@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loginWithLocalhost.js

@@ -1,359 +1,234 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginExchangeError = exports.LoginInitError = void 0;
-exports.loginWithLocalhost = loginWithLocalhost;
-/**
- * loginWithLocalhost.ts — Phase H.0 orchestrator.
- *
- * @deprecated Tier-1.1 (2026-04-29). This module talks to the older
- * `/api/auth/cli-init` + `/api/auth/cli-token-exchange` endpoints; the
- * canonical PKCE+localhost orchestrator is now
- * `daemon/src/cli/oauthLogin.ts:runOAuthLogin`, which uses the standard
- * `/api/oauth/token` endpoint and additionally arms a manual-paste
- * fallback arm. Retained until `--legacy` is removed (gated on Tier-2.2
- * telemetry showing <1% usage). New code MUST NOT call this — the only
- * remaining caller is the daemon's `loginInteractive` legacy fallback at
- * `daemon/src/auth.ts:loginWithLocalhostFlow`. See
- * `docs/daemon-auth-production-readiness-2026-04-29.md` Tier 1.1 for the
- * removal plan.
- *
- * Ties PKCE primitives + local 127.0.0.1 callback server + server-side
- * /cli-init / /cli-token-exchange endpoints into a single function the
- * CLI/daemon can call. Returns daemon-style tokens (same shape as the
- * device-code completion path) so the persistence layer in
- * `daemon/src/auth.ts:saveToken()` doesn't change.
- *
- * Flow:
- *
- *   1. generate code_verifier + state
- *   2. compute S256 code_challenge
- *   3. start local 127.0.0.1 callback server (handle.redirectUri ready)
- *   4. POST /api/auth/cli-init { code_challenge, redirect_uri, state,
- *                                 device_name, scope }
- *      → { requestId, authUrl }
- *   5. open authUrl in user's browser (caller-injected opener)
- *   6. user approves on app.oversky.ai/auth/cli?req=<requestId>
- *   7. server 302s browser → http://127.0.0.1:<port>/callback?code&state
- *   8. handle.waitForCallback() resolves with { code }
- *   9. POST /api/auth/cli-token-exchange { code, code_verifier,
- *                                          redirect_uri }
- *      → { token, expiresAt, refreshToken?, refreshExpiresAt? }
- *  10. return the token bundle (caller persists via saveToken())
- *
- * Design boundaries:
- *
- *   - Browser opener is caller-injected (auth-core stays platform-
- *     agnostic; daemon passes its `execFile('open' | 'xdg-open' |
- *     'rundll32', …)` wrapper).
- *   - fetch is caller-overridable for tests; defaults to globalThis.fetch
- *     (Node 20+).
- *   - SSH / headless / OVERSKY_FORCE_DEVICE_CODE detection is the
- *     CALLER's job — this orchestrator just runs the flow. The caller
- *     decides whether localhost callback is appropriate before calling.
- *   - No retries. The auth code is single-use and short-lived; if a
- *     network blip drops the token-exchange request, the user just
- *     reruns the login command. Adding retries here muddies error
- *     semantics for callers that want clean fallback signals.
- *
- * Error handling:
- *
- *   The orchestrator throws structured errors so callers can branch:
- *
- *     LocalCallbackBindError       — port unavailable; caller may retry
- *     LocalCallbackTimeoutError    — user never approved; fall back
- *     LocalCallbackStateMismatchError — likely attack; fail loudly
- *     LocalCallbackDeniedError     — user clicked deny; surface clearly
- *     LocalCallbackMalformedError  — server bug; surface for diagnosis
- *     LoginInitError               — /cli-init HTTP failure
- *                                   (code='FEATURE_DISABLED' for 404 →
- *                                    caller falls back to device-code)
- *     LoginExchangeError           — /cli-token-exchange HTTP failure
- *
- * Cleanup invariant: the local server is ALWAYS torn down before this
- * function returns or throws — any failure path runs through the
- * `try / finally(handle.close())` wrapper. A future caller cannot leak
- * a listening socket by catching the wrong error.
