instar 1.3.400 → 1.3.402

package/dist/core/EnrollmentWizard.d.ts

@@ -0,0 +1,84 @@
+/**
+ * EnrollmentWizard — mobile-first login orchestration (P2.1 of the Subscription
+ * & Auth Standard). Sits on top of PendingLoginStore and turns a raw framework
+ * login into a phone-friendly, expiry-resilient flow.
+ *
+ * The job (from the spec + the pi live-test specimen):
+ *   - START a login: drive the framework's login flow, capture the PUBLIC
+ *     device-code / auth URL, and store it with its TTL visible. (Codex →
+ *     device-code; Claude → URL+paste-back-code.)
+ *   - On EXPIRY: auto-reissue a fresh code/URL WITHOUT the operator asking — the
+ *     exact gap the pi live-test exposed (the first code expired before Justin
+ *     got to it and re-issuing took a manual round-trip).
+ *   - COMPLETE when the operator approves at the provider + the account enrols.
+ *
+ * The interactive part — actually driving the framework's login CLI to obtain a
+ * code/URL — is INJECTED (`driveLogin`), so this orchestrator is pure +
+ * hermetically testable (no spawning, no network, no real OAuth). In production
+ * the driver runs the framework's device-code/login flow and scrapes the code +
+ * URL + TTL; here tests pass a stub. NEVER handles a credential — only the
+ * public code/URL the operator types into the provider's own page.
+ */
+import { PendingLoginStore, type PendingLogin, type LoginFlowKind, type LoginProvider } from './PendingLoginStore.js';
+/** The public artifact a framework login yields (no secret). */
+export interface LoginArtifact {
+    verificationUrl: string;
+    userCode?: string;
+    ttlMs?: number;
+}
+/** Injected: drive the framework's login flow, return its public code/URL. */
+export type LoginDriver = (req: {
+    provider: LoginProvider;
+    framework: PendingLogin['framework'];
+    kind: LoginFlowKind;
+    /** The new account's CLAUDE_CONFIG_DIR — isolates this login to its own slot
+     *  so enrolling a 2nd account never clobbers the 1st. */
+    configHome?: string;
+}) => Promise<LoginArtifact>;
+export interface EnrollmentWizardConfig {
+    store: PendingLoginStore;
+    driveLogin: LoginDriver;
+    now?: () => number;
+    logger?: {
+        log: (m: string) => void;
+        warn: (m: string) => void;
+    };
+}
+export interface StartEnrollmentInput {
+    id: string;
+    label: string;
+    provider: LoginProvider;
+    framework: PendingLogin['framework'];
+    /** device-code (Codex) or url-code-paste (Claude). Defaults per provider. */
+    kind?: LoginFlowKind;
+    /** The new account's CLAUDE_CONFIG_DIR — isolates the login to its own slot. */
+    configHome?: string;
+}
+export declare class EnrollmentWizard {
+    private readonly store;
+    private readonly driveLogin;
+    private readonly logger;
+    constructor(cfg: EnrollmentWizardConfig);
+    /** Default flow kind per provider: Codex/OpenAI = device-code (its endorsed
+     *  flow); everyone else = url-code-paste (the phone-friendly Claude path). */
+    static defaultKind(provider: LoginProvider): LoginFlowKind;
+    /**
+     * Start an enrollment: drive the login, capture the public code/URL, store it
+     * as a pending login (TTL visible). Returns the stored PendingLogin — the
+     * surface the operator's phone shows.
+     */
+    start(input: StartEnrollmentInput): Promise<PendingLogin>;
+    /**
+     * Auto-reissue every EXPIRED pending login without the operator asking — the
+     * pi-live-test gap. For each expired login, re-drive the framework flow and
+     * refresh the stored code/URL + TTL. Returns the reissued logins. Driver
+     * failures are skipped (logged, left expired) so one bad re-drive doesn't
+     * abort the sweep.
+     */
+    reissueExpired(): Promise<PendingLogin[]>;
+    /** Mark a login completed once the operator approved + the account enrolled. */
+    complete(id: string): PendingLogin | null;
+    /** The phone surface: still-valid logins awaiting approval. */
+    pending(): PendingLogin[];
+}
+//# sourceMappingURL=EnrollmentWizard.d.ts.map

