driggsby 0.6.3 → 0.7.1

package/README.md

@@ -35,7 +35,9 @@ https://app.driggsby.com/mcp
 
 Some driggsby commands work with your Driggsby account directly and need
 an app token saved on your machine: run
-`npx driggsby@latest login` and approve the page it opens. The token is
+`npx driggsby@latest login` and approve the page it opens (approving in a
+browser on another computer shows a code to paste, or to finish with
+`npx driggsby@latest login --code <CODE>`). The token is
 stored in your platform keychain when one is available, otherwise in
 `~/.driggsby/credentials.json`, and is never printed.
 `npx driggsby@latest logout` removes it.
@@ -67,6 +69,8 @@ can't reach it, but anything running locally can, so stop it when you're
 done: press Ctrl+C, or run `npx driggsby@latest dev --stop` in the app's
 folder. It also stops on its own after 30 minutes with no page open.
 Previews for several apps can run at once; each prints its own addresses.
+Each data call the page makes prints one line in the terminal, after any
+retries: a check and how long it took, or a cross and the reason.
 
 ## Deploying an app
 

package/dist/args-login.js

@@ -0,0 +1,41 @@
+// Argv parsing for driggsby login: help, and --code to finish a sign-in that
+// is waiting on this computer with the code its approval page showed. Same
+// contract as the rest of the tree: usage errors exit 2, echoed argv is
+// sanitized.
+import { helpCommand, unexpectedArgument } from "./args-shared.js";
+import { CliError } from "./cli-error.js";
+import { LOGIN_HELP } from "./help.js";
+const LOGIN_USAGE = "Usage: npx driggsby@latest login [--code <CODE>]";
+export function parseLogin(argv) {
+    let code = null;
+    let optionsEnded = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index] ?? "";
+        if (!optionsEnded && token === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && (token === "-h" || token === "--help")) {
+            return helpCommand(LOGIN_HELP);
+        }
+        if (!optionsEnded && code === null && token === "--code") {
+            code = requireCode(argv[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (!optionsEnded && code === null && token.startsWith("--code=")) {
+            code = requireCode(token.slice("--code=".length));
+            continue;
+        }
+        throw unexpectedArgument(token, LOGIN_USAGE);
+    }
+    return { kind: "login", code };
+}
+// A code is never empty or flag-like; a pasted one may carry spaces, which
+// Driggsby reads past.
+function requireCode(value) {
+    if (value === undefined || value.trim() === "" || value.startsWith("-")) {
+        throw new CliError(`error: a value is required for '--code <CODE>' but none was supplied\n\n${LOGIN_USAGE}\n\nFor more information, try '--help'.`, 2);
+    }
+    return value;
+}

package/dist/args.js

@@ -10,13 +10,14 @@ import { parseDeploy, parseRollback, parseVersions } from "./args-deploy.js";
 import { parseDev } from "./args-dev.js";
 import { parseDelete } from "./args-delete.js";
 import { parseInit } from "./args-init.js";
+import { parseLogin } from "./args-login.js";
 import { parseMcpSetup } from "./args-mcp-setup.js";
 import { parseQuery } from "./args-query.js";
 import { parseRules } from "./args-rules.js";
 import { removeDashesTip, similarArgumentTip, unexpectedArgument, unexpectedFlagValue, } from "./args-shared.js";
 import { didYouMean } from "./clap-suggestions.js";
 import { CliError } from "./cli-error.js";
-import { LOGIN_HELP, LOGOUT_HELP, MCP_HELP, ROOT_HELP } from "./help.js";
+import { LOGOUT_HELP, MCP_HELP, ROOT_HELP } from "./help.js";
 import { sanitizeForTerminal } from "./terminal-text.js";
 export {} from "./args-shared.js";
 const ROOT_USAGE = "Usage: npx driggsby@latest <COMMAND>";
@@ -90,7 +91,7 @@ function dispatchSubcommand(name, rest) {
         case "mcp":
             return parseLevel(MCP_LEVEL, rest);
         case "login":
-            return parseBareCommand({ kind: "login" }, LOGIN_HELP, "Usage: npx driggsby@latest login", rest);
+            return parseLogin(rest);
         case "logout":
             return parseBareCommand({ kind: "logout" }, LOGOUT_HELP, "Usage: npx driggsby@latest logout", rest);
         case "init":
@@ -117,7 +118,7 @@ function dispatchSubcommand(name, rest) {
             throw new Error(`unhandled subcommand dispatch: ${name}`);
     }
 }
-// Parsing for commands that take no arguments beyond help: login and logout.
+// Parsing for commands that take no arguments beyond help: logout.
 // Same exit codes and error shape as the rest of the tree, no clap quirks.
 function parseBareCommand(command, helpText, usage, argv) {
     let optionsEnded = false;

