promigence 0.1.0-beta.12

package/dist/login.js

@@ -0,0 +1,1063 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { hostname } from "node:os";
+import { win32 } from "node:path";
+import { createInterface } from "node:readline";
+import { AuthError, DEFAULT_API_URL, PromigenceClient, PromigenceError, UnreachableError, credentialsPath, readCredentials, readCredentialsWithStore, } from "./sdk/index.js";
+import { forgetKeychainReads, storeLabel } from "./sdk/credstore.js";
+import { bool, clientOpts, nexts, positional, str } from "./commands.js";
+import { MINTED_BY, checkCredentialsPath, loginMintedKey, revokeReplacedKey, storeCredentials, storedWhere, } from "./credfile.js";
+import { emit, okEnvelope, recordNotice, usageError, write } from "./io.js";
+import { sh, shellArg } from "./term.js";
+import { keysCreateInOrg, projectKeyClient } from "./orgs.js";
+import { offerAfterLogin } from "./credits.js";
+import { deviceFetch, deviceHeader } from "./device.js";
+export function expiryBody(ctx) {
+    const raw = str(ctx, "--expires");
+    if (raw === undefined || raw.trim().toLowerCase() === "never")
+        return {};
+    const v = raw.trim();
+    const short = /^(\d+)\s*([hm])$/i.exec(v);
+    if (short) {
+        const n = Number(short[1]);
+        if (n < 1)
+            throw usageError(`--expires ${JSON.stringify(v)} is not in the future`, "Pass a lifetime of at least 1m, e.g. --expires 1h.");
+        const at = new Date(Date.now() + n * (short[2].toLowerCase() === "h" ? 3_600_000 : 60_000));
+        return { expires_at: at.toISOString().replace(/\.\d{3}Z$/, "Z") };
+    }
+    const unit = /^(\d+)\s*([dwy])$/i.exec(v);
+    if (unit) {
+        const n = Number(unit[1]);
+        const perUnit = { d: 1, w: 7, y: 365 };
+        return { expires_in_days: n * (perUnit[unit[2].toLowerCase()] ?? 1) };
+    }
+    if (/^\d{4}-\d{2}-\d{2}$/.test(v) || /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/.test(v))
+        return { expires_at: v };
+    throw usageError(`--expires ${JSON.stringify(v)} is not a lifetime`, "Use 1h, 90m, 30d, 12w, 1y, a date like 2027-01-31, a UTC time like 2027-01-31T12:00:00Z, or never (the default: the key does not expire).");
+}
+export function expiryLine(expiresAt) {
+    return expiresAt
+        ? `  expires: ${expiresAt} (the owners are mailed 14 and 3 days before)`
+        : "  expires: never. For a key that should stop on its own, create it with --expires 90d (or 30d, 1y, a date).";
+}
+export const LOGIN_WAIT_MS = 5 * 60_000;
+export const SIGNUP_WAIT_MS = 15 * 60_000;
+const b64url = (b) => b.toString("base64url");
+export function pkcePair() {
+    const verifier = b64url(randomBytes(32));
+    return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()) };
+}
+export function noncePair() {
+    const raw = b64url(randomBytes(32));
+    return { raw, hashed: b64url(createHash("sha256").update(raw).digest()) };
+}
+function anonClient(ctx, apiUrl) {
+    return new PromigenceClient({ ...clientOpts(ctx), ...(apiUrl === undefined ? {} : { apiUrl }), onNotice: recordNotice });
+}
+export function isLoopbackHost(hostname) {
+    return hostname === "localhost" || hostname === "[::1]" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname);
+}
+export function isSecureUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    return u.protocol === "https:" || (u.protocol === "http:" && isLoopbackHost(u.hostname));
+}
+export const OFFICIAL_SIGN_IN_HOSTS = ["auth.promigence.ai"];
+export function isOfficialSignInHost(host) {
+    return OFFICIAL_SIGN_IN_HOSTS.includes(host.toLowerCase());
+}
+export const OFFICIAL_CONSOLE_HOSTS = ["console.promigence.ai"];
+export function checkAuthConfig(cfg, apiUrl) {
+    const official = sameUrl(undefined, apiUrl);
+    for (const [label, raw] of [["authorize_url", cfg.authorize_url], ["token_url", cfg.token_url]]) {
+        let host;
+        try {
+            host = new URL(String(raw)).host;
+        }
+        catch {
+            host = "";
+        }
+        if (!host || !isSecureUrl(String(raw))) {
+            throw new AuthError(`the API at ${apiUrl} named a sign-in page that is not https: ${label} ${JSON.stringify(raw)}`, "Not signing in through it. Check PROMIGENCE_API_URL / --api-url, or report it with promigence --version.");
+        }
+        if (official && !isOfficialSignInHost(host)) {
+            throw new AuthError(`the API at ${apiUrl} named a sign-in page on ${host}, which is not the Promigence sign-in domain (${label})`, "Not signing in through it: something between you and the API changed its answer. Check your network or proxy, then run `promigence login` again.");
+        }
+    }
+    if (cfg.console_authorize_url !== undefined && cfg.console_authorize_url !== null) {
+        const raw = String(cfg.console_authorize_url);
+        let host;
+        try {
+            host = new URL(raw).host;
+        }
+        catch {
+            host = "";
+        }
+        if (!host || !isSecureUrl(raw)) {
+            throw new AuthError(`the API at ${apiUrl} named an authorize page that is not https: ${JSON.stringify(raw)}`, "Not signing in through it. Check PROMIGENCE_API_URL / --api-url, or report it with promigence --version.");
+        }
+        if (official && !OFFICIAL_CONSOLE_HOSTS.includes(host.toLowerCase())) {
+            throw new AuthError(`the API at ${apiUrl} named an authorize page on ${host}, which is not the Promigence console`, "Not signing in through it: something between you and the API changed its answer. Check your network or proxy, then run `promigence login` again.");
