nowaikit 4.12.1 → 4.15.1

package/dist/cli/detect-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect-clients.js","sourceRoot":"","sources":["../../src/cli/detect-clients.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAkBzC,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,0CAA0C;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QAC3E,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAc,EAAE,QAAgB;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,CAAC;YAC1C,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC;SACvD,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3E,+EAA+E;QAC/E,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3E,mFAAmF;IACnF,MAAM,mBAAmB,GACvB,CAAC,KAAK,OAAO;QACX,CAAC,CAAC,qBAAqB,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,4BAA4B,CAAC;QAClF,CAAC,CAAC,CAAC,KAAK,QAAQ;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAqB;QAChC;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,kGAAkG;SACzG;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK;YACf,2EAA2E;YAC3E,2DAA2D;YAC3D,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC;YAC7C,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,sEAAsE;SAC7E;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;YACtD,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,+FAA+F;SACtG;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK;YACf,uEAAuE;YACvE,4EAA4E;YAC5E,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC;YACjE,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,+BAA+B;SACtC;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC;YAClD,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,qDAAqD;SAC5D;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,SAAS;YACtB,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,yDAAyD;SAChE;QACD;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,iIAAiI;SACxI;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YACvC,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,yEAAyE;SAChF;KACF,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACrB,IAAI,CAAC,CAAC,EAAE,KAAK,gBAAgB,EAAE,CAAC;YAC9B,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EACN,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;oBACxB,SAAS,CACP,0BAA0B,EAC1B,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,EACxC,QAAQ,CACT;aACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EAAE,SAAS,CACjB,sCAAsC,EACtC,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,UAAU,CAAC,EACjD,MAAM,CACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EACN,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;oBACxB,SAAS,CAAC,4BAA4B,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC;aACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,2BAA2B,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3H,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"detect-clients.js","sourceRoot":"","sources":["../../src/cli/detect-clients.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAkBzC,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,0CAA0C;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QAC3E,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAc,EAAE,QAAgB;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACzG,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5H,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,EAAE,wBAAwB,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,CAAC;YAC1C,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC;SACvD,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3E,+EAA+E;QAC/E,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3E,mFAAmF;IACnF,MAAM,mBAAmB,GACvB,CAAC,KAAK,OAAO;QACX,CAAC,CAAC,qBAAqB,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,4BAA4B,CAAC;QAClF,CAAC,CAAC,CAAC,KAAK,QAAQ;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAqB;QAChC;YACE,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,kGAAkG;SACzG;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK;YACf,2EAA2E;YAC3E,2DAA2D;YAC3D,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC;YAC7C,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,sEAAsE;SAC7E;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,KAAK;YACf,0FAA0F;YAC1F,+EAA+E;YAC/E,UAAU,EAAE,oBAAoB,EAAE;YAClC,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,iJAAiJ;SACxJ;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK;YACf,uEAAuE;YACvE,4EAA4E;YAC5E,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC;YACjE,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,+BAA+B;SACtC;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC;YAClD,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,qDAAqD;SAC5D;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,KAAK;YACf,+FAA+F;YAC/F,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,CAAC;YACnE,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,mEAAmE;SAC1E;QACD;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,eAAe,EAAE;YAC7B,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,8FAA8F;SACrG;QACD;YACE,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,KAAK;YACf,kGAAkG;YAClG,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC;YAClD,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,oDAAoD;SAC3D;QACD;YACE,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,SAAS;YACtB,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,yDAAyD;SAChE;QACD;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE,iIAAiI;SACxI;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YACvC,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,yEAAyE;SAChF;KACF,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACrB,IAAI,CAAC,CAAC,EAAE,KAAK,gBAAgB,EAAE,CAAC;YAC9B,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EACN,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;oBACxB,SAAS,CACP,0BAA0B,EAC1B,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,EACxC,QAAQ,CACT;aACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EAAE,SAAS,CACjB,sCAAsC,EACtC,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,UAAU,CAAC,EACjD,MAAM,CACP;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EACN,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;oBACxB,SAAS,CAAC,4BAA4B,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC;aACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO;gBACL,GAAG,CAAC;gBACJ,QAAQ,EACN,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBAC7D,SAAS,CAAC,+BAA+B,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,CAAC,EAAE,aAAa,CAAC;aAChH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YACrB,6EAA6E;YAC7E,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,2BAA2B,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3H,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/cli/setup.ts"],"names":[],"mappings":"AAkXA,wBAAsB,QAAQ,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAqxB7E"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/cli/setup.ts"],"names":[],"mappings":"AA8fA,wBAAsB,QAAQ,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAs2B7E"}

package/dist/cli/setup.js

@@ -346,6 +346,125 @@ async function fetchOpenAIModels(apiKey) {
         return [];
     }
 }
+/**
+ * Print the exact steps to register the NowAIKit OAuth app on the instance. For the CLI the redirect
+ * is the local loopback the login listens on; the gateway path uses one HTTPS redirect instead
+ * (see AUTH-MODES.md). Kept as concrete, do-able steps so setup never assumes an app that isn't there.
