gooseworks 0.4.4 → 0.5.0-dev.11.ed7fa068

package/dist/auth/device-flow.d.ts

@@ -0,0 +1,79 @@
+import type { OAuthResult } from './oauth-server';
+export interface PendingDeviceLogin {
+    device_code: string;
+    user_code: string;
+    link: string;
+    api_base: string;
+    /** ISO timestamp. */
+    expires_at: string;
+    /** Seconds between polls. */
+    interval: number;
+}
+export type Sleep = (ms: number, signal?: AbortSignal) => Promise<void>;
+export interface DeviceWaitDeps {
+    sleep?: Sleep;
+    now?: () => number;
+}
+export type DeviceFlowOutcome = {
+    status: 'pending';
+    pending: PendingDeviceLogin;
+} | {
+    status: 'done';
+    result: OAuthResult;
+};
+/** The server predates device sign-in (`/api/cli/device/start` returned 404). */
+export declare class DeviceFlowUnavailableError extends Error {
+    constructor();
+}
+/** Ctrl-C / SIGTERM while waiting. The pending request is kept so a rerun resumes. */
+export declare class DeviceLoginStoppedError extends Error {
+    constructor();
+}
+export declare const EXPIRED_MESSAGE = "This sign-in code expired. Run the command again for a new link.";
+export declare const DENIED_MESSAGE = "Sign-in was canceled in the browser.";
+export declare const APPROVAL_GRACE_MS: number;
+/**
+ * The saved device sign-in for `apiBase`, or null when the file is missing,
+ * broken, expired, or belongs to another API base.
+ */
+export declare function readPendingDeviceLogin(apiBase: string, now?: () => number): PendingDeviceLogin | null;
+export declare function clearPendingDeviceLogin(): void;
+/**
+ * The link the user opens. Built from the CLI's own FRONTEND_URL (the same
+ * source `/cli/auth` uses) so local/staging overrides keep working.
+ */
+export declare function deviceLink(userCode: string, ref?: string): string;
+/**
+ * The link to print for a new code. An explicit GOOSEWORKS_FRONTEND_URL (local
+ * testing) wins. Otherwise the server's own `verification_url_complete`: it
+ * knows which Growth app serves /link in its environment (make.gooseworks.ai
+ * in production, ads-staging.gooseworks.ai on staging), which the CLI's
+ * FRONTEND_URL does not (staging's points at the old GTM app). It is used only
+ * when it is an https GooseWorks address, or a local one for a local API;
+ * anything else falls back to FRONTEND_URL.
+ */
+export declare function chooseDeviceLink(serverLink: unknown, userCode: string, apiBase: string, ref?: string, env?: NodeJS.ProcessEnv): string;
+export declare function startDeviceLogin(apiBase: string, ref?: string, now?: () => number, sleep?: Sleep): Promise<PendingDeviceLogin>;
+/** Prints the link and code. Never opens a browser. */
+export declare function printDeviceInstructions(pending: PendingDeviceLogin, opts?: {
+    resumed?: boolean;
+    now?: () => number;
+}): void;
+/**
+ * Polls until the user approves, denies, or the code expires. On success the
+ * key is saved like a browser sign-in and the pending file is removed. The
+ * server decides expiry; the local cut-off (expiry plus the approval grace)
+ * only stops a server that never answers.
+ */
+export declare function waitForDeviceLogin(apiBase: string, pending: PendingDeviceLogin, deps?: DeviceWaitDeps): Promise<OAuthResult>;
+/**
+ * Resume a saved request for this API base, or start a new one; print the
+ * link; then either return at once (`wait: false`) or wait for approval.
+ * Resuming with `wait: false` asks the server first, so it never re-prints a
+ * code that was already approved, canceled or used.
