@vigilbase/cli 0.1.2 → 0.1.4

package/SECURITY.md

@@ -0,0 +1,134 @@
+# Security command reference
+
+All commands start with `vigilbase security`. Sign in with `vigilbase login` first. Commands use the configured One origin and its authenticated `/api/flarehawk` boundary. One independently checks permissions and maps the current organization to its security tenant. Internal operators can supply `--customer-id <One customer UUID>` for validated View-as access; this never supplies an upstream organization identity.
+
+Every operation below is **GET/read-only**, except `incidents update`, which is **PATCH/write** and requires `--confirm` plus server service-write permission. Reads require server service-read permission. No command directly accesses the retained service, runs archived chat, changes remediation authority, or approves provider effects.
+
+Append `--json` for the complete validated wire envelope, including evidence, total counts, pagination cursors, warnings, and unavailable states. Text output preserves full resource IDs, sanitizes terminal control characters, and displays nested results. `--timeout <milliseconds>` controls request timeout; analytical queries can need `--timeout 120000`.
+
+All endpoint paths in the tables are relative to `/api/flarehawk`. `<id>`, `<asset>`, `<connection>`, and `<job>` are UUIDs copied from the relevant inventories. Unsupported filters and extra positional arguments are rejected. `get` aliases `show` on incidents, connections, reports, and alerts; `ls` aliases `list` on incidents, connections, and reports.
+
+## Incidents, signals, logs, and evidence
+
+| Grammar after `security` | Flags | Endpoint |
+|---|---|---|
+| `[overview]` | None | `/dashboard/overview` |
+| `incidents [list]` | `--limit`, `--offset`, `--status`, `--severity`, `--attack-category`, `--order-by`, `--order-direction` | `/incidents` |
+| `incidents show <id>` | None | `/incidents/<id>` |
+| `incidents timeline <id>` | `--limit`, `--before` | `/incidents/<id>/timeline` |
+| `incidents fabric <id>` | `--dataset`, `--min-weight`, `--limit` | `/incidents/<id>/fabric` |
+| `incidents share-links <id>` | None | `/incidents/<id>/share-links` |
+| `incidents update <id> <status> --confirm` | `--note` | **PATCH** `/incidents/<id>`; JSON body `{status,note?}` |
+| `alerts [list]` | `--limit`, `--asset-id`, `--start` | `/alerts`; `start` maps to `since` |
+| `alerts show <id>` | None | `/alerts/<id>` |
+| `logs` | `--limit`, `--asset-id`, `--provider`, `--dataset`, `--search`, `--start`, `--end`, `--sort`, `--frs-min`, `--cursor` | `/logs` |
+| `audit` | `--limit`, `--cursor`, `--action-prefix`, `--outcome` | `/vigilbase-one/audit-events` |
+
+Incident list statuses: `open`, `active`, `acknowledged`, `investigating`, `mitigating`, `mitigated`, `resolved`, `false_positive`. Update statuses: `acknowledged`, `mitigating`, `resolved`, `false_positive`. Severity: `critical`, `high`, `medium`, `low`. Ordering: `last_alert_at`, `first_alert_at`, `created_at`, `severity_rank`, `combined_score`, `alert_count`; direction: `asc` or `desc`. Hyphenated filter names map to snake_case on the wire. Incident updates report a `feedback_sync_error` warning when status changed but signal feedback synchronization failed; confirmation does not bypass server authorization.
+
+Logs require `--start` and `--end` together as ISO timestamps with an explicit timezone; start must precede end. They map to `start_time` and `end_time`. Sort: `ts`, `frs`, or `frs_desc`; FRS minimum: integer 0–100. Other hyphenated filter names map to snake_case. Audit outcome: `success`, `failure`, or `denied`; `--action-prefix` maps to `action_prefix`. Alerts accept a single ISO `--start` timestamp as the lower bound.
