carrick 0.3.90 → 0.3.92

package/README.md

@@ -99,8 +99,11 @@ repo in the folder attaches to the one repo there that has no identity.
 
 Credentials live in `$XDG_CONFIG_HOME/carrick/credentials.json`, falling back
 to `~/.config/carrick/` on macOS and Linux or `%APPDATA%\carrick\` on Windows.
-The file is written with mode 0600. `carrick logout` removes it; unset
-`CARRICK_TOKEN` separately if you set that override. Revoke issued keys at
+The file is written with mode 0600. `carrick logout` revokes that file's key
+on the server, then removes the file; other machines and editor connections
+stay signed in. If Carrick cannot be reached, the file is still removed and
+the command says the key is still live. Unset `CARRICK_TOKEN` separately if
+you set that override. Every issued key is listed, and can be revoked, at
 [your account](https://app.carrick.tools/account).
 
 Rust derives the same services for CI, local indexing and `init`. An existing

package/bin/carrick.mjs

@@ -279,7 +279,7 @@ function extraHelp() {
     "",
     "ACCOUNT:",
     "    login                        sign in to a Carrick workspace",
-    "    logout                       remove the saved local credential",
+    "    logout                       sign this machine out and revoke its key",
     "",
     "INTEGRATION:",
     "    lsp --stdio                  the language server, for an editor or an agent",
@@ -316,7 +316,7 @@ switch (command) {
   }
   case "logout": {
     const { logout } = await import("../dist/auth/run.js");
-    process.exit(logout(rest));
+    process.exit(await logout(rest));
   }
   case "lsp": {
     await pointAtNativeBinary();

package/dist/auth/credentials.d.ts

@@ -44,5 +44,5 @@ export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function credentialPath(env?: NodeJS.ProcessEnv): string;
 export declare function readCredential(env?: NodeJS.ProcessEnv): Credential | null;
 export declare function saveCredential(token: string, workspace: string | null, env?: NodeJS.ProcessEnv, scope?: string): void;
-/** Removes the local credential only; dashboard revocation is a separate action. */
+/** Removes the local credential only; `carrick logout` revokes the key first (`auth/run.ts`, `revokeKey`). */
 export declare function removeCredential(env?: NodeJS.ProcessEnv): boolean;

package/dist/auth/credentials.js

@@ -97,7 +97,7 @@ export function saveCredential(token, workspace, env = process.env, scope = SCOP
         fs.rmSync(temporary, { recursive: true, force: true });
     }
 }
-/** Removes the local credential only; dashboard revocation is a separate action. */
+/** Removes the local credential only; `carrick logout` revokes the key first (`auth/run.ts`, `revokeKey`). */
 export function removeCredential(env = process.env) {
     try {
         fs.unlinkSync(credentialPath(env));

package/dist/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC;AAqB3B;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACjC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACrJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACrG,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAmB,CAAC;QACvC,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACxE,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC;YACtF,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,CAAC;YACzE,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;YAC1F,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAAwB,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAgB,KAAK;IACjI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC;QACtI,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACvE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC;AAqB3B;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACjC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACrJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACrG,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAmB,CAAC;QACvC,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACxE,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC;YACtF,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,CAAC;YACzE,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;YAC1F,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAAwB,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAgB,KAAK;IACjI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC;QACtI,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACvE,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/auth/oauth.d.ts

@@ -5,7 +5,15 @@ export type OAuthOptions = {
     open?: (url: string) => Promise<boolean>;
     say?: (message: string) => void;
     timeoutMs?: number;
+    /** Bound on the workspace lookup that names the page. Default 3 s. */
+    lookupTimeoutMs?: number;
     signal?: AbortSignal;
 };
+/**
+ * The page the browser lands on after the loopback redirect (carrick#1488).
+ * Self-contained: inline CSS, no external assets. Kept deliberately plain:
+ * the word "carrick", one heading, one line. Every argument is escaped here.
+ */
+export declare function callbackPage(heading: string, line: string): string;
 /** RFC 8252 loopback + S256 PKCE against Carrick's existing public OAuth client flow. */
 export declare function authorize(options?: OAuthOptions): Promise<string>;

