@sun-asterisk/sungen 3.2.3 → 3.2.5

package/dist/tools/sungen-api/read-stdin.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Read piped stdin to a string. Returns null when stdin is a TTY (interactive),
+ * so callers can distinguish "no piped input" from "empty pipe".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStdin = readStdin;
+function readStdin() {
+    if (process.stdin.isTTY)
+        return Promise.resolve(null);
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => { data += chunk; });
+        process.stdin.on('end', () => resolve(data));
+        process.stdin.on('error', reject);
+    });
+}
+//# sourceMappingURL=read-stdin.js.map

package/dist/tools/sungen-api/read-stdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-stdin.js","sourceRoot":"","sources":["../../../src/tools/sungen-api/read-stdin.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAEH,8BASC;AATD,SAAgB,SAAS;IACvB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/sungen-auth/api-base-url.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolves the feedback backend base URL with a fixed precedence so `login` and
+ * `feedback` agree on where to talk.
+ *
+ * Precedence: explicit flag > SUNGEN_API_BASE_URL env > stored credential's
+ * api_base_url > DEFAULT_API_BASE_URL.
+ *
+ * DEFAULT_API_BASE_URL is the deployed production host, so the common case needs
+ * no config; override via --api-base-url / SUNGEN_API_BASE_URL for dev/staging.
+ */
+/** Deployed feedback backend (production). Override with SUNGEN_API_BASE_URL locally. */
+export declare const DEFAULT_API_BASE_URL = "https://sungen.sun-asterisk.vn";
+export declare function resolveApiBaseUrl(flagValue?: string): string;
+//# sourceMappingURL=api-base-url.d.ts.map

package/dist/tools/sungen-auth/api-base-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-base-url.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/api-base-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,mCAAmC,CAAC;AAErE,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5D"}

package/dist/tools/sungen-auth/api-base-url.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Resolves the feedback backend base URL with a fixed precedence so `login` and
+ * `feedback` agree on where to talk.
+ *
+ * Precedence: explicit flag > SUNGEN_API_BASE_URL env > stored credential's
+ * api_base_url > DEFAULT_API_BASE_URL.
+ *
+ * DEFAULT_API_BASE_URL is the deployed production host, so the common case needs
+ * no config; override via --api-base-url / SUNGEN_API_BASE_URL for dev/staging.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_API_BASE_URL = void 0;
+exports.resolveApiBaseUrl = resolveApiBaseUrl;
+const credentials_store_1 = require("./credentials-store");
+/** Deployed feedback backend (production). Override with SUNGEN_API_BASE_URL locally. */
+exports.DEFAULT_API_BASE_URL = 'https://sungen.sun-asterisk.vn';
+function resolveApiBaseUrl(flagValue) {
+    if (flagValue)
+        return flagValue;
+    if (process.env.SUNGEN_API_BASE_URL)
+        return process.env.SUNGEN_API_BASE_URL;
+    const stored = (0, credentials_store_1.loadCredentials)();
+    if (stored?.api_base_url)
+        return stored.api_base_url;
+    return exports.DEFAULT_API_BASE_URL;
+}
+//# sourceMappingURL=api-base-url.js.map

package/dist/tools/sungen-auth/api-base-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-base-url.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/api-base-url.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAOH,8CAMC;AAXD,2DAAsD;AAEtD,yFAAyF;AAC5E,QAAA,oBAAoB,GAAG,gCAAgC,CAAC;AAErE,SAAgB,iBAAiB,CAAC,SAAkB;IAClD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,mCAAe,GAAE,CAAC;IACjC,IAAI,MAAM,EAAE,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IACrD,OAAO,4BAAoB,CAAC;AAC9B,CAAC"}

