intlayer-editor 9.5.12 → 9.7.0

package/server/dist/services/editorAuth.service.cjs

@@ -0,0 +1,143 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.cjs');
+let _intlayer_config_colors = require("@intlayer/config/colors");
+_intlayer_config_colors = require_runtime.__toESM(_intlayer_config_colors, 1);
+let _intlayer_config_logger = require("@intlayer/config/logger");
+let _intlayer_api = require("@intlayer/api");
+let _intlayer_cli = require("@intlayer/cli");
+
+//#region src/services/editorAuth.service.ts
+/** Time after which an unanswered login is given up. */
+const LOGIN_TIMEOUT_MS = 3e5;
+/** Margin before expiry under which a cached access token is renewed. */
+const TOKEN_RENEWAL_MARGIN_MS = 6e4;
+/** Credentials picked during an editor-triggered login, kept for this run. */
+let runtimeCredentials = null;
+/** Access token exchanged from the access key, reused until it expires. */
+let accessKeyAuthCache = null;
+/** Identity bound to each CLI session token, resolved once per token. */
+const sessionIdentityCache = /* @__PURE__ */ new Map();
+/** Aborts the login flow waiting for the browser callback, if any. */
+let pendingLoginController = null;
+const isExpiringSoon = (expiresAt) => expiresAt !== null && new Date(expiresAt).getTime() - TOKEN_RENEWAL_MARGIN_MS <= Date.now();
+const getCredentials = (configuration) => {
+	if (runtimeCredentials) return runtimeCredentials;
+	const { clientId, clientSecret } = configuration.editor;
+	return clientId && clientSecret ? {
+		clientId,
+		clientSecret
+	} : null;
+};
+/**
+* Resolves the `intlayer login` session token, shared with the CLI through
+* the temp directory. `null` when absent, expired, or rejected by the CMS.
+*/
+const resolveSessionAuth = async (configuration) => {
+	const sessionData = await (0, _intlayer_cli.readCliSessionToken)(configuration);
+	if (!sessionData) return null;
+	if (!sessionIdentityCache.has(sessionData.token)) try {
+		const result = await (0, _intlayer_api.getIntlayerAPIProxy)(void 0, configuration, sessionData.token).oAuth.getCliSessionMe();
+		sessionIdentityCache.set(sessionData.token, {
+			user: result.data?.user ?? null,
+			organization: result.data?.organization ?? null,
+			project: result.data?.project ?? null
+		});
+	} catch {
+		return null;
+	}
+	return {
+		accessToken: sessionData.token,
+		expiresAt: sessionData.expiresAt,
+		authType: "session",
+		...sessionIdentityCache.get(sessionData.token)
+	};
+};
+/**
+* Exchanges the access key for an access token. The client secret stays on
+* the server: only the resulting short-lived token reaches the browser.
+*/
+const resolveAccessKeyAuth = async (configuration) => {
+	const credentials = getCredentials(configuration);
+	if (!credentials) return null;
+	if (accessKeyAuthCache?.clientId === credentials.clientId && !isExpiringSoon(accessKeyAuthCache.expiresAt)) {
+		const { clientId: _clientId, ...cachedAuth } = accessKeyAuthCache;
+		return cachedAuth;
+	}
+	try {
+		const token = (await (0, _intlayer_api.getOAuthAPI)(void 0, { editor: {
+			...configuration.editor,
+			...credentials
+		} }).getOAuth2AccessToken()).data;
+		if (!token?.accessToken) return null;
+		const accessKeyAuth = {
+			accessToken: token.accessToken,
+			expiresAt: token.accessTokenExpiresAt ? new Date(token.accessTokenExpiresAt).toISOString() : null,
+			authType: "accessKey",
+			user: token.user,
+			organization: token.organization,
+			project: token.project
+		};
+		accessKeyAuthCache = {
+			...accessKeyAuth,
+			clientId: credentials.clientId
+		};
+		return accessKeyAuth;
+	} catch {
+		accessKeyAuthCache = null;
+		return null;
+	}
+};
+/**
+* Resolves the CMS identity of the editor, in the same order as the CLI:
+* `intlayer login` session first, then the access key.
+*/
+const resolveEditorAuth = async (configuration) => await resolveSessionAuth(configuration) ?? await resolveAccessKeyAuth(configuration);
+/**
+* Signs the editor out: drops the `intlayer login` session (shared with the
+* CLI), the pending login and the access key loaded during this run. An access
+* key set in the configuration stays in use, as for the CLI.
+*/
+const logoutEditor = async (configuration) => {
+	pendingLoginController?.abort();
+	runtimeCredentials = null;
+	accessKeyAuthCache = null;
+	sessionIdentityCache.clear();
+	await (0, _intlayer_cli.clearCliSessionToken)(configuration);
+};
+/** Whether an editor-triggered login is waiting for the browser callback. */
+const isEditorLoginPending = () => pendingLoginController !== null;
+/**
+* Starts the `intlayer login` browser flow. A login still pending is dropped
+* first, so a closed login tab can be reopened. Resolves once the CMS has
+* called back (the session token being stored for both the editor and the
+* CLI), or when the login is dropped or times out.
+*/
+const startEditorLogin = async (configuration, configOptions) => {
+	pendingLoginController?.abort();
+	const appLogger = (0, _intlayer_config_logger.getAppLogger)(configuration);
+	const loginController = new AbortController();
+	const timeout = setTimeout(() => loginController.abort(), LOGIN_TIMEOUT_MS);
+	pendingLoginController = loginController;
+	await (0, _intlayer_cli.login)({
+		exitAfter: false,
+		configOptions,
+		signal: loginController.signal,
+		onCredentials: (credentials) => {
+			runtimeCredentials = credentials;
+			accessKeyAuthCache = null;
+			appLogger("Access key loaded for this editor session. Insert it in your .env file to keep it:");
+			appLogger(`${(0, _intlayer_config_logger.colorize)("INTLAYER_CLIENT_ID=", _intlayer_config_colors.GREY_LIGHT)}${(0, _intlayer_config_logger.colorize)(credentials.clientId, _intlayer_config_colors.BLUE)}`);
+			appLogger(`${(0, _intlayer_config_logger.colorize)("INTLAYER_CLIENT_SECRET=", _intlayer_config_colors.GREY_LIGHT)}${(0, _intlayer_config_logger.colorize)(credentials.clientSecret, _intlayer_config_colors.BLUE)}`);
+		}
+	}).finally(() => {
+		clearTimeout(timeout);
+		if (pendingLoginController === loginController) pendingLoginController = null;
+	});
+};
+
+//#endregion
+exports.isEditorLoginPending = isEditorLoginPending;
+exports.logoutEditor = logoutEditor;
+exports.resolveEditorAuth = resolveEditorAuth;
+exports.startEditorLogin = startEditorLogin;
+//# sourceMappingURL=editorAuth.service.cjs.map

