@taprootio/site-authoring 0.1.0

package/src/config.js

@@ -0,0 +1,412 @@
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+
+import {
+  CLI_BINARY_NAME,
+  CONFIG_FILE_NAME,
+  CONFIG_VERSION,
+  ENVIRONMENT_LOCAL,
+  ENVIRONMENT_PRODUCTION,
+  LIMITS,
+  VERB_ENV,
+} from "./constants.js";
+import { hasAsciiControl, isCanonicalUuid, SiteAuthoringError } from "./errors.js";
+import { parseJsonWithDuplicateGuard } from "./json-guard.js";
+
+const CONFIG_KEYS = new Set([
+  "configVersion",
+  "siteId",
+  "workspaceDir",
+]);
+const WINDOWS_DEVICE_BASENAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
+// The duplicate-key guard lives in json-guard.js now, shared with the machine
+// settings. It is still needed here for the reason it was written: a
+// configuration that says `siteId` twice is ambiguous about which site the
+// next command will write to, and the only safe reading of an ambiguous target
+// is to refuse it.
+function parseConfigJson(text) {
+  return parseJsonWithDuplicateGuard(text, {
+    onDuplicate: (key) =>
+      new SiteAuthoringError(
+        "config.duplicate_key",
+        `Configuration field '${key}' appears more than once.`,
+        { field: key },
+      ),
+    onInvalid: () =>
+      new SiteAuthoringError("config.invalid_json", "The site authoring configuration is not valid JSON."),
+  });
+}
+
+export async function readInspectedConfigFile(
+  filePath,
+  stats,
+  maximumBytes = LIMITS.configBytes,
+  errorField,
+) {
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    throw new SiteAuthoringError(
+      "config.not_regular",
+      "The site authoring configuration must be a regular file, not a link or directory.",
+      { field: errorField },
+    );
+  }
+  if (stats.size > BigInt(maximumBytes)) {
+    throw new SiteAuthoringError(
+      "config.too_large",
+      `The site authoring configuration exceeds ${maximumBytes} bytes.`,
+      { field: errorField },
+    );
+  }
+
+  let handle;
+  try {
+    handle = await open(
+      filePath,
+      fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0),
+    );
+    const before = await handle.stat({ bigint: true });
+    if (
+      !before.isFile()
+      || before.dev !== stats.dev
+      || before.ino !== stats.ino
+      || before.size !== stats.size
+      || before.mtimeNs !== stats.mtimeNs
+      || before.ctimeNs !== stats.ctimeNs
+      || before.size > BigInt(maximumBytes)
+    ) {
+      throw new SiteAuthoringError("config.changed", "The configuration changed while it was being opened.", {
+        field: errorField,
+      });
+    }
+    const buffer = Buffer.allocUnsafe(maximumBytes + 1);
+    let total = 0;
+    while (total <= maximumBytes) {
+      const { bytesRead } = await handle.read(buffer, total, buffer.byteLength - total, total);
+      if (bytesRead === 0) break;
+      total += bytesRead;
+    }
+    const after = await handle.stat({ bigint: true });
+    if (
+      after.dev !== before.dev
+      || after.ino !== before.ino
+      || after.size !== before.size
+      || after.mtimeNs !== before.mtimeNs
+      || after.ctimeNs !== before.ctimeNs
+      || total > maximumBytes
+      || total !== Number(after.size)
+    ) {
+      throw new SiteAuthoringError("config.changed", "The configuration changed while it was being read.", {
+        field: errorField,
+      });
+    }
+    return buffer.subarray(0, total);
+  } catch (error) {
+    if (error instanceof SiteAuthoringError) throw error;
