@vibe-commit/capture 0.4.5 → 0.6.0

package/dist/commands/device_credential.js

@@ -0,0 +1,275 @@
+/**
+ * The device sign-in beat — `CR-234d`, D219, plan item 7 (capture half), T8/T9.
+ *
+ * `browserCredential`'s sibling for a machine whose browser is not on this machine: it asks for a code,
+ * shows it, polls while the person approves elsewhere, spends the resulting mint ticket on ONE credential,
+ * and hands the credential to the SAME `finishMint` the loopback flow ends in.
+ *
+ * ```
+ *   discover → POST device_authorization → print URL + code (always) → [open the prefilled link]
+ *     → poll /oauth/token  ─ pending / slow_down ─┐
+ *                          ├ denied | expired | rate-limited → a §13.6 block, nothing changed
+ *                          └ ticket → mint (Bearer vcmt_) → finishMint({ confirm: "always", ticket })
+ * ```
+ *
+ * ## ⛔ What the shared tail guarantees, and why the device flow is the case it exists for
+ *
+ * In the loopback flow the approver IS the person at this terminal. Here they are not — the code may have
+ * been typed by someone a phishing script sent it to (the reverse attack, RFC 8628 §5.4). So the CLI's own
+ * confirmation (`account / workspace`, one default-NO question) is the control, and `confirm: "always"`
+ * means it is never skipped: not by an unanswered probe, not by a missing handle. The ticket response's
+ * `account` and `org_name` stand in when whoami(new) is not answered, and if there is nothing to show at
+ * all `finishMint` FAILS CLOSED (A4 §3).
+ *
+ * ## ⚠ Nothing here writes `session.json`
+ *
+ * A ticket buys a machine credential, not a read session (D219). The read lane is still `--sign-in`.
+ *
+ * ## ⚠ The wait is STATIC
+ *
+ * No spinner and no ticking countdown (DESIGN.md §13.8): the waiting line is printed once, and the expiry is
+ * an absolute local time so the screen stays true in a scrollback. The poll loop's clock and sleep are
+ * injected — a test advances a virtual clock rather than waiting out five-second intervals.
+ */
+import { hostname as osHostname } from "node:os";
+import { connectDeviceCommandFor } from "../install.js";
+import { AUTH, DEVICE, SIGNIN } from "../copy/index.js";
+import { discover } from "../oauth/discovery.js";
+import { DEFAULT_INTERVAL_S, pollDeviceToken, SLOW_DOWN_STEP_S, startDeviceAuthorization, } from "../oauth/device.js";
+import { machineLabel, mintUrl, requestMint } from "../oauth/mint.js";
+import { HTTP_TIMEOUT_MS, openBrowser as platformOpenBrowser } from "../oauth/signin.js";
+import { paint, renderErrorBlock, wrap } from "../term.js";
+import { finishMint } from "./finish_mint.js";
+import { writeLines } from "./context.js";
+/** Poll failures in a row (a deploy, a blip) before the wait gives up on the service. */
+const MAX_TRANSIENT = 3;
+/** 429s in a row on the poll before it is reported as a rate limit. */
+const MAX_LIMITED = 5;
+/** Slack past `expires_in` before the CLIENT calls the code expired; the server's own `expired_token` normally lands first. */
+const DEADLINE_GRACE_S = 15;
+/** `14:32`, local time, 24-hour — an absolute clock reading, never "in 5 minutes". */
+export function clockTime(date) {
+    const two = (n) => String(n).padStart(2, "0");
+    return `${two(date.getHours())}:${two(date.getMinutes())}`;
+}
+/** The real SIGINT wait: resolves on the first Ctrl+C, and `dispose` puts the default behaviour back. */
+function sigintOnce() {
+    let handler = null;
+    const promise = new Promise((resolve) => {
+        handler = () => resolve();
+        process.once("SIGINT", handler);
+    });
+    return {
+        promise,
+        dispose: () => {
+            if (handler !== null)
+                process.removeListener("SIGINT", handler);
+        },
+    };
+}
+const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function errorBlock(ctx, what, why, fixLabel, fixes) {
+    return renderErrorBlock({
+        kind: "bad",
+        what,
+        why: [why],
+        ...(fixLabel === undefined || fixes === undefined ? {} : { fixLabel, fixes }),
+    }, ctx.colour);
+}
+/** The static waiting block (plan decision 4A): URL accent, code strong, the rest muted. */
+function waitingBlock(ctx, grant) {
+    const expiresAt = new Date(ctx.now().getTime() + grant.expiresInS * 1000);
+    const muted = (text) => wrap(text, 2).map((line) => paint(ctx.colour, "muted", line));
+    return [
+        "",
+        ...muted(DEVICE.heading),
+        "",
+        `    ${paint(ctx.colour, "accent", grant.verificationUri)}`,
+        `    ${DEVICE.codeLabel}  ${paint(ctx.colour, "strong", grant.userCode)}`,
