@qoren/cli 0.1.0

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,uCAAuC;AACvC,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAiBnD,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAe,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,4EAA4E;QAC5E,0CAA0C;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,6EAA6E;IAC7E,+DAA+D;IAC/D,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,QAAiB;IAC3C,OAAO,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC,OAAO,IAAI,SAAS,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,gBAAgB;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,gBAAgB;KACzE,CAAC;AACJ,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,CACL,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE;QACjC,cAAc,CAAC,EAAE,CAAC,EAAE,OAAO;QAC3B,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAgB;IACxD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,mBAAmB,CAAC;QAClB,GAAG,MAAM;QACT,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE;KAClD,CAAC,CAAC;AACL,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAuB;IAChE,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,mBAAmB,CAAC;QAClB,GAAG,MAAM;QACT,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,mBAAmB,CAAC;QAClB,GAAG,MAAM;QACT,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,52 @@
+import { Qoren, QorenError } from "@qoren/sdk";
+import { type Profile } from "./config.js";
+export declare const VERSION = "0.1.0";
+export type GlobalOptions = {
+    json?: boolean;
+    profile?: string;
+    apiUrl?: string;
+    color?: boolean;
+};
+export type Context = {
+    qoren: Qoren;
+    profile: Profile;
+    profileName: string;
+};
+/**
+ * The org's plan does not include API access (a 403 with `code:
+ * "api_access_required"`). The token is fine, so this is a plan problem (exit
+ * 4), not a credential one (exit 3): logging in again would fail identically.
+ *
+ * Read off the code rather than the SDK's `isApiAccessRequired`, so a CLI
+ * built against an older SDK still tells the two apart.
+ */
+export declare function isApiAccessRequired(err: unknown): boolean;
+/**
+ * The caller's organization is being deleted (a 403 with `code:
+ * "org_deleting"`). Logging in again cannot help, so the server's message,
+ * which says what is happening, is shown instead of "credentials rejected".
+ */
+export declare function isOrgDeleting(err: unknown): boolean;
+/** Build the client for this invocation, or explain how to get one. */
+export declare function requireContext(options: GlobalOptions): Context;
+/**
+ * The org's fleet tenant slug, which creating an environment needs.
+ *
+ * Cached in the profile after the first lookup: it never changes for an
+ * account, and paying a round trip for it on every `env create` would be a
+ * waste. An explicit --org always wins.
+ */
+export declare function orgSlug(ctx: Context, explicit?: string): Promise<string>;
+/**
+ * Run a command body and turn whatever it throws into an exit code.
+ *
+ * The distinctions that matter to someone scripting this: 3 means the
+ * credential is the problem (log in again), 4 means the plan is (upgrade), 1
+ * means the request itself failed. Anything else would make a CI job unable to
+ * tell "my token expired" from "that environment doesn't exist".
+ */
+export declare function run(body: () => Promise<void>): (...args: never[]) => Promise<void>;
+/** The exit code for an Agent Designer refusal, or null when this is not one.
+ * A plan limit is a plan problem (4); owner-only is a plain failure (1). */
+export declare function designerRefusal(err: QorenError): number | null;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,aAAa,CAAC;AAarB,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMzD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEnD;AAGD,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAoB9D;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,OAAO,EACZ,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CACjB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACxB,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAQrC;AAiED;4EAC4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAW9D"}

