metergraph-cli 0.2.1 → 0.2.3

package/src/auth-browser.js

@@ -1,6 +1,8 @@
 import childProcess from "node:child_process";
 import path from "node:path";
 
+import { classifyEnvironment } from "./environment.js";
+
 // Opens a URL with the operating system's own launcher: a fixed executable
 // and an argument array, never a shell. The URL is the authorization request
 // (public client ID, state and PKCE challenge); no token, code or verifier is
@@ -51,24 +53,8 @@ export function systemRoot() {
   return "C:\\Windows";
 }
 
-// Variables whose presence means the browser a person uses is not on this
-// machine, or no person is present. Only presence is checked; values are
-// never read into output.
-const REMOTE_MARKERS = [
-  ["ssh_session", ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"]],
-  ["cloud_workspace", ["CODESPACES", "GITPOD_WORKSPACE_ID", "CLOUD_SHELL"]],
-  ["ci_environment", ["CI"]],
-];
-
-// Returns null for an ordinary local session, or a fixed reason token.
+// Returns null for an ordinary local session (including a local container),
+// or the fixed reason token of a remote or CI session. See environment.js.
 export function detectRemoteSession(env = process.env) {
-  for (const [reason, names] of REMOTE_MARKERS) {
-    for (const name of names) {
-      const value = env[name];
-      if (typeof value === "string" && value !== "" && value !== "0" && value.toLowerCase() !== "false") {
-        return reason;
-      }
-    }
-  }
-  return null;
+  return classifyEnvironment(env, { fileExists: () => false }).reason;
 }

package/src/auth-callback.js

@@ -1,6 +1,8 @@
 import { timingSafeEqual } from "node:crypto";
 import http from "node:http";
 
+import { PAGE_CSP, PAGES } from "./callback-page.js";
+
 // Loopback listener for the OAuth redirect (RFC 8252 section 7.3). It binds
 // 127.0.0.1 on an ephemeral port and accepts exactly one callback: a GET on
 // the fixed path, with the exact Host, one state that matches, and either one
@@ -14,23 +16,19 @@ const HOST = "127.0.0.1";
 const MAX_URL_LENGTH = 4096;
 const MAX_CODE_LENGTH = 2048;
 const ALLOWED_PARAMS = new Set(["code", "state", "error", "error_description", "error_uri", "iss"]);
+// The setup receipt a combined sign-in approval returns next to the code.
+// Accepted only by a wait that asked for it.
+export const SETUP_CODE_PARAM = "ingest_setup_code";
 
 const PAGE_HEADERS = {
   "content-type": "text/html; charset=utf-8",
   "cache-control": "no-store",
-  "content-security-policy": "default-src 'none'",
+  "content-security-policy": PAGE_CSP,
   "referrer-policy": "no-referrer",
   "x-content-type-options": "nosniff",
   "x-frame-options": "DENY",
   connection: "close",
 };
-const page = (text) =>
-  `<!doctype html><meta charset="utf-8"><title>Metergraph CLI</title><p>${text}</p>\n`;
-const PAGES = {
-  done: page("Metergraph CLI: authorization received. You can close this tab and return to the terminal."),
-  failed: page("Metergraph CLI: authorization did not complete. Return to the terminal for details."),
-  invalid: page("Metergraph CLI: this request was not accepted."),
-};
 
 // Starts listening. Resolves with { redirectUri, wait, close }.
 //   wait({ state, issuer, requireIss, timeoutMs, cancel }) arms the listener
@@ -38,7 +36,9 @@ const PAGES = {
 //     accepted and the timeout is running. Call it before the authorization
 //     URL is opened or printed, so a fast browser can never reach an unarmed
 //     listener. It may be called once. The promise resolves with
-//     { kind: "code", code }
+//     { kind: "code", code[, setupCode] } setupCode, the ingest_setup_code
+//                                         value, only when wait() was given
+//                                         acceptSetupCode and it was sent
 //     { kind: "denied" }                  the user or server declined
 //     { kind: "error", reason }           authorization_error,
 //                                         callback_issuer_mismatch or
@@ -85,7 +85,7 @@ export async function startCallbackListener() {
     await done;
   };
 
