@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loginLocalhost.js

@@ -1,350 +1,234 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = void 0;
-exports.startLocalCallback = startLocalCallback;
-/**
- * loginLocalhost.ts — local 127.0.0.1 callback server for the PKCE
- * authorization-code login flow (Phase H.0,
- * docs/daemon-auth-roadmap.md).
- *
- * The CLI starts this server on an ephemeral port BEFORE opening the
- * browser to the consent page. After the user approves on
- * `app.oversky.ai/auth/cli`, the OverSky server 302s the browser to
- * `http://127.0.0.1:<port>/callback?code=...&state=...`. We accept
- * exactly that one redirect (single-use, validated state, reject every
- * other path/method/payload), hand the auth code back to the caller,
- * close the server, and the caller proceeds to PKCE token exchange.
- *
- * API shape — handle pattern:
- *
- *   const handle = await startLocalCallback({ state });
- *   // handle.redirectUri is bound and known synchronously; pass it to
- *   // /cli-init so the server can validate + embed it in the consent
- *   // page's redirect.
- *   await postCliInit({ redirect_uri: handle.redirectUri, state, ... });
- *   openBrowser(authUrl);
- *   const { code } = await handle.waitForCallback();
- *
- * The split avoids the awkward "we need redirectUri before the
- * callback arrives but the same Promise resolves with the code" tangle
- * — the redirectUri is hot the moment listen() succeeds, the callback
- * promise resolves much later when the user approves.
- *
- * Security model:
- *   - 127.0.0.1 only — never 0.0.0.0. A daemon binding 0.0.0.0 lets
- *     any device on the LAN snag the auth code by hitting the callback
- *     URL on the developer's machine before the legitimate browser
- *     does. Numeric host (not "localhost") to avoid a DNS resolver
- *     surprise routing the lookup off-loopback.
- *   - State validation with timingSafeEqual via `pkce.safeEqual`. The
- *     state is generated by the CLI and bound into both the consent
- *     page request and the callback URL. A redirect that does not
- *     echo the exact state is rejected with no detail leaked to the
- *     page — attacker cannot tell "missing" from "wrong".
- *   - Single-use: the first valid callback resolves the promise and
- *     immediately closes the server. Any further requests during
- *     teardown receive a generic 503 from the closing socket.
- *   - Reject non-GET (405) and unknown paths (404) so a probing
- *     request can't deduce the server's purpose from differential
- *     responses.
- *   - No user-controlled data in any HTML response — static templates
- *     only. Defense vs reflected-XSS via a malicious
- *     `error_description` value an attacker might inject.
- *   - Structured error classes so the caller branches correctly:
- *       BindError       → fall back to a different port or device-code
- *       TimeoutError    → fall back to device-code with explanation
- *       StateMismatchError → likely attack; fail loudly, do not retry
- *       DeniedError     → user declined; surface clearly, do not retry
- *       MalformedCallbackError → server bug or rogue extension;
- *                         surface for diagnosis
- *       (CANCELLED)     → caller invoked handle.close() before the
- *                         callback arrived
- *
- * The server and timeout DO keep the event loop alive — that's the
- * whole point: this module is invoked from a top-level CLI command
- * that needs to block on the user clicking approve. Ctrl-C in the
- * CLI sends SIGINT, which interrupts the caller's await and triggers
- * normal shutdown logic (which should call handle.close()). Setting
- * server.unref() here would let isolated CLI invocations exit before
- * the callback arrives.
