@tonbo/cli 0.0.1

package/README.md

@@ -0,0 +1,77 @@
+# Tonbo CLI
+
+Install the public package with Node.js 22 or newer:
+
+```console
+npm install --global @tonbo/cli
+tonbo --version
+```
+
+The V1 CLI deploys a PI-based Agent directly from a local directory without requiring Git or Tonbo calls in the Agent source. Add one JSON declaration at the directory root:
+
+```json
+{
+  "version": 1,
+  "execution": {
+    "mode": "managed",
+    "runtime": "pi"
+  },
+  "inference": {
+    "model": "claude-sonnet-4-5"
+  },
+  "session_capture": {
+    "adapter": "pi-jsonl-v3"
+  }
+}
+```
+
+Then authenticate, bind the directory and deploy its current contents:
+
+```console
+tonbo login
+tonbo project create my-project
+tonbo deploy
+tonbo run "Reply with exactly READY."
+```
+
+Use `tonbo project use my-project` instead when the Project already exists.
+
+`run` creates a durable Session and prints its ID in `--json` output. Pass that identity back to continue the same PI conversation:
+
+```console
+tonbo run --session 4d8e9501-... "Continue the previous task."
+```
+
+Open the same singleton runtime and persistent `/workspace` interactively:
+
+```console
+tonbo ssh
+```
+
+`tonbo login` registers public keys found at the conventional `~/.ssh/id_ed25519.pub`, `id_ecdsa.pub` and `id_rsa.pub` paths. Register a key at another path with `tonbo ssh-key add <path.pub>` and revoke a lost or retired key with `tonbo ssh-key remove SHA256:...`. After that, the CLI is not part of the SSH connection; ordinary OpenSSH works directly:
+
+```console
+ssh my-project@tonbo.sh
+```
+
+The SSH username selects the globally unique Project; the signed public key identifies the Tonbo user and is checked against Project membership and IAM at connection time. The shell and HTTP turns may coexist on the singleton runtime, allowing the shell to observe the Agent while it works. Session writer fencing protects durable conversation history; ordinary workspace files retain Linux process concurrency semantics.
+
+The platform injects scoped inference access and the managed PI runtime writes the declared session format through the session-aware filesystem. Do not put a model-provider API key or a Tonbo credential in `.tonbo`.
+
+Deploy snapshots regular files under `.tonbo`, excluding `.git`, `node_modules`, local environment files and patterns in `.tonboignore`. Equal contents produce the same revision. Coding tools start in the persistent Artifacts workspace, while `.pi` extensions, skills and prompts load from the uploaded revision.
+
+For a non-interactive invocation, provide a current Tonbo CLI OAuth access token and an explicit Project:
+
+```console
+TONBO_ACCESS_TOKEN=... tonbo --json deploy --project project-id
+TONBO_ACCESS_TOKEN=... tonbo --json run --project project-id "health check"
+```
+
+Node.js 22 or newer is required. Human OAuth tokens are stored at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/credentials.json`; the CLI atomically replaces that file with owner-only permissions and never writes it into an Agent directory.
+
+## Related design
+
+- [Design documentation map](../../docs/design/README.md)
+- [Project resource model](../../docs/design/project-resource-model.md)
+- [ADR-0008: Tonbo CLI onboarding and credential boundaries](../../apps/user-center/docs/decisions/adr-0008-tonbo-cli-onboarding.md)
+- [Management API v1](../../contracts/management/openapi-v1.yaml)