package/dist/auth/oauth.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import http from "node:http";
 import { spawn } from "node:child_process";
 import { APP_BASE, API_BASE, SCOPE } from "./credentials.js";
+import { resolveRepos } from "./read.js";
 /** Launch a URL as an argument, never through a shell. */
 export async function openBrowser(url) {
     const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
@@ -12,6 +13,41 @@ export async function openBrowser(url) {
         child.on("exit", (code) => resolve(code === 0));
     });
 }
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+/**
+ * The page the browser lands on after the loopback redirect (carrick#1488).
+ * Self-contained: inline CSS, no external assets. Kept deliberately plain:
+ * the word "carrick", one heading, one line. Every argument is escaped here.
+ */
+export function callbackPage(heading, line) {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Carrick</title>
+<style>
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0b0d10;color:#e6e8eb;font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:32rem;padding:2rem}
+.brand{font-weight:600;letter-spacing:.02em;color:#9aa3ad;margin:0 0 1.5rem}
+h1{font-size:1.5rem;font-weight:600;margin:0 0 .5rem}
+p{margin:0;color:#b8c0c8}
+code{font:.95em ui-monospace,SFMono-Regular,Menlo,monospace;color:#e6e8eb}
+</style></head>
+<body><main><p class="brand">carrick</p><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(line).replace(/`([^`]+)`/g, "<code>$1</code>")}</p></main></body></html>
+`;
+}
+/** Send the page; resolves once it has been flushed or the browser went away. */
+function answer(res, status, heading, line) {
+    if (res.writableEnded)
+        return Promise.resolve();
+    const done = new Promise((resolve) => {
+        res.once("finish", resolve);
+        res.once("close", resolve);
+    });
+    res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" }).end(callbackPage(heading, line));
+    return done;
+}
+const TRY_AGAIN = "Run `carrick login` again.";
 /** RFC 8252 loopback + S256 PKCE against Carrick's existing public OAuth client flow. */
 export async function authorize(options = {}) {
     const request = options.fetch ?? fetch;
@@ -22,15 +58,18 @@ export async function authorize(options = {}) {
     let settle;
     const received = new Promise((resolve) => { settle = resolve; });
     let consumed = false;
+    // The browser that delivered the code waits on this response until the
+    // exchange has finished, so the page states the real outcome.
+    let pending = null;
+    let delivered = Promise.resolve();
     const server = http.createServer((req, res) => {
         res.setHeader("Cache-Control", "no-store");
-        res.setHeader("Content-Type", "text/plain; charset=utf-8");
         let url;
         try {
             url = new URL(req.url ?? "/", "http://127.0.0.1");
         }
         catch {
-            res.writeHead(400).end("Invalid authorization callback.");
+            answer(res, 400, "Sign-in failed", `This is not a valid sign-in link. ${TRY_AGAIN}`);
             return;
         }
         const supplied = url.searchParams.get("state") ?? "";
@@ -38,22 +77,22 @@ export async function authorize(options = {}) {
             url.searchParams.getAll("state").length !== 1 ||
             Buffer.byteLength(supplied) !== Buffer.byteLength(state) ||
             !timingSafeEqual(Buffer.from(supplied), Buffer.from(state))) {
-            res.writeHead(400).end("Invalid authorization callback.");
+            answer(res, 400, "Sign-in failed", `This is not a valid sign-in link. ${TRY_AGAIN}`);
             return;
         }
         if (url.searchParams.has("error")) {
             consumed = true;
-            res.writeHead(400).end("Carrick authorization was declined. Return to your terminal.");
+            answer(res, 400, "Sign-in declined", `Carrick authorization was declined. ${TRY_AGAIN}`);
             settle(new Error("Carrick authorization was declined. Run carrick login to try again."));
             return;
         }
         const code = url.searchParams.get("code");
         if (!code || url.searchParams.getAll("code").length !== 1) {
-            res.writeHead(400).end("Missing authorization code.");
+            answer(res, 400, "Sign-in failed", `The sign-in link carried no authorization code. ${TRY_AGAIN}`);
             return;
         }
         consumed = true;
-        res.end("Authorization received. Return to your terminal to finish Carrick login.");
+        pending = res;
         settle(code);
     });
     server.requestTimeout = 10_000;
@@ -103,18 +142,33 @@ export async function authorize(options = {}) {
             typeof body.token_type !== "string" || body.token_type.toLowerCase() !== "bearer" || body.scope !== SCOPE) {
             throw new Error("Carrick returned an invalid OAuth token response.");
         }
+        if (pending) {
+            // The workspace name is for the page only. A failed lookup must not
+            // lose an issued token: the caller saves it and reports the lookup.
+            // Bounded: a hung lookup must not hold the token back from the caller.
+            const lookup = AbortSignal.any([signal, AbortSignal.timeout(options.lookupTimeoutMs ?? 3_000)]);
+            const workspace = await resolveRepos(body.access_token, [], request, lookup).then((r) => r.workspace.slug, () => null);
+            delivered = answer(pending, 200, workspace ? `Signed in to ${workspace}` : "Signed in to Carrick", "You can close this tab. Next, run `carrick init` in the folder that holds your repos.");
+        }
         return body.access_token;
     }
     catch (error) {
-        if (signal.aborted)
-            throw new Error("Carrick login was cancelled or timed out. Run carrick login to try again.");
         // Never include a remote body, token, verifier or callback URL in an error.
-        if (error instanceof Error && error.message.startsWith("Carrick"))
-            throw error;
-        throw new Error("Carrick login could not complete. Check the connection and loopback listener, then run carrick login.");
+        const failure = signal.aborted
+            ? new Error("Carrick login was cancelled or timed out. Run carrick login to try again.")
+            : error instanceof Error && error.message.startsWith("Carrick")
+                ? error
+                : new Error("Carrick login could not complete. Check the connection and loopback listener, then run carrick login.");
+        if (pending) {
+            const said = failure.message.replace(/ Run carrick login.*$/, "").replace(/, then run carrick login\.$/, ".");
+            delivered = answer(pending, 400, "Sign-in failed", `${said} ${TRY_AGAIN}`);
+        }
+        throw failure;
     }
     finally {
         signal.removeEventListener("abort", cancel);
+        // Let the page finish writing before connections are torn down.
+        await delivered;
         server.closeAllConnections();
         if (server.listening)
             await new Promise((resolve) => server.close(() => resolve()));

