC,MAAM,uBAAuB,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,KAAa,EACb,OAAe,EACf,mBAA4B;IAE5B,OAAO,WAAW,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAqC,EAAE,KAAK,EAAE,CAAC;YACzD,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;YAClC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,4BAA4B,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,SAAS,GAAG,eAAe,CAAC;gBAChC,IAAI,YAAY,GAAG,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC;gBAEnD,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0E,CAAC;oBAC9G,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;wBAC1B,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;wBACjC,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC;oBACzD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,mDAAmD;gBACrD,CAAC;gBAED,4CAA4C;gBAC5C,IAAI,SAAS,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxD,MAAM,IAAI,QAAQ,CAChB,wFAAwF,EACxF;wBACE,IAAI,EAAE,SAAS,CAAC,YAAY;wBAC5B,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,kBAAkB,OAAO,WAAW,OAAO,8NAA8N;qBACpR,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,SAAS,KAAK,qBAAqB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9D,MAAM,IAAI,QAAQ,CAAC,iEAAiE,EAAE;wBACpF,IAAI,EAAE,SAAS,CAAC,WAAW;wBAC3B,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,2BAA2B;qBACtC,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,IAAI,QAAQ,CAAC,4BAA4B,YAAY,EAAE,EAAE;oBAC7D,IAAI,EAAE,SAAS,CAAC,YAAY;oBAC5B,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,SAAS,OAAO,gCAAgC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2F,CAAC;YAE1H,6CAA6C;YAC7C,IAAI,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC;gBACrD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC;gBACrE,MAAM,IAAI,QAAQ,CAChB,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,YAAY,EAC5F;oBACE,IAAI,EAAE,SAAS,CAAC,YAAY;oBAC5B,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,SAAS,OAAO,gCAAgC;iBAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAsB,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,2CAA2C;YAC3C,IAAI,GAAG,YAAY,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAEvC,wBAAwB;YACxB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;oBAClF,IAAI,EAAE,SAAS,CAAC,mBAAmB;oBACnC,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,2DAA2D;iBACtE,CAAC,CAAC;YACL,CAAC;YAED,gBAAgB;YAChB,MAAM,IAAI,QAAQ,CAAC,kBAAkB,GAAG,EAAE,EAAE;gBAC1C,IAAI,EAAE,SAAS,CAAC,mBAAmB;gBACnC,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,+CAA+C;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe,EAAE,WAAmB;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,MAAM,KAAK,GAAG;YACZ,gCAAgC,WAAW,EAAE;YAC7C,wBAAwB,MAAM,EAAE;YAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,EAAE;SACH,CAAC;QACF,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,WAAW,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,oEAAoE;IACpE,yDAAyD;IACzD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,WAAmB;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACrD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,sBAAsB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;IAE3D,+EAA+E;IAC/E,IAAI,iBAAiB,GAA4B,EAAE,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACpC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE7F,4EAA4E;IAC5E,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IAE/C,OAAO,EAAE,eAAe,EAAE,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrF,CAAC;AAeD;;;;;;;;GAQG;AACH,SAAS,iCAAiC,CAAC,SAAkB;IAC3D,IAAI,aAAa,EAAE,IAAI,SAAS;QAAE,OAAO;IACzC,MAAM,IAAI,QAAQ,CAChB,iFAAiF,EACjF;QACE,IAAI,EAAE,SAAS,CAAC,eAAe;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EACN,wFAAwF;YACxF,2FAA2F;YAC3F,oBAAoB;KACvB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CAAC,aAAqB,EAAE,SAAkB;IAC9E,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3B,OAAO,OAAO,CAAC;QACb,OAAO,EAAE,2BAA2B,aAAa,IAAI;QACrD,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gCAAgC,CAAC,OAAuB;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,oFAAoF;IACpF,iFAAiF;IACjF,iFAAiF;IACjF,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;QAC/B,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,mCAAmC;QAChD,YAAY,EAAE,mCAAmC;KAClD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,mCAAmC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,UAA0B,EAAE;IAC1E,2BAA2B;IAC3B,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE;YAC9B,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,qDAAqD,oBAAoB,uCAAuC;SAC3H,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,wFAAwF;IACxF,wFAAwF;IACxF,+EAA+E;IAC/E,iCAAiC,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAG,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE9D,sFAAsF;IACtF,oFAAoF;IACpF,wFAAwF;IACxF,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,mFAAmF;IACnF,+FAA+F;IAC/F,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,aAAa,MAAM;YAChF,0FAA0F,CAC7F,CAAC;QACF,OAAO;IACT,CAAC;IAED,wDAAwD;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,EAAE,eAAe,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,eAAe,0BAA0B,WAAW,MAAM,aAAa,gFAAgF,CACzL,CAAC;QACF,6FAA6F;QAC7F,0FAA0F;QAC1F,iDAAiD;QACjD,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,yFAAyF;IACzF,wFAAwF;IACxF,uEAAuE;IACvE,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IACxF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/commands/connect.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Tests for pb connect command (FEAT-958 S2).
+ * Covers token parsing, redemption, error handling, and key saving.
+ */
+export {};
+//# sourceMappingURL=connect.test.d.ts.map

package/dist/commands/connect.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.test.d.ts","sourceRoot":"","sources":["../../src/commands/connect.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}