checkly 9.5.0 → 10.0.0-prerelease-4f88d60

package/dist/ai-context/skills-command/references/initialize.md

@@ -91,6 +91,14 @@ Use the output to create a `checkly.config.ts` (or `checkly.config.js` if the us
 
 Adjust the `checkMatch` property according to previous selection. Use only locations verified as available in the previous step.
 
+Set `repoUrl` to this repository's own remote:
+
+1. Run `git remote get-url origin`.
+2. Convert it to an `https://` URL (`git@github.com:owner/repo.git` → `https://github.com/owner/repo`). Drop any credentials and the trailing `.git`.
+3. Set the result as `repoUrl`. If there is no remote, leave `repoUrl` out.
+
+Never copy the `repoUrl` from the example config.
+
 Present the generated configuration to the user and ask if it looks correct. Allow the user to make changes.
 
 Congratulate the user on completing the config. Now it's time to test the configuration and turn everything into monitoring!
@@ -105,10 +113,10 @@ npx checkly whoami
 
 If the user is logged in, verify the information and if it's the correct account.
 
-If the user is NOT logged in, present two options (lead with env vars — they work for agents, CI, and interactive use):
+If the user is NOT logged in, run the login yourself unless the user prefers API keys:
 
-- **Option A: Environment variables (recommended)** — The user sets `CHECKLY_API_KEY` and `CHECKLY_ACCOUNT_ID` as environment variables. They can create an API key at https://app.checklyhq.com/accounts/settings/user/api-keys. This is the recommended approach as it works in all contexts (agentic, CI/CD, and interactive). Once both variables are set, re-run `npx checkly whoami` to verify.
-- **Option B: Interactive login** — The user runs `npx checkly login` themselves. This command opens a browser for OAuth authentication and **cannot be completed by an AI agent**. Tell the user to run the command, complete the browser flow, and let you know when they're done so you can re-run `npx checkly whoami` to verify.
+- **Option A: `npx checkly login`** — Works for agents. It prints a JSON `action_required` line with a URL and a short code and exits: give both to the user, then run `npx checkly login --wait`, which returns once they have approved. With several accounts it stops at a `select_account` line listing them; ask the user which one and run `npx checkly login --account-id <id>`. Details are in the skill's "Logging in as an agent" section. Any authenticated command starts this flow on its own when no credentials are stored. To pin this project to one account, put `CHECKLY_ACCOUNT_ID=<id>` (without `CHECKLY_API_KEY`) in its `.env`.
+- **Option B: Environment variables** — For CI/CD, or when the user prefers keys: they set `CHECKLY_API_KEY` and `CHECKLY_ACCOUNT_ID` (API keys are created at https://app.checklyhq.com/accounts/settings/user/api-keys). Once both are set, re-run `npx checkly whoami` to verify.
 
 #### Step 6: Summarize and test the new monitoring configuration
 

package/dist/ai-context/skills-command/references/investigate-checks.md

@@ -13,7 +13,7 @@ npx checkly checks list --search "Homepage" --output json
 
 Flags:
 - `-t, --tag <tag>` — filter by tag (repeat for multiple)
-- `--type <type>` — filter by check type (`API`, `BROWSER`, `HEARTBEAT`, `MULTI_STEP`, `PLAYWRIGHT`, `TCP`, `ICMP`, `DNS`, `URL`, `AGENTIC`)
+- `--type <type>` — filter by check type (`API`, `BROWSER`, `HEARTBEAT`, `MULTI_STEP`, `PLAYWRIGHT`, `TCP`, `ICMP`, `DNS`, `URL`)
 - `-s, --search <name>` — filter by name (case-insensitive partial match)
 - `--status <status>` — filter by current status: `passing`, `failing`, or `degraded`
 - `-l, --limit <n>` — max checks to return (1-100, default 25)

package/dist/auth/api-key.d.ts

@@ -0,0 +1,24 @@
+import { type AxiosInstance } from 'axios';
+export interface ApiKeyExchangeDeps {
+    createClient: (accessToken: string) => AxiosInstance;
+    hostname: () => string;
+    sleep: (ms: number) => Promise<void>;
+}
+/**
+ * Trades an Auth0 access token for a long-lived Checkly API key, registering
+ * the user with Checkly first when the Auth0 identity is not known yet
+ * (that is what a fresh sign-up looks like from the CLI's point of view).
+ */
+export declare function exchangeAccessTokenForApiKey(accessToken: string, deps?: Partial<ApiKeyExchangeDeps>): Promise<{
+    key: string;
+}>;
+export interface Credentials {
+    /** Display name from the OpenID ID token. */
+    name: string;
+    /** Long-lived Checkly API key. */
+    key: string;
+}
+export declare function credentialsFromTokens(tokens: {
+    accessToken: string;
+    idToken: string;
+}, deps?: Partial<ApiKeyExchangeDeps>): Promise<Credentials>;