package/dist/src/api.d.ts

@@ -0,0 +1,70 @@
+import type { ProjectSession, ProjectSessionTurn, ProjectSessionTurnEvent, ManagedRevisionSpec, ProjectSummary, SourceBundle } from "./types.js";
+import type { SshPublicKey } from "./ssh-key.js";
+interface RevisionDto {
+    id: string;
+    spec_sha256: string;
+}
+interface DeploymentDto {
+    desired_revision_id: string;
+    generation: number | string;
+    observed_state: string;
+}
+export declare class TonboApi {
+    private readonly fetcher;
+    private readonly accountOrigin;
+    private readonly managementOrigin;
+    constructor(fetcher: typeof fetch, accountOrigin?: string, managementOrigin?: string);
+    listProjects(oauthToken: string): Promise<ProjectSummary[]>;
+    createProject(oauthToken: string, slug: string, name?: string): Promise<ProjectSummary>;
+    registerSshKey(oauthToken: string, key: SshPublicKey): Promise<{
+        fingerprint: string;
+    }>;
+    revokeSshKey(oauthToken: string, fingerprint: string): Promise<{
+        fingerprint: string;
+    }>;
+    exchangeManagementToken(oauthToken: string, projectId: string): Promise<string>;
+    deploy({ bundle, projectId, spec, token, }: {
+        bundle: SourceBundle;
+        projectId: string;
+        spec: ManagedRevisionSpec;
+        token: string;
+    }): Promise<{
+        deployment: DeploymentDto;
+        revision: RevisionDto;
+    }>;
+    run({ projectId, prompt, sessionId, token, turnId, }: {
+        projectId: string;
+        prompt: string;
+        sessionId?: string;
+        token: string;
+        turnId?: string;
+    }): Promise<{
+        deployment: DeploymentDto;
+        session: ProjectSession | {
+            id: string;
+        };
+        turn: ProjectSessionTurn;
+    }>;
+    turnEvents({ after, projectId, sessionId, token, turnId, }: {
+        after?: number;
+        projectId: string;
+        sessionId: string;
+        token: string;
+        turnId: string;
+    }): Promise<{
+        data: ProjectSessionTurnEvent[];
+        status: "pending" | "completed" | "failed";
+    }>;
+    listProjectSecrets(projectId: string, token: string): Promise<{
+        name: string;
+        updated_at: string;
+    }[]>;
+    setProjectSecret(projectId: string, name: string, value: string, token: string): Promise<{
+        name: string;
+        updated_at: string;
+    }>;
+    deleteProjectSecret(projectId: string, name: string, token: string): Promise<null>;
+    private management;
+    private managementList;
+}
+export {};