package/dist/dev/app-policy.js

@@ -0,0 +1,78 @@
+// The security headers on every app-origin response, the service worker
+// the app origin hands out, and the policy the host page requires of its
+// frame: a copy of what Driggsby's serving host and console do for a
+// deployed app, so the preview refuses what a deployed app is refused and a
+// page that works here works once deployed. The Driggsby service is
+// canonical: change it there first, then mirror it here.
+//
+// The content security policy keeps the page's loads on its own origin
+// (another site's script, font, image, or fetch is refused), refuses frames,
+// objects, forms, and eval, and sandboxes the page as the serving host does.
+// frame-ancestors names the host page, the only page that may frame the
+// app. A file that can run script (a page, an SVG, JavaScript) also carries
+// Connection-Allowlist, which has Chrome refuse any connection the page
+// starts to anywhere else, WebRTC included. Any other file gets neither the
+// list nor script: its sandbox grants nothing, so it opens in an origin of
+// its own, as it does deployed. Never widen the list to other files; the
+// serving host sends it only where script can run.
+const SCRIPT_MEDIA_TYPES = new Set([
+    "text/html",
+    "image/svg+xml",
+    "text/javascript",
+    "application/javascript",
+]);
+const POLICY_DIRECTIVES = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+];
+// What the host page requires of every document its frame shows (the
+// iframe's csp attribute), as the console does: it binds even a document
+// that doesn't come from this server.
+export const FRAME_POLICY = POLICY_DIRECTIVES.join("; ");
+// The only service worker either preview origin hands out, verbatim from
+// the serving host. An app's own worker could answer the frame's
+// navigations with documents it builds, carrying none of these headers, and
+// on these fixed ports it would outlive the preview and answer the next
+// app's too; a worker some other local server once left on the host port
+// would answer the host page, which runs tools. This one listens for
+// nothing.
+export const INERT_SERVICE_WORKER = `// This origin's only service worker. It listens for nothing, so it answers
+// no request: every page and file comes from the network with the host's
+// own headers. It behaves like any default worker: it waits until no page
+// is using the worker before it, then takes over.
+`;
+// hostOrigin is empty until the host server has bound (a startup race
+// measured in milliseconds); until then nothing may frame the app.
+export function appResponseHeaders(hostOrigin, contentType) {
+    const mediaType = (contentType.split(";")[0] ?? "").trim().toLowerCase();
+    const runsScript = SCRIPT_MEDIA_TYPES.has(mediaType);
+    const directives = [
+        runsScript ? "sandbox allow-scripts allow-same-origin" : "sandbox",
+        ...POLICY_DIRECTIVES,
+        `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin}`,
+    ];
+    const headers = {
+        "Content-Security-Policy": directives.join("; "),
+        // The served content types are final; the browser never guesses.
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "no-referrer",
+        "Cross-Origin-Resource-Policy": "same-origin",
+        "Cross-Origin-Opener-Policy": "same-origin",
+        "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()",
+    };
+    if (hostOrigin !== "") {
+        headers["Allow-CSP-From"] = hostOrigin;
+    }
+    if (runsScript) {
+        headers["Connection-Allowlist"] = "(response-origin)";
+    }
+    return headers;
+}

