accelr8 3.8.2 → 4.0.0-next.1

package/dist/chunks/{app-SYLCS3QX.js → app-JMUXGMWK.js}

@@ -1,18 +1,22 @@
 #!/usr/bin/env node
 import {
-  detectVoiceTools,
   tzCity,
   tzToCoords
-} from "./chunk-HY6ULYGH.js";
+} from "./chunk-CUUNLVID.js";
+import {
+  detectVoiceTools
+} from "./chunk-UMPU6SAD.js";
 import {
   DEFAULT_SERVER,
   VERSION
-} from "./chunk-7JSMON7M.js";
+} from "./chunk-5QXGOLQ3.js";
+import {
+  accelr8Dir
+} from "./chunk-62O2F73J.js";
 
 // src/radio/app.ts
 import tk from "terminal-kit";
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { WebSocket } from "ws";
 
@@ -5348,12 +5352,18 @@ function renderOverlay(ctx, opts) {
 import { spawn as spawn2, spawnSync } from "node:child_process";
 var SR = 44100;
 var CH = 2;
-function nextAudioAction(sched, serverNowMs, mem, driftBudgetMs = 1500) {
+function nextAudioAction(sched, serverNowMs, mem, driftBudgetMs = 1500, stallMs = 4e3) {
   const pos = nowPlaying(sched, serverNowMs);
   if (!pos || !pos.item.url) return { kind: "none" };
-  if (pos.item.id !== mem.playingTrackId || !mem.procAlive) return { kind: "play", track: pos.item, offsetMs: pos.offsetMs };
+  const play = (reason) => ({ kind: "play", track: pos.item, offsetMs: pos.offsetMs, reason });
+  if (pos.item.id !== mem.playingTrackId) return play(mem.playingTrackId ? "track" : "start");
+  if (!mem.procAlive) return play("dead");
+  if (mem.lastDataAtServerMs !== void 0) {
+    const quietFor = serverNowMs - (mem.lastDataAtServerMs || mem.spawnedAtServerMs);
+    if (quietFor > (mem.lastDataAtServerMs ? stallMs : stallMs * 2)) return play("stall");
+  }
   const implied = mem.spawnedOffsetMs + (serverNowMs - mem.spawnedAtServerMs);
-  if (Math.abs(implied - pos.offsetMs) > driftBudgetMs) return { kind: "play", track: pos.item, offsetMs: pos.offsetMs };
+  if (Math.abs(implied - pos.offsetMs) > driftBudgetMs) return play("drift");
   return { kind: "none" };
 }
 function applyGain(buf, fromGain, target, rampPerSample = 1 / 1400) {
@@ -5370,6 +5380,7 @@ function applyGain(buf, fromGain, target, rampPerSample = 1 / 1400) {
 }
 function decoderArgs(url, offsetMs) {
   const args = ["-hide_banner", "-loglevel", "error", "-re"];
+  if (/^https?:/i.test(url)) args.push("-rw_timeout", "8000000");
   if (offsetMs > 0) args.push("-ss", (offsetMs / 1e3).toFixed(3));
   args.push("-i", url, "-f", "s16le", "-ar", String(SR), "-ac", String(CH), "-");
   return args;
@@ -5408,6 +5419,39 @@ function sinkArgs(ffplayPath) {
     "-"
   ];
 }
+function coreAudioSinkArgs(ffmpegPath) {
+  return [
+    "-hide_banner",
+    "-loglevel",
+    "error",
+    "-f",
+    "s16le",
+    "-ar",
+    String(SR),
+    ...ffplayStereoFlag(ffmpegPath),
+    "-i",
+    "-",
+    "-f",
+    "audiotoolbox",
+    "-"
+  ];
+}
+var coreAudioCache = null;
+function hasCoreAudioSink(ffmpegPath) {
+  if (coreAudioCache !== null) return coreAudioCache;
+  coreAudioCache = false;
+  if (process.platform !== "darwin") return false;
+  try {
+    const out = spawnSync(ffmpegPath, ["-hide_banner", "-devices"], { encoding: "utf8", timeout: 3e3 });
+    coreAudioCache = /\baudiotoolbox\b/.test((out.stdout || "") + (out.stderr || ""));
+  } catch {
+  }
+  return coreAudioCache;
+}
+function pickSink(ffmpegPath, ffplayPath, pref = "auto") {
+  const core = pref === "coreaudio" || pref === "auto" && hasCoreAudioSink(ffmpegPath);
+  return core ? { kind: "coreaudio", bin: ffmpegPath, args: coreAudioSinkArgs(ffmpegPath) } : { kind: "ffplay", bin: ffplayPath, args: sinkArgs(ffplayPath) };
+}
 var SyncedAudio = class {
   sink = null;