+        "",
+        ...muted(DEVICE.expires(clockTime(expiresAt))),
+        ...muted(DEVICE.shareWarning),
+        "",
+        paint(ctx.colour, "muted", `  ${DEVICE.waiting}`),
+    ];
+}
+export async function deviceCredential(ctx, input, deps = {}) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const rerun = connectDeviceCommandFor(ctx.env, ctx.selfPath);
+    const discovery = await discover(input.endpoint, { fetch: fetchImpl, timeoutMs: HTTP_TIMEOUT_MS });
+    if (discovery.kind !== "ok") {
+        writeLines(ctx.stderr, [
+            "",
+            ...errorBlock(ctx, SIGNIN.noServerWhat, discovery.kind === "unreachable" ? SIGNIN.noServerUnreachableWhy : SIGNIN.noServerMalformedWhy, DEVICE.retryFix, [rerun]),
+        ]);
+        return { kind: "failed" };
+    }
+    const { device_authorization_endpoint, token_endpoint } = discovery.metadata;
+    if (device_authorization_endpoint === undefined) {
+        writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.unsupportedWhat, DEVICE.unsupportedWhy)]);
+        return { kind: "failed" };
+    }
+    const label = machineLabel((deps.hostname ?? osHostname)());
+    const http = { fetch: fetchImpl, timeoutMs: HTTP_TIMEOUT_MS };
+    const started = await startDeviceAuthorization(device_authorization_endpoint, {
+        machineLabel: label,
+        // 15A: the org the replaced credential belongs to, only on a 200 — a HINT the approver can change.
+        ...(input.prior?.who.kind === "ok" ? { orgId: input.prior.who.orgId } : {}),
+    }, http);
+    switch (started.kind) {
+        case "ok":
+            break;
+        case "rate-limited":
+            writeLines(ctx.stderr, ["", ...rateLimitedBlock(ctx, started.retryAfterS, rerun)]);
+            return { kind: "declined" };
+        case "refused":
+            writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.refusedWhat, DEVICE.refusedWhy, DEVICE.retryFix, [rerun])]);
+            return { kind: "failed" };
+        case "unreachable":
+            writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.unreachableWhat, DEVICE.unreachableWhy, DEVICE.retryFix, [rerun])]);
+            return { kind: "failed" };
+        case "malformed":
+            writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.malformedWhat, DEVICE.malformedWhy, DEVICE.retryFix, [rerun])]);
+            return { kind: "failed" };
+    }
+    const grant = started.grant;
+    // Printed ALWAYS — whether or not a browser opens (RFC 8628 §3.3.1) — and BEFORE the open, so a
+    // browser that steals focus cannot leave the person with nothing to type.
+    writeLines(ctx.stdout, waitingBlock(ctx, grant));
+    if (input.openLink)
+        (deps.openBrowser ?? platformOpenBrowser)(grant.verificationUriComplete);
+    const polled = await waitForApproval(ctx, grant, token_endpoint, http, deps);
+    if (polled.kind !== "ticket") {
+        switch (polled.kind) {
+            case "cancelled":
+                writeLines(ctx.stdout, ["", paint(ctx.colour, "muted", `  ${DEVICE.cancelled}`)]);
+                return { kind: "declined" };
+            case "denied":
+                writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.deniedWhat, DEVICE.deniedWhy, DEVICE.deniedFix, [rerun])]);
+                return { kind: "declined" };
+            case "code-signin-off":
+                writeLines(ctx.stderr, ["", ...gateOffBlock(ctx, rerun)]);
+                return { kind: "declined" };
+            case "expired":
+                writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.expiredWhat, DEVICE.expiredWhy, DEVICE.expiredFix, [rerun])]);
+                return { kind: "declined" };
+            case "rate-limited":
+                writeLines(ctx.stderr, ["", ...rateLimitedBlock(ctx, polled.retryAfterS, rerun)]);
+                return { kind: "declined" };
+            case "invalid":
+                writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.invalidWhat, DEVICE.invalidWhy, DEVICE.retryFix, [rerun])]);
+                return { kind: "failed" };
+            case "unreachable":
+                writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.unreachableWhat, DEVICE.unreachableWhy, DEVICE.retryFix, [rerun])]);
+                return { kind: "failed" };
+            case "malformed":
+                writeLines(ctx.stderr, ["", ...errorBlock(ctx, DEVICE.malformedWhat, DEVICE.malformedWhy, DEVICE.retryFix, [rerun])]);
+                return { kind: "failed" };
+        }
+    }
+    // Approved. Spend the ticket on ONE credential.
