@typeship-ax/cli 0.22.0 → 0.24.0

package/dist/console-login-check.d.ts

@@ -1,21 +0,0 @@
-import { type ConsoleLoginCheck, type ConsoleLoginConfiguration } from "./console-login-contract.js";
-import { type OAuthLoginSession } from "./oauth-login.js";
-import { type CredentialSchemes, type NamedCredentials } from "./named-credentials.js";
-/** No traffic to Typeship occurs without the explicit --console-check action.
- * Only the credentials selected for the identity read leave this process;
- * refresh tokens and other stored logins are never sent to the Console. */
-export declare function checkConsoleBrowserLogin(input: {
-    file: string;
-    configuration: ConsoleLoginConfiguration;
-    schemes: CredentialSchemes;
-    credentials: NamedCredentials;
-    login(timeoutMs: number): Promise<OAuthLoginSession>;
-    verify(credentials: NamedCredentials, expectations: ConsoleLoginCheck["expectations"]): Promise<void>;
-    progress(message: string): void;
-}): Promise<{
-    ok: true;
-    method: "oauth_browser";
-    console_verified: true;
-    revoked: boolean | null;
-}>;
-//# sourceMappingURL=console-login-check.d.ts.map

package/dist/console-login-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"console-login-check.d.ts","sourceRoot":"","sources":["../src/console-login-check.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgE,KAAK,iBAAiB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACnK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAyB,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAuB9G;;2EAE2E;AAC3E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,yBAAyB,CAAC;IACzC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,gBAAgB,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,CAiDlG"}