-  const wait = ({ state, issuer, requireIss, timeoutMs, cancel }) => {
+  const wait = ({ state, issuer, requireIss, timeoutMs, cancel, acceptSetupCode = false }) => {
     if (armed) throw new Error("callback listener is already armed");
     armed = true;
     // The executor runs synchronously, so the handler and timer are in
@@ -105,7 +105,7 @@ export async function startCallbackListener() {
 
       handler = (request, response) => {
         if (settled) return respond(response, 410, PAGES.invalid);
-        const verdict = inspect(request, { host, state, issuer, requireIss });
+        const verdict = inspect(request, { host, state, issuer, requireIss, acceptSetupCode });
         if (verdict.result === undefined) return respond(response, verdict.status, PAGES.invalid);
         const result = verdict.result;
         respond(response, verdict.status, result.kind === "code" ? PAGES.done : PAGES.failed);
@@ -131,7 +131,7 @@ function respond(response, status, body) {
 
 // Returns { status } for a request that is ignored, or { status, result }
 // for the one request that ends the flow.
-function inspect(request, { host, state, issuer, requireIss }) {
+function inspect(request, { host, state, issuer, requireIss, acceptSetupCode }) {
   const url = request.url ?? "";
   if (url.length > MAX_URL_LENGTH) return { status: 414 };
   if (request.method !== "GET") return { status: 405 };
@@ -148,7 +148,9 @@ function inspect(request, { host, state, issuer, requireIss }) {
   }
   const seen = new Set();
   for (const key of params.keys()) {
-    if (!ALLOWED_PARAMS.has(key) || seen.has(key)) return { status: 400 };
+    if (!(ALLOWED_PARAMS.has(key) || (acceptSetupCode && key === SETUP_CODE_PARAM)) || seen.has(key)) {
+      return { status: 400 };
+    }
     seen.add(key);
   }
   // Only a request that carries this flow's exact state can end it.
@@ -158,7 +160,9 @@ function inspect(request, { host, state, issuer, requireIss }) {
     return { status: 400, result: { kind: "error", reason: "callback_issuer_mismatch" } };
   }
   if (seen.has("error")) {
-    if (seen.has("code")) return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
+    if (seen.has("code") || seen.has(SETUP_CODE_PARAM)) {
+      return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
+    }
     return params.get("error") === "access_denied"
       ? { status: 200, result: { kind: "denied" } }
       : { status: 200, result: { kind: "error", reason: "authorization_error" } };
@@ -167,7 +171,12 @@ function inspect(request, { host, state, issuer, requireIss }) {
   if (code === null || code.length === 0 || code.length > MAX_CODE_LENGTH || /[^\x21-\x7e]/.test(code)) {
     return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
   }
-  return { status: 200, result: { kind: "code", code } };
+  if (!seen.has(SETUP_CODE_PARAM)) return { status: 200, result: { kind: "code", code } };
+  const setupCode = params.get(SETUP_CODE_PARAM);
+  if (setupCode.length === 0 || setupCode.length > MAX_CODE_LENGTH || /[^\x21-\x7e]/.test(setupCode)) {
+    return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
+  }
+  return { status: 200, result: { kind: "code", code, setupCode } };
 }
 
 function sameText(actual, expected) {

package/src/auth-login.js

@@ -1,4 +1,4 @@
-import { detectRemoteSession, openBrowser } from "./auth-browser.js";
+import { openBrowser } from "./auth-browser.js";
 import { startCallbackListener } from "./auth-callback.js";
 import {
   BINDING_PATH,
@@ -30,8 +30,9 @@ import {
   withSlotLock,
   writeCredential,
 } from "./auth-store.js";
-import { AUTH_HTTP_TIMEOUT_MS, CONNECTION_GUIDE_URL, METADATA_SCOPE } from "./constants.js";
+import { AUTH_HTTP_TIMEOUT_MS, METADATA_SCOPE } from "./constants.js";
 import { runDoctor } from "./doctor.js";
+import { agentKeyAction, classifyEnvironment } from "./environment.js";
 import { deadline, trapSignals } from "./transport.js";
 