package/dist/auth/api-key.js

@@ -0,0 +1,104 @@
+import axios, { isAxiosError } from 'axios';
+import * as os from 'os';
+import { jwtDecode } from 'jwt-decode';
+import { getDefaults as getApiDefaults } from '../rest/api.js';
+import { handleErrorResponse } from '../rest/errors.js';
+import { assignProxy } from '../services/proxy.js';
+function createDefaultClient(accessToken) {
+    // Keep axios instance stateless
+    const { baseURL } = getApiDefaults();
+    const axiosConf = assignProxy(baseURL, {
+        baseURL,
+        headers: {
+            Accept: 'application/json, text/plain, */*',
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    return axios.create(axiosConf);
+}
+const defaultDeps = {
+    createClient: createDefaultClient,
+    hostname: () => os.hostname(),
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+};
+// The device code is spent once its tokens are issued, so an exchange that
+// fails here costs the user another approval in the browser; ride out a
+// brief API hiccup first.
+const RETRY_DELAYS_MS = [1_000, 3_000];
+// Failures where the request never reached the server.
+const NOT_SENT_CODES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
+/**
+ * Any brief failure: for requests that are safe to repeat. Wider than the
+ * shared API client's policy (rest/retry.ts), which leaves out 500 and 408:
+ * here giving up costs the user another browser approval, not just a
+ * failed command.
+ */
+function isTransient(error) {
+    const status = error.response?.status;
+    return status === undefined || status >= 500 || status === 408 || status === 429;
+}
+/**
+ * A failure the server certainly did not act on: for creating an API key,
+ * where repeating a request that was processed but whose answer was lost
+ * would leave an extra long-lived key nobody holds.
+ */
+function wasNotProcessed(error) {
+    if (error.response) {
+        return error.response.status === 503 || error.response.status === 429;
+    }
+    return NOT_SENT_CODES.has(error.code ?? '');
+}
+async function withRetries(sleep, request, retryable) {
+    for (const delayMs of RETRY_DELAYS_MS) {
+        try {
+            return await request();
+        }
+        catch (error) {
+            if (!isAxiosError(error) || !retryable(error)) {
+                throw error;
+            }
+            await sleep(delayMs);
+        }
+    }
+    return request();
+}
+/**
+ * Trades an Auth0 access token for a long-lived Checkly API key, registering
+ * the user with Checkly first when the Auth0 identity is not known yet
+ * (that is what a fresh sign-up looks like from the CLI's point of view).
+ */
+export async function exchangeAccessTokenForApiKey(accessToken, deps = {}) {
+    const { createClient, hostname, sleep } = { ...defaultDeps, ...deps };
+    const client = createClient(accessToken);
+    try {
+        // Repeating this is safe: a registration that went through is seen by
+        // the next GET, so it is not attempted again.
+        await withRetries(sleep, async () => {
+            try {
+                await client.get('/users/me');
+            }
+            catch (error) {
+                if (error.response?.status === 401) {
+                    await client.post('/users/', { accessToken });
+                }
+                else {
+                    throw error;
+                }
+            }
+        }, isTransient);
+        const apiKeyName = `CLI User Key (${hostname()})`;
+        const { data } = await withRetries(sleep, () => client.post(`/users/me/api-keys?name=${apiKeyName}`), wasNotProcessed);
+        return data;
+    }
+    catch (error) {
+        // The same typed errors as the regular API client, so callers can tell a
+        // failed or unreachable Checkly API from other failures.
+        handleErrorResponse(error);
+    }
+}
+export async function credentialsFromTokens(tokens, deps = {}) {
+    const { name } = jwtDecode(tokens.idToken);
+    const { key } = await exchangeAccessTokenForApiKey(tokens.accessToken, deps);
+    return { name, key };
+}
+//# sourceMappingURL=api-key.js.map

