nomoreide 0.2.0 → 0.3.2

package/dist/core/providers/host-provider.d.ts

@@ -1,160 +0,0 @@
-import type { SshServerDefinition } from "../types.js";
-import type { ProviderAccount } from "./deploy-provider.js";
-import type { ProviderApiSpec } from "./egress.js";
-import type { ProviderStrings } from "./strings.js";
-/**
- * The contract an infrastructure host implements — Vultr today, DigitalOcean
- * and Hetzner next.
- *
- * This is the *second* contract, and it exists because the first one could not
- * hold it. A Vultr instance has no projects, no deployments, no build logs and
- * no environment variables; what it has is an address, a power state, and a
- * shell. One `Plugin` interface wide enough for both would have been a union of
- * two disjoint halves, so `DeployProvider` and `HostProvider` stay separate and
- * narrow — see §2 of `docs/plans/2026-08-13-provider-registry-design.md`.
- *
- * What the two contracts *do* share is deliberately shared rather than
- * re-declared: {@link ProviderAccount}, the whole of `providers/credentials.ts`
- * (a host provider's token resolves through the same three-source model), and
- * the read-safe / write-capable split. That overlap is the evidence the
- * provider layer generalized rather than just being renamed.
- *
- * {@link HostProvider.toSshTarget} is why this contract earns its keep: a
- * provider instance becomes a row in the SSH server list the user already has,
- * with the existing probe, metrics and terminal working against it, without
- * anyone registering it by hand.
- */
-/**
- * Normalized power state, chosen — like {@link
- * import("./deploy-provider.js").ProviderDeploymentState} — to be the
- * intersection that drives an icon and a filter. Anything finer belongs in
- * `rawState`.
- *
- * There is no `suspended`: a vendor lock (Vultr's `suspended`, and whatever
- * each other IaaS calls it) is something the user must act on, which is what
- * `error` already means to the UI, and the vendor's own word survives in
- * `rawState`. That is the pressure valve the deploy contract added on day one
- * and this one inherits.
- */
-export type HostInstanceState = "running" | "stopped" | "provisioning" | "error" | "unknown";
-/** One virtual machine. */
-export interface HostInstance {
-    id: string;
-    /** What the user named it, falling back to its hostname or id. */
-    label: string;
-    /** Drives the icon and the filter. */
-    state: HostInstanceState;
-    /** The vendor's own word for the state, shown in the UI detail. */
-    rawState: string;
-    /**
-     * Public IPv4. Absent while the instance is still being provisioned, which
-     * is exactly when it has no address to be reached at.
-     */
-    ipv4?: string;
-    ipv6?: string;
-    /** The instance's own hostname, when the vendor reports one. */
-    hostname?: string;
-    /** The vendor's region code — `ewr`, `nyc3`, `fsn1`. */
-    region?: string;
-    /** The vendor's plan / size id. */
-    plan?: string;
-    /** Operating system, as the vendor describes it. */
-    os?: string;
-    specs?: {
-        vcpus?: number;
-        memoryMb?: number;
-        diskGb?: number;
-    };
-    tags: string[];
-    createdAt?: number;
-    /**
-     * The login the vendor created on the machine — `root` for Vultr's default
-     * scheme, `linuxuser` for its unprivileged one, `ubuntu` or `ec2-user`
-     * elsewhere. Neutral because every IaaS builds an image with *some* account
-     * on it, and load-bearing because {@link HostProvider.toSshTarget} without it
-     * produces a host that `ssh` tries to reach as the local username.
-     */
-    defaultUser?: string;
-}
-/** Which provider instance backs an SSH host, carried into the servers list. */
-export interface HostInstanceRef {
-    providerId: string;
-    /** The provider's display name, so the row can be labelled without a lookup. */
-    providerName: string;
-    instanceId: string;
-    state: HostInstanceState;
-    rawState: string;
-    region?: string;
-}
-/**
- * An SSH target adopted from a provider instance — a plain
- * {@link SshServerDefinition}, which is the point: everything downstream
- * (`probeSshServer`, `readRemoteHostMetrics`, the terminal route, the remote
- * service runner) already takes one and needs no knowledge of providers.