+        }
+    }
+}
+export function tlsChecksOff(env = process.env) {
+    const v = env["NODE_TLS_REJECT_UNAUTHORIZED"];
+    return v !== undefined && /^\s*(0|false)\s*$/i.test(v);
+}
+export function refuseWithoutTlsChecks(what, env = process.env) {
+    if (!tlsChecksOff(env))
+        return;
+    throw usageError(`refusing to ${what}: TLS certificate checks are off in this shell (NODE_TLS_REJECT_UNAUTHORIZED=${env["NODE_TLS_REJECT_UNAUTHORIZED"]})`, "Unset it (unset NODE_TLS_REJECT_UNAUTHORIZED) and run the command again. Behind a TLS-inspecting proxy, trust its CA instead: NODE_EXTRA_CA_CERTS=/path/to/ca.pem.");
+}
+function apiUrlSource() {
+    if (process.env["PROMIGENCE_API_URL"])
+        return "PROMIGENCE_API_URL";
+    if (readCredentials().api_url)
+        return `the api_url in ${credentialsPath()}`;
+    return "the stored sign-in";
+}
+async function ask(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await new Promise((resolve) => rl.question(prompt, resolve));
+    }
+    finally {
+        rl.close();
+    }
+}
+async function confirmApiUrl(ctx, apiUrl, fromFlag) {
+    if (!isSecureUrl(apiUrl)) {
+        throw usageError(`refusing to sign in over ${apiUrl}: not https`, "The ID token and the new key would cross the network in the clear. Use the https URL (http is accepted only for localhost).");
+    }
+    await write(process.stderr, `Signing in to ${apiUrl}\n`);
+    if (sameUrl(undefined, apiUrl) || fromFlag || bool(ctx, "--yes"))
+        return;
+    const src = apiUrlSource();
+    if (process.stdin.isTTY && process.stderr.isTTY) {
+        const answer = await ask(`${apiUrl} (set by ${src}) is not the Promigence API (${DEFAULT_API_URL}). `
+            + "Sign in there and store its key? [y/N] ");
+        if (/^\s*y(es)?\s*$/i.test(answer))
+            return;
+        throw usageError(`not signing in to ${apiUrl}`, `To sign in to the Promigence API instead: ${sh `promigence login --api-url ${DEFAULT_API_URL}`}. If you trust ${apiUrl}: ${sh `promigence login --api-url ${apiUrl}`}.`);
+    }
+    throw usageError(`${apiUrl} (set by ${src}) is not the Promigence API; not signing in to it without confirmation`, `If you trust it, pass it explicitly: ${sh `promigence login --api-url ${apiUrl}`} (or --yes). To sign in to the Promigence API instead: ${sh `promigence login --api-url ${DEFAULT_API_URL}`}.`);
+}
+async function authConfig(c) {
+    try {
+        return await c.request({ method: "GET", path: "/auth/config", anonymous: true });
+    }
+    catch (e) {
+        if (e instanceof PromigenceError && e.code === "not_found") {
+            throw new AuthError(`self-serve login is not enabled on ${c.apiUrl}`, "Use a key issued by the operator: promigence auth login --from-env PROMIGENCE_API_KEY.");
+        }
+        throw e;
+    }
+}
+export function headless() {
+    if (process.env["SSH_CONNECTION"] || process.env["SSH_TTY"])
+        return true;
+    if (process.platform === "linux" && !process.env["DISPLAY"] && !process.env["WAYLAND_DISPLAY"])
+        return true;
+    return false;
+}
+function system32Exe(name, env) {
+    const root = env["SystemRoot"] ?? env["SYSTEMROOT"];
+    return win32.join(root && /^[A-Za-z]:[\\/]/.test(root) ? root : "C:\\Windows", "System32", name);
+}
+export function browserCommand(url, platform = process.platform, env = process.env) {
+    let href;
+    try {
+        href = new URL(url).href;
+    }
+    catch {
+        return undefined;
+    }
+    if (!isSecureUrl(href))
+        return undefined;
+    if (platform === "darwin")
+        return ["open", [href]];
+    if (platform === "win32")
+        return [system32Exe("rundll32.exe", env), ["url.dll,FileProtocolHandler", href]];
+    return ["xdg-open", [href]];
+}
+const OPENER_ENV_DROP = new Set(["PROMIGENCE_API_KEY", "PROMIGENCE_ID_TOKEN", "PROMIGENCE_LOGIN_NONCE", "E2B_API_KEY"]);
+const OPENER_ENV_DROP_PATTERN = /^PROMIGENCE_\w*(KEY|TOKEN|NONCE|SECRET)\w*$/;
+export function openerEnv(env = process.env) {
+    return Object.fromEntries(Object.entries(env).filter(([k]) => {
+        const up = k.toUpperCase();
+        return !OPENER_ENV_DROP.has(up) && !OPENER_ENV_DROP_PATTERN.test(up);
+    }));
+}
+export function openBrowser(url) {
+    if (process.env["PROMIGENCE_LOGIN_BROWSER"] === "print")
+        return false;
+    const command = browserCommand(url);
+    if (!command)
+        return false;
+    const [cmd, args] = command;
+    try {
+        const child = spawn(cmd, args, { stdio: "ignore", detached: true, shell: false, windowsHide: true, env: openerEnv() });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function bindOn(server, port, host) {
+    return new Promise((resolve) => {
+        server.once("error", (e) => resolve(e.code ?? "error"));
+        server.listen(port, host, () => resolve(undefined));
+    });
+}
+export function isUsableLoopbackUri(raw) {
+    if (typeof raw !== "string")
+        return false;
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const port = Number(u.port);
+    return u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname)
+        && Number.isInteger(port) && port >= 1024 && port <= 65535 && u.pathname.length > 1;
+}
+function loopbackUris(cfg) {
+    const all = Array.isArray(cfg.loopback_redirect_uris) ? cfg.loopback_redirect_uris : [];
+    return {
+        usable: all.filter(isUsableLoopbackUri),
+        skipped: all.filter((u) => !isUsableLoopbackUri(u)).map((u) => JSON.stringify(u)),