 // login and logout. Each returns { outcome, reason, data }; every string in
@@ -44,6 +45,10 @@ import { deadline, trapSignals } from "./transport.js";
 // exists, while the listener keeps waiting. The caller prints it as the one
 // JSON line, so an agent can hand the URL to a person; approval-handoff.js
 // lets the agent's command exit then while this process keeps waiting.
+// options.ingestSetup, given only by setup, is { familyId, supported(origin,
+// profile, signal) }. When the service supports it, the sign-in consent also
+// approves the first ingest key for that family, and an ok result carries the
+// unredeemed receipt as result.ingestSetup (never in data).
 
 export async function runLogin(options, progress) {
   const ctx = {
@@ -55,14 +60,20 @@ export async function runLogin(options, progress) {
     configured: false,
     status: null,
     previousGrant: null,
+    environment: null,
   };
   const end = (outcome, reason, next = null) => ({ outcome, reason, data: loginData(ctx, next) });
 
   // Handoffs come first: no listener, request or file write happens for a
-  // session that cannot finish sign in.
-  if (options.runtime !== "local") return end("unsupported", "runtime_not_supported", GUIDE);
-  const remote = detectRemoteSession();
-  if (remote !== null) return end("unsupported", remote, GUIDE);
+  // session that cannot finish sign in. The next action tells the agent how
+  // a person hands it a Metadata key instead.
+  const environment = options.environment ?? classifyEnvironment();
+  ctx.environment = environment.kind;
+  if (options.runtime !== "local") {
+    ctx.environment = "declared_cloud";
+    return end("unsupported", "runtime_not_supported", agentKeyAction({ kind: "declared_cloud" }, options.origin));
+  }
+  if (environment.remote) return end("unsupported", environment.reason, agentKeyAction(environment, options.origin));
   const trap = trapSignals();
   try {
     const root = resolveProject(options.project);
@@ -153,7 +164,7 @@ export async function runLogin(options, progress) {
     if (bound !== null && bound.credential_slot !== slot) {
       ctx.previousGrant = await retireSlot(store, bound);
     }
-    return end("ok", null, CONNECTED);
+    return { ...end("ok", null, CONNECTED), ingestSetup: flow.ingestSetup };
   } catch (error) {
     if (error instanceof Stop) return end(error.outcome, error.reason);
     throw error;
@@ -182,6 +193,16 @@ async function authorize(options, ctx, cancel, progress, announce) {
   if (!discovered.ok) return httpFailure(discovered, cancel);
   const { endpoints, requireIss, offeredClientId } = discovered;
 