+    writeLines(ctx.stdout, ["", ...wrap(AUTH.minting(label), 2)]);
+    const minted = await requestMint(mintUrl(input.endpoint), polled.ticket, label, {
+        fetch: fetchImpl,
+        timeoutMs: HTTP_TIMEOUT_MS,
+    });
+    if (minted.kind === "refused" && minted.error === "code_signin_off") {
+        writeLines(ctx.stderr, ["", ...gateOffBlock(ctx, rerun)]);
+        return { kind: "declined" };
+    }
+    if (minted.kind !== "ok") {
+        writeLines(ctx.stderr, [
+            "",
+            ...errorBlock(ctx, AUTH.mintFailedWhat, minted.kind === "unreachable"
+                ? AUTH.mintUnreachableWhy
+                : minted.kind === "refused" && minted.error === "rate_limited"
+                    ? AUTH.mintRateLimitedWhy
+                    : minted.kind === "malformed"
+                        ? AUTH.mintMalformedWhy
+                        : DEVICE.redeemFailedWhy, DEVICE.retryFix, [rerun]),
+        ]);
+        return { kind: "failed" };
+    }
+    return await finishMint(ctx, {
+        minted: minted.credential,
+        facts: minted.facts,
+        prior: input.prior,
+        endpoint: input.endpoint,
+        fetch: fetchImpl,
+        // The approver is not necessarily the person at this terminal: the question is never skipped (A4 §3).
+        confirm: "always",
+        ticket: { account: polled.account, orgName: polled.orgName },
+        rerun,
+    });
+}
+function gateOffBlock(ctx, rerun) {
+    return errorBlock(ctx, DEVICE.gateOffWhat, DEVICE.gateOffWhy, DEVICE.gateOffFix, [rerun]);
+}
+function rateLimitedBlock(ctx, retryAfterS, rerun) {
+    const fixLabel = retryAfterS === null
+        ? DEVICE.rateLimitedFixUnknown
+        : DEVICE.rateLimitedFix(clockTime(new Date(ctx.now().getTime() + retryAfterS * 1000)));
+    return errorBlock(ctx, DEVICE.rateLimitedWhat, DEVICE.rateLimitedWhy, fixLabel, [rerun]);
+}
+/**
+ * RFC 8628 §3.5's loop. The interval is the server's, `slow_down` raises it for good, and every poll is
+ * raced against Ctrl+C — a Ctrl+C during a ten-second request must not wait for the request.
+ */
+async function waitForApproval(ctx, grant, tokenEndpoint, http, deps) {
+    const sleep = deps.sleep ?? realSleep;
+    const interrupt = (deps.interrupt ?? sigintOnce)();
+    const CANCEL = Symbol("cancel");
+    const cancelled = interrupt.promise.then(() => CANCEL);
+    const startMs = ctx.now().getTime();
+    const deadlineMs = startMs + (grant.expiresInS + DEADLINE_GRACE_S) * 1000;
+    let intervalS = grant.intervalS > 0 ? grant.intervalS : DEFAULT_INTERVAL_S;
+    let transient = 0;
+    let limited = 0;
+    try {
+        for (;;) {
+            if ((await Promise.race([sleep(intervalS * 1000).then(() => null), cancelled])) === CANCEL) {
+                return { kind: "cancelled" };
+            }
+            if (ctx.now().getTime() > deadlineMs)
+                return { kind: "expired" };
+            const polled = await Promise.race([pollDeviceToken(tokenEndpoint, grant.deviceCode, http), cancelled]);
+            if (polled === CANCEL)
+                return { kind: "cancelled" };
+            switch (polled.kind) {
+                case "ticket":
+                    return polled;
+                case "pending":
+                    transient = 0;
+                    limited = 0;
+                    break;
+                case "slow-down":
+                    transient = 0;
+                    intervalS += SLOW_DOWN_STEP_S;
+                    break;
+                case "denied":
+                case "code-signin-off":
+                case "expired":
+                case "invalid":
+                case "malformed":
+                    return polled;
+                case "rate-limited":
+                    // The poll endpoint's own limiter. Back off like `slow_down`, and only report it when it persists.