- */
-const node_http_1 = __importDefault(require("node:http"));
-const pkce_js_1 = require("./pkce.js");
-const runtime_js_1 = require("./runtime.js");
-/** Callback path — hardcoded; caller MUST construct redirectUri to match. */
-const CALLBACK_PATH = '/callback';
-/** Default total wait (ms) for the callback. Matches consent-page UX. */
-exports.DEFAULT_LOGIN_TIMEOUT_MS = 2 * 60 * 1000;
-// ---------------------------------------------------------------------
-// Structured errors — caller branches on these
-// ---------------------------------------------------------------------
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var loginLocalhost_exports = {};
+__export(loginLocalhost_exports, {
+  DEFAULT_LOGIN_TIMEOUT_MS: () => DEFAULT_LOGIN_TIMEOUT_MS,
+  LocalCallbackBindError: () => LocalCallbackBindError,
+  LocalCallbackDeniedError: () => LocalCallbackDeniedError,
+  LocalCallbackError: () => LocalCallbackError,
+  LocalCallbackMalformedError: () => LocalCallbackMalformedError,
+  LocalCallbackStateMismatchError: () => LocalCallbackStateMismatchError,
+  LocalCallbackTimeoutError: () => LocalCallbackTimeoutError,
+  startLocalCallback: () => startLocalCallback
+});
+module.exports = __toCommonJS(loginLocalhost_exports);
+var import_node_http = __toESM(require("node:http"), 1);
+var import_pkce = require("./pkce.js");
+var import_runtime = require("./runtime.js");
+const CALLBACK_PATH = "/callback";
+const DEFAULT_LOGIN_TIMEOUT_MS = 2 * 60 * 1e3;
 class LocalCallbackError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = 'LocalCallbackError';
-        this.code = code;
-    }
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "LocalCallbackError";
+    this.code = code;
+  }
 }
-exports.LocalCallbackError = LocalCallbackError;
 class LocalCallbackBindError extends LocalCallbackError {
-    port;
-    cause;
-    constructor(port, cause) {
-        super('BIND_FAILED', `Failed to bind localhost callback on port ${port}: ${cause?.message ?? 'unknown error'}`);
-        this.name = 'LocalCallbackBindError';
-        this.port = port;
-        this.cause = cause;
-    }
+  port;
+  cause;
+  constructor(port, cause) {
+    super("BIND_FAILED", `Failed to bind localhost callback on port ${port}: ${cause?.message ?? "unknown error"}`);
+    this.name = "LocalCallbackBindError";
+    this.port = port;
+    this.cause = cause;
+  }
 }
-exports.LocalCallbackBindError = LocalCallbackBindError;
 class LocalCallbackTimeoutError extends LocalCallbackError {
-    timeoutMs;
-    constructor(timeoutMs) {
-        super('TIMEOUT', `No callback received within ${timeoutMs} ms`);
-        this.name = 'LocalCallbackTimeoutError';
-        this.timeoutMs = timeoutMs;
-    }
+  timeoutMs;
+  constructor(timeoutMs) {
+    super("TIMEOUT", `No callback received within ${timeoutMs} ms`);
+    this.name = "LocalCallbackTimeoutError";
+    this.timeoutMs = timeoutMs;
+  }
 }
-exports.LocalCallbackTimeoutError = LocalCallbackTimeoutError;
 class LocalCallbackStateMismatchError extends LocalCallbackError {
-    constructor() {
-        super('STATE_MISMATCH', 'Callback state did not match the expected value — rejecting (possible attack)');
-        this.name = 'LocalCallbackStateMismatchError';
-    }
+  constructor() {
+    super("STATE_MISMATCH", "Callback state did not match the expected value \u2014 rejecting (possible attack)");
+    this.name = "LocalCallbackStateMismatchError";
+  }
 }
-exports.LocalCallbackStateMismatchError = LocalCallbackStateMismatchError;
 class LocalCallbackDeniedError extends LocalCallbackError {
-    serverError;
-    constructor(serverError, description) {
-        super('DENIED', description ? `${serverError}: ${description}` : serverError);
-        this.name = 'LocalCallbackDeniedError';
-        this.serverError = serverError;
-    }
+  serverError;
+  constructor(serverError, description) {
+    super("DENIED", description ? `${serverError}: ${description}` : serverError);
+    this.name = "LocalCallbackDeniedError";
+    this.serverError = serverError;
+  }
 }
-exports.LocalCallbackDeniedError = LocalCallbackDeniedError;
 class LocalCallbackMalformedError extends LocalCallbackError {
-    constructor(reason) {
-        super('MALFORMED', `Malformed callback: ${reason}`);
-        this.name = 'LocalCallbackMalformedError';
-    }
+  constructor(reason) {
+    super("MALFORMED", `Malformed callback: ${reason}`);
+    this.name = "LocalCallbackMalformedError";
+  }
 }
-exports.LocalCallbackMalformedError = LocalCallbackMalformedError;
-// ---------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------
-/**
- * Start the local 127.0.0.1 callback server. Binds synchronously
- * (await'd via the listen handshake) and returns a handle whose
- * `redirectUri` is immediately usable. The caller drives the rest of
- * the flow and awaits `waitForCallback()` when ready.