+  // Setup asks this consent to approve the first ingest key too, but only
+  // when the service says it can. Otherwise sign in is unchanged and setup
+  // asks for its own approval afterwards.
+  let setupPkce = null;
+  if (options.ingestSetup) {
+    limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
+    if (await options.ingestSetup.supported(ctx.origin, ctx.profile, limit.signal)) setupPkce = newPkce();
+    if (cancel.aborted) return fail("authorization_failed", "cancelled");
+  }
+
   const listener = await startCallbackListener();
   let callback;
   let clientId;
@@ -204,6 +225,7 @@ async function authorize(options, ctx, cancel, progress, announce) {
       requireIss,
       timeoutMs: options.timeoutMs,
       cancel,
+      acceptSetupCode: setupPkce !== null,
     });
     const url = authorizationUrl(endpoints, {
       clientId,
@@ -211,15 +233,18 @@ async function authorize(options, ctx, cancel, progress, announce) {
       state: pkce.state,
       challenge: pkce.challenge,
       signup: options.signup,
+      ingestSetup: setupPkce === null ? null : { familyId: options.ingestSetup.familyId, challenge: setupPkce.challenge },
     });
+    const purpose = setupPkce === null ? "sign in with Metadata access"
+      : "sign in with Metadata access and approve an ingest-only key for this project";
     const seconds = Math.round(options.timeoutMs / 1000);
     // A wait armed after Ctrl+C has already settled; do not show the URL.
     if (cancel.aborted) return fail("authorization_failed", "cancelled");
     if (options.noBrowser && announce) {
-      announce(openUrl(url, seconds, "sign in with Metadata access"));
+      announce(openUrl(url, seconds, purpose));
     } else if (options.noBrowser) {
       progress(
-        "Open this URL in a browser on this machine to sign in:\n" +
+        `Open this URL in a browser on this machine to ${purpose}:\n` +
           `${url}\n` +
           `Waiting up to ${seconds} seconds for the browser. Press Ctrl+C to cancel.`,
       );
@@ -228,15 +253,25 @@ async function authorize(options, ctx, cancel, progress, announce) {
         return fail("authorization_failed", "browser_unavailable", {
           kind: "no_browser",
           message: "Run login again with --no-browser, without --json, and open the URL it prints.",
+          // A local container's loopback callback is reachable only when its
+          // port is forwarded to the person's machine. A Metadata key avoids
+          // the callback altogether.
+          ...(ctx.environment === "local_container"
+            ? { alternative: agentKeyAction({ kind: "local_container", remote: false }, ctx.origin) }
+            : {}),
         });
       }
-      progress(`Opened your browser to sign in. Waiting up to ${seconds} seconds. Press Ctrl+C to cancel.`);
+      progress(setupPkce === null
+        ? `Opened your browser to sign in. Waiting up to ${seconds} seconds. Press Ctrl+C to cancel.`
+        : "Opened your browser to sign in and approve this project's ingest key in one step. " +
+          `Waiting up to ${seconds} seconds. Press Ctrl+C to cancel.`);
     }
     callback = await pending;
   } finally {
     await listener.close();
   }
 
+  if (callback.kind === "code" && setupPkce !== null && callback.setupCode) options.ingestSetup.onApproved?.();
   if (callback.kind === "denied") return fail("authorization_failed", "access_denied");
   if (callback.kind === "timeout") return fail("authorization_failed", "timeout");
   if (callback.kind === "cancelled") return fail("authorization_failed", "cancelled");
@@ -270,7 +305,15 @@ async function authorize(options, ctx, cancel, progress, announce) {
     return rejectGrant(verified.outcome, verified.reason);
   }
   ctx.workspaceId = grant.tenant;
-  return { ok: true, endpoints, clientId, grant };
+  // The receipt is a separate credential: setup redeems it with its own
+  // verifier, for the family it named, after binding this sign in. A service
+  // that showed only the sign in returns no receipt, and setup falls back to
+  // its own approval.
+  const ingestSetup = setupPkce !== null && callback.setupCode
+    ? { familyId: options.ingestSetup.familyId, code: callback.setupCode, verifier: setupPkce.verifier,
+        clientId, redirectUri: listener.redirectUri }
+    : null;
+  return { ok: true, endpoints, clientId, grant, ingestSetup };
 }
 
 export async function runLogout(options) {
@@ -389,7 +432,6 @@ export function openUrl(url, seconds, purpose) {
   };
 }
 
-const GUIDE = { kind: "connection_guide", url: CONNECTION_GUIDE_URL };
 const RECONNECT = {
   kind: "reconnect",
   message: "Run login again with --reconnect to switch this project, or run logout first.",
@@ -403,6 +445,7 @@ function loginData(ctx, next) {
   return {
     origin: ctx.origin,
     runtime: ctx.runtime,
+    environment: ctx.environment,
     deployment_profile: ctx.profile,
     workspace: ctx.workspaceId === null ? null : { id: ctx.workspaceId },
     scopes: ctx.authenticated ? [METADATA_SCOPE] : [],

package/src/auth-oauth.js

@@ -1,6 +1,12 @@
 import { createHash, randomBytes } from "node:crypto";
 
-import { AGENT_CONTRACT_VERSION, AUTH_PATHS, METADATA_SCOPE } from "./constants.js";
+import {
+  AGENT_CONTRACT_VERSION,
+  AUTH_PATHS,
+  EXPERIMENT_START_KEY_SCOPES,
+  EXPERIMENT_START_SCOPE,
+  METADATA_SCOPE,
+} from "./constants.js";
 import { parseJsonObject } from "./http.js";
 import { failureOf, send } from "./transport.js";
 