+                    limited += 1;
+                    if (limited >= MAX_LIMITED)
+                        return polled;
+                    intervalS += SLOW_DOWN_STEP_S;
+                    break;
+                case "server-error":
+                case "unreachable":
+                    transient += 1;
+                    if (transient >= MAX_TRANSIENT)
+                        return { kind: "unreachable" };
+                    break;
+            }
+        }
+    }
+    finally {
+        interrupt.dispose();
+    }
+}
+//# sourceMappingURL=device_credential.js.map

package/dist/commands/device_credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device_credential.js","sourceRoot":"","sources":["../../src/commands/device_credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,GAGzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAsC,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAE/D,yFAAyF;AACzF,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,uEAAuE;AACvE,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,+HAA+H;AAC/H,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU;IACjB,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAWnG,SAAS,UAAU,CACjB,GAAmB,EACnB,IAAY,EACZ,GAAW,EACX,QAAiB,EACjB,KAAyB;IAEzB,OAAO,gBAAgB,CACrB;QACE,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,GAAG,EAAE,CAAC,GAAG,CAAC;QACV,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;KAC9E,EACD,GAAG,CAAC,MAAM,CACX,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,GAAmB,EAAE,KAAkB;IAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,EAAE;QACF,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACxB,EAAE;QACF,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE;QAC3D,OAAO,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QACzE,EAAE;QACF,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAC7B,EAAE;QACF,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAmB,EACnB,KAAkB,EAClB,OAAoB,EAAE;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACnG,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,UAAU,CACX,GAAG,EACH,MAAM,CAAC,YAAY,EACnB,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAC9F,MAAM,CAAC,QAAQ,EACf,CAAC,KAAK,CAAC,CACR;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,EAAE,6BAA6B,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC7E,IAAI,6BAA6B,KAAK,SAAS,EAAE,CAAC;QAChD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,6BAA6B,EAC7B;QACE,YAAY,EAAE,KAAK;QACnB,mGAAmG;QACnG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,EACD,IAAI,CACL,CAAC;IAEF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,IAAI;YACP,MAAM;QACR,KAAK,cAAc;YACjB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,aAAa;YAChB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1H,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,WAAW;YACd,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,gGAAgG;IAChG,0EAA0E;IAC1E,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ;QAAE,CAAC,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,WAAW;gBACd,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,KAAK,QAAQ;gBACX,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,KAAK,iBAAiB;gBACpB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,KAAK,SAAS;gBACZ,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,KAAK,cAAc;gBACjB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,KAAK,SAAS;gBACZ,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,KAAK,aAAa;gBAChB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1H,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,KAAK,WAAW;gBACd,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAC9E,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QACpE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,UAAU,CACX,GAAG,EACH,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,IAAI,KAAK,aAAa;gBAC3B,CAAC,CAAC,IAAI,CAAC,kBAAkB;gBACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc;oBAC5D,CAAC,CAAC,IAAI,CAAC,kBAAkB;oBACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;wBAC3B,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvB,CAAC,CAAC,MAAM,CAAC,eAAe,EAC9B,MAAM,CAAC,QAAQ,EACf,CAAC,KAAK,CAAC,CACR;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,SAAS;QAChB,sGAAsG;QACtG,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QAC5D,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,KAAa;IACtD,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB,EAAE,WAA0B,EAAE,KAAa;IACtF,MAAM,QAAQ,GACZ,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,MAAM,CAAC,qBAAqB;QAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3F,CAAC;AAaD;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAmB,EACnB,KAAkB,EAClB,aAAqB,EACrB,IAAkE,EAClE,IAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,EAAE,CAAC;IACnD,MAAM,MAAM,GAAkB,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,SAAS,GAA2B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAAC;IAE1E,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC3F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACvG,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAEpD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,QAAQ;oBACX,OAAO,MAAM,CAAC;gBAChB,KAAK,SAAS;oBACZ,SAAS,GAAG,CAAC,CAAC;oBACd,OAAO,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,KAAK,WAAW;oBACd,SAAS,GAAG,CAAC,CAAC;oBACd,SAAS,IAAI,gBAAgB,CAAC;oBAC9B,MAAM;gBACR,KAAK,QAAQ,CAAC;gBACd,KAAK,iBAAiB,CAAC;gBACvB,KAAK,SAAS,CAAC;gBACf,KAAK,SAAS,CAAC;gBACf,KAAK,WAAW;oBACd,OAAO,MAAM,CAAC;gBAChB,KAAK,cAAc;oBACjB,mGAAmG;oBACnG,OAAO,IAAI,CAAC,CAAC;oBACb,IAAI,OAAO,IAAI,WAAW;wBAAE,OAAO,MAAM,CAAC;oBAC1C,SAAS,IAAI,gBAAgB,CAAC;oBAC9B,MAAM;gBACR,KAAK,cAAc,CAAC;gBACpB,KAAK,aAAa;oBAChB,SAAS,IAAI,CAAC,CAAC;oBACf,IAAI,SAAS,IAAI,aAAa;wBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;oBAC/D,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/commands/finish_mint.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Everything between "the server minted a credential" and "this machine has it" — `finishMint` — and the
+ * result type both browser beats return. Shared by the loopback flow (`browser_credential.ts`) and the
+ * device flow (`device_credential.ts`, `CR-234d`), and living in neither so that the two can import it
+ * without importing each other.
+ */
+import { type IngestCredential } from "../credential.js";
+import type { MintFacts } from "../oauth/mint.js";
+import type { Whoami } from "../oauth/whoami.js";
+import { type CommandContext } from "./context.js";
+export type BrowserCredential = 
+/**
+ * Minted AND written to `credentials.json`. The caller confirms it on screen, and appends `notes`
+ * (the retire outcome, the env-shadow warning — one sentence each) to that block's `why`, so the
+ * block's own fix line stays the last thing printed.
+ */
+{
+    readonly kind: "saved";
+    readonly credential: IngestCredential;
+    readonly notes?: readonly string[];
+}
+/** Nothing was written. The reason is already on stderr; the caller offers the paste. */
+ | {
+    readonly kind: "failed";
+}
+/**
+ * The person said NO — at the replace confirmation, or by denying, cancelling or letting a device code
+ * lapse (`CR-234d`). Nothing was saved, the reason is already on screen, and no paste is offered: the
+ * answer was an answer, not a fault.
+ */
+ | {
+    readonly kind: "declined";
+};
+/** The credential being replaced, and what the server said about it before sign-in. */
+export interface Prior {
+    readonly credential: IngestCredential;
+    readonly who: Whoami;
+}
+export interface FinishMintInput {
+    readonly minted: IngestCredential;
+    readonly facts: MintFacts;
+    readonly prior: Prior | null;
+    /** The `/mcp` endpoint, whose origin hosts the retire route. */
+    readonly endpoint: string;
+    readonly fetch: typeof fetch;
+    readonly confirm: "on-replace" | "always";
+    /**
+     * The device flow's ticket response, for the confirmation when whoami(new) is not answered (A4 §3).
+     * `orgName` null means there is nothing to show, and `confirm: "always"` then fails closed.
+     */
+    readonly ticket?: {
+        readonly account: string | null;
+        readonly orgName: string | null;
+    };
+    /** The command a fail-closed refusal tells the user to run again. Default: this install's `auth`. */
+    readonly rerun?: string;
+}
+/**
+ * Everything between "the server minted a credential" and "this machine has it" — shared by the
+ * loopback flow now and the device flow in slice 2 (eng review D1 = B, the smaller arrangement).
+ *
+ *   1. probe the NEW credential (whoami) — a credential the server then refuses is never saved
+ *   2. the confirmation block, when it is called for — ONE question, default NO
+ *   3. N: save nothing, leave the old file byte-identical (see `REPLACE.declinedOrphan`)
+ *   4. y: atomic save → sidecar → retire the old credential
+ *
+ * ⛔ THE ORDER IS THE SAFETY. Retire is last because a retired old credential plus a failed save would
+ * leave the machine with nothing; it is attempted only when the old one came from the FILE (a null
+ * `prior` is every env case), only when the old one is not already known dead, and never when the
+ * two credentials are known to be in different workspaces ("re-auth across orgs retires nothing and
+ * says so").
