hammerkit 1.22.0 → 1.24.0

package/dist/remote/credentials.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessToken = exports.removeToken = exports.saveToken = exports.getCredentialsPath = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+function getCredentialsPath(environment) {
+    return environment.processEnvs.HAMMERKIT_CREDENTIALS ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'credentials.json');
+}
+exports.getCredentialsPath = getCredentialsPath;
+async function readAll(environment) {
+    const path = getCredentialsPath(environment);
+    if (!(await environment.file.exists(path))) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(await environment.file.read(path));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        // a damaged file only costs a new sign-in
+        return {};
+    }
+}
+// Only the owner may read it, and it is replaced atomically. The temporary file
+// has a name nobody can guess and is created exclusively (never through a link
+// someone left behind), already private.
+async function writeAll(environment, all) {
+    const path = getCredentialsPath(environment);
+    await (0, promises_1.mkdir)((0, path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+    const file = await (0, promises_1.open)(temporary, 'wx', 0o600);
+    try {
+        await file.writeFile(JSON.stringify(all, null, 2));
+    }
+    finally {
+        await file.close();
+    }
+    try {
+        await (0, promises_1.rename)(temporary, path);
+    }
+    catch (e) {
+        await (0, promises_1.unlink)(temporary).catch(() => undefined);
+        throw e;
+    }
+}
+// A token that others can read is as good as published: it isn't used.
+async function assertPrivate(environment) {
+    const path = getCredentialsPath(environment);
+    if (process.platform === 'win32' || !(await environment.file.exists(path))) {
+        return;
+    }
+    const info = await (0, promises_1.stat)(path);
+    if ((info.mode & 0o077) !== 0 || (process.getuid && info.uid !== process.getuid())) {
+        throw new Error(`${path} must belong to you and be private, fix it with: chmod 600 ${path}, or sign in again`);
+    }
+}
+async function saveToken(environment, name, token) {
+    const all = await readAll(environment);
+    all[name] = token;
+    await writeAll(environment, all);
+}
+exports.saveToken = saveToken;
+async function removeToken(environment, name) {
+    const all = await readAll(environment);
+    if (!all[name]) {
+        return false;
+    }
+    delete all[name];
+    await writeAll(environment, all);
+    return true;
+}
+exports.removeToken = removeToken;
+// The access token for a registered server, or the reason there is none.
+async function getAccessToken(environment, name, server, now = Date.now()) {
+    await assertPrivate(environment);
+    const all = await readAll(environment);
+    const stored = Object.prototype.hasOwnProperty.call(all, name) ? all[name] : undefined;
+    const signIn = `sign in with: hammerkit remote login ${name}`;
+    if (!stored) {
+        throw new Error(`not signed in to ${name}, ${signIn}`);
+    }
+    if (stored.url !== server.url || stored.issuer !== server.issuer) {
+        throw new Error(`the sign-in to ${name} was made for another server, ${signIn}`);
+    }
+    if (stored.expiresAt <= now) {
+        throw new Error(`the sign-in to ${name} has expired, ${signIn}`);
+    }
+    return stored.accessToken;
+}
+exports.getAccessToken = getAccessToken;
+//# sourceMappingURL=credentials.js.map

package/dist/remote/device-login.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceLogin = void 0;
+const server_client_1 = require("./server-client");
+const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_SECONDS = 5;
+const FETCH_TIMEOUT_MS = 10000;
+const MIN_INTERVAL_SECONDS = 1;
+const MAX_LIFETIME_SECONDS = 30 * 60;
+const isLoopbackHost = (hostname) => ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
+// An endpoint must use the scheme of the issuer: loopback http is for a test
+// identity provider on this machine only, never beside an https issuer.
+function isSecure(url, issuer) {
+    if (typeof url !== 'string') {
+        return false;
+    }
+    try {
+        const parsed = new URL(url);
+        const issuerHost = new URL(issuer);
+        return (parsed.protocol === 'https:' ||
+            (parsed.protocol === 'http:' && isLoopbackHost(parsed.hostname) && issuerHost.protocol === 'http:'));
+    }
+    catch {
+        return false;
+    }
+}
+// Redirects are refused: a 307 would send the device code to another place.