- *
- * Throws `LocalCallbackBindError` if the bind fails (caller decides
- * whether to retry on a different port or fall back to device-code).
- */
 async function startLocalCallback(opts) {
-    const log = (0, runtime_js_1.getAuthLogger)();
-    const port = opts.port ?? 0;
-    const timeoutMs = opts.timeoutMs ?? exports.DEFAULT_LOGIN_TIMEOUT_MS;
-    const expectedState = opts.state;
-    // P1 #5 (multica-convergence) — host/bindAddr split. Defaults preserve the
-    // pre-change security posture (127.0.0.1 for both). Any deviation is
-    // logged prominently because it widens the callback blast radius.
-    const urlHost = typeof opts.host === 'string' && opts.host.length > 0 ? opts.host : '127.0.0.1';
-    const bindAddr = typeof opts.bindAddr === 'string' && opts.bindAddr.length > 0 ? opts.bindAddr : urlHost;
-    const isLoopback = (h) => h === '127.0.0.1' || h === '::1' || h === 'localhost';
-    if (!isLoopback(bindAddr)) {
-        log.warn(`[loginLocalhost] non-loopback bind ${bindAddr} — any device reaching this interface ` +
-            'can race the callback. Only use on trusted networks.');
+  const log = (0, import_runtime.getAuthLogger)();
+  const port = opts.port ?? 0;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS;
+  const expectedState = opts.state;
+  const urlHost = typeof opts.host === "string" && opts.host.length > 0 ? opts.host : "127.0.0.1";
+  const bindAddr = typeof opts.bindAddr === "string" && opts.bindAddr.length > 0 ? opts.bindAddr : urlHost;
+  const isLoopback = (h) => h === "127.0.0.1" || h === "::1" || h === "localhost";
+  if (!isLoopback(bindAddr)) {
+    log.warn(`[loginLocalhost] non-loopback bind ${bindAddr} \u2014 any device reaching this interface can race the callback. Only use on trusted networks.`);
+  }
+  if (typeof expectedState !== "string" || expectedState.length === 0) {
+    throw new LocalCallbackError("BAD_OPTIONS", "startLocalCallback: state is required");
+  }
+  if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new LocalCallbackError("BAD_OPTIONS", `startLocalCallback: invalid timeoutMs=${timeoutMs}`);
+  }
+  let settled = false;
+  let resolveCallback;
+  let rejectCallback;
+  const callbackPromise = new Promise((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  let timer = null;
+  let redirectUri = "";
+  const tearDown = () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
     }
-    if (typeof expectedState !== 'string' || expectedState.length === 0) {
-        throw new LocalCallbackError('BAD_OPTIONS', 'startLocalCallback: state is required');
+    try {
+      server.closeAllConnections?.();
+    } catch {
     }
-    if (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-        throw new LocalCallbackError('BAD_OPTIONS', `startLocalCallback: invalid timeoutMs=${timeoutMs}`);
+    try {
+      server.close();
+    } catch {
     }
-    // Wire the callback promise up front so the request handler can
-    // settle it without referencing the outer Promise constructor.
-    let settled = false;
-    let resolveCallback;
-    let rejectCallback;
-    const callbackPromise = new Promise((resolve, reject) => {
-        resolveCallback = resolve;
-        rejectCallback = reject;
-    });
-    let timer = null;
-    // Populated after listen() succeeds — every code path that reads
-    // `redirectUri` runs strictly after that resolution.
