dazzer-connect 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,55 +1,2031 @@
 #!/usr/bin/env node
-/**
- * @purpose Entry point for the dazzer CLI — wires Commander subcommands for
- * auth login, logout, and status against a configurable authorization server.
- */
+
+// src/index.ts
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { runLogin } from "./commands/login.js";
-import { runLogout } from "./commands/logout.js";
-import { runStatus } from "./commands/status.js";
-import { validateEnv } from "./env.js";
-const require = createRequire(import.meta.url);
-const { version } = require("../package.json");
-const program = new Command();
+
+// src/commands/add.ts
+import { open, stat as statPath } from "node:fs/promises";
+import { basename, extname } from "node:path";
+
+// src/lib/output.ts
+function writeOut(message) {
+  process.stdout.write(`${message}
+`);
+}
+function writeErr(message) {
+  process.stderr.write(`${message}
+`);
+}
+var CANNOT_REACH_DAZZER = "I can't reach Dazzer right now \u2014 nothing was sent. Try again shortly.";
+var SIGN_IN_NO_LONGER_VALID = "Your Dazzer sign-in is no longer valid. Reconnect your client (or run `dazzer auth login`).";
+function printDeviceInstructions(deviceAuth) {
+  writeOut("");
+  if (deviceAuth.verification_uri_complete) {
+    writeOut("To finish signing in, open this link in your browser:");
+    writeOut(`  ${deviceAuth.verification_uri_complete}`);
+  } else {
+    writeOut("To finish signing in, open this page in your browser:");
+    writeOut(`  ${deviceAuth.verification_uri}`);
+    writeOut("");
+    writeOut("Then enter this code:");
+    writeOut(`  ${deviceAuth.user_code}`);
+  }
+  writeOut("");
+  writeOut("Waiting for you to approve in the browser...");
+}
+function printBrowserOpening(url) {
+  writeOut("");
+  writeOut("Opening your browser to sign in\u2026");
+  writeOut("If it doesn't open automatically, paste this into your browser:");
+  writeOut(`  ${url}`);
+  writeOut("");
+}
+function printLoginSuccess(keychainOk) {
+  writeOut("");
+  writeOut("Signed in successfully.");
+  if (!keychainOk) {
+    writeErr("Warning: could not save tokens to the OS keychain. Use the config below.");
+  }
+}
+function printConnectGuidance(mcpServerUrl, accessToken) {
+  const url = mcpServerUrl.replace(/\/$/, "");
+  writeOut("");
+  writeOut("Connect an AI client to Dazzer.");
+  writeOut("");
+  writeOut("Recommended \u2014 add this server by URL and sign in from your client;");
+  writeOut("it stays connected and renews itself:");
+  writeOut("");
+  writeOut("{");
+  writeOut('  "mcpServers": {');
+  writeOut('    "dazzer": {');
+  writeOut(`      "url": "${url}"`);
+  writeOut("    }");
+  writeOut("  }");
+  writeOut("}");
+  writeOut("");
+  writeOut("Fallback \u2014 only if your client cannot sign in and needs a pasted token.");
+  writeOut("This token expires in about an hour; re-run `dazzer auth login` to renew:");
+  writeOut("");
+  writeOut("{");
+  writeOut('  "mcpServers": {');
+  writeOut('    "dazzer": {');
+  writeOut(`      "url": "${url}",`);
+  writeOut('      "headers": {');
+  writeOut(`        "Authorization": "Bearer ${accessToken}"`);
+  writeOut("      }");
+  writeOut("    }");
+  writeOut("  }");
+  writeOut("}");
+  writeOut("");
+}
+function printAuthStatus(params) {
+  switch (params.state) {
+    case "signed-out":
+      writeOut("Not signed in. Run: dazzer auth login");
+      return;
+    case "store-unreadable":
+      writeOut("Cannot tell \u2014 this machine's credential store could not be opened.");
+      writeOut("  Common on servers and containers, which often have none.");
+      writeOut("  Run: dazzer auth login \u2014 it prints a pass you can paste in.");
+      return;
+    case "expired":
+      writeOut("Your sign-in has expired or been revoked. Run: dazzer auth login");
+      return;
+    case "unverified":
+      writeOut(
+        "Signed in on this device, but the sign-in server could not be reached to confirm it."
+      );
+      if (params.issuer) {
+        writeOut(`  Signed in at: ${params.issuer}`);
+      }
+      if (params.lastKnownExpiresAt) {
+        writeOut(`  Last confirmed expiry: ${new Date(params.lastKnownExpiresAt).toISOString()}`);
+      }
+      writeOut("  Check your connection, then run this again to confirm.");
+      return;
+    case "signed-in":
+      writeOut("Signed in \u2014 confirmed just now.");
+      if (params.issuer) {
+        writeOut(`  Signed in at: ${params.issuer}`);
+      }
+      if (params.expiresAt) {
+        writeOut(
+          `  This token expires ${new Date(params.expiresAt).toISOString()} and refreshes automatically.`
+        );
+      }
+      return;
+  }
+}
+function printLogoutSuccess() {
+  writeOut("Signed out.");
+}
+function printLogoutStoreLocked(offerForget) {
+  writeErr(
+    "Not signed out. This machine's credential store could not be opened, so a sign-in saved here may still work."
+  );
+  writeErr(
+    offerForget ? "  Unlock it and try again. If this machine has no credential store, run: dazzer auth logout --forget-this-machine" : "  Unlock it and try again."
+  );
+}
+function printLogoutNotCancelledYet() {
+  writeErr(
+    "Not signed out. Your sign-in could not be cancelled right now, so it is still saved here."
+  );
+  writeErr("  Try again: dazzer auth logout");
+}
+function printLogoutCannotCancel() {
+  writeOut(
+    "Signed out on this device, but your sign-in could not be cancelled at the server. It stops working once it goes 30 days unused."
+  );
+}
+function printLogoutNothingFound() {
+  writeOut("No saved sign-in was found here to cancel.");
+}
+function printLogoutIncomplete(cancelledAtServer) {
+  if (cancelledAtServer) {
+    writeErr(
+      "Not fully signed out. Your sign-in is cancelled, but this machine's credential store would not let it be removed, so what is saved here can work for up to an hour."
+    );
+  } else {
+    writeErr(
+      "Not signed out. This machine's credential store would not let your saved sign-in be removed, so it may still work from here."
+    );
+  }
+  writeErr("  Try again: dazzer auth logout");
+}
+function printLogoutForgotten() {
+  writeOut(
+    "Forgot this machine's sign-in record. Nothing was cancelled, and any sign-in still saved in this machine's credential store stays there."
+  );
+}
+function printForgetFailed(configDir) {
+  writeErr("Not forgotten: this machine's sign-in record could not be removed.");
+  writeErr(`  Remove it by hand: ${configDir}`);
+}
+function printLogoutPassLeft() {
+  writeOut(
+    "No sign-in that can be renewed is saved here. A short-lived pass this machine's credential store would not remove stops working within the hour."
+  );
+}
+function printLogoutBadSettings() {
+  writeErr(
+    "Not signed out. DAZZER_AUTH_ISSUER or DAZZER_AUTH_CLIENT_ID is not a valid setting, so there is nowhere to cancel your sign-in."