+async function fetchJson(url, init = {}) {
+    let response;
+    try {
+        response = await fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    }
+    catch (e) {
+        throw new server_client_1.ServerError(`unable to reach ${url}: ${(0, server_client_1.printable)(e instanceof Error ? e.message : e)}`);
+    }
+    return { status: response.status, body: await response.json().catch(() => ({})) };
+}
+function postForm(url, form) {
+    return fetchJson(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams(form),
+    });
+}
+// `offline_access` asks for a refresh token, which is never kept.
+function normalizeScope(scope) {
+    return scope
+        .split(/\s+/)
+        .filter((part) => part && part !== 'offline_access')
+        .join(' ');
+}
+// The token is sent to the hammerkit server next, so it has to be meant for it:
+// a server that talked the user into a token for another service (Graph, a
+// cloud API) gets nothing.
+function checkToken(token, issuer, audience) {
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));
+    }
+    catch {
+        // handled below
+    }
+    const audiences = Array.isArray(payload?.aud) ? payload.aud : [payload?.aud];
+    if (payload?.iss !== issuer || !audiences.includes(audience)) {
+        throw new server_client_1.ServerError(`the identity provider issued a token that is not meant for ${(0, server_client_1.printable)(audience)}, it is not sent to the server`);
+    }
+}
+function abortable(sleep, signal) {
+    return async (ms) => {
+        if (signal?.aborted) {
+            throw new server_client_1.ServerError('login was cancelled');
+        }
+        await sleep(ms);
+    };
+}
+// OAuth device authorization grant (RFC 8628) against the issuer the server
+// names for the issuer registered with `remote add`. Works headless: nothing is
+// opened, the user visits the address on any device. The refresh token, if the
+// issuer sends one, is dropped on purpose: what is kept is one short-lived
+// access token, and signing in again is the way to renew it.
+async function deviceLogin(server, options) {
+    const sleep = abortable(options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))), options.signal);
+    const now = options.now ?? Date.now;
+    const discovery = await (0, server_client_1.getDiscovery)(server);
+    const offered = discovery.issuers.find((i) => i.issuer === server.issuer);
+    if (!offered) {
+        const accepted = discovery.issuers.map((i) => (0, server_client_1.printable)(i.issuer)).join(', ');
+        throw new server_client_1.ServerError(`${server.url} does not accept tokens from ${server.issuer} (it accepts ${accepted})`);
+    }
+    if (!offered.clientId) {
+        throw new server_client_1.ServerError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
+    }
+    // What was pinned (by `remote add` or an earlier login) wins; the server can
+    // only offer the same, never something else to sign in with.
+    const wanted = {
+        clientId: offered.clientId,
+        audience: offered.audience,
+        scope: normalizeScope(offered.scope),
+    };
+    const pinned = {
+        clientId: server.clientId ?? wanted.clientId,
+        audience: server.audience ?? wanted.audience,
+        scope: normalizeScope(server.scope ?? wanted.scope),
+    };
+    for (const key of ['clientId', 'audience', 'scope']) {
+        if (pinned[key] !== wanted[key]) {
+            throw new server_client_1.ServerError(`${server.url} now asks for ${key} "${(0, server_client_1.printable)(wanted[key])}", but "${(0, server_client_1.printable)(pinned[key])}" is pinned. ` +
+                `If that is expected, register the server again with: hammerkit remote add <name> ${server.url} ` +
+                `--issuer ${server.issuer} --force`);
+        }
+    }
+    options.prompt(`signing in to ${server.url} through ${server.issuer}\n` +
+        `  client ${(0, server_client_1.printable)(pinned.clientId)}, audience ${(0, server_client_1.printable)(pinned.audience)}, scope ${(0, server_client_1.printable)(pinned.scope)}`);
+    const base = server.issuer.replace(/\/+$/, '');
+    const described = await fetchJson(`${base}/.well-known/openid-configuration`);
+    const metadata = described.body;
+    if (described.status !== 200) {
+        throw new server_client_1.ServerError(`${server.issuer} answered ${described.status} for its configuration`);
+    }
+    if (metadata.issuer !== server.issuer) {