package/dist/auth/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../src/auth/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,YAAY,EAAuC,MAAM,OAAO,CAAA;AAChF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAQlD,SAAS,mBAAmB,CAAE,WAAmB;IAC/C,gCAAgC;IAChC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE;QACrC,OAAO;QACP,OAAO,EAAE;YACP,MAAM,EAAE,mCAAmC;YAC3C,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,WAAW,GAAuB;IACtC,YAAY,EAAE,mBAAmB;IACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAC7D,CAAA;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,0BAA0B;AAC1B,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAEtC,uDAAuD;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAE1E;;;;;GAKG;AACH,SAAS,WAAW,CAAE,KAAiB;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAA;IACrC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAE,KAAiB;IACzC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;IACvE,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAoC,EACpC,OAAyB,EACzB,SAAyC;IAEzC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,KAAK,CAAA;YACb,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,EAAE,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAA;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAExC,IAAI,CAAC;QACH,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAK,KAAoB,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnD,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;gBAC/C,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAA;QAEf,MAAM,UAAU,GAAG,iBAAiB,QAAQ,EAAE,GAAG,CAAA;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EACtC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,CAAC,EAAE,eAAe,CAAC,CAAA;QAE9E,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,yDAAyD;QACzD,mBAAmB,CAAC,KAAc,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAgD,EAChD,OAAoC,EAAE;IAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAmB,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC5E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC"}

package/dist/auth/device-flow.d.ts

@@ -0,0 +1,58 @@
+export declare const AUTH0_CLIENT_ID = "mBtwLFVm39GVZ1HpSRBSdRiLFucYxmMb";
+export interface DeviceAuthorization {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    /** Epoch milliseconds after which the device code is no longer valid. */
+    expiresAt: number;
+    intervalMs: number;
+}
+export interface DeviceTokens {
+    accessToken: string;
+    idToken: string;
+}
+export interface OAuthResponse {
+    status: number;
+    data: any;
+}
+export interface DeviceFlowDeps {
+    /** Must resolve for non-2xx responses too; the flow reads OAuth error codes from the body. */
+    post: (url: string, params: URLSearchParams) => Promise<OAuthResponse>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+}
+export declare class DeviceFlowError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+/** The Auth0 client does not have the device_code grant enabled. */
+export declare class DeviceFlowNotAllowedError extends DeviceFlowError {
+    constructor(message: string);
+}
+export declare class DeviceFlow {
+    #private;
+    constructor(deps?: Partial<DeviceFlowDeps>);
+    requestAuthorization(): Promise<DeviceAuthorization>;
+    /**
+     * Polls until the user approves or the code expires. When the answers keep
+     * coming from something other than the login server (a proxy or captive
+     * portal), `onUnexpectedAnswers` is called once per such run with the latest one, and
+     * polling goes on: the user may still be getting past a captive portal,
+     * and the code stays valid. If the code expires during such a run, the
+     * error is a `network_error` rather than `expired_token`.
+     */
+    pollForTokens(auth: DeviceAuthorization, { onUnexpectedAnswers }?: {
+        onUnexpectedAnswers?: (failure: string) => void;
+    }): Promise<DeviceTokens>;
+    /**
+     * A single token request without waiting, so a caller can check a stored
+     * code and return at once. `tokens` once the user has approved; otherwise
+     * `failure` says why the login server could not answer, if it could not
+     * (the user may then have approved without the CLI seeing it yet).
+     */
+    pollOnce(auth: DeviceAuthorization): Promise<{
+        tokens?: DeviceTokens;
+        failure?: string;
+    }>;
+}