+ */
+function printOAuthAppSteps(instanceUrl) {
+    console.log('');
+    box([
+        accent('Create an OAuth app (one time, ~2 minutes)'),
+        dim('Any OAuth app works — it does not have to be a NowAIKit one.'),
+    ], accent);
+    console.log('');
+    console.log('  ' + brand('1.') + ' Open ' + accent(`${instanceUrl}/nav_to.do?uri=oauth_entity_list.do`));
+    console.log('     ' + dim('System OAuth > Application Registry'));
+    console.log('  ' + brand('2.') + ' New > ' + accent('Create an OAuth API endpoint for external clients'));
+    console.log('  ' + brand('3.') + ' Name: ' + accent('NowAIKit') + dim(' (any name)   Grant type: ') + accent('Authorization Code'));
+    console.log('  ' + brand('4.') + ' Redirect URL: ' + accent('http://localhost:8765/callback'));
+    console.log('     ' + dim('(this is the CLI loopback; the gateway path uses its own https callback)'));
+    console.log('  ' + brand('5.') + ' Save, then open the record and copy the ' + accent('Client ID') + ' and ' + accent('Client Secret') + '.');
+    console.log('');
+    console.log('  ' + dim('Already have an OAuth app? Just add the redirect URL above to it and reuse its Client ID / Secret.'));
+    console.log('');
+}
+/**
+ * Look for an OAuth app already registered on the instance for the CLI loopback, so the user does not
+ * have to know whether an admin created one. Returns the app if found, 'forbidden' when the account
+ * cannot read oauth_entity (i.e. not an admin, so we cannot detect), or null when none exists.
+ * oauth_entity is admin-only, so this only detects for privileged accounts — regular users cannot.
+ */
+async function findExistingOAuthApp(instanceUrl, user, pass) {
+    const authz = 'Basic ' + Buffer.from(`${user}:${pass}`).toString('base64');
+    const q = encodeURIComponent('type=client^active=true^redirect_urlLIKElocalhost:8765');
+    const resp = await fetch(`${instanceUrl}/api/now/table/oauth_entity?sysparm_query=${q}&sysparm_fields=client_id,client_secret&sysparm_limit=1`, { headers: { Authorization: authz, Accept: 'application/json' } });
+    if (resp.status === 401)
+        throw new Error('Sign-in failed (401). Check the username and password.');
+    if (resp.status === 403)
+        return 'forbidden';
+    if (!resp.ok)
+        return null;
+    const data = await resp.json();
+    const r = data.result?.[0];
+    if (!r || !r.client_id)
+        return null;
+    return { clientId: r.client_id, clientSecret: r.client_secret || '' };
+}
+/**
+ * Auto-provision an OAuth app on the instance via the Table API so the customer never opens the OAuth
+ * UI. Needs a one-time admin sign-in. Creates an Authorization Code client with the redirect pre-set,
+ * then reads back the generated client id/secret. Throws a readable reason (bad login, missing role,
+ * masked secret) so the caller can fall back to the manual steps.
