@usestatemachines/cli 0.0.0-stage → 0.1.0

package/dist/login.js

@@ -0,0 +1,965 @@
+import { join } from 'node:path';
+import { StateMachinesError } from '@usestatemachines/sdk';
+import { z } from 'zod';
+import { configSchema, emptyConfig, parseVersioned, pendingPayloadSchema, } from './config/schema.js';
+import { apiOriginFromEnvironment, apiOriginSchema, loginIdSchema, organizationIdSchema, profileNameFromEnvironment, profileNameSchema, tokenIdSchema, } from './context-types.js';
+import { createLoginKey, unsealLoginToken } from './credentials/sealing.js';
+import { CredentialStore } from './credentials/store.js';
+import { ApiError, CliError, failedWith, keychainFailures } from './errors.js';
+import { KeyOwner } from './keys.js';
+export const recoveryReportSchema = z.strictObject({
+    acknowledged: z.array(z.string()),
+    revoked: z.array(z.string()),
+    pending: z.array(z.string()),
+    unconfirmed: z.array(z.string()),
+});
+const copy = {
+    replace: 'Replace the saved session for this profile?',
+    replacementRequired: 'This profile already has a session. Use --yes to replace it.',
+    denied: 'Login was denied. Start a new login to try again.',
+    expired: 'Login expired. Start a new login to try again.',
+};
+const storeFailures = [
+    ...keychainFailures,
+    'cli.config_io',
+    'cli.credential_store_mismatch',
+];
+function sameRef(left, right) {
+    return (left.store === right.store &&
+        left.origin === right.origin &&
+        left.entry === right.entry);
+}
+function readPendingPayload(text, attempt) {
+    const payload = parseVersioned(text, pendingPayloadSchema);
+    if (attempt.login === null ||
+        payload.loginId !== attempt.login.loginId ||
+        payload.origin !== attempt.origin ||
+        payload.expiresAt !== attempt.login.expiresAt ||
+        payload.interval !== attempt.login.interval) {
+        throw new CliError('cli.credentials_invalid');
+    }
+    return payload;
+}
+class AccountOwner {
+    #io;
+    #clients;
+    #version;
+    #store;
+    #options;
+    #path;
+    #nonce;
+    programKeys;
+    constructor(input) {
+        this.#io = input.io;
+        this.#clients = input.clients;
+        this.#version = input.version;
+        this.#store = new CredentialStore(input.io);
+        this.#options = input.options ?? {
+            signal: input.io.signal,
+            deadline: null,
+        };
+        this.#path = join(input.io.host.configHome, 'config.json');
+        this.#nonce = this.#id();
+        this.programKeys = new KeyOwner({
+            io: input.io,
+            clients: input.clients,
+            store: this.#store,
+            files: input.environmentFiles,
+            transaction: (options, action) => this.#transaction(options, action, false),
+            readToken: (reference, options) => this.#readToken(reference, options),
+            readBackgroundToken: (reference, options, bounded) => this.#readBackgroundToken(reference, options, bounded),
+            queueCleanup: (state, reference) => this.#queueCleanup(state, reference),
+            cleanup: (transaction) => this.#cleanup(transaction),
+        });
+    }
+    #id() {
+        return Buffer.from(this.#io.randomBytes(24)).toString('base64url');
+    }
+    #check(options) {
+        if (options.signal.aborted) {
+            throw new CliError('cli.cancelled');
+        }
+        if (options.deadline !== null && this.#io.now() >= options.deadline) {
+            throw new CliError('cli.wait_timeout');
+        }
+    }
+    async #read(options) {
+        const text = await this.#io.files.read(this.#path, options);
+        return text === null ? emptyConfig() : parseVersioned(text, configSchema);
+    }
+    async #readToken(reference, options) {
+        const token = await this.#store.get(reference, options);
+        if (token !== null && !/^smcli_[A-Za-z0-9_-]{43}$/.test(token)) {
+            throw new CliError('cli.credentials_invalid');
+        }
+        return token;
+    }
+    async #readBackgroundToken(reference, options, bounded) {
+        try {
+            const token = await this.#readToken(reference, bounded);
+            this.#check(options);
+            return token === null ? { kind: 'missing' } : { kind: 'ready', token };
+        }
+        catch (error) {
+            this.#check(options);
+            if (failedWith(error, [
+                ...storeFailures,
+                'cli.wait_timeout',
+                'cli.credentials_invalid',
+            ])) {
+                return { kind: 'pending' };
+            }
+            throw error;
+        }
+    }
+    #selectedSession(state, selection) {
+        const name = this.#selectedProfile(selection.profile, state);
+        if (name === null) {
+            throw new CliError('cli.no_credential');
+        }
+        const profile = state.profiles.find((item) => item.name === name);
+        if (profile?.session === undefined || profile.session === null) {
+            throw new CliError('cli.profile_not_found');
+        }
+        const session = profile.session;
+        if (selection.expectedOrigin !== null &&