package/dist/auth/device-flow.js

@@ -0,0 +1,228 @@
+import axios from 'axios';
+import { assignProxy } from '../services/proxy.js';
+import config from '../services/config.js';
+// OAuth 2.0 Device Authorization Grant (RFC 8628) against Checkly's Auth0 tenant.
+// The user opens a URL on any device and enters a short code; the CLI polls for
+// the tokens. Unlike the authorization-code flow this needs no local callback
+// server, so it works over SSH, in containers and from agent sandboxes.
+export const AUTH0_CLIENT_ID = 'mBtwLFVm39GVZ1HpSRBSdRiLFucYxmMb';
+const deviceCodeUrl = () => `${config.getAuthUrl()}/oauth/device/code`;
+const tokenUrl = () => `${config.getAuthUrl()}/oauth/token`;
+const AUTH0_SCOPES = 'openid profile email';
+const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_INTERVAL_MS = 5_000;
+const SLOW_DOWN_STEP_MS = 5_000;
+// Upper bound for the time between polls, from the server's interval or
+// after backing off: a delay beyond setTimeout's range would fire at once,
+// and a long one would notice an approval late. Deliberately departs from
+// RFC 8628's "add 5 seconds on every slow_down" once reached; no login server
+// we use needs a minute between polls.
+const MAX_INTERVAL_MS = 60_000;
+// How many answers in a row that did not come from the login server (a proxy
+// or captive portal) a waiting login takes before it reports them.
+const MAX_UNEXPECTED_RESPONSES = 5;
+const REQUEST_TIMEOUT_MS = 30_000;
+export class DeviceFlowError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = 'DeviceFlowError';
+    }
+}
+/** The Auth0 client does not have the device_code grant enabled. */
+export class DeviceFlowNotAllowedError extends DeviceFlowError {
+    constructor(message) {
+        super('unauthorized_client', message);
+        this.name = 'DeviceFlowNotAllowedError';
+    }
+}
+const defaultDeps = {
+    post: async (url, params) => {
+        const { status, data } = await axios.post(url, params, assignProxy(url, {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Accept-Encoding': '*',
+            },
+            validateStatus: () => true,
+            timeout: REQUEST_TIMEOUT_MS,
+        }));
+        return { status, data };
+    },
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+};
+function errorFrom(data, fallback) {
+    const code = data?.error ?? fallback;
+    const message = data?.error_description ?? `Authentication failed (${code})`;
+    if (code === 'unauthorized_client') {
+        return new DeviceFlowNotAllowedError(message);
+    }
+    return new DeviceFlowError(code, message);
+}
+function notFromLoginServer(what) {
+    return `${what} that did not come from the login server; check your network or proxy settings`;
+}
+function unexpectedResponseError() {
+    return new DeviceFlowError('invalid_response', 'The login server returned an unexpected response. Check your network or proxy settings and try again.');
+}
+/**
+ * Names a failed request by its error code only: error messages can carry
+ * request or proxy URLs, credentials included.
+ */
+function transportFailure(error) {
+    const code = error?.code;
+    return typeof code === 'string' ? code : 'network error';
+}
+function tokenParams(auth) {
+    return new URLSearchParams({
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: auth.deviceCode,
+        client_id: AUTH0_CLIENT_ID,
+    });
+}
+export class DeviceFlow {
+    #deps;
+    constructor(deps = {}) {
+        this.#deps = { ...defaultDeps, ...deps };
+    }
+    async requestAuthorization() {
+        const params = new URLSearchParams({
+            client_id: AUTH0_CLIENT_ID,
+            scope: AUTH0_SCOPES,
+        });
+        let response;
+        try {
+            response = await this.#deps.post(deviceCodeUrl(), params);
+        }
+        catch (error) {
+            throw new DeviceFlowError('network_error', `Could not reach the login server (${transportFailure(error)}). `
+                + 'Check your network or proxy settings and try again.', { cause: error });
+        }
+        const { status, data } = response;
+        // A proxy or captive portal can answer in place of the login server, with
+        // an HTML page and any status; without these checks the user would see an
+        // unhelpful error or "undefined" for the URL and the code.
+        if (status < 200 || status >= 300) {
+            if (typeof data?.error !== 'string') {
+                throw unexpectedResponseError();
+            }
+            throw errorFrom(data, 'device_authorization_failed');
+        }
+        const isText = (value) => typeof value === 'string' && value !== '';
+        if (!isText(data?.device_code) || !isText(data?.user_code) || !isText(data?.verification_uri)
+            || !(Number.isFinite(data?.expires_in) && data.expires_in > 0)) {
+            throw unexpectedResponseError();
+        }
+        // At least a second and at most MAX_INTERVAL_MS, whatever the response says.
+        const intervalSeconds = Number.isFinite(data.interval) && data.interval > 0
+            ? Math.min(MAX_INTERVAL_MS / 1000, Math.max(1, data.interval))
+            : DEFAULT_INTERVAL_MS / 1000;
+        return {
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verificationUri: data.verification_uri,
