@urateam/cli 0.1.41 → 0.1.43

package/dist/lib/env-file.js

@@ -0,0 +1,69 @@
+/**
+ * Minimal `.env` read / upsert preserving unrelated keys, comments, and blank
+ * lines. We don't need the full `dotenv` spec — just replace-or-append.
+ *
+ * `upsertEnvFile` writes atomically by writing a sibling `<path>.tmp` first
+ * and then renaming. Same-FS rename is atomic on POSIX and on Windows in
+ * Node 22, which is the only target.
+ */
+import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync, } from "node:fs";
+import { dirname } from "node:path";
+export function readEnvFile(path) {
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    for (const raw of readFileSync(path, "utf8").split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq < 1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        out[key] = value;
+    }
+    return out;
+}
+export function upsertEnvFile(path, updates) {
+    mkdirSync(dirname(path), { recursive: true });
+    const updateKeys = new Set(Object.keys(updates));
+    const seen = new Set();
+    let lines = [];
+    if (existsSync(path)) {
+        lines = readFileSync(path, "utf8").split("\n");
+    }
+    const out = [];
+    for (const raw of lines) {
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith("#")) {
+            out.push(raw);
+            continue;
+        }
+        const eq = trimmed.indexOf("=");
+        if (eq < 1) {
+            out.push(raw);
+            continue;
+        }
+        const key = trimmed.slice(0, eq).trim();
+        if (updateKeys.has(key)) {
+            out.push(`${key}=${updates[key]}`);
+            seen.add(key);
+        }
+        else {
+            out.push(raw);
+        }
+    }
+    while (out.length > 0 && out[out.length - 1] === "")
+        out.pop();
+    for (const key of updateKeys) {
+        if (!seen.has(key)) {
+            out.push(`${key}=${updates[key]}`);
+        }
+    }
+    out.push("");
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, out.join("\n"));
+    renameSync(tmp, path);
+}
+//# sourceMappingURL=env-file.js.map

package/dist/lib/env-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/lib/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAA+B;IAE/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAE/D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEb,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/lib/linear-oauth-deps.d.ts

@@ -0,0 +1,14 @@
+import type { LinearTokenResponse } from "./linear-oauth.js";
+export declare function defaultBrowserOpen(url: string): Promise<void>;
+export declare function defaultFetchTokenEndpoint(body: {
+    code: string;
+    client_id: string;
+    client_secret: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+}): Promise<LinearTokenResponse>;
+export declare function defaultFetchViewer(accessToken: string): Promise<{
+    workspaceId: string;
+    workspaceName?: string;
+}>;
+//# sourceMappingURL=linear-oauth-deps.d.ts.map

package/dist/lib/linear-oauth-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth-deps.d.ts","sourceRoot":"","sources":["../../src/lib/linear-oauth-deps.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAI7D,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/B;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB1D"}

package/dist/lib/linear-oauth-deps.js

@@ -0,0 +1,54 @@
+/**
+ * Default real-world implementations of the LinearOAuthDeps callbacks.
+ * Split into its own module so tests can mock the entire shim without
+ * pulling in node:child_process and friends.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileP = promisify(execFile);
+export async function defaultBrowserOpen(url) {
+    // macOS: `open`, Linux: `xdg-open`. If neither resolves, print the URL.
+    const cmd = process.platform === "darwin" ? "open" : "xdg-open";
+    try {
+        await execFileP(cmd, [url]);
+    }
+    catch {
+        console.log("Open this URL in your browser:");
+        console.log(`  ${url}`);
+    }
+}
+export async function defaultFetchTokenEndpoint(body) {
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(body))
+        params.set(k, v);
+    const res = await fetch("https://api.linear.app/oauth/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!res.ok) {
+        const errText = await res.text().catch(() => res.statusText);
+        throw new Error(`${res.status}: ${errText.slice(0, 200)}`);
+    }
+    return (await res.json());
+}
+export async function defaultFetchViewer(accessToken) {
+    const query = "query { organization { id name } }";
+    const res = await fetch("https://api.linear.app/graphql", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({ query }),
+    });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch workspace metadata: ${res.status} ${res.statusText}`);
+    }
+    const json = (await res.json());
+    const org = json?.data?.organization;
+    if (!org?.id)
+        throw new Error("Linear returned no organization id");
+    return { workspaceId: org.id, workspaceName: org.name };
+}
+//# sourceMappingURL=linear-oauth-deps.js.map

package/dist/lib/linear-oauth-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth-deps.js","sourceRoot":"","sources":["../../src/lib/linear-oauth-deps.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,wEAAwE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAM/C;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACpE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/dist/lib/linear-oauth.d.ts