+            selection.expectedOrigin !== session.origin) {
+            throw new CliError('cli.origin_mismatch');
+        }
+        if (Date.parse(session.expiresAt) <= this.#io.now()) {
+            throw new CliError('cli.credential_expired');
+        }
+        return { name, profile, session };
+    }
+    async #transaction(options, action, recover = true) {
+        return this.#io.files.withLock(join(this.#io.host.configHome, '.lock'), options, async () => {
+            const state = await this.#read(options);
+            const transaction = {
+                state,
+                options,
+                save: () => this.#io.files.atomicWrite(this.#path, JSON.stringify(state), 'private', options),
+            };
+            if (recover) {
+                await this.#recover(transaction);
+            }
+            return action(transaction);
+        });
+    }
+    #selectedProfile(explicit, state) {
+        const environment = this.#io.host.environment.STATEMACHINES_PROFILE;
+        return (explicit ??
+            profileNameFromEnvironment(environment) ??
+            state.defaultProfile);
+    }
+    #queueCleanup(state, reference) {
+        if (!state.cleanup.some((item) => sameRef(item, reference))) {
+            state.cleanup.push(reference);
+        }
+    }
+    #retireAttempt(state, id) {
+        const attempt = state.attempts.find((item) => item.id === id);
+        if (attempt?.secret !== null && attempt?.secret !== undefined) {
+            this.#queueCleanup(state, attempt.secret);
+        }
+        state.attempts = state.attempts.filter((item) => item.id !== id);
+    }
+    async #cleanup(transaction) {
+        const { state, options } = transaction;
+        for (const reference of [...state.cleanup]) {
+            const held = [
+                ...this.programKeys.references(state),
+                ...state.profiles.flatMap((profile) => profile.session === null
+                    ? []
+                    : [
+                        profile.session.token,
+                        ...profile.session.runKeys.map((key) => key.secret),
+                    ]),
+                ...state.attempts.flatMap((attempt) => attempt.secret === null ? [] : [attempt.secret]),
+                ...state.acknowledgements.map((job) => job.token),
+                ...state.revocations.map((job) => job.token),
+                ...state.intents.map((intent) => intent.kind === 'install' ? intent.candidate.token : intent.token),
+            ];
+            if (held.some((item) => sameRef(item, reference))) {
+                continue;
+            }
+            try {
+                await this.#store.delete(reference, options);
+            }
+            catch (error) {
+                this.#check(options);
+                if (failedWith(error, storeFailures)) {
+                    continue;
+                }
+                throw error;
+            }
+            state.cleanup = state.cleanup.filter((item) => !sameRef(item, reference));
+            await transaction.save();
+        }
+    }
+    async #write(transaction, holder, value) {
+        try {
+            await this.#store.set(holder.token, value, transaction.options);
+        }
+        catch (error) {
+            holder.token = await this.#store.fallback(holder.token, error);
+            await transaction.save();
+            await this.#store.set(holder.token, value, transaction.options);
+        }
+    }
+    #queueRevocation(state, session) {
+        const id = `revoke:${session.origin}:${session.tokenId}`;
+        if (!state.revocations.some((job) => job.id === id)) {
+            state.revocations.push({
+                id,
+                origin: session.origin,
+                tokenId: session.tokenId,
+                token: session.token,
+            });
+        }
+    }
+    async #finishInstall(transaction, intent) {
+        const { state } = transaction;
+        const profile = state.profiles.find((item) => item.name === intent.profile);
+        const attempt = state.attempts.find((item) => item.id === intent.attemptId);
+        const valid = profile !== undefined &&
+            profile.generation === intent.generation &&
+            attempt?.generation === intent.generation &&
+            attempt.profile === intent.profile &&
+            attempt.owner?.nonce === this.#nonce;
+        if (!valid) {
+            this.#queueRevocation(state, intent.candidate);
+        }
+        else {
+            if (profile.session !== null) {
+                this.#queueRevocation(state, profile.session);
+                this.programKeys.retireSession(state, profile.session);
+            }
+            profile.session = intent.candidate;
+            profile.defaultWorkspace = null;
+            profile.generation += 1;
+            state.defaultProfile ??= profile.name;
+            state.acknowledgements.push({
+                id: `ack:${intent.candidate.origin}:${intent.loginId}:${intent.candidate.tokenId}`,
+                origin: intent.candidate.origin,
+                loginId: intent.loginId,