- */
-const pkce_js_1 = require("./pkce.js");
-const loginLocalhost_js_1 = require("./loginLocalhost.js");
-const runtime_js_1 = require("./runtime.js");
-/** Default scope for new daemon installs. */
-const DEFAULT_SCOPE = 'daemon';
-// ---------------------------------------------------------------------
-// Error classes
-// ---------------------------------------------------------------------
-/**
- * /cli-init failed. `code` distinguishes the failure mode so the
- * caller can branch (FEATURE_DISABLED → fall back to device-code; the
- * rest → surface to user).
- */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var loginWithLocalhost_exports = {};
+__export(loginWithLocalhost_exports, {
+  LoginExchangeError: () => LoginExchangeError,
+  LoginInitError: () => LoginInitError,
+  loginWithLocalhost: () => loginWithLocalhost
+});
+module.exports = __toCommonJS(loginWithLocalhost_exports);
+var import_pkce = require("./pkce.js");
+var import_loginLocalhost = require("./loginLocalhost.js");
+var import_runtime = require("./runtime.js");
+const DEFAULT_SCOPE = "daemon";
 class LoginInitError extends Error {
-    code; // 200 but body shape unexpected
-    status;
-    responseBody;
-    constructor(code, message, status, body) {
-        super(message);
-        this.name = 'LoginInitError';
-        this.code = code;
-        this.status = status;
-        this.responseBody = body;
-    }
+  code;
+  // 200 but body shape unexpected
+  status;
+  responseBody;
+  constructor(code, message, status, body) {
+    super(message);
+    this.name = "LoginInitError";
+    this.code = code;
+    this.status = status;
+    this.responseBody = body;
+  }
 }
-exports.LoginInitError = LoginInitError;
-/** /cli-token-exchange failed. */
 class LoginExchangeError extends Error {
-    code; // 200 but body shape unexpected
-    status;
-    responseBody;
-    constructor(code, message, status, body) {
-        super(message);
-        this.name = 'LoginExchangeError';
-        this.code = code;
-        this.status = status;
-        this.responseBody = body;
-    }
+  code;
+  // 200 but body shape unexpected
+  status;
+  responseBody;
+  constructor(code, message, status, body) {
+    super(message);
+    this.name = "LoginExchangeError";
+    this.code = code;
+    this.status = status;
+    this.responseBody = body;
+  }
 }
-exports.LoginExchangeError = LoginExchangeError;
-// ---------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------
-/**
- * Run the full PKCE-via-localhost login flow. See file header for the
- * step-by-step. Throws structured errors on every failure path. The
- * local callback server is always torn down before this function
- * returns or throws.
- */
 async function loginWithLocalhost(opts) {
-    const log = (0, runtime_js_1.getAuthLogger)();
-    const fetchFn = opts.fetchImpl ?? globalThis.fetch;
-    if (typeof fetchFn !== 'function') {
-        throw new TypeError('loginWithLocalhost: globalThis.fetch is missing — pass fetchImpl or run under Node ≥ 20');
+  const log = (0, import_runtime.getAuthLogger)();
+  const fetchFn = opts.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchFn !== "function") {
+    throw new TypeError("loginWithLocalhost: globalThis.fetch is missing \u2014 pass fetchImpl or run under Node \u2265 20");
+  }
+  const scope = opts.scope ?? DEFAULT_SCOPE;
+  const serverUrl = opts.serverUrl.replace(/\/+$/, "");
+  const codeVerifier = (0, import_pkce.generateVerifier)();
+  const codeChallenge = (0, import_pkce.challenge)(codeVerifier, "S256");
+  const state = (0, import_pkce.generateState)();
+  const handle = await (0, import_loginLocalhost.startLocalCallback)({
+    state,
+    port: opts.port,
+    host: opts.host,
+    bindAddr: opts.bindAddr,
+    timeoutMs: opts.timeoutMs
+  });
+  try {
+    const initBody = {
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      redirect_uri: handle.redirectUri,
+      state,
+      device_name: opts.deviceName,
+      daemon_id: opts.daemonId,
+      scope
+    };
+    let initRes;
+    try {
+      initRes = await fetchFn(`${serverUrl}/api/auth/cli-init`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(initBody)
+      });
+    } catch (err) {
+      throw new LoginInitError("NETWORK_ERROR", `POST /api/auth/cli-init failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (initRes.status === 404) {
+      throw new LoginInitError("FEATURE_DISABLED", "Server does not support PKCE localhost login (feature flag off or older build). Fall back to device-code.", 404);
+    }
+    if (initRes.status === 429) {
+      throw new LoginInitError("RATE_LIMITED", "Server rate-limited the login init request. Wait a moment and retry.", 429, await safeReadBody(initRes));
+    }
+    if (initRes.status >= 500) {
+      throw new LoginInitError("SERVER_ERROR", `Server returned ${initRes.status} on /cli-init.`, initRes.status, await safeReadBody(initRes));
     }
-    const scope = opts.scope ?? DEFAULT_SCOPE;
-    const serverUrl = opts.serverUrl.replace(/\/+$/, '');
-    // Step 1+2: PKCE primitives. The verifier never leaves this
-    // function's local scope until step 9.