package/dist/core/EnrollmentWizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnrollmentWizard.d.ts","sourceRoot":"","sources":["../../src/core/EnrollmentWizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAEhC,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,aAAa,CAAC;IACpB;6DACyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE7B,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,WAAW,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAClE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;gBAErE,GAAG,EAAE,sBAAsB;IAMvC;kFAC8E;IAC9E,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa;IAI1D;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;IAuB/D;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IA4B/C,gFAAgF;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIzC,+DAA+D;IAC/D,OAAO,IAAI,YAAY,EAAE;CAG1B"}

package/dist/core/EnrollmentWizard.js

@@ -0,0 +1,107 @@
+/**
+ * EnrollmentWizard — mobile-first login orchestration (P2.1 of the Subscription
+ * & Auth Standard). Sits on top of PendingLoginStore and turns a raw framework
+ * login into a phone-friendly, expiry-resilient flow.
+ *
+ * The job (from the spec + the pi live-test specimen):
+ *   - START a login: drive the framework's login flow, capture the PUBLIC
+ *     device-code / auth URL, and store it with its TTL visible. (Codex →
+ *     device-code; Claude → URL+paste-back-code.)
+ *   - On EXPIRY: auto-reissue a fresh code/URL WITHOUT the operator asking — the
+ *     exact gap the pi live-test exposed (the first code expired before Justin
+ *     got to it and re-issuing took a manual round-trip).
+ *   - COMPLETE when the operator approves at the provider + the account enrols.
+ *
+ * The interactive part — actually driving the framework's login CLI to obtain a
+ * code/URL — is INJECTED (`driveLogin`), so this orchestrator is pure +
+ * hermetically testable (no spawning, no network, no real OAuth). In production
+ * the driver runs the framework's device-code/login flow and scrapes the code +
+ * URL + TTL; here tests pass a stub. NEVER handles a credential — only the
+ * public code/URL the operator types into the provider's own page.
+ */
+export class EnrollmentWizard {
+    store;
+    driveLogin;
+    logger;
+    constructor(cfg) {
+        this.store = cfg.store;
+        this.driveLogin = cfg.driveLogin;
+        this.logger = cfg.logger ?? { log: () => { }, warn: () => { } };
+    }
+    /** Default flow kind per provider: Codex/OpenAI = device-code (its endorsed
+     *  flow); everyone else = url-code-paste (the phone-friendly Claude path). */
+    static defaultKind(provider) {
+        return provider === 'openai' ? 'device-code' : 'url-code-paste';
+    }
+    /**
+     * Start an enrollment: drive the login, capture the public code/URL, store it
+     * as a pending login (TTL visible). Returns the stored PendingLogin — the
+     * surface the operator's phone shows.
+     */
+    async start(input) {
+        const kind = input.kind ?? EnrollmentWizard.defaultKind(input.provider);
+        const artifact = await this.driveLogin({
+            provider: input.provider,
+            framework: input.framework,
+            kind,
+            configHome: input.configHome,
+        });
+        const login = this.store.issue({
+            id: input.id,
+            label: input.label,
+            provider: input.provider,
+            framework: input.framework,
+            kind,
+            configHome: input.configHome,
+            verificationUrl: artifact.verificationUrl,
+            userCode: artifact.userCode,
+            ttlMs: artifact.ttlMs,
+        });
+        this.logger.log(`[EnrollmentWizard] started ${kind} login for ${input.label} (${input.provider})`);
+        return login;
+    }
+    /**
+     * Auto-reissue every EXPIRED pending login without the operator asking — the
+     * pi-live-test gap. For each expired login, re-drive the framework flow and
+     * refresh the stored code/URL + TTL. Returns the reissued logins. Driver
+     * failures are skipped (logged, left expired) so one bad re-drive doesn't
+     * abort the sweep.
+     */
+    async reissueExpired() {
+        const reissued = [];
+        for (const login of this.store.expired()) {
+            try {
+                const fresh = await this.driveLogin({
+                    provider: login.provider,
+                    framework: login.framework,
+                    kind: login.kind,
+                    configHome: login.configHome,
+                });
+                const updated = this.store.reissue(login.id, {
+                    verificationUrl: fresh.verificationUrl,
+                    userCode: fresh.userCode,
+                    ttlMs: fresh.ttlMs,
+                });
+                if (updated) {
+                    reissued.push(updated);
+                    this.logger.log(`[EnrollmentWizard] auto-reissued expired login ${login.id} (reissue #${updated.reissueCount})`);
+                }
+            }
+            catch (err) {
+                // @silent-fallback-ok: one re-drive failing must not abort the sweep;
+                // the login stays expired and is retried next sweep.
+                this.logger.warn(`[EnrollmentWizard] reissue of ${login.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        return reissued;
+    }
+    /** Mark a login completed once the operator approved + the account enrolled. */
+    complete(id) {
+        return this.store.complete(id);
+    }
+    /** The phone surface: still-valid logins awaiting approval. */
+    pending() {
+        return this.store.active();
+    }
+}
+//# sourceMappingURL=EnrollmentWizard.js.map