+ */
+export declare function finishMint(ctx: CommandContext, input: FinishMintInput): Promise<BrowserCredential>;

package/dist/commands/finish_mint.js

@@ -0,0 +1,140 @@
+/**
+ * Everything between "the server minted a credential" and "this machine has it" — `finishMint` — and the
+ * result type both browser beats return. Shared by the loopback flow (`browser_credential.ts`) and the
+ * device flow (`device_credential.ts`, `CR-234d`), and living in neither so that the two can import it
+ * without importing each other.
+ */
+import { isAffirmative } from "../consent.js";
+import { authCommandFor } from "../install.js";
+import { CONNECT, REPLACE, RETIRE, AUTH } from "../copy/index.js";
+import { loadedFingerprints, recordCredentialMeta } from "../credential_meta.js";
+import { saveCredential } from "../credential.js";
+import { retireCredential, selfRevokeCredential } from "../oauth/retire.js";
+import { credentialFingerprint } from "../post.js";
+import { paint, labelled, renderErrorBlock, truncateMiddle, wrap, WRAP_COLUMNS, LABEL_GUTTER } from "../term.js";
+import { writeLines } from "./context.js";
+import { probeCredential } from "./probe.js";
+/**
+ * Everything between "the server minted a credential" and "this machine has it" — shared by the
+ * loopback flow now and the device flow in slice 2 (eng review D1 = B, the smaller arrangement).
+ *
+ *   1. probe the NEW credential (whoami) — a credential the server then refuses is never saved
+ *   2. the confirmation block, when it is called for — ONE question, default NO
+ *   3. N: save nothing, leave the old file byte-identical (see `REPLACE.declinedOrphan`)
+ *   4. y: atomic save → sidecar → retire the old credential
+ *
+ * ⛔ THE ORDER IS THE SAFETY. Retire is last because a retired old credential plus a failed save would
+ * leave the machine with nothing; it is attempted only when the old one came from the FILE (a null
+ * `prior` is every env case), only when the old one is not already known dead, and never when the
+ * two credentials are known to be in different workspaces ("re-auth across orgs retires nothing and
+ * says so").
+ */
+export async function finishMint(ctx, input) {
+    const { minted, facts, prior } = input;
+    const fresh = await probeCredential(ctx, minted, input.fetch, { record: false });
+    if (fresh.kind === "unauthorized") {
+        writeLines(ctx.stderr, ["", ...renderErrorBlock({ kind: "bad", what: AUTH.mintFailedWhat, why: [AUTH.mintUnconfirmedWhy] }, ctx.colour)]);
+        return { kind: "failed" };
+    }
+    const priorOk = prior !== null && prior.who.kind === "ok";
+    const crossOrg = priorOk && fresh.kind === "ok" && prior.who.orgId !== fresh.orgId;
+    // ⛔ NEVER SAVE WITHOUT THE QUESTION BECAUSE A PROBE FAILED (A4 §3). "A re-auth never silently moves
+    // capture between orgs" and the confirmation is the reverse-attack control, so an unanswered probe
+    // of the NEW credential cannot be a way past it:
+    //   - on-replace, the old credential was confirmed but the new one was not: the workspace match
+    //     cannot be shown, so ask — without naming a workspace;
+    //   - always (the device flow): never save unasked. Show the ticket's own account/workspace when the
+    //     probe failed; if there is none of that either, FAIL CLOSED.
+    // No prior (or an env credential) means nothing to move from, so an unanswered probe still saves.
+    const unconfirmed = fresh.kind !== "ok";
+    const askUnnamed = input.confirm === "on-replace" && priorOk && unconfirmed;
+    const shown = fresh.kind === "ok"
+        ? { account: fresh.account, orgName: fresh.orgName }
+        : input.confirm === "always"
+            ? { account: input.ticket?.account ?? null, orgName: input.ticket?.orgName ?? null }
+            : { account: facts.account, orgName: null };
+    if (input.confirm === "always" && unconfirmed && shown?.orgName == null) {
+        const revoked = await selfRevokeCredential(input.endpoint, minted, { fetch: input.fetch });
+        writeLines(ctx.stderr, [
+            "",
+            ...renderErrorBlock({
+                kind: "bad",
+                what: REPLACE.unconfirmableWhat,
+                why: [revoked.kind === "retired" ? REPLACE.unconfirmableWhyRevoked : REPLACE.unconfirmableWhyOrphan],
+                fixLabel: REPLACE.unconfirmableFix,
+                fixes: [input.rerun ?? authCommandFor(ctx.env, ctx.selfPath)],
+            }, ctx.colour),
+        ]);
+        return { kind: "failed" };
+    }
+    if (crossOrg || askUnnamed || input.confirm === "always") {
+        // Values are text this package does not control (a workspace name, a handle): cut each in the
+        // MIDDLE to what the gutter leaves, so no row passes 80 columns (§13.4).
