modelos-secure 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,41 @@
-# Temporary Holding Version
+# modelos-secure
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Tests an AI system for Security, Safety and Quality. One command in the system's repository connects it, with no code changes:
+
+```bash
+npx modelos-secure scan .
+```
+
+It reads the code, draws the system's map and asks only what it cannot work out. Everything it decides goes into `modelos-secure.yaml`. Before it sends anything it says exactly what leaves the machine, and `--explain` prints the outline without sending it. `--offline` keeps everything on your machine.
+
+| Command                                       | Does                                                           |
+| --------------------------------------------- | -------------------------------------------------------------- |
+| `modelos-secure login`                        | Saves a workspace token, and signs in with Google if needed.   |
+| `modelos-secure scan .`                       | Connects this repository. `--offline`, `--explain`, `--yes`.   |
+| `modelos-secure review`                       | Starts a review of this system. `--quick`, `--ci`, `--budget`. |
+| `modelos-secure replay F-031`                 | Replays one finding.                                           |
+| `modelos-secure doctor`                       | Checks the setup and fixes what it can.                        |
+| `modelos-secure export R-1179 --format sarif` | Writes a review's findings as SARIF or JSON.                   |
+
+During a review, actions are held and never run. Outside a review the hooks do nothing. Requires Node 20 or newer. Python apps need Python 3.10 or newer.
+
+## Signing in
+
+Copy the login command from the workspace tokens page in the app. It has the app's address and, when the app is behind Google sign-in, the Google client to sign in with:
+
+```bash
+npx modelos-secure login --url <address> --client-id <client ID> --client-secret <client secret>
+```
+
+Paste the workspace token when it asks. The token is never typed on the command line. Your browser then opens for you to sign in with Google. The address, the token and the Google sign-in are kept in `~/.modelos-secure/credentials.json`, readable only by you, and the sign-in is renewed as it runs out. Without `--client-id`, as on a local stack, there is no Google sign-in.
+
+When the app is reached at an IP address and its certificate is issued for a name, the login command also has `--tls-name` and that name. The CLI then connects to the address and checks the certificate against the name: its chain, its dates and the name are all still checked. `MODELOS_SECURE_TLS_NAME` does the same for one run. When something cannot be reached, the CLI says why in plain words.
+
+`MODELOS_SECURE_URL` and `MODELOS_SECURE_TOKEN` take the place of the saved address and token. `modelos-secure doctor` says who is signed in to Google, and why a request was turned away.
+
+## In CI
+
+CI has no browser, so it signs in to Google as a service account. The service account needs IAP-secured Web App User on the app, and the client ID must be the one on the tokens page. Set `MODELOS_SECURE_URL` and `MODELOS_SECURE_TOKEN`, then one of these:
+
+- `MODELOS_SECURE_CLIENT_ID`, the client ID from the tokens page, with gcloud signed in as the service account. The CLI runs `gcloud auth print-identity-token --audiences=<client ID>` and runs it again as the token runs out, so it suits reviews of any length. It does not work with a person's own gcloud sign-in.
+- `MODELOS_SECURE_IAP_TOKEN`, an ID token for the service account with the client ID as its audience. It is sent as it is and never renewed, and it lasts about an hour. In GitHub Actions, `google-github-actions/auth` makes one with `token_format: id_token`, `id_token_audience` set to the client ID and `id_token_include_email: true`.