package/dist/core/EnrollmentWizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnrollmentWizard.js","sourceRoot":"","sources":["../../src/core/EnrollmentWizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA4CH,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAoB;IACzB,UAAU,CAAc;IACxB,MAAM,CAA0D;IAEjF,YAAY,GAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;kFAC8E;IAC9E,MAAM,CAAC,WAAW,CAAC,QAAuB;QACxC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,IAAI,cAAc,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;oBAC3C,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kDAAkD,KAAK,CAAC,EAAE,cAAc,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;gBACnH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gFAAgF;IAChF,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,+DAA+D;IAC/D,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/core/FrameworkLoginDriver.d.ts

@@ -0,0 +1,85 @@
+/**
+ * FrameworkLoginDriver — the concrete `LoginDriver` for the EnrollmentWizard
+ * (P2.1 of the Subscription & Auth Standard). It is the "hands" that actually
+ * obtain a PUBLIC login artifact (verification URL + optional device code + TTL)
+ * from a framework's login flow, so the wizard can surface it to the operator's
+ * phone.
+ *
+ * Design constraints (why the I/O is injected):
+ *   - The SCRAPE logic — turning a pane's text into a `{ verificationUrl,
+ *     userCode, ttlMs }` artifact — is PURE and must be unit-testable against
+ *     real captured-output fixtures with no tmux, no spawning, no network.
+ *   - The I/O — spawning the login command under the target account's
+ *     `CLAUDE_CONFIG_DIR` and capturing the pane — is INJECTED (`spawn`,
+ *     `capture`, `sleep`, `now`). Production wiring (server.ts) passes the real
+ *     tmux primitives; tests pass fakes. This also keeps this module decoupled
+ *     from SessionManager's spawn internals.
+ *
+ * SECURITY: this driver only ever reads the PUBLIC artifact a provider prints to
+ * be typed into its own page — the verification URL and (for device-code flows)
+ * the short user code. It NEVER reads, stores, or returns a token. The actual
+ * credential is written by the framework's own login client into the account's
+ * config home; instar never touches it.
+ */
+import type { LoginArtifact, LoginDriver } from './EnrollmentWizard.js';
+import type { LoginFlowKind, LoginProvider } from './PendingLoginStore.js';
+/** A login flow we know how to launch + scrape. */
+export interface FrameworkLoginRequest {
+    provider: LoginProvider;
+    framework: 'claude-code' | 'codex-cli' | 'gemini-cli' | 'pi-cli';
+    kind: LoginFlowKind;
+    /** The account's CLAUDE_CONFIG_DIR — isolates this login to its own slot. */
+    configHome?: string;
+}
+/** Injected I/O so the driver is decoupled + hermetically testable. */
+export interface FrameworkLoginDriverDeps {
+    /**
+     * Spawn the framework's login command in a dedicated tmux pane under the
+     * given configHome. Returns a session handle the capture fn reads from.
+     */
+    spawn: (req: FrameworkLoginRequest) => Promise<{
+        session: string;
+    }>;
+    /** Capture the current text of a login pane. */
+    capture: (session: string) => Promise<string>;
+    /** Await ms (injected so tests don't really wait). */
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    logger?: {
+        log: (m: string) => void;
+        warn: (m: string) => void;
+    };
+    /** How long to poll the pane for the artifact before giving up (default 60s). */
+    scrapeTimeoutMs?: number;
+    /** Poll cadence while waiting for the artifact to appear (default 1s). */
+    pollIntervalMs?: number;
+}
+export declare class FrameworkLoginDriver {
+    private readonly deps;
+    private readonly sleep;
+    private readonly now;
+    private readonly logger;
+    private readonly scrapeTimeoutMs;
+    private readonly pollIntervalMs;
+    constructor(deps: FrameworkLoginDriverDeps);
+    /**
+     * Parse a PUBLIC login artifact out of captured pane text. Pure — no I/O.
+     * Returns null until the pane has emitted at least a verification URL (for
+     * device-code flows, also a user code). Exported via the static for tests.
+     */
+    static parseArtifact(paneText: string, kind: LoginFlowKind): LoginArtifact | null;
+    /**
+     * Drive a framework login: spawn it under the target config home, poll the
+     * pane until the public artifact appears (or timeout), and return it. Throws
+     * on timeout so the wizard logs + leaves the login for the next sweep.
+     */
+    drive(req: {
+        provider: LoginProvider;
+        framework: FrameworkLoginRequest['framework'];
+        kind: LoginFlowKind;
+        configHome?: string;
+    }): Promise<LoginArtifact>;
+    /** Adapt to the EnrollmentWizard's LoginDriver signature. */
+    asLoginDriver(): LoginDriver;
+}
+//# sourceMappingURL=FrameworkLoginDriver.d.ts.map

package/dist/core/FrameworkLoginDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FrameworkLoginDriver.d.ts","sourceRoot":"","sources":["../../src/core/FrameworkLoginDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE3E,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjE,IAAI,EAAE,aAAa,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,gDAAgD;IAChD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,sDAAsD;IACtD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACjE,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AASD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,IAAI,EAAE,wBAAwB;IAS1C;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,IAAI;IAiBjF;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE;QACf,QAAQ,EAAE,aAAa,CAAC;QACxB,SAAS,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,EAAE,aAAa,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,aAAa,CAAC;IA4B1B,6DAA6D;IAC7D,aAAa,IAAI,WAAW;CAG7B"}