@@ -225,7 +231,11 @@ export function newPkce() {
 // The authorization URL the browser opens. With signup, the browser starts
 // at the service's own signup page, which returns to the same authorization
 // request on this origin after the account exists.
-export function authorizationUrl(endpoints, { clientId, redirectUri, state, challenge, signup }) {
+// ingestSetup, when given as { familyId, challenge }, asks this one consent to
+// also approve the first ingest key for a new setup family. The service
+// returns that receipt next to the code; it is redeemed separately with its
+// own PKCE verifier.
+export function authorizationUrl(endpoints, { clientId, redirectUri, state, challenge, signup, ingestSetup = null }) {
   const url = new URL(endpoints.authorization);
   url.search = new URLSearchParams({
     response_type: "code",
@@ -236,6 +246,11 @@ export function authorizationUrl(endpoints, { clientId, redirectUri, state, chal
     code_challenge: challenge,
     code_challenge_method: "S256",
     resource: endpoints.resource,
+    ...(ingestSetup === null ? {} : {
+      ingest_setup: "1",
+      ingest_setup_family_id: ingestSetup.familyId,
+      ingest_setup_code_challenge: ingestSetup.challenge,
+    }),
   }).toString();
   if (!signup) return url.href;
   const entry = new URL(`${endpoints.origin}${AUTH_PATHS.signup}`);
@@ -383,10 +398,23 @@ function decodeClaims(token) {
 // Nothing else is read: no telemetry, content or provider requests.
 // Returns { ok: true, workspaceId, documents } or { ok: false, outcome, reason, denied }
 // where denied means the service refused the token (401 or 403).
-export async function verifyContext(origin, accessToken, { profile, workspaceId }, signal) {
+// workspaceId is the workspace the credential must be for. Only an agent key
+// with nothing to pin it to passes anyWorkspace: true with workspaceId null,
+// and then the workspace the service reports is checked for consistency and
+// returned as the verified one.
+// access is "metadata" (every read command and sign in) or
+// "experiment_start" (experiments start only: a coding-agent key with Debug
+// access and the start grant, checked for exactly that and used for nothing else).
+export async function verifyContext(origin, accessToken, { profile, workspaceId, anyWorkspace = false, access = "metadata" }, signal) {
   const workspace = await bearerJson(origin, AUTH_PATHS.workspace, accessToken, WORKSPACE_BYTES, signal, "workspace");
   if (!workspace.ok) return workspace;
-  const checked = checkWorkspace(workspace.body, { profile, workspaceId });
+  if (workspaceId === null && anyWorkspace === true) {
+    workspaceId = normalizeUuid(workspace.body.workspace?.id);
+    if (workspaceId === null) return stop("verification_failed", "workspace_response_invalid");
+  }
+  const checked = access === "experiment_start"
+    ? checkStartWorkspace(workspace.body, { profile, workspaceId })
+    : checkWorkspace(workspace.body, { profile, workspaceId });
   if (!checked.ok) return checked;
 
   const capabilities = await bearerJson(
@@ -398,11 +426,18 @@ export async function verifyContext(origin, accessToken, { profile, workspaceId
     "capabilities",
   );
   if (!capabilities.ok) return capabilities;
-  const allowed = checkCapabilities(capabilities.body, { profile, workspaceId });
+  const allowed = access === "experiment_start"
+    ? checkStartCapabilities(capabilities.body, { profile, workspaceId })
+    : checkCapabilities(capabilities.body, { profile, workspaceId });
   if (!allowed.ok) return allowed;
   // The verified documents stay in memory for read commands, which print
   // only fields they validate themselves.
-  return { ok: true, workspaceId, documents: { workspace: workspace.body, capabilities: capabilities.body } };
+  return {
+    ok: true,
+    workspaceId,
+    scopes: checked.scopes ?? [METADATA_SCOPE],
+    documents: { workspace: workspace.body, capabilities: capabilities.body },
+  };
 }
 
 // Both documents carry the service's contract version string in
@@ -427,6 +462,41 @@ export function checkWorkspace(body, { profile, workspaceId }) {
   return { ok: true };
 }
 