+ */
+/**
+ * Detect whether the instance supports modern OAuth (public client + PKCE, and CIMD) by probing the
+ * dictionary for the oauth_entity fields present on Australia+ releases. Returns all-false on any error
+ * so setup safely uses the older confidential-client path on instances that predate this.
+ */
+async function detectModernOAuth(instanceUrl, user, pass) {
+    const authz = 'Basic ' + Buffer.from(`${user}:${pass}`).toString('base64');
+    try {
+        const q = encodeURIComponent('name=oauth_entity^elementINuse_pkce,public_client,auth_cimd_client');
+        const resp = await fetch(`${instanceUrl}/api/now/table/sys_dictionary?sysparm_query=${q}&sysparm_fields=element&sysparm_limit=5`, { headers: { Authorization: authz, Accept: 'application/json' } });
+        if (!resp.ok)
+            return { publicPkce: false, cimd: false };
+        const data = await resp.json();
+        const els = new Set((data.result || []).map(r => r.element));
+        return { publicPkce: els.has('use_pkce') && els.has('public_client'), cimd: els.has('auth_cimd_client') };
+    }
+    catch {
+        return { publicPkce: false, cimd: false };
+    }
+}
+async function provisionOAuthApp(instanceUrl, adminUser, adminPass, redirectUrl, opts = {}) {
+    const authz = 'Basic ' + Buffer.from(`${adminUser}:${adminPass}`).toString('base64');
+    // On instances with modern OAuth (public client + PKCE), create a PUBLIC client with no secret. That
+    // removes the masked-secret readback problem entirely and matches how CIMD/MCP clients authenticate.
+    const body = {
+        name: 'NowAIKit',
+        type: 'client',
+        active: 'true',
+        default_grant_type: 'authorization_code',
+        redirect_url: redirectUrl,
+        access_token_lifespan: '1800',
+        refresh_token_lifespan: '8640000',
+    };
+    if (opts.publicPkce) {
+        body.public_client = 'true';
+        body.use_pkce = 'true';
+    }
+    const resp = await fetch(`${instanceUrl}/api/now/table/oauth_entity?sysparm_fields=sys_id,client_id,client_secret`, {
+        method: 'POST',
+        headers: { Authorization: authz, 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (resp.status === 401)
+        throw new Error('Admin sign-in failed (401). Check the username and password.');
+    if (resp.status === 403)
+        throw new Error('This account cannot create OAuth apps (403). It needs admin with security_admin elevation.');
+    if (!resp.ok)
+        throw new Error(`Could not create the OAuth app: ${resp.status} ${resp.statusText}`);
+    const data = await resp.json();
+    const clientId = data.result?.client_id || '';
+    let clientSecret = data.result?.client_secret || '';
+    if (!clientId)
+        throw new Error('The instance did not return a client id for the new app.');
+    // Public + PKCE client: no secret needed, the CLI login uses PKCE.
+    if (opts.publicPkce)
+        return { clientId, clientSecret: '' };
+    // Confidential client: some instances mask client_secret in the create response; re-read it by sys_id.
