@sun-asterisk/sungen 3.2.3-beta.3 → 3.2.4

package/dist/tools/sungen-auth/login-flow.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The 6-call RFC 8252 CLI login flow against FastSchema v0.13.0.
+ *
+ * Base path is /api/auth (verified live against the running v0.13.0 server;
+ * the earlier /api/user/auth contract was wrong). PKCE-S256 + single-use
+ * one-time code; the JWT is minted server-side
+ * and only delivered via the server-to-server `exchange` — it never appears in
+ * the browser. This module does NO disk I/O so it stays unit-testable.
+ */
+import type { PkceMaterial } from './sungen-auth-types';
+export interface LoginFlowDeps {
+    apiBaseUrl: string;
+    pkce: PkceMaterial;
+    correlation: string;
+    redirectUri: string;
+    /** Open the authorize URL; return false to trigger the manual-paste fallback. */
+    openBrowser: (url: string) => boolean;
+    /** Resolve with the one-time code once the loopback callback fires. */
+    waitForCode: (correlation: string, timeoutMs?: number) => Promise<string>;
+    /** Optional sink for user-facing progress lines (defaults to console.log). */
+    log?: (msg: string) => void;
+}
+export interface LoginResult {
+    token: string;
+    email: string;
+    expires_at?: number;
+}
+/**
+ * Run the full login flow. Throws with a clear, distinct message for each
+ * failure mode (feature-off, missing challenge, exchange-401, etc.).
+ */
+export declare function runLoginFlow(deps: LoginFlowDeps): Promise<LoginResult>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/tools/sungen-auth/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/login-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,uEAAuE;IACvE,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,8EAA8E;IAC9E,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6BD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAmE5E"}

package/dist/tools/sungen-auth/login-flow.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * The 6-call RFC 8252 CLI login flow against FastSchema v0.13.0.
+ *
+ * Base path is /api/auth (verified live against the running v0.13.0 server;
+ * the earlier /api/user/auth contract was wrong). PKCE-S256 + single-use
+ * one-time code; the JWT is minted server-side
+ * and only delivered via the server-to-server `exchange` — it never appears in
+ * the browser. This module does NO disk I/O so it stays unit-testable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runLoginFlow = runLoginFlow;
+/** Strip a trailing slash so path joins never double up. */
+function normalizeBase(url) {
+    return url.replace(/\/+$/, '');
+}
+async function postJson(url, body) {
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        throw new Error(`Network error reaching ${url}: ${err?.message ?? 'unknown'}`);
+    }
+    let data = null;
+    try {
+        const json = await res.json();
+        // FastSchema wraps success payloads in { data: ... } and errors in { error: ... }.
+        data = (json && json.data !== undefined ? json.data : json);
+    }
+    catch {
+        /* non-JSON body */
+    }
+    return { ok: res.ok, status: res.status, data };
+}
+/**
+ * Run the full login flow. Throws with a clear, distinct message for each
+ * failure mode (feature-off, missing challenge, exchange-401, etc.).
+ */
+async function runLoginFlow(deps) {
+    const base = normalizeBase(deps.apiBaseUrl);
+    const log = deps.log ?? ((m) => console.log(m));
+    // 1. initiate — exchange PKCE challenge + loopback redirect for a carrier.
+    const init = await postJson(`${base}/api/auth/cli/initiate`, {
+        redirect_uri: deps.redirectUri,
+        correlation: deps.correlation,
+        code_challenge: deps.pkce.challenge,
+    });
+    if (init.status === 403) {
+        throw new Error('CLI login is disabled on the server (AUTH_CLI_LOGIN_ENABLED=false).');
+    }
+    if (init.status === 400) {
+        throw new Error('Server rejected the login request (missing/invalid PKCE challenge or redirect).');
+    }
+    if (!init.ok || !init.data?.authorize_url) {
+        throw new Error(`Login initiate failed (HTTP ${init.status}).`);
+    }
+    // 2. open the dashboard login page (authorize_url is a path → join with base).