+// A start key's workspace document: the same identity checks as
+// checkWorkspace, and exactly the scopes Debug and the start grant.
+export function checkStartWorkspace(body, { profile, workspaceId }) {
+  const identity = checkWorkspace({ ...body, access: { scopes: [METADATA_SCOPE] } }, { profile, workspaceId });
+  if (!identity.ok) return identity;
+  const scopes = body.access?.scopes;
+  if (
+    !Array.isArray(scopes) ||
+    scopes.length !== EXPERIMENT_START_KEY_SCOPES.length ||
+    !EXPERIMENT_START_KEY_SCOPES.every((scope) => scopes.includes(scope))
+  ) {
+    return stop("permission_denied", "experiment_start_not_granted");
+  }
+  return { ok: true, scopes: [...scopes].sort() };
+}
+
+// A start key's capabilities document: the same identity checks as
+// checkCapabilities, and the start capability offered to this key.
+export function checkStartCapabilities(body, { profile, workspaceId }) {
+  if (body.schema_version !== AGENT_CONTRACT_VERSION || !isObject(body.provenance) || !isObject(body.agent)) {
+    return stop("verification_failed", "capabilities_response_invalid");
+  }
+  if (normalizeUuid(body.provenance.workspace_id) !== workspaceId) {
+    return stop("verification_failed", "workspace_context_mismatch");
+  }
+  if (body.provenance.deployment_profile !== profile || body.deployment_profile !== profile) {
+    return stop("verification_failed", "profile_mismatch");
+  }
+  const start = body.agent.experiment_start;
+  if (!isObject(start) || start.available !== true || start.required_scope !== EXPERIMENT_START_SCOPE || start.mutates !== true) {
+    return stop("capability_unavailable", "experiment_start_unavailable");
+  }
+  return { ok: true };
+}
+
 export function checkCapabilities(body, { profile, workspaceId }) {
   if (body.schema_version !== AGENT_CONTRACT_VERSION || !isObject(body.provenance) || !isObject(body.agent)) {
     return stop("verification_failed", "capabilities_response_invalid");
@@ -466,7 +536,7 @@ async function bearerJson(origin, path, accessToken, maxBytes, signal, document)
   const failure = failureOf(response);
   if (failure !== null) return { ok: false, ...failure };
   if (response.status === 401 || response.status === 403) {
-    return { ok: false, outcome: "verification_failed", reason: "access_rejected", denied: true };
+    return { ok: false, outcome: "verification_failed", reason: "access_rejected", denied: true, status: response.status };
   }
   if (response.status !== 200) return stop("unsupported", "unexpected_status");
   const body = parseJsonObject(response);