+    throw new SiteAuthoringError("config.unreadable", "Could not read the site authoring configuration.", {
+      field: errorField,
+    });
+  } finally {
+    await handle?.close().catch(() => {});
+  }
+}
+
+async function readRegularFile(filePath, maximumBytes, missingCode, errorField) {
+  let stats;
+  try {
+    stats = await lstat(filePath, { bigint: true });
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      throw new SiteAuthoringError(missingCode, `Configuration file '${filePath}' does not exist.`, {
+        field: errorField,
+      });
+    }
+    throw new SiteAuthoringError("config.unreadable", `Could not inspect configuration file '${filePath}'.`, {
+      field: errorField,
+    });
+  }
+  return await readInspectedConfigFile(filePath, stats, maximumBytes, errorField);
+}
+
+async function discoverConfig(cwd) {
+  let current;
+  try {
+    current = await realpath(cwd);
+  } catch {
+    throw new SiteAuthoringError("config.cwd_invalid", "The working directory does not exist or cannot be resolved.");
+  }
+  const matches = [];
+  for (let depth = 0; depth < LIMITS.configDiscoveryParents; depth += 1) {
+    const candidate = path.join(current, CONFIG_FILE_NAME);
+    try {
+      await lstat(candidate);
+      matches.push(candidate);
+    } catch (error) {
+      if (!error || typeof error !== "object" || error.code !== "ENOENT") {
+        throw new SiteAuthoringError(
+          "config.discovery_failed",
+          "Could not inspect a site authoring configuration candidate.",
+        );
+      }
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      if (matches.length === 0) {
+        throw new SiteAuthoringError(
+          "config.not_found",
+          `No ${CONFIG_FILE_NAME} was found. Pass --config or add the file to the repository.`,
+        );
+      }
+      if (matches.length > 1) {
+        throw new SiteAuthoringError(
+          "config.ambiguous",
+          `More than one ${CONFIG_FILE_NAME} was found in the parent chain. Pass --config explicitly.`,
+        );
+      }
+      return matches[0];
+    }
+    current = parent;
+  }
+  throw new SiteAuthoringError(
+    "config.discovery_limit",
+    `Configuration discovery exceeded ${LIMITS.configDiscoveryParents} parent directories. Pass --config explicitly.`,
+  );
+}
+
+async function resolveExplicitConfigPath(cwd, configPath) {
+  const lexicalCwd = path.resolve(cwd);
+  let canonicalCwd;
+  try {
+    canonicalCwd = await realpath(lexicalCwd);
+  } catch {
+    throw new SiteAuthoringError("config.cwd_invalid", "The working directory does not exist or cannot be resolved.");
+  }
+
+  if (!path.isAbsolute(configPath)) return path.resolve(canonicalCwd, configPath);
+
+  const lexicalSelectedPath = path.resolve(configPath);
+  const relativePath = path.relative(lexicalCwd, lexicalSelectedPath);
+  const isWithinCwd = relativePath === ""
+    || (
+      relativePath !== ".."
+      && !relativePath.startsWith(`..${path.sep}`)
+      && !path.isAbsolute(relativePath)
+    );
+  return isWithinCwd
+    ? path.resolve(canonicalCwd, relativePath)
+    : lexicalSelectedPath;
+}
+
+/**
+ * The reviewed-origin allowlist. It runs before any client exists and
+ * therefore before any Authorization header can be constructed, which is the
+ * whole point: the credential is site-scoped and long-lived, and the one
+ * failure that cannot be walked back is sending it to a host we do not
+ * control. Loopback keeps the local Tilt stack usable without widening the
+ * reviewed set.