package/dist/dev/dev-servers.js

@@ -5,6 +5,7 @@
 // only. The app token never appears here — the broker callback holds it in
 // the CLI process.
 import { createServer } from "node:http";
+import { appResponseHeaders, INERT_SERVICE_WORKER } from "./app-policy.js";
 import { DEV_IDENTITY_PATH } from "./dev-state.js";
 import { hostPageHtml, HOST_PAGE_JS } from "./host-page.js";
 import { serveStaticFile } from "./static-files.js";
@@ -15,13 +16,16 @@ import { APP_TOOL_ALLOWLIST } from "./tool-allowlist.js";
 export const GENERIC_TOOL_TROUBLE = "We couldn't run that just now. Try again in a moment.";
 export const TOOL_NOT_ALLOWED_MESSAGE = "That tool isn't available to Driggsby apps. Apps can use read-only tools like get_overview and list_accounts.";
 const MAX_TOOL_CALL_BODY_BYTES = 65_536;
+const PLAIN_TEXT = "text/plain; charset=utf-8";
+const JAVASCRIPT = "text/javascript; charset=utf-8";
 export async function startDevServers(options) {
     // Both origins bind and advertise 127.0.0.1: advertising "localhost"
     // while binding only the IPv4 loopback breaks on machines whose browser
     // resolves localhost to ::1 first.
     let appPortForGuard = 0;
-    // Filled in once the host server binds; app responses embed it in their
-    // frame-ancestors policy so only the real host page can frame the app.
+    // Filled in once the host server binds; app responses name it in their
+    // frame-ancestors and Allow-CSP-From, so only the real host page can
+    // frame the app.
     let hostOriginForFraming = "";
     const appServer = createServer((request, response) => {
         void handleAppRequest(options, appPortForGuard, hostOriginForFraming, request, response);
@@ -70,39 +74,41 @@ export async function startDevServers(options) {
 // The app origin: the SDK path, then the project's own files.
 // ---------------------------------------------------------------------------
 async function handleAppRequest(options, appPort, hostOrigin, request, response) {
-    // Only the real host page may frame the app: without this, any other
-    // loopback-served page could embed the app origin, pin itself as the
-    // app's host, and feed it fabricated numbers. Until the host server has
-    // bound (a startup race measured in milliseconds), nothing may frame it.
-    // nosniff keeps the browser honest about the served content types.
-    const appHeaders = {
-        "Content-Security-Policy": `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin};`,
-        "X-Content-Type-Options": "nosniff",
-    };
+    // Every response carries the deployed app's headers (app-policy.ts). Their
+    // frame-ancestors lets only the real host page frame the app: without it,
+    // any other loopback-served page could embed the app origin, pin itself
+    // as the app's host, and feed it fabricated numbers.
+    const plainTextHeaders = appResponseHeaders(hostOrigin, PLAIN_TEXT);
     // Same rebinding guard as the host origin: a page on another site that
     // tricked DNS into pointing here carries its own Host, and fails.
     if (!hostHeaderIsLocal(request.headers.host, appPort)) {
-        sendText(response, 403, "text/plain; charset=utf-8", "Forbidden.", appHeaders);
+        sendText(response, 403, PLAIN_TEXT, "Forbidden.", plainTextHeaders);
+        return;
+    }
+    // Every service worker script request, whatever path it names, gets the
+    // inert worker (app-policy.ts), as deployed. Browsers mark each one.
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER, appResponseHeaders(hostOrigin, JAVASCRIPT));
         return;
     }
     const path = requestPath(request);
     if (request.method !== "GET" && request.method !== "HEAD") {
-        sendText(response, 405, "text/plain; charset=utf-8", "Method not allowed.", appHeaders);
+        sendText(response, 405, PLAIN_TEXT, "Method not allowed.", plainTextHeaders);
         return;
     }
     if (path === "/-/driggsby-sdk.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", options.sdkBundle, appHeaders);
+        sendText(response, 200, JAVASCRIPT, options.sdkBundle, appResponseHeaders(hostOrigin, JAVASCRIPT));
         return;
     }
     const file = await serveStaticFile(options.serveDirectory, path);
     if (file === null) {
-        sendText(response, 404, "text/plain; charset=utf-8", "Not found.", appHeaders);
+        sendText(response, 404, PLAIN_TEXT, "Not found.", plainTextHeaders);
         return;
     }
     response.writeHead(file.status, {
         "Content-Type": file.contentType,
         "Cache-Control": "no-store",
-        ...appHeaders,
+        ...appResponseHeaders(hostOrigin, file.contentType),
     });
     response.end(file.body);
 }
@@ -117,6 +123,12 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         sendJson(response, 403, { ok: false, error: { message: "Forbidden." } });
         return;
     }
+    // The host page registers no worker, so a worker script request here is
+    // a foreign one; the inert worker replaces it (app-policy.ts).
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER);
+        return;
+    }
     const path = requestPath(request);
     if (request.method === "GET" && path === DEV_IDENTITY_PATH) {
         // Lets `dev --stop` (and `dev`) confirm that a record in ~/.driggsby
@@ -129,7 +141,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         return;
     }
     if (request.method === "GET" && path === "/host.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", HOST_PAGE_JS);
+        sendText(response, 200, JAVASCRIPT, HOST_PAGE_JS);
         return;
     }
     if (request.method === "GET" && path === "/events") {
@@ -150,7 +162,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         await handleToolCall(options, hostPort, request, response);
         return;
     }
-    sendText(response, 404, "text/plain; charset=utf-8", "Not found.");
+    sendText(response, 404, PLAIN_TEXT, "Not found.");
     return;
 }
 async function handleToolCall(options, hostPort, request, response) {
@@ -209,6 +221,9 @@ function requestPath(request) {
     const queryStart = url.indexOf("?");
     return queryStart === -1 ? url : url.slice(0, queryStart);
 }
+function isServiceWorkerScriptRequest(request) {
+    return request.headers["service-worker"] === "script" || request.headers["sec-fetch-dest"] === "serviceworker";
+}
 function hostHeaderIsLocal(host, port) {
     return host === `localhost:${String(port)}` || host === `127.0.0.1:${String(port)}`;
 }