   decoder = null;
@@ -5419,12 +5463,50 @@ var SyncedAudio = class {
   target = 0.7;
   // desired volume (0..1)
   muted = false;
+  sinkKind = "";
+  lastFeedAt = 0;
+  // wall ms of the last write to the sink (music or silence)
+  written = 0;
+  // bytes into the current sink, to keep whole s16 stereo frames
+  keepalive = null;
   start(opts) {
     this.stop();
     this.opts = opts;
     this.startSink();
     this.tick();
     this.timer = setInterval(() => this.tick(), 1e3);
+    this.keepalive = setInterval(() => {
+      const quiet = Date.now() - this.lastFeedAt;
+      if (quiet > 60) this.feed(Buffer.alloc(Math.floor(Math.min(quiet, 250) * SR / 1e3) * CH * 2));
+    }, 40);
+  }
+  /** Every write to the sink goes through here. Pads to a whole 4-byte frame
+   *  first, so a decoder killed mid-frame can't shift the stream into noise. */
+  feed(buf) {
+    const sink = this.sink;
+    if (!sink || !sink.stdin || sink.stdin.destroyed) return true;
+    const pad = (4 - this.written % 4) % 4;
+    if (pad && buf.length) {
+      sink.stdin.write(Buffer.alloc(pad));
+      this.written += pad;
+    }
+    this.written += buf.length;
+    this.lastFeedAt = Date.now();
+    return sink.stdin.write(buf);
+  }
+  /** Open a fresh sink, so it binds to whatever output is current NOW (the TV
+   *  while screen sharing, the speakers after). The old one is dropped first
+   *  so its exit handler doesn't treat this as a crash. */
+  restartSink() {
+    const old = this.sink;
+    this.sink = null;
+    this.startSink();
+    if (old) {
+      try {
+        old.kill("SIGKILL");
+      } catch {
+      }
+    }
   }
   setSchedule(sched) {
     if (this.opts) this.opts.schedule = sched;
@@ -5453,8 +5535,14 @@ var SyncedAudio = class {
   }
   startSink() {
     if (!this.opts) return;
-    const sink = spawn2(this.opts.ffplayPath, sinkArgs(this.opts.ffplayPath), { stdio: ["pipe", "ignore", "pipe"] });
+    const env = process.env.ACCELR8_RADIO_SINK;
+    const pref = env === "ffplay" || env === "coreaudio" ? env : this.opts.sink ?? "auto";
+    const pick4 = pickSink(this.opts.ffmpegPath, this.opts.ffplayPath, pref);
+    this.opts.onSink?.(pick4.kind);
+    const sink = spawn2(pick4.bin, pick4.args, { stdio: ["pipe", "ignore", "pipe"] });
     this.sink = sink;
+    this.sinkKind = pick4.kind;
+    this.written = 0;
     sink.stdin?.on("error", () => {
     });
     sink.stdin?.on("drain", () => this.decoder?.stdout?.resume());
@@ -5476,22 +5564,24 @@ var SyncedAudio = class {
     if (!this.opts) return;
     if (!this.sink) this.startSink();
     const action = nextAudioAction(this.opts.schedule, this.opts.serverNow(), this.mem);
-    if (action.kind === "play") this.spawnDecoder(action.track, action.offsetMs);
+    if (action.kind === "play") {
+      if (action.reason !== "track") this.opts.onRespawn?.(action.reason, action.track, action.offsetMs);
+      if (action.reason === "track" && this.sinkKind === "coreaudio") this.restartSink();
+      this.spawnDecoder(action.track, action.offsetMs);
+    }
   }
   spawnDecoder(track, offsetMs) {
     if (!this.opts) return;
     this.killDecoder();
     const dec = spawn2(this.opts.ffmpegPath, decoderArgs(track.url, offsetMs), { stdio: ["ignore", "pipe", "ignore"] });
     this.decoder = dec;
-    this.mem = { playingTrackId: track.id, spawnedAtServerMs: this.opts.serverNow(), spawnedOffsetMs: offsetMs, procAlive: true };
+    this.mem = { playingTrackId: track.id, spawnedAtServerMs: this.opts.serverNow(), spawnedOffsetMs: offsetMs, procAlive: true, lastDataAtServerMs: 0 };