+    };
+}
+const LOOP_CSS = "html{background:#09090b;color:#ededf0;font:16px/1.6 ui-sans-serif,system-ui,-apple-system,Segoe UI,sans-serif}"
+    + "body{min-height:100vh;margin:0;display:flex;align-items:center;justify-content:center;padding:24px}"
+    + "main{max-width:460px;border:1px solid #2a2a30;background:#111113;padding:32px 34px}"
+    + "b{display:block;color:#39ff14;font-size:12px;letter-spacing:.14em;text-transform:uppercase;margin-bottom:14px}"
+    + "h1{font-size:24px;margin:0 0 10px;letter-spacing:-.01em}p{margin:0;color:#a1a1aa}";
+const LOOP_CSP = `default-src 'none'; style-src 'sha256-${createHash("sha256").update(LOOP_CSS).digest("base64")}'`;
+export function loopbackPage(title, body) {
+    return `<!doctype html><html lang=en><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1">`
+        + `<title>${title}</title><style>${LOOP_CSS}</style><main><b>Promigence</b><h1>${title}</h1><p>${body}</p></main></html>`;
+}
+export function finishUrl(consoleOrigin, outcome) {
+    return consoleOrigin ? `${consoleOrigin}/cli/${outcome}` : undefined;
+}
+async function listenLoopback(uris, expectState, squatted, consoleOrigin) {
+    for (const uri of uris) {
+        const u = new URL(uri);
+        const hosts = new Set([`localhost:${u.port}`, `127.0.0.1:${u.port}`, `[::1]:${u.port}`]);
+        let settle;
+        let fail;
+        const result = new Promise((res, rej) => { settle = res; fail = rej; });
+        const server = createServer((req, res) => {
+            res.setHeader("content-type", "text/html; charset=utf-8");
+            res.setHeader("cache-control", "no-store");
+            res.setHeader("x-content-type-options", "nosniff");
+            res.setHeader("content-security-policy", LOOP_CSP);
+            res.setHeader("referrer-policy", "no-referrer");
+            if (!hosts.has((req.headers.host ?? "").toLowerCase())) {
+                res.writeHead(400).end();
+                return;
+            }
+            if (req.method !== "GET") {
+                res.writeHead(405, { allow: "GET" }).end();
+                return;
+            }
+            let got;
+            try {
+                got = new URL(req.url ?? "/", uri);
+            }
+            catch {
+                res.writeHead(400).end();
+                return;
+            }
+            if (got.pathname !== u.pathname) {
+                res.writeHead(404).end();
+                return;
+            }
+            const code = got.searchParams.get("code");
+            const state = got.searchParams.get("state") ?? "";
+            const error = got.searchParams.get("error");
+            const page = loopbackPage;
+            const finish = (outcome, status, title, body) => {
+                const to = finishUrl(consoleOrigin, outcome);
+                if (to)
+                    res.writeHead(303, { location: to }).end();
+                else
+                    res.writeHead(status).end(page(title, body));
+            };
+            if (state !== expectState) {
+                res.writeHead(400).end(page("Promigence login", "This login link is not the one the CLI started. Return to the terminal."));
+                return;
+            }
+            if (error || !code) {
+                finish(error === "access_denied" ? "cancelled" : "sign-in-failed", 400, "Sign-in did not finish", "Return to your terminal for the details.");
+                fail(new AuthError(`login was not completed: ${error ?? "no code"} ${got.searchParams.get("error_description") ?? ""}`.trim(), FAILED_SIGN_IN_FIX));
+                return;
+            }
+            finish("signed-in", 200, "You're signed in", "The Promigence CLI is signed in. You can close this tab and return to your terminal.");
+            settle({ code, state });
+        });
+        const v4err = await bindOn(server, Number(u.port), "127.0.0.1");
+        if (v4err) {
+            squatted.push(`127.0.0.1:${u.port} (${v4err})`);
+            continue;
+        }
+        const v6 = createServer((req, res) => server.emit("request", req, res));
+        const v6err = await bindOn(v6, Number(u.port), "::1");
+        if (v6err === "EADDRINUSE" || v6err === "EACCES") {
+            squatted.push(`[::1]:${u.port} (${v6err})`);
+            await new Promise((resolve) => server.close(() => resolve()));
+            continue;
+        }
+        const close = server.close.bind(server);
+        server.close = ((cb) => {
+            if (v6.listening)
+                v6.close();
+            return close(cb);
+        });
+        return { server, redirectUri: uri, result };
+    }
+    return undefined;
+}
+export const PASTE_MAX_BYTES = 64 * 1024;
+export const CODE_MAX_CHARS = 1024;
+const pasteTooLong = () => usageError(`the pasted text is longer than ${PASTE_MAX_BYTES / 1024} KiB; no login code is`, "Paste only the code shown on the page after signing in, then press Enter.");
+async function readPasted(prompt) {
+    if (process.stdin.isTTY) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        let seen = 0;
+        let count;
+        try {
+            return await new Promise((resolve, reject) => {
+                count = (chunk) => {
+                    seen += Buffer.byteLength(chunk);
+                    if (seen > PASTE_MAX_BYTES)
+                        reject(pasteTooLong());
+                };
+                process.stdin.on("data", count);
+                rl.on("SIGINT", () => reject(usageError("cancelled", "Run the command again when you are ready to sign in.")));