package/dist/context.js

@@ -0,0 +1,163 @@
+import { Qoren, QorenError } from "@qoren/sdk";
+import { patchProfile, profileName, resolveProfile, } from "./config.js";
+import { EXIT_AUTH, EXIT_ERROR, EXIT_PAYMENT, fail, isJsonMode, } from "./output.js";
+import { issuesFromBody, printIssues } from "./issues.js";
+// What every command needs: an authenticated client, and one place that turns a
+// control-plane failure into an exit code and a sentence worth reading.
+export const VERSION = "0.1.0";
+class AuthRequired extends Error {
+}
+/**
+ * The org's plan does not include API access (a 403 with `code:
+ * "api_access_required"`). The token is fine, so this is a plan problem (exit
+ * 4), not a credential one (exit 3): logging in again would fail identically.
+ *
+ * Read off the code rather than the SDK's `isApiAccessRequired`, so a CLI
+ * built against an older SDK still tells the two apart.
+ */
+export function isApiAccessRequired(err) {
+    return (err instanceof QorenError &&
+        err.status === 403 &&
+        err.code === API_ACCESS_REQUIRED);
+}
+const API_ACCESS_REQUIRED = "api_access_required";
+/**
+ * The caller's organization is being deleted (a 403 with `code:
+ * "org_deleting"`). Logging in again cannot help, so the server's message,
+ * which says what is happening, is shown instead of "credentials rejected".
+ */
+export function isOrgDeleting(err) {
+    return err instanceof QorenError && err.status === 403 && err.code === "org_deleting";
+}
+const PRICING_URL = "https://qoren.sh/pricing";
+/** Build the client for this invocation, or explain how to get one. */
+export function requireContext(options) {
+    const name = profileName(options.profile);
+    const profile = resolveProfile({
+        ...(options.profile !== undefined ? { profile: options.profile } : {}),
+        ...(options.apiUrl !== undefined ? { baseUrl: options.apiUrl } : {}),
+    });
+    if (!profile) {
+        throw new AuthRequired("You are not signed in. Run `qoren login`, or set QOREN_TOKEN.");
+    }
+    return {
+        qoren: new Qoren({
+            baseUrl: profile.baseUrl,
+            token: profile.token,
+            userAgent: `qoren-cli/${VERSION}`,
+        }),
+        profile,
+        profileName: name,
+    };
+}
+/**
+ * The org's fleet tenant slug, which creating an environment needs.
+ *
+ * Cached in the profile after the first lookup: it never changes for an
+ * account, and paying a round trip for it on every `env create` would be a
+ * waste. An explicit --org always wins.
+ */
+export async function orgSlug(ctx, explicit) {
+    if (explicit)
+        return explicit;
+    if (ctx.profile.orgSlug)
+        return ctx.profile.orgSlug;
+    const slug = await ctx.qoren.resolveOrgSlug();
+    patchProfile(ctx.profileName, { orgSlug: slug });
+    return slug;
+}
+/**
+ * Run a command body and turn whatever it throws into an exit code.
+ *
+ * The distinctions that matter to someone scripting this: 3 means the
+ * credential is the problem (log in again), 4 means the plan is (upgrade), 1
+ * means the request itself failed. Anything else would make a CI job unable to
+ * tell "my token expired" from "that environment doesn't exist".
+ */
+export function run(body) {
+    return async () => {
+        try {
+            await body();
+        }
+        catch (err) {
+            process.exitCode = report(err);
+        }
+    };
+}
+function report(err) {
+    if (err instanceof AuthRequired) {
+        fail(err.message);
+        return EXIT_AUTH;
+    }
+    if (err instanceof QorenError) {
+        // Checked before isAuthError: it is a 403, but signing in again is not the
+        // fix. The server's message names the plans that include API access.
+        // (A boolean, not a type guard: a guard would narrow QorenError out of
+        // every branch below.)
+        if (isApiAccessRequired(err)) {
+            fail(err.message ||
+                `Your plan does not include API access. Upgrade at ${PRICING_URL}.`, isJsonMode() ? err.body : undefined);
+            return EXIT_PAYMENT;
+        }
+        // Agent Designer refusals. They are 403s, but the credential is fine: the
+        // plan has no Custom agents (or no more of them), or only the owner may
+        // make this change. Sending someone to sign in again would be wrong.
+        const designer = designerRefusal(err);