+    const authorizeUrl = `${base}${init.data.authorize_url}`;
+    // Always print the URL: openBrowser reports success even when the launcher
+    // fails asynchronously (e.g. headless box with no xdg-open), so the paste
+    // path must stay visible regardless.
+    const opened = deps.openBrowser(authorizeUrl);
+    if (opened) {
+        log(`Opened your browser to complete login. Waiting…\nIf it didn't open, visit:\n  ${authorizeUrl}`);
+    }
+    else {
+        log(`Open this URL in your browser to continue login:\n  ${authorizeUrl}`);
+    }
+    // 3. wait for the loopback callback (asserts state===correlation inside).
+    const code = await deps.waitForCode(deps.correlation);
+    // 4. exchange the one-time code + verifier for the JWT.
+    const exch = await postJson(`${base}/api/auth/exchange`, {
+        code,
+        code_verifier: deps.pkce.verifier,
+    });
+    if (exch.status === 401) {
+        throw new Error('Token exchange rejected (code expired or verifier mismatch). Try `sungen login` again.');
+    }
+    if (!exch.ok || !exch.data?.token) {
+        throw new Error(`Token exchange failed (HTTP ${exch.status}).`);
+    }
+    const token = exch.data.token;
+    // Backend reports expiry as an ISO `expires` string; accept a numeric
+    // `expires_at` epoch too. Absent → rely on 401-on-expiry (single token, no refresh).
+    const expires_at = exch.data.expires_at ??
+        (exch.data.expires ? Math.floor(Date.parse(exch.data.expires) / 1000) : undefined);
+    // 5. confirm identity (Bearer) and capture the email.
+    let me;
+    try {
+        me = await fetch(`${base}/api/auth/me`, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (err) {
+        throw new Error(`Network error confirming identity: ${err?.message ?? 'unknown'}`);
+    }
+    if (!me.ok) {
+        throw new Error(`Logged in but identity check failed (HTTP ${me.status}).`);
+    }
+    const meJson = await me.json();
+    const meBody = (meJson && meJson.data !== undefined ? meJson.data : meJson);
+    return { token, email: meBody.email, expires_at };
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/tools/sungen-auth/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/login-flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA2DH,oCAmEC;AAlGD,4DAA4D;AAC5D,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa;IACnD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,GAAa,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,mFAAmF;QACnF,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAM,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,GAAG,IAAI,wBAAwB,EAAE;QAC7E,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;KACpC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,MAAM,YAAY,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;IACzD,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,iFAAiF,YAAY,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,uDAAuD,YAAY,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEtD,wDAAwD;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,GAAG,IAAI,oBAAoB,EAAE;QACzE,IAAI;QACJ,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;KAClC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC9B,sEAAsE;IACtE,qFAAqF;IACrF,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,sDAAsD;IACtD,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAQ,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAe,CAAC;IAE1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/tools/sungen-auth/loopback-server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Single-shot loopback HTTP listener for the CLI login redirect.
+ *
+ * Binds 127.0.0.1 on an ephemeral port, waits for exactly one
+ * GET /callback?code=<otc>&state=<correlation>, asserts state===correlation
+ * (CSRF guard), shows a "you may close this tab" page, then closes.
+ */
+export interface Loopback {
+    /** The ephemeral port the listener bound to. */
+    port: number;
+    /** Full redirect_uri to hand to the backend (http://127.0.0.1:<port>/callback). */
+    redirectUri: string;
+    /** Resolve with the one-time code once the browser hits /callback; reject on timeout/mismatch. */
+    waitForCode(correlation: string, timeoutMs?: number): Promise<string>;
+    /** Force-close the listener (idempotent). */
+    close(): void;
+}
+/** Start the loopback listener. Resolves once it is bound and ready. */
+export declare function startLoopback(): Promise<Loopback>;
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/tools/sungen-auth/loopback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/loopback-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,6CAA6C;IAC7C,KAAK,IAAI,IAAI,CAAC;CACf;AASD,wEAAwE;AACxE,wBAAgB,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,CAkFjD"}

package/dist/tools/sungen-auth/loopback-server.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Single-shot loopback HTTP listener for the CLI login redirect.