package/server/dist/services/editorAuth.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorAuth.service.cjs","names":["readCliSessionToken","getIntlayerAPIProxy","getOAuthAPI","clearCliSessionToken","getAppLogger","login","colorize","ANSIColors"],"sources":["../../src/services/editorAuth.service.ts"],"sourcesContent":["import { getIntlayerAPIProxy, getOAuthAPI } from '@intlayer/api';\nimport type { OrganizationAPI } from '@intlayer/backend-contract/organization';\nimport type { ProjectAPI } from '@intlayer/backend-contract/project';\nimport type { UserAPI } from '@intlayer/backend-contract/user';\nimport {\n  clearCliSessionToken,\n  login,\n  readCliSessionToken,\n} from '@intlayer/cli';\nimport * as ANSIColors from '@intlayer/config/colors';\nimport { colorize, getAppLogger } from '@intlayer/config/logger';\nimport type { GetConfigurationOptions } from '@intlayer/config/node';\nimport type { IntlayerConfig } from '@intlayer/types/config';\n\n/** Access-key credentials used for the client-credentials exchange. */\ntype EditorCredentials = {\n  clientId: string;\n  clientSecret: string;\n};\n\n/**\n * Identity the editor client uses to call the CMS, sent as a bearer token.\n *\n * - `session`: the user's short-lived `intlayer login` session token\n * - `accessKey`: an access token exchanged from the project access key\n */\nexport type EditorAuth = {\n  accessToken: string;\n  /** ISO date, `null` when the token never expires. */\n  expiresAt: string | null;\n  authType: 'session' | 'accessKey';\n  user?: UserAPI | null;\n  organization?: OrganizationAPI | null;\n  project?: ProjectAPI | null;\n};\n\n/** Time after which an unanswered login is given up. */\nconst LOGIN_TIMEOUT_MS = 5 * 60 * 1000;\n\n/** Margin before expiry under which a cached access token is renewed. */\nconst TOKEN_RENEWAL_MARGIN_MS = 60 * 1000;\n\n/** Credentials picked during an editor-triggered login, kept for this run. */\nlet runtimeCredentials: EditorCredentials | null = null;\n\n/** Access token exchanged from the access key, reused until it expires. */\nlet accessKeyAuthCache: (EditorAuth & { clientId: string }) | null = null;\n\n/** Identity bound to a CLI session token. */\ntype SessionIdentity = Pick<EditorAuth, 'user' | 'organization' | 'project'>;\n\n/** Identity bound to each CLI session token, resolved once per token. */\nconst sessionIdentityCache = new Map<string, SessionIdentity>();\n\n/** Aborts the login flow waiting for the browser callback, if any. */\nlet pendingLoginController: AbortController | null = null;\n\nconst isExpiringSoon = (expiresAt: string | null): boolean =>\n  expiresAt !== null &&\n  new Date(expiresAt).getTime() - TOKEN_RENEWAL_MARGIN_MS <= Date.now();\n\nconst getCredentials = (\n  configuration: IntlayerConfig\n): EditorCredentials | null => {\n  if (runtimeCredentials) return runtimeCredentials;\n\n  const { clientId, clientSecret } = configuration.editor;\n\n  return clientId && clientSecret ? { clientId, clientSecret } : null;\n};\n\n/**\n * Resolves the `intlayer login` session token, shared with the CLI through\n * the temp directory. `null` when absent, expired, or rejected by the CMS.\n */\nconst resolveSessionAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> => {\n  const sessionData = await readCliSessionToken(configuration);\n\n  if (!sessionData) return null;\n\n  if (!sessionIdentityCache.has(sessionData.token)) {\n    try {\n      const result = await getIntlayerAPIProxy(\n        undefined,\n        configuration,\n        sessionData.token\n      ).oAuth.getCliSessionMe();\n\n      sessionIdentityCache.set(sessionData.token, {\n        user: result.data?.user ?? null,\n        organization: result.data?.organization ?? null,\n        project: result.data?.project ?? null,\n      });\n    } catch {\n      // Revoked or unreachable: fall back to the access key, if any\n      return null;\n    }\n  }\n\n  return {\n    accessToken: sessionData.token,\n    expiresAt: sessionData.expiresAt,\n    authType: 'session',\n    ...sessionIdentityCache.get(sessionData.token),\n  };\n};\n\n/**\n * Exchanges the access key for an access token. The client secret stays on\n * the server: only the resulting short-lived token reaches the browser.\n */\nconst resolveAccessKeyAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> => {\n  const credentials = getCredentials(configuration);\n\n  if (!credentials) return null;\n\n  if (\n    accessKeyAuthCache?.clientId === credentials.clientId &&\n    !isExpiringSoon(accessKeyAuthCache.expiresAt)\n  ) {\n    const { clientId: _clientId, ...cachedAuth } = accessKeyAuthCache;\n    return cachedAuth;\n  }\n\n  try {\n    const result = await getOAuthAPI(undefined, {\n      editor: { ...configuration.editor, ...credentials },\n    }).getOAuth2AccessToken();\n\n    const token = result.data;\n\n    if (!token?.accessToken) return null;\n\n    const accessKeyAuth: EditorAuth = {\n      accessToken: token.accessToken,\n      expiresAt: token.accessTokenExpiresAt\n        ? new Date(token.accessTokenExpiresAt).toISOString()\n        : null,\n      authType: 'accessKey',\n      user: token.user,\n      organization: token.organization,\n      project: token.project,\n    };\n\n    accessKeyAuthCache = { ...accessKeyAuth, clientId: credentials.clientId };\n\n    return accessKeyAuth;\n  } catch {\n    accessKeyAuthCache = null;\n    return null;\n  }\n};\n\n/**\n * Resolves the CMS identity of the editor, in the same order as the CLI:\n * `intlayer login` session first, then the access key.\n */\nexport const resolveEditorAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> =>\n  (await resolveSessionAuth(configuration)) ??\n  (await resolveAccessKeyAuth(configuration));\n\n/**\n * Signs the editor out: drops the `intlayer login` session (shared with the\n * CLI), the pending login and the access key loaded during this run. An access\n * key set in the configuration stays in use, as for the CLI.\n */\nexport const logoutEditor = async (\n  configuration: IntlayerConfig\n): Promise<void> => {\n  pendingLoginController?.abort();\n  runtimeCredentials = null;\n  accessKeyAuthCache = null;\n  sessionIdentityCache.clear();\n\n  await clearCliSessionToken(configuration);\n};\n\n/** Whether an editor-triggered login is waiting for the browser callback. */\nexport const isEditorLoginPending = (): boolean =>\n  pendingLoginController !== null;\n\n/**\n * Starts the `intlayer login` browser flow. A login still pending is dropped\n * first, so a closed login tab can be reopened. Resolves once the CMS has\n * called back (the session token being stored for both the editor and the\n * CLI), or when the login is dropped or times out.\n */\nexport const startEditorLogin = async (\n  configuration: IntlayerConfig,\n  configOptions?: GetConfigurationOptions\n): Promise<void> => {\n  pendingLoginController?.abort();\n\n  const appLogger = getAppLogger(configuration);\n  const loginController = new AbortController();\n  const timeout = setTimeout(() => loginController.abort(), LOGIN_TIMEOUT_MS);\n\n  pendingLoginController = loginController;\n\n  await login({\n    exitAfter: false,\n    configOptions,\n    signal: loginController.signal,\n    onCredentials: (credentials) => {\n      runtimeCredentials = credentials;\n      accessKeyAuthCache = null;\n\n      appLogger(\n        'Access key loaded for this editor session. Insert it in your .env file to keep it:'\n      );\n      appLogger(\n        `${colorize('INTLAYER_CLIENT_ID=', ANSIColors.GREY_LIGHT)}${colorize(credentials.clientId, ANSIColors.BLUE)}`\n      );\n      appLogger(\n        `${colorize('INTLAYER_CLIENT_SECRET=', ANSIColors.GREY_LIGHT)}${colorize(credentials.clientSecret, ANSIColors.BLUE)}`\n      );\n    },\n  }).finally(() => {\n    clearTimeout(timeout);\n\n    if (pendingLoginController === loginController) {\n      pendingLoginController = null;\n    }\n  });\n};\n"],"mappings":";;;;;;;;;;AAqCA,MAAM,mBAAmB;;AAGzB,MAAM,0BAA0B;;AAGhC,IAAI,qBAA+C;;AAGnD,IAAI,qBAAiE;;AAMrE,MAAM,uCAAuB,IAAI,IAA6B;;AAG9D,IAAI,yBAAiD;AAErD,MAAM,kBAAkB,cACtB,cAAc,QACd,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,2BAA2B,KAAK,IAAI;AAEtE,MAAM,kBACJ,kBAC6B;CAC7B,IAAI,oBAAoB,OAAO;CAE/B,MAAM,EAAE,UAAU,iBAAiB,cAAc;CAEjD,OAAO,YAAY,eAAe;EAAE;EAAU;CAAa,IAAI;AACjE;;;;;AAMA,MAAM,qBAAqB,OACzB,kBAC+B;CAC/B,MAAM,cAAc,UAAMA,mCAAoB,aAAa;CAE3D,IAAI,CAAC,aAAa,OAAO;CAEzB,IAAI,CAAC,qBAAqB,IAAI,YAAY,KAAK,GAC7C,IAAI;EACF,MAAM,SAAS,UAAMC,mCACnB,QACA,eACA,YAAY,KACd,CAAC,CAAC,MAAM,gBAAgB;EAExB,qBAAqB,IAAI,YAAY,OAAO;GAC1C,MAAM,OAAO,MAAM,QAAQ;GAC3B,cAAc,OAAO,MAAM,gBAAgB;GAC3C,SAAS,OAAO,MAAM,WAAW;EACnC,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;CAGF,OAAO;EACL,aAAa,YAAY;EACzB,WAAW,YAAY;EACvB,UAAU;EACV,GAAG,qBAAqB,IAAI,YAAY,KAAK;CAC/C;AACF;;;;;AAMA,MAAM,uBAAuB,OAC3B,kBAC+B;CAC/B,MAAM,cAAc,eAAe,aAAa;CAEhD,IAAI,CAAC,aAAa,OAAO;CAEzB,IACE,oBAAoB,aAAa,YAAY,YAC7C,CAAC,eAAe,mBAAmB,SAAS,GAC5C;EACA,MAAM,EAAE,UAAU,WAAW,GAAG,eAAe;EAC/C,OAAO;CACT;CAEA,IAAI;EAKF,MAAM,SAAQ,UAJOC,2BAAY,QAAW,EAC1C,QAAQ;GAAE,GAAG,cAAc;GAAQ,GAAG;EAAY,EACpD,CAAC,CAAC,CAAC,qBAAqB,EAEJ,CAAC;EAErB,IAAI,CAAC,OAAO,aAAa,OAAO;EAEhC,MAAM,gBAA4B;GAChC,aAAa,MAAM;GACnB,WAAW,MAAM,uBACb,IAAI,KAAK,MAAM,oBAAoB,CAAC,CAAC,YAAY,IACjD;GACJ,UAAU;GACV,MAAM,MAAM;GACZ,cAAc,MAAM;GACpB,SAAS,MAAM;EACjB;EAEA,qBAAqB;GAAE,GAAG;GAAe,UAAU,YAAY;EAAS;EAExE,OAAO;CACT,QAAQ;EACN,qBAAqB;EACrB,OAAO;CACT;AACF;;;;;AAMA,MAAa,oBAAoB,OAC/B,kBAEC,MAAM,mBAAmB,aAAa,KACtC,MAAM,qBAAqB,aAAa;;;;;;AAO3C,MAAa,eAAe,OAC1B,kBACkB;CAClB,wBAAwB,MAAM;CAC9B,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB,MAAM;CAE3B,UAAMC,oCAAqB,aAAa;AAC1C;;AAGA,MAAa,6BACX,2BAA2B;;;;;;;AAQ7B,MAAa,mBAAmB,OAC9B,eACA,kBACkB;CAClB,wBAAwB,MAAM;CAE9B,MAAM,gBAAYC,sCAAa,aAAa;CAC5C,MAAM,kBAAkB,IAAI,gBAAgB;CAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,gBAAgB;CAE1E,yBAAyB;CAEzB,UAAMC,qBAAM;EACV,WAAW;EACX;EACA,QAAQ,gBAAgB;EACxB,gBAAgB,gBAAgB;GAC9B,qBAAqB;GACrB,qBAAqB;GAErB,UACE,oFACF;GACA,UACE,OAAGC,kCAAS,uBAAuBC,wBAAW,UAAU,QAAID,kCAAS,YAAY,UAAUC,wBAAW,IAAI,GAC5G;GACA,UACE,OAAGD,kCAAS,2BAA2BC,wBAAW,UAAU,QAAID,kCAAS,YAAY,cAAcC,wBAAW,IAAI,GACpH;EACF;CACF,CAAC,CAAC,CAAC,cAAc;EACf,aAAa,OAAO;EAEpB,IAAI,2BAA2B,iBAC7B,yBAAyB;CAE7B,CAAC;AACH"}