package/src/callback-page.js

@@ -0,0 +1,58 @@
+// The static pages the loopback callback listener answers with. They follow
+// the look of the server's consent page (green band with the Metergraph mark,
+// white card) so the hand-off from the browser back to the terminal reads as
+// one flow. Pages are fixed strings: nothing from a request is ever rendered.
+// The stylesheet is inline and allowed by its hash, so the policy stays
+// default-src 'none' with no script and no 'unsafe-inline'.
+import { createHash } from "node:crypto";
+
+const LOGO = `<svg class="logo" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 134 25" width="134" height="25" role="img" aria-label="Metergraph"><g fill="white" transform="scale(0.03681885)"><circle cx="105" cy="128" r="62"/><circle cx="105" cy="239" r="62"/><circle cx="105" cy="350" r="62"/><circle cx="105" cy="461" r="62"/><circle cx="105" cy="572" r="62"/><circle cx="578" cy="128" r="62"/><circle cx="578" cy="239" r="62"/><circle cx="578" cy="350" r="62"/><circle cx="578" cy="461" r="62"/><circle cx="578" cy="572" r="62"/><circle cx="221" cy="238" r="62"/><circle cx="282.5" cy="346" r="62"/><circle cx="341.5" cy="456" r="62"/><circle cx="400.5" cy="346" r="62"/><circle cx="462" cy="238" r="62"/></g><path d="M34.68 20V6H38.2L42.08 16.38L42.56 17.78C42.7 17.32 42.82 16.9 43.02 16.38L46.82 6H50.28V20H48.12V10.02L48.14 8.16L43.84 20H41.22L36.8 8.16L36.84 10.02V20H34.68ZM56.8091 20.32C53.9091 20.32 51.9691 18.48 51.9691 15.3C51.9691 12.1 53.9691 9.98 56.7091 9.98C59.6491 9.98 61.2891 12.02 61.2891 15.16V15.6H54.0891C54.1091 17.48 55.2491 18.7 56.8091 18.7C57.9291 18.7 58.9291 18.16 59.1291 16.92H61.2091C61.0091 18.76 59.4891 20.32 56.8091 20.32ZM59.1291 14.12C59.1091 12.6 58.2091 11.56 56.7091 11.56C55.2291 11.56 54.2291 12.68 54.1091 14.12H59.1291ZM66.6303 20.16C64.8703 20.16 63.6703 19.3 63.6703 17.14V11.98H61.6703V10.3H63.6703V6.94H65.7503V10.3H67.9503V11.98H65.7503V16.86C65.7503 17.94 66.2303 18.42 67.1903 18.42C67.4303 18.42 67.6503 18.4 67.9103 18.36V20.02C67.6103 20.1 67.1503 20.16 66.6303 20.16ZM73.4997 20.32C70.5997 20.32 68.6597 18.48 68.6597 15.3C68.6597 12.1 70.6597 9.98 73.3997 9.98C76.3397 9.98 77.9797 12.02 77.9797 15.16V15.6H70.7797C70.7997 17.48 71.9397 18.7 73.4997 18.7C74.6197 18.7 75.6197 18.16 75.8197 16.92H77.8997C77.6997 18.76 76.1797 20.32 73.4997 20.32ZM75.8197 14.12C75.7997 12.6 74.8997 11.56 73.3997 11.56C71.9197 11.56 70.9197 12.68 70.7997 14.12H75.8197ZM79.5581 20V10.3H81.6381V10.88L81.5981 11.98C82.0981 10.88 83.0581 9.98 84.5381 9.98C84.6981 9.98 84.8381 9.98 85.0181 10.02V12.04C84.8581 12.02 84.6781 11.98 84.3981 11.98C82.7181 11.98 81.6381 12.88 81.6381 15.02V20H79.5581ZM90.0131 24.44C87.3131 24.44 85.6531 22.96 85.6531 20.8H87.7531C87.7731 22.02 88.6131 22.82 90.0531 22.82C91.5931 22.82 92.6931 21.96 92.6931 20.2V19.08C92.6931 18.76 92.6931 18.46 92.7331 18.16C92.1931 19.08 91.0931 19.76 89.6331 19.76C87.0331 19.76 85.2531 17.92 85.2531 14.88C85.2531 11.88 87.2531 9.98 89.5931 9.98C91.2531 9.98 92.1931 10.74 92.7331 11.64C92.6931 11.36 92.6931 11.08 92.6931 10.78V10.3H94.7731V19.6C94.7731 22.86 92.9931 24.44 90.0131 24.44ZM90.1131 18.12C91.6931 18.12 92.8131 16.8 92.8131 14.88C92.8131 12.98 91.6931 11.62 90.1131 11.62C88.4931 11.62 87.3731 12.96 87.3731 14.88C87.3731 16.82 88.4931 18.12 90.1131 18.12ZM96.9128 20V10.3H98.9928V10.88L98.9528 11.98C99.4528 10.88 100.413 9.98 101.893 9.98C102.053 9.98 102.193 9.98 102.373 10.02V12.04C102.213 