-    let redirectUri = '';
-    const tearDown = () => {
-        if (timer) {
-            clearTimeout(timer);
-            timer = null;
-        }
-        try {
-            // Drop any keep-alive sockets a misbehaving extension may have
-            // opened — without this, server.close() waits indefinitely for
-            // them to idle out. Available since Node 18.2; we require >=20.
-            server.closeAllConnections?.();
-        }
-        catch {
-            /* ignore */
-        }
-        try {
-            server.close();
-        }
-        catch {
-            /* ignore */
-        }
-    };
-    const settle = (err, result) => {
-        if (settled)
-            return;
-        settled = true;
-        tearDown();
-        if (err)
-            rejectCallback(err);
-        else if (result)
-            resolveCallback(result);
+  };
+  const settle = (err, result) => {
+    if (settled)
+      return;
+    settled = true;
+    tearDown();
+    if (err)
+      rejectCallback(err);
+    else if (result)
+      resolveCallback(result);
+  };
+  const server = import_node_http.default.createServer((req, res) => {
+    if (req.method !== "GET") {
+      res.writeHead(405, { "Content-Type": "text/plain", Allow: "GET" });
+      res.end("Method not allowed");
+      return;
+    }
+    const reqUrl = new URL(req.url || "/", "http://127.0.0.1");
+    if (reqUrl.pathname !== CALLBACK_PATH) {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not found");
+      return;
+    }
+    const oauthError = reqUrl.searchParams.get("error");
+    if (oauthError) {
+      const desc = reqUrl.searchParams.get("error_description") ?? void 0;
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(declinedHtml());
+      log.warn(`[loginLocalhost] authorization server returned error=${oauthError} ` + (desc ? `description=${desc}` : ""));
+      settle(new LocalCallbackDeniedError(oauthError, desc));
+      return;
+    }
+    const code = reqUrl.searchParams.get("code");
+    const returnedState = reqUrl.searchParams.get("state");
+    if (!code || !returnedState) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(genericFailureHtml());
+      settle(new LocalCallbackMalformedError("missing code or state"));
+      return;
+    }
+    if (!(0, import_pkce.safeEqual)(returnedState, expectedState)) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(genericFailureHtml());
+      log.warn("[loginLocalhost] state mismatch on callback \u2014 rejecting");
+      settle(new LocalCallbackStateMismatchError());
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(successHtml());
+    settle(null, { code, state: returnedState, redirectUri });
+  });
+  await new Promise((resolve, reject) => {
+    const onListenError = (err) => {
+      reject(new LocalCallbackBindError(port, err));
     };
-    const server = node_http_1.default.createServer((req, res) => {
-        // Reject anything except GET /callback. Bodies are deliberately
-        // generic — never reveal which check failed (purpose-disclosure
-        // resistance); attacker probing the port shouldn't learn it's a
-        // PKCE callback server vs. some other localhost service.
-        if (req.method !== 'GET') {
-            res.writeHead(405, { 'Content-Type': 'text/plain', Allow: 'GET' });
-            res.end('Method not allowed');
-            return;
-        }
-        // Parse with an explicit base — never trust the Host header.
-        const reqUrl = new URL(req.url || '/', 'http://127.0.0.1');
-        if (reqUrl.pathname !== CALLBACK_PATH) {
-            res.writeHead(404, { 'Content-Type': 'text/plain' });
-            res.end('Not found');
-            return;
-        }
-        // Authorization-server error path: ?error=access_denied[&error_description=...]
-        // The error_description is attacker-controllable in principle, so
-        // never echo it into HTML — we serve a static page and surface
-        // the structured detail only via the rejected promise + log.