+ */
+export function validateApiBaseUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new SiteAuthoringError("config.api_base_url", "apiBaseUrl must be an absolute Taproot API URL.", {
+      field: "apiBaseUrl",
+    });
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  const reviewedHost = url.hostname === "app.taproot.io" || url.hostname === "app.taproot.test";
+  if (
+    (!reviewedHost && !loopback)
+    || (url.protocol !== "https:" && !(loopback && url.protocol === "http:"))
+    || (reviewedHost && url.port !== "")
+    || url.username !== ""
+    || url.password !== ""
+    || url.search !== ""
+    || url.hash !== ""
+    || url.pathname.replace(/\/+$/u, "") !== "/api"
+  ) {
+    throw new SiteAuthoringError(
+      "config.api_base_url",
+      "apiBaseUrl must be the /api endpoint on app.taproot.io, app.taproot.test, or an explicit loopback origin.",
+      { field: "apiBaseUrl" },
+    );
+  }
+  return url.toString().replace(/\/+$/u, "");
+}
+
+function validateWorkspaceDirectoryText(value) {
+  if (
+    typeof value !== "string"
+    || value.length === 0
+    || Buffer.byteLength(value, "utf8") > LIMITS.workspacePathBytes
+    || hasAsciiControl(value)
+    || path.isAbsolute(value)
+    || value.includes("\\")
+    || value.split("/").some((segment) => {
+      const base = segment.split(".")[0]?.replace(/[ .]+$/u, "") ?? "";
+      return segment === "" || segment === "." || segment === ".." || WINDOWS_DEVICE_BASENAME.test(base);
+    })
+  ) {
+    throw new SiteAuthoringError(
+      "config.workspace_dir",
+      "workspaceDir must be a bounded relative POSIX path beneath the configuration directory.",
+      { field: "workspaceDir" },
+    );
+  }
+  return value;
+}
+
+/**
+ * Resolves the local workspace `pull` writes into. Unlike a publish artifact,
+ * the workspace legitimately does not exist yet on a fresh clone — so a
+ * missing leaf is allowed, while every segment that *does* exist must be a
+ * real directory. A symlink anywhere in the chain is refused rather than
+ * followed: the workspace is a write target, and following a link is how a
+ * checked-in configuration turns `pull` into an arbitrary-file writer.
+ */
+async function resolveWorkspaceDirectory(configDirectory, relativeDirectory) {
+  let current = configDirectory;
+  let exists = true;
+  for (const segment of relativeDirectory.split("/")) {
+    current = path.join(current, segment);
+    if (!exists) continue;
+    let stats;
+    try {
+      stats = await lstat(current, { bigint: true });
+    } catch (error) {
+      if (error && typeof error === "object" && error.code === "ENOENT") {
+        exists = false;
+        continue;
+      }
+      throw new SiteAuthoringError("config.workspace_unreadable", "Could not inspect the configured workspace.", {
+        field: "workspaceDir",
+      });
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      throw new SiteAuthoringError(
+        "config.workspace_invalid",
+        "The workspace and each of its ancestors must be real directories, not links or files.",
+        { field: "workspaceDir" },
+      );
+    }
+  }
+
+  if (exists) {
+    let canonical;
+    try {
+      canonical = await realpath(current);
+    } catch {
+      throw new SiteAuthoringError("config.workspace_unreadable", "Could not resolve the configured workspace.", {
+        field: "workspaceDir",
+      });
+    }
+    if (canonical !== current) {
+      throw new SiteAuthoringError(
+        "config.workspace_invalid",
+        "The workspace and each of its ancestors must be real directories, not links or files.",
+        { field: "workspaceDir" },
+      );
+    }
+  }
+  if (!current.startsWith(`${configDirectory}${path.sep}`)) {
+    throw new SiteAuthoringError(
+      "config.workspace_escape",
+      "The configured workspace must resolve beneath the configuration directory.",
+      { field: "workspaceDir" },
+    );
+  }
+  return { workspaceDir: current, workspaceExists: exists };
+}
+
+export async function loadSiteConfig({ cwd = process.cwd(), configPath } = {}) {
+  if (
+    configPath !== undefined
+    && (
+      typeof configPath !== "string"
+      || configPath.length === 0
+      || Buffer.byteLength(configPath, "utf8") > LIMITS.configPathBytes
+      || hasAsciiControl(configPath)
+    )
+  ) {
+    throw new SiteAuthoringError("config.path_invalid", "The explicit configuration path is invalid.", {
+      field: "configPath",
+    });
+  }
+  const explicit = configPath !== undefined;
+  const selectedPath = configPath
+    ? await resolveExplicitConfigPath(cwd, configPath)
+    : await discoverConfig(cwd);
+  let canonicalConfigPath;
+  try {
+    canonicalConfigPath = await realpath(selectedPath);
+  } catch {
+    throw new SiteAuthoringError("config.not_found", `Configuration file '${selectedPath}' does not exist.`, {
+      field: explicit ? "configPath" : undefined,
+    });
+  }
+  if (canonicalConfigPath !== selectedPath) {
+    throw new SiteAuthoringError(
+      "config.not_regular",
+      "The configuration and each of its parent directories must be real paths, not links.",
+      { field: explicit ? "configPath" : undefined },
+    );
+  }
+  const bytes = await readRegularFile(
+    selectedPath,
+    LIMITS.configBytes,
+    "config.not_found",
+    explicit ? "configPath" : undefined,
+  );
+  if (await realpath(selectedPath).catch(() => undefined) !== canonicalConfigPath) {
+    throw new SiteAuthoringError("config.changed", "The configuration path changed while it was being read.", {
+      field: explicit ? "configPath" : undefined,
+    });
+  }
+  const parsed = parseConfigJson(bytes.toString("utf8"));
+  if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new SiteAuthoringError("config.shape", "The site authoring configuration must be a JSON object.");
+  }
+  // Named ahead of the general unknown-field refusal because this one field
+  // used to be valid here and its replacement is a command, not a spelling.