+        if (designer !== null) {
+            fail(err.message, isJsonMode() ? err.body : undefined);
+            return designer;
+        }
+        if (err.isAuthError) {
+            fail(err.status === 401
+                ? "Your credentials were rejected. Run `qoren login` again, or check QOREN_TOKEN."
+                : err.message);
+            return EXIT_AUTH;
+        }
+        if (err.isPaymentRequired) {
+            fail("This action needs an active plan. Open Qoren in a browser to choose one.");
+            return EXIT_PAYMENT;
+        }
+        // A 422 from a create carries the safety review's findings. They are the
+        // whole reason the call was refused, so print them rather than the summary
+        // line alone.
+        const findings = safetyFindings(err.body);
+        fail(err.message, isJsonMode() ? err.body : undefined);
+        // A design refused for its problems (422 validation_failed) lists them.
+        const issues = issuesFromBody(err.body);
+        if (!isJsonMode() && issues.length > 0)
+            printIssues(issues);
+        if (!isJsonMode() && findings.length > 0) {
+            for (const finding of findings) {
+                process.stderr.write(`  ${finding.severity}: ${finding.title}\n    ${finding.suggestion}\n`);
+            }
+        }
+        return EXIT_ERROR;
+    }
+    fail(err instanceof Error ? err.message : String(err));
+    return EXIT_ERROR;
+}
+/** The exit code for an Agent Designer refusal, or null when this is not one.
+ * A plan limit is a plan problem (4); owner-only is a plain failure (1). */
+export function designerRefusal(err) {
+    if (err.status !== 403)
+        return null;
+    switch (err.code) {
+        case "designer_disabled":
+        case "custom_agent_limit":
+            return EXIT_PAYMENT;
+        case "designer_owner_only":
+            return EXIT_ERROR;
+        default:
+            return null;
+    }
+}
+function safetyFindings(body) {
+    if (body &&
+        typeof body === "object" &&
+        "safetyFindings" in body &&
+        Array.isArray(body.safetyFindings)) {
+        return body.safetyFindings;
+    }
+    return [];
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,IAAI,EACJ,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D,gFAAgF;AAChF,wEAAwE;AAExE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAe/B,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,mBAAmB,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC;AACxF,CAAC;AACD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,aAAa,OAAO,EAAE;SAClC,CAAC;QACF,OAAO;QACP,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAY,EACZ,QAAiB;IAEjB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IAC9C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CACjB,IAAyB;IAEzB,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,qEAAqE;QACrE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CACF,GAAG,CAAC,OAAO;gBACT,qDAAqD,WAAW,GAAG,EACrE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CACpC,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CACF,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,GAAG,CAAC,OAAO,CAChB,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC1B,IAAI,CACF,0EAA0E,CAC3E,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,cAAc;QACd,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvD,wEAAwE;QACxE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,SAAS,OAAO,CAAC,UAAU,IAAI,CACvE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,mBAAmB,CAAC;QACzB,KAAK,oBAAoB;YACvB,OAAO,YAAY,CAAC;QACtB,KAAK,qBAAqB;YACxB,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAID,SAAS,cAAc,CAAC,IAAa;IACnC,IACE,IAAI;QACJ,OAAO,IAAI,KAAK,QAAQ;QACxB,gBAAgB,IAAI,IAAI;QACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAClC,CAAC;QACD,OAAO,IAAI,CAAC,cAA2B,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/duration.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Seconds for a duration like `30m`, `2h` or `3d`, or null when it is not one.
+ *
+ * A bare number is refused rather than guessed at: "7" could be days or seconds
+ * depending on what the reader had in mind, and getting that wrong on a public
+ * link is the difference between a week and a moment.
+ */
+export declare function parseDuration(input: string): number | null;
+//# sourceMappingURL=duration.d.ts.map