+  );
+  writeErr("  Fix it, then run: dazzer auth logout");
+}
+function printForgetRefused() {
+  writeErr(
+    "Not forgotten: a sign-in may be saved in this machine's credential store. Unlock it if needed, then run: dazzer auth logout"
+  );
+}
+function fail(message) {
+  writeErr(`Error: ${message}`);
+  process.exit(1);
+}
+
+// src/lib/refresh.ts
+var RefreshRejectedError = class extends Error {
+  constructor(oauthError) {
+    super(`Could not refresh token: ${oauthError}`);
+    this.oauthError = oauthError;
+    this.name = "RefreshRejectedError";
+  }
+  oauthError;
+};
+async function refreshAccessToken(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: options.clientId,
+    refresh_token: options.refreshToken
+  });
+  if (options.resource) {
+    params.set("resource", options.resource);
+  }
+  const res = await fetchFn(options.discovery.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    const error = typeof body.error === "string" ? body.error : "refresh_failed";
+    throw new RefreshRejectedError(error);
+  }
+  const accessToken = body.access_token;
+  const refreshToken = body.refresh_token;
+  if (typeof accessToken !== "string") {
+    throw new Error("The authorization server returned an unexpected refresh response.");
+  }
+  const newRefresh = typeof refreshToken === "string" ? refreshToken : options.refreshToken;
+  const expiresIn = typeof body.expires_in === "number" ? body.expires_in : null;
+  await options.tokenStore.save({ accessToken, refreshToken: newRefresh });
+  return { accessToken, refreshToken: newRefresh, expiresIn };
+}
+async function getValidAccessToken(options) {
+  const stored = await options.tokenStore.load();
+  if (!stored) {
+    return { status: "signed-out" };
+  }
+  try {
+    const refreshed = await refreshAccessToken({ ...options, refreshToken: stored.refreshToken });
+    return { status: "refreshed", expiresIn: refreshed.expiresIn };
+  } catch (err) {
+    if (err instanceof RefreshRejectedError) {
+      return { status: "rejected" };
+    }
+    return { status: "unreachable" };
+  }
+}
+async function persistLoginTokens(tokenStore, tokens) {
+  if (!tokens.refresh_token) {
+    throw new Error("The authorization server did not return a refresh token.");
+  }
+  const stored = {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token
+  };
+  await tokenStore.save(stored);
+  return stored;
+}
+
+// src/lib/api-client.ts
+function assertHttpsServiceAddress(address) {
+  let parsed;
+  try {
+    parsed = new URL(address);
+  } catch {
+    throw new Error(`Not a valid Dazzer address: ${address}. Check DAZZER_API_BASE_URL.`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `The Dazzer address must be an https URL (got ${parsed.protocol}//). Check DAZZER_API_BASE_URL.`
+    );
+  }
+  return address.replace(/\/$/, "");
+}
+function readOfferedPlaces(offered) {
+  if (!Array.isArray(offered)) return [];
+  return offered.flatMap((place) => {
+    if (typeof place !== "object" || place === null) return [];
+    const { scope_id: scopeId, space } = place;
+    if (typeof scopeId !== "number" || !Number.isFinite(scopeId)) return [];
+    if (typeof space !== "string" || space.trim() === "") return [];
+    return [{ scopeId, space }];
+  });
+}
+async function readJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function refusalDetail(body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const flat = body.detail;
+  if (typeof flat === "string" && flat !== "") return flat;
+  const enveloped = body.error;
+  if (typeof enveloped === "object" && enveloped !== null) {
+    const message = enveloped.message;
+    if (typeof message === "string" && message !== "") return message;
+  }
+  return void 0;
+}
+function refusalCode(body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const flat = body.code;
+  if (typeof flat === "string" && flat !== "") return flat;
+  const enveloped = body.error;
+  if (typeof enveloped === "object" && enveloped !== null) {
+    const code = enveloped.code;
+    if (typeof code === "string" && code !== "") return code;
+  }
+  return void 0;
+}
+function refusalPlaces(body) {
+  if (typeof body !== "object" || body === null) return {};
+  const offered = body.choices;
+  const places = readOfferedPlaces(offered);
+  const keep = body.keep_to_yourself;
+  return {
+    ...places.length > 0 ? { choices: places } : {},
+    ...typeof keep === "boolean" ? { keepToYourself: keep } : {}
+  };
+}
+async function resolveCredential(auth2) {
+  let held;
+  try {
+    held = await auth2.tokenStore.load();
+  } catch {
+    return { status: "store-unreadable" };
+  }
+  if (!held) return { status: "signed-out" };
+  let state;
+  try {
+    state = await getValidAccessToken(auth2);
+  } catch {
+    return { status: "store-unreadable" };
+  }
+  switch (state.status) {
+    case "signed-out":
+      return { status: "signed-out" };
+    case "rejected":
+      return { status: "sign-in-invalid" };
+    case "unreachable":
+      return { held: held.accessToken };
+    case "refreshed": {
+      try {
+        const rotated = await auth2.tokenStore.load();
+        return rotated ? { held: rotated.accessToken } : { status: "signed-out" };
+      } catch {
+        return { status: "store-unreadable" };
+      }
+    }
+  }
+}
+async function callDazzer(request) {
+  const base = assertHttpsServiceAddress(request.baseUrl);
+  const credential = await resolveCredential(request.auth);
+  if (!("held" in credential)) {
+    if (credential.status === "sign-in-invalid") {
+      return { status: "sign-in-invalid", message: SIGN_IN_NO_LONGER_VALID };
+    }
+    return { status: credential.status };
+  }
+  const fetchFn = request.fetchFn ?? fetch;
+  const headers = {
+    accept: "application/json",
+    authorization: `Bearer ${credential.held}`
+  };
+  if (request.body !== void 0) headers["content-type"] = "application/json";
+  let res;
+  try {
+    res = await fetchFn(`${base}${request.path}`, {
+      method: request.method ?? "POST",
+      headers,
+      body: request.body === void 0 ? void 0 : JSON.stringify(request.body)
+    });
+  } catch {
+    return { status: "unreachable", message: CANNOT_REACH_DAZZER };
+  }
+  if (res.status === 401) {
+    return { status: "sign-in-invalid", message: SIGN_IN_NO_LONGER_VALID };
+  }
+  const body = await readJson(res);
+  if (!res.ok) {
+    const detail = refusalDetail(body);
+    const code = refusalCode(body);
+    return {
+      status: "refused",
+      httpStatus: res.status,
+      ...detail === void 0 ? {} : { detail },
+      ...code === void 0 ? {} : { code },
+      ...refusalPlaces(body)
+    };
+  }
+  return { status: "ok", httpStatus: res.status, body };
+}
+
+// src/lib/config-store.ts
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import envPaths from "env-paths";
+
+// src/lib/discovery.ts
+function assertHttpsIssuer(issuer) {
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new Error(`Not a valid issuer URL: ${issuer}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`The issuer must be an https URL (got ${parsed.protocol}//). Check --issuer.`);
+  }
+  return issuer.replace(/\/$/, "");
+}
+var DiscoveryAnswered = class extends Error {
+  constructor(status) {
+    super(`Could not reach the authorization server (${status}). Check --issuer.`);
+    this.status = status;
+    this.name = "DiscoveryAnswered";
+  }
+  status;
+};
+var DiscoveryUnusable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DiscoveryUnusable";
+  }
+};
+async function discoverEndpoints(issuer, fetchFn = fetch) {
+  const normalized = assertHttpsIssuer(issuer);
+  const url = `${normalized}/.well-known/oauth-authorization-server`;
+  const res = await fetchFn(url);
+  if (!res.ok) {
+    throw new DiscoveryAnswered(res.status);
+  }
+  const body = await res.json();
+  const authorizationEndpoint = body.authorization_endpoint;
+  const deviceAuthorizationEndpoint = body.device_authorization_endpoint;
+  const tokenEndpoint = body.token_endpoint;
+  const revocationEndpoint = body.revocation_endpoint;
+  if (typeof tokenEndpoint !== "string" || tokenEndpoint === "") {
+    throw new DiscoveryUnusable("This authorization server is missing a token endpoint.");
+  }
+  const hasAuthorization = typeof authorizationEndpoint === "string" && authorizationEndpoint !== "";
+  const hasDevice = typeof deviceAuthorizationEndpoint === "string" && deviceAuthorizationEndpoint !== "";
+  const hasRevocation = typeof revocationEndpoint === "string" && revocationEndpoint !== "";
+  if (!hasAuthorization && !hasDevice) {
+    throw new DiscoveryUnusable(
+      "This authorization server does not support browser or device sign-in."
+    );
+  }
+  return {
+    issuer: typeof body.issuer === "string" ? body.issuer : normalized,
+    authorizationEndpoint: hasAuthorization ? authorizationEndpoint : void 0,
+    deviceAuthorizationEndpoint: hasDevice ? deviceAuthorizationEndpoint : void 0,
+    tokenEndpoint,
+    revocationEndpoint: hasRevocation ? revocationEndpoint : void 0
+  };
+}
+
+// src/lib/config-store.ts
+var paths = envPaths("dazzer", { suffix: "" });
+var CONFIG_FILE = join(paths.config, "auth.json");
+async function ensureConfigDir() {
+  await mkdir(paths.config, { recursive: true });
+}
+var MAX_CLIENT_ID_LENGTH = 512;
+async function saveAuthMetadata(meta) {
+  const issuer = assertHttpsIssuer(meta.issuer);
+  const clientId = typeof meta.clientId === "string" ? meta.clientId.trim() : "";
+  if (clientId === "" || clientId.length > MAX_CLIENT_ID_LENGTH || /[\r\n]/.test(clientId)) {
+    throw new Error("The authorization server returned an unusable client id.");
+  }
+  const expiresAt = typeof meta.expiresAt === "number" && Number.isFinite(meta.expiresAt) ? meta.expiresAt : null;
+  const savedToStore = typeof meta.savedToStore === "boolean" ? meta.savedToStore : void 0;
+  await ensureConfigDir();
+  const checked = { issuer, clientId, expiresAt, savedToStore };
+  await writeFile(CONFIG_FILE, `${JSON.stringify(checked, null, 2)}
+`, "utf8");
+}
+async function loadAuthMetadata() {
+  try {
+    const raw = await readFile(CONFIG_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.issuer !== "string" || typeof parsed.clientId !== "string") {
+      return null;
+    }
+    const { savedToStore, ...rest } = parsed;
+    return typeof savedToStore === "boolean" ? { ...rest, savedToStore } : rest;
+  } catch {
+    return null;
+  }
+}
+async function clearAuthMetadata() {
+  try {
+    await unlink(CONFIG_FILE);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function getConfigDir() {
+  return paths.config;
+}
+
+// src/lib/send.ts
+var DEFAULT_CHUNK_BYTES = 8 * 1024 * 1024;
+var DEFAULT_ATTEMPTS = 5;
+var BLOCK_BYTES = 256 * 1024;
+var RESUMABLE_START = "x-goog-resumable";
+function connectionDroppedLine(arrived, total) {
+  const percent = total > 0 ? Math.floor(arrived / total * 100) : 0;
+  return `Connection dropped at ${percent}% \u2014 picking up where it stopped.`;
+}
+function pieceEnd(start, total, chunkBytes) {
+  const proposed = Math.min(start + chunkBytes, total);
+  if (proposed >= total) return total;
+  const aligned = Math.floor(proposed / BLOCK_BYTES) * BLOCK_BYTES;
+  return aligned > start ? aligned : proposed;
+}
+function rangeReached(res) {
+  const range = res.headers.get("range");
+  if (range === null || range === "") return 0;
+  const match = /bytes=0-(\d+)/i.exec(range);
+  if (match?.[1] === void 0) return null;
+  return Number(match[1]) + 1;
+}
+async function openSession(uploadUrl, contentType, fetchFn) {
+  let res;
+  try {
+    res = await fetchFn(uploadUrl, {
+      method: "POST",
+      headers: { [RESUMABLE_START]: "start", "content-type": contentType },
+      // Never followed. The store answers this exchange with a 3xx-shaped status of its own that
+      // is not a redirect, and following it would send the session somewhere nobody signed.