package/dist/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE7D,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAwB,EAAE;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,MAAuC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAChE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACxD,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YACvF,MAAM,CAAC,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YAC/D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SACjM,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3G,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,EAA6B,CAAC;QACxE,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACtI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,kBAAkB,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5R,GAAG,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACnD,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;QAC5B,IAAI,IAAI,YAAY,KAAK;YAAE,MAAM,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,cAAc,EAAE;YACtD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC;SACrL,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAuE,CAAC;QACtG,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3F,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QACjH,4EAA4E;QAC5E,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;IAC3H,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACzH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IACxD,OAAO;;;;;;;;;;;8CAWqC,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC;CACpI,CAAC;AACF,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,GAAwB,EAAE,MAAc,EAAE,OAAe,EAAE,IAAY;IACrF,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAwB,EAAE;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,MAAuC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,qCAAqC,SAAS,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAChE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACxD,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,uCAAuC,SAAS,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mDAAmD,SAAS,EAAE,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YAC/D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SACjM,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3G,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,EAA6B,CAAC;QACxE,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACtI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,kBAAkB,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5R,GAAG,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACnD,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;QAC5B,IAAI,IAAI,YAAY,KAAK;YAAE,MAAM,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,cAAc,EAAE;YACtD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC;SACrL,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAuE,CAAC;QACtG,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3F,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YAChG,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACvH,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC,CAAC,sBAAsB,EAC/F,uFAAuF,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;YAC5B,CAAC,CAAC,IAAI,KAAK,CAAC,2EAA2E,CAAC;YACxF,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;QACzH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC9G,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,gEAAgE;QAChE,MAAM,SAAS,CAAC;QAChB,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/auth/run.d.ts

@@ -9,4 +9,22 @@ import { type Credential } from "./credentials.ts";
  */
 export declare function signIn(say?: (message: string) => void, signal?: AbortSignal): Promise<Credential>;
 export declare function login(argv: string[]): Promise<number>;
-export declare function logout(argv: string[]): number;
+/**
+ * Ask Carrick to revoke the key that makes the request (carrick#1487).
+ *
+ * The key is its own authority: `POST <app>/oauth/revoke` hashes the bearer
+ * and revokes that one row, so the user's other machines and editor keys
+ * survive. Only a 204 means the key is no longer live (an unknown or
+ * already-revoked key is a 204 too). Every other outcome is "not revoked":
+ * a 200, which the endpoint never sends; the 404 an older cloud gives for a
+ * route it does not have; and a network failure. The caller signs out
+ * locally either way.
+ */
+export declare function revokeKey(token: string, request?: typeof fetch): Promise<boolean>;
+export type LogoutOptions = {
+    env?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+    out?: (text: string) => void;
+    err?: (text: string) => void;
+};
+export declare function logout(argv: string[], options?: LogoutOptions): Promise<number>;