+ *
+ * Binds 127.0.0.1 on an ephemeral port, waits for exactly one
+ * GET /callback?code=<otc>&state=<correlation>, asserts state===correlation
+ * (CSRF guard), shows a "you may close this tab" page, then closes.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startLoopback = startLoopback;
+const http = __importStar(require("http"));
+const CLOSE_PAGE = '<!doctype html><meta charset="utf-8"><title>sungen login</title>' +
+    '<body style="font-family:system-ui;padding:3rem;text-align:center">' +
+    '<h2>Login complete</h2><p>You may close this tab and return to the terminal.</p></body>';
+const DEFAULT_TIMEOUT_MS = 180000;
+/** Start the loopback listener. Resolves once it is bound and ready. */
+function startLoopback() {
+    return new Promise((resolve, reject) => {
+        let resolveCode = null;
+        let rejectCode = null;
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404, { Connection: 'close' }).end('not found');
+                return;
+            }
+            // Connection: close so the browser doesn't hold a keep-alive socket open —
+            // otherwise server.close() would never fire and the CLI would hang after login.
+            res.writeHead(200, { 'Content-Type': 'text/html', Connection: 'close' }).end(CLOSE_PAGE);
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            // Hand the parsed values to the pending waitForCode promise.
+            pending = { code, state };
+            drain();
+        });
+        // Track live sockets so shutdown() can destroy any keep-alive stragglers.
+        const sockets = new Set();
+        server.on('connection', (s) => {
+            sockets.add(s);
+            s.on('close', () => sockets.delete(s));
+        });
+        /** Close the server AND destroy lingering sockets so the event loop can drain. */
+        function shutdown() {
+            if (server.listening)
+                server.close();
+            for (const s of sockets)
+                s.destroy();
+            sockets.clear();
+        }
+        // Buffer the callback result until a waiter (with its correlation) arrives.
+        let pending = null;
+        let expectedCorrelation = null;
+        function drain() {
+            if (!pending || !resolveCode || !rejectCode || expectedCorrelation == null)
+                return;
+            const { code, state } = pending;
+            if (state !== expectedCorrelation) {
+                rejectCode(new Error('Login state mismatch — possible CSRF; aborting.'));
+            }
+            else if (!code) {
+                rejectCode(new Error('Login callback missing authorization code.'));
+            }
+            else {
+                resolveCode(code);
+            }
+            // Let the response flush first, then tear everything down.
+            setImmediate(shutdown);
+        }
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const port = server.address().port;
+            resolve({
+                port,
+                redirectUri: `http://127.0.0.1:${port}/callback`,
+                waitForCode(correlation, timeoutMs = DEFAULT_TIMEOUT_MS) {
+                    expectedCorrelation = correlation;
+                    return new Promise((res, rej) => {
+                        resolveCode = res;
+                        rejectCode = rej;
+                        const timer = setTimeout(() => {
+                            shutdown();
+                            rej(new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s waiting for browser login.`));
+                        }, timeoutMs);
+                        timer.unref?.();
+                        // Wrap to always clear the timer.