+      redirect: "manual"
+    });
+  } catch {
+    return { started: null, reached: false };
+  }
+  if (res.status !== 200 && res.status !== 201) return { started: null, reached: true };
+  const location = res.headers.get("location");
+  return location === null || location === "" ? { started: null, reached: true } : { started: location };
+}
+async function askWhatArrived(session, total, fetchFn) {
+  let res;
+  try {
+    res = await fetchFn(session, {
+      method: "PUT",
+      headers: { "content-range": `bytes */${total}` },
+      redirect: "manual"
+    });
+  } catch {
+    return null;
+  }
+  if (res.status === 200 || res.status === 201) return total;
+  if (res.status !== 308) return null;
+  return rangeReached(res);
+}
+async function sendFile(input) {
+  const fetchFn = input.fetchFn ?? fetch;
+  const chunkBytes = input.chunkBytes ?? DEFAULT_CHUNK_BYTES;
+  let attemptsLeft = input.attempts ?? DEFAULT_ATTEMPTS;
+  const session = await openSession(input.uploadUrl, input.contentType, fetchFn);
+  if (session.started === null) {
+    return { status: "not-started", reached: session.reached };
+  }
+  let arrived = 0;
+  while (arrived < input.byteSize) {
+    const end = pieceEnd(arrived, input.byteSize, chunkBytes);
+    const piece = await input.read(arrived, end - arrived);
+    let res;
+    try {
+      res = await fetchFn(session.started, {
+        method: "PUT",
+        headers: {
+          "content-type": input.contentType,
+          "content-range": `bytes ${arrived}-${end - 1}/${input.byteSize}`
+        },
+        body: piece,
+        redirect: "manual"
+      });
+    } catch {
+      attemptsLeft -= 1;
+      if (attemptsLeft <= 0) return { status: "incomplete", arrived };
+      const confirmed = await askWhatArrived(session.started, input.byteSize, fetchFn);
+      if (confirmed === null) return { status: "incomplete", arrived };
+      if (confirmed >= input.byteSize) return { status: "sent", arrived: input.byteSize };
+      input.onNote?.(connectionDroppedLine(confirmed, input.byteSize));
+      arrived = confirmed;
+      continue;
+    }
+    if (res.status === 200 || res.status === 201)
+      return { status: "sent", arrived: input.byteSize };
+    if (res.status !== 308) return { status: "incomplete", arrived };
+    const reached = rangeReached(res);
+    if (reached === null || reached <= arrived) return { status: "incomplete", arrived };
+    arrived = reached;
+  }
+  return { status: "sent", arrived };
+}
+
+// src/lib/token-store.ts
+import { Entry } from "@napi-rs/keyring";
+var SERVICE = "dazzer-oauth-cli";
+var ACCESS_ACCOUNT = "access-token";
+var REFRESH_ACCOUNT = "refresh-token";
+var KeychainTokenStore = class {
+  constructor(openEntry = (account) => new Entry(SERVICE, account)) {
+    this.openEntry = openEntry;
+  }
+  openEntry;
+  async save(tokens) {
+    this.openEntry(ACCESS_ACCOUNT).setPassword(tokens.accessToken);
+    this.openEntry(REFRESH_ACCOUNT).setPassword(tokens.refreshToken);
+  }
+  async load() {
+    const accessToken = this.openEntry(ACCESS_ACCOUNT).getPassword();
+    const refreshToken = this.openEntry(REFRESH_ACCOUNT).getPassword();
+    if (!accessToken || !refreshToken) {
+      return null;
+    }
+    return { accessToken, refreshToken };
+  }
+  async loadRefreshToken() {
+    return this.openEntry(REFRESH_ACCOUNT).getPassword() || null;
+  }
+  /**
+   * NOTHING SAVED IS NOT AN ERROR, AND A FAILED REMOVAL IS NEVER HIDDEN. A delete of nothing answers
+   * `false` rather than throwing, so there is no missing-entry error to swallow. What the keychain
+   * library does throw is a removal the store refused. Swallowing that told a person they were signed
+   * out while their sign-in was still saved on the machine.
+   *
+   * THE LONG-LIVED HALF GOES FIRST, AND IF IT WILL NOT, NOTHING ELSE IS TOUCHED. Both then stay, so a
+   * second sign-out still finds a whole sign-in to cancel. Removing the access token anyway would leave
+   * only the refresh token — which can still renew a sign-in for weeks. Once the refresh token is gone,
+   * an access token left behind by a failed second removal expires within the hour.
+   */
+  async clear() {
+    this.openEntry(REFRESH_ACCOUNT).deletePassword();
+    this.openEntry(ACCESS_ACCOUNT).deletePassword();
+  }
+};
+function createTokenStore() {
+  return new KeychainTokenStore();
+}
+
+// src/lib/walk.ts
+import { readdir, realpath, stat } from "node:fs/promises";
+import { join as join2, sep } from "node:path";
+function inside(base, candidate) {
+  return candidate === base || candidate.startsWith(base.endsWith(sep) ? base : `${base}${sep}`);
+}
+async function walkFolder(root) {
+  const base = await realpath(root);
+  if (!(await stat(base)).isDirectory()) {
+    throw new Error("walkFolder was given something that is not a folder");
+  }
+  const files = [];
+  const skipped = [];
+  const handedOver = /* @__PURE__ */ new Set();
+  const walked = /* @__PURE__ */ new Set([base]);
+  async function descend(dir, prefix, isRoot = false) {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (isRoot) throw err;
+      skipped.push({ path: dir, relative: prefix.replace(/\/$/, ""), reason: "unreadable" });
+      return;
+    }
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const full = join2(dir, entry.name);
+      const relative = `${prefix}${entry.name}`;
+      if (entry.isSymbolicLink()) {
+        await followShortcut(full, relative);
+        continue;
+      }
+      if (entry.isDirectory()) {
+        await enter(full, relative);
+        continue;
+      }
+      if (entry.isFile()) take(full, relative);
+    }
+  }
+  async function enter(full, relative) {
+    let real;
+    try {
+      real = await realpath(full);
+    } catch {
+      skipped.push({ path: full, relative, reason: "unreadable" });
+      return;
+    }
+    if (walked.has(real)) return;
+    walked.add(real);
+    await descend(real, `${relative}/`);
+  }
+  function take(full, relative, real) {
+    const identity = real ?? full;
+    if (handedOver.has(identity)) return;
+    handedOver.add(identity);
+    files.push({ path: full, relative });
+  }
+  async function followShortcut(full, relative) {
+    let real;
+    try {
+      real = await realpath(full);
+    } catch {
+      skipped.push({ path: full, relative, reason: "unreadable" });
+      return;
+    }
+    if (!inside(base, real)) {
+      skipped.push({ path: full, relative, reason: "leads-out" });
+      return;
+    }
+    let kind;
+    try {
+      kind = await stat(real);
+    } catch {
+      skipped.push({ path: full, relative, reason: "unreadable" });
+      return;
+    }
+    if (kind.isDirectory()) {
+      if (walked.has(real)) return;
+      walked.add(real);
+      await descend(real, `${relative}/`);
+      return;
+    }
+    if (kind.isFile()) take(real, relative, real);
+  }
+  await descend(base, "", true);
+  files.sort((a, b) => a.relative < b.relative ? -1 : a.relative > b.relative ? 1 : 0);
+  skipped.sort((a, b) => a.relative < b.relative ? -1 : a.relative > b.relative ? 1 : 0);
+  return { files, skipped };
+}
+
+// src/commands/add.ts
+var SPACE_PATH = "/documents/v1/space";
+var LANDING_PATH = "/documents/v1/landing";
+var LANDED_PATH = "/documents/v1/landed";
+var cannotOpen = (name) => `Couldn't open ${name} \u2014 check its permissions.`;
+var SLOWING_DOWN = "Slowing down to stay within limits \u2014 still going.";
+var ALREADY_IN = "That one's already in \u2014 nothing to do.";
+var waitingOnYou = (many) => `${many} waiting on your answer.`;
+var collectedQuestion = (names, space) => `${names.length} of those look like newer versions of documents already in ${space} \u2014 ${listed(names)}. Treat all ${inWords(names.length)} as newer versions, keep all ${inWords(names.length)} as separate documents, or go through them one at a time?`;
+function listed(names) {
+  if (names.length <= 1) return names[0] ?? "";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+var NUMBER_WORDS = [
+  "",
+  "one",
+  "two",
+  "three",
+  "four",
+  "five",
+  "six",
+  "seven",
+  "eight",
+  "nine",
+  "ten"
+];
+var inWords = (many) => NUMBER_WORDS[many] ?? String(many);
+var cannotFind = (name) => `Couldn't find ${name}.`;
+var didNotFinish = (name) => `The send didn't finish \u2014 ${name} is not in Dazzer. Try again shortly.`;
+var wentWrong = (name) => `Something went wrong and ${name} is not in Dazzer. Try again shortly.`;
+var choiceLine = (space, scopeId) => `  ${asPrinted(space)} \u2014 ${scopeId}`;
+var answerWith = (keepToYourself, numbered) => {
+  const ways = [
+    '--space "<name>"',
+    ...numbered ? ["--space <number>"] : [],
+    ...keepToYourself ? ["--keep-to-myself"] : []
+  ];
+  const last = ways[ways.length - 1] ?? "";
+  const said = ways.length === 1 ? last : `${ways.slice(0, -1).join(", ")}, or ${last}`;
+  return `Run this again with ${said}.`;
+};
+var DECLARED_BY_EXTENSION = {
+  ".csv": "text/csv",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".markdown": "text/markdown",
+  ".md": "text/markdown",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".rtf": "application/rtf",