-    const codeVerifier = (0, pkce_js_1.generateVerifier)();
-    const codeChallenge = (0, pkce_js_1.challenge)(codeVerifier, 'S256');
-    const state = (0, pkce_js_1.generateState)();
-    // Step 3: bind the local callback server. Bind error here is fatal —
-    // caller decides whether to retry on a different port.
-    const handle = await (0, loginLocalhost_js_1.startLocalCallback)({
-        state,
-        port: opts.port,
-        host: opts.host,
-        bindAddr: opts.bindAddr,
-        timeoutMs: opts.timeoutMs,
-    });
+    if (!initRes.ok) {
+      throw new LoginInitError("BAD_REQUEST", `Server returned ${initRes.status} on /cli-init.`, initRes.status, await safeReadBody(initRes));
+    }
+    let initJson;
     try {
-        // Step 4: POST /cli-init.
-        const initBody = {
-            code_challenge: codeChallenge,
-            code_challenge_method: 'S256',
-            redirect_uri: handle.redirectUri,
-            state,
-            device_name: opts.deviceName,
-            daemon_id: opts.daemonId,
-            scope,
-        };
-        let initRes;
-        try {
-            initRes = await fetchFn(`${serverUrl}/api/auth/cli-init`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(initBody),
-            });
-        }
-        catch (err) {
-            throw new LoginInitError('NETWORK_ERROR', `POST /api/auth/cli-init failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        if (initRes.status === 404) {
-            // Server doesn't expose this endpoint — feature flag off, or
-            // older server build that pre-dates Phase H.0. Caller should
-            // fall back to device-code.
-            throw new LoginInitError('FEATURE_DISABLED', 'Server does not support PKCE localhost login (feature flag off or older build). ' +
-                'Fall back to device-code.', 404);
-        }
-        if (initRes.status === 429) {
-            throw new LoginInitError('RATE_LIMITED', 'Server rate-limited the login init request. Wait a moment and retry.', 429, await safeReadBody(initRes));
-        }
-        if (initRes.status >= 500) {
-            throw new LoginInitError('SERVER_ERROR', `Server returned ${initRes.status} on /cli-init.`, initRes.status, await safeReadBody(initRes));
-        }
-        if (!initRes.ok) {
-            throw new LoginInitError('BAD_REQUEST', `Server returned ${initRes.status} on /cli-init.`, initRes.status, await safeReadBody(initRes));
-        }
-        let initJson;
-        try {
-            initJson = await initRes.json();
-        }
-        catch (err) {
-            throw new LoginInitError('MALFORMED_RESPONSE', `Could not parse /cli-init response as JSON: ${err instanceof Error ? err.message : String(err)}`, initRes.status);
-        }
-        const init = parseInitResponse(initJson);
-        if (!init) {
-            throw new LoginInitError('MALFORMED_RESPONSE', '/cli-init response missing requestId or authUrl', initRes.status);
-        }
-        // Step 5: hand the auth URL to the caller (so they can print it
-        // before / instead of opening the browser) then open it. Both are
-        // best-effort — the user can copy/paste the URL.
