@seliseblocks/cli-os 0.1.2 → 0.1.3

package/dist/lib/auth.js

@@ -5,18 +5,7 @@ import { getClientSecret } from "./secret-store.js";
 import { CliActionableError } from "./errors.js";
 const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 const FALLBACK_IMPERSONATION_CLIENT_ID = "57214b67-aa9c-4307-92ab-a25e35180fac";
-export async function exchangeAuthorizationCode(args) {
-    const body = new URLSearchParams({
-        client_id: args.clientId,
-        code: args.code,
-        grant_type: "authorization_code",
-        redirect_uri: args.redirectUri
-    });
-    if (args.codeVerifier)
-        body.set("code_verifier", args.codeVerifier);
-    applyClientSecret(body, args.clientSecret);
-    return postFormToken(args.oidcUrl, body, args.rootTenantId);
-}
+const MAX_CONSECUTIVE_TRANSIENT_ERRORS = 3;
 export async function requestDeviceAuthorization(profile) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
@@ -45,34 +34,70 @@ export async function requestDeviceAuthorization(profile) {
     }
     return data;
 }
-export async function pollDeviceToken(profile, device) {
+export async function pollDeviceToken(profile, device, options = {}) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
         throw new Error("Device token polling requires rootTenantId in the account profile.");
     }
     let intervalSeconds = Math.max(device.interval ?? 5, 1);
     const deadline = Date.now() + device.expires_in * 1000;
+    let consecutiveTransientErrors = 0;
     while (Date.now() < deadline) {
-        await delay(intervalSeconds * 1000);
+        options.onWait?.(intervalSeconds);
+        await delay(Math.min(intervalSeconds * 1000, Math.max(deadline - Date.now(), 0)));
         const body = new URLSearchParams({
             client_id: profile.clientId,
             device_code: device.device_code,
             grant_type: DEVICE_GRANT
         });
         applyClientSecret(body, await getSecretForProfile(profile));
-        const response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
-        if (response.error === "authorization_pending")
+        let response;
+        try {
+            response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
+        }
+        catch (error) {
+            // The token endpoint itself never throws (postFormToken with
+            // throwOnOAuthError=false only returns error payloads) -- a thrown
+            // error here means fetch() failed before any response came back
+            // (DNS, connection reset, etc.). Treat it as transient and keep
+            // polling rather than aborting a multi-minute wait on one blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, error);
             continue;
+        }
+        if (response.error === "authorization_pending") {
+            consecutiveTransientErrors = 0;
+            continue;
+        }
         if (response.error === "slow_down") {
+            consecutiveTransientErrors = 0;
             intervalSeconds += 5;
             continue;
         }
+        if (response.error === "token_request_failed") {
+            // Synthetic error from postFormToken for a non-JSON HTTP failure
+            // (e.g. a 502 from an upstream proxy) -- not a real OAuth rejection,
+            // so treat it the same as a network blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, response.error_description ?? response.error);
+            continue;
+        }
+        if (response.error === "access_denied") {
+            throw new CliActionableError("Device authorization was denied.", "device_login_denied", "blocks-os login");
+        }
+        if (response.error === "expired_token") {
+            throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+        }
         if (response.error) {
-            throw new Error(response.error_description ?? response.error);
+            throw new CliActionableError(response.error_description ?? response.error, "device_login_failed", "blocks-os login");
         }
         return response;
     }
-    throw new Error("Device login expired before approval.");
+    throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+}
+function throwIfTooManyTransientErrors(count, cause) {
+    if (count <= MAX_CONSECUTIVE_TRANSIENT_ERRORS)
+        return;
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new CliActionableError(`Could not reach the identity provider while waiting for device approval (${detail}).`, "device_login_network_error", "Check your network connection and run 'blocks-os login' again.");
 }
 export async function getAccountSession(accountOverride) {
     let config = await readConfig();

package/dist/lib/config.d.ts

@@ -4,7 +4,6 @@ export type AccountProfile = {
     createdAt: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId?: string;
     scope: string;
     updatedAt: string;
@@ -31,9 +30,9 @@ export type BlocksCliConfig = {
 };
 export declare function defaults(): {
     apiUrl: string;
+    osClientId: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId: string;
     scope: string;
 };