package/server/dist/services/editorAuth.service.d.ts

@@ -0,0 +1,43 @@
+import { OrganizationAPI } from "@intlayer/backend-contract/organization";
+import { ProjectAPI } from "@intlayer/backend-contract/project";
+import { UserAPI } from "@intlayer/backend-contract/user";
+import { GetConfigurationOptions } from "@intlayer/config/node";
+import { IntlayerConfig } from "@intlayer/types/config";
+//#region src/services/editorAuth.service.d.ts
+/**
+ * Identity the editor client uses to call the CMS, sent as a bearer token.
+ *
+ * - `session`: the user's short-lived `intlayer login` session token
+ * - `accessKey`: an access token exchanged from the project access key
+ */
+export type EditorAuth = {
+  accessToken: string;
+  /** ISO date, `null` when the token never expires. */
+  expiresAt: string | null;
+  authType: 'session' | 'accessKey';
+  user?: UserAPI | null;
+  organization?: OrganizationAPI | null;
+  project?: ProjectAPI | null;
+};
+/**
+ * Resolves the CMS identity of the editor, in the same order as the CLI:
+ * `intlayer login` session first, then the access key.
+ */
+export declare const resolveEditorAuth: (configuration: IntlayerConfig) => Promise<EditorAuth | null>;
+/**
+ * Signs the editor out: drops the `intlayer login` session (shared with the
+ * CLI), the pending login and the access key loaded during this run. An access
+ * key set in the configuration stays in use, as for the CLI.
+ */
+export declare const logoutEditor: (configuration: IntlayerConfig) => Promise<void>;
+/** Whether an editor-triggered login is waiting for the browser callback. */
+export declare const isEditorLoginPending: () => boolean;
+/**
+ * Starts the `intlayer login` browser flow. A login still pending is dropped
+ * first, so a closed login tab can be reopened. Resolves once the CMS has
+ * called back (the session token being stored for both the editor and the
+ * CLI), or when the login is dropped or times out.
+ */
+export declare const startEditorLogin: (configuration: IntlayerConfig, configOptions?: GetConfigurationOptions) => Promise<void>;
+//#endregion
+//# sourceMappingURL=editorAuth.service.d.ts.map