+  ".text": "text/plain",
+  ".txt": "text/plain",
+  ".webp": "image/webp"
+};
+var UNDECLARED = "application/octet-stream";
+function asPrinted(name) {
+  return name.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, " ").trim();
+}
+function readEnvelope(body) {
+  if (typeof body !== "object" || body === null) return null;
+  const data = body.data;
+  return typeof data === "object" && data !== null ? data : null;
+}
+function readChoices(data) {
+  return readOfferedPlaces(data.choices);
+}
+function readLanding(body) {
+  const data = readEnvelope(body);
+  if (data === null) return null;
+  const { ticket, upload_url: uploadUrl, content_type: contentType, space_name: space } = data;
+  if (typeof ticket !== "string" || ticket === "") return null;
+  if (typeof uploadUrl !== "string" || uploadUrl === "") return null;
+  if (typeof contentType !== "string" || contentType === "") return null;
+  return {
+    ticket,
+    upload_url: uploadUrl,
+    content_type: contentType,
+    space_name: typeof space === "string" && space.trim() !== "" ? space : null
+  };
+}
+function named(space) {
+  return space === null ? "that space" : space;
+}
+async function resolveAuth(options) {
+  const tokenStore = createTokenStore();
+  const meta = await loadAuthMetadata();
+  const issuer = meta?.issuer ?? options.issuer;
+  try {
+    const discovery = await discoverEndpoints(issuer);
+    return {
+      discovery,
+      clientId: meta?.clientId ?? options.clientId,
+      tokenStore,
+      resource: options.resource
+    };
+  } catch {
+    return null;
+  }
+}
+var FIRST_WAIT_MS = 1e3;
+var LONGEST_WAIT_MS = 3e4;
+var PACED_ATTEMPTS = 6;
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function voiceFor(write) {
+  let said = false;
+  return {
+    write,
+    slowingDown: () => {
+      if (said) return;
+      said = true;
+      write(SLOWING_DOWN);
+    }
+  };
+}
+async function callPaced(request, deps, voice) {
+  const wait = deps.delay ?? sleep;
+  let waiting = FIRST_WAIT_MS;
+  for (let attempt = 1; ; attempt += 1) {
+    const answer = await callDazzer(request);
+    if (answer.status !== "refused" || answer.httpStatus !== 429) return answer;
+    if (attempt >= PACED_ATTEMPTS) return answer;
+    voice.slowingDown();
+    await wait(waiting);
+    waiting = Math.min(waiting * 2, LONGEST_WAIT_MS);
+  }
+}
+function askedWith(options) {
+  if (options.keepToMyself === true) return { keep_to_myself: true };
+  const answer = options.space?.trim();
+  if (answer === void 0 || answer === "") return {};
+  return { space: /^\d+$/.test(answer) ? Number(answer) : answer };
+}
+async function settleSpace(options, auth2, deps, voice, name) {
+  const answer = await callPaced(
+    {
+      baseUrl: options.baseUrl,
+      path: SPACE_PATH,
+      method: "POST",
+      body: askedWith(options),
+      auth: auth2,
+      fetchFn: deps.fetchFn
+    },
+    deps,
+    voice
+  );
+  if (answer.status !== "ok") {
+    say(voice.write, answer, name);
+    return null;
+  }
+  const data = readEnvelope(answer.body);
+  if (data === null) {
+    voice.write(wentWrong(name));
+    return null;
+  }
+  const space = typeof data.space === "string" && data.space.trim() !== "" ? data.space : null;
+  if (data.settled === true) {
+    return { scopeId: typeof data.scope_id === "number" ? data.scope_id : null, space };
+  }
+  const question = typeof data.question === "string" && data.question !== "" ? data.question : null;
+  if (question === null) {
+    voice.write(wentWrong(name));
+    return null;
+  }
+  voice.write(question);
+  const choices = readChoices(data);
+  for (const choice of choices) voice.write(choiceLine(choice.space, choice.scopeId));
+  voice.write(answerWith(data.keep_to_yourself === true, choices.length > 0));
+  return null;
+}
+var HELD_FOR_AN_ANSWER = "same_name_different_contents";
+function fromAnswer(answer) {
+  if (answer.status === "refused") {
+    if (answer.code === HELD_FOR_AN_ANSWER && answer.detail !== void 0) {
+      return { kind: "held", question: answer.detail };
+    }
+    return {
+      kind: "refused",
+      ...answer.detail === void 0 ? {} : { said: answer.detail },
+      ...answer.code === void 0 ? {} : { code: answer.code },
+      // Carried, not filled in: absent stays absent, so nothing downstream can print an offer the
+      // service did not make.
+      ...answer.choices === void 0 ? {} : { choices: answer.choices },
+      ...answer.keepToYourself === void 0 ? {} : { keepToYourself: answer.keepToYourself }
+    };
+  }
+  return { kind: "stop", answer };
+}
+async function sendOne(input) {
+  const { deps, handle, options, voice } = input;
+  const described = await callPaced(
+    {
+      baseUrl: options.baseUrl,
+      path: LANDING_PATH,
+      method: "POST",
+      body: {
+        file_name: basename(input.path),
+        byte_size: input.byteSize,
+        mime_type: DECLARED_BY_EXTENSION[extname(input.path).toLowerCase()] ?? UNDECLARED,
+        ...input.scopeId === null ? {} : { scope_id: input.scopeId }
+      },
+      auth: input.auth,
+      fetchFn: deps.fetchFn
+    },
+    deps,
+    voice
+  );
+  if (described.status !== "ok") return fromAnswer(described);
+  const landing = readLanding(described.body);
+  if (landing === null) return { kind: "went-wrong" };
+  let couldNotRead = false;
+  let sent;
+  try {
+    sent = await sendFile({
+      uploadUrl: landing.upload_url,
+      contentType: landing.content_type,
+      byteSize: input.byteSize,
+      read: async (start, length) => {
+        try {
+          const buffer = Buffer.allocUnsafe(length);
+          let filled = 0;
+          while (filled < length) {
+            const { bytesRead } = await handle.read(
+              buffer,
+              filled,
+              length - filled,
+              start + filled
+            );
+            if (bytesRead === 0) break;
+            filled += bytesRead;
+          }
+          return filled === length ? buffer : buffer.subarray(0, filled);
+        } catch (err) {
+          couldNotRead = true;
+          throw err;
+        }
+      },
+      fetchFn: deps.uploadFetchFn,
+      chunkBytes: deps.chunkBytes,
+      attempts: deps.attempts,
+      onNote: voice.write
+    });
+  } catch (err) {
+    if (couldNotRead) return { kind: "cannot-read" };
+    throw err;
+  }
+  if (sent.status !== "sent") {
+    return sent.status === "not-started" && !sent.reached ? { kind: "not-reached" } : { kind: "did-not-finish" };
+  }
+  const landed = await callPaced(
+    {
+      baseUrl: options.baseUrl,
+      path: LANDED_PATH,
+      method: "POST",
+      body: { ticket: landing.ticket },
+      auth: input.auth,
+      fetchFn: deps.fetchFn
+    },
+    deps,
+    voice
+  );
+  if (landed.status !== "ok") return fromAnswer(landed);
+  const stored = readEnvelope(landed.body);
+  if (stored === null) return { kind: "went-wrong" };
+  if (stored.already_here === true) return { kind: "already-here" };
+  return {
+    kind: "added",
+    fileName: typeof stored.file_name === "string" ? asPrinted(stored.file_name) : asPrinted(basename(input.path)),
+    space: typeof stored.space_name === "string" ? stored.space_name : null
+  };
+}
+async function sendOneSafely(input) {
+  try {
+    return await sendOne(input);
+  } catch {
+    return { kind: "went-wrong" };
+  }
+}
+async function openOne(path) {
+  try {
+    return await open(path, "r");
+  } catch (err) {
+    return err?.code === "ENOENT" ? "missing" : "cannot-open";
+  }
+}
+var REASON_ORDER = [
+  "type-not-readable",
+  "too-large",
+  "already-here",
+  "refused",
+  "cannot-open",
+  "did-not-finish",
+  "leads-out"
+];
+var FROM_THE_SERVICE = {
+  type_not_readable: "type-not-readable",
+  too_large: "too-large"
+};
+var COUNTED = {
+  "type-not-readable": (many) => `${many} file type${many === 1 ? "" : "s"} I can't read`,
+  "too-large": (many) => `${many} too large`,
+  "already-here": (many) => `${many} already there`,
+  refused: (many) => `${many} refused`,
+  "cannot-open": (many) => `${many} I couldn't open`,
+  "did-not-finish": (many) => `${many} that didn't finish`,
+  "leads-out": (many) => `${many} shortcut${many === 1 ? "" : "s"} out of the folder`
+};
+var IN_DETAIL = {
+  "type-not-readable": "a file type I can't read",
+  "too-large": "too large",
+  "already-here": "already there",
+  refused: "refused",
+  "cannot-open": "I couldn't open it",
+  "did-not-finish": "the send didn't finish",
+  "leads-out": "a shortcut out of the folder"
+};
+function countLine(added, space, skipped, why) {
+  const documents = `${added} document${added === 1 ? "" : "s"} in ${named(space)}.`;
+  if (skipped.length === 0) return documents;
+  const reasons = REASON_ORDER.flatMap((reason) => {
+    const many = skipped.filter((skip) => skip.reason === reason).length;
+    return many === 0 ? [] : [COUNTED[reason](many)];
+  }).join(", ");
+  return `${documents} ${skipped.length} skipped \u2014 ${reasons}.${why ? "" : " Run with --why to see each."}`;
+}
+function whyLine(skip) {
+  const because = skip.said === void 0 ? IN_DETAIL[skip.reason] : skip.reason === "refused" ? `refused: ${skip.said}` : skip.said;