@@ -0,0 +1,46 @@
+export interface LinearOAuthDeps {
+    clientId: string;
+    clientSecret: string;
+    scope: string;
+    /** Total time to wait for the operator to authorize, in milliseconds. */
+    timeoutMs: number;
+    /**
+     * Port to bind the local callback server to. Fixed because Linear requires
+     * the redirect URI registered in the OAuth app settings to match the URI
+     * sent in the authorize request EXACTLY (host + port + path), so a
+     * random port would force the operator to re-register every time.
+     * Pass `0` to bind a random free port (test-only — production code must
+     * pass a stable value).
+     */
+    port: number;
+    /** Opens the authorize URL in the operator's browser. Pure-test override. */
+    openBrowser: (url: string) => Promise<void>;
+    /** Exchanges the code for an access token. */
+    fetchTokenEndpoint: (body: {
+        code: string;
+        client_id: string;
+        client_secret: string;
+        redirect_uri: string;
+        grant_type: "authorization_code";
+    }) => Promise<LinearTokenResponse>;
+    /** Fetches workspace metadata for the audit event. */
+    fetchViewer: (accessToken: string) => Promise<{
+        workspaceId: string;
+        workspaceName?: string;
+    }>;
+}
+export interface LinearTokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope: string;
+}
+export interface LinearOAuthResult {
+    accessToken: string;
+    workspaceId: string;
+    workspaceName?: string;
+    scope: string;
+    expiresInSeconds: number;
+}
+export declare function runLinearOAuth(deps: LinearOAuthDeps): Promise<LinearOAuthResult>;
+//# sourceMappingURL=linear-oauth.d.ts.map

package/dist/lib/linear-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.d.ts","sourceRoot":"","sources":["../../src/lib/linear-oauth.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,8CAA8C;IAC9C,kBAAkB,EAAE,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,oBAAoB,CAAC;KAClC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,sDAAsD;IACtD,WAAW,EAAE,CACX,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAkBD,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CA6J5B"}