+                tokenId: intent.candidate.tokenId,
+                token: intent.candidate.token,
+            });
+        }
+        this.#retireAttempt(state, intent.attemptId);
+        state.intents = state.intents.filter((item) => item.id !== intent.id);
+        await transaction.save();
+        return valid;
+    }
+    async #recover(transaction) {
+        const { state, options } = transaction;
+        for (const intent of [...state.intents]) {
+            try {
+                if (intent.kind === 'install') {
+                    const token = await this.#readToken(intent.candidate.token, options);
+                    if (token !== null) {
+                        this.#queueRevocation(state, intent.candidate);
+                    }
+                    this.#retireAttempt(state, intent.attemptId);
+                }
+                else {
+                    const value = await this.#store.get(intent.token, options);
+                    const attempt = state.attempts.find((item) => item.id === intent.attemptId);
+                    if (value !== null && attempt !== undefined) {
+                        readPendingPayload(value, attempt);
+                        attempt.secret = intent.token;
+                        attempt.owner = null;
+                    }
+                    else {
+                        this.#retireAttempt(state, intent.attemptId);
+                        this.#queueCleanup(state, intent.token);
+                    }
+                }
+                state.intents = state.intents.filter((item) => item.id !== intent.id);
+                await transaction.save();
+            }
+            catch (error) {
+                this.#check(options);
+                if (!failedWith(error, [
+                    ...storeFailures,
+                    'cli.credentials_invalid',
+                    'cli.config_invalid',
+                ])) {
+                    throw error;
+                }
+            }
+        }
+        for (const attempt of [...state.attempts]) {
+            if (attempt.owner?.nonce === this.#nonce) {
+                continue;
+            }
+            if (attempt.login === null
+                ? Date.parse(attempt.createdAt) + 15 * 60_000 <= this.#io.now()
+                : Date.parse(attempt.login.expiresAt) <= this.#io.now()) {
+                this.#retireAttempt(state, attempt.id);
+                await transaction.save();
+                continue;
+            }
+            if (attempt.owner !== null &&
+                attempt.owner.hostname === this.#io.host.owner.hostname &&
+                (await this.#io.child.liveness(attempt.owner, options)) === 'dead') {
+                if (attempt.secret === null) {
+                    this.#retireAttempt(state, attempt.id);
+                }
+                else {
+                    attempt.owner = null;
+                }
+                await transaction.save();
+            }
+        }
+        for (const job of [...state.revocations]) {
+            const active = state.profiles.find((profile) => profile.session?.origin === job.origin &&
+                profile.session.tokenId === job.tokenId);
+            if (active?.session !== undefined && active.session !== null) {
+                state.revocations = state.revocations.filter((item) => item.id !== job.id);
+                if (!sameRef(active.session.token, job.token)) {
+                    this.#queueCleanup(state, job.token);
+                }
+                await transaction.save();
+            }
+        }
+        await this.programKeys.recover(transaction);
+        await this.#cleanup(transaction);
+    }
+    async reconcile(reason, options = this.#options) {
+        const budget = Math.min(this.#io.now() + 10_000, options.deadline ?? Infinity);
+        const bounded = { signal: options.signal, deadline: budget };
+        const queued = async (action) => {
+            try {
+                return { value: await action() };
+            }
+            catch (error) {
+                this.#check(options);
+                if (failedWith(error, ['cli.wait_timeout'])) {
+                    return undefined;
+                }
+                throw error;
+            }
+        };
+        const jobs = (await queued(() => this.#transaction(bounded, async ({ state }) => state)))?.value ?? (await this.#read(options));
+        const report = {
+            acknowledged: [],
+            revoked: [],
+            pending: [],
+            unconfirmed: [],
+        };
+        const call = () => {
+            const deadline = Math.min(budget, this.#io.now() + 5_000);
+            return deadline > this.#io.now()
+                ? { signal: options.signal, deadline }
+                : null;
+        };
+        for (const job of jobs.acknowledgements) {
+            this.#check(options);
+            const credential = await this.#readBackgroundToken(job.token, options, bounded);
+            if (credential.kind === 'pending') {
+                report.pending.push(job.id);
+                continue;
+            }