- */
-export interface HostSshTarget extends SshServerDefinition {
-    instance: HostInstanceRef;
-}
-/** The read-safe half. Nothing here starts, stops or destroys a machine. */
-export interface HostProvider {
-    /** Signed-in account. Reuses the deploy contract's type — an account is an account. */
-    account(): Promise<ProviderAccount>;
-    listInstances(): Promise<HostInstance[]>;
-    getInstance(id: string): Promise<HostInstance>;
-    /**
-     * The instance as an SSH host, or null when there is nothing to connect to
-     * yet.
-     *
-     * Nullable because a machine that is still provisioning genuinely has no
-     * address, and the alternative — inventing a placeholder host — would put a
-     * row in the servers list that can only ever fail to connect. A *stopped*
-     * instance still returns a target: it keeps its address, and being able to
-     * see it in the list is how the user notices it is down.
-     */
-    toSshTarget(instance: HostInstance): HostSshTarget | null;
-}
-/**
- * The write-capable half — dashboard-only, never an MCP tool.
- *
- * Split from {@link HostProvider} for the same reason `git-actions.ts` is split
- * from `git-manager.ts`: halting a production database server is not something
- * an agent holding read tools should be one call away from. §7 of the design
- * plan sketched `run?()` on the read interface; writing it that way would have
- * been the first crack in a boundary the rest of the codebase keeps.
- *
- * Named actions rather than `start()`/`stop()`/`reboot()` for the reason the
- * deploy contract gives: "halt" is Vultr's word, "power_off" is DigitalOcean's,
- * and the manifest is where a vendor's vocabulary belongs.
- */
-export interface HostProviderActions {
-    run(action: string, instanceId: string): Promise<void>;
-}
-/**
- * The declarative half — what a generic view needs to render a host provider
- * without knowing which one it is.
- */
-export interface HostProviderManifest {
-    id: string;
-    name: string;
-    kind: "host";
-    /**
-     * This provider's own words, per locale — the same field, the same meaning
-     * and the same enforcement as a deploy provider's.
-     *
-     * A host provider needs it at least as much: "halt" is Vultr's word,
-     * "power_off" is DigitalOcean's, and neither is a sentence a host catalogue
-     * could have been written to contain. No `scope.label` here — a host
-     * provider's instances are not grouped under anything the user picks between.
-     */
-    strings: ProviderStrings;
-    /** Action names accepted by {@link HostProviderActions.run}. */
-    actions: string[];
-    /** The subset of `actions` that interrupts a running machine; the UI confirms these first. */
-    productionAffecting: string[];
-    /**
-     * The egress allowlist — every host this provider may reach. Identical in
-     * meaning and enforcement to a deploy provider's, and one of the few fields
-     * the two contracts share, because the daemon it runs inside is the same one.
-     */
-    api: ProviderApiSpec;
-}

package/dist/core/providers/host-provider.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=host-provider.js.map

package/dist/core/providers/host-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-provider.js","sourceRoot":"","sources":["../../../src/core/providers/host-provider.ts"],"names":[],"mappings":""}

package/dist/core/providers/oauth.d.ts

@@ -1,97 +0,0 @@
-/** Refresh a little early so a call never starts with an about-to-expire token. */
-export declare const TOKEN_REFRESH_SKEW_MS: number;
-/**
- * The vendor-specific half of a browser sign-in.
- *
- * Deliberately four plain values and no behaviour: this is the shape that has
- * to survive being read out of a provider manifest rather than compiled in.