package/dist/console-login-check.js

@@ -1,107 +0,0 @@
-import { openSync, readSync, closeSync, fstatSync, constants } from "node:fs";
-import { oauthJsonRequest } from "./oauth-request.js";
-import { sameConsoleLoginConfiguration, matchesConsoleBrowserEvidence } from "./console-login-contract.js";
-import { parseNamedCredentials } from "./named-credentials.js";
-function readCheck(path) {
-    let fd;
-    try {
-        fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
-        if (!fstatSync(fd).isFile())
-            throw new Error();
-        const buffer = Buffer.alloc(65_537);
-        let size = 0;
-        while (size < buffer.length) {
-            const n = readSync(fd, buffer, size, buffer.length - size, null);
-            if (!n)
-                break;
-            size += n;
-        }
-        if (size > 65_536)
-            throw new Error();
-        const value = JSON.parse(buffer.subarray(0, size).toString("utf8"));
-        if (value.version !== 1 || typeof value.ticket !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.ticket) || !value.configuration || !Array.isArray(value.expectations) || !value.expectations.length || value.expectations.length > 3)
-            throw new Error();
-        const endpoint = new URL(value.endpoint);
-        const development = endpoint.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(endpoint.hostname);
-        if (!(endpoint.origin === "https://typeship.dev" || development) || endpoint.pathname !== "/api/authentication/browser" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash)
-            throw new Error();
-        const remaining = Date.parse(value.expiresAt) - Date.now();
-        if (!Number.isFinite(remaining) || remaining <= 0 || remaining > 600_000)
-            throw new Error();
-        return value;
-    }
-    catch {
-        throw new Error("Download a new login check from your Typeship Console and pass its JSON file to --console-check. Checks expire after ten minutes.");
-    }
-    finally {
-        if (fd !== undefined)
-            closeSync(fd);
-    }
-}
-/** No traffic to Typeship occurs without the explicit --console-check action.
- * Only the credentials selected for the identity read leave this process;
- * refresh tokens and other stored logins are never sent to the Console. */
-export async function checkConsoleBrowserLogin(input) {
-    const check = readCheck(input.file);
-    if (!sameConsoleLoginConfiguration(input.configuration, check.configuration))
-        throw new Error("This CLI's authentication settings do not match the saved Target. Regenerate the CLI, select the matching environment, and download a new check.");
-    const send = async (body, timeoutMs = 30_000) => {
-        const response = await oauthJsonRequest(check.endpoint, { method: "POST", headers: { "Content-Type": "application/json", Accept: "application/json" }, body: JSON.stringify({ ticket: check.ticket, ...body }) }, timeoutMs);
-        if (response.status === 422)
-            throw new Error("Typeship could not verify this login. Check the expected identity, API permissions and saved Target settings, then download a new check.");
-        if (response.status !== 200 || response.data?.ok !== true)
-            throw new Error("The Console check expired, was already used, changed, or could not be completed. Download a new check and try again.");
-        return response.data;
-    };
-    await send({ action: "inspect" });
-    let revoked = null;
-    try {
-        const supplied = parseNamedCredentials(input.credentials, input.schemes);
-        // Only a complete alternative that uses the fresh browser token proves
-        // browser access. An unrelated key-only alternative is not sufficient.
-        const requirement = input.configuration.requirements.find((entry) => {
-            const names = Object.keys(entry);
-            if (!names.some((name) => input.schemes[name]?.kind === "bearer") || !names.every((name) => input.schemes[name]?.kind === "bearer" || supplied[name] !== undefined))
-                return false;
-            const selected = input.configuration.requirements.find((candidate) => Object.keys(candidate).every((name) => names.includes(name)));
-            return selected && Object.keys(selected).some((name) => input.schemes[name]?.kind === "bearer");
-        });
-        if (!requirement)
-            throw new Error("Supply the additional named credentials required by the identity read with --credentials @file or environment variables.");
-        input.progress("This check runs a temporary browser login. Typeship will receive only the access token and any additional credentials required for the identity read; refresh tokens stay on this computer.");
-        const session = await input.login(Math.max(1, Date.parse(check.expiresAt) - Date.now()));
-        try {
-            const evidence = { method: "oauth_browser", issuer: session.issuer, clientId: session.clientId, redirectUri: session.redirectUri };
-            if (!matchesConsoleBrowserEvidence(input.configuration, evidence))
-                throw new Error("The browser login did not use the Target's client registration and native callback.");
-            const credentials = Object.fromEntries(Object.keys(requirement).map((name) => [name, input.schemes[name].kind === "bearer" ? session.accessToken : supplied[name]]));
-            await input.verify(credentials, check.expectations);
-            await send({ action: "complete", configuration: input.configuration, evidence, credentials, expectations: check.expectations });
-        }
-        finally {
-            // Verification sessions never replace the customer's saved login.
-            // Revoke the temporary grant when the provider advertises an endpoint.
-            if (session.revocationUrl) {
-                try {
-                    const response = await fetch(session.revocationUrl, { method: "POST", redirect: "error", credentials: "omit", signal: AbortSignal.timeout(10_000), headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: session.refreshToken ?? session.accessToken, token_type_hint: session.refreshToken ? "refresh_token" : "access_token", client_id: session.clientId }) });
-                    void response.body?.cancel().catch(() => { });
-                    revoked = response.status === 200;
-                }
-                catch {
-                    revoked = false;
-                }
-            }
-        }
-    }
-    catch (error) {
-        // Report only that the attempt ended. Never send provider errors, identity
-        // values or credentials, and never replace the original local error. A
-        // consumed check rejects this report, preserving any completed API proof.
-        try {
-            await send({ action: "fail" }, 5_000);
-        }
-        catch { /* Best effort; the Console can still expire the check. */ }
-        throw error;
-    }
-    return { ok: true, method: "oauth_browser", console_verified: true, revoked };
-}

package/dist/console-login-contract.d.ts

@@ -1,45 +0,0 @@
-export interface ConsoleLoginConfiguration {
-    baseUrl: string;
-    environment: string | null;
-    operation: string;
-    request: {
-        method: string;
-        path: string;
-        graphqlField: string | null;
-        graphqlQuery: string | null;
-    };
-    requirements: Record<string, string[]>[];
-    issuer: string;
-    clientId: string;
-    discoveryUrl: string | null;
-    authorizationUrl: string | null;
-    tokenUrl: string | null;
-    redirectUri: string;
-    scopes: string[];
-    audience: string | null;
-    resource: string | null;
-}
-export interface ConsoleIdentityExpectation {
-    kind: "account" | "organization" | "user";
-    pointer: string;
-    expected: string | number;
-}
-export interface ConsoleLoginCheck {
-    version: 1;
-    endpoint: string;
-    ticket: string;
-    expiresAt: string;
-    configuration: ConsoleLoginConfiguration;
-    expectations: ConsoleIdentityExpectation[];
-}
-export interface ConsoleBrowserEvidence {
-    method: "oauth_browser";
-    issuer: string;
-    clientId: string;
-    redirectUri: string;
-}
-/** Compare the generated product's own settings with the reviewed check.
- * The downloaded file never supplies the CLI's OAuth or API destination. */
-export declare function sameConsoleLoginConfiguration(left: ConsoleLoginConfiguration, right: ConsoleLoginConfiguration): boolean;
-export declare function matchesConsoleBrowserEvidence(config: ConsoleLoginConfiguration, evidence: ConsoleBrowserEvidence): boolean;
-//# sourceMappingURL=console-login-contract.d.ts.map