package/dist/tools/sungen-auth/credentials-store.d.ts

@@ -0,0 +1,19 @@
+/**
+ * User-level credential storage at ~/.sungen/credentials.json.
+ *
+ * Deliberately user-scoped (not project-local like the Figma PAT in .env): the
+ * login token is tied to the person and works across every sungen project.
+ * File mode 0600, parent dir 0700 — the token is a bearer secret.
+ */
+import type { Credentials } from './sungen-auth-types';
+/** Absolute path to the credentials file (~/.sungen/credentials.json). */
+export declare function credentialsPath(): string;
+/** Load stored credentials, or null when absent / unreadable / malformed. */
+export declare function loadCredentials(): Credentials | null;
+/** Persist credentials with restrictive permissions (dir 0700, file 0600). */
+export declare function saveCredentials(creds: Credentials): void;
+/** Remove the credentials file; no-op when absent. */
+export declare function clearCredentials(): void;
+/** True when the credential carries an expiry that is already past (no refresh token — prompt re-login on expiry). */
+export declare function isExpired(creds: Credentials): boolean;
+//# sourceMappingURL=credentials-store.d.ts.map

package/dist/tools/sungen-auth/credentials-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CASpD;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAOxD;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,IAAI,IAAI,CAMvC;AAED,sHAAsH;AACtH,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAGrD"}

package/dist/tools/sungen-auth/credentials-store.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * User-level credential storage at ~/.sungen/credentials.json.
+ *
+ * Deliberately user-scoped (not project-local like the Figma PAT in .env): the
+ * login token is tied to the person and works across every sungen project.
+ * File mode 0600, parent dir 0700 — the token is a bearer secret.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialsPath = credentialsPath;
+exports.loadCredentials = loadCredentials;
+exports.saveCredentials = saveCredentials;
+exports.clearCredentials = clearCredentials;
+exports.isExpired = isExpired;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const DIR_NAME = '.sungen';
+const FILE_NAME = 'credentials.json';
+/** Absolute path to the credentials file (~/.sungen/credentials.json). */
+function credentialsPath() {
+    return path.join(os.homedir(), DIR_NAME, FILE_NAME);
+}
+/** Load stored credentials, or null when absent / unreadable / malformed. */
+function loadCredentials() {
+    try {
+        const raw = fs.readFileSync(credentialsPath(), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed.token !== 'string')
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist credentials with restrictive permissions (dir 0700, file 0600). */
+function saveCredentials(creds) {
+    const dir = path.join(os.homedir(), DIR_NAME);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const fp = credentialsPath();
+    // Write then chmod so an existing looser-mode file is tightened too.
+    fs.writeFileSync(fp, JSON.stringify(creds, null, 2), { mode: 0o600 });
+    fs.chmodSync(fp, 0o600);
+}
+/** Remove the credentials file; no-op when absent. */
+function clearCredentials() {
+    try {
+        fs.unlinkSync(credentialsPath());
+    }
+    catch {
+        /* already gone */
+    }
+}
+/** True when the credential carries an expiry that is already past (no refresh token — prompt re-login on expiry). */
+function isExpired(creds) {
+    if (typeof creds.expires_at !== 'number')
+        return false;
+    return creds.expires_at * 1000 <= Date.now();
+}
+//# sourceMappingURL=credentials-store.js.map

package/dist/tools/sungen-auth/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/credentials-store.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWH,0CAEC;AAGD,0CASC;AAGD,0CAOC;AAGD,4CAMC;AAGD,8BAGC;AAhDD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,0EAA0E;AAC1E,SAAgB,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,6EAA6E;AAC7E,SAAgB,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,KAAkB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B,qEAAqE;IACrE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,sDAAsD;AACtD,SAAgB,gBAAgB;IAC9B,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,SAAgB,SAAS,CAAC,KAAkB;IAC1C,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/tools/sungen-auth/login-flow.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The 6-call RFC 8252 CLI login flow against FastSchema v0.13.0.
+ *
+ * Base path is /api/auth (verified live against the running v0.13.0 server;
+ * the earlier /api/user/auth contract was wrong). PKCE-S256 + single-use
+ * one-time code; the JWT is minted server-side
+ * and only delivered via the server-to-server `exchange` — it never appears in
+ * the browser. This module does NO disk I/O so it stays unit-testable.
+ */
+import type { PkceMaterial } from './sungen-auth-types';
+export interface LoginFlowDeps {
+    apiBaseUrl: string;
+    pkce: PkceMaterial;
+    correlation: string;
+    redirectUri: string;
+    /** Open the authorize URL; return false to trigger the manual-paste fallback. */
+    openBrowser: (url: string) => boolean;
+    /** Resolve with the one-time code once the loopback callback fires. */
+    waitForCode: (correlation: string, timeoutMs?: number) => Promise<string>;
+    /** Optional sink for user-facing progress lines (defaults to console.log). */
+    log?: (msg: string) => void;
+}
+export interface LoginResult {
+    token: string;
+    email: string;
+    expires_at?: number;
+}
+/**
+ * Run the full login flow. Throws with a clear, distinct message for each
+ * failure mode (feature-off, missing challenge, exchange-401, etc.).
+ */
+export declare function runLoginFlow(deps: LoginFlowDeps): Promise<LoginResult>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/tools/sungen-auth/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/login-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,uEAAuE;IACvE,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,8EAA8E;IAC9E,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6BD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAmE5E"}