package/dist/dev/host-page.js

@@ -5,6 +5,7 @@
 // inside Driggsby. The page carries no token and no data; every tool call
 // goes to the CLI's own /tool-calls endpoint, which holds the token and
 // enforces the allowlist and bounds.
+import { FRAME_POLICY } from "./app-policy.js";
 // The page's script is served as its own file so the page can carry a
 // Content-Security-Policy with no inline scripts.
 //
@@ -14,7 +15,11 @@
 // `appOrigin` is built by startDevServers from a literal plus a bound port
 // number, and `background` has passed readProjectConfig's strict hex-color
 // rule (or is null). Anything looser than those sources must not be
-// passed here.
+// passed here. FRAME_POLICY is a constant with no double quote in it.
+//
+// The frame gets the console's sandbox and, as its csp attribute, the
+// deployed policy (app-policy.ts), which Chrome then requires of every
+// document the frame shows, even one this server didn't send.
 export function hostPageHtml(slug, appOrigin, background) {
     return `<!doctype html>
 <html lang="en" data-app-origin="${appOrigin}">
@@ -84,7 +89,7 @@ export function hostPageHtml(slug, appOrigin, background) {
     <span class="slug">${slug}</span>
     <span class="mode">driggsby dev — your live data</span>
   </header>
-  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>
+  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin" csp="${FRAME_POLICY}"></iframe>
   <script type="module" src="/host.js"></script>
 </body>
 </html>

package/dist/help.js

@@ -64,10 +64,15 @@ app token that lets this machine read your Driggsby data, deploy Driggsby
 apps, and manage your transaction rules. The token is saved locally for
 other driggsby commands and is never printed.
 
-Usage: npx driggsby@latest login
+If you approve in a browser on another computer, the page shows a code
+instead. Paste it where login is waiting, or finish with --code.
+
+Usage: npx driggsby@latest login [--code <CODE>]
 
 Options:
-  -h, --help  Print help
+      --code <CODE>  Finish the sign-in waiting on this machine with the
+                     code its approval page showed
+  -h, --help         Print help
 `;
 export const LOGOUT_HELP = `Remove the saved Driggsby app token.
 