package/dist/console-login-contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"console-login-contract.d.ts","sourceRoot":"","sources":["../src/console-login-contract.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AACD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AACD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,yBAAyB,CAAC;IACzC,YAAY,EAAE,0BAA0B,EAAE,CAAC;CAC5C;AACD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;4EAC4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAOxH;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAU1H"}

package/dist/console-login-contract.js

@@ -1,40 +0,0 @@
-function canonical(value) {
-    if (Array.isArray(value))
-        return "[" + value.map(canonical).join(",") + "]";
-    if (value && typeof value === "object")
-        return "{" + Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => JSON.stringify(key) + ":" + canonical(item)).join(",") + "}";
-    return JSON.stringify(value) ?? "null";
-}
-/** Compare the generated product's own settings with the reviewed check.
- * The downloaded file never supplies the CLI's OAuth or API destination. */
-export function sameConsoleLoginConfiguration(left, right) {
-    const normalize = (value) => ({ ...value,
-        baseUrl: new URL(value.baseUrl).href,
-        scopes: [...new Set(value.scopes)].sort(),
-        requirements: value.requirements.map((entry) => Object.fromEntries(Object.entries(entry).map(([key, scopes]) => [key, [...new Set(scopes)].sort()]))),
-    });
-    try {
-        return canonical(normalize(left)) === canonical(normalize(right));
-    }
-    catch {
-        return false;
-    }
-}
-export function matchesConsoleBrowserEvidence(config, evidence) {
-    try {
-        if (evidence.method !== "oauth_browser" || evidence.issuer !== config.issuer || evidence.clientId !== config.clientId)
-            return false;
-        const configured = new URL(config.redirectUri), actual = new URL(evidence.redirectUri);
-        if (configured.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(configured.hostname) || configured.username || configured.password || configured.search || configured.hash)
-            return false;
-        if (configured.port && configured.port !== actual.port)
-            return false;
-        if (!actual.port)
-            return false;
-        configured.port = actual.port;
-        return configured.href === actual.href;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/resources/generate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/resources/generate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAoB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3F,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,GAAG,CACP,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,oBAAoB,CAAC;IA0BhC;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,MAAM,EAAE,6BAA6B,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBtG;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,oCAAoC;AACpC,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gDAAgD;AAChD,MAAM,MAAM,4BAA4B,GACpC,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}

package/dist/resources/publications.d.ts

@@ -1,47 +0,0 @@
-import { HttpCore, type RequestOptions } from "../core/http.js";
-import { PagePromise } from "../core/pagination.js";
-import { ResponseParseError, TransportError, UnexpectedApiError, ValidationError, BadRequestError, ForbiddenError, InternalServerError, NotFoundError, RateLimitedError, UnauthorizedError } from "../errors.js";
-import type { PublicationId, PublicationRead, PublicationResponseRead, ReleaseId } from "../types.js";
-export declare class PublicationsResource {
-    private readonly _core;
-    constructor(_core: HttpCore);
-    /**
-     * List publications
-     *
-     * Auto-paginates: `for await (const item of …)` walks every page.
-     * `GET /publications`
-     */
-    list(params?: PublicationsListParams, options?: RequestOptions): PagePromise<PublicationRead, PublicationsListError>;
-    /**
-     * Get publishing status
-     *
-     * Returns the registry publishing status for a release. A status in another organization returns
-     * 404 resource_not_found.
-     * `GET /publications/{publication_id}`
-     */
-    get(publicationId: PublicationId, options?: RequestOptions): Promise<PublicationResponseRead>;
-}
-export interface PublicationsListParams {
-    /**
-     * Maximum number of resources to return. Omit for 20; otherwise supply base-10 digits
-     * representing an integer from 1 to 100. Empty, malformed, or out-of-range values return 400
-     * input_invalid. List query parameters must appear only once; repeated or unrecognized parameters
-     * return 400 query_param_invalid.
-     */
-    limit?: number;
-    /**
-     * Opaque cursor from the preceding page's next_cursor. Valid only for the same organization,
-     * operation, filters, and ordering that issued it. Omit to start at the first page. Empty or
-     * malformed cursors, and cursors issued for different filters, return 400 cursor_invalid; start
-     * again from the first page. Repeated cursors return 400 query_param_invalid. The page limit may
-     * change between requests.
-     */
-    cursor?: string;
-    /** Only publications of this release. */
-    releaseId?: ReleaseId;
-}
-/** Typed errors `list` can throw. */
-export type PublicationsListError = BadRequestError | UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | InternalServerError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
-/** Typed errors `get` can throw. */
-export type PublicationsGetError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | InternalServerError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
-//# sourceMappingURL=publications.d.ts.map