+                        const origRes = resolveCode, origRej = rejectCode;
+                        resolveCode = (c) => { clearTimeout(timer); origRes(c); };
+                        rejectCode = (e) => { clearTimeout(timer); origRej(e); };
+                        drain();
+                    });
+                },
+                close() {
+                    shutdown();
+                },
+            });
+        });
+    });
+}
+//# sourceMappingURL=loopback-server.js.map

package/dist/tools/sungen-auth/loopback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/loopback-server.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBH,sCAkFC;AAxGD,2CAA6B;AAc7B,MAAM,UAAU,GACd,kEAAkE;IAClE,qEAAqE;IACrE,yFAAyF,CAAC;AAE5F,MAAM,kBAAkB,GAAG,MAAO,CAAC;AAEnC,wEAAwE;AACxE,SAAgB,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,WAAW,GAAoC,IAAI,CAAC;QACxD,IAAI,UAAU,GAAkC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,2EAA2E;YAC3E,gFAAgF;YAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,6DAA6D;YAC7D,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1B,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,kFAAkF;QAClF,SAAS,QAAQ;YACf,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,GAAyD,IAAI,CAAC;QACzE,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAE9C,SAAS,KAAK;YACZ,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,mBAAmB,IAAI,IAAI;gBAAE,OAAO;YACnF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;YAChC,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,2DAA2D;YAC3D,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,OAAO,CAAC;gBACN,IAAI;gBACJ,WAAW,EAAE,oBAAoB,IAAI,WAAW;gBAChD,WAAW,CAAC,WAAW,EAAE,SAAS,GAAG,kBAAkB;oBACrD,mBAAmB,GAAG,WAAW,CAAC;oBAClC,OAAO,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;wBACtC,WAAW,GAAG,GAAG,CAAC;wBAClB,UAAU,GAAG,GAAG,CAAC;wBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;4BAC5B,QAAQ,EAAE,CAAC;4BACX,GAAG,CAAC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;wBAChG,CAAC,EAAE,SAAS,CAAC,CAAC;wBACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;wBAChB,kCAAkC;wBAClC,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,GAAG,UAAU,CAAC;wBAClD,WAAW,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC3D,UAAU,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1D,KAAK,EAAE,CAAC;oBACV,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK;oBACH,QAAQ,EAAE,CAAC;gBACb,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/sungen-auth/open-browser.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Cross-platform "open this URL in the default browser" helper.
+ *
+ * Deliberately dependency-free — a small platform switch instead of pulling in
+ * the `open` npm package. Returns false on failure so the caller can fall back
+ * to printing the URL for manual paste.
+ */
+/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */
+export declare function openBrowser(url: string): boolean;
+//# sourceMappingURL=open-browser.d.ts.map

package/dist/tools/sungen-auth/open-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/open-browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA8BhD"}

package/dist/tools/sungen-auth/open-browser.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * Cross-platform "open this URL in the default browser" helper.
+ *
+ * Deliberately dependency-free — a small platform switch instead of pulling in
+ * the `open` npm package. Returns false on failure so the caller can fall back
+ * to printing the URL for manual paste.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowser = openBrowser;
+const child_process_1 = require("child_process");
+/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */
+function openBrowser(url) {
+    let command;
+    let args;
+    switch (process.platform) {
+        case 'darwin':
+            command = 'open';
+            args = [url];
+            break;
+        case 'win32':
+            // `start` is a cmd builtin; the empty "" is the window-title placeholder.
+            command = 'cmd';
+            args = ['/c', 'start', '', url];
+            break;
+        default:
+            command = 'xdg-open';
+            args = [url];
+            break;
+    }
+    try {
+        const child = (0, child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore' });
+        // A missing launcher fails asynchronously here, after we've already returned
+        // true; that's why callers also print the URL rather than relying on this.
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/tools/sungen-auth/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/open-browser.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAKH,kCA8BC;AAjCD,iDAAsC;AAEtC,2FAA2F;AAC3F,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;QACR,KAAK,OAAO;YACV,0EAA0E;YAC1E,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM;QACR;YACE,OAAO,GAAG,UAAU,CAAC;YACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;IACV,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA4B,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/tools/sungen-auth/pkce.d.ts

@@ -0,0 +1,13 @@
+/**
+ * PKCE-S256 + correlation generation for the CLI login flow.
+ *
+ * The backend mandates S256 (plain is rejected). The verifier never leaves the
+ * process except inside the server-to-server `exchange` POST; the challenge is
+ * what travels to the browser side.