package/assets/login-BcHFyX6z.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-WwE-Gunj.js";

package/assets/login-WwE-Gunj.js

@@ -0,0 +1,625 @@
+import { join } from "node:path";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { execFile, spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { emitKeypressEvents } from "node:readline";
+import { request } from "node:https";
+import { checkServerIdentity } from "node:tls";
+// src/ui.ts
+var color = process.stdout.isTTY && !process.env.NO_COLOR;
+var unicode = process.env.TERM !== "dumb" && !process.env.MODELOS_SECURE_ASCII;
+var paint = (code, text) => color ? `\u001b[${code}m${text}\u001b[0m` : text;
+var red = (t) => paint("31", t);
+var blue = (t) => paint("34", t);
+var grey = (t) => paint("90", t);
+var bold = (t) => paint("1", t);
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY) && !process.env.CI;
+var pointer = unicode ? "›" : ">";
+var dash = unicode ? "–" : "-";
+function say(line = "") {
+	console.log(line);
+}
+var STEP_WIDTH = 13;
+function step(name, detail, state = "done") {
+	const right = state === "done" ? "done" : "";
+	say(`  ${bold(name.padEnd(STEP_WIDTH))}${detail}${right ? `  ${grey(right)}` : ""}`);
+}
+/** One question, one reason, a default. Arrows, Enter and the first letter of each choice. */
+async function ask(question, why, choices) {
+	const start = Math.max(0, choices.findIndex((c) => c.recommended));
+	say();
+	say(`  ${question}`);
+	say();
+	if (!interactive()) {
+		const chosen = choices[start];
+		say(`  ${pointer} ${chosen.label}`);
+		return chosen.value;
+	}
+	let index = start;
+	const render = (first) => {
+		if (!first) process.stdout.write(`\u001b[${choices.length.toString()}A`);
+		for (const [i, choice] of choices.entries()) {
+			const mark = i === index ? blue(pointer) : " ";
+			process.stdout.write(`\u001b[2K  ${mark} ${choice.label}${choice.recommended ? grey("   (recommended)") : ""}\n`);
+		}
+	};
+	render(true);
+	if (why) say(`\n  ${grey(`Why we ask: ${why}`)}`);
+	if (why) process.stdout.write(`\u001b[2A`);
+	return new Promise((resolve, reject) => {
+		emitKeypressEvents(process.stdin);
+		process.stdin.setRawMode(true);
+		process.stdin.resume();
+		const done = () => {
+			process.stdin.off("keypress", onKey);
+			process.stdin.setRawMode(false);
+			process.stdin.pause();
+			if (why) process.stdout.write(`\u001b[2B\n`);
+		};
+		const onKey = (text, key) => {
+			if (key.ctrl && key.name === "c") {
+				done();
+				reject(new Interrupted());
+				return;
+			}
+			if (key.name === "up") index = (index - 1 + choices.length) % choices.length;
+			else if (key.name === "down") index = (index + 1) % choices.length;
+			else if (key.name === "return") {
+				done();
+				resolve(choices[index].value);
+				return;
+			} else if (text) {
+				const match = choices.findIndex((c) => c.label.toLowerCase().startsWith(text.toLowerCase()));
+				if (match >= 0) index = match;
+			}
+			render(false);
+		};
+		process.stdin.on("keypress", onKey);
+	});
+}
+/** Reads a line. Used only when a person has to type something, such as a command. */
+async function askText(question, secret = false) {
+	process.stdout.write(`  ${question} `);
+	if (!interactive()) return "";
+	return new Promise((resolve) => {
+		let value = "";
+		emitKeypressEvents(process.stdin);
+		process.stdin.setRawMode(true);
+		process.stdin.resume();
+		const onKey = (text, key) => {
+			if (key.ctrl && key.name === "c") {
+				process.stdin.setRawMode(false);
+				process.exit(130);
+			}
+			if (key.name === "return") {
+				process.stdin.off("keypress", onKey);
+				process.stdin.setRawMode(false);
+				process.stdin.pause();
+				process.stdout.write("\n");
+				resolve(value.trim());
+				return;
+			}
+			if (key.name === "backspace") value = value.slice(0, -1);
+			else if (text && !key.ctrl) {
+				value += text;
+				if (!secret) process.stdout.write(text);
+			}
+		};
+		process.stdin.on("keypress", onKey);
+	});
+}
+var Interrupted = class extends Error {};
+// src/google.ts
+var AUTHORIZE = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN = "https://oauth2.googleapis.com/token";
+/** A person has this long to finish signing in in the browser. */
+var SIGN_IN_WAIT_MS = 3e5;
+/** The sign-in was refused by Google: it expired, or was revoked. Only login can mend it. */
+var SignInRefused = class extends Error {};
+/** Reads a JWT's claims without checking its signature. Only for showing who and when. */
+function claims(token) {
+	try {
+		const payload = token.split(".")[1] ?? "";
+		const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+		return {
+			email: typeof parsed.email === "string" ? parsed.email : void 0,
+			exp: typeof parsed.exp === "number" ? parsed.exp : void 0
+		};
+	} catch {
+		return {};
+	}
+}
+var expiresAt = (token) => {
+	const exp = claims(token).exp;