+        throw new server_client_1.ServerError(`${server.issuer} describes itself as ${(0, server_client_1.printable)(metadata.issuer)}`);
+    }
+    if (!isSecure(metadata.device_authorization_endpoint, server.issuer) ||
+        !isSecure(metadata.token_endpoint, server.issuer)) {
+        throw new server_client_1.ServerError(`${server.issuer} does not support the device authorization grant over https`);
+    }
+    const started = await postForm(metadata.device_authorization_endpoint, {
+        client_id: pinned.clientId,
+        scope: pinned.scope,
+        audience: pinned.audience,
+    });
+    const device = started.body;
+    if (started.status !== 200 || typeof device.device_code !== 'string' || typeof device.user_code !== 'string') {
+        throw new server_client_1.ServerError(`${server.issuer} refused the sign-in: ${(0, server_client_1.printable)(device.error_description ?? device.error ?? started.status)}`);
+    }
+    const address = device.verification_uri_complete ?? device.verification_uri;
+    if (!isSecure(address, server.issuer)) {
+        throw new server_client_1.ServerError(`${server.issuer} sent a sign-in address that is not https`);
+    }
+    options.prompt(`To sign in, open ${(0, server_client_1.printable)(address)} and enter the code ${(0, server_client_1.printable)(device.user_code)}`);
+    const lifetimeSeconds = typeof device.expires_in === 'number' ? device.expires_in : 600;
+    const deadline = now() + Math.min(Math.max(lifetimeSeconds, 0), MAX_LIFETIME_SECONDS) * 1000;
+    const intervalSeconds = typeof device.interval === 'number' ? device.interval : DEFAULT_INTERVAL_SECONDS;
+    let interval = Math.max(intervalSeconds, MIN_INTERVAL_SECONDS) * 1000;
+    for (;;) {
+        await sleep(interval);
+        if (now() > deadline) {
+            throw new server_client_1.ServerError('the code expired, run the login again');
+        }
+        const answer = await postForm(metadata.token_endpoint, {
+            grant_type: GRANT_TYPE,
+            device_code: device.device_code,
+            client_id: pinned.clientId,
+        });
+        if (answer.status === 200 && typeof answer.body.access_token === 'string') {
+            checkToken(answer.body.access_token, server.issuer, pinned.audience);
+            const lifetime = typeof answer.body.expires_in === 'number' ? answer.body.expires_in : 3600;
+            return { accessToken: answer.body.access_token, expiresAt: now() + lifetime * 1000, pinned };
+        }
+        switch (answer.body.error) {
+            case 'authorization_pending':
+                break;
+            case 'slow_down':
+                interval += SLOW_DOWN_SECONDS * 1000;
+                break;
+            case 'access_denied':
+                throw new server_client_1.ServerError('the sign-in was denied');
+            case 'expired_token':
+                throw new server_client_1.ServerError('the code expired, run the login again');
+            default:
+                throw new server_client_1.ServerError(`${server.issuer} refused the sign-in: ${(0, server_client_1.printable)(answer.body.error_description ?? answer.body.error ?? answer.status)}`);
+        }
+    }
+}
+exports.deviceLogin = deviceLogin;
+//# sourceMappingURL=device-login.js.map

package/dist/remote/host-config.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+const path_1 = require("path");
+const zod_1 = require("zod");
+const yaml_1 = require("yaml");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+// Names with a meaning of their own in `run.on` / `--on`
+exports.RESERVED_SERVER_NAMES = ['local', 'auto'];
+const serverNamePattern = /^[a-z0-9][a-z0-9._-]*$/i;
+const checked = (what) => (value, ctx) => {
+    try {
+        normalizeServerUrl(value, what);
+    }
+    catch (e) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: e.message });
+    }
+};
+// `clientId`, `audience` and `scope` are what a login asks the identity provider
+// for. They are pinned the first time a login happens (or given to `remote add`),
+// so a server can't change them later, see device-login.ts.
+exports.hostServerSchema = zod_1.z
+    .object({
+    url: zod_1.z.string().superRefine(checked('url')),
+    issuer: zod_1.z.string().superRefine(checked('issuer')),
+    clientId: zod_1.z.string().min(1).optional(),
+    audience: zod_1.z.string().min(1).optional(),
+    scope: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+// Unknown top-level keys are kept when the file is written back, so a newer
+// hammerkit's settings survive an older one editing the file.