+ */
+import type { PkceMaterial } from './sungen-auth-types';
+/** Generate a fresh PKCE verifier + S256 challenge pair. */
+export declare function generatePkce(): PkceMaterial;
+/** Random opaque value used to bind the loopback callback to this attempt (CSRF guard). */
+export declare function randomCorrelation(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/tools/sungen-auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOxD,4DAA4D;AAC5D,wBAAgB,YAAY,IAAI,YAAY,CAI3C;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/tools/sungen-auth/pkce.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * PKCE-S256 + correlation generation for the CLI login flow.
+ *
+ * The backend mandates S256 (plain is rejected). The verifier never leaves the
+ * process except inside the server-to-server `exchange` POST; the challenge is
+ * what travels to the browser side.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkce = generatePkce;
+exports.randomCorrelation = randomCorrelation;
+const crypto_1 = require("crypto");
+/** base64url with padding stripped, per RFC 7636 §A. */
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Generate a fresh PKCE verifier + S256 challenge pair. */
+function generatePkce() {
+    const verifier = base64url((0, crypto_1.randomBytes)(32));
+    const challenge = base64url((0, crypto_1.createHash)('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+/** Random opaque value used to bind the loopback callback to this attempt (CSRF guard). */
+function randomCorrelation() {
+    return (0, crypto_1.randomBytes)(16).toString('hex');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/tools/sungen-auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/pkce.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAWH,oCAIC;AAGD,8CAEC;AAlBD,mCAAiD;AAGjD,wDAAwD;AACxD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,4DAA4D;AAC5D,SAAgB,YAAY;IAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2FAA2F;AAC3F,SAAgB,iBAAiB;IAC/B,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/tools/sungen-auth/sungen-auth-types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared types for the sungen CLI login flow (RFC 8252 native-app login against
+ * a FastSchema v0.13.0 backend: PKCE-S256 + loopback redirect + one-time code).
+ */
+/** Persisted, user-level credentials at ~/.sungen/credentials.json (mode 0600). */
+export interface Credentials {
+    /** Bearer JWT minted by the backend exchange step. */
+    token: string;
+    /** Authenticated account email (from /api/auth/me). */
+    email: string;
+    /** Backend base URL the token was issued against (so `feedback` knows where to POST). */
+    api_base_url: string;
+    /** Unix epoch seconds when the token expires, if the backend reports it (single token, no refresh). */
+    expires_at?: number;
+}
+/** Response of POST /api/auth/cli/initiate (unwrapped from the {data} envelope). */
+export interface InitiateResponse {
+    /** Signed carrier the dashboard login page consumes. */
+    carrier: string;
+    /** Path (not absolute) to open in the browser, e.g. /dash/login?cli=<carrier>. */
+    authorize_url: string;
+}
+/** Response of POST /api/auth/exchange (unwrapped from the {data} envelope). */
+export interface ExchangeResponse {
+    /** Bearer JWT. */
+    token: string;
+    /** ISO expiry string the backend returns (e.g. "2026-07-08T06:42:30Z"). */
+    expires?: string;
+    /** Numeric epoch-seconds expiry, if a build reports it instead. */
+    expires_at?: number;
+}
+/** Response of GET /api/auth/me (subset we rely on, unwrapped from {data}). */
+export interface MeResponse {
+    email: string;
+}
+/** PKCE material generated per login attempt; never persisted to disk. */
+export interface PkceMaterial {
+    verifier: string;
+    challenge: string;
+}
+//# sourceMappingURL=sungen-auth-types.d.ts.map

package/dist/tools/sungen-auth/sungen-auth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sungen-auth-types.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/sungen-auth-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,uGAAuG;IACvG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/tools/sungen-auth/sungen-auth-types.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Shared types for the sungen CLI login flow (RFC 8252 native-app login against