+ */
+export declare function runDeviceFlow(apiBase: string, opts?: {
+    ref?: string;
+    wait?: boolean;
+} & DeviceWaitDeps): Promise<DeviceFlowOutcome>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/auth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5C,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;;CAKpD;AAED,sFAAsF;AACtF,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,eAAO,MAAM,eAAe,qEAAqE,CAAC;AAClG,eAAO,MAAM,cAAc,yCAAyC,CAAC;AAUrE,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAuD7C;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,kBAAkB,GAAG,IAAI,CAuB/G;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAKjE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAmBR;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,MAAiB,EAC5B,KAAK,GAAE,KAAiE,GACvE,OAAO,CAAC,kBAAkB,CAAC,CAsC7B;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACnD,IAAI,CAaN;AA0GD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,cAAmB,GAC3D,OAAO,CAAC,iBAAiB,CAAC,CAa5B"}

package/dist/auth/device-flow.js

@@ -0,0 +1,411 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPROVAL_GRACE_MS = exports.DENIED_MESSAGE = exports.EXPIRED_MESSAGE = exports.DeviceLoginStoppedError = exports.DeviceFlowUnavailableError = void 0;
+exports.readPendingDeviceLogin = readPendingDeviceLogin;
+exports.clearPendingDeviceLogin = clearPendingDeviceLogin;
+exports.deviceLink = deviceLink;
+exports.chooseDeviceLink = chooseDeviceLink;
+exports.startDeviceLogin = startDeviceLogin;
+exports.printDeviceInstructions = printDeviceInstructions;
+exports.waitForDeviceLogin = waitForDeviceLogin;
+exports.runDeviceFlow = runDeviceFlow;
+/**
+ * Device sign-in (GOOSE-3937) — the "TV login" pattern (RFC 8628 shape).
+ *
+ * The CLI asks the server for a short code, prints a link, and the user
+ * approves on any device. The CLI then collects its key by polling. Nothing
+ * travels through localhost, so this works when the shell runs in a cloud
+ * sandbox or over SSH and the browser is on a phone or laptop.
+ *
+ * `--no-wait` prints the link and exits; the pending request is saved in the
+ * profile dir so the next sign-in (e.g. `install --skills-only`) resumes it.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const environment_1 = require("../environment");
+const http_1 = require("../utils/http");
+const logger = __importStar(require("../utils/logger"));
+const credentials_1 = require("./credentials");
+/** The server predates device sign-in (`/api/cli/device/start` returned 404). */
+class DeviceFlowUnavailableError extends Error {
+    constructor() {
+        super("Device sign-in isn't available on this server yet.");
+        this.name = 'DeviceFlowUnavailableError';
+    }
+}
+exports.DeviceFlowUnavailableError = DeviceFlowUnavailableError;
+/** Ctrl-C / SIGTERM while waiting. The pending request is kept so a rerun resumes. */
+class DeviceLoginStoppedError extends Error {
+    constructor() {
+        super('Stopped waiting for sign-in. Run the command again to finish; the same link works until it expires.');
+        this.name = 'DeviceLoginStoppedError';
+    }
+}
+exports.DeviceLoginStoppedError = DeviceLoginStoppedError;
+exports.EXPIRED_MESSAGE = 'This sign-in code expired. Run the command again for a new link.';
+exports.DENIED_MESSAGE = 'Sign-in was canceled in the browser.';
+const REQUEST_TIMEOUT_MS = 15_000;
+// The collecting poll mints the key (and, for a new user, their workspace and
+// credits), so give it longer than the other calls.
+const POLL_TIMEOUT_MS = 60_000;
+// The server gives an approval its own 10 minutes to be collected, because in
+// a cloud agent the user approves and then has to go back and tell the agent.
+// So a saved request stays usable this long past its own expiry; the server
+// says "expired" if it really is.
+exports.APPROVAL_GRACE_MS = 10 * 60_000;
+const DEFAULT_EXPIRES_IN_S = 600;
+const DEFAULT_INTERVAL_S = 3;
+const MAX_INTERVAL_S = 60;
+function pendingFile() {
+    return path.join((0, environment_1.profileRoot)(), 'pending-login.json');
+}
+function trimBase(apiBase) {
+    return apiBase.replace(/\/+$/, '');
+}
+function saneInterval(value, fallback) {
+    const n = Number(value);
+    if (!Number.isFinite(n) || n <= 0)
+        return fallback;
+    return Math.min(Math.max(n, 1), MAX_INTERVAL_S);
+}
+function savePendingDeviceLogin(pending) {
+    const dir = (0, environment_1.profileRoot)();
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { mode: 0o700, recursive: true });
+    fs.writeFileSync(pendingFile(), JSON.stringify(pending, null, 2) + '\n', { mode: 0o600 });
+    fs.chmodSync(dir, 0o700);
+    fs.chmodSync(pendingFile(), 0o600);
+}
+/**
+ * The saved device sign-in for `apiBase`, or null when the file is missing,
+ * broken, expired, or belongs to another API base.