+            if (credential.kind === 'ready') {
+                const effect = call();
+                if (effect === null) {
+                    report.pending.push(job.id);
+                    continue;
+                }
+                try {
+                    await this.#clients
+                        .authenticated(job.origin, credential.token)
+                        .collected(job.loginId, effect);
+                    report.acknowledged.push(job.id);
+                }
+                catch (error) {
+                    this.#check(options);
+                    const code = error instanceof StateMachinesError
+                        ? error.code
+                        : error instanceof ApiError
+                            ? error.document.error.code
+                            : null;
+                    if (!((error instanceof StateMachinesError &&
+                        error.status === 401 &&
+                        code === 'unauthenticated') ||
+                        code === 'expired_token')) {
+                        report.pending.push(job.id);
+                        continue;
+                    }
+                }
+            }
+            if (!(await queued(() => this.#transaction(bounded, async (transaction) => {
+                transaction.state.acknowledgements =
+                    transaction.state.acknowledgements.filter((item) => item.id !== job.id);
+                await transaction.save();
+                await this.#cleanup(transaction);
+            })))) {
+                report.pending.push(job.id);
+            }
+        }
+        if (reason !== 'next-command') {
+            for (const job of jobs.revocations) {
+                this.#check(options);
+                const credential = await this.#readBackgroundToken(job.token, options, bounded);
+                let outcome = 'unconfirmed';
+                if (credential.kind === 'pending') {
+                    report.pending.push(job.id);
+                    continue;
+                }
+                if (credential.kind === 'ready') {
+                    const effect = call();
+                    if (effect === null) {
+                        report.pending.push(job.id);
+                        continue;
+                    }
+                    try {
+                        if ((await this.#clients
+                            .authenticated(job.origin, credential.token)
+                            .revokeCurrent(effect)) === 'revoked') {
+                            outcome = 'revoked';
+                        }
+                    }
+                    catch {
+                        this.#check(options);
+                        report.pending.push(job.id);
+                        continue;
+                    }
+                }
+                const removed = await queued(() => this.#transaction(bounded, async (transaction) => {
+                    const { state } = transaction;
+                    const matching = state.revocations.find((item) => item.id === job.id && sameRef(item.token, job.token));
+                    if (matching === undefined) {
+                        return;
+                    }
+                    state.revocations = state.revocations.filter((item) => item !== matching);
+                    state.acknowledgements = state.acknowledgements.filter((item) => item.origin !== job.origin || item.tokenId !== job.tokenId);
+                    this.programKeys.cascade(state, job);
+                    this.#queueCleanup(state, job.token);
+                    await transaction.save();
+                    await this.#cleanup(transaction);
+                }));
+                if (!removed) {
+                    report.pending.push(job.id);
+                }
+                else if (outcome === 'revoked') {
+                    report.revoked.push(job.id);
+                }
+                else {
+                    report.unconfirmed.push(job.tokenId);
+                }
+            }
+        }
+        const keys = await this.programKeys.reconcile(options, call);
+        report.revoked.push(...keys.revoked);
+        report.pending.push(...keys.pending);
+        report.unconfirmed = [
+            ...new Set([...report.unconfirmed, ...keys.unconfirmed]),
+        ];
+        return report;
+    }
+    async list(options = this.#options) {
+        await this.reconcile('next-command', options);
+        const state = await this.#read(options);
+        return {
+            defaultProfile: state.defaultProfile,
+            profiles: state.profiles.flatMap((profile) => profile.session === null
+                ? []
+                : [
+                    {
+                        name: profile.name,
+                        origin: profile.session.origin,
+                        organization: profile.session.organization,
+                        email: profile.session.email,
+                        tokenId: profile.session.tokenId,
+                        idleExpiresAt: profile.session.idleExpiresAt,
+                        expiresAt: profile.session.expiresAt,