package/dist/src/api.js

@@ -0,0 +1,179 @@
+import { createHash, randomUUID } from "node:crypto";
+import { requestJson } from "./http.js";
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const object = value;
+    return `{${Object.keys(object)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`)
+        .join(",")}}`;
+}
+function digest(value) {
+    return createHash("sha256").update(stableJson(value)).digest("hex");
+}
+export class TonboApi {
+    fetcher;
+    accountOrigin;
+    managementOrigin;
+    constructor(fetcher, accountOrigin = "https://tonbo.dev", managementOrigin = "https://api.tonbo.dev") {
+        this.fetcher = fetcher;
+        this.accountOrigin = accountOrigin;
+        this.managementOrigin = managementOrigin;
+    }
+    listProjects(oauthToken) {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/projects`, {
+            headers: { authorization: `Bearer ${oauthToken}` },
+        }).then((body) => body.projects);
+    }
+    createProject(oauthToken, slug, name) {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/projects`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${oauthToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ slug, ...(name ? { name } : {}) }),
+        }).then((body) => body.project);
+    }
+    registerSshKey(oauthToken, key) {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/ssh-keys`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${oauthToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                algorithm: key.algorithm,
+                key_base64: key.keyBase64,
+                label: key.label,
+            }),
+        }).then((body) => body.key);
+    }
+    revokeSshKey(oauthToken, fingerprint) {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/ssh-keys`, {
+            method: "DELETE",
+            headers: {
+                authorization: `Bearer ${oauthToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ fingerprint }),
+        }).then((body) => body.key);
+    }
+    exchangeManagementToken(oauthToken, projectId) {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/projects/${projectId}/token`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${oauthToken}` },
+        }).then((body) => body.access_token);
+    }
+    async deploy({ bundle, projectId, spec, token, }) {
+        const descriptor = {
+            format: bundle.format,
+            sha256: bundle.sha256,
+            size_bytes: bundle.size_bytes,
+        };
+        const projectPath = `/v1/projects/${projectId}`;
+        const bundlesPath = `${projectPath}/source-bundles`;
+        const prepared = await this.management("PUT", `${bundlesPath}/${bundle.sha256}`, token, {
+            format: descriptor.format,
+            size_bytes: descriptor.size_bytes,
+        });
+        if (prepared.status === "upload") {
+            if (!prepared.upload_url)
+                throw new Error("Tonbo did not return a source upload URL.");
+            const uploaded = await this.fetcher(prepared.upload_url, {
+                method: "PUT",
+                headers: {
+                    "content-type": prepared.content_type ?? "application/vnd.tonbo.source+tar",
+                    "x-upsert": "false",
+                },
+                body: new Blob([new Uint8Array(bundle.bytes)]),
+            });
+            let uploadError = null;
+            if (!uploaded.ok) {
+                uploadError = new Error(`Source upload failed with HTTP ${uploaded.status}.`);
+            }
+            try {
+                await this.management("POST", `${bundlesPath}/${bundle.sha256}/complete`, token, {
+                    format: bundle.format,
+                    size_bytes: bundle.size_bytes,
+                });
+            }
+            catch (error) {
+                if (uploadError)
+                    throw new AggregateError([uploadError, error], "Source bundle upload did not complete.");
+                throw error;
+            }
+        }
+        const revisionsPath = `${projectPath}/revisions`;
+        const revisionDigest = digest(spec);
+        const revisions = await this.managementList(revisionsPath, token);
+        let revision = revisions.find((candidate) => candidate.spec_sha256 === revisionDigest);
+        if (!revision) {
+            revision = (await this.management("POST", revisionsPath, token, { spec })).data;
+        }
+        const deploymentPath = `${projectPath}/deployment`;
+        const current = await this.management("GET", deploymentPath, token).catch((error) => {
+            if (error.status === 404)
+                return null;
+            throw error;
+        });
+        const deployment = (await this.management("PUT", deploymentPath, token, {
+            desired_revision_id: revision.id,
+            desired_state: "running",
+            expected_generation: current ? Number(current.data.generation) : null,
+        })).data;
+        return { deployment, revision };
+    }
+    async run({ projectId, prompt, sessionId, token, turnId = randomUUID(), }) {
+        const projectPath = `/v1/projects/${projectId}`;
+        const deployment = (await this.management("GET", `${projectPath}/deployment`, token)).data;
+        if (deployment.observed_state !== "running")
+            throw new Error(`Project Agent is ${deployment.observed_state}; wait for it to be running.`);
+        const session = sessionId
+            ? { id: sessionId }
+            : (await this.management("POST", `${projectPath}/sessions`, token, { revision_id: deployment.desired_revision_id })).data;
+        const turn = (await this.management("POST", `${projectPath}/sessions/${session.id}/turns`, token, { prompt }, turnId)).data;
+        return { deployment, session, turn };
+    }
+    turnEvents({ after = 0, projectId, sessionId, token, turnId, }) {
+        return this.management("GET", `/v1/projects/${projectId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`, token);
+    }
+    listProjectSecrets(projectId, token) {
+        return this.management("GET", `/v1/projects/${projectId}/secrets`, token).then((body) => body.data);
+    }
+    setProjectSecret(projectId, name, value, token) {
+        return this.management("PUT", `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`, token, { value });
+    }
+    deleteProjectSecret(projectId, name, token) {
+        return this.management("DELETE", `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`, token);
+    }
+    management(method, path, token, body, idempotencyKey) {
+        return requestJson(this.fetcher, `${this.managementOrigin}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(body === undefined
+                    ? {}
+                    : {
+                        "content-type": "application/json",
+                        "idempotency-key": idempotencyKey ?? randomUUID(),
+                    }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+    }
+    async managementList(path, token) {
+        const values = [];
+        let cursor = null;
+        do {
+            const separator = path.includes("?") ? "&" : "?";
+            const page = await this.management("GET", `${path}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`, token);
+            values.push(...page.data);
+            cursor = page.next_cursor;
+        } while (cursor);
+        return values;
+    }
+}