+ */
+function readPendingDeviceLogin(apiBase, now = Date.now) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(pendingFile(), 'utf-8'));
+        if (typeof parsed.device_code !== 'string' || !parsed.device_code ||
+            typeof parsed.user_code !== 'string' || !parsed.user_code ||
+            typeof parsed.link !== 'string' || !parsed.link ||
+            typeof parsed.api_base !== 'string' || typeof parsed.expires_at !== 'string')
+            return null;
+        if (trimBase(parsed.api_base) !== trimBase(apiBase))
+            return null;
+        const expiresAt = Date.parse(parsed.expires_at);
+        if (!Number.isFinite(expiresAt) || expiresAt + exports.APPROVAL_GRACE_MS <= now())
+            return null;
+        return {
+            device_code: parsed.device_code,
+            user_code: parsed.user_code,
+            link: parsed.link,
+            api_base: parsed.api_base,
+            expires_at: parsed.expires_at,
+            interval: saneInterval(parsed.interval, DEFAULT_INTERVAL_S),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function clearPendingDeviceLogin() {
+    try {
+        if (fs.existsSync(pendingFile()))
+            fs.unlinkSync(pendingFile());
+    }
+    catch {
+        // Ignore errors during cleanup
+    }
+}
+/**
+ * The link the user opens. Built from the CLI's own FRONTEND_URL (the same
+ * source `/cli/auth` uses) so local/staging overrides keep working.
+ */
+function deviceLink(userCode, ref) {
+    let link = `${config_1.FRONTEND_URL}/link?code=${encodeURIComponent(userCode)}`;
+    const trimmed = ref?.trim();
+    if (trimmed)
+        link += `&creator_ref=${encodeURIComponent(trimmed)}`;
+    return link;
+}
+function isLocalHost(hostname) {
+    return ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
+}
+/**
+ * The link to print for a new code. An explicit GOOSEWORKS_FRONTEND_URL (local
+ * testing) wins. Otherwise the server's own `verification_url_complete`: it
+ * knows which Growth app serves /link in its environment (make.gooseworks.ai
+ * in production, ads-staging.gooseworks.ai on staging), which the CLI's
+ * FRONTEND_URL does not (staging's points at the old GTM app). It is used only
+ * when it is an https GooseWorks address, or a local one for a local API;
+ * anything else falls back to FRONTEND_URL.
+ */
+function chooseDeviceLink(serverLink, userCode, apiBase, ref, env = process.env) {
+    if (env.GOOSEWORKS_FRONTEND_URL?.trim() || typeof serverLink !== 'string')
+        return deviceLink(userCode, ref);
+    let url;
+    try {
+        url = new URL(serverLink);
+    }
+    catch {
+        return deviceLink(userCode, ref);
+    }
+    const gooseworks = url.protocol === 'https:' && (url.hostname === 'gooseworks.ai' || url.hostname.endsWith('.gooseworks.ai'));
+    let localApi = false;
+    try {
+        localApi = isLocalHost(new URL(apiBase).hostname);
+    }
+    catch { /* not local */ }
+    const local = localApi && isLocalHost(url.hostname) && (url.protocol === 'http:' || url.protocol === 'https:');
+    if ((!gooseworks && !local) || url.username || url.password || url.hash || url.pathname.replace(/\/+$/, '') !== '/link') {
+        return deviceLink(userCode, ref);
+    }
+    // Same encoding as deviceLink(), so both paths print identical links.
+    const trimmed = ref?.trim();
+    url.search = `?code=${encodeURIComponent(userCode)}${trimmed ? `&creator_ref=${encodeURIComponent(trimmed)}` : ''}`;
+    return url.toString();
+}
+async function startDeviceLogin(apiBase, ref, now = Date.now, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    let res;
+    // Cloud agents share egress IPs, so a busy platform can hit the per-IP
+    // limit: back off and try a couple more times.