+  return `${asPrinted(skip.relative)} \u2014 ${because}`;
+}
+var FROM_THE_WALK = {
+  "leads-out": "leads-out",
+  unreadable: "cannot-open"
+};
+async function runAdd(options, deps = {}) {
+  const voice = voiceFor(deps.write ?? ((line) => process.stdout.write(`${line}
+`)));
+  const name = asPrinted(basename(options.file));
+  let isFolder;
+  try {
+    isFolder = (await statPath(options.file)).isDirectory();
+  } catch (err) {
+    voice.write(
+      err?.code === "ENOENT" ? cannotFind(name) : cannotOpen(name)
+    );
+    return { ok: false };
+  }
+  return isFolder ? await addFolder(options, deps, voice) : await addOneFile(options, deps, voice);
+}
+async function addOneFile(options, deps, voice) {
+  const name = asPrinted(basename(options.file));
+  const handle = await openOne(options.file);
+  if (typeof handle === "string") {
+    voice.write(handle === "missing" ? cannotFind(name) : cannotOpen(name));
+    return { ok: false };
+  }
+  try {
+    const byteSize = (await handle.stat()).size;
+    const auth2 = deps.auth ?? await resolveAuth(options);
+    if (auth2 === null) {
+      voice.write(CANNOT_REACH_DAZZER);
+      return { ok: false };
+    }
+    const settled = await settleSpace(options, auth2, deps, voice, name);
+    if (settled === null) return { ok: false };
+    const outcome = await sendOneSafely({
+      path: options.file,
+      handle,
+      byteSize,
+      scopeId: settled.scopeId,
+      options,
+      deps,
+      auth: auth2,
+      voice
+    });
+    switch (outcome.kind) {
+      case "added":
+        voice.write(`${outcome.fileName} is in Dazzer, in ${named(outcome.space)}.`);
+        return { ok: true };
+      case "already-here":
+        voice.write(ALREADY_IN);
+        return { ok: true };
+      // ONE FILE, ONE QUESTION, IN THE SERVICE'S OWN WORDS. It is the only thing that knows what it
+      // already holds and what the space is called, and rewriting its question here would be a
+      // second wording of a question somebody approved. Nothing was added and nobody has answered,
+      // so this run did not do what it was asked to — the same answer a run that asked where things
+      // go gives.
+      case "held":
+        voice.write(outcome.question);
+        return { ok: false };
+      // ONE FILE, ONE REFUSAL, AND THE PLACES IT OFFERED. The sentence is the service's and is
+      // printed as sent; the places under it are the service's too, and without them a refusal
+      // that says to name one of them is a dead end for the person holding this one file.
+      case "refused":
+        voice.write(outcome.said ?? wentWrong(name));
+        offerThePlaces(voice.write, outcome);
+        return { ok: false };
+      case "did-not-finish":
+        voice.write(didNotFinish(name));
+        return { ok: false };
+      case "not-reached":
+        voice.write(CANNOT_REACH_DAZZER);
+        return { ok: false };
+      case "went-wrong":
+        voice.write(wentWrong(name));
+        return { ok: false };
+      // IT OPENED AND WOULD NOT READ — answered in the approved sentence for a file that cannot be
+      // opened, because that is the same thing a person can act on, and never as a crash.
+      case "cannot-read":
+        voice.write(cannotOpen(name));
+        return { ok: false };
+      case "stop":
+        say(voice.write, outcome.answer, name);
+        return { ok: false };
+    }
+  } finally {
+    await handle.close();
+  }
+}
+async function addFolder(options, deps, voice) {
+  const name = asPrinted(basename(options.file));
+  const walked = await (async () => {
+    try {
+      return await walkFolder(options.file);
+    } catch {
+      return null;
+    }
+  })();
+  if (walked === null) {
+    voice.write(cannotOpen(name));
+    return { ok: false };
+  }
+  const auth2 = deps.auth ?? await resolveAuth(options);
+  if (auth2 === null) {
+    voice.write(CANNOT_REACH_DAZZER);
+    return { ok: false };
+  }
+  const settled = await settleSpace(options, auth2, deps, voice, name);
+  if (settled === null) return { ok: false };
+  const skipped = walked.skipped.map((skip) => ({
+    relative: skip.relative,
+    reason: FROM_THE_WALK[skip.reason]
+  }));
+  const held = [];
+  let added = 0;
+  let ran = true;
+  for (const file of walked.files) {
+    const handle = await openOne(file.path);
+    if (typeof handle === "string") {
+      skipped.push({ relative: file.relative, reason: "cannot-open" });
+      continue;
+    }
+    let outcome;
+    try {
+      outcome = await sendOneSafely({
+        path: file.path,
+        handle,
+        byteSize: (await handle.stat()).size,
+        scopeId: settled.scopeId,
+        options,
+        deps,
+        auth: auth2,
+        voice
+      });
+    } finally {
+      await handle.close();
+    }
+    if (outcome.kind === "added") {
+      added += 1;
+      continue;
+    }
+    if (outcome.kind === "already-here") {
+      skipped.push({ relative: file.relative, reason: "already-here" });
+      continue;
+    }
+    if (outcome.kind === "held") {
+      held.push({
+        relative: file.relative,
+        name: basename(file.path),
+        question: outcome.question
+      });
+      continue;
+    }
+    if (outcome.kind === "refused") {
+      skipped.push({
+        relative: file.relative,
+        // KEYED ON THE SERVICE'S CODE, never on the words it sent: the words are the person's and
+        // may be reworded, the code is the label the service publishes.
+        reason: (outcome.code === void 0 ? void 0 : FROM_THE_SERVICE[outcome.code]) ?? "refused",
+        ...outcome.said === void 0 ? {} : { said: outcome.said }
+      });
+      continue;
+    }
+    if (outcome.kind === "cannot-read") {
+      skipped.push({ relative: file.relative, reason: "cannot-open" });
+      continue;
+    }
+    if (outcome.kind === "did-not-finish" || outcome.kind === "went-wrong") {
+      skipped.push({ relative: file.relative, reason: "did-not-finish" });
+      continue;
+    }
+    if (outcome.kind === "not-reached") voice.write(CANNOT_REACH_DAZZER);
+    else say(voice.write, outcome.answer, name);
+    ran = false;
+    break;
+  }
+  skipped.sort((a, b) => a.relative < b.relative ? -1 : a.relative > b.relative ? 1 : 0);
+  held.sort((a, b) => a.relative < b.relative ? -1 : a.relative > b.relative ? 1 : 0);
+  voice.write(countLine(added, settled.space, skipped, options.why === true));
+  if (held.length > 0) voice.write(waitingOnYou(held.length));
+  if (options.why === true) for (const skip of skipped) voice.write(whyLine(skip));
+  const onlyOne = held.length === 1 ? held[0] : void 0;
+  if (onlyOne !== void 0) {
+    voice.write(onlyOne.question);
+  } else if (held.length > 1) {
+    voice.write(
+      collectedQuestion(
+        held.map((one) => asPrinted(one.name)),
+        named(settled.space)
+      )
+    );
+  }
+  return { ok: ran };
+}
+function offerThePlaces(write, offer) {
+  const places = offer.choices ?? [];
+  const keepToYourself = offer.keepToYourself === true;
+  if (places.length === 0 && !keepToYourself) return;
+  for (const place of places) write(choiceLine(place.space, place.scopeId));
+  write(answerWith(keepToYourself, places.length > 0));
+}
+function say(write, answer, name) {
+  switch (answer.status) {
+    case "refused":
+      write(answer.detail ?? wentWrong(name));
+      offerThePlaces(write, answer);
+      return;
+    case "sign-in-invalid":
+    case "unreachable":
+      write(answer.message);
+      return;
+    case "signed-out":
+      printAuthStatus({ state: "signed-out" });
+      return;
+    case "store-unreadable":
+      printAuthStatus({ state: "store-unreadable" });
+      return;
+    case "ok":
+      return;
+  }
+}
+
+// src/lib/device-flow.ts
+var DEFAULT_SCOPE = "openid offline_access";
+function parseDeviceResponse(body) {
+  const deviceCode = body.device_code;
+  const userCode = body.user_code;
+  const verificationUri = body.verification_uri;
+  const expiresIn = body.expires_in;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof expiresIn !== "number") {
+    throw new Error("The authorization server returned an unexpected device response.");
+  }
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: verificationUri,
+    verification_uri_complete: typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : void 0,
+    expires_in: expiresIn,
+    interval: typeof body.interval === "number" ? body.interval : void 0
+  };
+}
+async function requestDeviceCode(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const endpoint = options.discovery.deviceAuthorizationEndpoint;
+  if (!endpoint) {
+    throw new Error("This authorization server does not support device sign-in.");
+  }
+  const params = new URLSearchParams({
+    client_id: options.clientId,
+    scope: options.scope ?? DEFAULT_SCOPE
+  });
+  if (options.resource) {
+    params.set("resource", options.resource);
+  }
+  const res = await fetchFn(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  if (!res.ok) {
+    throw new Error(`Device sign-in request failed (${res.status}).`);