package/dist/resources/publications.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"publications.d.ts","sourceRoot":"","sources":["../../src/resources/publications.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAY,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAEV,aAAa,EAGb,eAAe,EAEf,uBAAuB,EACvB,SAAS,EACV,MAAM,aAAa,CAAC;AAErB,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;OAKG;IACH,IAAI,CACF,MAAM,CAAC,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,eAAe,EAAE,qBAAqB,CAAC;IA+BtD;;;;;;OAMG;IACG,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAiBpG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,qCAAqC;AACrC,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,oCAAoC;AACpC,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}

package/dist/resources/publications.js

@@ -1,70 +0,0 @@
-// typeship — publications resource.
-// Generated by typeship — https://typeship.dev
-import { paginate } from "../core/pagination.js";
-import { BadRequestError, ForbiddenError, InternalServerError, NotFoundError, RateLimitedError, UnauthorizedError, } from "../errors.js";
-export class PublicationsResource {
-    _core;
-    constructor(_core) {
-        this._core = _core;
-    }
-    /**
-     * List publications
-     *
-     * Auto-paginates: `for await (const item of …)` walks every page.
-     * `GET /publications`
-     */
-    list(params, options) {
-        return paginate(this._core, {
-            method: "GET",
-            path: "/publications",
-            security: [{ "apiKey": [] }],
-            query: {
-                limit: params?.limit,
-                cursor: params?.cursor,
-                release_id: params?.releaseId,
-            },
-            errors: {
-                "400": BadRequestError,
-                "401": UnauthorizedError,
-                "403": ForbiddenError,
-                "404": NotFoundError,
-                "429": RateLimitedError,
-                "500": InternalServerError,
-            },
-            idempotent: true,
-            schemaKey: "publications.list",
-            options,
-        }, {
-            style: "cursor",
-            itemsField: "data",
-            cursorParam: "cursor",
-            nextCursorField: "next_cursor",
-            hasMoreField: "has_more",
-            limitParam: "limit",
-        });
-    }
-    /**
-     * Get publishing status
-     *
-     * Returns the registry publishing status for a release. A status in another organization returns
-     * 404 resource_not_found.
-     * `GET /publications/{publication_id}`
-     */
-    async get(publicationId, options) {
-        return this._core.requestData({
-            method: "GET",
-            path: `/publications/${encodeURIComponent(String(publicationId))}`,
-            security: [{ "apiKey": [] }],
-            errors: {
-                "401": UnauthorizedError,
-                "403": ForbiddenError,
-                "404": NotFoundError,
-                "429": RateLimitedError,
-                "500": InternalServerError,
-            },
-            idempotent: true,
-            schemaKey: "publications.get",
-            options,
-        });
-    }
-}