package/dist/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../src/duration.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM1D"}

package/dist/duration.js

@@ -0,0 +1,30 @@
+// Reading a human duration off the command line.
+//
+// The API takes seconds, because a client has no reason to produce or parse
+// "3d". A person at a terminal has every reason not to type 259200, so the flag
+// takes the short form and this turns it into the number the wire wants. Same
+// vocabulary the agent-facing files_share tool accepts, so a duration copied
+// from the docs works in either place.
+const UNITS = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+};
+/**
+ * Seconds for a duration like `30m`, `2h` or `3d`, or null when it is not one.
+ *
+ * A bare number is refused rather than guessed at: "7" could be days or seconds
+ * depending on what the reader had in mind, and getting that wrong on a public
+ * link is the difference between a week and a moment.
+ */
+export function parseDuration(input) {
+    const match = /^\s*(\d+)\s*([smhd])\s*$/i.exec(input);
+    if (!match)
+        return null;
+    const amount = Number.parseInt(match[1], 10);
+    if (!Number.isFinite(amount) || amount <= 0)
+        return null;
+    return amount * UNITS[match[2].toLowerCase()];
+}
+//# sourceMappingURL=duration.js.map

package/dist/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../src/duration.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,uCAAuC;AAEvC,MAAM,KAAK,GAA2B;IACpC,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,EAAE;IACL,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAE,CAAC;AAClD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { argvForInteractive, buildProgram } from "./program.js";
+import { EXIT_ERROR, EXIT_USAGE, fail } from "./output.js";
+// The `qoren` binary. The command tree lives in program.ts; this only runs it
+// and decides what the shell sees.
+async function main() {
+    try {
+        await buildProgram().parseAsync(argvForInteractive(process.argv));
+    }
+    catch (err) {
+        const code = err.code;
+        // Commander signals --help and --version by throwing. Neither is a failure.
+        if (code === "commander.helpDisplayed" || code === "commander.version") {
+            return;
+        }
+        if (code?.startsWith("commander.")) {
+            process.exitCode = EXIT_USAGE;
+            return;
+        }
+        // A command body handles its own errors (see context.run); anything
+        // arriving here is unexpected, so report it rather than dying silently.
+        fail(err instanceof Error ? err.message : String(err));
+        process.exitCode = EXIT_ERROR;
+    }
+}
+void main();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE3D,8EAA8E;AAC9E,mCAAmC;AAEnC,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,YAAY,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,4EAA4E;QAC5E,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/issues.d.ts

@@ -0,0 +1,10 @@
+import type { DesignIssue } from "@qoren/sdk";
+/** The issues a 422 body carries, or an empty list. */
+export declare function issuesFromBody(body: unknown): DesignIssue[];
+export declare function hasErrors(issues: DesignIssue[]): boolean;
+/** One line per issue, errors first: severity, where, message, code. */
+export declare function formatIssue(issue: DesignIssue): string;
+export declare function printIssues(issues: DesignIssue[]): void;
+/** "2 errors, 1 warning", or "no problems". */
+export declare function issueSummary(issues: DesignIssue[]): string;
+//# sourceMappingURL=issues.d.ts.map

package/dist/issues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../src/issues.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAU9C,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,EAAE,CAe3D;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAExD;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKtD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAMvD;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAQ1D"}

package/dist/issues.js

@@ -0,0 +1,45 @@
+import pc from "picocolors";
+// Showing what is wrong with a design.
+//
+// Import, publish, deploy and test runs all answer with the same list of
+// issues, either as data (a push) or inside a 422 (a publish refused). One
+// renderer, so a problem reads the same whichever command found it. Issues are
+// commentary on the result, so they go to stderr like every other note.
+/** The issues a 422 body carries, or an empty list. */
+export function issuesFromBody(body) {
+    if (body &&
+        typeof body === "object" &&
+        "issues" in body &&
+        Array.isArray(body.issues)) {
+        return body.issues.filter((i) => !!i &&
+            typeof i === "object" &&
+            typeof i.message === "string");
+    }
+    return [];
+}
+export function hasErrors(issues) {
+    return issues.some((i) => i.severity === "error");
+}
+/** One line per issue, errors first: severity, where, message, code. */
+export function formatIssue(issue) {
+    const where = [issue.nodeId, issue.path].filter(Boolean).join(" ");
+    const severity = issue.severity === "error" ? pc.red("error  ") : pc.yellow("warning");
+    return `  ${severity} ${where ? `${pc.bold(where)}: ` : ""}${issue.message} ${pc.dim(`(${issue.code})`)}`;
+}
+export function printIssues(issues) {
+    const sorted = [...issues].sort((a, b) => (a.severity === "error" ? 0 : 1) - (b.severity === "error" ? 0 : 1));
+    for (const issue of sorted)
+        process.stderr.write(`${formatIssue(issue)}\n`);
+}
+/** "2 errors, 1 warning", or "no problems". */
+export function issueSummary(issues) {
+    const errors = issues.filter((i) => i.severity === "error").length;
+    const warnings = issues.length - errors;
+    if (issues.length === 0)
+        return "no problems";
+    const part = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+    return [errors ? part(errors, "error") : "", warnings ? part(warnings, "warning") : ""]
+        .filter(Boolean)
+        .join(", ");
+}
+//# sourceMappingURL=issues.js.map

package/dist/issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.js","sourceRoot":"","sources":["../src/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,uCAAuC;AACvC,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AAExE,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IACE,IAAI;QACJ,OAAO,IAAI,KAAK,QAAQ;QACxB,QAAQ,IAAI,IAAI;QAChB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAC1B,CAAC;QACD,OAAQ,IAAI,CAAC,MAAoB,CAAC,MAAM,CACtC,CAAC,CAAC,EAAoB,EAAE,CACtB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,QAAQ;YACrB,OAAQ,CAAiB,CAAC,OAAO,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,KAAkB;IAC5C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACtE,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/jobProgress.d.ts