+  }
+  return parseDeviceResponse(await res.json());
+}
+async function pollForTokens(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const sleep2 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const baseIntervalMs = (options.deviceAuth.interval ?? 5) * 1e3;
+  let intervalMs = options.pollIntervalMs ?? baseIntervalMs;
+  const deadline = Date.now() + (options.maxWaitMs ?? options.deviceAuth.expires_in * 1e3);
+  while (Date.now() < deadline) {
+    await sleep2(intervalMs);
+    const params = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: options.deviceCode,
+      client_id: options.clientId
+    });
+    if (options.resource) {
+      params.set("resource", options.resource);
+    }
+    const res = await fetchFn(options.discovery.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: params.toString()
+    });
+    const body = await res.json();
+    if (res.ok) {
+      const accessToken = body.access_token;
+      if (typeof accessToken !== "string") {
+        throw new Error("The authorization server returned an unexpected token response.");
+      }
+      return {
+        access_token: accessToken,
+        refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+        expires_in: typeof body.expires_in === "number" ? body.expires_in : void 0,
+        token_type: typeof body.token_type === "string" ? body.token_type : void 0
+      };
+    }
+    const error = typeof body.error === "string" ? body.error : "unknown_error";
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    if (error === "access_denied") {
+      throw new Error("Sign-in was denied.");
+    }
+    if (error === "expired_token") {
+      throw new Error("The device code expired. Run auth login again.");
+    }
+    throw new Error(`Token request failed: ${error}`);
+  }
+  throw new Error("Timed out waiting for sign-in. Run auth login again.");
+}
+
+// src/lib/loopback-flow.ts
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+// ../auth-ui/dist/html.js
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+
+// ../auth-ui/dist/theme.js
+var TOKENS = {
+  orange: "#ff5000",
+  orangeMid: "#ee7d4e",
+  lavender: "#dae2ff",
+  skyMid: "#d2e7f3",
+  ink: "#000000",
+  inkSoft: "#0d0d0d",
+  muted: "#595959",
+  line: "#e6e1da",
+  error: "#8a2a00",
+  gbtnBorder: "#DADCE0",
+  gbtnText: "#3C4043"
+};
+var baseCss = `
+:root{--orange:${TOKENS.orange};--orange-mid:${TOKENS.orangeMid};--lavender:${TOKENS.lavender};--sky-mid:${TOKENS.skyMid};--ink:${TOKENS.ink};--ink-soft:${TOKENS.inkSoft};--muted:${TOKENS.muted};--line:${TOKENS.line};--error:${TOKENS.error};--gbtn-border:${TOKENS.gbtnBorder};--gbtn-text:${TOKENS.gbtnText};--serif:'Source Serif 4',Georgia,serif;--mono:'IBM Plex Mono',ui-monospace,monospace;}
+*{box-sizing:border-box;margin:0;padding:0;}html,body{height:100%;}
+body{font-family:var(--mono);color:var(--ink);
+background:linear-gradient(180deg,${TOKENS.orange} 0%,${TOKENS.orange} 12.98%,${TOKENS.skyMid} 69.23%,${TOKENS.lavender} 100%);
+-webkit-font-smoothing:antialiased;display:flex;align-items:center;justify-content:center;min-height:100vh;padding:32px 20px;}
+.card{width:100%;max-width:392px;max-height:calc(100dvh - 64px);overflow-y:auto;background:rgba(255,255,255,0.80);border:1px solid rgba(255,255,255,0.55);border-radius:16px;
+-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px);
+padding:40px 36px 30px;box-shadow:0 12px 40px rgba(0,0,0,.05),inset 0 1px 1px rgba(255,255,255,.35);}
+.mark{width:40px;height:40px;margin-bottom:22px;border-radius:22px;display:flex;align-items:center;justify-content:center;}
+.mark svg{display:block;width:100%;height:100%;}
+.icon{width:46px;height:46px;margin:0 auto 18px;display:block;}
+h1{font-family:var(--serif);font-weight:600;font-size:21px;letter-spacing:-.015em;margin-bottom:7px;}
+h1 em{font-weight:600;font-style:italic;}
+.sub{font-size:14px;line-height:1.5;color:var(--muted);margin-bottom:24px;}
+.sub strong{color:var(--ink);font-weight:600;}
+p{font-size:14px;line-height:1.55;color:var(--muted);}
+.perms-label{font-size:13px;font-weight:600;color:var(--ink);margin-bottom:10px;}
+.perms{list-style:none;margin:0 0 24px;padding:16px;background:#fff;border:1px solid var(--line);border-radius:10px;display:grid;gap:11px;}
+.perms li{position:relative;padding-left:18px;font-size:13.5px;color:var(--muted);line-height:1.35;}
+.perms li::before{content:"";position:absolute;left:1px;top:7px;width:6px;height:6px;border-radius:50%;background:var(--orange);}
+.actions{display:flex;flex-direction:column;gap:10px;margin-bottom:4px;}
+.btn{width:100%;height:44px;border-radius:6px;font-family:var(--mono);font-weight:600;font-size:14px;cursor:pointer;
+display:inline-flex;align-items:center;justify-content:center;transition:background .15s ease,box-shadow .15s ease,border-color .15s ease;}
+.btn:focus-visible{outline:2px solid var(--ink);outline-offset:2px;}
+.btn-primary{border:0;background:var(--orange);color:#fff;}
+.btn-primary:hover{background:#e64800;box-shadow:0 1px 3px rgba(0,0,0,.12);}
+.btn-secondary{border:1px solid var(--line);background:#fff;color:var(--ink);}
+.btn-secondary:hover{background:#fafafa;border-color:#d4cfc8;}
+.gbtn{width:100%;height:44px;border:1px solid var(--gbtn-border);border-radius:6px;background:#fff;color:var(--gbtn-text);
+font-family:'Roboto',-apple-system,sans-serif;font-weight:500;font-size:14px;cursor:pointer;
+display:inline-flex;align-items:center;justify-content:center;gap:12px;transition:background .15s ease,box-shadow .15s ease,border-color .15s ease;}
+.gbtn:hover{background:#F8FAFB;box-shadow:0 1px 3px rgba(0,0,0,.12);border-color:#C9CDD2;}
+.gbtn:disabled{opacity:.65;cursor:default;box-shadow:none;background:#fff;}
+.gbtn:focus-visible{outline:2px solid var(--ink);outline-offset:2px;}
+.gbtn svg{display:block;}
+.err{margin-top:14px;font-size:13px;color:var(--error);min-height:16px;}
+.trust,.foot{margin-top:22px;padding-top:18px;border-top:1px solid var(--line);display:flex;align-items:center;gap:7px;font-size:12px;color:var(--muted);}
+.trust svg,.foot svg{flex:none;}
+.code-input{width:100%;height:44px;margin:16px 0;padding:0 14px;border:1px solid var(--line);border-radius:6px;background:#fff;
+font-family:var(--mono);font-size:18px;letter-spacing:.08em;text-align:center;color:var(--ink);}
+.code-input:focus{outline:2px solid var(--ink);outline-offset:0;border-color:var(--ink);}
+.msg{margin-bottom:16px;font-size:14px;line-height:1.5;color:var(--muted);}
+.msg strong{color:var(--ink);font-weight:600;}
+`;
+var fontLinks = `<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:ital,wght@0,400;0,600;1,400&family=Roboto:wght@500&family=Source+Serif+4:ital,opsz,wght@0,8..60,400;0,8..60,600;1,8..60,400;1,8..60,600&display=swap" rel="stylesheet">`;
+
+// ../auth-ui/dist/marks.js
+var brandMark = `<svg viewBox="0 0 100 100" aria-hidden="true"><defs><linearGradient id="dz" x1="0" y1="0" x2="0" y2="1"><stop offset="0" stop-color="${TOKENS.orange}"/><stop offset=".52" stop-color="${TOKENS.orangeMid}"/><stop offset="1" stop-color="${TOKENS.lavender}"/></linearGradient></defs><rect width="100" height="100" rx="22" fill="url(#dz)"/><text x="50" y="54" text-anchor="middle" dominant-baseline="central" font-family="'Source Serif 4',Georgia,serif" font-size="68" fill="${TOKENS.inkSoft}">d</text></svg>`;
+var shieldIcon = `<svg width="13" height="13" viewBox="0 0 14 14" aria-hidden="true"><path d="M7 1l4.5 1.8v3.4c0 3-1.9 5-4.5 6.3C4.4 11.2 2.5 9.2 2.5 6.2V2.8L7 1z" fill="none" stroke="${TOKENS.muted}" stroke-width="1.1" stroke-linejoin="round"/></svg>`;
+var successMark = `<svg class="icon" viewBox="0 0 46 46" aria-hidden="true"><circle cx="23" cy="23" r="23" fill="#ffe3d6"/><path d="M14 23.5l6 6 12-13" fill="none" stroke="${TOKENS.orange}" stroke-width="2.6" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+var errorMark = `<svg class="icon" viewBox="0 0 46 46" aria-hidden="true"><circle cx="23" cy="23" r="23" fill="#f6e0d6"/><path d="M23 13v13M23 31.5v.5" fill="none" stroke="${TOKENS.error}" stroke-width="2.6" stroke-linecap="round"/></svg>`;
+
+// ../auth-ui/dist/layout.js
+var faviconHref = `data:image/svg+xml,${encodeURIComponent(brandMark)}`;
+function pageShell(innerHtml) {
+  return `<main class="card">${innerHtml}</main>`;
+}
+function renderDocument(params) {
+  const { title, body, headExtra, centered } = params;
+  const centerStyle = centered ? "body{text-align:center;}" : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="theme-color" content="${TOKENS.orange}">
+  <title>${title}</title>
+  <link rel="icon" type="image/svg+xml" href="${faviconHref}">
+  ${fontLinks}
+  <style>${baseCss}${centerStyle}${headExtra ?? ""}</style>
+</head>
+<body>
+  ${body}
+</body>
+</html>`;
+}
+
+// src/lib/loopback-flow.ts
+var DEFAULT_SCOPE2 = "openid offline_access brain";
+var CALLBACK_PATH = "/callback";
+var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+function base64url(buf) {
+  return buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function createPkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function launchBrowser(url) {
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function buildAuthorizeUrl(endpoint, params) {