- */
-export interface ProviderOAuthSpec {
-    /** Display name, used verbatim in every message the user may see. */
-    name: string;
-    /** Issuer whose `/.well-known/openid-configuration` is read. */
-    issuer: string;
-    /** Scopes requested at authorize time, space-separated. */
-    scope: string;
-    /** Path the loopback redirect points at, e.g. `/api/providers/vercel/oauth/callback`. */
-    callbackPath: string;
-    /** Name registered with the authorization server. */
-    clientName?: string;
-}
-export interface OAuthMetadata {
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    registrationEndpoint?: string;
-    userinfoEndpoint?: string;
-}
-export interface OAuthTokens {
-    accessToken: string;
-    refreshToken?: string;
-    /** Epoch ms at which `accessToken` stops being accepted. */
-    expiresAt: number;
-}
-export interface PendingLogin {
-    state: string;
-    verifier: string;
-    clientId: string;
-    redirectUri: string;
-    authorizeUrl: string;
-    createdAt: number;
-}
-/** Injected in tests; defaults to the global `fetch`. */
-export interface OAuthDeps {
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-}
-export declare const clock: (deps: OAuthDeps | undefined) => number;
-/**
- * Exposed for tests, which must not inherit another case's cached discovery.
- * With no argument every issuer is cleared.
- */
-export declare function resetOAuthDiscoveryCache(issuer?: string): void;
-/**
- * The issuer's advertised endpoints. Discovered rather than hard-coded so a
- * move of the token or registration endpoint doesn't silently break sign-in.
- */
-export declare function discoverOAuth(spec: ProviderOAuthSpec, deps?: OAuthDeps): Promise<OAuthMetadata>;
-/**
- * Registers a client for `redirectUri` (RFC 7591).
- *
- * Called immediately before every sign-in rather than once at install time:
- * the endpoint may hand back a shared client whose redirect list is replaced by
- * whatever was registered last, so re-registering is what guarantees our own
- * redirect is the one in force when we send the user to the consent screen.
- */
-export declare function registerOAuthClient(spec: ProviderOAuthSpec, metadata: OAuthMetadata, redirectUri: string, deps?: OAuthDeps): Promise<string>;
-/** Registers a client and builds the URL the user's browser must open. */
-export declare function beginLogin(spec: ProviderOAuthSpec, redirectUri: string, deps?: OAuthDeps): Promise<PendingLogin>;
-/** Exchanges the authorization code the callback received for tokens. */
-export declare function completeLogin(spec: ProviderOAuthSpec, pending: PendingLogin, code: string, deps?: OAuthDeps): Promise<OAuthTokens>;
-/**
- * Trades a refresh token for a fresh access token. Treat the returned
- * `refreshToken` as replacing the one passed in — providers rotate on use.
- */
-export declare function refreshOAuthTokens(spec: ProviderOAuthSpec, clientId: string, refreshToken: string, deps?: OAuthDeps): Promise<OAuthTokens>;
-/**
- * The sign-ins awaiting their callback. Kept in memory, never on disk: the
- * PKCE verifier is only meaningful for the minutes between the redirect and
- * the callback, and a restart mid-login is better restarted than resumed.
- */
-export declare class LoginSessions {
-    private readonly now;
-    private readonly pending;
-    constructor(now?: () => number);
-    remember(login: PendingLogin): void;
-    /** Returns and forgets the login for `state`; a code is only redeemable once. */
-    take(state: string): PendingLogin | undefined;
-    private sweep;
-}
-/**
- * The loopback callback URL for a request that arrived on `host`.
- *
- * Derived from the incoming Host header so the flow works on whatever port the
- * daemon (or the Vite dev proxy) is actually serving, and rejected unless it is
- * loopback — a redirect pointing anywhere else would hand the code to a host
- * that is not this machine.
- */
-export declare function loopbackCallbackUrl(spec: ProviderOAuthSpec, host: string | undefined): string;

package/dist/core/providers/oauth.js

@@ -1,238 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-/**
- * Browser sign-in for a deploy/host provider: OAuth 2.0 authorization code +
- * PKCE against a loopback redirect (RFC 8252, "OAuth 2.0 for Native Apps").