package/dist/core/FrameworkLoginDriver.js

@@ -0,0 +1,110 @@
+/**
+ * FrameworkLoginDriver — the concrete `LoginDriver` for the EnrollmentWizard
+ * (P2.1 of the Subscription & Auth Standard). It is the "hands" that actually
+ * obtain a PUBLIC login artifact (verification URL + optional device code + TTL)
+ * from a framework's login flow, so the wizard can surface it to the operator's
+ * phone.
+ *
+ * Design constraints (why the I/O is injected):
+ *   - The SCRAPE logic — turning a pane's text into a `{ verificationUrl,
+ *     userCode, ttlMs }` artifact — is PURE and must be unit-testable against
+ *     real captured-output fixtures with no tmux, no spawning, no network.
+ *   - The I/O — spawning the login command under the target account's
+ *     `CLAUDE_CONFIG_DIR` and capturing the pane — is INJECTED (`spawn`,
+ *     `capture`, `sleep`, `now`). Production wiring (server.ts) passes the real
+ *     tmux primitives; tests pass fakes. This also keeps this module decoupled
+ *     from SessionManager's spawn internals.
+ *
+ * SECURITY: this driver only ever reads the PUBLIC artifact a provider prints to
+ * be typed into its own page — the verification URL and (for device-code flows)
+ * the short user code. It NEVER reads, stores, or returns a token. The actual
+ * credential is written by the framework's own login client into the account's
+ * config home; instar never touches it.
+ */
+const URL_RE = /(https?:\/\/[^\s"'<>)\]]+)/i;
+// Device codes are short, dash-grouped, uppercase-alnum: e.g. 7DAU-W4XJA, ABCD-1234.
+const DEVICE_CODE_RE = /\b([A-Z0-9]{4}-[A-Z0-9]{4,6})\b/;
+// "expires in 15 minutes", "valid for 10 min", "expires in 900 seconds".
+const TTL_MIN_RE = /(?:expire[sd]?|valid)\b[^.\n]*?\b(\d{1,3})\s*(?:minutes?|mins?\b)/i;
+const TTL_SEC_RE = /(?:expire[sd]?|valid)\b[^.\n]*?\b(\d{2,5})\s*(?:seconds?|secs?\b)/i;
+export class FrameworkLoginDriver {
+    deps;
+    sleep;
+    now;
+    logger;
+    scrapeTimeoutMs;
+    pollIntervalMs;
+    constructor(deps) {
+        this.deps = deps;
+        this.sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.now = deps.now ?? (() => Date.now());
+        this.logger = deps.logger ?? { log: () => { }, warn: () => { } };
+        this.scrapeTimeoutMs = deps.scrapeTimeoutMs ?? 60_000;
+        this.pollIntervalMs = deps.pollIntervalMs ?? 1_000;
+    }
+    /**
+     * Parse a PUBLIC login artifact out of captured pane text. Pure — no I/O.
+     * Returns null until the pane has emitted at least a verification URL (for