12.02 102.033 11.98 101.753 11.98C100.073 11.98 98.9928 12.88 98.9928 15.02V20H96.9128ZM105.929 20.32C104.169 20.32 102.589 19.2 102.589 17.34C102.589 15.3 104.189 14.48 106.089 14.22L107.829 13.96C108.589 13.86 108.849 13.58 108.849 13.04C108.849 12.18 108.169 11.56 107.089 11.56C105.769 11.56 105.029 12.28 104.969 13.38H102.849C102.949 11.5 104.469 9.98 106.949 9.98C109.629 9.98 110.909 11.48 110.909 13.96V20H108.969V19.56C108.969 19.26 108.969 19 109.009 18.68C108.509 19.66 107.489 20.32 105.929 20.32ZM106.389 18.76C107.809 18.76 108.889 17.76 108.889 16.28V15.04C108.729 15.22 108.369 15.36 107.789 15.46L106.689 15.68C105.549 15.9 104.729 16.34 104.729 17.28C104.729 18.22 105.469 18.76 106.389 18.76ZM112.92 24.12V10.3H115V10.86C115 11.12 114.98 11.36 114.96 11.66C115.54 10.7 116.66 9.98 118.14 9.98C120.82 9.98 122.5 12.14 122.5 15.16C122.5 18.28 120.64 20.32 118.08 20.32C116.56 20.32 115.58 19.64 114.96 18.66L115 19.52V24.12H112.92ZM117.64 18.7C119.28 18.7 120.36 17.24 120.36 15.14C120.36 13.08 119.32 11.62 117.64 11.62C116.04 11.62 114.9 12.98 114.9 15.14C114.9 17.26 116.02 18.7 117.64 18.7ZM124.058 20V6H126.138V10.76L126.098 11.64C126.618 10.7 127.658 9.98 129.078 9.98C131.258 9.98 132.578 11.44 132.578 13.88V20H130.498V14.16C130.498 12.54 129.838 11.62 128.478 11.62C127.058 11.62 126.138 12.8 126.138 14.24V20H124.058Z" fill="white"/></svg>`;
+
+const STYLE = `
+:root{color-scheme:light}
+*{box-sizing:border-box}
+body{margin:0;background:#edeee9;color:#151b17;font-family:Arial,Helvetica,sans-serif;font-size:16px;line-height:1.55}
+.shell{max-width:600px;margin:0 auto;padding:28px 12px 48px}
+.hero{background:linear-gradient(90deg,#0a6146,#0a5944 54%,#073d32);color:#fff;padding:26px 30px 34px}
+.logo{display:block;width:150px;height:auto;margin:0 0 36px}
+.eyebrow{margin:0 0 6px;color:#d7f68e;font-size:13px;font-weight:700;letter-spacing:.06em;text-transform:uppercase}
+h1{margin:0;font-size:30px;font-weight:400;letter-spacing:-.6px;line-height:1.2}
+.card{background:#fff;padding:30px}
+p{margin:0 0 18px}
+p:last-child{margin-bottom:0}
+.note{color:#505b53;font-size:14px}
+@media (max-width:520px){
+.shell{padding:0 0 32px}
+.hero{padding:22px 20px 28px}
+.logo{margin-bottom:28px}
+h1{font-size:25px}
+.card{padding:22px 20px}
+}
+`;
+
+export const PAGE_CSP = `default-src 'none'; style-src 'sha256-${createHash("sha256").update(STYLE).digest("base64")}'`;
+
+const page = (title, lead, note) =>
+  '<!doctype html><html lang="en"><head><meta charset="utf-8">' +
+  '<meta name="viewport" content="width=device-width, initial-scale=1">' +
+  `<title>${title} | Metergraph CLI</title><style>${STYLE}</style></head><body>` +
+  `<div class="shell"><header class="hero">${LOGO}<p class="eyebrow">Metergraph CLI</p><h1>${title}</h1></header>` +
+  `<main class="card"><p>${lead}</p><p class="note">${note}</p></main></div></body></html>\n`;
+
+export const PAGES = {
+  done: page(
+    "Authorization received",
+    "Return to the terminal. The command finishes signing in there and reports the result.",
+    "You can close this tab.",
+  ),
+  failed: page(
+    "Authorization did not complete",
+    "Return to the terminal for details and the next step.",
+    "You can close this tab.",
+  ),
+  invalid: page(
+    "Request not accepted",
+    "This page only accepts the browser hand-off for a command that is waiting in your terminal.",
+    "If you started a sign-in, return to the terminal and try again.",
+  ),
+};