package/dist/login/await-token.js

@@ -0,0 +1,260 @@
+// The wait inside driggsby login, once the approval page is in front of the
+// person: the first of the loopback's code, a pasted code, or the claim
+// going away (declined or expired) ends it. Every code is traded with the
+// verifier; only that trade returns the token.
+import { CliError } from "../cli-error.js";
+import { pollClaimRequest, tradeCode } from "./claim-client.js";
+import {} from "./loopback.js";
+export const LOGIN_RETRY_COMMAND = "npx driggsby@latest login";
+export const CODE_COMMAND = "npx driggsby@latest login --code <CODE>";
+// Approving leaves at least this long to trade the code, even past the
+// link's own lifetime, so a late approval can still finish.
+export const CODE_WINDOW_MS = 300_000;
+// Driggsby's codes are four groups of five; a paste longer than this is
+// not one (the approval link, say), and is refused here without a trade.
+const MAX_CODE_CHARS = 64;
+// A trade that hits a momentary hiccup is tried again this many times.
+const TRADE_ATTEMPTS = 3;
+const TRADE_RETRY_MS = 2_000;
+// A code from the loopback is the only copy there is: when Driggsby can't
+// be reached, the wait keeps trying it this often until the wait ends.
+const LOOPBACK_RETRY_MS = 5_000;
+const CODE_SHAPE_REFUSED = "That doesn't look like a sign-in code. Copy the code the approval page\nshows.";
+const UNREACHABLE = "We couldn't reach Driggsby to finish signing in just now.";
+// The claim went away: declined, expired, or already spent. Distinct, so
+// login can tell it from other failures (another command may have spent it).
+export class ClaimGone extends CliError {
+}
+// The trades in flight. The trade that spends the claim makes the poll
+// read gone before the trade's own answer arrives; the poll waits for any
+// trade in flight so that answer speaks first.
+class Trades {
+    #inFlight = 0;
+    #started = 0;
+    #idle = [];
+    get started() {
+        return this.#started;
+    }
+    busy() {
+        return this.#inFlight > 0;
+    }
+    async run(work) {
+        this.#inFlight += 1;
+        this.#started += 1;
+        try {
+            return await work();
+        }
+        finally {
+            this.#inFlight -= 1;
+            if (this.#inFlight === 0) {
+                for (const resolve of this.#idle.splice(0)) {
+                    resolve();
+                }
+            }
+        }
+    }
+    idle() {
+        return this.#inFlight === 0 ? Promise.resolve() : new Promise((resolve) => this.#idle.push(resolve));
+    }
+}
+export async function awaitToken(sign, clock) {
+    const stop = new AbortController();
+    const trades = new Trades();
+    try {
+        const outcome = await Promise.race([
+            fromLoopback(sign, clock, trades, stop.signal),
+            fromPaste(sign, clock, trades, stop.signal),
+            fromPoll(sign, clock, trades, stop.signal),
+        ]);
+        if (outcome.kind === "error") {
+            throw outcome.error;
+        }
+        return outcome.appToken;
+    }
+    finally {
+        stop.abort();
+    }
+}
+// A browser on this computer handed over a code, or Driggsby's denial. Its
+// request waits on the loopback until the trade is done, so it lands on a
+// page that already says how it went. Any page on this computer can reach
+// the loopback, so a callback proves nothing by itself: a code that doesn't
+// trade is refused without saying where the approval page is, and a denial
+// counts only once Driggsby confirms the claim is gone.
+async function fromLoopback(sign, clock, trades, signal) {
+    if (sign.loopback === null) {
+        return never();
+    }
+    for (;;) {
+        const callback = await sign.loopback.next();
+        if (stopped(signal)) {
+            // The sign-in already ended; the page says how.
+            callback.answer(sign.landingUrl);
+            return never();
+        }
+        if (callback.kind === "denied") {
+            const mark = trades.started;
+            const poll = await pollLettingTradesSpeak(sign, trades, mark);
+            if (poll.kind === "approved") {
+                // A server older than PKCE handed this poll the token; it counts,
+                // as it does in fromPoll.
+                callback.answer(sign.landingUrl);
+                return { kind: "token", appToken: poll.appToken };
+            }
+            if (poll.kind === "gone") {
+                // A trade in flight may be what spent the claim; it speaks first.
+                await settleTrades(trades, mark);
+                callback.answer(sign.landingUrl);
+                return stopped(signal) ? never() : { kind: "error", error: declined() };
+            }
+            callback.refuse();
+            continue;
+        }
+        for (;;) {
+            const result = await trades.run(() => tradeWithRetries(sign, callback.code, clock, signal));
+            if (stopped(signal)) {
+                callback.refuse();
+                return never();
+            }
+            if (result.kind === "approved") {
+                callback.answer(sign.landingUrl);
+                return { kind: "token", appToken: result.appToken };
+            }
+            if (result.kind === "rejected") {
+                callback.refuse();
+                break;
+            }