package/server/dist/services/editorAuth.service.mjs

@@ -0,0 +1,137 @@
+import * as ANSIColors from "@intlayer/config/colors";
+import { colorize, getAppLogger } from "@intlayer/config/logger";
+import { getIntlayerAPIProxy, getOAuthAPI } from "@intlayer/api";
+import { clearCliSessionToken, login, readCliSessionToken } from "@intlayer/cli";
+
+//#region src/services/editorAuth.service.ts
+/** Time after which an unanswered login is given up. */
+const LOGIN_TIMEOUT_MS = 3e5;
+/** Margin before expiry under which a cached access token is renewed. */
+const TOKEN_RENEWAL_MARGIN_MS = 6e4;
+/** Credentials picked during an editor-triggered login, kept for this run. */
+let runtimeCredentials = null;
+/** Access token exchanged from the access key, reused until it expires. */
+let accessKeyAuthCache = null;
+/** Identity bound to each CLI session token, resolved once per token. */
+const sessionIdentityCache = /* @__PURE__ */ new Map();
+/** Aborts the login flow waiting for the browser callback, if any. */
+let pendingLoginController = null;
+const isExpiringSoon = (expiresAt) => expiresAt !== null && new Date(expiresAt).getTime() - TOKEN_RENEWAL_MARGIN_MS <= Date.now();
+const getCredentials = (configuration) => {
+	if (runtimeCredentials) return runtimeCredentials;
+	const { clientId, clientSecret } = configuration.editor;
+	return clientId && clientSecret ? {
+		clientId,
+		clientSecret
+	} : null;
+};
+/**
+* Resolves the `intlayer login` session token, shared with the CLI through
+* the temp directory. `null` when absent, expired, or rejected by the CMS.
+*/
+const resolveSessionAuth = async (configuration) => {
+	const sessionData = await readCliSessionToken(configuration);
+	if (!sessionData) return null;
+	if (!sessionIdentityCache.has(sessionData.token)) try {
+		const result = await getIntlayerAPIProxy(void 0, configuration, sessionData.token).oAuth.getCliSessionMe();
+		sessionIdentityCache.set(sessionData.token, {
+			user: result.data?.user ?? null,
+			organization: result.data?.organization ?? null,
+			project: result.data?.project ?? null
+		});
+	} catch {
+		return null;
+	}
+	return {
+		accessToken: sessionData.token,
+		expiresAt: sessionData.expiresAt,
+		authType: "session",
+		...sessionIdentityCache.get(sessionData.token)
+	};
+};
+/**
+* Exchanges the access key for an access token. The client secret stays on
+* the server: only the resulting short-lived token reaches the browser.
+*/
+const resolveAccessKeyAuth = async (configuration) => {
+	const credentials = getCredentials(configuration);
+	if (!credentials) return null;
+	if (accessKeyAuthCache?.clientId === credentials.clientId && !isExpiringSoon(accessKeyAuthCache.expiresAt)) {
+		const { clientId: _clientId, ...cachedAuth } = accessKeyAuthCache;
+		return cachedAuth;
+	}
+	try {
+		const token = (await getOAuthAPI(void 0, { editor: {
+			...configuration.editor,
+			...credentials
+		} }).getOAuth2AccessToken()).data;
+		if (!token?.accessToken) return null;
+		const accessKeyAuth = {
+			accessToken: token.accessToken,
+			expiresAt: token.accessTokenExpiresAt ? new Date(token.accessTokenExpiresAt).toISOString() : null,
+			authType: "accessKey",
+			user: token.user,
+			organization: token.organization,
+			project: token.project
+		};
+		accessKeyAuthCache = {
+			...accessKeyAuth,
+			clientId: credentials.clientId
+		};
+		return accessKeyAuth;
+	} catch {
+		accessKeyAuthCache = null;
+		return null;
+	}
+};
+/**
+* Resolves the CMS identity of the editor, in the same order as the CLI:
+* `intlayer login` session first, then the access key.
+*/
+const resolveEditorAuth = async (configuration) => await resolveSessionAuth(configuration) ?? await resolveAccessKeyAuth(configuration);
+/**
+* Signs the editor out: drops the `intlayer login` session (shared with the
+* CLI), the pending login and the access key loaded during this run. An access
+* key set in the configuration stays in use, as for the CLI.
+*/
+const logoutEditor = async (configuration) => {
+	pendingLoginController?.abort();
+	runtimeCredentials = null;
+	accessKeyAuthCache = null;
+	sessionIdentityCache.clear();
+	await clearCliSessionToken(configuration);
+};
+/** Whether an editor-triggered login is waiting for the browser callback. */
+const isEditorLoginPending = () => pendingLoginController !== null;
+/**
+* Starts the `intlayer login` browser flow. A login still pending is dropped
+* first, so a closed login tab can be reopened. Resolves once the CMS has
+* called back (the session token being stored for both the editor and the
+* CLI), or when the login is dropped or times out.
+*/
+const startEditorLogin = async (configuration, configOptions) => {
+	pendingLoginController?.abort();
+	const appLogger = getAppLogger(configuration);
+	const loginController = new AbortController();
+	const timeout = setTimeout(() => loginController.abort(), LOGIN_TIMEOUT_MS);
+	pendingLoginController = loginController;
+	await login({
+		exitAfter: false,
+		configOptions,
+		signal: loginController.signal,
+		onCredentials: (credentials) => {
+			runtimeCredentials = credentials;
+			accessKeyAuthCache = null;
+			appLogger("Access key loaded for this editor session. Insert it in your .env file to keep it:");
+			appLogger(`${colorize("INTLAYER_CLIENT_ID=", ANSIColors.GREY_LIGHT)}${colorize(credentials.clientId, ANSIColors.BLUE)}`);
+			appLogger(`${colorize("INTLAYER_CLIENT_SECRET=", ANSIColors.GREY_LIGHT)}${colorize(credentials.clientSecret, ANSIColors.BLUE)}`);
+		}
+	}).finally(() => {
+		clearTimeout(timeout);
+		if (pendingLoginController === loginController) pendingLoginController = null;
+	});
+};
+
+//#endregion
+export { isEditorLoginPending, logoutEditor, resolveEditorAuth, startEditorLogin };
+//# sourceMappingURL=editorAuth.service.mjs.map