+    if (!clientSecret && data.result?.sys_id) {
+        const re = await fetch(`${instanceUrl}/api/now/table/oauth_entity/${data.result.sys_id}?sysparm_fields=client_secret`, { headers: { Authorization: authz, Accept: 'application/json' } });
+        if (re.ok) {
+            const d = await re.json();
+            clientSecret = d.result?.client_secret || '';
+        }
+    }
+    if (!clientSecret)
+        throw new Error('Created the app but could not read its client secret. Open the record and copy it, then re-run and paste it.');
+    return { clientId, clientSecret };
+}
 // ═══════════════════════════════════════════════════════════════════════════════
 // MAIN SETUP FLOW
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -479,7 +598,7 @@ export async function runSetup(options = {}) {
     step(2, 'Authentication');
     sectionLabel('Choose how to authenticate with ServiceNow');
     console.log('');
-    const authMethod = await select({
+    let authMethod = await select({
         message: brand('?') + ' Auth method' + brand(':'),
         choices: [
             { name: `${brand('🔑')} Basic ${dim('(username + password) — good for dev/PDI')}`, value: 'basic' },
@@ -509,6 +628,9 @@ export async function runSetup(options = {}) {
     let userPassword;
     let clientId;
     let clientSecret;
+    // True once we've already made a successful authenticated call during OAuth setup (provisioning or
+    // reading an existing app), so the separate "Testing Connection" step is redundant and can be skipped.
+    let connectionVerified = false;
     if (authMode === 'per-user') {
         box([
             warn('Per-user mode selected'),
@@ -522,21 +644,122 @@ export async function runSetup(options = {}) {
         userPassword = await password({ message: brand('?') + ' Password' + brand(':'), mask: '•' });
     }
     else {
-        sectionLabel('OAuth 2.0 credentials');
-        console.log('');
-        clientId = await input({ message: brand('?') + ' Client ID' + brand(':') });
-        clientSecret = await password({ message: brand('?') + ' Client Secret' + brand(':'), mask: '•' });
+        sectionLabel('OAuth 2.0 sign-in');
+        console.log('  ' + dim('NowAIKit checks the instance for an OAuth app, so you do not have to know if one exists.'));
         console.log('');
-        sectionLabel('Service account for token generation');
-        console.log('');
-        username = await input({ message: brand('?') + ' Username' + brand(':') });
-        userPassword = await password({ message: brand('?') + ' Password' + brand(':'), mask: '•' });
+        // Detection-first: sign in once, then look for an existing app. This sign-in doubles as the
+        // setup connection-test account and, if the account is an admin, is used to create the app.
+        const signInUser = await input({ message: brand('?') + ' ServiceNow username' + brand(':') });
+        const signInPass = await password({ message: brand('?') + ' ServiceNow password' + brand(':'), mask: '•' });
+        // Detect modern OAuth (public client + PKCE, CIMD) so we can provision a secret-less client where
+        // supported, and point the customer at the zero-registration CIMD path on newer releases.
+        const caps = await detectModernOAuth(instanceUrl, signInUser, signInPass);
+        if (caps.cimd) {
+            console.log('  ' + dim('This instance supports CIMD (zero-registration OAuth). See OAUTH-ARCHITECTURE.md for the gateway path.'));
+        }
+        const detect = ora('  Checking the instance for an OAuth app…').start();
+        let found = null;
+        try {
+            found = await findExistingOAuthApp(instanceUrl, signInUser, signInPass);
+        }
+        catch (e) {
+            detect.fail(err('  ' + (e instanceof Error ? e.message : String(e))));
+        }
+        if (found && found !== 'forbidden' && found.clientId) {
+            clientId = found.clientId;
+            clientSecret = found.clientSecret;
+            username = signInUser;
+            userPassword = signInPass;
+            connectionVerified = true; // findExistingOAuthApp already made an authenticated call with these creds
+            if (clientSecret) {
+                detect.succeed(success('  Found an existing OAuth app — using it ') + dim(`(Client ID ${clientId})`));
+            }
+            else if (caps.publicPkce) {
+                detect.succeed(success('  Found a public OAuth app — using it with PKCE ') + dim(`(Client ID ${clientId})`));
+            }
+            else {