+            // Unreachable: the code may still work, and it's the only copy.
+            await clock.sleep(LOOPBACK_RETRY_MS, signal);
+            if (stopped(signal)) {
+                return never();
+            }
+        }
+    }
+}
+// A code pasted at the prompt. A refused code asks again, so a typo costs
+// nothing; the claim's own expiry still ends the wait.
+async function fromPaste(sign, clock, trades, signal) {
+    if (sign.prompt === null) {
+        return never();
+    }
+    let question = sign.promptQuestion;
+    for (;;) {
+        const line = await sign.prompt.ask(question);
+        if (stopped(signal) || line === null) {
+            return never();
+        }
+        const code = line.trim();
+        if (code === "") {
+            continue;
+        }
+        const result = await trades.run(() => tradeWithRetries(sign, code, clock, signal));
+        if (stopped(signal)) {
+            return never();
+        }
+        if (result.kind === "approved") {
+            return { kind: "token", appToken: result.appToken };
+        }
+        question =
+            result.kind === "unreachable"
+                ? `${result.message}\nPaste the code again to retry: `
+                : `${result.message}\nCheck the code and paste it again: `;
+    }
+}
+// The claim's own state: declined or expired ends the wait. An approval
+// waiting for its code still polls as pending, so the wait runs past the
+// link's lifetime by up to the code window, until Driggsby says it's gone.
+// Driggsby never hands a PKCE claim's token to the poll; a server that did
+// (one older than PKCE) is still handing it to the CLI that made the claim,
+// so it counts.
+async function fromPoll(sign, clock, trades, signal) {
+    const ceiling = sign.deadline + CODE_WINDOW_MS;
+    while (clock.now() < ceiling) {
+        await clock.sleep(clock.pollIntervalMs, signal);
+        if (stopped(signal)) {
+            return never();
+        }
+        const mark = trades.started;
+        const result = await pollLettingTradesSpeak(sign, trades, mark);
+        if (stopped(signal)) {
+            return never();
+        }
+        if (result.kind === "approved") {
+            return { kind: "token", appToken: result.appToken };
+        }
+        if (result.kind === "gone") {
+            await settleTrades(trades, mark);
+            if (stopped(signal)) {
+                return never();
+            }
+            return {
+                kind: "error",
+                error: new ClaimGone("This sign-in link is no longer active — it may have been declined or timed out.\n\n" +
+                    `Start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1),
+            };
+        }
+    }
+    // A trade still in flight at the ceiling may be the one that spends it.
+    await settleTrades(trades, trades.started);
+    if (stopped(signal)) {
+        return never();
+    }
+    return {
+        kind: "error",
+        error: new CliError(`The sign-in link expired before it was approved.\n\nStart a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1),
+    };
+}
+// The claim's state. A poll that fails outright (an answer Driggsby never
+// gives) ends the wait, but only after any trade in flight speaks: that
+// trade may be what spent the claim, and its token must not be dropped.
+function pollLettingTradesSpeak(sign, trades, mark) {
+    return pollClaimRequest(sign.baseUrl, { claimRequestId: sign.claimRequestId, pollSecret: sign.pollSecret }).catch(async (error) => {
+        await settleTrades(trades, mark);
+        throw error;
+    });
+}
+// Waits out any trade that is in flight, or that started since mark, and
+// then one more turn, so a trade that spent the claim settles the race
+// before a "gone" or "expired" does.
+async function settleTrades(trades, mark) {
+    if (!trades.busy() && trades.started === mark) {
+        return;
+    }
+    await trades.idle();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+}
+export async function tradeWithRetries(sign, code, clock, signal) {
+    if (code === "" || code.length > MAX_CODE_CHARS) {
+        return { kind: "rejected", message: CODE_SHAPE_REFUSED };
+    }
+    for (let attempt = 1;; attempt += 1) {
+        if (attempt > 1 && signal !== undefined && stopped(signal)) {
+            return { kind: "unreachable", message: UNREACHABLE };
+        }
+        const result = await tradeCode(sign.baseUrl, {
+            claimRequestId: sign.claimRequestId,
+            code,
+            codeVerifier: sign.codeVerifier,
+        });
+        if (result.kind !== "transient") {
+            return result;
+        }
+        if (attempt >= TRADE_ATTEMPTS || (signal !== undefined && stopped(signal))) {
+            return { kind: "unreachable", message: UNREACHABLE };
+        }
+        await clock.sleep(TRADE_RETRY_MS, signal);
+    }
+}
+// A confirmed denial is the claim gone too, so a login whose sign-in
+// another command finished still tells that apart.
+function declined() {
+    return new ClaimGone(`This sign-in was declined.\n\nStart a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+}
+// Read through a call: the signal flips while this code awaits, which a
+// property check narrowed before the await would not see.
+function stopped(signal) {
+    return signal.aborted;
+}
+function never() {
+    return new Promise(() => undefined);
+}