+    for (let attempt = 1; !res; attempt++) {
+        try {
+            res = await (0, http_1.requestJson)({
+                apiBase: trimBase(apiBase),
+                method: 'POST',
+                path: '/api/cli/device/start',
+                body: { scope_type: 'user' },
+                timeoutMs: REQUEST_TIMEOUT_MS,
+            });
+        }
+        catch (err) {
+            if (err instanceof http_1.HttpError && err.status === 404)
+                throw new DeviceFlowUnavailableError();
+            if (err instanceof http_1.HttpError && err.status === 429 && attempt < 3) {
+                await sleep(attempt * 2000);
+                continue;
+            }
+            throw err;
+        }
+    }
+    const data = res?.data;
+    if (!data || typeof data.device_code !== 'string' || !data.device_code || typeof data.user_code !== 'string' || !data.user_code) {
+        throw new Error('The server did not return a sign-in code. Please try again.');
+    }
+    const expiresInRaw = Number(data.expires_in);
+    const expiresIn = Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? expiresInRaw : DEFAULT_EXPIRES_IN_S;
+    const pending = {
+        device_code: data.device_code,
+        user_code: data.user_code,
+        link: chooseDeviceLink(data.verification_url_complete, data.user_code, apiBase, ref),
+        api_base: apiBase,
+        expires_at: new Date(now() + expiresIn * 1000).toISOString(),
+        interval: saneInterval(data.interval, DEFAULT_INTERVAL_S),
+    };
+    savePendingDeviceLogin(pending);
+    return pending;
+}
+/** Prints the link and code. Never opens a browser. */
+function printDeviceInstructions(pending, opts = {}) {
+    const now = opts.now ?? Date.now;
+    const left = Date.parse(pending.expires_at) - now();
+    const heading = opts.resumed ? 'Still waiting for you to approve:' : 'Sign in to GooseWorks from any device:';
+    logger.info(`${heading}\n        ${pending.link}`);
+    if (left > 0) {
+        const minutes = Math.max(1, Math.ceil(left / 60_000));
+        logger.info(`Code: ${pending.user_code} (expires in ${minutes} minute${minutes === 1 ? '' : 's'})`);
+    }
+    else {
+        // Past its approval deadline but inside the collection grace: the server
+        // still hands over the key if the user approved in time.
+        logger.info(`Code: ${pending.user_code}`);
+    }
+}
+const defaultSleep = (ms, signal) => new Promise((resolve) => {
+    const onAbort = () => { clearTimeout(timer); resolve(); };
+    const timer = setTimeout(() => {
+        signal?.removeEventListener('abort', onAbort);
+        resolve();
+    }, ms);
+    signal?.addEventListener('abort', onAbort, { once: true });
+});
+function credentialsFromPoll(apiBase, data) {
+    if (!data || typeof data.token !== 'string' || !data.token || typeof data.email !== 'string' || !data.email || typeof data.agent_id !== 'string' || !data.agent_id) {
+        throw new Error('The server sent an incomplete sign-in. Run the command again for a new link.');
+    }
+    const scopeType = data.scope_type === 'agent' || data.scope_type === 'user' ? data.scope_type : undefined;
+    return {
+        api_key: data.token,
+        email: data.email,
+        agent_id: data.agent_id,
+        api_base: data.api_base || apiBase,
+        ...(scopeType ? { scope_type: scopeType } : {}),
+        ...(data.default_agent_id ? { default_agent_id: data.default_agent_id } : {}),
+        ...(data.mcp_server_url ? { mcp_server_url: data.mcp_server_url } : {}),
+    };
+}
+/** One poll. Saves the key on success; never throws for a server answer. */
+async function pollOnce(apiBase, pending, interval, guard = (work) => work) {
+    let res;
+    try {
+        res = await guard((0, http_1.requestJson)({
+            apiBase: trimBase(apiBase),
+            method: 'POST',
+            path: '/api/cli/device/poll',
+            body: { device_code: pending.device_code },
+            timeoutMs: POLL_TIMEOUT_MS,
+        }));
+    }
+    catch (err) {
+        if (err instanceof DeviceLoginStoppedError)
+            throw err;
+        if (err instanceof http_1.HttpError && err.status === 404) {
+            clearPendingDeviceLogin();
+            return { kind: 'gone', message: exports.EXPIRED_MESSAGE };
+        }
+        if (err instanceof http_1.HttpError && err.status === 429) {
+            return { kind: 'waiting', interval: Math.min(interval + 2, MAX_INTERVAL_S) };
+        }
+        if (err instanceof http_1.HttpError && err.status >= 400 && err.status < 500) {
+            clearPendingDeviceLogin();
+            return { kind: 'gone', message: `Sign-in failed (status ${err.status}). Run the command again for a new link.` };
+        }
+        // 5xx, timeouts and network errors are transient.
+        return { kind: 'waiting', interval };
+    }
+    switch (res?.status) {
+        case 'success': {
+            // The code is single-use: once collected, the pending file is useless.