package/dist/auth/run.js

@@ -1,4 +1,4 @@
-import { API_BASE, readCredential, saveCredential, removeCredential } from "./credentials.js";
+import { API_BASE, APP_BASE, readCredential, saveCredential, removeCredential } from "./credentials.js";
 import { authorize } from "./oauth.js";
 import { resolveRepos } from "./read.js";
 /**
@@ -47,21 +47,64 @@ export async function login(argv) {
         process.removeListener("SIGINT", cancel);
     }
 }
-export function logout(argv) {
+/**
+ * Ask Carrick to revoke the key that makes the request (carrick#1487).
+ *
+ * The key is its own authority: `POST <app>/oauth/revoke` hashes the bearer
+ * and revokes that one row, so the user's other machines and editor keys
+ * survive. Only a 204 means the key is no longer live (an unknown or
+ * already-revoked key is a 204 too). Every other outcome is "not revoked":
+ * a 200, which the endpoint never sends; the 404 an older cloud gives for a
+ * route it does not have; and a network failure. The caller signs out
+ * locally either way.
+ */
+export async function revokeKey(token, request = fetch) {
+    try {
+        const result = await request(`${APP_BASE}/oauth/revoke`, {
+            method: "POST", redirect: "error", signal: AbortSignal.timeout(10_000),
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        return result.status === 204;
+    }
+    catch {
+        return false;
+    }
+}
+export async function logout(argv, options = {}) {
+    const out = options.out ?? ((text) => process.stdout.write(text));
+    const err = options.err ?? ((text) => process.stderr.write(text));
     if (argv.length) {
-        process.stdout.write("carrick logout\n\nRemove the saved local credential. Revoke the key at https://app.carrick.tools/account.\n");
+        out("carrick logout\n\nSign this machine out: revoke its Carrick key on the server and remove the saved credential.\n");
         return argv.length === 1 && ["--help", "-h"].includes(argv[0]) ? 0 : 2;
     }
+    const env = options.env ?? process.env;
+    // The saved credential, never CARRICK_TOKEN: logout signs this machine's
+    // login out, and an override is a key the user manages somewhere else.
+    const { CARRICK_TOKEN: _override, ...fileEnv } = env;
+    let saved = null;
+    // An unreadable file still gets removed below; there is just no key to revoke.
     try {
-        const removed = removeCredential();
-        process.stdout.write(removed ? "Removed the saved Carrick credential.\n" : "No saved Carrick credential.\n");
-        if (process.env["CARRICK_TOKEN"] !== undefined)
-            process.stdout.write("CARRICK_TOKEN still overrides login; unset it in your shell to sign out.\n");
-        process.stdout.write("To revoke the key on the server, visit https://app.carrick.tools/account.\n");
+        saved = readCredential(fileEnv);
+    }
+    catch {
+        saved = null;
+    }
+    try {
+        const revoked = saved ? await revokeKey(saved.token, options.fetch) : false;
+        const removed = removeCredential(env);
+        const where = saved?.workspace_slug ?? "Carrick";
+        if (!removed)
+            out("No saved Carrick credential.\n");
+        else if (revoked)
+            out(`Signed out of ${where}.\n`);
+        else
+            out(`Signed out of ${where} on this machine, but Carrick could not revoke the key on the server. Revoke it at ${APP_BASE}/account.\n`);
+        if (env["CARRICK_TOKEN"] !== undefined)
+            out("CARRICK_TOKEN still overrides login; unset it in your shell to sign out.\n");
         return 0;
     }
     catch (error) {
-        process.stderr.write(`${error.message}\n`);
+        err(`${error.message}\n`);
         return 1;
     }
 }

package/dist/auth/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/auth/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAC/G,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAiC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,EAClF,MAAoB;IAEpB,qFAAqF;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,gFAAgF;IAChF,IAAI,CAAC,QAAQ;QAAE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kCAAkC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,OAAO,CACL,QAAQ,IAAI;QACV,QAAQ,EAAE,QAAQ;QAClB,KAAK;QACL,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;QACvC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc;IACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACpI,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/auth/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAiC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,EAClF,MAAoB;IAEpB,qFAAqF;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,gFAAgF;IAChF,IAAI,CAAC,QAAQ;QAAE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,kCAAkC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,OAAO,CACL,QAAQ,IAAI;QACV,QAAQ,EAAE,QAAQ;QAClB,KAAK;QACL,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;QACvC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc;IACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,UAAwB,KAAK;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,eAAe,EAAE;YACvD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACtE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,UAAyB,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,kHAAkH,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC;IACrD,IAAI,KAAK,GAAsB,IAAI,CAAC;IACpC,+EAA+E;IAC/E,IAAI,CAAC;QAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC;IAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,EAAE,cAAc,IAAI,SAAS,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,gCAAgC,CAAC,CAAC;aAC/C,IAAI,OAAO;YAAE,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC;;YAC9C,GAAG,CAAC,iBAAiB,KAAK,sFAAsF,QAAQ,aAAa,CAAC,CAAC;QAC5I,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAC1H,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,GAAI,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC"}