+        const room = WRAP_COLUMNS - 2 - LABEL_GUTTER;
+        const orgName = shown?.orgName ?? null;
+        writeLines(ctx.stdout, [
+            "",
+            labelled(2, REPLACE.accountLabel, truncateMiddle(shown?.account == null ? REPLACE.accountUnavailable : `@${shown.account}`, room)),
+            labelled(2, REPLACE.workspaceLabel, truncateMiddle(orgName ?? REPLACE.workspaceUnconfirmed, room)),
+            ...(crossOrg && prior?.who.kind === "ok"
+                ? [labelled(2, REPLACE.replacesLabel, truncateMiddle(REPLACE.replacesValue(prior.who.orgName), room))]
+                : []),
+        ]);
+        // ⛔ A REJECTED QUESTION IS AN N (VQ F1). On a terminal, Ctrl+C at a `readline/promises` question does
+        // not raise SIGINT: the interface closes and the promise REJECTS with an AbortError. Left to escape,
+        // that skipped the self-revoke below and surfaced as an "unexpected error", leaving the credential
+        // just created LIVE and unused in the person's Settings. Any rejection means nobody said yes.
+        let answer;
+        try {
+            answer = await ctx.ask(`  ${orgName === null ? REPLACE.questionUnconfirmed : REPLACE.question(truncateMiddle(orgName, 30))} ${paint(ctx.colour, "muted", CONNECT.consentAnswers)} `);
+        }
+        catch {
+            answer = null;
+        }
+        if (answer === null || !isAffirmative(answer)) {
+            // N: nothing is saved, and the credential the server just created is unused.
+            // Revoke it with itself as the bearer (brief A3) — the two-token retire cannot, because the only
+            // credential this machine holds in that workspace is the one to remove. Anything but a clean
+            // "retired" leaves it live, and the sentence says where to remove it.
+            const revoked = await selfRevokeCredential(input.endpoint, minted, { fetch: input.fetch });
+            writeLines(ctx.stdout, [
+                "",
+                ...wrap(answer === null ? REPLACE.cancelled : REPLACE.declined, 2),
+                ...wrap(revoked.kind === "retired" ? REPLACE.declinedRevoked : REPLACE.declinedOrphan, 2),
+            ]);
+            return { kind: "declined" };
+        }
+    }
+    // y — or no question was called for.
+    saveCredential(ctx.home, minted);
+    recordCredentialMeta(ctx.home, credentialFingerprint(minted), {
+        expires_at: fresh.kind === "ok" ? fresh.expiresAt ?? facts.expiresAt : facts.expiresAt,
+        credential_id: fresh.kind === "ok" ? fresh.credentialId : facts.credentialId,
+        org_id: fresh.kind === "ok" ? fresh.orgId : null,
+        account: fresh.kind === "ok" ? fresh.account ?? facts.account : facts.account,
+        seen_at: ctx.now().toISOString(),
+    }, loadedFingerprints(ctx.home, ctx.env));
+    const notes = [];
+    const envToken = ctx.env.VIBECOMMIT_TOKEN;
+    if (envToken !== undefined && envToken.trim() !== "") {
+        // D206 §4: the variable still wins, and nothing was retired — `prior` is null for an env credential.