- *
- * Every provider that offers a browser sign-in needs the same seven things —
- * discovery, dynamic client registration, a PKCE challenge, the authorize URL,
- * the code exchange, a rotating refresh, and somewhere to park the verifier
- * between the redirect and the callback. None of that is vendor-specific. What
- * *is* vendor-specific is four constants, which arrive as a
- * {@link ProviderOAuthSpec}.
- *
- * Two behaviours this module is built around, both first met in Vercel's
- * authorization server and both common enough to be the default:
- *
- * 1. `offline_access` (or the provider's equivalent) is **required**. Without
- *    it the grant comes back with no refresh token and dies after an hour,
- *    forcing the user to sign in again. Hence `scope` is not optional.
- * 2. Refresh may **rotate**: a refresh can return a new refresh token and
- *    invalidate the previous one, so the caller must persist what comes back.
- *    Callers must treat the returned `refreshToken` as replacing the one they
- *    passed in, whether or not their provider rotates.
- */
-const DISCOVERY_TTL_MS = 60 * 60 * 1000;
-const PENDING_LOGIN_TTL_MS = 10 * 60 * 1000;
-/** Refresh a little early so a call never starts with an about-to-expire token. */
-export const TOKEN_REFRESH_SKEW_MS = 60 * 1000;
-const DEFAULT_CLIENT_NAME = "NoMoreIDE";
-const call = (deps) => deps?.fetchImpl ?? fetch;
-export const clock = (deps) => (deps?.now ?? Date.now)();
-/**
- * Discovered metadata per issuer. Keyed rather than a single slot because two
- * providers signed in at once would otherwise serve each other's endpoints.
- */
-const cachedMetadata = new Map();
-/**
- * Exposed for tests, which must not inherit another case's cached discovery.
- * With no argument every issuer is cleared.
- */
-export function resetOAuthDiscoveryCache(issuer) {
-    if (issuer)
-        cachedMetadata.delete(issuer);
-    else
-        cachedMetadata.clear();
-}
-/**
- * The issuer's advertised endpoints. Discovered rather than hard-coded so a
- * move of the token or registration endpoint doesn't silently break sign-in.
- */
-export async function discoverOAuth(spec, deps) {
-    const now = clock(deps);
-    const cached = cachedMetadata.get(spec.issuer);
-    if (cached && now - cached.fetchedAt < DISCOVERY_TTL_MS)
-        return cached.value;
-    const response = await call(deps)(`${spec.issuer}/.well-known/openid-configuration`, {
-        headers: { Accept: "application/json" },
-    });
-    if (!response.ok) {
-        throw new Error(`${spec.name} OAuth discovery failed (HTTP ${response.status}).`);
-    }
-    const body = (await response.json());
-    const authorizationEndpoint = stringField(body, "authorization_endpoint");
-    const tokenEndpoint = stringField(body, "token_endpoint");
-    if (!authorizationEndpoint || !tokenEndpoint) {
-        throw new Error(`${spec.name} OAuth discovery is missing its authorization or token endpoint.`);
-    }
-    const value = {
-        authorizationEndpoint,
-        tokenEndpoint,
-        registrationEndpoint: stringField(body, "registration_endpoint"),
-        userinfoEndpoint: stringField(body, "userinfo_endpoint"),
-    };
-    cachedMetadata.set(spec.issuer, { value, fetchedAt: now });
-    return value;
-}
-/**
- * Registers a client for `redirectUri` (RFC 7591).
- *
- * Called immediately before every sign-in rather than once at install time:
- * the endpoint may hand back a shared client whose redirect list is replaced by
- * whatever was registered last, so re-registering is what guarantees our own
- * redirect is the one in force when we send the user to the consent screen.