package/dist/lib/linear-oauth.js

@@ -0,0 +1,154 @@
+/**
+ * Linear OAuth 2.0 authorization-code flow, runnable headlessly with
+ * dependency-injected browser-open and HTTP transport for tests.
+ *
+ * High-level:
+ *   1. Bind an ephemeral 127.0.0.1 server (random free port).
+ *   2. Redirect the operator's browser to Linear with the loopback callback.
+ *   3. Verify the HMAC-signed state on the callback.
+ *   4. Exchange the code for an access token.
+ *   5. Look up workspace metadata (for the audit event).
+ *   6. Shut the server down.
+ *
+ * Token handling: the access token never crosses console.log, never lands
+ * in the success-page HTML, and never appears in the audit event payload.
+ */
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { newNonce, signState, verifyState } from "./oauth-state.js";
+const SUCCESS_HTML = `<!doctype html>
+<html><head><meta charset="utf-8"><title>urateam OAuth</title></head>
+<body style="font-family: -apple-system, sans-serif; max-width: 520px; margin: 80px auto; line-height: 1.5;">
+<h1>Authorized</h1>
+<p>You can close this tab. Return to your terminal to continue.</p>
+</body></html>`;
+const ERROR_HTML = (msg) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>urateam OAuth</title></head>
+<body style="font-family: -apple-system, sans-serif; max-width: 520px; margin: 80px auto; line-height: 1.5;">
+<h1>Authorization failed</h1>
+<p>${msg}</p>
+</body></html>`;
+const AUTHORIZE_URL = "https://linear.app/oauth/authorize";
+export async function runLinearOAuth(deps) {
+    const stateSecret = randomBytes(32).toString("hex");
+    const nonce = newNonce();
+    const state = signState(stateSecret, nonce);
+    return await new Promise((resolve, reject) => {
+        let resolved = false;
+        let server = null;
+        const timeout = setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
+            server?.close();
+            reject(new Error(`ura self-auth-linear: timed out waiting for the OAuth callback (${deps.timeoutMs}ms)`));
+        }, deps.timeoutMs);
+        const finalize = (ok, err, e) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            server?.close();
+            if (e && err)
+                err(e);
+            else
+                ok();
+        };
+        server = createServer(async (req, res) => {
+            try {
+                const url = new URL(req.url ?? "/", `http://127.0.0.1`);
+                if (url.pathname !== "/callback") {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const code = url.searchParams.get("code");
+                const incomingState = url.searchParams.get("state") ?? "";
+                const verified = verifyState(stateSecret, incomingState);
+                if (!verified || verified !== nonce) {
+                    res.writeHead(400, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("State mismatch — possible CSRF; abort."));
+                    finalize(() => { }, (e) => reject(e), new Error("ura self-auth-linear: state mismatch — aborting"));
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(400, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("Missing 'code' parameter from Linear."));
+                    finalize(() => { }, (e) => reject(e), new Error("ura self-auth-linear: missing code in callback"));
+                    return;
+                }
+                const port = server.address().port;
+                const redirectUri = `http://127.0.0.1:${port}/callback`;
+                const token = await deps.fetchTokenEndpoint({
+                    code,
+                    client_id: deps.clientId,
+                    client_secret: deps.clientSecret,
+                    redirect_uri: redirectUri,
+                    grant_type: "authorization_code",
+                });
+                // Render the success page IMMEDIATELY after token exchange succeeds.
+                // The operator's view of "Authorized" must not depend on the
+                // subsequent viewer fetch, which is only used for the audit event's
+                // display name. If `fetchViewer` fails (Linear GraphQL hiccup), we
+                // still resolve with the token — falling back to an "unknown"
+                // workspace placeholder.
+                res.writeHead(200, { "content-type": "text/html" });
+                res.end(SUCCESS_HTML);
+                let viewer;
+                try {
+                    viewer = await deps.fetchViewer(token.access_token);
+                }
+                catch {
+                    viewer = { workspaceId: "unknown", workspaceName: undefined };
+                }
+                if (!resolved) {
+                    resolved = true;
+                    clearTimeout(timeout);
+                    server?.close();
+                    resolve({
+                        accessToken: token.access_token,
+                        workspaceId: viewer.workspaceId,
+                        workspaceName: viewer.workspaceName,
+                        scope: token.scope,
+                        expiresInSeconds: token.expires_in,
+                    });
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                try {
+                    res.writeHead(500, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("Token exchange failed; check the terminal."));
+                }
+                catch {
+                    // response may already be sent
+                }
+                finalize(() => { }, (e) => reject(e), new Error(`ura self-auth-linear: ${message}`));
+            }
+        });
+        server.on("error", (err) => {
+            if (err.code === "EADDRINUSE") {
+                finalize(() => { }, (e) => reject(e), new Error(`ura self-auth-linear: port ${deps.port} is already in use. ` +
+                    `Pass --port <other-port> and register the matching redirect URI in your Linear OAuth app.`));
+                return;
+            }
+            finalize(() => { }, (e) => reject(e), err instanceof Error ? err : new Error(String(err)));
+        });
+        server.listen(deps.port, "127.0.0.1", async () => {
+            try {
+                const port = server.address().port;
+                const redirectUri = `http://127.0.0.1:${port}/callback`;
+                const authUrl = new URL(AUTHORIZE_URL);
+                authUrl.searchParams.set("client_id", deps.clientId);
+                authUrl.searchParams.set("redirect_uri", redirectUri);
+                authUrl.searchParams.set("response_type", "code");
+                authUrl.searchParams.set("scope", deps.scope);
+                authUrl.searchParams.set("state", state);
+                await deps.openBrowser(authUrl.toString());
+            }
+            catch (err) {
+                finalize(() => { }, (e) => reject(e), err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+    });
+}
+//# sourceMappingURL=linear-oauth.js.map