package/src/console-login-check.ts

@@ -1,88 +0,0 @@
-import { openSync, readSync, closeSync, fstatSync, constants } from "node:fs";
-import { oauthJsonRequest } from "./oauth-request.js";
-import { sameConsoleLoginConfiguration, matchesConsoleBrowserEvidence, type ConsoleLoginCheck, type ConsoleLoginConfiguration } from "./console-login-contract.js";
-import { type OAuthLoginSession } from "./oauth-login.js";
-import { parseNamedCredentials, type CredentialSchemes, type NamedCredentials } from "./named-credentials.js";
-
-function readCheck(path: string): ConsoleLoginCheck {
-  let fd: number | undefined;
-  try {
-    fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
-    if (!fstatSync(fd).isFile()) throw new Error();
-    const buffer = Buffer.alloc(65_537);
-    let size = 0;
-    while (size < buffer.length) { const n = readSync(fd, buffer, size, buffer.length - size, null); if (!n) break; size += n; }
-    if (size > 65_536) throw new Error();
-    const value = JSON.parse(buffer.subarray(0, size).toString("utf8")) as ConsoleLoginCheck;
-    if (value.version !== 1 || typeof value.ticket !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.ticket) || !value.configuration || !Array.isArray(value.expectations) || !value.expectations.length || value.expectations.length > 3) throw new Error();
-    const endpoint = new URL(value.endpoint);
-    const development = endpoint.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(endpoint.hostname);
-    if (!(endpoint.origin === "https://typeship.dev" || development) || endpoint.pathname !== "/api/authentication/browser" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error();
-    const remaining = Date.parse(value.expiresAt) - Date.now();
-    if (!Number.isFinite(remaining) || remaining <= 0 || remaining > 600_000) throw new Error();
-    return value;
-  } catch { throw new Error("Download a new login check from your Typeship Console and pass its JSON file to --console-check. Checks expire after ten minutes."); }
-  finally { if (fd !== undefined) closeSync(fd); }
-}
-
-/** No traffic to Typeship occurs without the explicit --console-check action.
- * Only the credentials selected for the identity read leave this process;
- * refresh tokens and other stored logins are never sent to the Console. */
-export async function checkConsoleBrowserLogin(input: {
-  file: string;
-  configuration: ConsoleLoginConfiguration;
-  schemes: CredentialSchemes;
-  credentials: NamedCredentials;
-  login(timeoutMs: number): Promise<OAuthLoginSession>;
-  verify(credentials: NamedCredentials, expectations: ConsoleLoginCheck["expectations"]): Promise<void>;
-  progress(message: string): void;
-}): Promise<{ ok: true; method: "oauth_browser"; console_verified: true; revoked: boolean | null }> {
-  const check = readCheck(input.file);
-  if (!sameConsoleLoginConfiguration(input.configuration, check.configuration)) throw new Error("This CLI's authentication settings do not match the saved Target. Regenerate the CLI, select the matching environment, and download a new check.");
-  const send = async (body: Record<string, unknown>, timeoutMs = 30_000) => {
-    const response = await oauthJsonRequest(check.endpoint, { method: "POST", headers: { "Content-Type": "application/json", Accept: "application/json" }, body: JSON.stringify({ ticket: check.ticket, ...body }) }, timeoutMs);
-    if (response.status === 422) throw new Error("Typeship could not verify this login. Check the expected identity, API permissions and saved Target settings, then download a new check.");
-    if (response.status !== 200 || response.data?.ok !== true) throw new Error("The Console check expired, was already used, changed, or could not be completed. Download a new check and try again.");
-    return response.data;
-  };
-  await send({ action: "inspect" });
-  let revoked: boolean | null = null;
-  try {
-    const supplied = parseNamedCredentials(input.credentials, input.schemes);
-    // Only a complete alternative that uses the fresh browser token proves
-    // browser access. An unrelated key-only alternative is not sufficient.
-    const requirement = input.configuration.requirements.find((entry) => {
-      const names = Object.keys(entry);
-      if (!names.some((name) => input.schemes[name]?.kind === "bearer") || !names.every((name) => input.schemes[name]?.kind === "bearer" || supplied[name] !== undefined)) return false;
-      const selected = input.configuration.requirements.find((candidate) => Object.keys(candidate).every((name) => names.includes(name)));
-      return selected && Object.keys(selected).some((name) => input.schemes[name]?.kind === "bearer");
-    });
-    if (!requirement) throw new Error("Supply the additional named credentials required by the identity read with --credentials @file or environment variables.");
-    input.progress("This check runs a temporary browser login. Typeship will receive only the access token and any additional credentials required for the identity read; refresh tokens stay on this computer.");
-    const session = await input.login(Math.max(1, Date.parse(check.expiresAt) - Date.now()));
-    try {
-      const evidence = { method: "oauth_browser" as const, issuer: session.issuer, clientId: session.clientId, redirectUri: session.redirectUri };
-      if (!matchesConsoleBrowserEvidence(input.configuration, evidence)) throw new Error("The browser login did not use the Target's client registration and native callback.");
-      const credentials: NamedCredentials = Object.fromEntries(Object.keys(requirement).map((name) => [name, input.schemes[name]!.kind === "bearer" ? session.accessToken : supplied[name]! ]));
-      await input.verify(credentials, check.expectations);
-      await send({ action: "complete", configuration: input.configuration, evidence, credentials, expectations: check.expectations });
-    } finally {
-      // Verification sessions never replace the customer's saved login.
-      // Revoke the temporary grant when the provider advertises an endpoint.
-      if (session.revocationUrl) {
-        try {
-          const response = await fetch(session.revocationUrl, { method: "POST", redirect: "error", credentials: "omit", signal: AbortSignal.timeout(10_000), headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: session.refreshToken ?? session.accessToken, token_type_hint: session.refreshToken ? "refresh_token" : "access_token", client_id: session.clientId }) });
-          void response.body?.cancel().catch(() => {});
-          revoked = response.status === 200;
-        } catch { revoked = false; }
-      }
-    }
-  } catch (error) {
-    // Report only that the attempt ended. Never send provider errors, identity
-    // values or credentials, and never replace the original local error. A
-    // consumed check rejects this report, preserving any completed API proof.
-    try { await send({ action: "fail" }, 5_000); } catch { /* Best effort; the Console can still expire the check. */ }
-    throw error;
-  }
-  return { ok: true, method: "oauth_browser", console_verified: true, revoked };
-}