+	return exp === void 0 ? void 0 : exp * 1e3;
+};
+var fresh = (expires, now = Date.now()) => expires !== void 0 && expires - 6e4 > now;
+async function tokenRequest(form) {
+	const response = await fetch(TOKEN, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(form).toString()
+	}).catch((error) => {
+		throw new Error(`I can't reach Google to sign in: ${error instanceof Error ? error.message : String(error)}.`);
+	});
+	const body = await response.json().catch(() => ({}));
+	return {
+		status: response.status,
+		body
+	};
+}
+function signedIn(previous, body) {
+	if (!body.id_token) throw new Error("Google answered without an ID token. Check that the client ID on the tokens page is a Desktop app client.");
+	return {
+		...previous,
+		refreshToken: body.refresh_token ?? previous.refreshToken,
+		idToken: body.id_token,
+		expiresAt: expiresAt(body.id_token),
+		email: claims(body.id_token).email ?? previous.email
+	};
+}
+/** Renews the ID token with the refresh token. Google needs the client secret for this too. */
+async function renew(signIn) {
+	if (!signIn.refreshToken) throw new SignInRefused();
+	const { status, body } = await tokenRequest({
+		client_id: signIn.clientId,
+		client_secret: signIn.clientSecret,
+		refresh_token: signIn.refreshToken,
+		grant_type: "refresh_token"
+	});
+	if (body.error === "invalid_grant" || status === 401) throw new SignInRefused();
+	if (status !== 200) throw new Error(`Google did not renew the sign-in: ${body.error_description ?? body.error ?? `it answered ${status.toString()}`}.`);
+	return signedIn(signIn, body);
+}
+/** The address the browser is sent to. Exported so the request can be checked. */
+function authorizeUrl(input) {
+	return `${AUTHORIZE}?${new URLSearchParams({
+		client_id: input.clientId,
+		redirect_uri: input.redirectUri,
+		response_type: "code",
+		scope: "openid email",
+		code_challenge: input.challenge,
+		code_challenge_method: "S256",
+		state: input.state,
+		access_type: "offline",
+		prompt: "consent"
+	}).toString()}`;
+}
+function openBrowser(url) {
+	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+var PAGE = (text) => `<!doctype html><meta charset="utf-8"><title>ModelOS Secure</title><body style="font: 14px/20px system-ui, sans-serif; margin: 48px">${text}</body>`;
+/**
+* Signs a person in with Google in their browser: the authorization code flow with PKCE and a
+* loopback address on this machine, as Google asks of desktop apps.
+*/
+async function signInWithGoogle(clientId, clientSecret) {
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	const state = randomBytes(16).toString("base64url");
+	const server = createServer();
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => resolve());
+	});
+	const address = server.address();
+	const redirectUri = `http://127.0.0.1:${(typeof address === "object" && address ? address.port : 0).toString()}`;
+	const { status, body } = await tokenRequest({
+		client_id: clientId,
+		client_secret: clientSecret,
+		code: await new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				server.close();
+				reject(/* @__PURE__ */ new Error("The Google sign-in was not finished within 5 minutes. Run modelos-secure login again."));
+			}, SIGN_IN_WAIT_MS);
+			server.on("request", (request, response) => {
+				const url = new URL(request.url ?? "/", redirectUri);
+				if (url.pathname !== "/" || url.searchParams.get("state") !== state) {
+					response.writeHead(404).end();
+					return;
+				}
+				const error = url.searchParams.get("error");
+				const got = url.searchParams.get("code");
+				response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+				response.end(PAGE(got ? "Signed in. Go back to the terminal to finish." : "The sign-in did not finish. Go back to the terminal."));
+				clearTimeout(timer);
+				server.close();
+				if (got) resolve(got);
+				else reject(/* @__PURE__ */ new Error(error === "access_denied" ? "The Google sign-in was cancelled. Run modelos-secure login again to sign in." : `Google did not sign you in: ${error ?? "no code came back"}.`));
+			});
+			const url = authorizeUrl({
+				clientId,
+				redirectUri,
+				challenge,
+				state
+			});
+			say("  Sign in with Google in your browser. If it does not open, open:");
+			say(`  ${url}`);
+			openBrowser(url);
+		}),
+		code_verifier: verifier,
+		redirect_uri: redirectUri,
+		grant_type: "authorization_code"
+	});
+	if (status !== 200) throw new Error(`Google did not finish the sign-in: ${body.error_description ?? body.error ?? `it answered ${status.toString()}`}. Check the client ID and secret against the tokens page.`);
+	return signedIn({
+		clientId,
+		clientSecret
+	}, body);
+}
+/**
+* An ID token from gcloud for the given audience. This works when gcloud is signed in as a
+* service account, as in CI, and returns null otherwise.