+                        defaultWorkspace: profile.defaultWorkspace,
+                    },
+                ]),
+        };
+    }
+    async inspect(options = this.#options) {
+        const state = await this.#transaction(options, async (transaction) => transaction.state, false);
+        return {
+            defaultProfile: state.defaultProfile,
+            profiles: state.profiles.flatMap((profile) => profile.session === null
+                ? []
+                : [
+                    {
+                        name: profile.name,
+                        origin: profile.session.origin,
+                        organizationId: profile.session.organization.id,
+                        store: profile.session.token.store,
+                        idleExpiresAt: profile.session.idleExpiresAt,
+                        expiresAt: profile.session.expiresAt,
+                    },
+                ]),
+            pendingAcknowledgements: state.acknowledgements.length,
+            pendingRevocations: state.revocations.length + state.keyRevocations.length,
+            pendingCleanup: state.cleanup.length,
+        };
+    }
+    async use(name, options = this.#options) {
+        await this.reconcile('next-command', options);
+        return this.#transaction(options, async ({ state, save }) => {
+            if (!state.profiles.some((profile) => profile.name === name && profile.session !== null)) {
+                throw new CliError('cli.invalid_arguments', {
+                    message: `No saved profile is named ${name}.`,
+                    next: [
+                        {
+                            command: 'statemachines profiles list',
+                            reason: 'See the saved profiles.',
+                        },
+                    ],
+                });
+            }
+            state.defaultProfile = name;
+            await save();
+            return { profile: name };
+        });
+    }
+    async setWorkspace(input, options = this.#options) {
+        const { account, workspace, mode } = input;
+        await this.reconcile('next-command', options);
+        await this.#transaction(options, async ({ state, save }) => {
+            const profile = state.profiles.find((item) => item.name === account.profile);
+            if (profile?.session === undefined || profile.session === null) {
+                throw new CliError('cli.profile_not_found');
+            }
+            if (profile.session.tokenId !== account.tokenId ||
+                profile.session.origin !== account.origin) {
+                throw new CliError('cli.profile_changed');
+            }
+            if (mode === 'if-unset' && profile.defaultWorkspace !== null) {
+                return;
+            }
+            profile.defaultWorkspace = workspace;
+            await save();
+        });
+    }
+    async withCredential(selection, action, options = this.#options) {
+        this.#selectedSession(await this.#read(options), selection);
+        await this.reconcile('next-command', options);
+        const { name, profile, session } = this.#selectedSession(await this.#read(options), selection);
+        const token = await this.#readToken(session.token, options);
+        if (token === null) {
+            throw new CliError('cli.credentials_invalid');
+        }
+        return action({
+            account: {
+                kind: 'cli-token',
+                origin: session.origin,
+                profile: name,
+                tokenId: session.tokenId,
+                organizationId: session.organization.id,
+            },
+            defaultWorkspace: profile.defaultWorkspace,
+            token,
+        });
+    }
+    async logout(input, options = this.#options) {
+        const removed = await this.#transaction(options, async (transaction) => {
+            const { state } = transaction;
+            const name = input.profiles === 'all'
+                ? null
+                : this.#selectedProfile(input.profiles, state);
+            const selected = input.profiles === 'all'
+                ? state.profiles
+                : state.profiles.filter((profile) => profile.name === name);
+            const names = [];
+            const revocations = [];
+            for (const profile of selected) {
+                if (profile.session !== null) {
+                    names.push(profile.name);
+                    revocations.push(`revoke:${profile.session.origin}:${profile.session.tokenId}`);
+                    this.#queueRevocation(state, profile.session);
+                    this.programKeys.retireSession(state, profile.session);
+                }
+                profile.session = null;
+                profile.defaultWorkspace = null;
+                profile.generation += 1;
+                for (const attempt of state.attempts.filter((item) => item.profile === profile.name)) {
+                    this.#retireAttempt(state, attempt.id);
+                }
+                if (state.defaultProfile === profile.name) {
+                    state.defaultProfile = null;
+                }
+            }