package/server/dist/services/editorAuth.service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorAuth.service.mjs","names":[],"sources":["../../src/services/editorAuth.service.ts"],"sourcesContent":["import { getIntlayerAPIProxy, getOAuthAPI } from '@intlayer/api';\nimport type { OrganizationAPI } from '@intlayer/backend-contract/organization';\nimport type { ProjectAPI } from '@intlayer/backend-contract/project';\nimport type { UserAPI } from '@intlayer/backend-contract/user';\nimport {\n  clearCliSessionToken,\n  login,\n  readCliSessionToken,\n} from '@intlayer/cli';\nimport * as ANSIColors from '@intlayer/config/colors';\nimport { colorize, getAppLogger } from '@intlayer/config/logger';\nimport type { GetConfigurationOptions } from '@intlayer/config/node';\nimport type { IntlayerConfig } from '@intlayer/types/config';\n\n/** Access-key credentials used for the client-credentials exchange. */\ntype EditorCredentials = {\n  clientId: string;\n  clientSecret: string;\n};\n\n/**\n * Identity the editor client uses to call the CMS, sent as a bearer token.\n *\n * - `session`: the user's short-lived `intlayer login` session token\n * - `accessKey`: an access token exchanged from the project access key\n */\nexport type EditorAuth = {\n  accessToken: string;\n  /** ISO date, `null` when the token never expires. */\n  expiresAt: string | null;\n  authType: 'session' | 'accessKey';\n  user?: UserAPI | null;\n  organization?: OrganizationAPI | null;\n  project?: ProjectAPI | null;\n};\n\n/** Time after which an unanswered login is given up. */\nconst LOGIN_TIMEOUT_MS = 5 * 60 * 1000;\n\n/** Margin before expiry under which a cached access token is renewed. */\nconst TOKEN_RENEWAL_MARGIN_MS = 60 * 1000;\n\n/** Credentials picked during an editor-triggered login, kept for this run. */\nlet runtimeCredentials: EditorCredentials | null = null;\n\n/** Access token exchanged from the access key, reused until it expires. */\nlet accessKeyAuthCache: (EditorAuth & { clientId: string }) | null = null;\n\n/** Identity bound to a CLI session token. */\ntype SessionIdentity = Pick<EditorAuth, 'user' | 'organization' | 'project'>;\n\n/** Identity bound to each CLI session token, resolved once per token. */\nconst sessionIdentityCache = new Map<string, SessionIdentity>();\n\n/** Aborts the login flow waiting for the browser callback, if any. */\nlet pendingLoginController: AbortController | null = null;\n\nconst isExpiringSoon = (expiresAt: string | null): boolean =>\n  expiresAt !== null &&\n  new Date(expiresAt).getTime() - TOKEN_RENEWAL_MARGIN_MS <= Date.now();\n\nconst getCredentials = (\n  configuration: IntlayerConfig\n): EditorCredentials | null => {\n  if (runtimeCredentials) return runtimeCredentials;\n\n  const { clientId, clientSecret } = configuration.editor;\n\n  return clientId && clientSecret ? { clientId, clientSecret } : null;\n};\n\n/**\n * Resolves the `intlayer login` session token, shared with the CLI through\n * the temp directory. `null` when absent, expired, or rejected by the CMS.\n */\nconst resolveSessionAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> => {\n  const sessionData = await readCliSessionToken(configuration);\n\n  if (!sessionData) return null;\n\n  if (!sessionIdentityCache.has(sessionData.token)) {\n    try {\n      const result = await getIntlayerAPIProxy(\n        undefined,\n        configuration,\n        sessionData.token\n      ).oAuth.getCliSessionMe();\n\n      sessionIdentityCache.set(sessionData.token, {\n        user: result.data?.user ?? null,\n        organization: result.data?.organization ?? null,\n        project: result.data?.project ?? null,\n      });\n    } catch {\n      // Revoked or unreachable: fall back to the access key, if any\n      return null;\n    }\n  }\n\n  return {\n    accessToken: sessionData.token,\n    expiresAt: sessionData.expiresAt,\n    authType: 'session',\n    ...sessionIdentityCache.get(sessionData.token),\n  };\n};\n\n/**\n * Exchanges the access key for an access token. The client secret stays on\n * the server: only the resulting short-lived token reaches the browser.\n */\nconst resolveAccessKeyAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> => {\n  const credentials = getCredentials(configuration);\n\n  if (!credentials) return null;\n\n  if (\n    accessKeyAuthCache?.clientId === credentials.clientId &&\n    !isExpiringSoon(accessKeyAuthCache.expiresAt)\n  ) {\n    const { clientId: _clientId, ...cachedAuth } = accessKeyAuthCache;\n    return cachedAuth;\n  }\n\n  try {\n    const result = await getOAuthAPI(undefined, {\n      editor: { ...configuration.editor, ...credentials },\n    }).getOAuth2AccessToken();\n\n    const token = result.data;\n\n    if (!token?.accessToken) return null;\n\n    const accessKeyAuth: EditorAuth = {\n      accessToken: token.accessToken,\n      expiresAt: token.accessTokenExpiresAt\n        ? new Date(token.accessTokenExpiresAt).toISOString()\n        : null,\n      authType: 'accessKey',\n      user: token.user,\n      organization: token.organization,\n      project: token.project,\n    };\n\n    accessKeyAuthCache = { ...accessKeyAuth, clientId: credentials.clientId };\n\n    return accessKeyAuth;\n  } catch {\n    accessKeyAuthCache = null;\n    return null;\n  }\n};\n\n/**\n * Resolves the CMS identity of the editor, in the same order as the CLI:\n * `intlayer login` session first, then the access key.\n */\nexport const resolveEditorAuth = async (\n  configuration: IntlayerConfig\n): Promise<EditorAuth | null> =>\n  (await resolveSessionAuth(configuration)) ??\n  (await resolveAccessKeyAuth(configuration));\n\n/**\n * Signs the editor out: drops the `intlayer login` session (shared with the\n * CLI), the pending login and the access key loaded during this run. An access\n * key set in the configuration stays in use, as for the CLI.\n */\nexport const logoutEditor = async (\n  configuration: IntlayerConfig\n): Promise<void> => {\n  pendingLoginController?.abort();\n  runtimeCredentials = null;\n  accessKeyAuthCache = null;\n  sessionIdentityCache.clear();\n\n  await clearCliSessionToken(configuration);\n};\n\n/** Whether an editor-triggered login is waiting for the browser callback. */\nexport const isEditorLoginPending = (): boolean =>\n  pendingLoginController !== null;\n\n/**\n * Starts the `intlayer login` browser flow. A login still pending is dropped\n * first, so a closed login tab can be reopened. Resolves once the CMS has\n * called back (the session token being stored for both the editor and the\n * CLI), or when the login is dropped or times out.\n */\nexport const startEditorLogin = async (\n  configuration: IntlayerConfig,\n  configOptions?: GetConfigurationOptions\n): Promise<void> => {\n  pendingLoginController?.abort();\n\n  const appLogger = getAppLogger(configuration);\n  const loginController = new AbortController();\n  const timeout = setTimeout(() => loginController.abort(), LOGIN_TIMEOUT_MS);\n\n  pendingLoginController = loginController;\n\n  await login({\n    exitAfter: false,\n    configOptions,\n    signal: loginController.signal,\n    onCredentials: (credentials) => {\n      runtimeCredentials = credentials;\n      accessKeyAuthCache = null;\n\n      appLogger(\n        'Access key loaded for this editor session. Insert it in your .env file to keep it:'\n      );\n      appLogger(\n        `${colorize('INTLAYER_CLIENT_ID=', ANSIColors.GREY_LIGHT)}${colorize(credentials.clientId, ANSIColors.BLUE)}`\n      );\n      appLogger(\n        `${colorize('INTLAYER_CLIENT_SECRET=', ANSIColors.GREY_LIGHT)}${colorize(credentials.clientSecret, ANSIColors.BLUE)}`\n      );\n    },\n  }).finally(() => {\n    clearTimeout(timeout);\n\n    if (pendingLoginController === loginController) {\n      pendingLoginController = null;\n    }\n  });\n};\n"],"mappings":";;;;;;;AAqCA,MAAM,mBAAmB;;AAGzB,MAAM,0BAA0B;;AAGhC,IAAI,qBAA+C;;AAGnD,IAAI,qBAAiE;;AAMrE,MAAM,uCAAuB,IAAI,IAA6B;;AAG9D,IAAI,yBAAiD;AAErD,MAAM,kBAAkB,cACtB,cAAc,QACd,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,2BAA2B,KAAK,IAAI;AAEtE,MAAM,kBACJ,kBAC6B;CAC7B,IAAI,oBAAoB,OAAO;CAE/B,MAAM,EAAE,UAAU,iBAAiB,cAAc;CAEjD,OAAO,YAAY,eAAe;EAAE;EAAU;CAAa,IAAI;AACjE;;;;;AAMA,MAAM,qBAAqB,OACzB,kBAC+B;CAC/B,MAAM,cAAc,MAAM,oBAAoB,aAAa;CAE3D,IAAI,CAAC,aAAa,OAAO;CAEzB,IAAI,CAAC,qBAAqB,IAAI,YAAY,KAAK,GAC7C,IAAI;EACF,MAAM,SAAS,MAAM,oBACnB,QACA,eACA,YAAY,KACd,CAAC,CAAC,MAAM,gBAAgB;EAExB,qBAAqB,IAAI,YAAY,OAAO;GAC1C,MAAM,OAAO,MAAM,QAAQ;GAC3B,cAAc,OAAO,MAAM,gBAAgB;GAC3C,SAAS,OAAO,MAAM,WAAW;EACnC,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;CAGF,OAAO;EACL,aAAa,YAAY;EACzB,WAAW,YAAY;EACvB,UAAU;EACV,GAAG,qBAAqB,IAAI,YAAY,KAAK;CAC/C;AACF;;;;;AAMA,MAAM,uBAAuB,OAC3B,kBAC+B;CAC/B,MAAM,cAAc,eAAe,aAAa;CAEhD,IAAI,CAAC,aAAa,OAAO;CAEzB,IACE,oBAAoB,aAAa,YAAY,YAC7C,CAAC,eAAe,mBAAmB,SAAS,GAC5C;EACA,MAAM,EAAE,UAAU,WAAW,GAAG,eAAe;EAC/C,OAAO;CACT;CAEA,IAAI;EAKF,MAAM,SAAQ,MAJO,YAAY,QAAW,EAC1C,QAAQ;GAAE,GAAG,cAAc;GAAQ,GAAG;EAAY,EACpD,CAAC,CAAC,CAAC,qBAAqB,EAEJ,CAAC;EAErB,IAAI,CAAC,OAAO,aAAa,OAAO;EAEhC,MAAM,gBAA4B;GAChC,aAAa,MAAM;GACnB,WAAW,MAAM,uBACb,IAAI,KAAK,MAAM,oBAAoB,CAAC,CAAC,YAAY,IACjD;GACJ,UAAU;GACV,MAAM,MAAM;GACZ,cAAc,MAAM;GACpB,SAAS,MAAM;EACjB;EAEA,qBAAqB;GAAE,GAAG;GAAe,UAAU,YAAY;EAAS;EAExE,OAAO;CACT,QAAQ;EACN,qBAAqB;EACrB,OAAO;CACT;AACF;;;;;AAMA,MAAa,oBAAoB,OAC/B,kBAEC,MAAM,mBAAmB,aAAa,KACtC,MAAM,qBAAqB,aAAa;;;;;;AAO3C,MAAa,eAAe,OAC1B,kBACkB;CAClB,wBAAwB,MAAM;CAC9B,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB,MAAM;CAE3B,MAAM,qBAAqB,aAAa;AAC1C;;AAGA,MAAa,6BACX,2BAA2B;;;;;;;AAQ7B,MAAa,mBAAmB,OAC9B,eACA,kBACkB;CAClB,wBAAwB,MAAM;CAE9B,MAAM,YAAY,aAAa,aAAa;CAC5C,MAAM,kBAAkB,IAAI,gBAAgB;CAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,gBAAgB;CAE1E,yBAAyB;CAEzB,MAAM,MAAM;EACV,WAAW;EACX;EACA,QAAQ,gBAAgB;EACxB,gBAAgB,gBAAgB;GAC9B,qBAAqB;GACrB,qBAAqB;GAErB,UACE,oFACF;GACA,UACE,GAAG,SAAS,uBAAuB,WAAW,UAAU,IAAI,SAAS,YAAY,UAAU,WAAW,IAAI,GAC5G;GACA,UACE,GAAG,SAAS,2BAA2B,WAAW,UAAU,IAAI,SAAS,YAAY,cAAc,WAAW,IAAI,GACpH;EACF;CACF,CAAC,CAAC,CAAC,cAAc;EACf,aAAa,OAAO;EAEpB,IAAI,2BAA2B,iBAC7B,yBAAyB;CAE7B,CAAC;AACH"}