+            try {
+                const creds = credentialsFromPoll(apiBase, res.data);
+                if ((0, environment_1.getEnvironment)() === 'staging' && (!res.data?.api_base || new URL(res.data.api_base).origin !== new URL(apiBase).origin)) {
+                    throw new Error('The sign-in did not confirm the staging API');
+                }
+                (0, credentials_1.validateCredentials)(creds);
+                (0, credentials_1.saveCredentials)(creds);
+                return {
+                    kind: 'done',
+                    result: {
+                        api_key: creds.api_key,
+                        email: creds.email,
+                        agent_id: creds.agent_id,
+                        ...(creds.scope_type ? { scope_type: creds.scope_type } : {}),
+                        ...(creds.default_agent_id ? { default_agent_id: creds.default_agent_id } : {}),
+                        ...(creds.mcp_server_url ? { mcp_server_url: creds.mcp_server_url } : {}),
+                    },
+                };
+            }
+            finally {
+                clearPendingDeviceLogin();
+            }
+        }
+        case 'expired':
+            clearPendingDeviceLogin();
+            return { kind: 'gone', message: exports.EXPIRED_MESSAGE };
+        case 'denied':
+            clearPendingDeviceLogin();
+            return { kind: 'gone', message: exports.DENIED_MESSAGE };
+        case 'slow_down':
+            return { kind: 'waiting', interval: saneInterval(res.interval, Math.min(interval + 2, MAX_INTERVAL_S)) };
+        default:
+            // 'pending' (and anything unrecognised): keep the server's pace.
+            return { kind: 'waiting', interval: saneInterval(res?.interval, interval) };
+    }
+}
+/**
+ * Polls until the user approves, denies, or the code expires. On success the
+ * key is saved like a browser sign-in and the pending file is removed. The
+ * server decides expiry; the local cut-off (expiry plus the approval grace)
+ * only stops a server that never answers.
+ */
+async function waitForDeviceLogin(apiBase, pending, deps = {}) {
+    const sleep = deps.sleep ?? defaultSleep;
+    const now = deps.now ?? Date.now;
+    const giveUpAt = Date.parse(pending.expires_at) + exports.APPROVAL_GRACE_MS;
+    let interval = saneInterval(pending.interval, DEFAULT_INTERVAL_S);
+    const controller = new AbortController();
+    const stopped = new Promise((_, reject) => {
+        controller.signal.addEventListener('abort', () => reject(new DeviceLoginStoppedError()), { once: true });
+    });
+    stopped.catch(() => undefined);
+    const guard = (work) => Promise.race([work, stopped]);
+    const onSignal = () => controller.abort();
+    process.once('SIGINT', onSignal);
+    process.once('SIGTERM', onSignal);
+    try {
+        for (;;) {
+            const step = await pollOnce(apiBase, pending, interval, guard);
+            if (step.kind === 'done')
+                return step.result;
+            if (step.kind === 'gone')
+                throw new Error(step.message);
+            interval = step.interval;
+            if (!(now() < giveUpAt)) {
+                clearPendingDeviceLogin();
+                throw new Error(exports.EXPIRED_MESSAGE);
+            }
+            await guard(sleep(interval * 1000, controller.signal));
+        }
+    }
+    finally {
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
+    }
+}
+/**
+ * Resume a saved request for this API base, or start a new one; print the
+ * link; then either return at once (`wait: false`) or wait for approval.
+ * Resuming with `wait: false` asks the server first, so it never re-prints a
+ * code that was already approved, canceled or used.