+        notes.push(RETIRE.envShadows);
+    }
+    if (prior !== null && prior.who.kind !== "unauthorized") {
+        if (crossOrg) {
+            notes.push(RETIRE.notRetired);
+        }
+        else {
+            const retired = await retireCredential(input.endpoint, minted, prior.credential, { fetch: input.fetch });
+            notes.push(retired.kind === "retired"
+                ? RETIRE.retired
+                : retired.kind === "not-retired"
+                    ? RETIRE.notRetired
+                    : retired.kind === "unknown"
+                        ? RETIRE.unknown
+                        : RETIRE.failed);
+        }
+    }
+    return { kind: "saved", credential: minted, notes };
+}
+//# sourceMappingURL=finish_mint.js.map

package/dist/commands/finish_mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finish_mint.js","sourceRoot":"","sources":["../../src/commands/finish_mint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACjH,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA0C7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAAsB;IAC1E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,UAAU,CACR,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAClH,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;IAEnF,oGAAoG;IACpG,mGAAmG;IACnG,iDAAiD;IACjD,gGAAgG;IAChG,4DAA4D;IAC5D,qGAAqG;IACrG,kEAAkE;IAClE,kGAAkG;IAClG,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,IAAI,WAAW,CAAC;IAC5E,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QACpD,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE;YACpF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAElD,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,IAAI,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,gBAAgB,CACjB;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,OAAO,CAAC,iBAAiB;gBAC/B,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBACpG,QAAQ,EAAE,OAAO,CAAC,gBAAgB;gBAClC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;aAC9D,EACD,GAAG,CAAC,MAAM,CACX;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzD,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,IAAI,GAAG,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YAClI,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClG,GAAG,CAAC,QAAQ,IAAI,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI;gBACtC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,8FAA8F;QAC9F,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CACpB,KAAK,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAC7J,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,6EAA6E;YAC7E,iGAAiG;YACjG,6FAA6F;YAC7F,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3F,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,EAAE;gBACF,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAClE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;aAC1F,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAClB,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,MAAM,CAAC,EAC7B;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QACtF,aAAa,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY;QAC5E,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAChD,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;QAC7E,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KACjC,EACD,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CACtC,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,qGAAqG;QACrG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzG,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;oBAC9B,CAAC,CAAC,MAAM,CAAC,UAAU;oBACnB,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;wBAC1B,CAAC,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,MAAM,CAAC,MAAM,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC"}

package/dist/commands/probe.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Ask the server whether a credential is still accepted, and remember what it said — `R12`, `R10`.
+ *
+ * One function for `connect` (the gate before its send) and `browser_credential` (the old credential
+ * before sign-in, the new one before it is saved). A 200 also refreshes the sidecar: the whoami 200
+ * handler is one of its three writers, and it is how a pasted or `VIBECOMMIT_TOKEN` credential, which
+ * was never minted here, comes to have an `expires_at` the client can say "expired" from.
+ */
+import type { IngestCredential } from "../credential.js";
+import { type Whoami } from "../oauth/whoami.js";
+import type { CommandContext } from "./context.js";
+export declare function probeCredential(ctx: CommandContext, credential: IngestCredential, fetchImpl?: typeof fetch, options?: {
+    readonly record?: boolean;
+}): Promise<Whoami>;

package/dist/commands/probe.js

@@ -0,0 +1,29 @@
+/**
+ * Ask the server whether a credential is still accepted, and remember what it said — `R12`, `R10`.
+ *
+ * One function for `connect` (the gate before its send) and `browser_credential` (the old credential
+ * before sign-in, the new one before it is saved). A 200 also refreshes the sidecar: the whoami 200
+ * handler is one of its three writers, and it is how a pasted or `VIBECOMMIT_TOKEN` credential, which
+ * was never minted here, comes to have an `expires_at` the client can say "expired" from.
+ */
+import { loadedFingerprints, recordCredentialMeta } from "../credential_meta.js";
+import { whoami } from "../oauth/whoami.js";
+import { credentialFingerprint, ingestUrl } from "../post.js";
+export async function probeCredential(ctx, credential, fetchImpl = fetch, options = {}) {
+    const url = ingestUrl(ctx.env);
+    // An override we refuse to send to is not a server that answered.
+    if (url === null)
+        return { kind: "unavailable" };
+    const result = await whoami(url, credential, { fetch: fetchImpl });
+    if (result.kind === "ok" && options.record !== false) {
+        recordCredentialMeta(ctx.home, credentialFingerprint(credential), {
+            expires_at: result.expiresAt,
+            credential_id: result.credentialId,
+            org_id: result.orgId,
+            account: result.account,
+            seen_at: ctx.now().toISOString(),
+        }, loadedFingerprints(ctx.home, ctx.env));
+    }
+    return result;
+}
+//# sourceMappingURL=probe.js.map

package/dist/commands/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/commands/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,MAAM,EAAe,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAmB,EACnB,UAA4B,EAC5B,YAA0B,KAAK,EAC/B,UAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,kEAAkE;IAClE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAClB,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,UAAU,CAAC,EACjC;YACE,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACjC,EACD,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}