package/dist/tools/sungen-auth/login-flow.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * The 6-call RFC 8252 CLI login flow against FastSchema v0.13.0.
+ *
+ * Base path is /api/auth (verified live against the running v0.13.0 server;
+ * the earlier /api/user/auth contract was wrong). PKCE-S256 + single-use
+ * one-time code; the JWT is minted server-side
+ * and only delivered via the server-to-server `exchange` — it never appears in
+ * the browser. This module does NO disk I/O so it stays unit-testable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runLoginFlow = runLoginFlow;
+/** Strip a trailing slash so path joins never double up. */
+function normalizeBase(url) {
+    return url.replace(/\/+$/, '');
+}
+async function postJson(url, body) {
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        throw new Error(`Network error reaching ${url}: ${err?.message ?? 'unknown'}`);
+    }
+    let data = null;
+    try {
+        const json = await res.json();
+        // FastSchema wraps success payloads in { data: ... } and errors in { error: ... }.
+        data = (json && json.data !== undefined ? json.data : json);
+    }
+    catch {
+        /* non-JSON body */
+    }
+    return { ok: res.ok, status: res.status, data };
+}
+/**
+ * Run the full login flow. Throws with a clear, distinct message for each
+ * failure mode (feature-off, missing challenge, exchange-401, etc.).
+ */
+async function runLoginFlow(deps) {
+    const base = normalizeBase(deps.apiBaseUrl);
+    const log = deps.log ?? ((m) => console.log(m));
+    // 1. initiate — exchange PKCE challenge + loopback redirect for a carrier.
+    const init = await postJson(`${base}/api/auth/cli/initiate`, {
+        redirect_uri: deps.redirectUri,
+        correlation: deps.correlation,
+        code_challenge: deps.pkce.challenge,
+    });
+    if (init.status === 403) {
+        throw new Error('CLI login is disabled on the server (AUTH_CLI_LOGIN_ENABLED=false).');
+    }
+    if (init.status === 400) {
+        throw new Error('Server rejected the login request (missing/invalid PKCE challenge or redirect).');
+    }
+    if (!init.ok || !init.data?.authorize_url) {
+        throw new Error(`Login initiate failed (HTTP ${init.status}).`);
+    }
+    // 2. open the dashboard login page (authorize_url is a path → join with base).
+    const authorizeUrl = `${base}${init.data.authorize_url}`;
+    // Always print the URL: openBrowser reports success even when the launcher
+    // fails asynchronously (e.g. headless box with no xdg-open), so the paste
+    // path must stay visible regardless.
+    const opened = deps.openBrowser(authorizeUrl);
+    if (opened) {
+        log(`Opened your browser to complete login. Waiting…\nIf it didn't open, visit:\n  ${authorizeUrl}`);
+    }
+    else {
+        log(`Open this URL in your browser to continue login:\n  ${authorizeUrl}`);
+    }
+    // 3. wait for the loopback callback (asserts state===correlation inside).
+    const code = await deps.waitForCode(deps.correlation);
+    // 4. exchange the one-time code + verifier for the JWT.
+    const exch = await postJson(`${base}/api/auth/exchange`, {
+        code,
+        code_verifier: deps.pkce.verifier,
+    });
+    if (exch.status === 401) {
+        throw new Error('Token exchange rejected (code expired or verifier mismatch). Try `sungen login` again.');
+    }
+    if (!exch.ok || !exch.data?.token) {
+        throw new Error(`Token exchange failed (HTTP ${exch.status}).`);
+    }
+    const token = exch.data.token;
+    // Backend reports expiry as an ISO `expires` string; accept a numeric
+    // `expires_at` epoch too. Absent → rely on 401-on-expiry (single token, no refresh).
+    const expires_at = exch.data.expires_at ??
+        (exch.data.expires ? Math.floor(Date.parse(exch.data.expires) / 1000) : undefined);
+    // 5. confirm identity (Bearer) and capture the email.
+    let me;
+    try {
+        me = await fetch(`${base}/api/auth/me`, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (err) {
+        throw new Error(`Network error confirming identity: ${err?.message ?? 'unknown'}`);
+    }
+    if (!me.ok) {
+        throw new Error(`Logged in but identity check failed (HTTP ${me.status}).`);
+    }
+    const meJson = await me.json();
+    const meBody = (meJson && meJson.data !== undefined ? meJson.data : meJson);
+    return { token, email: meBody.email, expires_at };
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/tools/sungen-auth/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/login-flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA2DH,oCAmEC;AAlGD,4DAA4D;AAC5D,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa;IACnD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,KAAK,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,GAAa,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,mFAAmF;QACnF,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAM,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,GAAG,IAAI,wBAAwB,EAAE;QAC7E,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;KACpC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,MAAM,YAAY,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;IACzD,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,iFAAiF,YAAY,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,uDAAuD,YAAY,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEtD,wDAAwD;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,GAAG,IAAI,oBAAoB,EAAE;QACzE,IAAI;QACJ,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;KAClC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC9B,sEAAsE;IACtE,qFAAqF;IACrF,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,sDAAsD;IACtD,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAQ,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAe,CAAC;IAE1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/tools/sungen-auth/loopback-server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Single-shot loopback HTTP listener for the CLI login redirect.
+ *
+ * Binds 127.0.0.1 on an ephemeral port, waits for exactly one
+ * GET /callback?code=<otc>&state=<correlation>, asserts state===correlation
+ * (CSRF guard), shows a "you may close this tab" page, then closes.
+ */
+export interface Loopback {
+    /** The ephemeral port the listener bound to. */
+    port: number;
+    /** Full redirect_uri to hand to the backend (http://127.0.0.1:<port>/callback). */
+    redirectUri: string;
+    /** Resolve with the one-time code once the browser hits /callback; reject on timeout/mismatch. */
+    waitForCode(correlation: string, timeoutMs?: number): Promise<string>;
+    /** Force-close the listener (idempotent). */
+    close(): void;
+}
+/** Start the loopback listener. Resolves once it is bound and ready. */
+export declare function startLoopback(): Promise<Loopback>;
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/tools/sungen-auth/loopback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/loopback-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,6CAA6C;IAC7C,KAAK,IAAI,IAAI,CAAC;CACf;AASD,wEAAwE;AACxE,wBAAgB,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,CAkFjD"}