+ */
+async function runDeviceFlow(apiBase, opts = {}) {
+    const now = opts.now ?? Date.now;
+    let existing = readPendingDeviceLogin(apiBase, now);
+    if (existing && opts.wait === false) {
+        const step = await pollOnce(apiBase, existing, existing.interval);
+        if (step.kind === 'done')
+            return { status: 'done', result: step.result };
+        if (step.kind === 'gone')
+            existing = null;
+    }
+    const pending = existing ?? await startDeviceLogin(apiBase, opts.ref, now, opts.sleep);
+    printDeviceInstructions(pending, { resumed: existing !== null, now });
+    if (opts.wait === false)
+        return { status: 'pending', pending };
+    const result = await waitForDeviceLogin(apiBase, pending, { sleep: opts.sleep, now });
+    return { status: 'done', result };
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/auth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgIA,wDAuBC;AAED,0DAMC;AAMD,gCAKC;AAeD,4CAyBC;AAED,4CA2CC;AAGD,0DAgBC;AAgHD,gDAoCC;AAQD,sCAgBC;AA9bD;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,sCAAyC;AACzC,gDAA6D;AAC7D,wCAAuD;AACvD,wDAA0C;AAC1C,+CAAuF;AAyBvF,iFAAiF;AACjF,MAAa,0BAA2B,SAAQ,KAAK;IACnD;QACE,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,sFAAsF;AACtF,MAAa,uBAAwB,SAAQ,KAAK;IAChD;QACE,KAAK,CAAC,qGAAqG,CAAC,CAAC;QAC7G,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAEY,QAAA,eAAe,GAAG,kEAAkE,CAAC;AACrF,QAAA,cAAc,GAAG,sCAAsC,CAAC;AAErE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,kCAAkC;AACrB,QAAA,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7C,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AA8B1B,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAW,GAAE,EAAE,oBAAoB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,QAAgB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA2B;IACzD,MAAM,GAAG,GAAG,IAAA,yBAAW,GAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,OAAe,EAAE,MAAoB,IAAI,CAAC,GAAG;IAClF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAgC,CAAC;QAClG,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;YAC7D,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS;YACzD,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;YAC/C,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YAC5E,OAAO,IAAI,CAAC;QACd,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,yBAAiB,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,uBAAuB;IACrC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,QAAgB,EAAE,GAAY;IACvD,IAAI,IAAI,GAAG,GAAG,qBAAY,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO;QAAE,IAAI,IAAI,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,UAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5G,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9H,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/G,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QACxH,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,GAAG,CAAC,MAAM,GAAG,SAAS,kBAAkB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,GAAY,EACZ,MAAoB,IAAI,CAAC,GAAG,EAC5B,QAAe,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAExE,IAAI,GAA8B,CAAC;IACnC,uEAAuE;IACvE,+CAA+C;IAC/C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAgB;gBACrC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC1B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;gBAC5B,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,0BAA0B,EAAE,CAAC;YAC3F,IAAI,GAAG,YAAY,gBAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC1G,MAAM,OAAO,GAAuB;QAClC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC;QACpF,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC5D,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KAC1D,CAAC;IACF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uDAAuD;AACvD,SAAgB,uBAAuB,CACrC,OAA2B,EAC3B,OAAkD,EAAE;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wCAAwC,CAAC;IAC9G,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,SAAS,gBAAgB,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;IACxE,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,OAAe,EAAE,IAAiC;IAC7E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnK,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO;QAClC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AASD,4EAA4E;AAC5E,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,OAA2B,EAC3B,QAAgB,EAChB,QAA6C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;IAE3D,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAA,kBAAW,EAAe;YAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;YAC1C,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB;YAAE,MAAM,GAAG,CAAC;QACtD,IAAI,GAAG,YAAY,gBAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnD,uBAAuB,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAe,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,YAAY,gBAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,YAAY,gBAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtE,uBAAuB,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,0CAA0C,EAAE,CAAC;QACnH,CAAC;QACD,kDAAkD;QAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,IAAA,4BAAc,GAAE,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7H,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAA,iCAAmB,EAAC,KAAK,CAAC,CAAC;gBAC3B,IAAA,6BAAe,EAAC,KAAK,CAAC,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/E,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,uBAAuB,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,SAAS;YACZ,uBAAuB,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAe,EAAE,CAAC;QACpD,KAAK,QAAQ;YACX,uBAAuB,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAc,EAAE,CAAC;QACnD,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC3G;YACE,iEAAiE;YACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,OAA2B,EAC3B,OAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,yBAAiB,CAAC;IACpE,IAAI,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAI,IAAgB,EAAc,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YACzB,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;gBACxB,uBAAuB,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAe,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,OAA0D,EAAE;IAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,IAAI,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,QAAQ,GAAG,IAAI,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,IAAI,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,uBAAuB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/auth/login-mode.d.ts

@@ -0,0 +1,25 @@
+export type LoginMode = 'device' | 'browser';
+export interface LoginModeOptions {
+    /** `--device` */
+    device?: boolean;
+    /** `--browser` */
+    browser?: boolean;
+    /** `--no-wait` (only makes sense with device sign-in). */
+    noWait?: boolean;
+    /** A saved, unexpired device sign-in exists for this API base. */
+    pendingLogin?: boolean;
+}
+/**
+ * Picks browser (localhost callback) or device (code + link) sign-in.