@@ -0,0 +1,12 @@
+import type { Job } from "@qoren/sdk";
+import type { Context } from "./context.js";
+/**
+ * Await a job, printing each step as it begins. Returns the finished job.
+ *
+ * Silent in --json mode: the caller emits the result as data, and progress
+ * chatter on stdout would corrupt it (see output.ts).
+ */
+export declare function followJob(ctx: Context, jobId: string, headline?: string): Promise<Job>;
+/** Step completion for `jobs ls`, e.g. "9/12". */
+export declare function jobSummary(job: Job): string;
+//# sourceMappingURL=jobProgress.d.ts.map

package/dist/jobProgress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobProgress.d.ts","sourceRoot":"","sources":["../src/jobProgress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAW,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAe5C;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,CA+Bd;AAED,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAG3C"}

package/dist/jobProgress.js

@@ -0,0 +1,56 @@
+import { dim, isJsonMode, note, statusColor } from "./output.js";
+// Following a job in a terminal.
+//
+// Deploying an agent is twelve steps over SSH and takes minutes. Printing
+// nothing for that long looks like a hang, and redrawing a live table breaks
+// the moment output is piped to a file. So: one line per step, printed once,
+// when that step starts. It reads as a log, works in CI, and never lies about
+// where the job has got to.
+function stepLabel(step) {
+    return step.label || step.key;
+}
+/**
+ * Await a job, printing each step as it begins. Returns the finished job.
+ *
+ * Silent in --json mode: the caller emits the result as data, and progress
+ * chatter on stdout would corrupt it (see output.ts).
+ */
+export async function followJob(ctx, jobId, headline) {
+    if (isJsonMode())
+        return ctx.qoren.jobs.await(jobId);
+    if (headline)
+        note(headline);
+    const announced = new Set();
+    let disconnected = false;
+    const job = await ctx.qoren.jobs.await(jobId, (snapshot) => {
+        if (!snapshot) {
+            // A retryable outage swallowed the poll. Say so once rather than every
+            // 2.5 seconds, and say it as "reconnecting" — the job itself is durable
+            // and still there.
+            if (!disconnected) {
+                disconnected = true;
+                note(dim("  reconnecting…"));
+            }
+            return;
+        }
+        disconnected = false;
+        for (const step of snapshot.steps) {
+            if (announced.has(step.key))
+                continue;
+            // Only announce a step once it has actually started; a queued step is
+            // not progress.
+            if (step.status === "Pending")
+                continue;
+            announced.add(step.key);
+            note(`  ${dim("·")} ${stepLabel(step)}`);
+        }
+    });
+    note(`  ${statusColor("Succeeded")} ${dim(`(job ${jobId})`)}`);
+    return job;
+}
+/** Step completion for `jobs ls`, e.g. "9/12". */
+export function jobSummary(job) {
+    const done = job.steps.filter((s) => s.status === "Succeeded").length;
+    return job.steps.length > 0 ? `${done}/${job.steps.length}` : "";
+}
+//# sourceMappingURL=jobProgress.js.map

package/dist/jobProgress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobProgress.js","sourceRoot":"","sources":["../src/jobProgress.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAE5B,SAAS,SAAS,CAAC,IAAa;IAC9B,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAY,EACZ,KAAa,EACb,QAAiB;IAEjB,IAAI,UAAU,EAAE;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAErD,IAAI,QAAQ;QAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,wEAAwE;YACxE,mBAAmB;YACnB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO;QACT,CAAC;QACD,YAAY,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACtC,sEAAsE;YACtE,gBAAgB;YAChB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACxC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,WAAW,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACtE,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/loopback.d.ts