+exports.hostConfigSchema = zod_1.z
+    .object({
+    servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
+})
+    .passthrough();
+// Names like "constructor" must not find inherited members.
+function hasServer(servers, name) {
+    return Object.prototype.hasOwnProperty.call(servers, name);
+}
+exports.hasServer = hasServer;
+function getHostConfigPath(environment) {
+    return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
+}
+exports.getHostConfigPath = getHostConfigPath;
+async function readHostConfig(environment) {
+    const path = getHostConfigPath(environment);
+    if (!(await environment.file.exists(path))) {
+        return exports.hostConfigSchema.parse({});
+    }
+    let raw;
+    try {
+        raw = (0, yaml_1.parse)(await environment.file.read(path));
+    }
+    catch (e) {
+        throw new Error(`unable to read ${path}: ${e.message}`);
+    }
+    const result = exports.hostConfigSchema.safeParse(raw ?? {});
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        throw new Error(`invalid ${path}: ${issue.path.join('.') || 'config'}: ${issue.message}`);
+    }
+    return result.data;
+}
+exports.readHostConfig = readHostConfig;
+async function writeHostConfig(environment, config) {
+    const path = getHostConfigPath(environment);
+    await environment.file.createDirectory((0, path_1.join)(path, '..'));
+    await environment.file.writeFile(path, (0, yaml_1.stringify)(config));
+}
+exports.writeHostConfig = writeHostConfig;
+function validateServerName(name) {
+    if (exports.RESERVED_SERVER_NAMES.includes(name.toLowerCase())) {
+        throw new Error(`"${name}" is reserved and cannot be used as a server name`);
+    }
+    if (!serverNamePattern.test(name)) {
+        throw new Error(`invalid server name "${name}": use letters, digits, ".", "_" and "-", starting with a letter or digit`);
+    }
+    return name;
+}
+exports.validateServerName = validateServerName;
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+// A server receives the source of a run and the caller's OAuth token, so it must
+// be reached over https; plain http is only for a server on this machine. The
+// result has no trailing slash, so one server has one spelling.
+// An issuer is compared as a string with the `iss` of tokens, so it keeps the
+// spelling it was given (some providers end it with a slash, some don't).
+function normalizeServerUrl(value, what = 'url') {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`invalid ${what} "${value}"`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`the ${what} must not contain credentials`);
+    }
+    if (url.search || url.hash) {
+        throw new Error(`the ${what} must not contain a query or fragment`);
+    }
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback(url.hostname))) {
+        throw new Error(`the ${what} must use https (http is only allowed for localhost), got "${value}"`);
+    }
+    return what === 'issuer' ? value : url.toString().replace(/\/+$/, '');
+}
+exports.normalizeServerUrl = normalizeServerUrl;
+const PINNED = ['clientId', 'audience', 'scope'];
+async function addServer(environment, name, url, options) {
+    validateServerName(name);
+    const server = {
+        url: normalizeServerUrl(url),
+        issuer: normalizeServerUrl(options.issuer, 'issuer'),
+    };
+    for (const key of PINNED) {
+        if (options[key]) {
+            server[key] = options[key];
+        }
+    }
+    const config = await readHostConfig(environment);
+    const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    if (existing && changed(existing, server) && !options.force) {
+        throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
+            `use --force to point it somewhere else`);
+    }
+    config.servers[name] = server;
+    await writeHostConfig(environment, config);
+    return server;
+}
+exports.addServer = addServer;
+async function removeServer(environment, name) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        throw new Error(`server "${name}" is not registered`);
+    }
+    delete config.servers[name];
+    const resetDefault = config.run.on === name;
+    if (resetDefault) {
+        delete config.run.on;
+    }
+    await writeHostConfig(environment, config);
+    return { resetDefault };
+}
+exports.removeServer = removeServer;
+async function setDefaultLocation(environment, on) {
+    const config = await readHostConfig(environment);
+    if (!exports.RESERVED_SERVER_NAMES.includes(on) && !hasServer(config.servers, on)) {
+        throw new Error(`server "${on}" is not registered; add it with: hammerkit remote add ${on} <url> --issuer <url>`);
+    }
+    config.run.on = on;
+    await writeHostConfig(environment, config);
+}
+exports.setDefaultLocation = setDefaultLocation;
+// Remember what the first login asked the identity provider for; later logins
+// have to ask for the same.