+            verificationUriComplete: isText(data.verification_uri_complete)
+                ? data.verification_uri_complete
+                : data.verification_uri,
+            expiresAt: this.#deps.now() + data.expires_in * 1000,
+            intervalMs: intervalSeconds * 1000,
+        };
+    }
+    /**
+     * Polls until the user approves or the code expires. When the answers keep
+     * coming from something other than the login server (a proxy or captive
+     * portal), `onUnexpectedAnswers` is called once per such run with the latest one, and
+     * polling goes on: the user may still be getting past a captive portal,
+     * and the code stays valid. If the code expires during such a run, the
+     * error is a `network_error` rather than `expired_token`.
+     */
+    async pollForTokens(auth, { onUnexpectedAnswers } = {}) {
+        const params = tokenParams(auth);
+        let intervalMs = auth.intervalMs;
+        let lastFailure;
+        let unexpectedInARow = 0;
+        while (this.#deps.now() + intervalMs <= auth.expiresAt) {
+            await this.#deps.sleep(intervalMs);
+            const result = await this.#requestTokens(params);
+            lastFailure = result.failure;
+            unexpectedInARow = result.unexpected ? unexpectedInARow + 1 : 0;
+            if (unexpectedInARow === MAX_UNEXPECTED_RESPONSES) {
+                onUnexpectedAnswers?.(result.failure);
+            }
+            if (result.state === 'slow_down') {
+                intervalMs = Math.min(MAX_INTERVAL_MS, intervalMs + SLOW_DOWN_STEP_MS);
+            }
+            else if (result.state === 'approved') {
+                return result.tokens;
+            }
+        }
+        // A code the user approved can still expire here when the login server
+        // was unreachable at the end; say so rather than blaming the user. While
+        // something else kept answering for it, the connection is the problem.
+        if (unexpectedInARow >= MAX_UNEXPECTED_RESPONSES) {
+            throw new DeviceFlowError('network_error', 'The login code expired while the answers to the login server '
+                + `kept coming from something else (${lastFailure}); a proxy or captive portal may be in the way. `
+                + 'Fix the connection and run the login again.');
+        }
+        throw new DeviceFlowError('expired_token', lastFailure
+            ? `The login code expired; the last attempt to reach the login server failed (${lastFailure}). `
+                + 'Please run the login again.'
+            : 'The login code expired before it was used. Please run the login again.');
+    }
+    /**
+     * A single token request without waiting, so a caller can check a stored
+     * code and return at once. `tokens` once the user has approved; otherwise
+     * `failure` says why the login server could not answer, if it could not
+     * (the user may then have approved without the CLI seeing it yet).
+     */
+    async pollOnce(auth) {
+        const result = await this.#requestTokens(tokenParams(auth));
+        return result.state === 'approved' ? { tokens: result.tokens } : { failure: result.failure };
+    }
+    /**
+     * One token request. Polling can last as long as the code is valid, often
+     * after the user has already approved it in the browser, so a network
+     * failure, a server-side error, a rate limit or an answer that did not come from the
+     * login server (e.g. a proxy's or captive portal's page) counts as "try
+     * again" rather than ending the login; only an OAuth error from the server
+     * is final.
+     */
+    async #requestTokens(params) {
+        let response;
+        try {
+            response = await this.#deps.post(tokenUrl(), params);
+        }
+        catch (error) {
+            return { state: 'pending', failure: transportFailure(error) };
+        }
+        const { status, data } = response;
+        if (status >= 200 && status < 300) {
+            if (!data?.access_token || !data?.id_token) {
+                return { state: 'pending', failure: notFromLoginServer('a response without tokens'), unexpected: true };
+            }
+            return { state: 'approved', tokens: { accessToken: data.access_token, idToken: data.id_token } };
+        }
+        // Not counted as unexpected: an outage of the login server itself is
+        // worth waiting out for as long as the code is valid.
+        if (status >= 500) {
+            return { state: 'pending', failure: `HTTP ${status}` };
+        }
+        if (data?.error === 'slow_down') {
+            return { state: 'slow_down' };
+        }
+        // Rate limited (by the login server or something in front of it): never
+        // a final answer, and it says nothing about whether the code was approved.
+        if (status === 429) {
+            return { state: 'slow_down', failure: 'HTTP 429' };
+        }
+        if (data?.error === 'authorization_pending') {
+            return { state: 'pending' };
+        }
+        if (typeof data?.error !== 'string') {
+            return { state: 'pending', failure: notFromLoginServer(`HTTP ${status}`), unexpected: true };
+        }
+        throw errorFrom(data, 'token_request_failed');
+    }