+
+## Assets, providers, and connection health
+
+| Grammar after `security` | Flags | Endpoint |
+|---|---|---|
+| `assets` | None | `/domains` |
+| `assets allowlist <asset>` | None | `/domains/<asset>/allowlist` |
+| `assets blocklist <asset>` | None | `/domains/<asset>/blocklist` |
+| `assets remediation <asset>` | None | `/assets/<asset>/remediation-settings` |
+| `assets autonomy <asset>` | None | `/assets/<asset>/vigil-autonomy` |
+| `assets datasets <asset>` | None | `/fabric/assets/<asset>/datasets` |
+| `assets graph <asset>` | `--dataset`, `--hours`, `--min-weight`, `--limit` | `/fabric/assets/<asset>/graph` |
+| `fabric default-asset` | None | `/fabric/default-asset` |
+| `detections` | `--asset-id` | `/detections?asset_id=…` when scoped |
+| `providers` | None | `/providers?connectable=false` |
+| `connections [list]` | None | `/connections` |
+| `connections show <connection>` | None | `/connections/<connection>` |
+| `connections available-assets <connection>` | None | `/connections/<connection>/available-assets` |
+| `connections remediation <connection>` | None | `/connections/<connection>/remediation-settings` |
+| `connections logpush-status <connection> <job>` | None | `/connections/<connection>/logpush-jobs/<job>/status` |
+| `connections worker-stats <connection> <job>` | None | `/connections/<connection>/worker-routes/<job>/stats` |
+
+Graph `--hours` maps to `window_hours`; `--min-weight` maps to `min_weight`. Incident graphs use the incident window and reject `--hours`. IP lists retain enforcement verification and synchronization status. Connection health includes stored state, provider status, receipt health, and available warnings. Credential-bearing HEC profile retrieval is outside this command set.
+
+## Analytics and Cloudflare security
+
+The time-window flags **W** are `--hours`, `--start`, `--end`, and `--asset-id`. Default: 24 hours. `--hours` is an integer 1–720. An explicit ISO `--start`/`--end` pair replaces `--hours`; these forms cannot be combined. `--asset-id` narrows the authenticated tenant's data. Wire keys are `hours`, `start`, `end`, and `asset_id`.
+
+| Grammar after `security` | Flags | Endpoint |
+|---|---|---|
+| `analytics [overview]` | W, `--metrics` | `/analytics` |
+| `analytics security-analysis` | W | `/analytics/security-analysis` |
+| `analytics bot-activity` | W | `/analytics/bot-activity` |
+| `analytics top-attacker-ips` | W | `/analytics/top-attacker-ips` |
+| `analytics bot-asns` | W | `/analytics/bot-asns` |
+| `analytics dns-security` | W | `/analytics/dns-security` |
+| `analytics page-shield` | W | `/analytics/page-shield` |
+| `analytics provider-events` | Required `--provider`, `--dataset`, `--start`, `--end`; optional `--asset-id`, `--search`, `--limit` | `/analytics/provider-events` |
+| `zero-trust device-health` | W | `/zero-trust/device-health` |
+| `zero-trust app-tests` | W | `/zero-trust/app-tests` |
+| `zero-trust gateway <dns\|http\|network>` | W | `/zero-trust/gateway?surface=…` |
+| `zero-trust access` | W | `/zero-trust/access` |
+| `zero-trust sessions` | W | `/zero-trust/sessions` |
+| `zero-trust device-posture` | W | `/zero-trust/device-posture` |
+| `cloudflare-account [inventory]` | None | `/cloudflare-account/inventory` |
+| `cloudflare-account audit` | W | `/cloudflare-account/audit` |
+| `cloudflare-account ingestion` | W | `/cloudflare-account/ingestion` |
+| `cloudflare-account posture` | W | `/cloudflare-account/posture` |
+
+Analytics metrics are a comma-separated selection of `summary`, `hourly`, `by_domain`, `by_dataset`, `response_status`, `waf_scores`, `alerts`, `geographic`, `top_paths`, `waf_rules`, and `performance`. Default: `hourly,by_domain,by_dataset`.