package/server/dist/utils/checkPortAvailability.cjs

@@ -4,21 +4,47 @@ let node_net = require("node:net");
 node_net = require_runtime.__toESM(node_net, 1);
 
 //#region src/utils/checkPortAvailability.ts
-const checkPortAvailability = (port) => {
-	return new Promise((resolve) => {
-		const server = node_net.default.createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve(false);
-			else resolve(true);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve(true);
-		});
-		server.listen(port);
+/**
+* Resolves `false` when `port` is already bound on `host`.
+*
+* Probe the same host the server listens on: on macOS an IPv6 `::` probe
+* succeeds even when `0.0.0.0:port` is taken.
+*/
+const checkPortAvailability = (port, host = "0.0.0.0") => new Promise((resolve) => {
+	const server = node_net.default.createServer();
+	server.once("error", (error) => {
+		resolve(error.code !== "EADDRINUSE");
 	});
+	server.once("listening", () => {
+		server.close();
+		resolve(true);
+	});
+	server.listen(port, host);
+});
+/**
+* Loopback hosts probed besides the listening one: a server bound to a single
+* loopback address (e.g. a dev server on `::1`) would shadow the editor for
+* `localhost` while leaving `0.0.0.0` free.
+*/
+const LOOPBACK_HOSTS = ["127.0.0.1", "::1"];
+/**
+* First port from `startPort` free on `host` and on the loopback addresses,
+* trying the next ones in order.
+*
+* @returns The port, or `undefined` when the `attempts` ports are all taken.
+*/
+const findAvailablePort = async (startPort, host = "0.0.0.0", attempts = 20) => {
+	for (let port = startPort; port < startPort + attempts; port++) {
+		let isAvailable = true;
+		for (const probedHost of [host, ...LOOPBACK_HOSTS]) {
+			isAvailable = await checkPortAvailability(port, probedHost);
+			if (!isAvailable) break;
+		}
+		if (isAvailable) return port;
+	}
 };
 