package/dist/src/app.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type CommandDependencies } from "./commands.js";
+export declare function createDependencies(json?: boolean): CommandDependencies;
+export declare function createProgram(dependencies?: typeof createDependencies): Command;

package/dist/src/app.js

@@ -0,0 +1,99 @@
+import { Command } from "commander";
+import { readFileSync } from "node:fs";
+import { TonboApi } from "./api.js";
+import { AuthClient } from "./auth.js";
+import { deployCommand, runCommand, loginCommand, projectCreateCommand, projectUseCommand, sshCommand, sshKeyAddCommand, sshKeyRemoveCommand, secretListCommand, secretRemoveCommand, secretSetCommand, } from "./commands.js";
+import { FileConfigStore } from "./config.js";
+import { FileCredentialStore } from "./credentials.js";
+const packageVersion = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+export function createDependencies(json = false) {
+    const accountOrigin = process.env.TONBO_ACCOUNT_ORIGIN || "https://tonbo.dev";
+    const managementOrigin = process.env.TONBO_API_ORIGIN || "https://api.tonbo.dev";
+    return {
+        api: new TonboApi(fetch, accountOrigin, managementOrigin),
+        auth: new AuthClient(new FileCredentialStore(), fetch, accountOrigin),
+        config: new FileConfigStore(),
+        cwd: () => process.cwd(),
+        output: (value) => {
+            if (json)
+                console.log(JSON.stringify(value));
+            else
+                console.log(value.message ?? value);
+        },
+        secretValue: async (name, fromEnvironment) => {
+            const environmentName = fromEnvironment ?? name;
+            const value = process.env[environmentName];
+            if (!value)
+                throw new Error(`Environment variable ${environmentName} is empty. Set it before running tonbo secret set.`);
+            return value;
+        },
+    };
+}
+export function createProgram(dependencies = createDependencies) {
+    const program = new Command()
+        .name("tonbo")
+        .description("Deploy a persistent Project Agent to Tonbo.")
+        .version(packageVersion.version)
+        .option("--json", "print machine-readable JSON");
+    program
+        .command("login")
+        .description("sign in through the browser and store the session in the user config")
+        .action(async () => loginCommand(dependencies(program.opts().json)));
+    const project = program
+        .command("project")
+        .description("manage the Project bound to this Agent directory");
+    project
+        .command("create <slug>")
+        .description("create and bind a Project to this Agent directory")
+        .option("--name <name>", "display name for the Project")
+        .action(async (slug, options) => projectCreateCommand(dependencies(program.opts().json), slug, options.name));
+    const sshKey = program
+        .command("ssh-key")
+        .description("manage public keys used by native Project SSH");
+    sshKey
+        .command("add <public-key>")
+        .description("register an OpenSSH public key with the current Tonbo account")
+        .action(async (path) => sshKeyAddCommand(dependencies(program.opts().json), path));
+    sshKey
+        .command("remove <fingerprint>")
+        .description("revoke an SSH public key from the current Tonbo account")
+        .action(async (fingerprint) => sshKeyRemoveCommand(dependencies(program.opts().json), fingerprint));
+    project
+        .command("use <project>")
+        .description("bind this .tonbo directory to a Project slug or ID")
+        .action(async (selector) => projectUseCommand(dependencies(program.opts().json), selector));
+    program
+        .command("deploy")
+        .description("upload this directory as the selected Project deployment")
+        .option("--project <project>", "override the bound Project for this deploy")
+        .action(async (options) => deployCommand(dependencies(program.opts().json), options.project));
+    program
+        .command("run <prompt>")
+        .description("run one prompt in a durable Project session")
+        .option("--project <project>", "override the bound Project for this turn")
+        .option("--session <session>", "resume an existing Agent Session UUID")
+        .action(async (prompt, options) => runCommand(dependencies(program.opts().json), prompt, options));
+    program
+        .command("ssh")
+        .description("open the selected Project's singleton runtime over SSH")
+        .option("--project <project>", "override the bound Project")
+        .action(async (options) => sshCommand(dependencies(program.opts().json), options.project));
+    const secret = program
+        .command("secret")
+        .description("manage encrypted environment secrets for the Project service");
+    secret
+        .command("list")
+        .option("--project <project>", "override the bound Project")
+        .action(async (options) => secretListCommand(dependencies(program.opts().json), options.project));
+    secret
+        .command("set <name>")
+        .description("set a secret from an environment variable (the same name by default)")
+        .option("--from-env <name>", "read the value from another environment variable")
+        .option("--project <project>", "override the bound Project")
+        .action(async (name, options) => secretSetCommand(dependencies(program.opts().json), name, options));
+    secret
+        .command("remove <name>")
+        .option("--project <project>", "override the bound Project")
+        .action(async (name, options) => secretRemoveCommand(dependencies(program.opts().json), name, options.project));
+    return program;
+}