+                rl.question(prompt, resolve);
+            });
+        }
+        finally {
+            if (count)
+                process.stdin.off("data", count);
+            rl.close();
+        }
+    }
+    await write(process.stderr, prompt);
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        const b = Buffer.from(chunk);
+        size += b.length;
+        if (size > PASTE_MAX_BYTES)
+            throw pasteTooLong();
+        chunks.push(b);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function checkCode(code) {
+    if (code.length > CODE_MAX_CHARS || !/^[A-Za-z0-9._~-]+$/.test(code)) {
+        throw usageError("that does not look like a login code", "Paste only the code shown on the page.");
+    }
+    return code;
+}
+export const FAILED_SIGN_IN_FIX = "Run `promigence login` again. Signing in with GitHub? Your GitHub account needs a "
+    + "verified primary email address (https://github.com/settings/emails).";
+export function parsePasted(raw, expectState) {
+    const text = raw.trim();
+    if (!text)
+        throw usageError("no code was pasted", "Paste the code shown on the page after signing in, then press Enter.");
+    if (text.includes("code=")) {
+        let u;
+        try {
+            u = new URL(text.includes("://") ? text : `http://x/?${text.replace(/^.*\?/, "")}`);
+        }
+        catch {
+            throw usageError("the pasted URL could not be read", "Paste only the code shown on the page, or the whole address of that page.");
+        }
+        const state = u.searchParams.get("state");
+        if (state !== null && state !== expectState) {
+            throw new AuthError("the pasted URL belongs to a different login", "Run `promigence login` again and paste the code from that login.");
+        }
+        const code = u.searchParams.get("code");
+        if (code)
+            return checkCode(code);
+    }
+    return checkCode(text);
+}
+async function loopbackOrPaste(ctx, cfg, state) {
+    if (bool(ctx, "--no-browser") || headless())
+        return undefined;
+    const { usable, skipped } = loopbackUris(cfg);
+    const squatted = [];
+    const via = consoleAuthorizeUrl(cfg);
+    let origin;
+    try {
+        origin = via ? new URL(via).origin : undefined;
+    }
+    catch {
+        origin = undefined;
+    }
+    const loop = await listenLoopback(usable, state, squatted, origin);
+    if (loop)
+        return loop;
+    if (squatted.length) {
+        await write(process.stderr, `promigence ${ctx.cmd.name}: the login ports are held by another program (${squatted.join(", ")}); `
+            + "not sharing them. Using paste mode instead.\n");
+    }
+    else {
+        await write(process.stderr, `promigence ${ctx.cmd.name}: the API named no loopback redirect this CLI can listen on `
+            + `(${skipped.join(", ") || "none"}). Using paste mode instead.\n`);
+    }
+    return undefined;
+}
+function authorizeUrl(cfg, params) {
+    const u = new URL(cfg.authorize_url);
+    for (const [k, v] of Object.entries(params))
+        u.searchParams.set(k, v);
+    return u.href;
+}
+export function signInUrl(cfg, params, signup) {
+    const u = new URL(authorizeUrl(cfg, params));
+    if (signup && !params["identity_provider"] && u.pathname === "/oauth2/authorize")
+        u.pathname = "/signup";
+    return u.href;
+}
+export function shownUrl(url) {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+}
+export function waitExpiredError(command, ms) {
+    if (command === "signup") {
+        return new AuthError(`no browser sign-up within ${Math.round(ms / 60_000)} min`, "Your account may already be created (for example if the email code arrived late). Run `promigence login` next; "
+            + "run `promigence signup` again only if login says there is no account.");
+    }
+    return new AuthError(`no browser login within ${Math.round(ms / 1000)}s`, `Run \`promigence ${command}\` again, or \`promigence ${command} --no-browser\` to paste the code.`);
+}
+function withTimeout(p, ms, command = "login") {
+    let t;
+    return Promise.race([
+        p.finally(() => clearTimeout(t)),
+        new Promise((_, rej) => {
+            t = setTimeout(() => rej(waitExpiredError(command, ms)), ms);
+        }),
+    ]);
+}
+export function browserWaitMs(isSignup, inviteExpiresInS) {
+    if (inviteExpiresInS !== undefined)
+        return inviteWaitMs(inviteExpiresInS);
+    return isSignup ? SIGNUP_WAIT_MS : LOGIN_WAIT_MS;
+}
+export function inviteWaitMs(expiresInS) {
+    return Math.max(LOGIN_WAIT_MS, expiresInS * 1000 - INVITE_HOLD_MARGIN_MS);
+}
+const INVITE_HOLD_MARGIN_MS = 30_000;
+export function inviteHold(release, onSignal = (sig) => {
+    process.exit(sig === "SIGINT" ? 130 : 143);
+}) {
+    let done = false;
+    const giveBack = async () => {
+        if (done)
+            return;
+        done = true;
+        let t;
+        await Promise.race([
+            release().catch(() => undefined),
+            new Promise((resolve) => { t = setTimeout(resolve, 5_000); }),
+        ]);
+        if (t)
+            clearTimeout(t);
+    };
+    const handler = (sig) => { void giveBack().finally(() => onSignal(sig)); };
+    process.once("SIGINT", handler);
+    process.once("SIGTERM", handler);
+    return {
+        release: giveBack,
+        dispose: () => {
+            done = true;
+            process.off("SIGINT", handler);
+            process.off("SIGTERM", handler);
+        },
+    };
+}