+async function pinLogin(environment, name, pins) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        return;
+    }
+    Object.assign(config.servers[name], pins);
+    await writeHostConfig(environment, config);
+}
+exports.pinLogin = pinLogin;
+//# sourceMappingURL=host-config.js.map

package/dist/remote/location.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRunLocation = void 0;
+const host_config_1 = require("./host-config");
+// Where a run happens, highest precedence first: --on / --local, HAMMERKIT_ON,
+// the runner of the tasks, `run.on` of the host config, local. `auto` (as
+// --on, HAMMERKIT_ON or run.on) means the runner of the tasks, else local.
+// A name that is not registered is an error: a run never falls back to the
+// local machine silently.
+async function resolveRunLocation(workTree, environment, options = {}) {
+    if (options.on && options.local) {
+        throw new Error('--on and --local contradict each other');
+    }
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    const explicit = options.local ? 'local' : options.on ?? (environment.processEnvs.HAMMERKIT_ON || undefined);
+    if (explicit && explicit !== 'auto') {
+        return explicit === 'local' ? { type: 'local' } : lookup(config.servers, explicit);
+    }
+    const runners = getTaskRunners(workTree);
+    if (runners.length > 1) {
+        throw new Error(`a run goes to one server, but its tasks name ${runners.join(', ')}`);
+    }
+    const requested = runners[0] ?? (explicit ? undefined : config.run.on);
+    if (!requested || requested === 'local' || requested === 'auto') {
+        return { type: 'local' };
+    }
+    return lookup(config.servers, requested);
+}
+exports.resolveRunLocation = resolveRunLocation;
+function lookup(servers, name) {
+    const server = (0, host_config_1.hasServer)(servers, name) ? servers[name] : undefined;
+    if (!server) {
+        throw new Error(`server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`);
+    }
+    return { type: 'server', name, server };
+}
+function getTaskRunners(workTree) {
+    const runners = new Set();
+    for (const task of Object.values(workTree.tasks)) {
+        if (task.data.runner) {
+            runners.add(task.data.runner);
+        }
+    }
+    return [...runners].sort();
+}
+//# sourceMappingURL=location.js.map

package/dist/remote/remote-commands.js

@@ -0,0 +1,154 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRemoteCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const log_1 = require("../log");
+const host_config_1 = require("./host-config");
+const device_login_1 = require("./device-login");
+const credentials_1 = require("./credentials");
+const server_client_1 = require("./server-client");
+const remote_work_commands_1 = require("./remote-work-commands");
+// Host-level commands: they only touch the machine's config file, so they work
+// with or without a build file in the working directory.