-        if (opts.onAuthUrl) {
-            try {
-                opts.onAuthUrl(init.authUrl);
-            }
-            catch (err) {
-                log.warn(`[loginWithLocalhost] onAuthUrl callback threw (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        try {
-            await opts.openBrowser(init.authUrl);
-        }
-        catch (err) {
-            log.warn(`[loginWithLocalhost] openBrowser failed (non-fatal — user can paste URL): ${err instanceof Error ? err.message : String(err)}`);
-        }
-        // Step 6–8: wait for the callback. Errors here are the structured
-        // LocalCallback* set; they propagate as-is so the caller branches
-        // on instanceof.
-        const callback = await handle.waitForCallback();
-        // Step 9: POST /cli-token-exchange.
-        const exchangeBody = {
-            code: callback.code,
-            code_verifier: codeVerifier,
-            redirect_uri: handle.redirectUri,
-        };
-        let exchangeRes;
-        try {
-            exchangeRes = await fetchFn(`${serverUrl}/api/auth/cli-token-exchange`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(exchangeBody),
-            });
-        }
-        catch (err) {
-            throw new LoginExchangeError('NETWORK_ERROR', `POST /api/auth/cli-token-exchange failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        if (exchangeRes.status === 400) {
-            throw new LoginExchangeError('INVALID_GRANT', 'Server rejected the PKCE code exchange (verifier mismatch, expired code, or already redeemed).', 400, await safeReadBody(exchangeRes));
-        }
-        if (exchangeRes.status >= 500) {
-            throw new LoginExchangeError('SERVER_ERROR', `Server returned ${exchangeRes.status} on /cli-token-exchange.`, exchangeRes.status, await safeReadBody(exchangeRes));
-        }
-        if (!exchangeRes.ok) {
-            throw new LoginExchangeError('BAD_REQUEST', `Server returned ${exchangeRes.status} on /cli-token-exchange.`, exchangeRes.status, await safeReadBody(exchangeRes));
-        }
-        let exchangeJson;
-        try {
-            exchangeJson = await exchangeRes.json();
-        }
-        catch (err) {
-            throw new LoginExchangeError('MALFORMED_RESPONSE', `Could not parse /cli-token-exchange response as JSON: ${err instanceof Error ? err.message : String(err)}`, exchangeRes.status);
-        }
-        const result = parseExchangeResponse(exchangeJson);
-        if (!result) {
-            throw new LoginExchangeError('MALFORMED_RESPONSE', '/cli-token-exchange response missing token or has bad shape', exchangeRes.status);
-        }
-        log.info(`[loginWithLocalhost] login successful (scope=${result.scope ?? scope}` +
-            (result.daemonId ? ` daemonId=${result.daemonId}` : '') +
-            ')');
-        return result;
+      initJson = await initRes.json();
+    } catch (err) {
+      throw new LoginInitError("MALFORMED_RESPONSE", `Could not parse /cli-init response as JSON: ${err instanceof Error ? err.message : String(err)}`, initRes.status);
     }
-    finally {
-        // Cleanup invariant: server torn down on every exit path.
-        //
-        // Subtlety: when /cli-init fails (404, network, etc.) we throw
-        // BEFORE reaching `await handle.waitForCallback()`, so the
-        // callback Promise has no .catch attached. `handle.close()` will
-        // reject that Promise with CANCELLED → an unhandledRejection
-        // event the test runner correctly flags. Attach a no-op .catch
-        // first so the artifact-of-cleanup rejection is observed.
-        // Harmless on the happy path: the try-block's await already
-        // attached its own handler, and multiple .catches on the same
-        // Promise all observe the same outcome.
-        void handle.waitForCallback().catch(() => undefined);
-        handle.close();
+    const init = parseInitResponse(initJson);
+    if (!init) {
+      throw new LoginInitError("MALFORMED_RESPONSE", "/cli-init response missing requestId or authUrl", initRes.status);
+    }
+    if (opts.onAuthUrl) {
+      try {
+        opts.onAuthUrl(init.authUrl);
+      } catch (err) {
+        log.warn(`[loginWithLocalhost] onAuthUrl callback threw (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
-}
-function parseInitResponse(raw) {
-    if (!raw || typeof raw !== 'object')
-        return null;
-    const obj = raw;
-    const requestId = typeof obj.requestId === 'string' ? obj.requestId : null;
-    const authUrl = typeof obj.authUrl === 'string' ? obj.authUrl : null;
-    if (!requestId || !authUrl)
-        return null;
-    // Defense in depth: refuse to open URLs that aren't http/https.