+  // "Unknown configuration field 'apiBaseUrl'" would be true and useless.
+  if (Object.hasOwn(parsed, "apiBaseUrl")) {
+    throw new SiteAuthoringError(
+      "config.api_base_url_moved",
+      "apiBaseUrl is no longer a configuration field: which Taproot the CLI talks to is a property of this "
+        + `machine, not of this project. Remove the line and run '${CLI_BINARY_NAME} ${VERB_ENV} `
+        + `${ENVIRONMENT_LOCAL}' (or '${ENVIRONMENT_PRODUCTION}').`,
+      { field: "apiBaseUrl" },
+    );
+  }
+  const unknown = Object.keys(parsed).filter((key) => !CONFIG_KEYS.has(key)).sort();
+  if (unknown.length > 0) {
+    throw new SiteAuthoringError("config.unknown_field", `Unknown configuration field '${unknown[0]}'.`, {
+      field: unknown[0],
+    });
+  }
+  if (parsed.configVersion !== CONFIG_VERSION) {
+    throw new SiteAuthoringError(
+      "config.unsupported_version",
+      `configVersion must be ${CONFIG_VERSION}.`,
+      { field: "configVersion" },
+    );
+  }
+  // Optional since TR00645: `use` writes it, and `login`, `sites`, and `whoami`
+  // all run before any site has been chosen. Present-but-malformed is still a
+  // refusal — an ambiguous site is not a missing one.
+  if (parsed.siteId !== undefined && !isCanonicalUuid(parsed.siteId)) {
+    throw new SiteAuthoringError("config.site_id", "siteId must be a canonical lowercase UUID.", { field: "siteId" });
+  }
+  const workspaceDirectoryText = validateWorkspaceDirectoryText(parsed.workspaceDir);
+  const configDirectory = path.dirname(canonicalConfigPath);
+  const { workspaceDir, workspaceExists } = await resolveWorkspaceDirectory(configDirectory, workspaceDirectoryText);
+  return Object.freeze({
+    configVersion: CONFIG_VERSION,
+    configPath: canonicalConfigPath,
+    configDirectory,
+    siteId: parsed.siteId,
+    workspaceDir,
+    workspaceExists,
+  });
+}

package/src/constants.js

@@ -0,0 +1,173 @@
+export const CLI_NAME = "@taprootio/site-authoring";
+export const CLI_VERSION = "0.1.0";
+export const CLI_BINARY_NAME = "taproot-site";
+export const RESULT_SCHEMA_VERSION = 1;
+export const CONFIG_FILE_NAME = "taproot-site.json";
+export const CONFIG_VERSION = 1;
+export const CANONICAL_TIMESTAMP =
+  /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d{3}|\.\d{6}|\.\d{9})?Z$/u;
+
+// The site-scoped authoring key is read only from the environment. There is no
+// flag, no config field, and no prompt: a credential on the command line lands
+// in shell history, `ps` output, and CI logs, and a credential in the config
+// file lands in the repository.