+  const url = new URL(endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("code_challenge", params.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  if (params.resource) {
+    url.searchParams.set("resource", params.resource);
+  }
+  return url.toString();
+}
+function statusPage(title, heading, body, mark) {
+  return renderDocument({
+    title,
+    centered: true,
+    body: pageShell(`${mark}<h1>${heading}</h1><p>${body}</p>
+<div class="foot">Dazzer secure sign-in</div>`)
+  });
+}
+function successPage() {
+  return statusPage(
+    "Signed in to Dazzer",
+    "You're signed in",
+    "You can close this tab and return to your terminal.",
+    successMark
+  );
+}
+function errorPage(reason) {
+  return statusPage(
+    "Sign-in failed",
+    "Something went wrong",
+    `We couldn't complete sign-in (${escapeHtml(reason)}). Close this tab and run the command again.`,
+    errorMark
+  );
+}
+function sendHtml(res, html) {
+  res.statusCode = 200;
+  res.setHeader("Content-Type", "text/html; charset=utf-8");
+  res.end(html);
+}
+async function runLoopbackFlow(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const { authorizationEndpoint } = options.discovery;
+  if (!authorizationEndpoint) {
+    throw new Error("This authorization server does not support browser sign-in.");
+  }
+  const { verifier, challenge } = createPkce();
+  const state = base64url(randomBytes(16));
+  const scope = options.scope ?? DEFAULT_SCOPE2;
+  const { code, redirectUri } = await new Promise(
+    (resolve, reject) => {
+      let timer;
+      const server = createServer((req, res2) => {
+        const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (requestUrl.pathname !== CALLBACK_PATH) {
+          res2.statusCode = 404;
+          res2.end("Not found");
+          return;
+        }
+        const addr = server.address();
+        const redirect = `http://127.0.0.1:${addr.port}${CALLBACK_PATH}`;
+        const returnedState = requestUrl.searchParams.get("state");
+        const errorParam = requestUrl.searchParams.get("error");
+        const returnedCode = requestUrl.searchParams.get("code");
+        const finish = (err) => {
+          if (timer) clearTimeout(timer);
+          server.close();
+          if (err) reject(err);
+        };
+        if (errorParam) {
+          sendHtml(res2, errorPage(errorParam));
+          finish(new Error(`Sign-in failed: ${errorParam}.`));
+          return;
+        }
+        if (returnedState !== state) {
+          sendHtml(res2, errorPage("state_mismatch"));
+          finish(new Error("Sign-in failed: state mismatch."));
+          return;
+        }
+        if (!returnedCode) {
+          sendHtml(res2, errorPage("missing_code"));
+          finish(new Error("Sign-in failed: no authorization code returned."));
+          return;
+        }
+        sendHtml(res2, successPage());
+        finish();
+        resolve({ code: returnedCode, redirectUri: redirect });
+      });
+      server.on("error", (err) => {
+        if (timer) clearTimeout(timer);
+        reject(err);
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const addr = server.address();
+        const redirect = `http://127.0.0.1:${addr.port}${CALLBACK_PATH}`;
+        const authorizeUrl = buildAuthorizeUrl(authorizationEndpoint, {
+          clientId: options.clientId,
+          redirectUri: redirect,
+          scope,
+          state,
+          challenge,
+          resource: options.resource
+        });
+        timer = setTimeout(() => {
+          server.close();
+          reject(new Error("Timed out waiting for sign-in. Run the command again."));
+        }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        (options.openBrowser ?? launchBrowser)(authorizeUrl);
+        options.onPrompt?.(authorizeUrl);
+      });
+    }
+  );
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: options.clientId,
+    code_verifier: verifier
+  });
+  if (options.resource) {
+    params.set("resource", options.resource);
+  }
+  const res = await fetchFn(options.discovery.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    const error = typeof body.error === "string" ? body.error : "token_exchange_failed";
+    throw new Error(`Token request failed: ${error}`);
+  }
+  const accessToken = body.access_token;
+  if (typeof accessToken !== "string") {
+    throw new Error("The authorization server returned an unexpected token response.");
+  }
+  return {
+    access_token: accessToken,
+    refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    expires_in: typeof body.expires_in === "number" ? body.expires_in : void 0,
+    token_type: typeof body.token_type === "string" ? body.token_type : void 0
+  };
+}
+function browserLikelyAvailable() {
+  if (process.platform === "darwin" || process.platform === "win32") {
+    return true;
+  }
+  return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+
+// src/commands/login.ts
+async function runLogin(options) {
+  const tokenStore = createTokenStore();
+  let keychainOk = true;
+  let discovery;
+  try {
+    discovery = await discoverEndpoints(options.issuer);
+  } catch (err) {
+    fail(err instanceof Error ? err.message : "Could not reach the authorization server.");
+  }
+  const useLoopback = !options.noBrowser && Boolean(discovery.authorizationEndpoint) && browserLikelyAvailable();
+  let tokens;
+  try {
+    if (useLoopback) {
+      tokens = await runLoopbackFlow({
+        discovery,
+        clientId: options.clientId,
+        resource: options.resource,
+        onPrompt: printBrowserOpening
+      });
+    } else {
+      const deviceAuth = await requestDeviceCode({
+        discovery,
+        clientId: options.clientId
+      });
+      printDeviceInstructions(deviceAuth);
+      tokens = await pollForTokens({
+        discovery,
+        clientId: options.clientId,
+        deviceCode: deviceAuth.device_code,
+        deviceAuth,
+        resource: options.resource
+      });
+    }
+  } catch (err) {
+    fail(err instanceof Error ? err.message : "Sign-in failed.");
+  }
+  if (!tokens.refresh_token) {
+    fail("The authorization server did not return a refresh token.");
+  }
+  try {
+    await persistLoginTokens(tokenStore, tokens);
+  } catch {
+    keychainOk = false;
+  }
+  const expiresAt = typeof tokens.expires_in === "number" ? Date.now() + tokens.expires_in * 1e3 : null;
+  const previous = await loadAuthMetadata();
+  const keepPrevious = !keychainOk && previous?.savedToStore === true;
+  await saveAuthMetadata(
+    keepPrevious ? previous : {
+      issuer: discovery.issuer,
+      clientId: options.clientId,
+      expiresAt,
+      savedToStore: keychainOk
+    }
+  );
+  printLoginSuccess(keychainOk);
+  printConnectGuidance(options.resource ?? discovery.issuer, tokens.access_token);
+}
+
+// src/lib/revoke.ts
+var RevocationRefused = class extends Error {
+  constructor(status) {
+    super(`Token revocation failed (${status}).`);
+    this.status = status;
+    this.name = "RevocationRefused";
+  }
+  status;
+};
+var RevocationRedirected = class extends Error {
+  constructor(status) {
+    super(`Token revocation was redirected (${status}).`);
+    this.status = status;
+    this.name = "RevocationRedirected";
+  }
+  status;
+};
+async function revokeToken(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const params = new URLSearchParams({
+    token: options.token,
+    token_type_hint: options.tokenTypeHint,
+    client_id: options.clientId
+  });
+  const res = await fetchFn(options.revocationEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString(),
+    redirect: "manual"
+  });
+  if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+    throw new RevocationRedirected(res.status);
+  }
+  if (!res.ok) {
+    throw new RevocationRefused(res.status);
+  }
+}
+
+// src/commands/logout.ts
+function mayWorkLater(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function afterFailure(error) {
+  if (error instanceof DiscoveryUnusable) return "refused";
+  if (error instanceof DiscoveryAnswered || error instanceof RevocationRefused) {
+    return mayWorkLater(error.status) ? "unanswered" : "refused";
+  }
+  return "unanswered";
+}
+function sameOrigin(address, issuer) {
+  try {
+    return new URL(address).origin === new URL(issuer).origin;
+  } catch {
+    return false;
+  }
+}
+async function cancelAtServer(refreshToken, server, fetchFn) {
+  try {
+    assertHttpsIssuer(server.issuer);
+  } catch {
+    return "refused";
+  }
+  try {
+    const { revocationEndpoint } = await discoverEndpoints(server.issuer, fetchFn);
+    if (!revocationEndpoint || !sameOrigin(revocationEndpoint, server.issuer)) return "refused";
+    await revokeToken({
+      revocationEndpoint,
+      clientId: server.clientId,
+      token: refreshToken,
+      tokenTypeHint: "refresh_token",
+      fetchFn
+    });
+    return "cancelled";
+  } catch (error) {
+    return afterFailure(error);
+  }
+}
+async function removeRecordAfterSignOut() {
+  try {
+    await clearAuthMetadata();
+  } catch {
+  }
+}
+function defaultServer(defaults) {
+  try {
+    return defaults();