+            await transaction.save();
+            await this.#cleanup(transaction);
+            return { names, revocations };
+        });
+        const report = await this.reconcile('logout', options);
+        const pendingJobs = (await this.#read(options)).revocations;
+        const pending = pendingJobs.map((job) => job.tokenId);
+        if (pendingJobs.some((job) => removed.revocations.includes(job.id))) {
+            throw new CliError('cli.logout_pending', {
+                details: {
+                    profiles: removed.names,
+                    pendingRevocations: pending,
+                    unconfirmedRevocations: report.unconfirmed,
+                    environmentCredentialUnchanged: this.#io.host.environment.STATEMACHINES_API_KEY !== undefined,
+                },
+            });
+        }
+        return {
+            profiles: removed.names,
+            pendingRevocations: pending,
+            unconfirmedRevocations: report.unconfirmed,
+            environmentCredentialUnchanged: this.#io.host.environment.STATEMACHINES_API_KEY !== undefined,
+        };
+    }
+    async #claim(input, options) {
+        return this.#transaction(options, async (transaction) => {
+            const { state } = transaction;
+            let profile = state.profiles.find((item) => item.name === input.profile);
+            if (profile === undefined) {
+                profile = {
+                    name: input.profile,
+                    generation: 0,
+                    session: null,
+                    defaultWorkspace: null,
+                };
+                state.profiles.push(profile);
+            }
+            const pending = state.attempts.find((item) => item.profile === input.profile);
+            if (pending !== undefined) {
+                if (pending.owner !== null) {
+                    const dead = pending.owner.hostname === this.#io.host.owner.hostname &&
+                        (await this.#io.child.liveness(pending.owner, options)) === 'dead';
+                    if (!dead) {
+                        throw new CliError('cli.login_busy', pending.login === null
+                            ? {
+                                next: [
+                                    {
+                                        command: 'statemachines logout --profile <profile> --yes',
+                                        reason: `Cancel the unfinished login for ${input.profile}. This also signs out any existing session in that profile.`,
+                                    },
+                                ],
+                            }
+                            : {});
+                    }
+                }
+                if (input.mode === 'resume' &&
+                    pending.secret !== null &&
+                    pending.login !== null) {
+                    if (pending.origin !== input.origin) {
+                        throw new CliError('cli.origin_mismatch');
+                    }
+                    pending.owner = { ...this.#io.host.owner, nonce: this.#nonce };
+                    await transaction.save();
+                    return pending;
+                }
+                if (pending.owner === null && pending.secret !== null) {
+                    throw new CliError('cli.login_busy', {
+                        next: [
+                            {
+                                command: 'statemachines login --profile <profile> --resume',
+                                reason: `Continue the saved login for ${input.profile}.`,
+                            },
+                        ],
+                    });
+                }
+                this.#retireAttempt(state, pending.id);
+            }
+            if (input.mode === 'resume') {
+                throw new CliError('cli.profile_not_found');
+            }
+            const attempt = {
+                id: this.#id(),
+                profile: input.profile,
+                generation: profile.generation,
+                origin: input.origin,
+                owner: { ...this.#io.host.owner, nonce: this.#nonce },
+                login: null,
+                secret: null,
+                createdAt: new Date(this.#io.now()).toISOString(),
+            };
+            state.attempts.push(attempt);
+            await transaction.save();
+            return attempt;
+        });
+    }
+    async *login(request, options = this.#options) {
+        await this.reconcile('login', options);
+        const initial = await this.#read(options);
+        const profileName = this.#selectedProfile(request.profile, initial) ??
+            profileNameSchema.parse('default');
+        const saved = initial.profiles.find((profile) => profile.name === profileName);
+        const pending = initial.attempts.find((attempt) => attempt.profile === profileName);
+        const configuredOrigin = this.#io.host.environment.STATEMACHINES_BASE_URL;
+        const origin = request.origin ??
+            apiOriginFromEnvironment(configuredOrigin) ??
+            (request.mode === 'resume' ? pending?.origin : saved?.session?.origin) ??