package/dist/lib/linear-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.js","sourceRoot":"","sources":["../../src/lib/linear-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgDpE,MAAM,YAAY,GAAG;;;;;eAKN,CAAC;AAEhB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;KAI/B,GAAG;eACO,CAAC;AAEhB,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB;IAErB,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,CACJ,IAAI,KAAK,CACP,mEAAmE,IAAI,CAAC,SAAS,KAAK,CACvF,CACF,CAAC;QACJ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,CACf,EAAc,EACd,GAAwB,EACxB,CAAS,EACH,EAAE;YACR,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAChB,EAAE,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAC,CAAC;oBAC9D,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAC7D,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,uCAAuC,CAAC,CAAC,CAAC;oBAC7D,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAC5D,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAI,MAAO,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;gBAC1D,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;gBAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;oBAC1C,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;iBACjC,CAAC,CAAC;gBAEH,qEAAqE;gBACrE,6DAA6D;gBAC7D,oEAAoE;gBACpE,mEAAmE;gBACnE,8DAA8D;gBAC9D,yBAAyB;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAEtB,IAAI,MAAuD,CAAC;gBAC5D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;gBAChE,CAAC;gBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,EAAE,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC;wBACN,WAAW,EAAE,KAAK,CAAC,YAAY;wBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,gBAAgB,EAAE,KAAK,CAAC,UAAU;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;gBACD,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAC9C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CACP,8BAA8B,IAAI,CAAC,IAAI,sBAAsB;oBAC3D,2FAA2F,CAC9F,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAI,MAAO,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;gBAC1D,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;gBACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/oauth-state.d.ts

@@ -0,0 +1,9 @@
+export declare function newNonce(): string;
+export declare function signState(secret: string, nonce: string): string;
+/**
+ * Returns the verified nonce when `state` is valid; `null` otherwise.
+ * Constant-time signature comparison so attacker timing observations don't
+ * leak the expected signature byte-by-byte.
+ */
+export declare function verifyState(secret: string, state: string): string | null;
+//# sourceMappingURL=oauth-state.d.ts.map

package/dist/lib/oauth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.d.ts","sourceRoot":"","sources":["../../src/lib/oauth-state.ts"],"names":[],"mappings":"AAUA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAexE"}

package/dist/lib/oauth-state.js

@@ -0,0 +1,43 @@
+/**
+ * HMAC-signed OAuth `state` parameter helpers.
+ *
+ * The OAuth provider echoes `state` back on the callback; verifying the HMAC
+ * before trusting the callback's `code` defends against open-redirect / CSRF
+ * attacks. Format: `<nonce>.<hmac-sha256-hex>`. The secret is per-invocation
+ * and never persisted — sign + verify happen in the same process.
+ */
+import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
+export function newNonce() {
+    return randomBytes(16).toString("hex");
+}
+export function signState(secret, nonce) {
+    const sig = createHmac("sha256", secret).update(nonce).digest("hex");
+    return `${nonce}.${sig}`;
+}
+/**
+ * Returns the verified nonce when `state` is valid; `null` otherwise.
+ * Constant-time signature comparison so attacker timing observations don't
+ * leak the expected signature byte-by-byte.
+ */
+export function verifyState(secret, state) {
+    if (!state)
+        return null;
+    const parts = state.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [nonce, providedSig] = parts;
+    if (!nonce || !providedSig)
+        return null;
+    const expectedSig = createHmac("sha256", secret).update(nonce).digest("hex");
+    const a = Buffer.from(providedSig, "hex");
+    const b = Buffer.from(expectedSig, "hex");
+    if (a.length !== b.length)
+        return null;
+    try {
+        return timingSafeEqual(a, b) ? nonce : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-state.js.map

package/dist/lib/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.js","sourceRoot":"","sources":["../../src/lib/oauth-state.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,UAAU,QAAQ;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/tunnel.d.ts