package/dist/src/auth.d.ts

@@ -0,0 +1,13 @@
+import type { CredentialStore } from "./credentials.js";
+import type { OAuthTokenSet } from "./types.js";
+export declare class AuthClient {
+    private readonly credentials;
+    private readonly fetcher;
+    private readonly accountOrigin;
+    constructor(credentials: CredentialStore, fetcher: typeof fetch, accountOrigin?: string);
+    accessToken(): Promise<string>;
+    login(): Promise<OAuthTokenSet>;
+    private config;
+    private exchange;
+    private listenForCode;
+}

package/dist/src/auth.js

@@ -0,0 +1,147 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { callbackResponse } from "./callback-page.js";
+import { requestJson } from "./http.js";
+const exec = promisify(execFile);
+const LOOPBACK_REDIRECT = "http://localhost:17655/callback";
+function base64url(value) {
+    return value.toString("base64url");
+}
+function withAbsoluteExpiry(tokens) {
+    if (tokens.expires_at || !Number.isInteger(tokens.expires_in) || (tokens.expires_in ?? 0) <= 0)
+        return tokens;
+    return {
+        ...tokens,
+        expires_at: Math.floor(Date.now() / 1000) + (tokens.expires_in ?? 0),
+    };
+}
+export class AuthClient {
+    credentials;
+    fetcher;
+    accountOrigin;
+    constructor(credentials, fetcher, accountOrigin = "https://tonbo.dev") {
+        this.credentials = credentials;
+        this.fetcher = fetcher;
+        this.accountOrigin = accountOrigin;
+    }
+    async accessToken() {
+        const injected = process.env.TONBO_ACCESS_TOKEN?.trim();
+        if (injected)
+            return injected;
+        const tokens = await this.credentials.load();
+        if (!tokens)
+            throw new Error("Not logged in. Run `tonbo login`.");
+        // Older CLI releases stored OAuth's relative `expires_in` without the
+        // issue time, so its remaining lifetime cannot be reconstructed. Refresh
+        // that shape once instead of treating the access token as immortal.
+        const legacyRelativeExpiry = !tokens.expires_at && tokens.expires_in;
+        if (!legacyRelativeExpiry &&
+            (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1000) + 30))
+            return tokens.access_token;
+        if (!tokens.refresh_token)
+            throw new Error("Tonbo login expired. Run `tonbo login` again.");
+        const config = await this.config();
+        const refreshed = withAbsoluteExpiry(await this.exchange(config.token_endpoint, new URLSearchParams({
+            client_id: config.client_id,
+            grant_type: "refresh_token",
+            refresh_token: tokens.refresh_token,
+        })));
+        if (!refreshed.refresh_token)
+            refreshed.refresh_token = tokens.refresh_token;
+        await this.credentials.save(refreshed);
+        return refreshed.access_token;
+    }
+    async login() {
+        const config = await this.config();
+        if (config.redirect_uri !== LOOPBACK_REDIRECT)
+            throw new Error(`Unsupported OAuth redirect URI: ${config.redirect_uri}`);
+        const verifier = base64url(randomBytes(48));
+        const challenge = createHash("sha256").update(verifier).digest("base64url");
+        const state = base64url(randomBytes(24));
+        const authorization = new URL(config.authorization_endpoint);
+        authorization.search = new URLSearchParams({
+            client_id: config.client_id,
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            redirect_uri: config.redirect_uri,
+            response_type: "code",
+            scope: "openid profile email",
+            state,
+        }).toString();
+        const code = await this.listenForCode(state, () => openBrowser(authorization.toString()));