+            apiOriginSchema.parse('https://api.usestatemachines.com');
+        const input = {
+            ...request,
+            profile: profileName,
+            origin,
+        };
+        const attempt = await this.#claim(input, options);
+        let payload;
+        let completed = false;
+        try {
+            const snapshot = await this.#read(options);
+            const profile = snapshot.profiles.find((item) => item.name === input.profile);
+            if (profile?.session !== undefined &&
+                profile.session !== null &&
+                !input.replace &&
+                input.mode !== 'resume') {
+                if (!input.interactive) {
+                    throw new CliError('cli.input_required', {
+                        message: copy.replacementRequired,
+                        next: [
+                            {
+                                command: 'statemachines login --profile <profile> --yes',
+                                reason: 'Replace the saved session for this profile.',
+                            },
+                        ],
+                    });
+                }
+                if (!(await this.#io.prompt.confirm(copy.replace, options))) {
+                    throw new CliError('cli.cancelled');
+                }
+            }
+            if (profile?.session !== undefined && profile.session !== null) {
+                await this.#readToken(profile.session.token, options);
+            }
+            const selectedStore = attempt.secret?.store ?? this.#store.select();
+            if (input.mode === 'resume') {
+                if (attempt.secret === null) {
+                    throw new CliError('cli.credentials_invalid');
+                }
+                const stored = await this.#store.get(attempt.secret, options);
+                if (stored === null) {
+                    throw new CliError('cli.credentials_invalid');
+                }
+                payload = readPendingPayload(stored, attempt);
+            }
+            else {
+                const keys = createLoginKey(this.#io);
+                const started = await this.#clients.anonymous(input.origin).start({
+                    publicKey: keys.publicKey,
+                    cliVersion: this.#version,
+                    hostname: this.#io.host.owner.hostname.slice(0, 64),
+                    platform: this.#io.host.platform,
+                }, options);
+                attempt.login = {
+                    loginId: loginIdSchema.parse(started.loginId),
+                    userCode: started.userCode,
+                    verificationUrl: started.verificationUrl,
+                    expiresAt: new Date(this.#io.now() + started.expiresIn * 1000).toISOString(),
+                    interval: started.interval,
+                };
+                payload = {
+                    version: 1,
+                    loginId: attempt.login.loginId,
+                    origin: attempt.origin,
+                    expiresAt: attempt.login.expiresAt,
+                    interval: attempt.login.interval,
+                    deviceCode: started.deviceCode,
+                    privateKey: keys.privateKey,
+                };
+                await this.#transaction(options, async ({ state, save }) => {
+                    const current = state.attempts.find((item) => item.id === attempt.id);
+                    if (current === undefined ||
+                        current.generation !== attempt.generation) {
+                        throw new CliError('cli.profile_changed');
+                    }
+                    current.login = attempt.login;
+                    await save();
+                });
+            }
+            const login = attempt.login;
+            if (login === null) {
+                throw new CliError('cli.config_invalid');
+            }
+            if (input.mode === 'no-wait') {
+                await this.#transaction(options, async (transaction) => {
+                    const current = transaction.state.attempts.find((item) => item.id === attempt.id);
+                    if (current === undefined) {
+                        throw new CliError('cli.profile_changed');
+                    }
+                    const intent = {
+                        kind: 'pending',
+                        id: `pending:${attempt.id}`,
+                        attemptId: attempt.id,
+                        token: this.#store.reference(selectedStore, input.origin, `pending:${attempt.id}`),
+                    };
+                    transaction.state.intents.push(intent);
+                    await transaction.save();
+                    const serialized = JSON.stringify(payload);
+                    await this.#write(transaction, intent, serialized);
+                    if ((await this.#store.get(intent.token, options)) !== serialized) {
+                        throw new CliError('cli.credentials_invalid');
+                    }
+                    current.secret = intent.token;
+                    current.owner = null;
+                    transaction.state.intents = transaction.state.intents.filter((item) => item.id !== intent.id);
+                    await transaction.save();
+                });
+                completed = true;
+                yield {
+                    kind: 'result',
+                    value: {
+                        status: 'awaiting-approval',
+                        profile: input.profile,
+                        loginId: login.loginId,
+                        userCode: login.userCode,
+                        verificationUrl: login.verificationUrl,
+                        expiresAt: login.expiresAt,
+                        userActionRequired: true,
+                    },
+                };
+                return;
+            }
+            yield {
+                kind: 'progress',
+                value: {
+                    status: 'waiting',
+                    userCode: login.userCode,
+                    verificationUrl: login.verificationUrl,
+                    expiresAt: login.expiresAt,
+                },
+            };
+            if (input.browser && input.interactive) {
+                await this.#io.openBrowser(login.verificationUrl, options);