package/src/console-login-contract.ts

@@ -1,65 +0,0 @@
-
-export interface ConsoleLoginConfiguration {
-  baseUrl: string;
-  environment: string | null;
-  operation: string;
-  request: { method: string; path: string; graphqlField: string | null; graphqlQuery: string | null };
-  requirements: Record<string, string[]>[];
-  issuer: string;
-  clientId: string;
-  discoveryUrl: string | null;
-  authorizationUrl: string | null;
-  tokenUrl: string | null;
-  redirectUri: string;
-  scopes: string[];
-  audience: string | null;
-  resource: string | null;
-}
-export interface ConsoleIdentityExpectation {
-  kind: "account" | "organization" | "user";
-  pointer: string;
-  expected: string | number;
-}
-export interface ConsoleLoginCheck {
-  version: 1;
-  endpoint: string;
-  ticket: string;
-  expiresAt: string;
-  configuration: ConsoleLoginConfiguration;
-  expectations: ConsoleIdentityExpectation[];
-}
-export interface ConsoleBrowserEvidence {
-  method: "oauth_browser";
-  issuer: string;
-  clientId: string;
-  redirectUri: string;
-}
-
-function canonical(value: unknown): string {
-  if (Array.isArray(value)) return "[" + value.map(canonical).join(",") + "]";
-  if (value && typeof value === "object") return "{" + Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => JSON.stringify(key) + ":" + canonical(item)).join(",") + "}";
-  return JSON.stringify(value) ?? "null";
-}
-
-/** Compare the generated product's own settings with the reviewed check.
- * The downloaded file never supplies the CLI's OAuth or API destination. */
-export function sameConsoleLoginConfiguration(left: ConsoleLoginConfiguration, right: ConsoleLoginConfiguration): boolean {
-  const normalize = (value: ConsoleLoginConfiguration) => ({ ...value,
-    baseUrl: new URL(value.baseUrl).href,
-    scopes: [...new Set(value.scopes)].sort(),
-    requirements: value.requirements.map((entry) => Object.fromEntries(Object.entries(entry).map(([key, scopes]) => [key, [...new Set(scopes)].sort()]))),
-  });
-  try { return canonical(normalize(left)) === canonical(normalize(right)); } catch { return false; }
-}
-
-export function matchesConsoleBrowserEvidence(config: ConsoleLoginConfiguration, evidence: ConsoleBrowserEvidence): boolean {
-  try {
-    if (evidence.method !== "oauth_browser" || evidence.issuer !== config.issuer || evidence.clientId !== config.clientId) return false;
-    const configured = new URL(config.redirectUri), actual = new URL(evidence.redirectUri);
-    if (configured.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(configured.hostname) || configured.username || configured.password || configured.search || configured.hash) return false;
-    if (configured.port && configured.port !== actual.port) return false;
-    if (!actual.port) return false;
-    configured.port = actual.port;
-    return configured.href === actual.href;
-  } catch { return false; }
-}