+     * device-code flows, also a user code). Exported via the static for tests.
+     */
+    static parseArtifact(paneText, kind) {
+        if (!paneText)
+            return null;
+        const urlMatch = paneText.match(URL_RE);
+        if (!urlMatch)
+            return null;
+        const verificationUrl = stripTrailingPunctuation(urlMatch[1]);
+        let userCode;
+        if (kind === 'device-code') {
+            const codeMatch = paneText.match(DEVICE_CODE_RE);
+            if (!codeMatch)
+                return null; // device-code flow isn't ready until the code prints
+            userCode = codeMatch[1];
+        }
+        const ttlMs = parseTtlMs(paneText);
+        return { verificationUrl, userCode, ttlMs };
+    }
+    /**
+     * Drive a framework login: spawn it under the target config home, poll the
+     * pane until the public artifact appears (or timeout), and return it. Throws
+     * on timeout so the wizard logs + leaves the login for the next sweep.
+     */
+    async drive(req) {
+        const { session } = await this.deps.spawn({
+            provider: req.provider,
+            framework: req.framework,
+            kind: req.kind,
+            configHome: req.configHome,
+        });
+        const deadline = this.now() + this.scrapeTimeoutMs;
+        let lastText = '';
+        while (this.now() < deadline) {
+            lastText = await this.deps.capture(session);
+            const artifact = FrameworkLoginDriver.parseArtifact(lastText, req.kind);
+            if (artifact) {
+                this.logger.log(`[FrameworkLoginDriver] captured ${req.kind} artifact for ${req.provider}/${req.framework}`);
+                return artifact;
+            }
+            await this.sleep(this.pollIntervalMs);
+        }
+        this.logger.warn(`[FrameworkLoginDriver] timed out scraping ${req.kind} login for ${req.provider}/${req.framework}`);
+        throw new Error(`login artifact not found for ${req.provider}/${req.framework} within ${this.scrapeTimeoutMs}ms`);
+    }
+    /** Adapt to the EnrollmentWizard's LoginDriver signature. */
+    asLoginDriver() {
+        return (req) => this.drive(req);
+    }
+}
+function stripTrailingPunctuation(url) {
+    return url.replace(/[.,;:'")\]]+$/, '');
+}
+function parseTtlMs(text) {
+    const min = text.match(TTL_MIN_RE);
+    if (min)
+        return Number(min[1]) * 60_000;
+    const sec = text.match(TTL_SEC_RE);
+    if (sec)
+        return Number(sec[1]) * 1_000;
+    return undefined;
+}
+//# sourceMappingURL=FrameworkLoginDriver.js.map