package/dist/lib/config.js

@@ -1,19 +1,20 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
-const DEFAULT_API_URL = "https://api.seliseblocks.com";
+const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_API_URL = "https://os.seliseblocks.com";
+const DEFAULT_OS_CLIENT_ID = "4a633b13-1108-4fbf-84fd-b196c9dcdee2";
 const DEFAULT_OIDC_URL = "https://iam.seliseblocks.com";
 const DEFAULT_OS_URL = "https://os.seliseblocks.com";
-const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_PROFILE_TIMESTAMP = "2026-01-01T00:00:00.000Z";
 const DEFAULT_ROOT_TENANT_ID = "d7e5554c758541db8a18694b64ef423d";
 const DEFAULT_SCOPE = "openid profile offline_access";
-const DEFAULT_REDIRECT_URI = "http://127.0.0.1:8976/callback";
 export function defaults() {
     return {
         apiUrl: DEFAULT_API_URL,
+        osClientId: DEFAULT_OS_CLIENT_ID,
         oidcUrl: DEFAULT_OIDC_URL,
         osUrl: DEFAULT_OS_URL,
-        redirectUri: DEFAULT_REDIRECT_URI,
         rootTenantId: DEFAULT_ROOT_TENANT_ID,
         scope: DEFAULT_SCOPE
     };
@@ -40,9 +41,7 @@ export async function readConfig() {
     }
     catch (error) {
         if (error.code === "ENOENT") {
-            return {
-                accounts: {}
-            };
+            return defaultConfig();
         }
         throw error;
     }
@@ -61,7 +60,7 @@ export function normalizeAccountName(account) {
 export function getActiveAccountName(config, override) {
     const account = normalizeAccountName(override ?? config.activeAccount);
     if (!config.accounts[account]) {
-        throw new Error("OIDC account is not configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' first.");
+        throw new Error("OIDC account is not configured.");
     }
     return account;
 }
@@ -73,21 +72,54 @@ export function getAccountProfile(config, account) {
     };
 }
 function normalizeConfig(config) {
+    const env = defaults();
     const accounts = {};
     for (const [name, profile] of Object.entries(config.accounts ?? {})) {
-        accounts[name] = {
+        accounts[name] = name === "default" ? defaultProfile(profile) : {
             ...profile,
-            oidcUrl: profile.oidcUrl ?? DEFAULT_OIDC_URL,
-            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? DEFAULT_OS_URL : profile.osUrl,
-            rootTenantId: profile.rootTenantId ?? DEFAULT_ROOT_TENANT_ID
+            apiUrl: profile.apiUrl ?? env.apiUrl,
+            clientId: profile.clientId ?? env.osClientId,
+            createdAt: profile.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+            oidcUrl: profile.oidcUrl ?? env.oidcUrl,
+            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? env.osUrl : profile.osUrl,
+            rootTenantId: profile.rootTenantId ?? env.rootTenantId,
+            scope: profile.scope ?? env.scope,
+            updatedAt: profile.updatedAt ?? DEFAULT_PROFILE_TIMESTAMP
+        };
+    }
+    if (Object.keys(accounts).length === 0) {
+        return {
+            ...defaultConfig(),
+            selectedProject: config.selectedProject
         };
     }
     return {
-        activeAccount: config.activeAccount,
+        activeAccount: config.activeAccount ?? "default",
         accounts,
         selectedProject: config.selectedProject
     };
 }
+function defaultConfig() {
+    return {
+        activeAccount: "default",
+        accounts: {
+            default: defaultProfile()
+        }
+    };
+}
+function defaultProfile(existing) {
+    const env = defaults();
+    return {
+        apiUrl: env.apiUrl,
+        clientId: env.osClientId,
+        createdAt: existing?.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+        oidcUrl: env.oidcUrl,
+        osUrl: env.osUrl,
+        rootTenantId: env.rootTenantId,
+        scope: env.scope,
+        updatedAt: DEFAULT_PROFILE_TIMESTAMP
+    };
+}
 function nonEmptyEnv(name) {
     const value = process.env[name]?.trim();
     return value || undefined;