+async function exchangeCode(cfg, code, redirectUri, verifier) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code", client_id: cfg.client_id, code, redirect_uri: redirectUri, code_verifier: verifier,
+    });
+    let res;
+    try {
+        res = await fetch(cfg.token_url, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body,
+            redirect: "error",
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch (e) {
+        const err = e;
+        if (/redirect/i.test(`${err.cause?.message ?? ""} ${err.message ?? ""}`)) {
+            throw new AuthError(`the login service ${cfg.token_url} answered the code exchange with a redirect; not following it`, "Nothing was sent on. Check your network or proxy, then run `promigence login` again.");
+        }
+        throw new UnreachableError(`cannot reach the login service ${cfg.token_url}: ${err.message}`);
+    }
+    const text = await res.text();
+    let j = {};
+    try {
+        j = JSON.parse(text);
+    }
+    catch { }
+    if (!res.ok || typeof j["id_token"] !== "string") {
+        throw new AuthError(`the login service refused the code: ${String(j["error"] ?? `HTTP ${res.status}`)}`, "Codes are single-use and expire in minutes. Run `promigence login` again.");
+    }
+    return j["id_token"];
+}
+export function writeCredentials(apiKey, apiUrl, keyId) {
+    const body = {};
+    if (apiKey)
+        body["api_key"] = apiKey;
+    if (apiUrl && apiUrl.replace(/\/+$/, "") !== DEFAULT_API_URL.replace(/\/+$/, ""))
+        body["api_url"] = apiUrl;
+    if (apiKey && keyId) {
+        body["key_id"] = keyId;
+        body["minted_by"] = MINTED_BY;
+    }
+    return storeCredentials(Object.keys(body).length ? body : undefined);
+}
+const sameUrl = (a, b) => (a ?? DEFAULT_API_URL).replace(/\/+$/, "") === b.replace(/\/+$/, "");
+export function consoleAuthorizeUrl(cfg, env = process.env) {
+    const flow = (env["PROMIGENCE_LOGIN_FLOW"] ?? "").trim().toLowerCase();
+    if (flow === "direct" || flow === "legacy")
+        return undefined;
+    if (typeof cfg.console_authorize_url !== "string" || !cfg.console_authorize_url)
+        return undefined;
+    return cfg.console_authorize_url;
+}
+export function deviceName() {
+    return hostname().replace(/[^\x20-\x7e]/g, "").slice(0, 64);
+}
+export function consoleUrl(base, params) {
+    const u = new URL(base);
+    for (const [k, v] of Object.entries(params))
+        u.searchParams.set(k, v);
+    return u.href;
+}
+async function consoleSignIn(ctx, cfg, base, apiUrl, opts) {
+    const { verifier, challenge } = pkcePair();
+    const state = b64url(randomBytes(16));
+    const loop = await loopbackOrPaste(ctx, cfg, state);
+    const port = loop ? new URL(loop.redirectUri).port : undefined;
+    let url;
+    try {
+        const created = await new PromigenceClient({ apiUrl }).request({
+            method: "POST", path: "/auth/cli/requests", anonymous: true,
+            body: {
+                code_challenge: challenge, code_challenge_method: "S256", state,
+                ...(port ? { port: Number(port) } : {}),
+                device: deviceName(), key_name: opts.keyName,
+                ...(opts.provider ? { provider: opts.provider } : {}),
+                ...(opts.ref ? { ref: opts.ref } : {}),
+            },
+        });
+        url = created.authorize_url;
+    }
+    catch (e) {
+        loop?.server.close();
+        throw e;
+    }
+    if (typeof url !== "string" || !url.startsWith(`${base}?request=`)) {
+        loop?.server.close();
+        throw new PromigenceError({ code: "internal", message: `the API answered an authorize page that is not its console's (${String(url).slice(0, 80)})`,
+            fix: "Run `promigence login` again; if it repeats, report it with promigence --version.", exitCode: 1 });
+    }
+    const verb = "sign in (or create your account) and authorize this CLI";
+    let code;
+    try {
+        if (loop) {
+            const opened = openBrowser(url);
+            await write(process.stderr, opened
+                ? `Opening your browser to ${verb} (${shownUrl(url)}).\nWaiting for the browser (${Math.floor(opts.waitMs / 60_000)} min)…\n`
+                : `Open this URL to ${verb}:\n  ${url}\nWaiting for the browser (${Math.floor(opts.waitMs / 60_000)} min)…\n`);
+            code = (await withTimeout(loop.result, opts.waitMs, ctx.cmd.name)).code;
+        }
+        else {
+            await write(process.stderr, `Open this URL in any browser and ${verb}:\n  ${url}\n`);
+            code = parsePasted(await readPasted("Paste the code shown after you authorize: "), state);
+        }
+    }
+    finally {
+        loop?.server.close();
+    }
+    const viaDevice = deviceFetch(deviceHeader());
+    return new PromigenceClient({ apiUrl, ...(viaDevice ? { fetch: viaDevice } : {}) }).request({
+        method: "POST", path: "/auth/cli/token", anonymous: true,
+        body: { code, code_verifier: verifier, ...(port ? { redirect_uri: `http://127.0.0.1:${port}/callback` } : {}) },
+    });
+}
+function refuseRetiredPaste(cfg, command) {
+    if (typeof cfg.console_authorize_url !== "string" || !cfg.console_authorize_url)
+        return;
+    throw usageError(`${command} cannot paste a sign-in code here: with no browser on this machine, sign-in codes come from the Promigence console`, command === "promigence login" || command === "promigence signup"
+        ? "Run it without PROMIGENCE_LOGIN_FLOW=direct: `promigence login --no-browser` prints the console's page to open on any device."