     this.opts.onTrack?.(track);
     dec.stdout?.on("data", (chunk) => {
       if (this.decoder !== dec) return;
+      if (this.opts) this.mem.lastDataAtServerMs = this.opts.serverNow();
       this.gain = applyGain(chunk, this.gain, this.effTarget());
-      const sink = this.sink;
-      if (!sink || !sink.stdin || sink.stdin.destroyed) return;
-      const ok = sink.stdin.write(chunk);
-      if (ok === false) dec.stdout?.pause();
+      if (this.feed(chunk) === false) dec.stdout?.pause();
     });
     dec.on("error", () => {
       if (this.decoder === dec) this.mem.procAlive = false;
@@ -5514,6 +5604,10 @@ var SyncedAudio = class {
       clearInterval(this.timer);
       this.timer = null;
     }
+    if (this.keepalive) {
+      clearInterval(this.keepalive);
+      this.keepalive = null;
+    }
     this.killDecoder();
     if (this.sink) {
       try {
@@ -5529,7 +5623,7 @@ var SyncedAudio = class {
 // src/radio/app.ts
 function rlog(msg) {
   try {
-    const dir = path.join(os.homedir(), ".accelr8");
+    const dir = accelr8Dir();
     fs.mkdirSync(dir, { recursive: true });
     fs.appendFileSync(path.join(dir, "radio.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
@@ -5550,6 +5644,7 @@ var frameH = 0;
 var renderTimer = null;
 var running = false;
 var startedAt = Date.now();
+var VISUAL_EPOCH = Date.UTC(2026, 0, 1);
 var skewMs = 0;
 var serverNow = () => Date.now() + skewMs;
 var W = () => Math.max(20, term.width || process.stdout.columns || 100);
@@ -5595,10 +5690,29 @@ function connectStation(opts) {
     return;
   }
   stationWs = ws;
+  let lastHeard = Date.now();
+  const beat = setInterval(() => {
+    if (ws.readyState !== WebSocket.OPEN) return;
+    if (Date.now() - lastHeard > 25e3) {
+      rlog("station socket silent 25s, reconnecting");
+      ws.terminate();
+      return;
+    }
+    try {
+      ws.ping();
+    } catch {
+    }
+  }, 1e4);
+  ws.on("pong", () => {
+    lastHeard = Date.now();
+  });
   ws.on("open", () => {
+    lastHeard = Date.now();
     ws.send(JSON.stringify({ t: "hello", id: me.id, name: me.name, tz: me.tz, color: me.color }));
+    if (youVoted && skipTrackId) ws.send(JSON.stringify({ t: "voteSkip", trackId: skipTrackId }));
   });
   ws.on("message", (raw) => {
+    lastHeard = Date.now();
     let m;
     try {
       m = JSON.parse(raw.toString());
@@ -5608,6 +5722,7 @@ function connectStation(opts) {
     if (m && m.t === "radioState") applyStation(m);
   });
   ws.on("close", () => {
+    clearInterval(beat);
     if (stationWs === ws) {
       state = { ...state, connected: false };
       scheduleReconnect(opts);
@@ -5615,7 +5730,7 @@ function connectStation(opts) {
   });
   ws.on("error", () => {
     try {
-      ws.close();
+      ws.terminate();
     } catch {
     }
   });
@@ -5638,8 +5753,14 @@ function applyStation(m) {
     skipVotes = m.skip.votes ?? 0;
     skipNeeded = m.skip.needed ?? 1;
     if (m.skip.trackId && m.skip.trackId !== skipTrackId) {
+      if (youVoted && skipTrackId) {
+        skipNote = "skipped \u2713";
+        skipNoteUntil = Date.now() + 4e3;
+      }
       skipTrackId = m.skip.trackId;
       youVoted = false;
+    } else if (Array.isArray(m.skip.voters) && Date.now() - lastToggleAt > 2e3) {
+      youVoted = m.skip.voters.includes(me.id);
     }
   }
 }
@@ -5668,7 +5789,14 @@ function startBackground(opts) {
   }
   if (tools.ffmpegPath && tools.ffplayPath) {
     audio = new SyncedAudio();
-    audio.start({ ffplayPath: tools.ffplayPath, ffmpegPath: tools.ffmpegPath, schedule: state.schedule, serverNow });