package/dist/lib/open-browser.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { platform } from "node:os";
+const LAUNCH_GRACE_PERIOD_MS = 500;
 export async function openBrowser(url) {
     const os = platform();
     const command = os === "win32" ? "rundll32" : os === "darwin" ? "open" : "xdg-open";
@@ -10,10 +11,32 @@ export async function openBrowser(url) {
             stdio: "ignore",
             windowsHide: true
         });
-        child.once("error", () => resolve(false));
-        child.once("spawn", () => {
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
+        child.once("error", () => settle(false));
+        // A launcher like xdg-open can spawn successfully and still exit
+        // non-zero almost immediately when no browser/display session is
+        // available (headless SSH, missing DISPLAY, etc.). Give it a short
+        // grace period to fail fast before treating the launch as a success
+        // and detaching the process.
+        const grace = setTimeout(() => {
             child.unref();
-            resolve(true);
+            settle(true);
+        }, LAUNCH_GRACE_PERIOD_MS);
+        child.once("exit", (code) => {
+            clearTimeout(grace);
+            if (code === 0 || code === null) {
+                child.unref();
+                settle(true);
+            }
+            else {
+                settle(false);
+            }
         });
     });
 }

package/dist/lib/secret-store.d.ts

@@ -17,7 +17,6 @@ export declare function writeSecretStore(store: BlocksSecretStore): Promise<void
 export declare function setClientSecret(account: string, clientSecret: string): Promise<void>;
 export declare function getClientSecret(account: string): Promise<string | undefined>;
 export declare function removeAccountSecrets(account: string): Promise<void>;
-export declare function clearSecretStore(): Promise<void>;
 export declare function setSecretValue(key: string, value: string): Promise<void>;
 export declare function getSecretValue(key: string): Promise<string | undefined>;
 export declare function removeSecretValue(key: string): Promise<void>;

package/dist/lib/secret-store.js

@@ -1,5 +1,5 @@
 import { execFile, spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { platform } from "node:os";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
@@ -57,9 +57,6 @@ export async function removeAccountSecrets(account) {
     await removeSecretValue(`client-secret:${account}`);
     await removeFallbackSecret(account);
 }
-export async function clearSecretStore() {
-    await rm(secretPath(), { force: true });
-}
 export async function setSecretValue(key, value) {
     const backend = await resolveBackend();
     if (backend === "macos-keychain") {

package/dist/lib/token-store.d.ts

@@ -15,4 +15,3 @@ export declare function tokenStoreInfo(): Promise<{
 export declare function readTokenStore(): Promise<BlocksTokenStore>;
 export declare function writeTokenStore(store: BlocksTokenStore): Promise<void>;
 export declare function removeAccountTokens(account: string): Promise<void>;
-export declare function clearTokenStore(): Promise<void>;

package/dist/lib/token-store.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { configDir, configPath } from "./config.js";
-import { getSecretValue, removeSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
+import { getSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
 const TOKEN_SECRET_KEY = "oauth-token-store";
 export function tokenPath() {
     return join(configDir(), "tokens.json");
@@ -56,10 +56,6 @@ export async function removeAccountTokens(account) {
     const { [account]: _, ...accounts } = store.accounts;
     await writeTokenStore({ accounts });
 }
-export async function clearTokenStore() {
-    await removeSecretValue(TOKEN_SECRET_KEY);
-    await rm(tokenPath(), { force: true });
-}
 function normalizeTokenStore(store) {
     return {
         accounts: store?.accounts ?? {}

package/dist/lib/token.d.ts

@@ -13,7 +13,6 @@ export type TokenResponse = {
     scope?: string;
     token_type?: string;
 };
-export declare function randomState(): string;
 export declare function expiresAtFromToken(response: TokenResponse, accessToken: string): string | undefined;
 export declare function expiresAtFromJwtFirst(response: TokenResponse, accessToken: string): string | undefined;
 export declare function refreshExpiresAtFromToken(response: TokenResponse, refreshToken?: string): string | undefined;