+export const PUBLISH_KEY_ENVIRONMENT_VARIABLE = "TAPROOT_SITE_KEY";
+export const DEFAULT_API_BASE_URL = "https://app.taproot.io/api";
+
+// The one other Taproot that exists. `env` names these rather than making an
+// operator type a URL, because the two of them are the whole set and a typo in
+// the third component of a hostname is the kind of mistake that silently
+// authors against the wrong place.
+export const LOCAL_API_BASE_URL = "https://app.taproot.test/api";
+export const ENVIRONMENT_PRODUCTION = "production";
+export const ENVIRONMENT_LOCAL = "local";
+
+// Which Taproot the CLI talks to, remembered per machine rather than per
+// project (TR00645).
+//
+// It was a `taproot-site.json` field first, and that was the wrong home. The
+// endpoint has to be known *before* any project exists — `login`, `sites`, and
+// `use` all run before the file `use` writes — so pinning it in the project
+// meant hand-writing a configuration purely to say "talk to local", including
+// a `workspaceDir` that none of those verbs use. It is a property of the
+// machine an operator is sitting at, not of the site they happen to be
+// authoring, so it lives with the credential it is meaningless without.
+export const SETTINGS_FILE_NAME = "settings.json";
+export const SETTINGS_VERSION = 1;
+export const SETTINGS_FILE_MODE = 0o644;
+
+// The credential `login` writes and `logout` removes. It lives under the user's
+// configuration directory, never in the repository: a credential inside the
+// working tree is one `git add -A` away from being published, and one shared
+// checkout away from being someone else's.
+export const CREDENTIAL_DIRECTORY_NAME = "taproot-site";
+export const CREDENTIAL_FILE_NAME = "credentials.json";
+// Bumped by TR00645: the store went from many site credentials to one
+// account sign-in per origin, which is a different record entirely. A v1
+// store is refused with a message naming `login` rather than migrated —
+// the CLI is unpublished, so the only v1 stores are in this repository, and
+// a migration path would be code that exists for nobody.
+export const CREDENTIAL_STORE_VERSION = 2;
+export const CREDENTIAL_DIRECTORY_MODE = 0o700;
+export const CREDENTIAL_FILE_MODE = 0o600;
+
+// The browser page the CLI prints. It is composed from the reviewed API origin
+// and never taken from a response, so a compromised or misconfigured server
+// cannot steer an owner to somewhere else to approve a credential.
+export const AUTHORIZE_CLI_PATH = "/authorize-cli";
+
+/**
+ * The workspace directory `use` writes into a configuration it creates
+ * (TR00645).
+ *
+ * A real child directory rather than ".", because `validateWorkspaceDirectoryText`
+ * rejects a "." segment: the workspace must be *beneath* the configuration, so
+ * that pulling a site can never scatter page files over whatever else lives
+ * beside taproot-site.json.
+ */
+export const DEFAULT_WORKSPACE_DIR = "site";
+export const DEFAULT_LOGIN_KEY_NAME = "Site authoring CLI";
+export const LOGIN_KEY_NAME_MAXIMUM = 100;
+
+export const GITHUB_OUTPUT_RESULT_KEY = "taproot_site_result";
+export const GITHUB_OUTPUT_KEY_PREFIX = "taproot_site";
+
+// The verbs this binary accepts, in help order. The CLI matches the longest
+// token sequence, so a two-token family ("pages push") never collides with a
+// one-token verb.
+export const VERB_PULL = "pull";
+export const VERB_HELP = "help";
+export const VERB_VALIDATE = "validate";
+export const VERB_LOGIN = "login";
+export const VERB_LOGOUT = "logout";
+export const VERB_PAGES_PUSH = "pages push";
+export const VERB_NAV_PUSH = "nav push";
+export const VERB_THEME_PUSH = "theme push";
+export const VERB_FOOTER_PUSH = "footer push";
+export const VERB_MEDIA_UPLOAD = "media upload";
+export const VERB_APPROVE = "approve";
+export const VERB_DEPLOY = "deploy";
+export const VERB_PREVIEW_PAGE = "preview page";
+export const VERB_PREVIEW_REVOKE = "preview revoke";
+export const VERB_STATUS = "status";
+export const VERB_SITES = "sites";
+export const VERB_USE = "use";
+export const VERB_WHOAMI = "whoami";
+export const VERB_ENV = "env";
+
+export const DEPLOY_TARGET_STAGING = "staging";
+export const DEPLOY_TARGET_PRODUCTION = "production";
+
+/**
+ * The refusal vocabulary TR00602/TR00603 speak, collapsed into the four
+ * distinct client behaviors plus an explicit "we do not know" value. The CLI
+ * keeps these apart because an agent's correct next move differs for each:
+ * see `ApiError.refusalKind()` in transport.js.