+    audio.start({
+      ffplayPath: tools.ffplayPath,
+      ffmpegPath: tools.ffmpegPath,
+      schedule: state.schedule,
+      serverNow,
+      onRespawn: (reason, track, offsetMs) => rlog(`audio respawn: ${reason} \xB7 ${track.id} @ ${(offsetMs / 1e3).toFixed(1)}s`),
+      onSink: (kind) => rlog(`audio sink: ${kind}`)
+    });
   }
 }
 function makeScreen() {
@@ -5694,9 +5822,18 @@ var skipVotes = 0;
 var skipNeeded = 1;
 var youVoted = false;
 var skipTrackId = "";
+var skipNote = "";
+var skipNoteUntil = 0;
+var lastToggleAt = 0;
 function toggleSkip() {
+  if (!stationWs || stationWs.readyState !== WebSocket.OPEN) {
+    skipNote = "offline, retrying";
+    skipNoteUntil = Date.now() + 3e3;
+    return;
+  }
   youVoted = !youVoted;
-  if (stationWs && stationWs.readyState === 1) stationWs.send(JSON.stringify({ t: youVoted ? "voteSkip" : "unvoteSkip" }));
+  lastToggleAt = Date.now();
+  stationWs.send(JSON.stringify({ t: youVoted ? "voteSkip" : "unvoteSkip", trackId: skipTrackId || void 0 }));
 }
 function drawControls() {
   const w = screen.width, y = 1;
@@ -5708,7 +5845,7 @@ function drawControls() {
   const vol = audio ? audio.isMuted ? "MUTED" : `vol ${audio.volume}%` : "no audio";
   put2(1, `\u266A ${vol}   [m] mute   [+/-] volume   [q] quit`);
   const met = skipVotes >= skipNeeded && skipVotes > 0;
-  const label = youVoted ? "[s] voted \u2713" : "[s] vote skip";
+  const label = Date.now() < skipNoteUntil ? `[s] ${skipNote}` : youVoted ? "[s] voted \u2713" : "[s] vote skip";
   const right = `${label}   skip ${skipVotes}/${skipNeeded} `;
   put2(w - right.length, right, met ? C_GOOD : 231, youVoted);
 }
@@ -5743,7 +5880,7 @@ var renderErrs = 0;
 function renderFrame() {
   if (!running) return;
   try {
-    const tMs = Date.now() - startedAt;
+    const tMs = serverNow() - VISUAL_EPOCH;
     if (visuals) {
       lastFrame = visuals.frame(tMs, screen.width, screen.height);
       frameW = screen.width;
@@ -5810,7 +5947,7 @@ function runRadio(opts) {
     const detail = err instanceof Error ? err.stack || err.message : String(err);
     rlog(`CRASH: ${detail}`);
     teardown();
-    console.error("\naccelr8 radio crashed:\n" + detail + "\n\nlog: " + path.join(os.homedir(), ".accelr8", "radio.log") + "\n(press any key to close)");
+    console.error("\naccelr8 radio crashed:\n" + detail + "\n\nlog: " + path.join(accelr8Dir(), "radio.log") + "\n(press any key to close)");
     try {
       process.stdin.setRawMode?.(true);
       process.stdin.resume();

package/dist/chunks/authclient-AUBBFWCI.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import {
+  AuthNetworkError,
+  approveSignIn,
+  approveUrl,
+  deviceLogin,
+  ensureSignedIn,
+  getAccessToken,
+  httpBase,
+  legacyProofs,
+  logout,
+  olderServerMessage,
+  pendingSignIn,
+  refreshCredentials,
+  whoami
+} from "./chunk-3OTVRBTJ.js";
+import "./chunk-FVC2UPMV.js";
+import "./chunk-5QXGOLQ3.js";
+import "./chunk-62O2F73J.js";
+export {
+  AuthNetworkError,
+  approveSignIn,
+  approveUrl,
+  deviceLogin,
+  ensureSignedIn,
+  getAccessToken,
+  httpBase,
+  legacyProofs,
+  logout,
+  olderServerMessage,
+  pendingSignIn,
+  refreshCredentials,
+  whoami
+};

package/dist/chunks/authpage-X2AKCMVH.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import {
+  DIFFERENT_NETWORK,
+  ago,
+  confirmPage,
+  deniedPage,
+  donePage,
+  enterCodePage,
+  esc,
+  platformName
+} from "./chunk-RZ4OBBLX.js";
+export {
+  DIFFERENT_NETWORK,
+  ago,
+  confirmPage,
+  deniedPage,
+  donePage,
+  enterCodePage,
+  esc,
+  platformName
+};