-    // Prevents a hostile/buggy server response steering the caller's
-    // browser at javascript: / file: / data: URIs.
     try {
-        const u = new URL(authUrl);
-        if (u.protocol !== 'http:' && u.protocol !== 'https:')
-            return null;
+      await opts.openBrowser(init.authUrl);
+    } catch (err) {
+      log.warn(`[loginWithLocalhost] openBrowser failed (non-fatal \u2014 user can paste URL): ${err instanceof Error ? err.message : String(err)}`);
     }
-    catch {
-        return null;
+    const callback = await handle.waitForCallback();
+    const exchangeBody = {
+      code: callback.code,
+      code_verifier: codeVerifier,
+      redirect_uri: handle.redirectUri
+    };
+    let exchangeRes;
+    try {
+      exchangeRes = await fetchFn(`${serverUrl}/api/auth/cli-token-exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(exchangeBody)
+      });
+    } catch (err) {
+      throw new LoginExchangeError("NETWORK_ERROR", `POST /api/auth/cli-token-exchange failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    return { requestId, authUrl };
+    if (exchangeRes.status === 400) {
+      throw new LoginExchangeError("INVALID_GRANT", "Server rejected the PKCE code exchange (verifier mismatch, expired code, or already redeemed).", 400, await safeReadBody(exchangeRes));
+    }
+    if (exchangeRes.status >= 500) {
+      throw new LoginExchangeError("SERVER_ERROR", `Server returned ${exchangeRes.status} on /cli-token-exchange.`, exchangeRes.status, await safeReadBody(exchangeRes));
+    }
+    if (!exchangeRes.ok) {
+      throw new LoginExchangeError("BAD_REQUEST", `Server returned ${exchangeRes.status} on /cli-token-exchange.`, exchangeRes.status, await safeReadBody(exchangeRes));
+    }
+    let exchangeJson;
+    try {
+      exchangeJson = await exchangeRes.json();
+    } catch (err) {
+      throw new LoginExchangeError("MALFORMED_RESPONSE", `Could not parse /cli-token-exchange response as JSON: ${err instanceof Error ? err.message : String(err)}`, exchangeRes.status);
+    }
+    const result = parseExchangeResponse(exchangeJson);
+    if (!result) {
+      throw new LoginExchangeError("MALFORMED_RESPONSE", "/cli-token-exchange response missing token or has bad shape", exchangeRes.status);
+    }
+    log.info(`[loginWithLocalhost] login successful (scope=${result.scope ?? scope}` + (result.daemonId ? ` daemonId=${result.daemonId}` : "") + ")");
+    return result;
+  } finally {
+    void handle.waitForCallback().catch(() => void 0);
+    handle.close();
+  }
+}
+function parseInitResponse(raw) {
+  if (!raw || typeof raw !== "object")
+    return null;
+  const obj = raw;
+  const requestId = typeof obj.requestId === "string" ? obj.requestId : null;
+  const authUrl = typeof obj.authUrl === "string" ? obj.authUrl : null;
+  if (!requestId || !authUrl)
+    return null;
+  try {
+    const u = new URL(authUrl);
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+      return null;
+  } catch {
+    return null;
+  }
+  return { requestId, authUrl };
 }
 function parseExchangeResponse(raw) {
-    if (!raw || typeof raw !== 'object')
-        return null;
-    const obj = raw;
-    const token = typeof obj.token === 'string' && obj.token.length > 0 ? obj.token : undefined;
-    const expiresAt = parseEpochMs(obj.expiresAt);
-    const refreshToken = typeof obj.refreshToken === 'string' && obj.refreshToken.length > 0
-        ? obj.refreshToken
-        : undefined;
-    const refreshExpiresAt = parseEpochMs(obj.refreshExpiresAt);
-    const daemonId = typeof obj.daemonId === 'string' && obj.daemonId.length > 0 ? obj.daemonId : undefined;
-    const scope = parseScope(obj.scope);
-    // Stage-E #1 — opaque `osk_dmn_*` co-issued for daemon-scope mints
-    // (server-side: routes/cliAuth.js sends it in the response payload).