+
+Provider events map `--provider` to `provider_id`, `--dataset` to `dataset_id`, and `--asset-id` to `asset_ids`; start/end retain their names. Search is limited to 200 characters. Provider/dataset response identity and Gateway surface identity must match the request. `unavailable` results stay explicitly unavailable rather than implying healthy empty data.
+
+## Notifications, reports, intelligence, and personal settings
+
+| Grammar after `security` | Flags | Endpoint |
+|---|---|---|
+| `notifications [list]` | `--limit` | `/notifications` |
+| `notifications settings` | None | `/notifications/settings` |
+| `notifications preferences` | None | `/notifications/preferences` |
+| `notifications slack-channels` | None | `/notifications/slack/channels` |
+| `reports [list]` | `--limit`, `--offset` | `/reports` |
+| `reports show <id>` | None | `/reports/<id>` |
+| `reports settings` | None | `/reports/settings` |
+| `intel quota` | None | `/intel/quota` |
+| `intel <ip\|asn\|cidr\|ja3\|ja4> <query>` | None | `/intel/lookup?q=…&type=…` |
+| `settings lifecycle-emails` | None | `/settings/lifecycle-emails` |
+| `settings broadcast-emails` | None | `/settings/broadcast-emails` |
+| `settings applications` | None | `/integrations/grants` |
+
+Intel lookup input is trimmed and limited to 512 characters; the server validates the indicator and applies lookup quota. Personal settings show existing preferences and authorized application grants. They do not change preferences or revoke grants. Reports are fetched on demand; this CLI does not persist report or billing records.
+
+## Limits and pagination
+
+These are CLI validation bounds; the service can impose stricter limits.
+
+| Operation | Default `--limit` | Allowed range | Continuation |
+|---|---:|---:|---|
+| Incidents list | 50 | 1–100 | `--offset`; `has_more`, `filters_applied` preserved |
+| Timeline | 100 | 1–200 | `--before` using `next_cursor` |
+| Logs | 100 | 1–1000 | `--cursor` using `nextCursor` |
+| Audit | 50 | 1–100 | `--cursor` using `next_cursor` |
+| Reports list | 50 | 1–100 | `--offset` |
+| Alerts list | 100 | 1–100 | Bounded list; use `--start` and `--asset-id` to narrow |
+| Notifications list | 100 | 1–100 | Bounded list |
+| Provider events | 200 | 1–500 | Bounded sample; aggregates remain server-provided |
+| Asset/incident graph | 200 | 1–1000 | Bounded graph |
+
+Offsets are integers 0–1,000,000 and are omitted unless supplied. Graph minimum weight defaults to 1 and accepts integers 1–1,000,000. Graph hours default to 24 and accept 1–720. No command auto-fetches unbounded pages.
+
+Examples:
+
+```bash
+vigilbase security incidents --status open --severity high
+vigilbase security incidents timeline <incident-uuid> --before '<cursor>'
+vigilbase security incidents update <incident-uuid> acknowledged --note 'Review started' --confirm
+vigilbase security assets graph <asset-uuid> --dataset http_requests --hours 24 --json
+vigilbase security analytics security-analysis --asset-id <asset-uuid> --hours 48
+vigilbase security zero-trust gateway dns --hours 24 --json
+vigilbase security cloudflare-account posture --customer-id <one-customer-uuid>
+vigilbase security connections logpush-status <connection-uuid> <job-uuid>
+vigilbase security intel ip 1.1.1.1
+```
+
+The API contract sources are One's `flarehawk/policy.ts`, `flarehawk-ui/client.ts`, `flarehawk-ui/normalizers.ts`, specialized analytics request/normalizer modules, personal-controls schemas, and incident-share schemas. Binary log downloads and routes without a verified JSON consumer are not exposed. The standalone `scripts/fixtures/security.mjs` catalog covers every named wire operation for compiled CLI end-to-end verification.