+        const tokens = withAbsoluteExpiry(await this.exchange(config.token_endpoint, new URLSearchParams({
+            client_id: config.client_id,
+            code,
+            code_verifier: verifier,
+            grant_type: "authorization_code",
+            redirect_uri: config.redirect_uri,
+        })));
+        await this.credentials.save(tokens);
+        return tokens;
+    }
+    config() {
+        return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/config`);
+    }
+    exchange(endpoint, body) {
+        return requestJson(this.fetcher, endpoint, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body,
+        });
+    }
+    listenForCode(expectedState, ready) {
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                server.close();
+                if ("code" in result)
+                    resolve(result.code);
+                else
+                    reject(result.error);
+            };
+            const timeout = setTimeout(() => {
+                finish({ error: new Error("Timed out waiting for browser login.") });
+            }, 5 * 60 * 1000);
+            const server = createServer((request, response) => {
+                const url = new URL(request.url ?? "/", LOOPBACK_REDIRECT);
+                const code = url.searchParams.get("code");
+                const oauthError = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+                if (oauthError) {
+                    respond(response, "denied");
+                    finish({ error: new Error(oauthError) });
+                    return;
+                }
+                if (url.pathname !== "/callback" ||
+                    url.searchParams.get("state") !== expectedState ||
+                    !code) {
+                    respond(response, "invalid");
+                    return;
+                }
+                respond(response, "complete");
+                finish({ code });
+            });
+            server.once("error", (error) => finish({ error }));
+            server.listen(17655, "localhost", () => void ready().catch((error) => finish({
+                error: error instanceof Error ? error : new Error("Could not open the login browser."),
+            })));
+        });
+    }
+}
+function respond(response, outcome) {
+    const page = callbackResponse(outcome);
+    response.writeHead(page.status, page.headers);
+    response.end(page.body);
+}
+async function openBrowser(url) {
+    if (process.platform === "darwin")
+        return void (await exec("open", [url]));
+    if (process.platform === "win32")
+        return void (await exec("rundll32", ["url.dll,FileProtocolHandler", url]));
+    return void (await exec("xdg-open", [url]));
+}

package/dist/src/callback-page.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The page a browser lands on after `tonbo login`.
+ *
+ * This is served by a loopback HTTP server inside the CLI, so it cannot reach
+ * the app's stylesheet or webfonts. It is self-contained on purpose: no
+ * external request, which also means it renders offline and leaks nothing
+ * about the login to a third party.
+ *
+ * Nothing from the query string is interpolated here. The callback URL is
+ * reachable by anything that can make the user's browser open a localhost
+ * address, so reflecting `error_description` would put attacker-chosen text
+ * into a page served from the user's own machine.
+ */
+export type CallbackOutcome = "complete" | "denied" | "invalid";
+export declare function renderCallbackPage(outcome: CallbackOutcome): string;
+export declare function callbackResponse(outcome: CallbackOutcome): {
+    status: number;
+    headers: {
+        "content-type": string;
+        "cache-control": string;
+    };
+    body: string;
+};