+*/
+function gcloudIdentityToken(audience) {
+	if (!/^[\w.-]+$/.test(audience)) return Promise.resolve(null);
+	return new Promise((resolve) => {
+		execFile("gcloud", [
+			"auth",
+			"print-identity-token",
+			`--audiences=${audience}`
+		], {
+			timeout: 3e4,
+			shell: process.platform === "win32",
+			windowsHide: true
+		}, (error, stdout) => {
+			const token = String(stdout).trim();
+			resolve(!error && token.split(".").length === 3 ? token : null);
+		});
+	});
+}
+// src/tls.ts
+/** A fetch that connects to the URL's host and checks its certificate against `name`. */
+function fetchCheckingName(name) {
+	return (url, init = {}) => new Promise((resolve, reject) => {
+		const outgoing = request(new URL(url), {
+			method: init.method ?? "GET",
+			headers: init.headers,
+			servername: name,
+			checkServerIdentity: (_host, certificate) => checkServerIdentity(name, certificate),
+			signal: init.signal
+		}, (incoming) => {
+			const chunks = [];
+			incoming.on("data", (chunk) => chunks.push(chunk));
+			incoming.on("error", reject);
+			incoming.on("end", () => {
+				const headers = new Headers();
+				for (const [key, value] of Object.entries(incoming.headers)) if (value !== void 0) headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+				const status = incoming.statusCode ?? 502;
+				resolve(new Response(status === 204 || status === 304 ? null : Buffer.concat(chunks), {
+					status,
+					headers
+				}));
+			});
+		});
+		outgoing.on("error", reject);
+		if (init.body !== void 0) outgoing.write(init.body);
+		outgoing.end();
+	});
+}
+/** What went wrong reaching an address, in plain words, from the error Node gave. */
+function networkMessage(error, url, tlsName) {
+	const cause = error?.cause;
+	const code = (typeof cause?.code === "string" ? cause.code : void 0) ?? error?.code;
+	let host = url;
+	try {
+		host = new URL(url).hostname;
+	} catch {}
+	switch (code) {
+		case "ERR_TLS_CERT_ALTNAME_INVALID": return tlsName ? `The certificate at ${host} is not issued for ${tlsName}. Copy the login command from the tokens page again.` : `The certificate at ${host} is not issued for that address. If it is issued for a name, such as one in your company's domain, log in again with --tls-name and that name.`;
+		case "DEPTH_ZERO_SELF_SIGNED_CERT":
+		case "SELF_SIGNED_CERT_IN_CHAIN":
+		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY": return `This machine does not trust the certificate at ${host}. If your company adds its own certificates to this machine, set NODE_OPTIONS=--use-system-ca and try again.`;
+		case "CERT_HAS_EXPIRED": return `The certificate at ${host} has expired. Tell whoever runs that address.`;
+		case "ENOTFOUND":
+		case "EAI_AGAIN": return `${host} cannot be found from this machine. Check the address.`;
+		case "ECONNREFUSED":
+		case "ECONNRESET":
+		case "ETIMEDOUT":
+		case "EHOSTUNREACH":
+		case "ENETUNREACH":
+		case "UND_ERR_CONNECT_TIMEOUT": return `${host} cannot be reached from this machine. It may only be reachable on the company network.`;
+		default: return `The request to ${host} failed${code ? ` (${code})` : ""}.`;
+	}
+}
+// src/iap.ts
+/**
+* The Google credential for one connection, in this order: MODELOS_SECURE_IAP_TOKEN as it is;
+* the person signed in with login, renewed near its expiry; an ID token from gcloud when a
+* client ID is known, which works for a service account; or nothing, as on a local stack.