+function registerRemoteCommands(program, environment, buildFile) {
+    const remote = program.command('remote').description('register the servers runs can be sent to');
+    const guarded = (failure, fn) => {
+        return async (...args) => {
+            try {
+                await fn(...args);
+            }
+            catch (e) {
+                if (e instanceof commander_1.CommanderError) {
+                    throw e;
+                }
+                program.error(`${failure}: ${(0, log_1.getErrorMessage)(e)}`, { exitCode: 1 });
+            }
+        };
+    };
+    remote
+        .command('add <name> <url>')
+        .description('register a server under a name that build files and --on can refer to')
+        .addOption(new commander_1.Option('--issuer <url>', 'OAuth issuer the server accepts tokens from').makeOptionMandatory())
+        .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
+        .action(guarded('Remote add was not successful', async (name, url, options) => {
+        const server = await (0, host_config_1.addServer)(environment, name, url, {
+            issuer: options.issuer,
+            clientId: options.clientId,
+            audience: options.audience,
+            scope: options.scope,
+            force: options.force,
+        });
+        environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+    }));
+    remote
+        .command('list')
+        .description('list the registered servers')
+        .action(guarded('Remote list was not successful', async () => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const names = Object.keys(config.servers).sort();
+        if (names.length === 0) {
+            environment.stdout.write(`no servers registered (config: ${(0, host_config_1.getHostConfigPath)(environment)})\n`);
+            return;
+        }
+        for (const name of names) {
+            const server = config.servers[name];
+            const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+        }
+        if (config.run.on === 'auto' || config.run.on === 'local') {
+            environment.stdout.write(`default location: ${config.run.on}\n`);
+        }
+    }));
+    remote
+        .command('remove <name>')
+        .description('forget a registered server')
+        .action(guarded('Remote remove was not successful', async (name) => {
+        const { resetDefault } = await (0, host_config_1.removeServer)(environment, name);
+        environment.stdout.write(`removed ${name}\n`);
+        if (resetDefault) {
+            environment.stdout.write('it was the default location, runs are local again\n');
+        }
+    }));
+    remote
+        .command('use <location>')
+        .description('set where runs happen by default: local, auto or a registered server')
+        .action(guarded('Remote use was not successful', async (location) => {
+        await (0, host_config_1.setDefaultLocation)(environment, location);
+        environment.stdout.write(`default location: ${location}\n`);
+    }));
+    const getServer = async (name) => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const chosen = name ?? config.run.on;
+        if (!chosen || !(0, host_config_1.hasServer)(config.servers, chosen)) {
+            throw new Error(name
+                ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
+                : 'name a server, or set one as the default with: hammerkit remote use <name>');
+        }
+        return { name: chosen, server: config.servers[chosen] };
+    };
+    remote
+        .command('login <name>')
+        .description('sign in to a registered server with your identity provider (device code, works headless)')
+        .action(guarded('Remote login was not successful', async (name) => {
+        const { server } = await getServer(name);
+        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
+            prompt: (message) => environment.stdout.write(`${message}\n`),
+            signal: environment.abortCtrl.signal,
+        });
+        await (0, host_config_1.pinLogin)(environment, name, pinned);
+        await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
+        try {
+            const me = await (0, server_client_1.getMe)(server, result.accessToken);
+            environment.stdout.write(`signed in to ${name} as ${me.sub}\n`);
+            environment.stdout.write(me.accounts.length > 0
+                ? `service accounts: ${me.accounts.join(', ')}\n`
+                : 'you have no service accounts on this server\n');
+        }
+        catch (e) {
+            // a token the server does not accept is of no use
+            await (0, credentials_1.removeToken)(environment, name);
+            throw e;
+        }
+    }));
+    remote
+        .command('logout <name>')
+        .description('forget the sign-in to a server')
+        .action(guarded('Remote logout was not successful', async (name) => {
+        const removed = await (0, credentials_1.removeToken)(environment, name);
+        environment.stdout.write(removed ? `signed out of ${name}\n` : `not signed in to ${name}\n`);
+    }));
+    remote
+        .command('accounts [name]')
+        .description('show who you are on a server and which service accounts you may use')
+        .action(guarded('Remote accounts was not successful', async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const me = await (0, server_client_1.getMe)(chosen.server, token);
+        environment.stdout.write(`${chosen.name}: ${me.sub} (${me.iss})\n`);
+        if (me.accounts.length === 0 && !(me.request && me.request.length > 0)) {
+            environment.stdout.write('no service accounts\n');
+        }
+        for (const account of me.accounts) {
+            environment.stdout.write(`${account}${account === me.default ? colors_1.default.green(' (default)') : ''}\n`);
+        }
+        if (me.publish && me.publish.length > 0) {
+            environment.stdout.write(`may publish build files: ${me.publish.join(', ')}\n`);
+        }
+        if (me.propose && me.propose.length > 0) {
+            environment.stdout.write(`may propose build files, which need an approval: ${me.propose.join(', ')}\n`);
+        }
+        if (me.request && me.request.length > 0) {
+            environment.stdout.write(`may request runs, which an admin approves: ${me.request.join(', ')}\n`);
+        }
+    }));
+    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+}
+exports.registerRemoteCommands = registerRemoteCommands;
+//# sourceMappingURL=remote-commands.js.map