package/dist/auth/device-auth.d.ts

@@ -41,7 +41,7 @@ export type PollResult = {
     error: DeviceTokenPendingError;
 };
 export declare function pollDeviceToken(config: CliConfig, deviceCode: string): Promise<PollResult>;
-export declare function sleep(ms: number): Promise<void>;
+export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
 /**
  * Run the full device-code poll loop until authorized, denied, or expired.
  * Returns the token payload on success.

package/dist/auth/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAOnB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ7D;AAkDD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,uBAAuB,CAAA;CAC/B,CAAA;AAEL,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAoErB;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;KAC9B,KAAK,IAAI,CAAA;IACV,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,GACA,OAAO,CAAC,kBAAkB,CAAC,CAiF7B"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAOnB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ7D;AAkCD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgC7B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,uBAAuB,CAAA;CAC/B,CAAA;AAEL,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CA2ErB;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3E;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;KAC9B,KAAK,IAAI,CAAA;IACV,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,GACA,OAAO,CAAC,kBAAkB,CAAC,CAkF7B"}

package/dist/auth/device-auth.js

@@ -1,13 +1,6 @@
-/**
- * Better Auth device authorization (RFC 8628) client for Vigilbase One.
- *
- * Server plugin: https://better-auth.com/docs/plugins/device-authorization
- * Endpoints (relative to One's Better Auth base, typically `/api/auth`):
- *   POST /device/code
- *   POST /device/token
- *
- * Public tool commands do not use this module. One-scoped commands will.
- */
+import { z } from 'zod';
+import { validateOneOrigin } from '../lib/config.js';
+import { NetworkError, parseJsonResponse, requestText } from '../lib/network.js';
 const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
 /** How many consecutive unreachable token polls before aborting a live login. */
 const MAX_CONSECUTIVE_TRANSIENT = 8;
@@ -24,7 +17,7 @@ export class DeviceAuthError extends Error {
     }
 }
 function authBase(config) {
-    return `${config.oneBaseUrl}/api/auth`;
+    return `${validateOneOrigin(config.oneBaseUrl)}/api/auth`;
 }
 function isRetryableTokenStatus(status) {
     return (status === 404 ||
@@ -35,34 +28,16 @@ function isRetryableTokenStatus(status) {
 }
 async function postJson(config, path, body) {
     const url = `${authBase(config)}${path}`;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
-    try {
-        const response = await fetch(url, {
-            method: 'POST',
-            signal: controller.signal,
-            headers: {
-                Accept: 'application/json',
-                'Content-Type': 'application/json',
-                'User-Agent': config.userAgent,
-            },
-            body: JSON.stringify(body),
-        });
-        const text = await response.text();
-        let json = null;
-        if (text) {
-            try {
-                json = JSON.parse(text);
-            }
-            catch {
-                json = { raw: text };
-            }
-        }
-        return { status: response.status, json };
-    }
-    finally {
-        clearTimeout(timer);
-    }
+    const { response, text } = await requestText(config, url, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+            'User-Agent': config.userAgent,
+        },
+        body: JSON.stringify(body),
+    });
+    return { status: response.status, json: parseJsonResponse(response, text) };
 }
 export async function requestDeviceCode(config, options) {
     const { status, json } = await postJson(config, '/device/code', {
@@ -71,29 +46,25 @@ export async function requestDeviceCode(config, options) {
     });
     if (status === 404) {
         throw new DeviceAuthError(`Device authorization is not enabled on ${config.oneBaseUrl} yet. ` +
-            'Enable Better Auth\'s deviceAuthorization plugin on Vigilbase One, then retry `vigilbase login`.', { status, body: json, code: 'not_enabled' });
+            'Enable Better Auth\'s deviceAuthorization plugin on Vigilbase One, then retry `vigilbase login`.', { status, code: 'not_enabled' });
     }
     if (status < 200 || status >= 300) {
-        const message = json &&