package/dist/tools/sungen-auth/loopback-server.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Single-shot loopback HTTP listener for the CLI login redirect.
+ *
+ * Binds 127.0.0.1 on an ephemeral port, waits for exactly one
+ * GET /callback?code=<otc>&state=<correlation>, asserts state===correlation
+ * (CSRF guard), shows a "you may close this tab" page, then closes.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startLoopback = startLoopback;
+const http = __importStar(require("http"));
+const CLOSE_PAGE = '<!doctype html><meta charset="utf-8"><title>sungen login</title>' +
+    '<body style="font-family:system-ui;padding:3rem;text-align:center">' +
+    '<h2>Login complete</h2><p>You may close this tab and return to the terminal.</p></body>';
+const DEFAULT_TIMEOUT_MS = 180000;
+/** Start the loopback listener. Resolves once it is bound and ready. */
+function startLoopback() {
+    return new Promise((resolve, reject) => {
+        let resolveCode = null;
+        let rejectCode = null;
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404, { Connection: 'close' }).end('not found');
+                return;
+            }
+            // Connection: close so the browser doesn't hold a keep-alive socket open —
+            // otherwise server.close() would never fire and the CLI would hang after login.
+            res.writeHead(200, { 'Content-Type': 'text/html', Connection: 'close' }).end(CLOSE_PAGE);
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            // Hand the parsed values to the pending waitForCode promise.
+            pending = { code, state };
+            drain();
+        });
+        // Track live sockets so shutdown() can destroy any keep-alive stragglers.
+        const sockets = new Set();
+        server.on('connection', (s) => {
+            sockets.add(s);
+            s.on('close', () => sockets.delete(s));
+        });
+        /** Close the server AND destroy lingering sockets so the event loop can drain. */
+        function shutdown() {
+            if (server.listening)
+                server.close();
+            for (const s of sockets)
+                s.destroy();
+            sockets.clear();
+        }
+        // Buffer the callback result until a waiter (with its correlation) arrives.
+        let pending = null;
+        let expectedCorrelation = null;
+        function drain() {
+            if (!pending || !resolveCode || !rejectCode || expectedCorrelation == null)
+                return;
+            const { code, state } = pending;
+            if (state !== expectedCorrelation) {
+                rejectCode(new Error('Login state mismatch — possible CSRF; aborting.'));
+            }
+            else if (!code) {
+                rejectCode(new Error('Login callback missing authorization code.'));
+            }
+            else {
+                resolveCode(code);
+            }
+            // Let the response flush first, then tear everything down.
+            setImmediate(shutdown);
+        }
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const port = server.address().port;
+            resolve({
+                port,
+                redirectUri: `http://127.0.0.1:${port}/callback`,
+                waitForCode(correlation, timeoutMs = DEFAULT_TIMEOUT_MS) {
+                    expectedCorrelation = correlation;
+                    return new Promise((res, rej) => {
+                        resolveCode = res;
+                        rejectCode = rej;
+                        const timer = setTimeout(() => {
+                            shutdown();
+                            rej(new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s waiting for browser login.`));
+                        }, timeoutMs);
+                        timer.unref?.();
+                        // Wrap to always clear the timer.
+                        const origRes = resolveCode, origRej = rejectCode;
+                        resolveCode = (c) => { clearTimeout(timer); origRes(c); };
+                        rejectCode = (e) => { clearTimeout(timer); origRej(e); };
+                        drain();
+                    });
+                },
+                close() {
+                    shutdown();
+                },
+            });
+        });
+    });
+}
+//# sourceMappingURL=loopback-server.js.map