package/dist/init/connect.d.ts

@@ -1,5 +1,13 @@
 import { type ResolvedRepos } from "../auth/read.ts";
 import { type AssignOutcome } from "./projects.ts";
+import type { StepProgress, StepReport } from "./output.ts";
+/**
+ * Show a status that updates in place while `work` runs, then its report.
+ *
+ * `InitOutput.step` in a run: a spinner on a terminal, one line per change on
+ * a pipe. The default is the pipe's behaviour, for a caller with no output.
+ */
+export type Track = <T>(label: string, work: (progress: StepProgress) => Promise<T>, report: (value: T) => StepReport) => Promise<T>;
 type ConnectOptions = {
     interactive: boolean;
     say: (message: string) => void;
@@ -17,6 +25,12 @@ type ConnectOptions = {
      * the grant finishing rather than a move out of a project anyone chose.
      */
     movable?: Set<string>;
+    /**
+     * The movable repos whose move is said, lowercased: the ones in a project
+     * somebody chose. A repo the App grant has just put in the default project
+     * moves silently, because nobody chose where it was (carrick#1489).
+     */
+    announce?: Set<string>;
     /** How a project is printed: display name beside slug, where one is known. */
     label?: (slug: string) => string;
     open?: (url: string) => Promise<boolean>;
@@ -24,6 +38,8 @@ type ConnectOptions = {
     /** Placing repos in the project, injected so tests state the server (carrick#999). */
     assign?: (repos: string[], signal?: AbortSignal) => Promise<AssignOutcome>;
     wait?: (signal: AbortSignal) => Promise<void>;
+    /** The live status line the wait is shown on (carrick#1489). */
+    track?: Track;
     signal?: AbortSignal;
 };
 /**
@@ -35,6 +51,12 @@ type ConnectOptions = {
  * the friction this says out loud (carrick#993).
  */
 export declare const ADMIN_WAIT = "A workspace owner or admin must do this; Ctrl-C and run init again once they have.";
+/** The dashboard pages init sends a reader to, for one workspace. */
+export declare function workspaceUrls(slug: string): {
+    connect: string;
+    projects: string;
+    repos: string;
+};
 /** Every requested repo must be present, connected, and assigned to this project. */
 export declare function reposAreInProject(identity: ResolvedRepos, repos: string[], project: string): boolean;
 /**
@@ -45,15 +67,32 @@ export declare function reposAreInProject(identity: ResolvedRepos, repos: string
  * in a project answers the question on its own (carrick#987).
  */
 export declare function projectAssignments(identity: ResolvedRepos, repos: string[]): Array<string | null>;
+/** The requested repos this read says are not connected, as the server spells them. */
+export declare function unconnectedRepos(identity: ResolvedRepos, repos: string[]): string[];
+/**
+ * The one line that sends a reader to the GitHub App, naming the repos it is
+ * for. Printed only for repos a read taken just now says are unconnected: the
+ * grant page re-asks GitHub for the whole repo list, which is wasted on a repo
+ * that is already connected (carrick#1489).
+ */
+export declare function connectLine(unconnected: string[], total: number, url: string): string;
 /**
  * The GitHub App grant is the only browser step; the CLI places the repos.
  *
  * Assignment is a server action on this credential (carrick#999), tried for
  * every connected repo the moment the poll sees it, so nobody has to open the
- * Repos page and move it by hand. An API that does not serve the action yet —
- * which is every API until the deploy lands — answers an absence, and the
- * browser instruction this command printed before is what it falls back to.
+ * Repos page and move it by hand. An API that does not serve the action yet
+ * answers an absence, and the browser instruction is what it falls back to.
  * Ctrl-C stops verification.
+ *
+ * What it prints is the state and the next step, not the traffic
+ * (carrick#1489): the wait is one status line that updates in place, a move
+ * the run was allowed to make is not announced (the first one out of an
+ * untouched default project is the App grant finishing, not a decision), and
+ * a repo gets a line of its own only when something about it failed.
+ *
+ * `initial` must be a read taken just before this call: it decides which
+ * repos are sent to the grant page and whether there is anything to wait for.
  */
 export declare function connectRepos(token: string, repos: string[], initial: ResolvedRepos, options: ConnectOptions): Promise<ResolvedRepos>;
 export {};