-            typeof json === 'object' &&
-            'message' in json &&
-            typeof json.message === 'string'
-            ? json.message
-            : `Device code request failed (HTTP ${status})`;
-        throw new DeviceAuthError(message, { status, body: json });
+        throw new DeviceAuthError(`Device code request failed (HTTP ${status})`, { status });
     }
-    const data = json;
-    if (!data.device_code || !data.user_code || !data.verification_uri) {
-        throw new DeviceAuthError('Device code response was missing required fields.', { status, body: json });
+    const result = z.object({
+        device_code: z.string().min(1),
+        user_code: z.string().min(1),
+        verification_uri: z.string().min(1),
+        verification_uri_complete: z.string().min(1).optional(),
+        expires_in: z.number().int().positive().max(86_400).default(600),
+        interval: z.number().int().positive().max(86_400).default(5),
+    }).safeParse(json);
+    if (!result.success) {
+        throw new DeviceAuthError('Device code response was missing required fields or contained invalid values.', {
+            status, code: 'invalid_response',
+        });
     }
-    return {
-        device_code: data.device_code,
-        user_code: data.user_code,
-        verification_uri: data.verification_uri,
-        verification_uri_complete: data.verification_uri_complete,
-        expires_in: data.expires_in ?? 600,
-        interval: data.interval ?? 5,
-    };
+    return result.data;
 }
 export async function pollDeviceToken(config, deviceCode) {
     let status;
@@ -107,6 +78,8 @@ export async function pollDeviceToken(config, deviceCode) {
         }));
     }
     catch (error) {
+        if (error instanceof NetworkError && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|UNABLE_TO_GET_ISSUER|INVALID_RESPONSE/.test(error.code))
+            throw error;
         const description = error instanceof Error ? error.message : 'Network error while polling';
         return {
             status: 'transient',
@@ -117,14 +90,24 @@ export async function pollDeviceToken(config, deviceCode) {
             },
         };
     }
-    if (json &&
-        typeof json === 'object' &&
-        'access_token' in json &&
-        typeof json.access_token === 'string') {
-        return { status: 'authorized', token: json };
+    const token = z.object({
+        access_token: z.string().trim().min(1),
+        token_type: z.string().optional(),
+        expires_in: z.number().int().positive().optional(),
+        refresh_token: z.string().optional(),
+        scope: z.string().optional(),
+    }).safeParse(json);
+    if (status >= 200 && status < 300 && token.success) {
+        return { status: 'authorized', token: token.data };
     }
-    const errorBody = (json ?? {});
-    const code = errorBody.error || `http_${status}`;
+    if (status >= 200 && status < 300) {
+        throw new DeviceAuthError('Invalid device token response.', { status, code: 'invalid_response' });
+    }
+    const parsedError = z.object({
+        error: z.string(), error_description: z.string().optional(),
+    }).safeParse(json);
+    const errorBody = parsedError.success ? parsedError.data : { error: `http_${status}` };
+    const code = errorBody.error;
     switch (code) {
         case 'authorization_pending':
         case 'slow_down':
@@ -150,12 +133,23 @@ export async function pollDeviceToken(config, deviceCode) {
             },
         };
     }
-    throw new DeviceAuthError(errorBody.error_description ||
-        errorBody.error ||
-        `Device token request failed (HTTP ${status})`, { status, body: json, code });
+    throw new DeviceAuthError(`Device token request failed (HTTP ${status})`, { status, code, body: errorBody });
 }
-export async function sleep(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
+export async function sleep(ms, signal) {
+    await new Promise((resolve, reject) => {
+        const cancel = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', cancel);
+            reject(new DeviceAuthError('Login cancelled.', { status: 0, code: 'cancelled' }));
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener('abort', cancel);
+            resolve();
+        }, ms);
+        signal?.addEventListener('abort', cancel, { once: true });
+        if (signal?.aborted)
+            cancel();
+    });
 }
 /**
  * Run the full device-code poll loop until authorized, denied, or expired.