package/dist/lib/token.js

@@ -1,10 +1,6 @@
-import { randomBytes } from "node:crypto";
 import { decodeJwtPayload, tenantFromToken } from "./jwt.js";
 const EXPIRY_SKEW_MS = 60_000;
 const DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS = 30 * 60;
-export function randomState() {
-    return randomBytes(24).toString("base64url");
-}
 export function expiresAtFromToken(response, accessToken) {
     if (typeof response.expires_in === "number" && response.expires_in > 0) {
         return new Date(Date.now() + response.expires_in * 1000).toISOString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seliseblocks/cli-os",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "CLI for SELISE Blocks OS project setup and configuration.",
   "license": "MIT",
   "type": "module",

package/dist/commands/auth/add.d.ts

@@ -1 +0,0 @@
-export declare function authAdd(argv: string[]): Promise<void>;

package/dist/commands/auth/add.js

@@ -1,51 +0,0 @@
-import { parseFlags, stringFlag } from "../../lib/args.js";
-import { defaults, normalizeAccountName, readConfig, writeConfig } from "../../lib/config.js";
-import { promptSecret, promptValue } from "../../lib/prompt.js";
-import { getClientSecret, setClientSecret } from "../../lib/secret-store.js";
-export async function authAdd(argv) {
-    const { args, flags } = parseFlags(argv);
-    const account = normalizeAccountName(args[0]);
-    const current = await readConfig();
-    const previous = current.accounts[account];
-    const now = new Date().toISOString();
-    const apiUrl = stringFlag(flags, "api-url") || previous?.apiUrl || defaults().apiUrl;
-    const oidcUrl = stringFlag(flags, "oidc-url") || previous?.oidcUrl || defaults().oidcUrl;
-    const osUrl = stringFlag(flags, "os-url") || defaults().osUrl;
-    const clientId = await value(flags, "client-id", "OIDC client id", previous?.clientId);
-    const existingSecret = await getClientSecret(account);
-    const clientSecret = await value(flags, "client-secret", "OIDC client secret", existingSecret, true);
-    const scope = stringFlag(flags, "scope") || previous?.scope || defaults().scope;
-    const redirectUri = stringFlag(flags, "redirect-uri") || previous?.redirectUri || defaults().redirectUri;
-    const rootTenantId = optionalStringFlag(flags, "root-tenant") ?? previous?.rootTenantId ?? defaults().rootTenantId;
-    await writeConfig({
-        ...current,
-        activeAccount: current.activeAccount ?? account,
-        accounts: {
-            ...current.accounts,
-            [account]: {
-                apiUrl,
-                clientId,
-                createdAt: previous?.createdAt ?? now,
-                oidcUrl,
-                osUrl,
-                redirectUri,
-                rootTenantId,
-                scope,
-                updatedAt: now
-            }
-        }
-    });
-    await setClientSecret(account, clientSecret);
-    console.log(`Saved OIDC account '${account}'.`);
-}
-async function value(flags, name, label, defaultValue, secret = false) {
-    const flag = stringFlag(flags, name);
-    const resolved = flag || await (secret ? promptSecret(label, defaultValue) : promptValue(label, defaultValue));
-    if (!resolved)
-        throw new Error(`Missing --${name}`);
-    return resolved;
-}
-function optionalStringFlag(flags, name) {
-    const value = flags[name];
-    return typeof value === "string" && value ? value : undefined;
-}

package/dist/commands/auth/list.d.ts

@@ -1 +0,0 @@
-export declare function authList(argv?: string[]): Promise<void>;

package/dist/commands/auth/list.js

@@ -1,33 +0,0 @@
-import { parseFlags } from "../../lib/args.js";
-import { readConfig } from "../../lib/config.js";
-import { writeOutput } from "../../lib/output.js";
-export async function authList(argv = []) {
-    const { flags } = parseFlags(argv);
-    const config = await readConfig();
-    const names = Object.keys(config.accounts);
-    if (names.length === 0) {
-        if (flags.json) {
-            writeOutput({ activeAccount: config.activeAccount ?? null, accounts: [] }, flags);
-            return;
-        }
-        console.log("No OIDC accounts configured.");
-        return;
-    }
-    if (flags.json) {
-        writeOutput({
-            activeAccount: config.activeAccount ?? null,
-            accounts: names.map((name) => ({
-                name,
-                active: config.activeAccount === name,
-                apiUrl: config.accounts[name].apiUrl,
-                oidcUrl: config.accounts[name].oidcUrl
-            }))
-        }, flags);
-        return;
-    }
-    for (const name of names) {
-        const profile = config.accounts[name];
-        const active = config.activeAccount === name ? "*" : " ";
-        console.log(`${active} ${name}  ${profile.apiUrl}  ${profile.oidcUrl}`);
-    }
-}