+ *
+ * Explicit flags win, then `GOOSEWORKS_LOGIN`, then a pending device sign-in,
+ * then environment heuristics that only fire where a local browser can't reach
+ * the CLI (SSH, CI, Linux with no display, containers). macOS/Windows desktops
+ * always get the browser flow by default. We can't rely on `open()` failing:
+ * open@7 resolves on Linux even with no browser.
+ */
+export declare function chooseLoginMode(opts: LoginModeOptions, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, exists?: (file: string) => boolean, readFile?: (file: string) => string): {
+    mode: LoginMode;
+    reason: string;
+};
+//# sourceMappingURL=login-mode.d.ts.map

package/dist/auth/login-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-mode.d.ts","sourceRoot":"","sources":["../../src/auth/login-mode.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAuB,EACjD,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiD,GAC5E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBrC"}

package/dist/auth/login-mode.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chooseLoginMode = chooseLoginMode;
+const fs = __importStar(require("fs"));
+function truthy(value) {
+    if (value === undefined)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v !== '' && v !== '0' && v !== 'false';
+}
+function isWsl(env, readFile) {
+    if (env.WSL_DISTRO_NAME)
+        return true;
+    try {
+        return readFile('/proc/version').toLowerCase().includes('microsoft');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Picks browser (localhost callback) or device (code + link) sign-in.
+ *
+ * Explicit flags win, then `GOOSEWORKS_LOGIN`, then a pending device sign-in,
+ * then environment heuristics that only fire where a local browser can't reach
+ * the CLI (SSH, CI, Linux with no display, containers). macOS/Windows desktops
+ * always get the browser flow by default. We can't rely on `open()` failing:
+ * open@7 resolves on Linux even with no browser.
+ */
+function chooseLoginMode(opts, env = process.env, platform = process.platform, exists = fs.existsSync, readFile = (file) => fs.readFileSync(file, 'utf-8')) {
+    if (opts.device)
+        return { mode: 'device', reason: '--device' };
+    if (opts.noWait)
+        return { mode: 'device', reason: '--no-wait' };
+    if (opts.browser)
+        return { mode: 'browser', reason: '--browser' };
+    const forced = env.GOOSEWORKS_LOGIN?.trim().toLowerCase();
+    if (forced === 'device' || forced === 'browser')
+        return { mode: forced, reason: `GOOSEWORKS_LOGIN=${forced}` };
+    if (opts.pendingLogin)
+        return { mode: 'device', reason: 'resuming a pending device sign-in' };
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return { mode: 'device', reason: 'SSH session' };
+    if (truthy(env.CI))
+        return { mode: 'device', reason: 'CI environment' };
+    if (platform === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY && !isWsl(env, readFile)) {
+        return { mode: 'device', reason: 'Linux without a display' };
+    }
+    if (exists('/.dockerenv') || exists('/run/.containerenv') || env.container || env.KUBERNETES_SERVICE_HOST) {
+        return { mode: 'device', reason: 'container' };
+    }
+    return { mode: 'browser', reason: 'default' };
+}
+//# sourceMappingURL=login-mode.js.map

package/dist/auth/login-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-mode.js","sourceRoot":"","sources":["../../src/auth/login-mode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,0CA6BC;AApED,uCAAyB;AAezB,SAAS,MAAM,CAAC,KAAyB;IACvC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,GAAsB,EAAE,QAAkC;IACvE,IAAI,GAAG,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAC7B,IAAsB,EACtB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,SAAoC,EAAE,CAAC,UAAU,EACjD,WAAqC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;IAE7E,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAElE,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,MAAM,EAAE,EAAE,CAAC;IAE/G,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAE9F,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE1G,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -1,4 +1,5 @@
-interface OAuthResult {
+export declare const OAUTH_TIMEOUT_MS = 300000;
+export interface OAuthResult {
     api_key: string;
     email: string;
     agent_id: string;
@@ -14,5 +15,4 @@ interface OAuthResult {
  *   authenticated attribution call.
  */
 export declare function runOAuthFlow(apiBase: string, attributionRef?: string): Promise<OAuthResult>;
-export {};
 //# sourceMappingURL=oauth-server.d.ts.map