package/dist/chunks/chunk-3OTVRBTJ.js

@@ -0,0 +1,265 @@
+#!/usr/bin/env node
+import {
+  AuthLockTimeout,
+  credentialsKey,
+  deleteCredentials,
+  loadCredentials,
+  loadLegacyIdentity,
+  loadTokens,
+  saveCredentials,
+  withAuthLock
+} from "./chunk-FVC2UPMV.js";
+import {
+  PORT,
+  VERSION
+} from "./chunk-5QXGOLQ3.js";
+
+// src/authclient.ts
+import os from "node:os";
+import { createHash } from "node:crypto";
+var sha256hex = (s) => createHash("sha256").update(s).digest("hex");
+function legacyProofs(serverUrl, baseDir) {
+  const server = credentialsKey(serverUrl);
+  const out = [];
+  for (const [key, token] of Object.entries(loadTokens(baseDir))) {
+    const i = key.indexOf(":");
+    if (i <= 0 || !token) continue;
+    out.push({ projectId: key.slice(0, i), handle: key.slice(i + 1), proof: sha256hex(sha256hex(token) + "\n" + server) });
+    if (out.length >= 20) break;
+  }
+  return out;
+}
+var REFRESH_EARLY_MS = 6e4;
+function httpBase(serverUrl) {
+  const key = credentialsKey(serverUrl);
+  return key.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
+}
+function approveUrl(serverUrl) {
+  return httpBase(serverUrl) + "/approve";
+}
+var AuthNetworkError = class extends Error {
+};
+async function call(url, init = {}) {
+  let res;
+  try {
+    res = await fetch(url, {
+      method: init.method ?? (init.body === void 0 ? "GET" : "POST"),
+      headers: {
+        ...init.body === void 0 ? {} : { "content-type": "application/json" },
+        ...init.bearer ? { authorization: `Bearer ${init.bearer}` } : {}
+      },
+      body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (e) {
+    throw new AuthNetworkError(`could not reach ${new URL(url).origin}: ${e instanceof Error ? e.message : e}`);
+  }
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  return { status: res.status, data };
+}
+function toCredentials(serverUrl, r, now = Date.now()) {
+  return {
+    server: credentialsKey(serverUrl),
+    user: { id: r.user.id, name: r.user.name, color: r.user.color },
+    sessionId: r.sessionId,
+    accessToken: r.accessToken,
+    accessExpiresAt: now + r.accessExpiresIn * 1e3,
+    refreshToken: r.refreshToken,
+    refreshExpiresAt: now + r.refreshExpiresIn * 1e3,
+    signedInAt: now
+  };
+}
+var isTokens = (d) => !!d && typeof d.accessToken === "string" && typeof d.refreshToken === "string" && !!d.user;
+function defaultName() {
+  try {
+    return os.userInfo().username;
+  } catch {
+    return process.env.USER || "guest";
+  }
+}
+var OLDER_SERVER = /* @__PURE__ */ new Set([404, 405, 426]);
+function olderServerMessage(serverUrl) {
+  return [
+    `${credentialsKey(serverUrl)} runs an older accelr8 with no sign-in yet, so this version can't use it.`,
+    "To try this version, start your own server in another terminal:",
+    `    accelr8 serve --host 127.0.0.1`,
+    "then open accelr8 on it:",
+    `    accelr8 --server ws://127.0.0.1:${PORT}`
+  ].join("\n  ");
+}
+async function deviceLogin(serverUrl, opts = {}) {
+  const print = opts.print ?? ((l) => console.log(l));
+  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const base = httpBase(serverUrl);
+  const legacy = loadLegacyIdentity(opts.baseDir);
+  const startRes = await call(`${base}/auth/device`, {
+    body: {
+      machine: (opts.machine ?? os.hostname()).slice(0, 64),
+      platform: process.platform,
+      name: opts.name || legacy.name || defaultName(),
+      legacyId: legacy.id,
+      legacyName: legacy.name,
+      // old ids were public: the old projects come along only with proof