package/dist/commands/auth/repair.d.ts

@@ -1 +0,0 @@
-export declare function authRepair(argv: string[]): Promise<void>;

package/dist/commands/auth/repair.js

@@ -1,39 +0,0 @@
-import { booleanFlag, parseFlags } from "../../lib/args.js";
-import { confirmMutation } from "../../lib/confirm.js";
-import { getAccountProfile, normalizeAccountName, readConfig } from "../../lib/config.js";
-import { writeOutput } from "../../lib/output.js";
-import { removeAccountSecrets } from "../../lib/secret-store.js";
-import { clearTokenStore } from "../../lib/token-store.js";
-export async function authRepair(argv) {
-    const { args, flags } = parseFlags(argv);
-    const config = await readConfig();
-    const account = args[0] ? normalizeAccountName(args[0]) : getAccountProfile(config).name;
-    if (!config.accounts[account]) {
-        throw new Error(`OIDC account '${account}' is not configured.`);
-    }
-    const result = {
-        account,
-        clearedClientSecret: true,
-        clearedTokenCache: "all accounts",
-        nextSteps: [
-            ["blocks-os auth:add", account === "default" ? "" : account, "--client-id <id>", "--client-secret <secret>"].filter(Boolean).join(" "),
-            `blocks-os login${account === "default" ? "" : ` --account ${account}`}`
-        ]
-    };
-    if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, ...result }, flags);
-        return;
-    }
-    await confirmMutation(flags, `Repair local auth state for '${account}'. This clears the account client secret and all cached OAuth tokens, but keeps account profile config.`);
-    await removeAccountSecrets(account);
-    await clearTokenStore();
-    if (flags.json) {
-        writeOutput(result, flags);
-        return;
-    }
-    console.log(`Repaired local auth state for '${account}'.`);
-    console.log("Client secret and cached OAuth tokens were cleared.");
-    console.log("Next:");
-    for (const step of result.nextSteps)
-        console.log(`  ${step}`);
-}

package/dist/commands/auth/show.d.ts

@@ -1 +0,0 @@
-export declare function authShow(argv: string[]): Promise<void>;

package/dist/commands/auth/show.js

@@ -1,23 +0,0 @@
-import { parseFlags, stringFlag } from "../../lib/args.js";
-import { getAccountProfile, readConfig } from "../../lib/config.js";
-import { getClientSecret, secretStoreInfo } from "../../lib/secret-store.js";
-export async function authShow(argv) {
-    const { args, flags } = parseFlags(argv);
-    const config = await readConfig();
-    const account = args[0] || stringFlag(flags, "account") || config.activeAccount;
-    const { name, profile } = getAccountProfile(config, account);
-    const secretInfo = await secretStoreInfo();
-    console.log(JSON.stringify({
-        account: name,
-        active: config.activeAccount === name,
-        apiUrl: profile.apiUrl,
-        clientId: profile.clientId,
-        clientSecret: await getClientSecret(name) ? "configured" : "missing",
-        secretStorage: secretInfo,
-        oidcUrl: profile.oidcUrl,
-        osUrl: profile.osUrl,
-        redirectUri: profile.redirectUri,
-        rootTenantId: profile.rootTenantId,
-        scope: profile.scope
-    }, null, 2));
-}

package/dist/commands/auth/use.d.ts

@@ -1 +0,0 @@
-export declare function authUse(argv: string[]): Promise<void>;

package/dist/commands/auth/use.js

@@ -1,15 +0,0 @@
-import { parseFlags } from "../../lib/args.js";
-import { normalizeAccountName, readConfig, writeConfig } from "../../lib/config.js";
-export async function authUse(argv) {
-    const { args } = parseFlags(argv);
-    const account = normalizeAccountName(args[0]);
-    const config = await readConfig();
-    if (!config.accounts[account]) {
-        throw new Error("OIDC account is not configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' first.");
-    }
-    await writeConfig({
-        ...config,
-        activeAccount: account
-    });
-    console.log(`Active account is now '${account}'.`);
-}