-    // Treat any non-string/empty as absent — login responses don't have
-    // the "explicitly clear" null semantic that refresh responses do.
-    const opaqueAccessToken = typeof obj.opaqueAccessToken === 'string' && obj.opaqueAccessToken.length > 0
-        ? obj.opaqueAccessToken
-        : undefined;
-    // Stage-E #1 step 4 — daemon-scope login responses omit `token`
-    // because the daemon-JWT substrate is retired. Accept the response
-    // as long as the server returned at least one credential class.
-    // Pre-step-4 responses (token only / token + opaque) and post-step-4
-    // responses (opaque only) both pass.
-    if (!token && !opaqueAccessToken)
-        return null;
-    // Match the device-code defensive path in daemon/src/auth.ts: if the
-    // server claimed to issue a refresh token but the expiry is
-    // unparseable, drop both rather than persist a refresh that reads
-    // back as "valid forever" via Date.now() > NaN.
-    const safeRefresh = refreshToken !== undefined && refreshExpiresAt !== undefined
-        ? { refreshToken, refreshExpiresAt }
-        : undefined;
-    return {
-        ...(token ? { token } : {}),
-        ...(expiresAt !== undefined ? { expiresAt } : {}),
-        ...(safeRefresh ?? {}),
-        ...(daemonId ? { daemonId } : {}),
-        ...(scope ? { scope } : {}),
-        ...(opaqueAccessToken ? { opaqueAccessToken } : {}),
-    };
+  if (!raw || typeof raw !== "object")
+    return null;
+  const obj = raw;
+  const token = typeof obj.token === "string" && obj.token.length > 0 ? obj.token : void 0;
+  const expiresAt = parseEpochMs(obj.expiresAt);
+  const refreshToken = typeof obj.refreshToken === "string" && obj.refreshToken.length > 0 ? obj.refreshToken : void 0;
+  const refreshExpiresAt = parseEpochMs(obj.refreshExpiresAt);
+  const daemonId = typeof obj.daemonId === "string" && obj.daemonId.length > 0 ? obj.daemonId : void 0;
+  const scope = parseScope(obj.scope);
+  const opaqueAccessToken = typeof obj.opaqueAccessToken === "string" && obj.opaqueAccessToken.length > 0 ? obj.opaqueAccessToken : void 0;
+  if (!token && !opaqueAccessToken)
+    return null;
+  const safeRefresh = refreshToken !== void 0 && refreshExpiresAt !== void 0 ? { refreshToken, refreshExpiresAt } : void 0;
+  return {
+    ...token ? { token } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {},
+    ...safeRefresh ?? {},
+    ...daemonId ? { daemonId } : {},
+    ...scope ? { scope } : {},
+    ...opaqueAccessToken ? { opaqueAccessToken } : {}
+  };
 }
 function parseEpochMs(v) {
-    if (typeof v !== 'string' && typeof v !== 'number')
-        return undefined;
-    const ms = new Date(v).getTime();
-    return Number.isFinite(ms) ? ms : undefined;
+  if (typeof v !== "string" && typeof v !== "number")
+    return void 0;
+  const ms = new Date(v).getTime();
+  return Number.isFinite(ms) ? ms : void 0;
 }
 function parseScope(v) {
-    if (v === 'daemon' || v === 'cli' || v === 'web')
-        return v;
-    return undefined;
+  if (v === "daemon" || v === "cli" || v === "web")
+    return v;
+  return void 0;
 }
 async function safeReadBody(res) {
-    try {
-        const txt = await res.text();
-        // Truncate so a massive 5xx HTML page doesn't bloat error objects.
-        return txt.length > 500 ? txt.slice(0, 500) + '… [truncated]' : txt;
-    }
-    catch {
-        return undefined;
-    }
+  try {
+    const txt = await res.text();
+    return txt.length > 500 ? txt.slice(0, 500) + "\u2026 [truncated]" : txt;
+  } catch {
+    return void 0;
+  }
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LoginExchangeError,
+  LoginInitError,
+  loginWithLocalhost
+});