package/dist/core/FrameworkLoginDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FrameworkLoginDriver.js","sourceRoot":"","sources":["../../src/core/FrameworkLoginDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAiCH,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAC7C,qFAAqF;AACrF,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,yEAAyE;AACzE,MAAM,UAAU,GAAG,oEAAoE,CAAC;AACxF,MAAM,UAAU,GAAG,oEAAoE,CAAC;AAExF,MAAM,OAAO,oBAAoB;IACd,IAAI,CAA2B;IAC/B,KAAK,CAAgC;IACrC,GAAG,CAAe;IAClB,MAAM,CAA0D;IAChE,eAAe,CAAS;IACxB,cAAc,CAAS;IAExC,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAmB;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,eAAe,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9D,IAAI,QAA4B,CAAC;QACjC,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,CAAC,qDAAqD;YAClF,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAKX;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACnD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mCAAmC,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE,CAC5F,CAAC;gBACF,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CAA6C,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE,CACnG,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,WAAW,IAAI,CAAC,eAAe,IAAI,CACjG,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,aAAa;QACX,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/PendingLoginStore.d.ts

@@ -0,0 +1,118 @@
+/**
+ * PendingLoginStore — durable record of in-flight subscription logins (P2.1 of
+ * the Subscription & Auth Standard, the mobile-first enrollment wizard).
+ *
+ * When the operator enrolls an account from their phone, the login is a
+ * short-lived artifact: a device-code (Codex: `auth.openai.com/codex/device` +
+ * a 9-char code, ~15min TTL) or a URL+paste-back-code flow (Claude). The pi
+ * live-test exposed the gap this closes: the first code expired before the
+ * operator got to it, the provider's error was opaque, and re-issuing required a
+ * manual round-trip. This store makes pending logins durable + TTL-aware so the
+ * wizard can:
+ *   - surface a code/URL IMMEDIATELY with its TTL visible,
+ *   - detect expiry and re-issue a fresh one WITHOUT the operator asking,
+ *   - present a "Pending Logins" surface where a fresh code is one tap away.
+ *
+ * It stores NO credential — only the public device-code / auth URL the provider
+ * shows, which the operator types into the provider's own page. The actual login
+ * happens against the provider, never through instar (Secret-Drop discipline).
+ *
+ * File-backed JSON (atomic tmp+rename), mirrors the SubscriptionPool durable-
+ * registry pattern. The re-issue mechanism (re-driving the framework login) is
+ * the wizard's concern + injected, so this store stays pure + hermetically
+ * testable (no spawning, no network).
+ */
+export type LoginFlowKind = 'device-code' | 'url-code-paste';
+export type LoginProvider = 'openai' | 'anthropic' | 'github-copilot' | 'google';
+/**
+ * Pending-login lifecycle:
+ *   pending   — code/URL issued, awaiting the operator's approval at the provider
+ *   expired   — TTL elapsed before approval (eligible for auto-reissue)
+ *   completed — the operator approved + the account enrolled
+ *   abandoned — operator/admin cancelled, or superseded by a re-issue
+ */
+export type PendingLoginStatus = 'pending' | 'expired' | 'completed' | 'abandoned';
+export interface PendingLogin {
+    /** Stable id, charset ^[a-z0-9-]+$. */
+    id: string;
+    /** Operator-facing label / intended account nickname. */
+    label: string;
+    provider: LoginProvider;
+    framework: 'claude-code' | 'codex-cli' | 'gemini-cli' | 'pi-cli';
+    kind: LoginFlowKind;
+    /** The new account's CLAUDE_CONFIG_DIR (a filesystem path, never a secret) —
+     *  recorded so an auto-reissue re-drives the login under the SAME slot. */
+    configHome?: string;
+    /** The public verification URL the operator opens (never a secret). */
+    verificationUrl: string;