+  } catch {
+    return null;
+  }
+}
+async function endWithStoreUnopened(meta, options) {
+  const platform = options.platform ?? process.platform;
+  const mayForget = (platform === "linux" || platform === "freebsd") && meta?.savedToStore !== true;
+  if (!options.forgetThisMachine) {
+    printLogoutStoreLocked(mayForget);
+    return { ok: false };
+  }
+  if (!mayForget) {
+    printForgetRefused();
+    return { ok: false };
+  }
+  try {
+    await clearAuthMetadata();
+  } catch {
+    printForgetFailed(getConfigDir());
+    return { ok: false };
+  }
+  printLogoutForgotten();
+  return { ok: true };
+}
+async function runLogout(options) {
+  const tokenStore = options.tokenStore ?? createTokenStore();
+  const meta = await loadAuthMetadata();
+  let refreshToken;
+  try {
+    refreshToken = await tokenStore.loadRefreshToken();
+  } catch {
+    return endWithStoreUnopened(meta, options);
+  }
+  if (refreshToken === null) {
+    let passRemoved = true;
+    try {
+      await tokenStore.clear();
+    } catch {
+      passRemoved = false;
+    }
+    await removeRecordAfterSignOut();
+    if (!passRemoved) {
+      printLogoutPassLeft();
+    } else if (meta?.savedToStore === false) {
+      printLogoutSuccess();
+    } else {
+      printLogoutNothingFound();
+    }
+    return { ok: true };
+  }
+  if (options.forgetThisMachine) {
+    printForgetRefused();
+    return { ok: false };
+  }
+  const server = meta ?? defaultServer(options.defaults);
+  if (!server) {
+    printLogoutBadSettings();
+    return { ok: false };
+  }
+  const atServer = await cancelAtServer(refreshToken, server, options.fetchFn ?? fetch);
+  if (atServer === "unanswered") {
+    printLogoutNotCancelledYet();
+    return { ok: false };
+  }
+  try {
+    await tokenStore.clear();
+  } catch {
+    printLogoutIncomplete(atServer === "cancelled");
+    return { ok: false };
+  }
+  await removeRecordAfterSignOut();
+  if (atServer === "refused") {
+    printLogoutCannotCancel();
+  } else {
+    printLogoutSuccess();
+  }
+  return { ok: true };
+}
+
+// src/commands/status.ts
+async function runStatus(options) {
+  const tokenStore = createTokenStore();
+  const meta = await loadAuthMetadata();
+  let tokens;
+  try {
+    tokens = await tokenStore.load();
+  } catch {
+    printAuthStatus({ state: "store-unreadable" });
+    return;
+  }
+  if (!meta || !tokens) {
+    printAuthStatus({ state: "signed-out" });
+    return;
+  }
+  const issuer = options.issuer ?? meta.issuer;
+  const clientId = options.clientId ?? meta.clientId;
+  let discovery;
+  try {
+    discovery = await discoverEndpoints(issuer);
+  } catch {
+    printAuthStatus({
+      state: "unverified",
+      issuer: meta.issuer,
+      lastKnownExpiresAt: meta.expiresAt
+    });
+    return;
+  }
+  let result;
+  try {
+    result = await getValidAccessToken({
+      discovery,
+      clientId,
+      tokenStore,
+      resource: options.resource
+    });
+  } catch {
+    printAuthStatus({ state: "store-unreadable" });
+    return;
+  }
+  switch (result.status) {
+    case "signed-out":
+      printAuthStatus({ state: "signed-out" });
+      return;
+    case "rejected":
+      printAuthStatus({ state: "expired" });
+      return;
+    case "unreachable":
+      printAuthStatus({
+        state: "unverified",
+        issuer: meta.issuer,
+        lastKnownExpiresAt: meta.expiresAt
+      });
+      return;
+    case "refreshed": {
+      const expiresAt = result.expiresIn ? Date.now() + result.expiresIn * 1e3 : null;
+      await saveAuthMetadata({ issuer: discovery.issuer, clientId, expiresAt, savedToStore: true });
+      printAuthStatus({ state: "signed-in", issuer: discovery.issuer, expiresAt });
+      return;
+    }
+  }
+}
+
+// src/env.ts
+import { z } from "zod/v4";
+var cliEnvSchema = z.object({
+  /** Authorization server issuer URL. Defaults to production; override for local dev. */
+  DAZZER_AUTH_ISSUER: z.url().default("https://auth.dazzer.io"),
+  /** OAuth public client id. */
+  DAZZER_AUTH_CLIENT_ID: z.string().min(1).default("dazzer-cli-local"),
+  /** Resource indicator for JWT access tokens. Defaults to the production MCP server. */
+  DAZZER_AUTH_RESOURCE: z.url().default("https://graph.dazzer.io/mcp"),
+  /**
+   * Where Dazzer itself is — the main service, as opposed to the sign-in server the other three
+   * settings describe. It defaults to the same host the sign-in audience above already names,
+   * because they are the same service seen from two sides; the default lives here, beside the
+   * others, so no library and no command carries a production host of its own.
+   */
+  DAZZER_API_BASE_URL: z.url().default("https://graph.dazzer.io")
+});
+var cachedEnv = null;
+function validateEnv() {
+  if (!cachedEnv) {
+    cachedEnv = cliEnvSchema.parse(process.env);
+  }
+  return cachedEnv;
+}
+function signInServerDefaults() {
+  const settings = cliEnvSchema.pick({ DAZZER_AUTH_ISSUER: true, DAZZER_AUTH_CLIENT_ID: true }).parse(process.env);
+  return { issuer: settings.DAZZER_AUTH_ISSUER, clientId: settings.DAZZER_AUTH_CLIENT_ID };
+}
+
+// src/index.ts
+var require2 = createRequire(import.meta.url);
+var { version } = require2("../package.json");
+var program = new Command();
 program.name("dazzer").description("Sign in to Dazzer from your terminal").version(version);
-const auth = program.command("auth").description("Manage sign-in");
-auth
-    .command("login")
-    .description("Sign in through your browser; falls back to a device code when headless")
-    .option("--issuer <url>", "Authorization server URL")
-    .option("--client-id <id>", "OAuth client id")
-    .option("--resource <url>", "Resource indicator for access tokens")
-    .option("--no-browser", "Use the device-code flow instead of opening a browser")
-    .action(async (opts) => {
+program.command("add").description("Put a file, or a whole folder, into Dazzer").argument("<path>", "The file or folder to add").option("--space <name>", "The space to put it in \u2014 the name you were shown, or its number").option("--keep-to-myself", "Keep it to yourself, rather than putting it in a shared space").option("--why", "Show each document that was skipped, and why").action(async (file, opts) => {
+  const env = validateEnv();
+  const result = await runAdd({
+    file,
+    space: opts.space,
+    keepToMyself: opts.keepToMyself === true,
+    why: opts.why === true,
+    baseUrl: env.DAZZER_API_BASE_URL,
+    issuer: env.DAZZER_AUTH_ISSUER,
+    clientId: env.DAZZER_AUTH_CLIENT_ID,
+    resource: env.DAZZER_AUTH_RESOURCE
+  });
+  if (!result.ok) process.exitCode = 1;
+});
+var auth = program.command("auth").description("Manage sign-in");
+auth.command("login").description("Sign in through your browser; falls back to a device code when headless").option("--issuer <url>", "Authorization server URL").option("--client-id <id>", "OAuth client id").option("--resource <url>", "Resource indicator for access tokens").option("--no-browser", "Use the device-code flow instead of opening a browser").action(
+  async (opts) => {
     const env = validateEnv();
     await runLogin({
-        issuer: opts.issuer ?? env.DAZZER_AUTH_ISSUER,
-        clientId: opts.clientId ?? env.DAZZER_AUTH_CLIENT_ID,
-        resource: opts.resource ?? env.DAZZER_AUTH_RESOURCE,
-        noBrowser: opts.browser === false,
+      issuer: opts.issuer ?? env.DAZZER_AUTH_ISSUER,
+      clientId: opts.clientId ?? env.DAZZER_AUTH_CLIENT_ID,
+      resource: opts.resource ?? env.DAZZER_AUTH_RESOURCE,
+      noBrowser: opts.browser === false
     });
+  }
+);
+auth.command("logout").description("Cancel your sign-in and remove it from this machine").option(
+  "--forget-this-machine",
+  "On a machine with no credential store, remove its sign-in record without cancelling anything"
+).action(async (opts) => {
+  const result = await runLogout({
+    defaults: signInServerDefaults,
+    forgetThisMachine: opts.forgetThisMachine === true
+  });
+  if (!result.ok) process.exitCode = 1;
 });
-auth
-    .command("logout")
-    .description("Sign out and remove stored tokens")
-    .action(async () => {
-    await runLogout();
-});
-auth
-    .command("status")
-    .description("Show sign-in status")
-    .option("--issuer <url>", "Authorization server URL")
-    .option("--client-id <id>", "OAuth client id")
-    .option("--resource <url>", "Resource indicator for access tokens")
-    .action(async (opts) => {
-    await runStatus({
-        issuer: opts.issuer,
-        clientId: opts.clientId,
-        resource: opts.resource,
-    });
+auth.command("status").description("Show sign-in status").option("--issuer <url>", "Authorization server URL").option("--client-id <id>", "OAuth client id").option("--resource <url>", "Resource indicator for access tokens").action(async (opts) => {
+  await runStatus({
+    issuer: opts.issuer,
+    clientId: opts.clientId,
+    resource: opts.resource
+  });
 });
 program.parseAsync(process.argv).catch((err) => {
-    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
-    process.exit(1);
+  process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
 });