+        : "Run it on a machine with a browser, or set PROMIGENCE_ID_TOKEN to an ID token you already hold.");
+}
+async function directSignIn(ctx, cfg, apiUrl, p) {
+    const { state, verifier, challenge, nonce, idp, isSignup, keyName, ref, waitMs } = p;
+    const loop = await loopbackOrPaste(ctx, cfg, state);
+    if (!loop)
+        refuseRetiredPaste(cfg, ctx.cmd.name);
+    const redirectUri = loop ? loop.redirectUri : cfg.paste_redirect_uri;
+    const url = signInUrl(cfg, {
+        response_type: "code", client_id: cfg.client_id, redirect_uri: redirectUri,
+        scope: cfg.scopes.join(" "), state, nonce: nonce.hashed, code_challenge: challenge, code_challenge_method: "S256",
+        ...(idp ? { identity_provider: idp } : {}),
+    }, isSignup);
+    const verb = url.includes("/signup?") ? "create your account" : "sign in";
+    const inboxHint = isSignup ? "Check your inbox (and spam) for the verification code.\n" : "";
+    let code;
+    try {
+        if (loop) {
+            const opened = openBrowser(url);
+            await write(process.stderr, opened
+                ? `Opening your browser to ${verb} (${shownUrl(url)}).\n${inboxHint}Waiting for the browser (${Math.floor(waitMs / 60_000)} min)…\n`
+                : `Open this URL to ${verb}:\n  ${url}\n${inboxHint}Waiting for the browser (${Math.floor(waitMs / 60_000)} min)…\n`);
+            code = (await withTimeout(loop.result, waitMs, ctx.cmd.name)).code;
+        }
+        else {
+            await write(process.stderr, `Open this URL in any browser and ${verb}:\n  ${url}\n${inboxHint}`);
+            code = parsePasted(await readPasted("Paste the code shown after signing in: "), state);
+        }
+    }
+    finally {
+        loop?.server.close();
+    }
+    const idToken = await exchangeCode(cfg, code, redirectUri, verifier);
+    const viaDevice = deviceFetch(deviceHeader());
+    return new PromigenceClient({ apiKey: idToken, apiUrl, ...(viaDevice ? { fetch: viaDevice } : {}) }).request({
+        method: "POST", path: "/auth/session",
+        body: { mint_key: true, key_name: keyName, nonce: nonce.raw, ...(ref ? { ref } : {}) },
+    });
+}
+export async function signIn(ctx) {
+    refuseWithoutTlsChecks("sign in");
+    const anon = anonClient(ctx);
+    const preset = process.env["PROMIGENCE_ID_TOKEN"];
+    if (preset) {
+        if (!isSecureUrl(anon.apiUrl)) {
+            throw usageError(`refusing to send a sign-in token to ${anon.apiUrl}: not https`, "The token would cross the network in the clear. Use the https URL (http is accepted only for localhost).");
+        }
+        return { idToken: preset, ...(process.env["PROMIGENCE_LOGIN_NONCE"] ? { nonce: process.env["PROMIGENCE_LOGIN_NONCE"] } : {}), apiUrl: anon.apiUrl };
+    }
+    await confirmApiUrl(ctx, anon.apiUrl, false);
+    const cfg = await authConfig(anon);
+    checkAuthConfig(cfg, anon.apiUrl);
+    const { verifier, challenge } = pkcePair();
+    const nonce = noncePair();
+    const state = b64url(randomBytes(16));
+    const loop = await loopbackOrPaste(ctx, cfg, state);
+    if (!loop)
+        refuseRetiredPaste(cfg, ctx.cmd.name);
+    const redirectUri = loop ? loop.redirectUri : cfg.paste_redirect_uri;
+    const url = authorizeUrl(cfg, {
+        response_type: "code", client_id: cfg.client_id, redirect_uri: redirectUri,
+        scope: cfg.scopes.join(" "), state, nonce: nonce.hashed, code_challenge: challenge, code_challenge_method: "S256",
+    });
+    let code;
+    try {
+        if (loop) {
+            const opened = openBrowser(url);
+            await write(process.stderr, `${ctx.cmd.name} acts as you: ${opened ? "opening your browser to sign in" : "open this URL to sign in"}:\n  ${url}\nWaiting for the browser (${LOGIN_WAIT_MS / 60_000} min)…\n`);
+            code = (await withTimeout(loop.result, LOGIN_WAIT_MS)).code;
+        }
+        else {
+            await write(process.stderr, `${ctx.cmd.name} acts as you. Open this URL in any browser and sign in:\n  ${url}\n`);
+            code = parsePasted(await readPasted("Paste the code shown after signing in: "), state);
+        }
+    }
+    finally {
+        loop?.server.close();
+    }
+    return { idToken: await exchangeCode(cfg, code, redirectUri, verifier), nonce: nonce.raw, apiUrl: anon.apiUrl };
+}
+async function inviteCode(ctx) {
+    const flag = str(ctx, "--invite");
+    if (flag !== undefined) {
+        await write(process.stderr, "promigence signup: warning: --invite is visible to other users of this machine (ps) and "
+            + "stays in your shell history; next time, enter it when asked or set PROMIGENCE_INVITE_CODE\n");
+        return flag;
+    }
+    const env = process.env["PROMIGENCE_INVITE_CODE"];
+    if (env)
+        return env;
+    if (!process.stdin.isTTY) {
+        throw usageError("this API needs an invite code for new accounts, and there is no terminal to ask for it", "Set PROMIGENCE_INVITE_CODE, or run `promigence signup` in a terminal and enter the code when asked.");