+      legacyProof: legacy.id ? legacyProofs(serverUrl, opts.baseDir) : void 0,
+      version: VERSION
+    }
+  });
+  if (startRes.status !== 200 || typeof startRes.data?.deviceCode !== "string") {
+    if (!startRes.data?.message && OLDER_SERVER.has(startRes.status)) throw new Error(olderServerMessage(serverUrl));
+    throw new Error(startRes.data?.message || `the server refused to start a sign-in (HTTP ${startRes.status})`);
+  }
+  const start = startRes.data;
+  print("");
+  print(`  To sign in, open this page in your browser:`);
+  print(`    ${approveUrl(serverUrl)}`);
+  print(`  and type this code:`);
+  print(`    ${start.userCode}`);
+  print("");
+  print(`  Waiting for you to approve it. The code expires in ${Math.round(start.expiresIn / 60)} minutes.`);
+  await opts.onCode?.(start);
+  let interval = Math.max(1, start.interval) * 1e3;
+  const deadline = Date.now() + start.expiresIn * 1e3;
+  for (; ; ) {
+    const r = await call(`${base}/auth/device/token`, { body: { deviceCode: start.deviceCode } });
+    if (r.status === 200 && isTokens(r.data)) {
+      const creds = toCredentials(serverUrl, r.data);
+      saveCredentials(creds, opts.baseDir);
+      return creds;
+    }
+    if (r.status === 200 && r.data?.pending) {
+    } else if (r.data?.error === "slow_down") interval += 5e3;
+    else throw new Error(r.data?.message || `sign-in failed (HTTP ${r.status})`);
+    if (Date.now() + interval > deadline) throw new Error("The code expired. Run accelr8 login again for a new one.");
+    await sleep(interval);
+  }
+}
+async function refreshCredentials(serverUrl, opts = {}) {
+  const before = loadCredentials(serverUrl, opts.baseDir);
+  try {
+    return await withAuthLock(async () => {
+      const creds = loadCredentials(serverUrl, opts.baseDir);
+      if (!creds) return null;
+      if (!opts.force && creds.accessExpiresAt - Date.now() > REFRESH_EARLY_MS) return creds;
+      if (opts.force && before && creds.refreshToken !== before.refreshToken) return creds;
+      const r = await call(`${httpBase(serverUrl)}/auth/refresh`, { body: { refreshToken: creds.refreshToken } });
+      if (r.status === 200 && isTokens(r.data)) {
+        const next = { ...toCredentials(serverUrl, r.data), signedInAt: creds.signedInAt };
+        saveCredentials(next, opts.baseDir);
+        return next;
+      }
+      if (r.data?.error === "invalid_grant") {
+        deleteCredentials(serverUrl, opts.baseDir, (saved) => saved.refreshToken === creds.refreshToken);
+        return null;
+      }
+      throw new AuthNetworkError(`refresh failed (HTTP ${r.status})`);
+    }, opts.baseDir, opts.lock);
+  } catch (e) {
+    if (!(e instanceof AuthLockTimeout)) throw e;
+    const now = loadCredentials(serverUrl, opts.baseDir);
+    if (now && (!before || now.refreshToken !== before.refreshToken)) return now;
+    throw new AuthNetworkError("another accelr8 process is refreshing this sign-in; trying again shortly");
+  }
+}
+async function getAccessToken(serverUrl, opts = {}) {
+  const creds = loadCredentials(serverUrl, opts.baseDir);
+  if (!creds) return null;
+  if (!opts.force && creds.accessExpiresAt - Date.now() > REFRESH_EARLY_MS) return { token: creds.accessToken, creds };
+  try {
+    const next = await refreshCredentials(serverUrl, opts);
+    return next ? { token: next.accessToken, creds: next } : null;
+  } catch (e) {
+    if (e instanceof AuthNetworkError) return { token: creds.accessToken, creds };
+    throw e;
+  }
+}
+async function logout(serverUrl, opts = {}) {
+  const creds = loadCredentials(serverUrl, opts.baseDir);