+                detect.succeed(success('  Found an OAuth app ') + dim(`(Client ID ${clientId})`));
+                console.log('  ' + dim('Could not read its secret over the API. Paste it, or leave blank to use PKCE.'));
+                clientSecret = await password({ message: brand('?') + ' Client Secret (blank = PKCE)' + brand(':'), mask: '•' });
+            }
+        }
+        else {
+            if (found === 'forbidden') {
+                detect.info(dim('  This account cannot list OAuth apps (not an admin), so auto-detection is off.'));
+            }
+            else {
+                detect.info(dim('  No OAuth app found on the instance.'));
+            }
+            console.log('');
+            const how = await select({
+                message: brand('?') + ' How do you want to set up OAuth' + brand('?'),
+                choices: [
+                    { name: `${success('✨')} Create it for me ${dim('— needs the sign-in above to be an ADMIN')}`, value: 'auto' },
+                    { name: `${accent('🔑')} I have the Client ID and Secret ${dim('— enter them')}`, value: 'have' },
+                    { name: `${accent('🔧')} Show me the manual steps ${dim('(needs an admin)')}`, value: 'manual' },
+                    { name: `${brand('🔒')} Skip OAuth — username/password ${dim('(no app, any user)')}`, value: 'basic' },
+                ],
+            });
+            if (how === 'auto') {
+                const spin = ora('  Creating the OAuth app on the instance…').start();
+                try {
+                    const app = await provisionOAuthApp(instanceUrl, signInUser, signInPass, 'http://localhost:8765/callback', { publicPkce: caps.publicPkce });
+                    clientId = app.clientId;
+                    clientSecret = app.clientSecret;
+                    spin.succeed(success('  OAuth app created — Client ID ') + accent(clientId) + (caps.publicPkce ? dim(' (public client, PKCE)') : ''));
+                    username = signInUser;
+                    userPassword = signInPass;
+                    connectionVerified = true; // the create call itself proved the instance + admin creds work
+                }
+                catch (e) {
+                    spin.fail(err('  ' + (e instanceof Error ? e.message : String(e))));
+                    console.log('');
+                    console.log('  ' + dim('Create it by hand with these steps, then enter the Client ID / Secret below:'));
+                    printOAuthAppSteps(instanceUrl);
+                }
+            }
+            else if (how === 'manual') {
+                printOAuthAppSteps(instanceUrl);
+            }
+            else if (how === 'basic') {
+                console.log('');
+                box([
+                    warn('Skipping OAuth, using username/password (works without an app).'),
+                    dim('On SSO-only instances you will need the OAuth app or Entra instead — see AUTH-MODES.md.'),
+                ], warn);
+                console.log('');
+                authMethod = 'basic';
+                username = signInUser;
+                userPassword = signInPass;
+            }
+            // 'have' falls through to the Client ID / Secret prompt below.
+        }
+        if (authMethod === 'oauth') {
+            if (!clientId) {
+                clientId = await input({ message: brand('?') + ' Client ID' + brand(':') });
+                clientSecret = await password({ message: brand('?') + ' Client Secret' + brand(':'), mask: '•' });
+            }
+            // The sign-in above already serves as the setup-test / service account for per-user mode.
+            if (!username) {
+                username = signInUser;
+                userPassword = signInPass;
+            }
+        }
     }
     // ─── Step 4: Test Connection ──────────────────────────────────────────────
     step(4, 'Testing Connection');
     let connected = false;
+    // Already proven during OAuth setup (we provisioned or read an app with these creds) — no re-test.
+    if (connectionVerified) {
+        console.log('  ' + success('✓') + dim(' Connection already verified during sign-in.'));
+        connected = true;
+    }
     while (!connected) {
-        const { ok } = await testConnection(instanceUrl, authMethod, {
+        // A public OAuth client (PKCE, no secret) can't be exercised by the setup-time password grant —
+        // the per-user token comes later from `nowaikit auth login`. Verify the instance and the
+        // service-account credentials with basic auth instead. The saved config stays OAuth.