- */
-export async function registerOAuthClient(spec, metadata, redirectUri, deps) {
-    if (!metadata.registrationEndpoint) {
-        throw new Error(`${spec.name} does not advertise a client registration endpoint.`);
-    }
-    const response = await call(deps)(metadata.registrationEndpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify({
-            client_name: spec.clientName ?? DEFAULT_CLIENT_NAME,
-            redirect_uris: [redirectUri],
-            grant_types: ["authorization_code", "refresh_token"],
-            response_types: ["code"],
-            token_endpoint_auth_method: "none",
-            application_type: "native",
-        }),
-    });
-    const body = (await response.json().catch(() => ({})));
-    if (!response.ok) {
-        throw new Error(oauthErrorMessage(body) ?? `Client registration failed (HTTP ${response.status}).`);
-    }
-    const clientId = stringField(body, "client_id");
-    if (!clientId)
-        throw new Error(`${spec.name} returned no client_id.`);
-    return clientId;
-}
-/** Registers a client and builds the URL the user's browser must open. */
-export async function beginLogin(spec, redirectUri, deps) {
-    const metadata = await discoverOAuth(spec, deps);
-    const clientId = await registerOAuthClient(spec, metadata, redirectUri, deps);
-    const verifier = base64Url(randomBytes(32));
-    const state = base64Url(randomBytes(16));
-    const challenge = base64Url(createHash("sha256").update(verifier).digest());
-    const authorizeUrl = new URL(metadata.authorizationEndpoint);
-    authorizeUrl.searchParams.set("client_id", clientId);
-    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
-    authorizeUrl.searchParams.set("response_type", "code");
-    authorizeUrl.searchParams.set("code_challenge", challenge);
-    authorizeUrl.searchParams.set("code_challenge_method", "S256");
-    authorizeUrl.searchParams.set("state", state);
-    authorizeUrl.searchParams.set("scope", spec.scope);
-    return {
-        state,
-        verifier,
-        clientId,
-        redirectUri,
-        authorizeUrl: authorizeUrl.toString(),
-        createdAt: clock(deps),
-    };
-}
-/** Exchanges the authorization code the callback received for tokens. */
-export async function completeLogin(spec, pending, code, deps) {
-    return tokenRequest(spec, new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: pending.redirectUri,
-        client_id: pending.clientId,
-        code_verifier: pending.verifier,
-    }), deps);
-}
-/**
- * Trades a refresh token for a fresh access token. Treat the returned
- * `refreshToken` as replacing the one passed in — providers rotate on use.
- */
-export async function refreshOAuthTokens(spec, clientId, refreshToken, deps) {
-    return tokenRequest(spec, new URLSearchParams({
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        client_id: clientId,
-    }), deps);
-}
-async function tokenRequest(spec, body, deps) {
-    const metadata = await discoverOAuth(spec, deps);
-    const response = await call(deps)(metadata.tokenEndpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-        body,
-    });
-    const parsed = (await response.json().catch(() => ({})));
-    if (!response.ok) {
-        throw new Error(oauthErrorMessage(parsed) ?? `${spec.name} token request failed (HTTP ${response.status}).`);
-    }
-    const accessToken = stringField(parsed, "access_token");
-    if (!accessToken)
-        throw new Error(`${spec.name} returned no access token.`);
-    const expiresIn = typeof parsed.expires_in === "number" ? parsed.expires_in : 3600;
-    return {
-        accessToken,
-        refreshToken: stringField(parsed, "refresh_token"),
-        expiresAt: clock(deps) + expiresIn * 1000,
-    };
-}
-/**
- * The sign-ins awaiting their callback. Kept in memory, never on disk: the
- * PKCE verifier is only meaningful for the minutes between the redirect and
- * the callback, and a restart mid-login is better restarted than resumed.