+  if (!creds) return { wasSignedIn: false, revoked: null };
+  let revoked = null;
+  try {
+    const r = await call(`${httpBase(serverUrl)}/auth/logout`, { body: { refreshToken: creds.refreshToken, all: opts.all === true }, bearer: creds.accessToken });
+    if (r.status === 200) revoked = Number(r.data?.revoked ?? 0);
+  } catch {
+  }
+  deleteCredentials(serverUrl, opts.baseDir);
+  return { wasSignedIn: true, user: creds.user, revoked };
+}
+async function whoami(serverUrl, opts = {}) {
+  const local = loadCredentials(serverUrl, opts.baseDir);
+  if (!local) return null;
+  let tok;
+  try {
+    tok = await getAccessToken(serverUrl, opts);
+  } catch {
+    tok = { token: local.accessToken, creds: local };
+  }
+  if (!tok) return null;
+  try {
+    let r = await call(`${httpBase(serverUrl)}/auth/me`, { bearer: tok.token });
+    if (r.status === 401) {
+      const again = await getAccessToken(serverUrl, { ...opts, force: true });
+      if (!again) return null;
+      tok = again;
+      r = await call(`${httpBase(serverUrl)}/auth/me`, { bearer: tok.token });
+    }
+    if (r.status === 200 && r.data?.user) {
+      const user = r.data.user;
+      if (user.name !== tok.creds.user.name || user.color !== tok.creds.user.color) {
+        saveCredentials({ ...tok.creds, user: { id: user.id, name: user.name, color: user.color } }, opts.baseDir);
+      }
+      return { server: tok.creds.server, user, machine: r.data.session?.machine, since: r.data.session?.createdAt, verified: true };
+    }
+    return { server: tok.creds.server, user: tok.creds.user, since: tok.creds.signedInAt, verified: false, note: `server answered HTTP ${r.status}` };
+  } catch (e) {
+    return { server: tok.creds.server, user: tok.creds.user, since: tok.creds.signedInAt, verified: false, note: e instanceof Error ? e.message : String(e) };
+  }
+}
+async function signedInCall(serverUrl, route, body, baseDir) {
+  const tok = await getAccessToken(serverUrl, { baseDir });
+  if (!tok) throw new Error(`This machine is not signed in to ${credentialsKey(serverUrl)}. Run accelr8 login first.`);
+  return call(`${httpBase(serverUrl)}${route}`, { body, bearer: tok.token });
+}
+async function pendingSignIn(serverUrl, userCode, opts = {}) {
+  const r = await signedInCall(serverUrl, "/auth/device/pending", { userCode }, opts.baseDir);
+  if (r.status !== 200 || typeof r.data?.machine !== "string") throw new Error(r.data?.message || `the server refused (HTTP ${r.status})`);
+  return r.data;
+}
+async function approveSignIn(serverUrl, userCode, opts = {}) {
+  const r = await signedInCall(serverUrl, "/auth/device/approve", { userCode }, opts.baseDir);
+  if (r.status !== 200 || !r.data?.user) throw new Error(r.data?.message || `the server refused (HTTP ${r.status})`);
+  return r.data.user;
+}
+async function ensureSignedIn(serverUrl, opts = {}) {
+  const have = loadCredentials(serverUrl, opts.baseDir);
+  if (have) return have;
+  const print = opts.print ?? ((l) => console.log(l));
+  print(`You are not signed in to ${credentialsKey(serverUrl)} yet.`);
+  try {
+    const creds = await deviceLogin(serverUrl, opts);
+    print(`  Signed in as ${creds.user.name}. Opening accelr8...`);
+    return creds;
+  } catch (e) {
+    print(`  ${e instanceof Error ? e.message : e}`);
+    return null;
+  }
+}
+
+export {
+  legacyProofs,
+  httpBase,
+  approveUrl,
+  AuthNetworkError,
+  olderServerMessage,
+  deviceLogin,
+  refreshCredentials,
+  getAccessToken,
+  logout,
+  whoami,
+  pendingSignIn,
+  approveSignIn,
+  ensureSignedIn
+};