package/dist/commands/login-device.d.ts

@@ -1 +0,0 @@
-export declare function loginDevice(argv: string[]): Promise<void>;

package/dist/commands/login-device.js

@@ -1,6 +0,0 @@
-import { parseFlags, stringFlag } from "../lib/args.js";
-import { loginWithDeviceProfile } from "./login.js";
-export async function loginDevice(argv) {
-    const { flags } = parseFlags(argv);
-    await loginWithDeviceProfile(stringFlag(flags, "account"));
-}

package/dist/lib/login-server.d.ts

@@ -1 +0,0 @@
-export declare function waitForAuthorizationCode(port: number, expectedState?: string): Promise<string>;

package/dist/lib/login-server.js

@@ -1,43 +0,0 @@
-import { createServer } from "node:http";
-export async function waitForAuthorizationCode(port, expectedState) {
-    return new Promise((resolve, reject) => {
-        const server = createServer((request, response) => {
-            const url = new URL(request.url ?? "/", `http://127.0.0.1:${port}`);
-            if (url.pathname !== "/callback") {
-                response.writeHead(404);
-                response.end("Not found");
-                return;
-            }
-            const error = url.searchParams.get("error");
-            const code = url.searchParams.get("code");
-            const state = url.searchParams.get("state");
-            if (error) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end(`Blocks OS login failed: ${error}`);
-                server.close();
-                reject(new Error(error));
-                return;
-            }
-            if (expectedState && state !== expectedState) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end("Blocks OS login failed: invalid state");
-                server.close();
-                reject(new Error("Invalid authorization state"));
-                return;
-            }
-            if (!code) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end("Blocks OS login failed: missing code");
-                server.close();
-                reject(new Error("Missing authorization code"));
-                return;
-            }
-            response.writeHead(200, { "Content-Type": "text/plain" });
-            response.end("Blocks OS login complete. You can close this tab.");
-            server.close();
-            resolve(code);
-        });
-        server.on("error", reject);
-        server.listen(port, "127.0.0.1");
-    });
-}

package/dist/lib/pkce.d.ts

@@ -1,4 +0,0 @@
-export declare function createPkcePair(): {
-    challenge: string;
-    verifier: string;
-};

package/dist/lib/pkce.js

@@ -1,9 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-function base64Url(input) {
-    return input.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-export function createPkcePair() {
-    const verifier = base64Url(randomBytes(32));
-    const challenge = base64Url(createHash("sha256").update(verifier).digest());
-    return { challenge, verifier };
-}

package/dist/lib/prompt.d.ts

@@ -1,2 +0,0 @@
-export declare function promptValue(label: string, defaultValue?: string): Promise<string>;
-export declare function promptSecret(label: string, defaultValue?: string): Promise<string>;

package/dist/lib/prompt.js

@@ -1,36 +0,0 @@
-import { createInterface } from "node:readline";
-import { createInterface as createPromiseInterface } from "node:readline/promises";
-import { stdin as input, stdout as output } from "node:process";
-export async function promptValue(label, defaultValue) {
-    const rl = createPromiseInterface({ input, output });
-    try {
-        const suffix = defaultValue ? ` (${defaultValue})` : "";
-        const answer = await rl.question(`${label}${suffix}: `);
-        return answer.trim() || defaultValue || "";
-    }
-    finally {
-        rl.close();
-    }
-}
-export async function promptSecret(label, defaultValue) {
-    if (!input.isTTY || !output.isTTY)
-        return promptValue(label, defaultValue);
-    return new Promise((resolve) => {
-        const rl = createInterface({ input, output, terminal: true });
-        const muted = rl;
-        muted._writeToOutput = (value) => {
-            if (value === "\r\n" || value === "\n" || value === "\r") {
-                output.write(value);
-                return;
-            }
-            output.write("*".repeat(value.length));
-        };
-        const suffix = defaultValue ? " (configured, press Enter to keep)" : "";
-        output.write(`${label}${suffix}: `);
-        rl.question("", (answer) => {
-            rl.close();
-            output.write("\n");
-            resolve(answer.trim() || defaultValue || "");
-        });
-    });
-}