- */
-export class LoginSessions {
-    now;
-    pending = new Map();
-    constructor(now = Date.now) {
-        this.now = now;
-    }
-    remember(login) {
-        this.sweep();
-        this.pending.set(login.state, login);
-    }
-    /** Returns and forgets the login for `state`; a code is only redeemable once. */
-    take(state) {
-        this.sweep();
-        const login = this.pending.get(state);
-        if (login)
-            this.pending.delete(state);
-        return login;
-    }
-    sweep() {
-        const cutoff = this.now() - PENDING_LOGIN_TTL_MS;
-        for (const [state, login] of this.pending) {
-            if (login.createdAt < cutoff)
-                this.pending.delete(state);
-        }
-    }
-}
-/**
- * The loopback callback URL for a request that arrived on `host`.
- *
- * Derived from the incoming Host header so the flow works on whatever port the
- * daemon (or the Vite dev proxy) is actually serving, and rejected unless it is
- * loopback — a redirect pointing anywhere else would hand the code to a host
- * that is not this machine.
- */
-export function loopbackCallbackUrl(spec, host) {
-    const hostname = host?.trim().replace(/^\[|\]$/g, "").split(":")[0];
-    if (!host || !hostname || !isLoopbackHost(hostname)) {
-        throw new Error(`${spec.name} sign-in requires a loopback address (localhost or 127.0.0.1).`);
-    }
-    return `http://${host}${spec.callbackPath}`;
-}
-function isLoopbackHost(hostname) {
-    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-}
-function base64Url(buffer) {
-    return buffer.toString("base64url");
-}
-function stringField(body, field) {
-    const value = body[field];
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
-function oauthErrorMessage(body) {
-    const description = stringField(body, "error_description");
-    const error = stringField(body, "error");
-    if (description && error)
-        return `${description} (${error})`;
-    return description ?? error;
-}
-//# sourceMappingURL=oauth.js.map

package/dist/core/providers/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/core/providers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAkDxC,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAgB,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC;AACrF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAA2B,EAAU,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAExF;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuD,CAAC;AAEtF;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM;QAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;;QACrC,cAAc,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAuB,EACvB,IAAgB;IAEhB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,gBAAgB;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAE7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,mCAAmC,EAAE;QACnF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,qBAAqB,GAAG,WAAW,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,kEAAkE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAkB;QAC3B,qBAAqB;QACrB,aAAa;QACb,oBAAoB,EAAE,WAAW,CAAC,IAAI,EAAE,uBAAuB,CAAC;QAChE,gBAAgB,EAAE,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC;KACzD,CAAC;IACF,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAuB,EACvB,QAAuB,EACvB,WAAmB,EACnB,IAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,qDAAqD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,mBAAmB;YACnD,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAClF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iBAAiB,CAAC,IAAI,CAAC,IAAI,oCAAoC,QAAQ,CAAC,MAAM,IAAI,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAuB,EACvB,WAAmB,EACnB,IAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC7D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEnD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAuB,EACvB,OAAqB,EACrB,IAAY,EACZ,IAAgB;IAEhB,OAAO,YAAY,CACjB,IAAI,EACJ,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,QAAQ;KAChC,CAAC,EACF,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,QAAgB,EAChB,YAAoB,EACpB,IAAgB;IAEhB,OAAO,YAAY,CACjB,IAAI,EACJ,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,CAAC,EACF,IAAI,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAuB,EACvB,IAAqB,EACrB,IAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI;KACL,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iBAAiB,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,+BAA+B,QAAQ,CAAC,MAAM,IAAI,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO;QACL,WAAW;QACX,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC;QAClD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAGK;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YAA6B,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAE7D,QAAQ,CAAC,KAAmB;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;QACjD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,IAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,gEAAgE,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC;IAC7D,OAAO,WAAW,IAAI,KAAK,CAAC;AAC9B,CAAC"}

package/dist/core/providers/project-resolution.d.ts

@@ -1,81 +0,0 @@
-import type { NoMoreIdeConfig } from "../types.js";
-import type { DeployProviderHooks, ProviderScope } from "./deploy-provider.js";
-/**
- * Which provider project a repository deploys, and which scope to open on.