@@ -0,0 +1,28 @@
+export type PkcePair = {
+    verifier: string;
+    challenge: string;
+};
+export declare function createPkcePair(): PkcePair;
+export type LoopbackResult = {
+    code: string;
+};
+/**
+ * Serve one redirect on a loopback port and resolve with the code it carries.
+ *
+ * `onReady` receives the redirect URI once the port is known, so the caller can
+ * build the authorize URL and open it. The server always shuts down: on
+ * success, on a mismatched state, and on timeout.
+ */
+export declare function awaitLoopbackCode(options: {
+    state: string;
+    timeoutMs: number;
+    onReady: (redirectUri: string) => void | Promise<void>;
+}): Promise<LoopbackResult>;
+/**
+ * Open a URL in the user's browser, best effort.
+ *
+ * Returns false when we could not, which is not an error: the caller prints the
+ * URL either way, and on a headless box printing it is the whole answer.
+ */
+export declare function openBrowser(url: string): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,wBAAgB,cAAc,IAAI,QAAQ,CAMzC;AAaD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD,GAAG,OAAO,CAAC,cAAc,CAAC,CAyE1B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBhD"}

package/dist/loopback.js

@@ -0,0 +1,110 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+export function createPkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return {
+        verifier,
+        challenge: createHash("sha256").update(verifier).digest("base64url"),
+    };
+}
+const PAGE = (title, body) => `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${title}</title>
+<style>
+  body{font:16px/1.6 system-ui,sans-serif;margin:0;display:grid;place-items:center;
+       min-height:100vh;background:#0b0d10;color:#e6e8eb}
+  main{max-width:32rem;padding:2rem;text-align:center}
+  h1{font-size:1.25rem;margin:0 0 .5rem}
+  p{margin:0;color:#9aa4b2}
+</style></head>
+<body><main><h1>${title}</h1><p>${body}</p></main></body></html>`;
+/**
+ * Serve one redirect on a loopback port and resolve with the code it carries.
+ *
+ * `onReady` receives the redirect URI once the port is known, so the caller can
+ * build the authorize URL and open it. The server always shuts down: on
+ * success, on a mismatched state, and on timeout.
+ */
+export async function awaitLoopbackCode(options) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            const done = (status, title, body) => {
+                res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+                res.end(PAGE(title, body));
+            };
+            if (!code || !state) {
+                done(400, "Something went wrong", "No authorization code arrived.");
+                return;
+            }
+            // A state mismatch means this redirect is not the one we started. Refuse
+            // it rather than accepting a code we cannot account for.
+            if (state !== options.state) {
+                done(400, "Something went wrong", "This response did not match the request.");
+                finish(() => reject(new Error("The sign-in response did not match the request.")));
+                return;
+            }
+            done(200, "You're signed in", "You can close this tab and return to your terminal.");
+            finish(() => resolve({ code }));
+        });
+        function finish(action) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            // Let the response flush before tearing the socket down.
+            setTimeout(() => server.close(), 100);
+            action();
+        }
+        const timer = setTimeout(() => {
+            finish(() => reject(new Error("Timed out waiting for the browser. Run `qoren login` again, or use `qoren login --token`.")));
+        }, options.timeoutMs);
+        server.on("error", (err) => finish(() => reject(err)));
+        // Port 0 = let the OS pick. 127.0.0.1 rather than localhost so we bind one
+        // known interface instead of whatever the resolver returns.
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address) {
+                finish(() => reject(new Error("Could not open a local port.")));
+                return;
+            }
+            void (async () => {
+                try {
+                    await options.onReady(`http://127.0.0.1:${address.port}/callback`);
+                }
+                catch (err) {
+                    finish(() => reject(err instanceof Error ? err : new Error(String(err))));
+                }
+            })();
+        });
+    });
+}
+/**
+ * Open a URL in the user's browser, best effort.
+ *
+ * Returns false when we could not, which is not an error: the caller prints the
+ * URL either way, and on a headless box printing it is the whole answer.
+ */
+export function openBrowser(url) {
+    const command = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "cmd"
+            : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => {
+            /* No browser here; the printed URL is the fallback. */
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=loopback.js.map

package/dist/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAiB3C,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE,CAAC;qDACO,KAAK;;;;;;;;kBAQxC,KAAK,WAAW,IAAI,2BAA2B,CAAC;AAIlE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAIvC;IACC,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;gBAC3D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC;YAEF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,gCAAgC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;gBAC9E,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YAED,IAAI,CACF,GAAG,EACH,kBAAkB,EAClB,qDAAqD,CACtD,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,SAAS,MAAM,CAAC,MAAkB;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,yDAAyD;YACzD,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,EAAE,CAAC;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,KAAK,CACP,2FAA2F,CAC5F,CACF,CACF,CAAC;QACJ,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAwB,CAAC;YACvD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,UAAU,CAAC;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,uDAAuD;QACzD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}