 //#endregion
 exports.checkPortAvailability = checkPortAvailability;
+exports.findAvailablePort = findAvailablePort;
 //# sourceMappingURL=checkPortAvailability.cjs.map

package/server/dist/utils/checkPortAvailability.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"checkPortAvailability.cjs","names":["net"],"sources":["../../src/utils/checkPortAvailability.ts"],"sourcesContent":["import net from 'node:net';\n\nexport const checkPortAvailability = (port: number): Promise<boolean> => {\n  return new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once('error', (err: any) => {\n      if (err.code === 'EADDRINUSE') {\n        resolve(false); // Port is in use\n      } else {\n        resolve(true);\n      }\n    });\n\n    server.once('listening', () => {\n      server.close();\n      resolve(true); // Port is available\n    });\n\n    server.listen(port);\n  });\n};\n"],"mappings":";;;;;;AAEA,MAAa,yBAAyB,SAAmC;CACvE,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,SAASA,iBAAI,aAAa;EAEhC,OAAO,KAAK,UAAU,QAAa;GACjC,IAAI,IAAI,SAAS,cACf,QAAQ,KAAK;QAEb,QAAQ,IAAI;EAEhB,CAAC;EAED,OAAO,KAAK,mBAAmB;GAC7B,OAAO,MAAM;GACb,QAAQ,IAAI;EACd,CAAC;EAED,OAAO,OAAO,IAAI;CACpB,CAAC;AACH"}
+{"version":3,"file":"checkPortAvailability.cjs","names":["net"],"sources":["../../src/utils/checkPortAvailability.ts"],"sourcesContent":["import net from 'node:net';\n\n/**\n * Resolves `false` when `port` is already bound on `host`.\n *\n * Probe the same host the server listens on: on macOS an IPv6 `::` probe\n * succeeds even when `0.0.0.0:port` is taken.\n */\nexport const checkPortAvailability = (\n  port: number,\n  host = '0.0.0.0'\n): Promise<boolean> =>\n  new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once('error', (error: NodeJS.ErrnoException) => {\n      resolve(error.code !== 'EADDRINUSE');\n    });\n\n    server.once('listening', () => {\n      server.close();\n      resolve(true);\n    });\n\n    server.listen(port, host);\n  });\n\n/**\n * Loopback hosts probed besides the listening one: a server bound to a single\n * loopback address (e.g. a dev server on `::1`) would shadow the editor for\n * `localhost` while leaving `0.0.0.0` free.\n */\nconst LOOPBACK_HOSTS = ['127.0.0.1', '::1'] as const;\n\n/**\n * First port from `startPort` free on `host` and on the loopback addresses,\n * trying the next ones in order.\n *\n * @returns The port, or `undefined` when the `attempts` ports are all taken.\n */\nexport const findAvailablePort = async (\n  startPort: number,\n  host = '0.0.0.0',\n  attempts = 20\n): Promise<number | undefined> => {\n  for (let port = startPort; port < startPort + attempts; port++) {\n    let isAvailable = true;\n\n    for (const probedHost of [host, ...LOOPBACK_HOSTS]) {\n      isAvailable = await checkPortAvailability(port, probedHost);\n      if (!isAvailable) break;\n    }\n\n    if (isAvailable) return port;\n  }\n\n  return undefined;\n};\n"],"mappings":";;;;;;;;;;;;AAQA,MAAa,yBACX,MACA,OAAO,cAEP,IAAI,SAAS,YAAY;CACvB,MAAM,SAASA,iBAAI,aAAa;CAEhC,OAAO,KAAK,UAAU,UAAiC;EACrD,QAAQ,MAAM,SAAS,YAAY;CACrC,CAAC;CAED,OAAO,KAAK,mBAAmB;EAC7B,OAAO,MAAM;EACb,QAAQ,IAAI;CACd,CAAC;CAED,OAAO,OAAO,MAAM,IAAI;AAC1B,CAAC;;;;;;AAOH,MAAM,iBAAiB,CAAC,aAAa,KAAK;;;;;;;AAQ1C,MAAa,oBAAoB,OAC/B,WACA,OAAO,WACP,WAAW,OACqB;CAChC,KAAK,IAAI,OAAO,WAAW,OAAO,YAAY,UAAU,QAAQ;EAC9D,IAAI,cAAc;EAElB,KAAK,MAAM,cAAc,CAAC,MAAM,GAAG,cAAc,GAAG;GAClD,cAAc,MAAM,sBAAsB,MAAM,UAAU;GAC1D,IAAI,CAAC,aAAa;EACpB;EAEA,IAAI,aAAa,OAAO;CAC1B;AAGF"}

package/server/dist/utils/checkPortAvailability.d.ts

@@ -1,4 +1,17 @@
 //#region src/utils/checkPortAvailability.d.ts
-export declare const checkPortAvailability: (port: number) => Promise<boolean>;
+/**
+ * Resolves `false` when `port` is already bound on `host`.
+ *
+ * Probe the same host the server listens on: on macOS an IPv6 `::` probe
+ * succeeds even when `0.0.0.0:port` is taken.
+ */
+export declare const checkPortAvailability: (port: number, host?: string) => Promise<boolean>;
+/**
+ * First port from `startPort` free on `host` and on the loopback addresses,
+ * trying the next ones in order.
+ *
+ * @returns The port, or `undefined` when the `attempts` ports are all taken.
+ */
+export declare const findAvailablePort: (startPort: number, host?: string, attempts?: number) => Promise<number | undefined>;
 //#endregion
 //# sourceMappingURL=checkPortAvailability.d.ts.map

package/server/dist/utils/checkPortAvailability.mjs

@@ -1,21 +1,46 @@
 import net from "node:net";
 
 //#region src/utils/checkPortAvailability.ts
-const checkPortAvailability = (port) => {
-	return new Promise((resolve) => {
-		const server = net.createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve(false);
-			else resolve(true);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve(true);
-		});
-		server.listen(port);
+/**
+* Resolves `false` when `port` is already bound on `host`.
+*
+* Probe the same host the server listens on: on macOS an IPv6 `::` probe
+* succeeds even when `0.0.0.0:port` is taken.
+*/
+const checkPortAvailability = (port, host = "0.0.0.0") => new Promise((resolve) => {
+	const server = net.createServer();
+	server.once("error", (error) => {
+		resolve(error.code !== "EADDRINUSE");
 	});
+	server.once("listening", () => {
+		server.close();
+		resolve(true);
+	});
+	server.listen(port, host);
+});
+/**
+* Loopback hosts probed besides the listening one: a server bound to a single
+* loopback address (e.g. a dev server on `::1`) would shadow the editor for
+* `localhost` while leaving `0.0.0.0` free.
+*/
+const LOOPBACK_HOSTS = ["127.0.0.1", "::1"];
+/**
+* First port from `startPort` free on `host` and on the loopback addresses,
+* trying the next ones in order.
+*
+* @returns The port, or `undefined` when the `attempts` ports are all taken.
+*/
+const findAvailablePort = async (startPort, host = "0.0.0.0", attempts = 20) => {
+	for (let port = startPort; port < startPort + attempts; port++) {
+		let isAvailable = true;
+		for (const probedHost of [host, ...LOOPBACK_HOSTS]) {
+			isAvailable = await checkPortAvailability(port, probedHost);
+			if (!isAvailable) break;
+		}
+		if (isAvailable) return port;
+	}
 };
 