+ */
+export const REFUSAL_PLATFORM_PAUSED = "platform_paused";
+export const REFUSAL_CREDENTIAL_REJECTED = "credential_rejected";
+export const REFUSAL_PLAN_LIMIT = "plan_limit";
+export const REFUSAL_THROTTLED = "throttled";
+export const REFUSAL_UNCLASSIFIED = "unclassified";
+
+export const REFUSAL_KINDS = Object.freeze([
+  REFUSAL_PLATFORM_PAUSED,
+  REFUSAL_CREDENTIAL_REJECTED,
+  REFUSAL_PLAN_LIMIT,
+  REFUSAL_THROTTLED,
+  REFUSAL_UNCLASSIFIED,
+]);
+
+// The validation field names the API refuses with. They are wire identities,
+// not display strings, so they are matched case-insensitively but never
+// reworded.
+export const ROLLOUT_REFUSAL_FIELD = "SiteAuthoringRollout";
+export const CREDENTIAL_REFUSAL_FIELD = "ExternalApiKey";
+export const PLAN_LIMIT_REFUSAL_FIELD = "UpgradePrompt";
+
+// gRPC `ResourceExhausted`. Transcoded responses carry the numeric code in the
+// body; the HTTP mapping is 429.
+export const GRPC_RESOURCE_EXHAUSTED = 8;
+export const HTTP_TOO_MANY_REQUESTS = 429;
+
+// gRPC `Unauthenticated`, and its HTTP mapping. The authority resolver refuses
+// a bad credential with a bare status and no field violation at all, so status
+// is the only thing there is to classify on: see `ApiError.refusalKind()`.
+export const GRPC_UNAUTHENTICATED = 16;
+export const HTTP_UNAUTHORIZED = 401;
+
+export const LIMITS = Object.freeze({
+  configBytes: 16 * 1024,
+  configPathBytes: 4 * 1024,
+  // One version and one URL. Anything larger is not this file.
+  settingsBytes: 4 * 1024,
+  configDiscoveryParents: 32,
+  workspacePathBytes: 4 * 1024,
+  apiResponseBytes: 1024 * 1024,
+  requestMilliseconds: 60_000,
+  uploadMilliseconds: 5 * 60_000,
+  deploymentMilliseconds: 30 * 60_000,
+  previewMilliseconds: 5 * 60_000,
+  pollIntervalMilliseconds: 2_000,
+  requestAttempts: 4,
+  uploadAttempts: 4,
+  diagnosticScalars: 2_000,
+  githubOutputBytes: 64 * 1024,
+  credentialsBytes: 64 * 1024,
+  // The store's read-modify-write is serialized by an exclusive lock file so two
+  // overlapping logins (or a login racing a logout) cannot discard each other's
+  // records — the store holds one record per API origin, so concurrent writes
+  // across origins are real. Contention is human-scale and brief; the bound
+  // exists so a crashed process's leftover lock fails loudly instead of hanging.
+  credentialLockAttempts: 20,
+  credentialLockRetryMilliseconds: 100,
+  // The login poll takes its wait and its cadence from the authorization the
+  // server actually issued (`expiresInSeconds`, `pollIntervalSeconds`) rather
+  // than from a constant here, because the server owns that policy. These are
+  // the walls that value is clamped between, so a wrong or hostile response
+  // cannot turn one interactive sign-in into an unbounded wait or a poll fast
+  // enough to trip the endpoint's own rate limiter.
+  loginMaximumMilliseconds: 30 * 60_000,
+  loginPollIntervalMinimumMilliseconds: 2_000,
+  loginPollIntervalMaximumMilliseconds: 60_000,
+});