+*/
+function proxyCredentials(google, options = {}) {
+	let signIn = google;
+	let refused = false;
+	let fromGcloud = null;
+	let pending = null;
+	const find = async () => {
+		const env = options.env ?? process.env;
+		const now = (options.now ?? Date.now)();
+		const given = env.MODELOS_SECURE_IAP_TOKEN?.trim();
+		if (given) return {
+			token: given,
+			source: "env",
+			email: claims(given).email
+		};
+		if (signIn?.refreshToken || signIn?.idToken) {
+			if (refused) throw new SignInRefused();
+			if (!signIn.idToken || !fresh(signIn.expiresAt, now)) {
+				try {
+					signIn = await (options.renew ?? renew)(signIn);
+				} catch (error) {
+					if (error instanceof SignInRefused) refused = true;
+					throw error;
+				}
+				await options.saved?.(signIn).catch(() => void 0);
+			}
+			return {
+				token: signIn.idToken,
+				source: "signed-in",
+				email: signIn.email
+			};
+		}
+		const audience = env.MODELOS_SECURE_CLIENT_ID?.trim() || signIn?.clientId;
+		if (audience) {
+			if (!fromGcloud || fromGcloud.token && !fresh(fromGcloud.expires, now)) {
+				const token = await (options.gcloud ?? gcloudIdentityToken)(audience);
+				fromGcloud = {
+					token,
+					expires: token ? expiresAt(token) : void 0
+				};
+			}
+			if (fromGcloud.token) return {
+				token: fromGcloud.token,
+				source: "gcloud",
+				email: claims(fromGcloud.token).email
+			};
+		}
+		return { source: "none" };
+	};
+	return { 
+	/** One lookup at a time, so many runners waiting at once renew the sign-in once. */
+get() {
+		pending ??= find().finally(() => {
+			pending = null;
+		});
+		return pending;
+	} };
+}
+/**
+* Whether an answer came from IAP, or from something that is not the app, rather than from our
+* API. Our API always answers JSON, with an `error` field when it says no. IAP answers with a
+* page or plain text and marks it with x-goog-iap-generated-response, and may send a request
+* with no credential to Google's sign-in page.
+*/
+function refusalKind(answer) {
+	const { status, headers, body, sent } = answer;
+	if (status >= 300 && status < 400) {
+		const location = headers.get("location") ?? "";
+		if (!(() => {
+			try {
+				return new URL(location).hostname === "accounts.google.com";
+			} catch {
+				return false;
+			}
+		})()) return "not-the-app";
+		return sent ? "refused" : "no-sign-in";
+	}
+	const json = typeof body === "object" && body !== null;
+	const ours = json && typeof body.error === "string";
+	const fromIap = headers.get("x-goog-iap-generated-response") === "true";
+	if ((status === 401 || status === 403) && (fromIap || !ours)) {
+		if (!sent) return "no-sign-in";
+		return status === 401 ? "refused" : "not-allowed";
+	}
+	const page = (headers.get("content-type") ?? "").includes("text/html");
+	if (!json && status < 500 && (status < 300 || page)) return "not-the-app";
+	return null;
+}
+/** What happened, why, and what to do, in the voice of the CLI's other failures. */
+function refusalMessage(kind, credential, url, ci = Boolean(process.env.CI)) {
+	if (kind === "not-the-app") return `${url} answered, but it is not ModelOS Secure. Check the address against the login command on the tokens page.`;
+	if (kind === "no-sign-in") return ci ? "This address needs a Google sign-in, and none was found. In CI, set MODELOS_SECURE_CLIENT_ID with gcloud signed in as a service account, or set MODELOS_SECURE_IAP_TOKEN." : "This address needs a Google sign-in, and this machine has none yet. Run modelos-secure login with the command from the tokens page.";