+ * a FastSchema v0.13.0 backend: PKCE-S256 + loopback redirect + one-time code).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sungen-auth-types.js.map

package/dist/tools/sungen-auth/sungen-auth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sungen-auth-types.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/sungen-auth-types.ts"],"names":[],"mappings":";AAAA;;;GAGG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.3-beta.3",
+  "version": "3.2.4",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -12,7 +12,7 @@
     "copy-templates": "mkdir -p dist/generators/test-generator/adapters/playwright/templates/steps && mkdir -p dist/generators/test-generator/templates && mkdir -p dist/orchestrator/templates && mkdir -p dist/dashboard/templates && cp -r src/generators/test-generator/adapters/playwright/templates/*.hbs dist/generators/test-generator/adapters/playwright/templates/ 2>/dev/null || true && cp -r src/generators/test-generator/adapters/playwright/templates/steps dist/generators/test-generator/adapters/playwright/templates/ && mkdir -p dist/generators/test-generator/adapters/appium/templates/steps && cp -r src/generators/test-generator/adapters/appium/templates/*.hbs dist/generators/test-generator/adapters/appium/templates/ 2>/dev/null || true && cp -r src/generators/test-generator/adapters/appium/templates/steps dist/generators/test-generator/adapters/appium/templates/ && cp src/generators/test-generator/templates/*.hbs dist/generators/test-generator/templates/ 2>/dev/null || true && cp -r src/orchestrator/templates/* dist/orchestrator/templates/ && cp src/dashboard/templates/index.html dist/dashboard/templates/index.html && mkdir -p dist/harness/catalog && cp src/harness/catalog/*.yaml dist/harness/catalog/",
     "build:dashboard": "cd ../../dashboard && npm install --silent && npm run build && cd - && cp ../../dashboard/dist/index.html src/dashboard/templates/index.html",
     "dev": "tsx src/cli/index.ts",
-    "test": "tsx tests/golden/run.ts && tsx tests/audit/run.ts && tsx tests/ingest/run.ts && tsx tests/eval/run.ts && tsx tests/exporter/run.ts && tsx tests/exporter/feature-parser-category.run.ts && tsx tests/exporter/api-detail-sheet.run.ts && tsx tests/exporter/mobile-app-id.run.ts && tsx tests/api-runtime/base-path-url-join.run.ts && tsx tests/capabilities/run.ts && tsx tests/openapi/run.ts && tsx tests/packaging/run.ts && tsx tests/generate-hint/run.ts && tsx tests/template-assertion/run.ts && tsx tests/journey/run.ts && tsx tests/harness/serial-cascade.run.ts && tsx src/orchestrator/ai-skills/golden-skills.test.ts",
+    "test": "tsx tests/golden/run.ts && tsx tests/audit/run.ts && tsx tests/ingest/run.ts && tsx tests/eval/run.ts && tsx tests/exporter/run.ts && tsx tests/exporter/feature-parser-category.run.ts && tsx tests/exporter/api-detail-sheet.run.ts && tsx tests/exporter/overview-sheet.run.ts && tsx tests/exporter/delivery-divider-tcid.run.ts && tsx tests/exporter/note-expected-actual.run.ts && tsx tests/exporter/test-data-vars.run.ts && tsx tests/exporter/mobile-app-id.run.ts && tsx tests/api-runtime/base-path-url-join.run.ts && tsx tests/capabilities/run.ts && tsx tests/openapi/run.ts && tsx tests/packaging/run.ts && tsx tests/generate-hint/run.ts && tsx tests/template-assertion/run.ts && tsx tests/journey/run.ts && tsx tests/harness/serial-cascade.run.ts && tsx tests/ai-skills/cross-assistant-orphan.run.ts && tsx src/orchestrator/ai-skills/golden-skills.test.ts",
     "test:update": "tsx tests/golden/run.ts --update && tsx tests/audit/run.ts --update && tsx tests/ingest/run.ts --update",
     "prepublishOnly": "npm run build:dashboard && npm run build"
   },
@@ -33,7 +33,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@sungen/driver-ui": "3.2.3-beta.3",
+    "@sungen/driver-ui": "3.2.4",
     "@anthropic-ai/sdk": "^0.71.0",
     "@babel/parser": "^7.28.5",
     "@babel/traverse": "^7.28.5",