package/src/resources/publications.ts

@@ -1,140 +0,0 @@
-// typeship — publications resource.
-// Generated by typeship — https://typeship.dev
-
-import { HttpCore, type RequestOptions } from "../core/http.js";
-import { paginate, PagePromise } from "../core/pagination.js";
-import {
-  ResponseParseError,
-  TransportError,
-  UnexpectedApiError,
-  ValidationError,
-  BadRequestError,
-  ForbiddenError,
-  InternalServerError,
-  NotFoundError,
-  RateLimitedError,
-  UnauthorizedError,
-} from "../errors.js";
-import type {
-  Publication,
-  PublicationId,
-  PublicationList,
-  PublicationListRead,
-  PublicationRead,
-  PublicationResponse,
-  PublicationResponseRead,
-  ReleaseId,
-} from "../types.js";
-
-export class PublicationsResource {
-  constructor(private readonly _core: HttpCore) {}
-  /**
-   * List publications
-   *
-   * Auto-paginates: `for await (const item of …)` walks every page.
-   * `GET /publications`
-   */
-  list(
-    params?: PublicationsListParams,
-    options?: RequestOptions,
-  ): PagePromise<PublicationRead, PublicationsListError> {
-    return paginate<PublicationRead, PublicationsListError>(this._core, {
-      method: "GET",
-      path: "/publications",
-      security: [{"apiKey":[]}],
-      query: {
-        limit: params?.limit,
-        cursor: params?.cursor,
-        release_id: params?.releaseId,
-      },
-      errors: {
-        "400": BadRequestError,
-        "401": UnauthorizedError,
-        "403": ForbiddenError,
-        "404": NotFoundError,
-        "429": RateLimitedError,
-        "500": InternalServerError,
-      },
-      idempotent: true,
-      schemaKey: "publications.list",
-      options,
-    }, {
-      style: "cursor",
-      itemsField: "data",
-      cursorParam: "cursor",
-      nextCursorField: "next_cursor",
-      hasMoreField: "has_more",
-      limitParam: "limit",
-    });
-  }
-
-  /**
-   * Get publishing status
-   *
-   * Returns the registry publishing status for a release. A status in another organization returns
-   * 404 resource_not_found.
-   * `GET /publications/{publication_id}`
-   */
-  async get(publicationId: PublicationId, options?: RequestOptions): Promise<PublicationResponseRead> {
-    return this._core.requestData<PublicationResponseRead, PublicationsGetError>({
-      method: "GET",
-      path: `/publications/${encodeURIComponent(String(publicationId))}`,
-      security: [{"apiKey":[]}],
-      errors: {
-        "401": UnauthorizedError,
-        "403": ForbiddenError,
-        "404": NotFoundError,
-        "429": RateLimitedError,
-        "500": InternalServerError,
-      },
-      idempotent: true,
-      schemaKey: "publications.get",
-      options,
-    });
-  }
-}
-
-export interface PublicationsListParams {
-  /**
-   * Maximum number of resources to return. Omit for 20; otherwise supply base-10 digits
-   * representing an integer from 1 to 100. Empty, malformed, or out-of-range values return 400
-   * input_invalid. List query parameters must appear only once; repeated or unrecognized parameters
-   * return 400 query_param_invalid.
-   */
-  limit?: number;
-  /**
-   * Opaque cursor from the preceding page's next_cursor. Valid only for the same organization,
-   * operation, filters, and ordering that issued it. Omit to start at the first page. Empty or
-   * malformed cursors, and cursors issued for different filters, return 400 cursor_invalid; start
-   * again from the first page. Repeated cursors return 400 query_param_invalid. The page limit may
-   * change between requests.
-   */
-  cursor?: string;
-  /** Only publications of this release. */
-  releaseId?: ReleaseId;
-}
-
-/** Typed errors `list` can throw. */
-export type PublicationsListError =
-  | BadRequestError
-  | UnauthorizedError
-  | ForbiddenError
-  | NotFoundError
-  | RateLimitedError
-  | InternalServerError
-  | UnexpectedApiError
-  | ResponseParseError
-  | TransportError
-  | ValidationError;
-
-/** Typed errors `get` can throw. */
-export type PublicationsGetError =
-  | UnauthorizedError
-  | ForbiddenError
-  | NotFoundError
-  | RateLimitedError
-  | InternalServerError
-  | UnexpectedApiError
-  | ResponseParseError
-  | TransportError
-  | ValidationError;