+	if (kind === "not-allowed") return credential.email ? `You are signed in to Google as ${credential.email}, but that account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.` : "This Google account is not allowed through to ModelOS Secure. Ask whoever runs ModelOS Secure to give it access.";
+	if (credential.source === "env") return "Google refused the token in MODELOS_SECURE_IAP_TOKEN: it has expired, or it was made for another client ID. Make a new one for the client ID on the tokens page.";
+	if (credential.source === "gcloud") return "Google refused the identity token from gcloud: it was made for another client ID, or the account is not a service account. Check MODELOS_SECURE_CLIENT_ID against the tokens page.";
+	return "Google refused your sign-in: it has expired or was revoked. Run modelos-secure login again.";
+}
+// src/api.ts
+var folder = () => join(homedir(), ".modelos-secure");
+var credentials = () => join(folder(), "credentials.json");
+var trim = (url) => url.replace(/\/$/, "");
+async function readSaved() {
+	return readFile(credentials(), "utf8").then((t) => JSON.parse(t)).catch(() => null);
+}
+async function readConnection() {
+	const saved = await readSaved();
+	const url = process.env.MODELOS_SECURE_URL ?? saved?.url;
+	const token = process.env.MODELOS_SECURE_TOKEN ?? saved?.token;
+	if (!url || !token) return null;
+	const same = Boolean(saved?.url && trim(saved.url) === trim(url));
+	const google = same ? saved?.google : void 0;
+	const tlsName = process.env.MODELOS_SECURE_TLS_NAME ?? (same ? saved?.tlsName : void 0);
+	return {
+		url: trim(url),
+		token,
+		...google ? { google } : {},
+		...tlsName ? { tlsName } : {}
+	};
+}
+/** The same connection at another address. The Google sign-in goes only to the same origin. */
+function atAddress(connection, url) {
+	const origin = (u) => {
+		try {
+			return new URL(u).origin;
+		} catch {
+			return null;
+		}
+	};
+	return origin(url) !== null && origin(url) === origin(connection.url) ? {
+		...connection,
+		url: trim(url)
+	} : {
+		url: trim(url),
+		token: connection.token
+	};
+}
+async function saveConnection(connection) {
+	await mkdir(folder(), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(credentials(), JSON.stringify(connection), { mode: 384 });
+	await chmod(credentials(), 384);
+}
+/** Keeps a renewed Google sign-in, if the saved one is still the one that was renewed. */
+async function saveRenewed(url, google) {
+	const saved = await readSaved();
+	if (saved?.url && saved.token && trim(saved.url) === url && saved.google?.clientId === google.clientId) await saveConnection({
+		url: saved.url,
+		token: saved.token,
+		google,
+		...saved.tlsName ? { tlsName: saved.tlsName } : {}
+	});
+}
+var ApiError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/** IAP, or something that is not the app, answered instead of ModelOS Secure. */
+var IapRefusal = class extends ApiError {
+	kind;
+	constructor(kind, status, message) {
+		super(message, status);
+		this.kind = kind;
+	}
+};
+function apiClient(connection, options = {}) {
+	const proxy = proxyCredentials(connection.google, {
+		saved: (google) => saveRenewed(connection.url, google),
+		...options
+	});
+	/** The Google credential this client sends. A refused sign-in is an IAP refusal. */
+	const credential = async () => {
+		try {
+			return await proxy.get();
+		} catch (error) {
+			if (!(error instanceof SignInRefused)) throw error;
+			throw new IapRefusal("refused", 401, refusalMessage("refused", {
+				source: "signed-in",
+				email: connection.google?.email
+			}, connection.url));
+		}
+	};
+	const call = async (method, path, body, signal) => {
+		const sent = await credential();
+		const url = `${connection.url}/api/v1${path}`;
+		const headers = {
+			authorization: `Bearer ${connection.token}`,