- *
- * Both algorithms below came from `vercel-context.ts` and neither is
- * vendor-specific — what varies is only the two hooks in
- * {@link DeployProviderHooks}. They are generic over the project and scope
- * types so a caller holding a vendor-shaped client can use them before the
- * `DeployProvider` adapter is wired through to the HTTP surface.
- */
-export interface ResolveProjectOptions<P> {
-    providerId: string;
-    hooks: DeployProviderHooks;
-    config: NoMoreIdeConfig;
-    gitCwd: string;
-    /** Reads one project by id. Rejecting means "not this one", not a failure. */
-    getProject: (id: string) => Promise<P>;
-    /** Looks a project up by the URL the vendor keys imports by. */
-    findByRepoUrl: (repoUrl: string) => Promise<P | undefined>;
-}
-/**
- * The project this repository deploys, in order of confidence:
- *
- * 1. an explicit pin the user chose in the dashboard;
- * 2. the vendor CLI's own link file — the same file the CLI trusts, so a linked
- *    repo needs no configuration here at all;
- * 3. a lookup by the repo's git remote, which is how the provider itself keys
- *    an imported project.
- *
- * Returns undefined rather than guessing when none of those answer, since the
- * wrong project would show deployments for unrelated code.
- */
-export declare function resolveProviderProject<P>(options: ResolveProjectOptions<P>): Promise<P | undefined>;
-/** The project id recorded by the vendor CLI's link command, when present. */
-export declare function readLinkedProjectId(repoRoot: string, linkFile: {
-    path: string;
-    field: string;
-}): Promise<string | undefined>;
-/** The working directory provider operations run against — mirrors the GitHub seam. */
-export declare function selectedProviderCwd(config: NoMoreIdeConfig, fallbackCwd: string): string;
-export interface AdoptSoleScopeOptions<S extends Pick<ProviderScope, "id" | "slug">> {
-    /** A `cli` credential follows the vendor CLI's own scope; see below. */
-    source: "cli" | "stored" | "oauth";
-    listScopes: () => Promise<S[]>;
-    persist: (scope: {
-        scopeId: string;
-        scopeSlug: string;
-    }) => Promise<void>;
-    /**
-     * Whether the vendor's CLI selects a scope of its own that ours must not
-     * override. True by default, which is Vercel: `vercel switch` writes a
-     * current team, the credential resolver has already inherited it, and a scope
-     * written here would outrank it from then on — so a `cli` credential adopts
-     * nothing at all.
-     *
-     * False says the CLI has no such notion (Wrangler has no account switch; the
-     * account comes from the environment). Then the sole scope *is* adopted for a
-     * `cli` credential — a provider that needs a scope for every call would
-     * otherwise have no way to get one — but still never persisted, because a
-     * saved scope would outrank the environment variable that should win.
-     */
-    cliSelectsScope?: boolean;
-}
-/**
- * The scope to use when the user has never chosen one.
- *
- * Vercel puts a personal account's projects under an implicit "<name>'s
- * projects" team, not under the account itself, so an unscoped client lists
- * nothing at all — which reads as "no projects" rather than "wrong scope". Any
- * provider with an implicit default scope has this problem. A `cli` connection
- * avoids it by inheriting the CLI's own scope; a browser sign-in or a pasted
- * token has nothing to inherit, so the sole scope is adopted here and
- * persisted, making this a one-time lookup.
- *
- * With several scopes there is no unambiguous answer, so none is chosen and the
- * dashboard's scope switcher is left to ask. Failures are swallowed: an
- * unscoped client still works, and the caller's own request should be what
- * surfaces an auth problem.
- */
-export declare function adoptSoleScope<S extends Pick<ProviderScope, "id" | "slug">>(options: AdoptSoleScopeOptions<S>): Promise<string | undefined>;