 //#endregion
-export { checkPortAvailability };
+export { checkPortAvailability, findAvailablePort };
 //# sourceMappingURL=checkPortAvailability.mjs.map

package/server/dist/utils/checkPortAvailability.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"checkPortAvailability.mjs","names":[],"sources":["../../src/utils/checkPortAvailability.ts"],"sourcesContent":["import net from 'node:net';\n\nexport const checkPortAvailability = (port: number): Promise<boolean> => {\n  return new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once('error', (err: any) => {\n      if (err.code === 'EADDRINUSE') {\n        resolve(false); // Port is in use\n      } else {\n        resolve(true);\n      }\n    });\n\n    server.once('listening', () => {\n      server.close();\n      resolve(true); // Port is available\n    });\n\n    server.listen(port);\n  });\n};\n"],"mappings":";;;AAEA,MAAa,yBAAyB,SAAmC;CACvE,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,SAAS,IAAI,aAAa;EAEhC,OAAO,KAAK,UAAU,QAAa;GACjC,IAAI,IAAI,SAAS,cACf,QAAQ,KAAK;QAEb,QAAQ,IAAI;EAEhB,CAAC;EAED,OAAO,KAAK,mBAAmB;GAC7B,OAAO,MAAM;GACb,QAAQ,IAAI;EACd,CAAC;EAED,OAAO,OAAO,IAAI;CACpB,CAAC;AACH"}
+{"version":3,"file":"checkPortAvailability.mjs","names":[],"sources":["../../src/utils/checkPortAvailability.ts"],"sourcesContent":["import net from 'node:net';\n\n/**\n * Resolves `false` when `port` is already bound on `host`.\n *\n * Probe the same host the server listens on: on macOS an IPv6 `::` probe\n * succeeds even when `0.0.0.0:port` is taken.\n */\nexport const checkPortAvailability = (\n  port: number,\n  host = '0.0.0.0'\n): Promise<boolean> =>\n  new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once('error', (error: NodeJS.ErrnoException) => {\n      resolve(error.code !== 'EADDRINUSE');\n    });\n\n    server.once('listening', () => {\n      server.close();\n      resolve(true);\n    });\n\n    server.listen(port, host);\n  });\n\n/**\n * Loopback hosts probed besides the listening one: a server bound to a single\n * loopback address (e.g. a dev server on `::1`) would shadow the editor for\n * `localhost` while leaving `0.0.0.0` free.\n */\nconst LOOPBACK_HOSTS = ['127.0.0.1', '::1'] as const;\n\n/**\n * First port from `startPort` free on `host` and on the loopback addresses,\n * trying the next ones in order.\n *\n * @returns The port, or `undefined` when the `attempts` ports are all taken.\n */\nexport const findAvailablePort = async (\n  startPort: number,\n  host = '0.0.0.0',\n  attempts = 20\n): Promise<number | undefined> => {\n  for (let port = startPort; port < startPort + attempts; port++) {\n    let isAvailable = true;\n\n    for (const probedHost of [host, ...LOOPBACK_HOSTS]) {\n      isAvailable = await checkPortAvailability(port, probedHost);\n      if (!isAvailable) break;\n    }\n\n    if (isAvailable) return port;\n  }\n\n  return undefined;\n};\n"],"mappings":";;;;;;;;;AAQA,MAAa,yBACX,MACA,OAAO,cAEP,IAAI,SAAS,YAAY;CACvB,MAAM,SAAS,IAAI,aAAa;CAEhC,OAAO,KAAK,UAAU,UAAiC;EACrD,QAAQ,MAAM,SAAS,YAAY;CACrC,CAAC;CAED,OAAO,KAAK,mBAAmB;EAC7B,OAAO,MAAM;EACb,QAAQ,IAAI;CACd,CAAC;CAED,OAAO,OAAO,MAAM,IAAI;AAC1B,CAAC;;;;;;AAOH,MAAM,iBAAiB,CAAC,aAAa,KAAK;;;;;;;AAQ1C,MAAa,oBAAoB,OAC/B,WACA,OAAO,WACP,WAAW,OACqB;CAChC,KAAK,IAAI,OAAO,WAAW,OAAO,YAAY,UAAU,QAAQ;EAC9D,IAAI,cAAc;EAElB,KAAK,MAAM,cAAc,CAAC,MAAM,GAAG,cAAc,GAAG;GAClD,cAAc,MAAM,sBAAsB,MAAM,UAAU;GAC1D,IAAI,CAAC,aAAa;EACpB;EAEA,IAAI,aAAa,OAAO;CAC1B;AAGF"}

package/client/dist/assets/CodeBlockShiki-df1uxmSd.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/shikiBundle-C3MOPHUk.js","assets/rolldown-runtime-hePW80VL.js","assets/MarkDownRender-MV3lk0jo.js","assets/react-Cvdyeg_0.js","assets/dynamic-OZWF58s3.js","assets/dist-CcmWBeAo.js","assets/index-DPHRjaWO.js","assets/index-D82ZIHVs.css"])))=>i.map(i=>d[i]);
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{t}from"./react-Cvdyeg_0.js";import{n}from"./dist-CcmWBeAo.js";import{d as r,l as i,o as a,u as o}from"./MarkDownRender-MV3lk0jo.js";import{l as s}from"./index-DPHRjaWO.js";var c=e(t(),1),l=n(),u=async(e,t)=>{let{codeToHtml:n}=await s(async()=>{let{codeToHtml:e}=await import(`./shikiBundle-C3MOPHUk.js`).then(e=>e.i);return{codeToHtml:e}},__vite__mapDeps([0,1,2,3,4,5,6,7]));return n(String(e),{lang:i(t).id,themes:a,defaultColor:!1})},d=({children:e,lang:t})=>{let[n,i]=(0,c.useState)(null);return(0,c.useEffect)(()=>{let n=!1;return u(e,t).then(e=>{n||i(e)}).catch(e=>{console.error(`Failed to highlight code:`,e),n||i(``)}),()=>{n=!0}},[e,t]),(0,l.jsx)(`div`,{className:r,children:n?(0,l.jsx)(`div`,{dangerouslySetInnerHTML:{__html:n}}):(0,l.jsx)(o,{children:e})})};export{d as CodeBlockShiki};

package/client/dist/assets/MarkDownRender-DYcnaCQP.js

@@ -1 +0,0 @@
-import{t as e}from"./MarkDownRender-MV3lk0jo.js";export{e as MarkdownRenderer};