package/dist/tools/sungen-auth/loopback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/loopback-server.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBH,sCAkFC;AAxGD,2CAA6B;AAc7B,MAAM,UAAU,GACd,kEAAkE;IAClE,qEAAqE;IACrE,yFAAyF,CAAC;AAE5F,MAAM,kBAAkB,GAAG,MAAO,CAAC;AAEnC,wEAAwE;AACxE,SAAgB,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,WAAW,GAAoC,IAAI,CAAC;QACxD,IAAI,UAAU,GAAkC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,2EAA2E;YAC3E,gFAAgF;YAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,6DAA6D;YAC7D,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1B,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,kFAAkF;QAClF,SAAS,QAAQ;YACf,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,GAAyD,IAAI,CAAC;QACzE,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAE9C,SAAS,KAAK;YACZ,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,mBAAmB,IAAI,IAAI;gBAAE,OAAO;YACnF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;YAChC,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,2DAA2D;YAC3D,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,OAAO,CAAC;gBACN,IAAI;gBACJ,WAAW,EAAE,oBAAoB,IAAI,WAAW;gBAChD,WAAW,CAAC,WAAW,EAAE,SAAS,GAAG,kBAAkB;oBACrD,mBAAmB,GAAG,WAAW,CAAC;oBAClC,OAAO,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;wBACtC,WAAW,GAAG,GAAG,CAAC;wBAClB,UAAU,GAAG,GAAG,CAAC;wBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;4BAC5B,QAAQ,EAAE,CAAC;4BACX,GAAG,CAAC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;wBAChG,CAAC,EAAE,SAAS,CAAC,CAAC;wBACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;wBAChB,kCAAkC;wBAClC,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,GAAG,UAAU,CAAC;wBAClD,WAAW,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC3D,UAAU,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1D,KAAK,EAAE,CAAC;oBACV,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK;oBACH,QAAQ,EAAE,CAAC;gBACb,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/sungen-auth/open-browser.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Cross-platform "open this URL in the default browser" helper.
+ *
+ * Deliberately dependency-free — a small platform switch instead of pulling in
+ * the `open` npm package. Returns false on failure so the caller can fall back
+ * to printing the URL for manual paste.
+ */
+/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */
+export declare function openBrowser(url: string): boolean;
+//# sourceMappingURL=open-browser.d.ts.map