+    /** Device-code (e.g. "7DAU-W4XJA") for device-code flows; absent for url-code-paste. */
+    userCode?: string;
+    /** ISO timestamp the code/URL expires. */
+    ttlExpiresAt: string;
+    status: PendingLoginStatus;
+    /** How many times this login has been re-issued after expiry. */
+    reissueCount: number;
+    createdAt: string;
+    updatedAt: string;
+    /** Monotonic version for optimistic CAS. */
+    version: number;
+}
+export interface PendingLoginStoreConfig {
+    stateDir: string;
+    /** Injectable clock (ms epoch) for deterministic TTL tests. */
+    now?: () => number;
+}
+export interface IssueLoginInput {
+    id: string;
+    label: string;
+    provider: LoginProvider;
+    framework: PendingLogin['framework'];
+    kind: LoginFlowKind;
+    configHome?: string;
+    verificationUrl: string;
+    userCode?: string;
+    /** TTL in ms from now (default 15 min — the observed Codex device-code TTL). */
+    ttlMs?: number;
+}
+export declare class ValidationError extends Error {
+    constructor(message: string);
+}
+export declare class PendingLoginStore {
+    private storePath;
+    private store;
+    private readonly now;
+    constructor(config: PendingLoginStoreConfig);
+    /** All pending logins, with live status (expiry computed against the clock). */
+    list(): PendingLogin[];
+    get(id: string): PendingLogin | null;
+    /** Logins that are expired (TTL elapsed) but not completed/abandoned — the
+     *  auto-reissue work-list. */
+    expired(): PendingLogin[];
+    /** Active (still-valid, awaiting-approval) logins — the "Pending Logins" surface. */
+    active(): PendingLogin[];
+    size(): number;
+    /** Issue a new pending login. Stores the public URL/code only — never a token. */
+    issue(input: IssueLoginInput, rawExtra?: Record<string, unknown>): PendingLogin;
+    /**
+     * Re-issue an expired (or pending) login with a fresh URL/code + TTL — the
+     * auto-reissue path. Bumps reissueCount, resets status to pending. Returns null
+     * if not found.
+     */
+    reissue(id: string, fresh: {
+        verificationUrl: string;
+        userCode?: string;
+        ttlMs?: number;
+    }): PendingLogin | null;
+    /** Mark a login completed (the operator approved + the account enrolled). */
+    complete(id: string): PendingLogin | null;
+    /** Cancel a login (operator/admin). */
+    abandon(id: string): PendingLogin | null;
+    private transition;
+    /** Computes live `expired` status from the TTL without mutating the store
+     *  (pending → expired when past TTL; completed/abandoned are terminal). */
+    private withLiveStatus;
+    private assertNoCredentialFields;
+    private load;
+    private save;
+}
+//# sourceMappingURL=PendingLoginStore.d.ts.map

package/dist/core/PendingLoginStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PendingLoginStore.d.ts","sourceRoot":"","sources":["../../src/core/PendingLoginStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAC7D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAEnF,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjE,IAAI,EAAE,aAAa,CAAC;IACpB;+EAC2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,eAAe,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAUD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAwB;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,MAAM,EAAE,uBAAuB;IAM3C,gFAAgF;IAChF,IAAI,IAAI,YAAY,EAAE;IAItB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAKpC;kCAC8B;IAC9B,OAAO,IAAI,YAAY,EAAE;IAIzB,qFAAqF;IACrF,MAAM,IAAI,YAAY,EAAE;IAIxB,IAAI,IAAI,MAAM;IAId,kFAAkF;IAClF,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAoC/E;;;;OAIG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,GAAG,IAAI;IAmB/G,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIzC,uCAAuC;IACvC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIxC,OAAO,CAAC,UAAU;IAUlB;+EAC2E;IAC3E,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,IAAI;IAgBZ,OAAO,CAAC,IAAI;CAWb"}