+    }
+    const code = await readHidden("Invite code: ");
+    if (!code.trim())
+        throw usageError("no invite code entered", "Run `promigence signup` again and enter the code you were given.");
+    return code;
+}
+export function readHidden(prompt) {
+    const stdin = process.stdin;
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        const done = (err) => {
+            stdin.removeListener("data", onData);
+            if (stdin.isTTY)
+                stdin.setRawMode(false);
+            stdin.pause();
+            process.stderr.write("\n");
+            if (err)
+                reject(err);
+            else
+                resolve(buf);
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk.toString("utf8")) {
+                if (ch === "\r" || ch === "\n" || ch === "\u0004")
+                    return done();
+                if (ch === "\u0003")
+                    return done(usageError("cancelled", "Run `promigence signup` again when you have the code."));
+                if (ch === "\u007f" || ch === "\b") {
+                    buf = buf.slice(0, -1);
+                    continue;
+                }
+                if (buf.length < 256 && ch >= " ")
+                    buf += ch;
+            }
+        };
+        process.stderr.write(prompt);
+        if (stdin.isTTY)
+            stdin.setRawMode(true);
+        stdin.resume();
+        stdin.on("data", onData);
+    });
+}
+const login = (ctx) => signInAndStore(ctx, false);
+const signup = (ctx) => signInAndStore(ctx, true);
+async function signInAndStore(ctx, isSignup) {
+    refuseWithoutTlsChecks("sign in");
+    const provider = str(ctx, "--provider");
+    const flagUrl = str(ctx, "--api-url");
+    if (flagUrl !== undefined && !/^https?:\/\/[^/]/i.test(flagUrl)) {
+        throw usageError(`--api-url: '${flagUrl}' is not an http(s) URL`, `Pass the API's base URL, e.g. --api-url ${DEFAULT_API_URL}.`);
+    }
+    const anon = anonClient(ctx, flagUrl);
+    await confirmApiUrl(ctx, anon.apiUrl, flagUrl !== undefined);
+    const cfg = await authConfig(anon);
+    checkAuthConfig(cfg, anon.apiUrl);
+    let idp;
+    if (provider !== undefined) {
+        idp = cfg.identity_providers[provider];
+        if (!idp) {
+            throw usageError(`--provider: '${provider}' is not a login method`, `Pass --provider ${Object.keys(cfg.identity_providers).join(" | ")}, or omit it to choose in the browser.`);
+        }
+        if (provider === "email")
+            idp = undefined;
+    }
+    const keyName = (str(ctx, "--key-name") ?? `cli@${deviceName()}`).slice(0, 64);
+    const ref = str(ctx, "--ref")?.trim();
+    if (ref !== undefined && (ref === "" || ref.length > 64)) {
+        throw usageError("--ref: a referral code is 1-64 characters", "Pass the code as you were given it, e.g. --ref K7QM2XPD.");
+    }
+    checkCredentialsPath(credentialsPath());
+    const viaConsole = consoleAuthorizeUrl(cfg);
+    if (viaConsole && isSignup && (str(ctx, "--invite") !== undefined || process.env["PROMIGENCE_INVITE_CODE"])) {
+        await write(process.stderr, "promigence signup: enter your invite code in the browser when it asks; it is not sent from here\n");
+    }
+    const { verifier, challenge } = pkcePair();
+    const nonce = noncePair();
+    const state = b64url(randomBytes(16));
+    let waitMs = browserWaitMs(isSignup);
+    let hold;
+    if (isSignup && cfg.invite_mode && !viaConsole) {
+        const code = await inviteCode(ctx);
+        const r = await anon.request({
+            method: "POST", path: "/auth/invite", anonymous: true, body: { code, nonce: nonce.raw },
+        });
+        if (r.invite_mode) {
+            waitMs = browserWaitMs(true, r.expires_in_s);
+            hold = inviteHold(() => anon.request({
+                method: "POST", path: "/auth/invite/release", anonymous: true, body: { nonce: nonce.raw },
+            }));
+            await write(process.stderr, `Invite code accepted; finish signing in within ${Math.floor(waitMs / 60_000)} minutes.\n`);
+        }
+    }
+    let session;
+    try {
+        session = viaConsole
+            ? await consoleSignIn(ctx, cfg, viaConsole, anon.apiUrl, {
+                isSignup, ...(provider !== undefined ? { provider } : {}), keyName, waitMs, ...(ref ? { ref } : {}),
+            })
+            : await directSignIn(ctx, cfg, anon.apiUrl, {
+                state, verifier, challenge, nonce, ...(idp ? { idp } : {}), isSignup, keyName,
+                ...(ref ? { ref } : {}), waitMs,
+            });
+    }
+    catch (e) {
+        await hold?.release();
+        throw e;
+    }
+    finally {
+        hold?.dispose();
+    }
+    if (!session.api_key) {
+        throw new PromigenceError({ code: "internal", message: "the API created no key for this login",