+        const testMethod = (authMethod === 'oauth' && !clientSecret) ? 'basic' : authMethod;
+        const { ok } = await testConnection(instanceUrl, testMethod, {
             username,
             password: userPassword,
             clientId,
@@ -773,7 +996,7 @@ export async function runSetup(options = {}) {
             choices: providerChoices,
             default: localProviders.ollama.running ? 'ollama'
                 : localProviders.lmstudio.running ? 'lmstudio'
-                    : undefined,
+                    : 'skip',
         });
         if (selectedProvider !== 'skip') {
             aiProvider = selectedProvider;
@@ -869,16 +1092,10 @@ export async function runSetup(options = {}) {
                 });
                 console.log(`  ${success('✓')} Google Gemini configured with ${accent(aiModel)}`);
             }
-            // Custom base URL option for advanced users
-            const useCustomUrl = await confirm({
-                message: brand('?') + ' Use a custom API endpoint URL' + brand('?'),
-                default: false,
-            });
-            if (useCustomUrl) {
-                aiBaseUrl = await input({
-                    message: brand('?') + ' Custom endpoint URL' + brand(':'),
-                });
-            }
+            // Advanced: a custom AI base URL (proxy / OpenAI-compatible endpoint) can be set via
+            // NOWAIKIT_AI_BASE_URL. No prompt here — it keeps setup short for the common case.
+            if (process.env.NOWAIKIT_AI_BASE_URL)
+                aiBaseUrl = process.env.NOWAIKIT_AI_BASE_URL;
         }
         else {
             console.log(`  ${dim('→')} AI provider skipped — use --provider flag or environment variables when running capabilities.`);
@@ -920,24 +1137,8 @@ export async function runSetup(options = {}) {
         console.log(dim('  Generate reports:      ') + brand('npx nowaikit report scan-health --format pdf'));
         console.log(dim('  Supports: ') + accent('Anthropic') + dim(', ') + accent('OpenAI') + dim(', ') + accent('Ollama') + dim(' (BYOK — bring your own key)'));
         console.log('');
-        const showMoreCaps = await confirm({
-            message: brand('?') + ' Would you like to list all 26 capabilities in detail' + brand('?'),
-            default: false,
-        });
-        if (showMoreCaps) {
-            console.log('');
-            try {
-                const { getCapabilityMeta } = await import('../prompts/index.js');
-                const caps = getCapabilityMeta();
-                for (const c of caps) {
-                    console.log(`    ${brand('/' + c.name.padEnd(24))} ${dim(c.description)}`);
-                }
-            }
-            catch {
-                console.log(dim('  (Capability metadata not available — run ') + brand('npx nowaikit capabilities') + dim(' to see the full list)'));
-            }
-            console.log('');
-        }
+        console.log(dim('  See all 26 in detail any time: ') + brand('npx nowaikit capabilities'));
+        console.log('');
     }
     else {
         console.log(`  ${dim('▸')} ${dim('Apex AI Skills disabled — 26 capabilities not loaded.')}`);
@@ -1129,11 +1330,8 @@ async function runAutoConfiguration(instance, mcpEnabled, sdkEnabled, chosenClie
             console.log(`  ${dim('→')} ${dim('Starter file already exists:')} ${accent(examplePath)}`);
         }
         else {
-            const shouldCreate = await confirm({
-                message: brand('?') + ' Create a starter ' + brand('nowaikit-example.ts') + ' in the current directory' + brand('?'),
-                default: true,
-            });
-            if (shouldCreate) {
+            // Just create it (no prompt) — it's harmless, never overwrites, and only runs when SDK is enabled.
+            {
                 const instanceUrl = instance.instanceUrl;
                 const starter = [
                     `/**`,
@@ -1172,7 +1370,7 @@ async function runAutoConfiguration(instance, mcpEnabled, sdkEnabled, chosenClie
                     `console.log('Created incident:', newIncident.sys_id);`,
                 ].join('\n');
                 writeFileSync(examplePath, starter, 'utf8');
-                console.log(`  ${success('✓')} Created starter file: ${accent(examplePath)}`);
+                console.log(`  ${success('✓')} Created starter file: ${accent(examplePath)} ${dim('(delete if you do not need it)')}`);
             }
         }
         console.log('');