+            }
+            let interval = login.interval;
+            while (true) {
+                this.#check(options);
+                if (this.#io.now() >= Date.parse(login.expiresAt)) {
+                    throw new ApiError({
+                        status: 400,
+                        code: 'expired_token',
+                        message: copy.expired,
+                        requestId: null,
+                        details: null,
+                    });
+                }
+                await this.#io.sleep(Math.min(interval * 1000, Date.parse(login.expiresAt) - this.#io.now()), options);
+                if (this.#io.now() >= Date.parse(login.expiresAt)) {
+                    continue;
+                }
+                const response = await this.#clients
+                    .anonymous(input.origin)
+                    .poll(payload.deviceCode, options);
+                this.#check(options);
+                if (response.kind !== 'approved') {
+                    if (response.kind === 'pending' || response.kind === 'slow-down') {
+                        interval = Math.max(interval, response.interval);
+                        continue;
+                    }
+                    throw new ApiError({
+                        status: 400,
+                        code: response.kind === 'denied' ? 'access_denied' : 'expired_token',
+                        message: response.kind === 'denied' ? copy.denied : copy.expired,
+                        requestId: null,
+                        details: null,
+                    });
+                }
+                const token = unsealLoginToken({
+                    envelope: response.envelope,
+                    privateKey: payload.privateKey,
+                    loginId: login.loginId,
+                });
+                const candidate = {
+                    origin: input.origin,
+                    organization: {
+                        id: organizationIdSchema.parse(response.organization.id),
+                        name: response.organization.name,
+                    },
+                    email: response.user.email,
+                    tokenId: tokenIdSchema.parse(response.tokenId),
+                    token: this.#store.reference(selectedStore, input.origin, `token:${attempt.id}`),
+                    idleExpiresAt: response.idleExpiresAt,
+                    expiresAt: response.expiresAt,
+                    runKeys: [],
+                };
+                const installed = await this.#transaction(options, async (transaction) => {
+                    const intent = {
+                        kind: 'install',
+                        id: `install:${attempt.id}`,
+                        attemptId: attempt.id,
+                        profile: input.profile,
+                        generation: attempt.generation,
+                        loginId: login.loginId,
+                        candidate,
+                    };
+                    transaction.state.intents.push(intent);
+                    await transaction.save();
+                    await this.#write(transaction, candidate, token);
+                    if ((await this.#store.get(candidate.token, options)) !== token) {
+                        throw new CliError('cli.credentials_invalid');
+                    }
+                    const valid = await this.#finishInstall(transaction, intent);
+                    await this.#cleanup(transaction);
+                    return valid;
+                });
+                completed = true;
+                await this.reconcile('login', options);
+                if (!installed) {
+                    throw new CliError('cli.profile_changed');
+                }
+                const workspace = await this.#clients
+                    .defaultWorkspace(input.origin, token, {
+                    signal: options.signal,
+                    deadline: Math.min(this.#io.now() + 5_000, options.deadline ?? Infinity),
+                })
+                    .catch(() => null);
+                this.#check(options);
+                if (workspace !== null) {
+                    await this.#transaction(options, async ({ state, save }) => {
+                        const current = state.profiles.find((item) => item.name === input.profile);
+                        if (current?.session?.tokenId === candidate.tokenId) {
+                            current.defaultWorkspace = workspace;
+                            await save();
+                        }
+                    });
+                }
+                yield {
+                    kind: 'result',
+                    value: {
+                        status: 'signed-in',
+                        profile: input.profile,
+                        organization: candidate.organization,
+                        email: candidate.email,
+                        idleExpiresAt: candidate.idleExpiresAt,
+                        expiresAt: candidate.expiresAt,
+                        userActionRequired: false,
+                    },
+                };
+                return;
+            }
+        }
+        finally {
+            if (!completed &&
+                !options.signal.aborted &&
+                (options.deadline === null || options.deadline > this.#io.now())) {
+                await this.#transaction(options, async (transaction) => {
+                    const { state, save } = transaction;
+                    const current = state.attempts.find((item) => item.id === attempt.id && item.owner?.nonce === this.#nonce);
+                    if (current !== undefined) {
+                        if (current.secret === null) {
+                            this.#retireAttempt(state, current.id);
+                        }
+                        else {
+                            current.owner = null;
+                        }
+                        await save();
+                    }
+                    await this.#recover(transaction);
+                }, false);
+            }
+        }
+    }
+}
+export function createAccounts(input) {
+    const owner = new AccountOwner(input);
+    return {
+        accounts: owner,
+        authentication: owner,
+        programKeys: owner.programKeys,
+    };
+}