+			...sent.token ? { "proxy-authorization": `Bearer ${sent.token}` } : {},
+			...body ? { "content-type": body.type } : {}
+		};
+		const response = await (connection.tlsName ? fetchCheckingName(connection.tlsName)(url, {
+			method,
+			headers,
+			body: body?.text,
+			signal
+		}) : fetch(url, {
+			method,
+			redirect: "manual",
+			headers,
+			body: body?.text,
+			signal
+		})).catch((error) => {
+			if (signal?.aborted) throw error;
+			throw new ApiError(networkMessage(error, connection.url, connection.tlsName), 0);
+		});
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			parsed = void 0;
+		}
+		const kind = refusalKind({
+			status: response.status,
+			headers: response.headers,
+			body: parsed,
+			sent: Boolean(sent.token)
+		});
+		if (kind) throw new IapRefusal(kind, response.status, refusalMessage(kind, sent, connection.url));
+		if (!response.ok) {
+			const error = typeof parsed === "object" && parsed !== null ? parsed.error : void 0;
+			throw new ApiError(typeof error === "string" ? error : `The server answered ${response.status.toString()}.`, response.status);
+		}
+		return parsed;
+	};
+	return {
+		credential,
+		postText: (path, text) => call("POST", path, {
+			text,
+			type: "text/csv"
+		}),
+		get: (path) => call("GET", path),
+		post: (path, body, signal) => call("POST", path, body === void 0 ? void 0 : {
+			text: JSON.stringify(body),
+			type: "application/json"
+		}, signal)
+	};
+}
+// src/commands/login.ts
+/** Reads a login command pasted at the address prompt, or a bare address. */
+function parseLoginLine(line) {
+	const words = line.trim().split(/\s+/).filter(Boolean);
+	const after = (name) => {
+		const index = words.indexOf(`--${name}`);
+		return index >= 0 ? words[index + 1] : void 0;
+	};
+	if (!words.some((w) => w.startsWith("--"))) return words[0] ? { url: words[0] } : {};
+	return {
+		url: after("url"),
+		clientId: after("client-id"),
+		clientSecret: after("client-secret"),
+		tlsName: after("tls-name")
+	};
+}
+async function loginCommand(given = {}) {
+	let url = given.url ?? process.env.MODELOS_SECURE_URL;
+	let { clientId, clientSecret, tlsName } = given;
+	if (!url) {
+		const pasted = parseLoginLine(await askText("Where is ModelOS Secure? Paste the login command from the tokens page, or type the address:"));
+		url = pasted.url;
+		clientId ??= pasted.clientId;
+		clientSecret ??= pasted.clientSecret;
+		tlsName ??= pasted.tlsName;
+	}
+	tlsName ??= process.env.MODELOS_SECURE_TLS_NAME;
+	if (!url) throw new Error("A login needs the address. Copy the login command from the tokens page.");
+	if (clientId && !clientSecret) throw new Error("The client ID needs its client secret. Copy the whole login command from the tokens page.");
+	const token = process.env.MODELOS_SECURE_TOKEN ?? await askText("Paste a workspace token from the tokens page:", true);
+	if (!token) throw new Error("A login needs a workspace token. Create one on the tokens page.");
+	const connection = {
+		url: url.replace(/\/$/, ""),
+		token,
+		...tlsName ? { tlsName } : {}
+	};
+	if (clientId && clientSecret) connection.google = await signInWithGoogle(clientId, clientSecret);
+	const me = await apiClient(connection).get("/whoami");
+	await saveConnection(connection);
+	const who = connection.google?.email;
+	say(`Saved. This machine now works in ${me.workspace}${who ? `, signed in to Google as ${who}` : ""}.`);
+}
+export { step as _, apiClient as a, Interrupted as c, blue as d, bold as f, say as g, red as h, IapRefusal as i, ask as l, grey as m, parseLoginLine as n, atAddress as o, dash as p, ApiError as r, readConnection as s, loginCommand as t, askText as u };