package/dist/tools/sungen-auth/open-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/open-browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA8BhD"}

package/dist/tools/sungen-auth/open-browser.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * Cross-platform "open this URL in the default browser" helper.
+ *
+ * Deliberately dependency-free — a small platform switch instead of pulling in
+ * the `open` npm package. Returns false on failure so the caller can fall back
+ * to printing the URL for manual paste.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowser = openBrowser;
+const child_process_1 = require("child_process");
+/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */
+function openBrowser(url) {
+    let command;
+    let args;
+    switch (process.platform) {
+        case 'darwin':
+            command = 'open';
+            args = [url];
+            break;
+        case 'win32':
+            // `start` is a cmd builtin; the empty "" is the window-title placeholder.
+            command = 'cmd';
+            args = ['/c', 'start', '', url];
+            break;
+        default:
+            command = 'xdg-open';
+            args = [url];
+            break;
+    }
+    try {
+        const child = (0, child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore' });
+        // A missing launcher fails asynchronously here, after we've already returned
+        // true; that's why callers also print the URL rather than relying on this.
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/tools/sungen-auth/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/open-browser.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAKH,kCA8BC;AAjCD,iDAAsC;AAEtC,2FAA2F;AAC3F,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;QACR,KAAK,OAAO;YACV,0EAA0E;YAC1E,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM;QACR;YACE,OAAO,GAAG,UAAU,CAAC;YACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;IACV,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA4B,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/tools/sungen-auth/pkce.d.ts

@@ -0,0 +1,13 @@
+/**
+ * PKCE-S256 + correlation generation for the CLI login flow.
+ *
+ * The backend mandates S256 (plain is rejected). The verifier never leaves the
+ * process except inside the server-to-server `exchange` POST; the challenge is
+ * what travels to the browser side.
+ */
+import type { PkceMaterial } from './sungen-auth-types';
+/** Generate a fresh PKCE verifier + S256 challenge pair. */
+export declare function generatePkce(): PkceMaterial;
+/** Random opaque value used to bind the loopback callback to this attempt (CSRF guard). */
+export declare function randomCorrelation(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/tools/sungen-auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/tools/sungen-auth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOxD,4DAA4D;AAC5D,wBAAgB,YAAY,IAAI,YAAY,CAI3C;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/tools/sungen-auth/pkce.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * PKCE-S256 + correlation generation for the CLI login flow.
+ *
+ * The backend mandates S256 (plain is rejected). The verifier never leaves the
+ * process except inside the server-to-server `exchange` POST; the challenge is
+ * what travels to the browser side.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkce = generatePkce;
+exports.randomCorrelation = randomCorrelation;
+const crypto_1 = require("crypto");
+/** base64url with padding stripped, per RFC 7636 §A. */
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Generate a fresh PKCE verifier + S256 challenge pair. */
+function generatePkce() {
+    const verifier = base64url((0, crypto_1.randomBytes)(32));
+    const challenge = base64url((0, crypto_1.createHash)('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+/** Random opaque value used to bind the loopback callback to this attempt (CSRF guard). */
+function randomCorrelation() {
+    return (0, crypto_1.randomBytes)(16).toString('hex');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/tools/sungen-auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/tools/sungen-auth/pkce.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAWH,oCAIC;AAGD,8CAEC;AAlBD,mCAAiD;AAGjD,wDAAwD;AACxD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,4DAA4D;AAC5D,SAAgB,YAAY;IAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2FAA2F;AAC3F,SAAgB,iBAAiB;IAC/B,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}