@@ -0,0 +1,105 @@
+/**
+ * `ura start --tunnel <mode>` runtime: wraps `cloudflared` as a child process.
+ *
+ * Two modes:
+ *   - "cloudflare-quick": `cloudflared tunnel --url http://localhost:<port>`.
+ *     Cloudflare assigns a random `*.trycloudflare.com` URL, which is parsed
+ *     out of cloudflared's stderr.
+ *   - "cloudflare-token": `cloudflared tunnel --token <token> run`. Operator
+ *     has already configured a named tunnel in Cloudflare; the public URL
+ *     is known ahead of time and must be passed via `opts.publicUrl` /
+ *     `URATEAM_PUBLIC_URL`.
+ *
+ * Restart-on-exit: the child is supervised with exponential-backoff retries
+ * (default 1s → 2s → 4s ... capped at 30s, max 10 attempts). On `stop()`
+ * the supervisor cancels any pending retry timer and SIGTERMs the child.
+ *
+ * All I/O is injectable for tests; the real `spawn` is only invoked when the
+ * caller doesn't override `opts.spawn`.
+ */
+import { spawn as realSpawn } from "node:child_process";
+import { EventEmitter } from "node:events";
+export type TunnelMode = "cloudflare-quick" | "cloudflare-token";
+export interface TunnelManagerOpts {
+    mode: TunnelMode;
+    /** Required for "cloudflare-token" — typically from `CLOUDFLARE_TUNNEL_TOKEN`. */
+    token?: string;
+    /** Static public URL — required for "cloudflare-token", ignored for quick. */
+    publicUrl?: string;
+    /** Local port the daemon listens on. For "cloudflare-quick". */
+    localPort: number;
+    /**
+     * Override for real `spawn` — tests pass a stub returning a controllable
+     * EventEmitter with `stdout`, `stderr`, `kill`, and an `on("exit", ...)`
+     * surface.
+     */
+    spawn?: typeof realSpawn;
+    /** Initial restart delay (ms). Default 1000. */
+    initialRestartDelayMs?: number;
+    /** Max restart delay (ms). Default 30000. */
+    maxRestartDelayMs?: number;
+    /** Max restart attempts before giving up. Default 10. */
+    maxRestartAttempts?: number;
+    /** Time to wait for the public URL to appear in stderr (quick mode). Default 30s. */
+    urlDetectTimeoutMs?: number;
+    /** Logger (defaults to console.log). */
+    log?: (msg: string) => void;
+}
+export interface TunnelStartResult {
+    publicUrl: string;
+    restartCount: number;
+}
+/**
+ * Thrown when the `cloudflared` binary isn't installed (ENOENT on spawn).
+ * Carries an install hint so the start command can render an actionable
+ * error.
+ */
+export declare class CloudflaredMissingError extends Error {
+    constructor();
+}
+export declare class TunnelManager extends EventEmitter {
+    private readonly opts;
+    private child;
+    private restartCount;
+    private shuttingDown;
+    private restartTimer;
+    private publicUrl;
+    private readonly spawnFn;
+    private readonly initialRestartDelayMs;
+    private readonly maxRestartDelayMs;
+    private readonly maxRestartAttempts;
+    private readonly urlDetectTimeoutMs;
+    private readonly log;
+    constructor(opts: TunnelManagerOpts);
+    /**
+     * Start the tunnel. Resolves with the detected (quick) or pre-configured
+     * (token) public URL. Throws `CloudflaredMissingError` on ENOENT.
+     */
+    start(): Promise<TunnelStartResult>;
+    /**
+     * Stop the tunnel. Cancels any pending restart, SIGTERMs the child, and
+     * awaits the exit. Subsequent restarts (e.g. an exit fired during
+     * shutdown) are skipped.
+     */
+    stop(): Promise<void>;
+    private buildArgs;
+    private spawnChild;
+    private spawnAndDetectUrl;
+    /**
+     * Wire the supervisor: on unexpected exit, schedule a restart with
+     * exponential backoff. Caps at `maxRestartAttempts` then emits "error".
+     */
+    private wireSupervisor;
+    private restart;
+    /** Currently-known public URL, or null before `start()`. */
+    getPublicUrl(): string | null;
+    /**
+     * Total restart attempts made since `start()`. Never resets within the
+     * lifetime of a single TunnelManager — so even a long stable period
+     * followed by a single new failure still incurs the cap-tier delay.
+     * Operators who care can construct a fresh manager. Used by the
+     * `tunnel.stopped` audit event to attribute flap loops correctly.
+     */
+    getRestartCount(): number;
+}
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/lib/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/lib/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,KAAK,IAAI,SAAS,EAGnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,gDAAgD;IAChD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;;CAUjD;AAED,qBAAa,aAAc,SAAQ,YAAY;IAajC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEf,IAAI,EAAE,iBAAiB;IAUpD;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAoBzC;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;YAYJ,iBAAiB;IAoD/B;;;OAGG;IACH,OAAO,CAAC,cAAc;YAiCR,OAAO;IA6BrB,4DAA4D;IAC5D,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM;CAG1B"}