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/auth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,MAAM,MAAM,uBAAuB,CAAA;AAE1C,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AAExE,MAAM,CAAC,MAAM,eAAe,GAAG,kCAAkC,CAAA;AAEjE,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAA;AACtE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,cAAc,CAAA;AAC3D,MAAM,YAAY,GAAG,sBAAsB,CAAA;AAC3C,MAAM,iBAAiB,GAAG,8CAA8C,CAAA;AACxE,MAAM,mBAAmB,GAAG,KAAK,CAAA;AACjC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAC/B,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAkCjC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAClB;IAAtB,YAAsB,IAAY,EAAE,OAAe,EAAE,OAAsB;QACzE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QADH,SAAI,GAAJ,IAAI,CAAQ;QAEhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAa,OAAe;QAC1B,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,MAAM,WAAW,GAAmB;IAClC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE;YACtE,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,iBAAiB,EAAE,GAAG;aACvB;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;YAC1B,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC,CAAA;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IACD,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5D,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACtB,CAAA;AAED,SAAS,SAAS,CAAE,IAAS,EAAE,QAAgB;IAC7C,MAAM,IAAI,GAAW,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAA;IAC5C,MAAM,OAAO,GAAW,IAAI,EAAE,iBAAiB,IAAI,0BAA0B,IAAI,GAAG,CAAA;IACpF,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAE,IAAY;IACvC,OAAO,GAAG,IAAI,gFAAgF,CAAA;AAChG,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAC3C,uGAAuG,CAAC,CAAA;AAC5G,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAE,KAAc;IACvC,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAA;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;AAC1D,CAAC;AAED,SAAS,WAAW,CAAE,IAAyB;IAC7C,OAAO,IAAI,eAAe,CAAC;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,UAAU;IACrB,KAAK,CAAgB;IAErB,YAAa,OAAgC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,YAAY;SACpB,CAAC,CAAA;QAEF,IAAI,QAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,qCAAqC,gBAAgB,CAAC,KAAK,CAAC,KAAK;kBACxG,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;QAEjC,0EAA0E;QAC1E,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClC,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,uBAAuB,EAAE,CAAA;YACjC,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAA;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;eACxF,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,uBAAuB,EAAE,CAAA;QACjC,CAAC;QAED,6EAA6E;QAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAA;QAE9B,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;YACtC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC;gBAC7D,CAAC,CAAC,IAAI,CAAC,yBAAyB;gBAChC,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;YACpD,UAAU,EAAE,eAAe,GAAG,IAAI;SACnC,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,IAAyB,EACzB,EAAE,mBAAmB,KAA0D,EAAE;QAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAChC,IAAI,WAA+B,CAAA;QACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;QAExB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAChD,WAAW,GAAG,MAAM,CAAC,OAAO,CAAA;YAC5B,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/D,IAAI,gBAAgB,KAAK,wBAAwB,EAAE,CAAC;gBAClD,mBAAmB,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,iBAAiB,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC,MAAM,CAAA;YACtB,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,wBAAwB,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,+DAA+D;kBACtG,oCAAoC,WAAW,kDAAkD;kBACjG,6CAA6C,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,WAAW;YACpD,CAAC,CAAC,8EAA8E,WAAW,KAAK;kBAC9F,6BAA6B;YAC/B,CAAC,CAAC,wEAAwE,CAAC,CAAA;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAE,IAAyB;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IAC9F,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAE,MAAuB;QAC3C,IAAI,QAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAA;QAC/D,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;QAEjC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YACzG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAA;QAClG,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAA;QACxD,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAC/B,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;QACpD,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,KAAK,uBAAuB,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,CAAC;QACD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QAC9F,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;IAC/C,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -1,4 +1,5 @@
-export type AuthMode = 'signup' | 'login';
+/** 'any' leaves both login and sign-up enabled on the hosted page. */
+export type AuthMode = 'signup' | 'login' | 'any';
 export declare function generatePKCE(): {
     codeChallenge: string;
     codeVerifier: string;
@@ -7,9 +8,8 @@ export declare class AuthContext {
     #private;
     private mode;
     authenticationUrl: string;
-    constructor(mode: AuthMode);
-    getAuth0Credentials(): Promise<{
-        name: any;
-        key: any;
-    }>;
+    constructor(mode: AuthMode, { timeoutMs }?: {
+        timeoutMs?: number;
+    });
+    getAuth0Credentials(): Promise<import("./api-key.js").Credentials>;
 }