@@ -181,7 +175,9 @@ export async function waitForDeviceAuthorization(config, device, options) {
             intervalSec,
             kind: consecutiveTransient > 0 ? 'transient' : 'pending',
         });
-        await sleep(intervalSec * 1000);
+        await sleep(Math.min(intervalSec * 1000, Math.max(0, deadline - Date.now())), options?.signal);
+        if (Date.now() >= deadline)
+            break;
         const result = await pollDeviceToken(config, device.device_code);
         switch (result.status) {
             case 'authorized':
@@ -200,7 +196,7 @@ export async function waitForDeviceAuthorization(config, device, options) {
                         (lastTransientStatus
                             ? ` (HTTP ${lastTransientStatus})`
                             : '') +
-                        '. Retry `vigilbase login` once One is healthy.', {
+                        `. ${result.error.error_description ?? 'Retry `vigilbase login` once One is healthy.'}`, {
                         status: lastTransientStatus,
                         code: 'unreachable',
                         body: result.error,

package/dist/auth/device-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,YAAY,GAAG,8CAA8C,CAAA;AAEnE,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IACb,MAAM,CAAQ;IACd,IAAI,CAAS;IAEtB,YACE,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,GAAG,MAAM,CAAC,UAAU,WAAW,CAAA;AACxC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,CACL,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,IAAI,GAAG,CACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAiB,EACjB,IAAY,EACZ,IAA6B;IAE7B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,MAAM,CAAC,SAAS;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,IAAI,GAAY,IAAI,CAAA;QACxB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CACvB,0CAA0C,MAAM,CAAC,UAAU,QAAQ;YACjE,kGAAkG,EACpG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAC5C,CAAA;IACH,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,OAAO,GACX,IAAI;YACJ,OAAO,IAAI,KAAK,QAAQ;YACxB,SAAS,IAAI,IAAI;YACjB,OAAQ,IAA6B,CAAC,OAAO,KAAK,QAAQ;YACxD,CAAC,CAAE,IAA4B,CAAC,OAAO;YACvC,CAAC,CAAC,oCAAoC,MAAM,GAAG,CAAA;QACnD,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,IAAmC,CAAA;IAChD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,mDAAmD,EACnD,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACvB,CAAA;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;KAC7B,CAAA;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,UAAkB;IAElB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;YAC3D,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,GACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAA;QACxE,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EAAE,WAAW;aAC/B;SACF,CAAA;IACH,CAAC;IAED,IACE,IAAI;QACJ,OAAO,IAAI,KAAK,QAAQ;QACxB,cAAc,IAAI,IAAI;QACtB,OAAQ,IAAkC,CAAC,YAAY,KAAK,QAAQ,EACpE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,IAA0B,EAAE,CAAA;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,IAAI,QAAQ,MAAM,EAAE,CAAA;IAEhD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD;YACE,MAAK;IACT,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EACf,SAAS,CAAC,iBAAiB;oBAC3B,SAAS,CAAC,KAAK;oBACf,sCAAsC,MAAM,GAAG;aAClD;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,iBAAiB;QACzB,SAAS,CAAC,KAAK;QACf,qCAAqC,MAAM,GAAG,EAChD,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAC7B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU;IACpC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiB,EACjB,MAA0B,EAC1B,OAQC;IAED,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;IACtD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAChB,OAAO,EAAE,uBAAuB,IAAI,yBAAyB,CAAA;IAC/D,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE;gBAC5C,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,CAAA;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO;YACP,WAAW;YACX,IAAI,EAAE,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAE/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QAChE,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,SAAS;gBACZ,oBAAoB,GAAG,CAAC,CAAA;gBACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACvC,WAAW,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oBAAoB,IAAI,CAAC,CAAA;gBACzB,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACvC,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,UAAU,6BAA6B;wBACzF,CAAC,mBAAmB;4BAClB,CAAC,CAAC,UAAU,mBAAmB,GAAG;4BAClC,CAAC,CAAC,EAAE,CAAC;wBACP,gDAAgD,EAClD;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,MAAM,CAAC,KAAK;qBACnB,CACF,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE;oBAC7D,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAA;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,eAAe,CACvB,uDAAuD,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAC3D,CAAA;YACH,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,MAAM,CAAA;gBACjC,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACxD;oBACE,MAAM,EAAE,CAAC;oBACT,IAAI,EAAE,YAAY;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,2EAA2E,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAC/B,CAAA;AACH,CAAC"}