-        const oauthError = reqUrl.searchParams.get('error');
-        if (oauthError) {
-            const desc = reqUrl.searchParams.get('error_description') ?? undefined;
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(declinedHtml());
-            log.warn(`[loginLocalhost] authorization server returned error=${oauthError} ` +
-                (desc ? `description=${desc}` : ''));
-            settle(new LocalCallbackDeniedError(oauthError, desc));
-            return;
-        }
-        const code = reqUrl.searchParams.get('code');
-        const returnedState = reqUrl.searchParams.get('state');
-        if (!code || !returnedState) {
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(genericFailureHtml());
-            settle(new LocalCallbackMalformedError('missing code or state'));
-            return;
-        }
-        if (!(0, pkce_js_1.safeEqual)(returnedState, expectedState)) {
-            // Generic 400 body — do NOT distinguish "missing" from "wrong"
-            // on the page. Logged separately for ops triage.
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(genericFailureHtml());
-            log.warn('[loginLocalhost] state mismatch on callback — rejecting');
-            settle(new LocalCallbackStateMismatchError());
-            return;
-        }
-        // Happy path.
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        res.end(successHtml());
-        settle(null, { code, state: returnedState, redirectUri });
+    server.once("error", onListenError);
+    server.listen(port, bindAddr, () => {
+      server.removeListener("error", onListenError);
+      resolve();
     });
-    // Bind. Use a one-shot 'error' listener that's removed on success so
-    // post-bind socket errors flow through the server-level handler set
-    // up below.
-    await new Promise((resolve, reject) => {
-        const onListenError = (err) => {
-            reject(new LocalCallbackBindError(port, err));
-        };
-        server.once('error', onListenError);
-        server.listen(port, bindAddr, () => {
-            server.removeListener('error', onListenError);
-            resolve();
-        });
-    });
-    const addr = server.address();
-    if (!addr || typeof addr === 'string') {
-        try {
-            server.close();
-        }
-        catch {
-            /* ignore */
-        }
-        throw new LocalCallbackBindError(port, new Error('server.address() returned non-AddressInfo after listen'));
+  });
+  const addr = server.address();
+  if (!addr || typeof addr === "string") {
+    try {
+      server.close();
+    } catch {
     }
-    // IPv6 literal hosts need brackets in the URL form.
-    const hostInUrl = urlHost.includes(':') && !urlHost.startsWith('[') ? `[${urlHost}]` : urlHost;
-    redirectUri = `http://${hostInUrl}:${addr.port}${CALLBACK_PATH}`;
-    log.debug?.(`[loginLocalhost] listening on ${redirectUri}`);
-    // Post-bind error handler — socket errors etc. Once we've settled the
-    // happy path, swallow further errors quietly so a delayed
-    // ECONNRESET from a closed-tab keep-alive can't blow up the process.
-    server.on('error', (err) => {
-        if (settled)
-            return;
-        log.warn(`[loginLocalhost] post-bind server error: ${err.message}`);
-        settle(new LocalCallbackError('SERVER_ERROR', err.message));
-    });
-    timer = setTimeout(() => {
-        settle(new LocalCallbackTimeoutError(timeoutMs));
-    }, timeoutMs);
-    // Deliberately NOT calling server.unref() / timer.unref(). The
-    // whole point of this server is to keep the parent process alive
-    // while waiting for the user to click approve in the browser; if
-    // nothing else in the CLI is ref'd (we may be deep in an isolated
-    // login command), an unref'd server would let the event loop exit
-    // before the callback ever arrives. Ctrl-C handles teardown via
-    // SIGINT, which interrupts the await in the caller and lets normal
-    // shutdown logic invoke handle.close().