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAmBhF,MAAM,YAAY,GAAG,8CAA8C,CAAA;AAEnE,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IACb,MAAM,CAAQ;IACd,IAAI,CAAS;IAEtB,YACE,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAA;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,CACL,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,IAAI,GAAG,CACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAiB,EACjB,IAAY,EACZ,IAA6B;IAE7B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,MAAM,CAAC,SAAS;SAC/B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CACvB,0CAA0C,MAAM,CAAC,UAAU,QAAQ;YACjE,kGAAkG,EACpG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,oCAAoC,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE;YACzG,MAAM,EAAE,IAAI,EAAE,kBAAkB;SACjC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,UAAkB;IAElB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;YAC3D,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,yEAAyE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAA;QAC5I,MAAM,WAAW,GACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAA;QACxE,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EAAE,WAAW;aAC/B;SACF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClB,MAAM,SAAS,GAA4B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAA;IAC/G,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAA;IAE5B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD;YACE,MAAK;IACT,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EACf,SAAS,CAAC,iBAAiB;oBAC3B,SAAS,CAAC,KAAK;oBACf,sCAAsC,MAAM,GAAG;aAClD;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,qCAAqC,MAAM,GAAG,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAClC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,eAAe,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QACnF,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,OAAO,EAAE,CAAA;QACX,CAAC,EAAE,EAAE,CAAC,CAAA;QACN,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,EAAE,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiB,EACjB,MAA0B,EAC1B,OAQC;IAED,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;IACtD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAChB,OAAO,EAAE,uBAAuB,IAAI,yBAAyB,CAAA;IAC/D,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE;gBAC5C,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,CAAA;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO;YACP,WAAW;YACX,IAAI,EAAE,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAK;QAEjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QAChE,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,SAAS;gBACZ,oBAAoB,GAAG,CAAC,CAAA;gBACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACvC,WAAW,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oBAAoB,IAAI,CAAC,CAAA;gBACzB,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACvC,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,UAAU,6BAA6B;wBACzF,CAAC,mBAAmB;4BAClB,CAAC,CAAC,UAAU,mBAAmB,GAAG;4BAClC,CAAC,CAAC,EAAE,CAAC;wBACP,KAAK,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,8CAA8C,EAAE,EACzF;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,MAAM,CAAC,KAAK;qBACnB,CACF,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE;oBAC7D,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAA;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,eAAe,CACvB,uDAAuD,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAC3D,CAAA;YACH,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,MAAM,CAAA;gBACjC,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACxD;oBACE,MAAM,EAAE,CAAC;oBACT,IAAI,EAAE,YAAY;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,2EAA2E,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAC/B,CAAA;AACH,CAAC"}

package/dist/auth/store.d.ts

@@ -1,12 +1,10 @@
 import type { CliConfig } from '../lib/config.js';
 import type { CredentialsFile, OneCredentials } from './types.js';
-/**
- * Resolve the credentials file path and reject path traversal outside configDir.
- * Filename is a fixed constant — only configDir varies (from env / XDG).
- */
+type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl'>>;
 export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
 export declare function readCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
-export declare function writeOneCredentials(config: Pick<CliConfig, 'configDir'>, one: OneCredentials): Promise<void>;
+export declare function writeOneCredentials(config: CredentialsConfig, one: OneCredentials): Promise<void>;
 export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
-export declare function getOneAccessToken(config: Pick<CliConfig, 'configDir'>): Promise<string | null>;
+export declare function getOneAccessToken(config: CredentialsConfig): Promise<string | null>;
+export {};
 //# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMjE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAQ5E;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EACpC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMjE,KAAK,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;AAQ9F,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAG5E;AA4DD,wBAAsB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAepG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBvG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKhG;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAczF"}