-    return {
-        redirectUri,
-        waitForCallback: () => callbackPromise,
-        close: () => {
-            settle(new LocalCallbackError('CANCELLED', 'callback wait cancelled by caller'));
-        },
-    };
+    throw new LocalCallbackBindError(port, new Error("server.address() returned non-AddressInfo after listen"));
+  }
+  const hostInUrl = urlHost.includes(":") && !urlHost.startsWith("[") ? `[${urlHost}]` : urlHost;
+  redirectUri = `http://${hostInUrl}:${addr.port}${CALLBACK_PATH}`;
+  log.debug?.(`[loginLocalhost] listening on ${redirectUri}`);
+  server.on("error", (err) => {
+    if (settled)
+      return;
+    log.warn(`[loginLocalhost] post-bind server error: ${err.message}`);
+    settle(new LocalCallbackError("SERVER_ERROR", err.message));
+  });
+  timer = setTimeout(() => {
+    settle(new LocalCallbackTimeoutError(timeoutMs));
+  }, timeoutMs);
+  return {
+    redirectUri,
+    waitForCallback: () => callbackPromise,
+    close: () => {
+      settle(new LocalCallbackError("CANCELLED", "callback wait cancelled by caller"));
+    }
+  };
 }
-/**
- * The machine end of the handshake. Deliberately a display rather than
- * a terminal window: the user just came from a browser, and a monitor
- * outline is the one glyph that reads as "the computer in front of
- * you" without needing a caption.
- */
 const DISPLAY_GLYPH = `<svg class="glyph" viewBox="0 0 24 24" aria-hidden="true">
         <rect x="2.25" y="3.5" width="19.5" height="13.5" rx="2.5"/>
         <path d="M12 17v3.25"/>
         <path d="M8.5 20.5h7"/>
       </svg>`;
-/** Badge interiors, one per verdict. Stroked, never filled. */
 const VERDICT_MARK = {
-    success: '<path d="M5.5 12.5 10 17l8.5-9"/>',
-    declined: '<path d="M7 7l10 10M17 7 7 17"/>',
-    error: '<path d="M12 7v6.25"/><path d="M12 16.75h.01"/>',
+  success: '<path d="M5.5 12.5 10 17l8.5-9"/>',
+  declined: '<path d="M7 7l10 10M17 7 7 17"/>',
+  error: '<path d="M12 7v6.25"/><path d="M12 16.75h.01"/>'
 };
-/**
- * Renders the shared page. `verdict` selects the badge palette via a
- * class — no interpolated colour, so the template stays a constant
- * string per state and there is nothing for a caller to smuggle CSS
- * through.
- */
 function htmlShell(title, verdict, headline, body) {
-    // Single inline template — keeps the binary self-contained (no
-    // bundled assets) and survives offline/firewalled environments.
-    return `<!doctype html>
+  return `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -468,7 +352,7 @@ function htmlShell(title, verdict, headline, body) {
     }
 
     /* Entrance: one short rise, staggered. Nothing loops, nothing
-       moves after ~0.4s — this page is read once and closed. */
+       moves after ~0.4s \u2014 this page is read once and closed. */
     @keyframes rise {
       from { opacity: 0; transform: translateY(9px); }
       to   { opacity: 1; transform: none; }
@@ -509,11 +393,22 @@ function htmlShell(title, verdict, headline, body) {
 </html>`;
 }
 function successHtml() {
-    return htmlShell('Connected to Skrr', 'success', 'Connected to Skrr', 'You may now close this window and return to your terminal.');
+  return htmlShell("Connected to Skrr", "success", "Connected to Skrr", "You may now close this window and return to your terminal.");
 }
 function declinedHtml() {
-    return htmlShell('Skrr — Authorization declined', 'declined', 'Authorization declined', 'You can close this window. Run the command again to retry.');
+  return htmlShell("Skrr \u2014 Authorization declined", "declined", "Authorization declined", "You can close this window. Run the command again to retry.");
 }
 function genericFailureHtml() {
-    return htmlShell('Skrr — Authorization error', 'error', 'Authorization error', 'Something went wrong. Close this window and try again.');
+  return htmlShell("Skrr \u2014 Authorization error", "error", "Authorization error", "Something went wrong. Close this window and try again.");
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_LOGIN_TIMEOUT_MS,
+  LocalCallbackBindError,
+  LocalCallbackDeniedError,
+  LocalCallbackError,
+  LocalCallbackMalformedError,
+  LocalCallbackStateMismatchError,
+  LocalCallbackTimeoutError,
+  startLocalCallback
+});