+            fix: "Run `promigence login` again; if it repeats, report it with promigence --version.", exitCode: 1 });
+    }
+    const existing = readCredentials();
+    const previous = loginMintedKey();
+    const stored = writeCredentials(session.api_key, anon.apiUrl, session.key?.key_id);
+    const path = stored.path;
+    const warnings = [...stored.warnings];
+    let revoked;
+    if (previous && previous.apiKey !== session.api_key && previous.keyId !== session.key?.key_id) {
+        if (sameUrl(previous.apiUrl, anon.apiUrl)) {
+            const r = await revokeReplacedKey(previous, "this login replaced", session.api_key);
+            revoked = r.revoked;
+            if (r.warning)
+                warnings.push(r.warning);
+        }
+        else {
+            const was = (previous.apiUrl ?? DEFAULT_API_URL).replace(/\/+$/, "");
+            warnings.push(`the key the previous login minted (${previous.keyId}) belongs to ${was}, not ${anon.apiUrl}, so it was `
+                + `not revoked and still works; revoke it with \`${sh `promigence keys revoke ${previous.keyId}`}\` from a login to ${was}`);
+        }
+    }
+    const consoleHome = viaConsole ? `${new URL(viaConsole).origin}/home` : undefined;
+    const credit = await offerAfterLogin(ctx, anon.apiUrl, session.api_key, consoleHome);
+    const location = await anon.health({ timeoutMs: 3000 }).then((h) => (typeof h.location === "string" && h.location ? h.location : undefined)).catch(() => undefined);
+    const next = nexts(["promigence me", "your org, limits and spend"], ["promigence examples", "what you can fork with no build (the built-in base)"]);
+    const fields = {
+        credentials: path, store: stored.store, mode: stored.store === "file" ? "0600" : null, created: session.created,
+        user: session.user, org: session.org, key: session.key, replaced: Boolean(existing.api_key),
+        revoked_key_id: revoked ?? null,
+    };
+    if (stored.note)
+        fields["store_note"] = stored.note;
+    if (session.referral)
+        fields["referral"] = session.referral;
+    fields["credit_offer"] = credit.field;
+    if (location)
+        fields["location"] = location;
+    if (warnings.length)
+        fields["warnings"] = warnings;
+    const rf = session.referral;
+    const referralLine = !rf ? [] : rf.status === "not_applied"
+        ? [`  referral: ${rf.code} not applied (${rf.detail ?? "not eligible"})`]
+        : rf.status === "under_review"
+            ? [`  referral: ${rf.code} recorded; it is being checked before any credit is granted`]
+            : [`  referral: ${rf.code} applied: $${rf.reward_usd} of compute credit with your first paid plan invoice`];
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, fields, next), [
+        `promigence login: ${session.created ? "account created" : "signed in"} as ${session.user.email} (${session.user.provider})`,
+        `  org: ${session.org.name} (${session.org.org_id})`,
+        ...(location ? [`  Your sandboxes run on our servers on the ${location}.`] : []),
+        `  key: ${session.key?.prefix ?? ""}… "${session.key?.name ?? keyName}" stored in ${storedWhere(stored)}`,
+        ...(session.key?.expires_at ? [`  key expires: ${session.key.expires_at.slice(0, 10)} (sign in again before then; \`promigence keys list\` shows it)`] : []),
+        ...(stored.note ? [`  note: ${stored.note}`] : []),
+        ...referralLine,
+        ...(revoked ? [`  replaced key ${revoked} revoked`] : []),
+        ...warnings.map((w) => `  warning: ${w}`),
+        ...credit.lines,
+        `  next: ${next[0].cmd}`,
+    ], 0, ctx.pointer);
+}
+;
+const logout = async (ctx) => {
+    const { creds, store: heldIn, unavailable } = readCredentialsWithStore();
+    const path = credentialsPath();
+    if (unavailable) {
+        throw usageError(`${storeLabel(unavailable.store)} could not be read (${unavailable.reason}), so the sign-in stored in it was neither revoked nor removed`, unavailable.store === "macos-keychain"
+            ? "Unlock it (security unlock-keychain, or sign in at the Mac itself) and run `promigence logout` again."
+            : "Unlock the keyring (sign in to the desktop session) and run `promigence logout` again.");
+    }
+    const minted = loginMintedKey();
+    const warnings = [];
+    let revoked;
+    if (creds.api_key && !bool(ctx, "--keep-key") && !(minted && minted.apiKey === creds.api_key)) {
+        warnings.push("the key was not minted by `promigence login` (it was stored with `promigence auth login`), so it was only "
+            + "forgotten here and still works; revoke it with `promigence keys revoke <key_id>` if nothing else uses it");
+    }
+    else if (minted && creds.api_key && !bool(ctx, "--keep-key")) {
+        try {
+            const c = new PromigenceClient({ apiKey: minted.apiKey, apiUrl: minted.apiUrl ?? DEFAULT_API_URL, onNotice: recordNotice });
+            const list = await c.request({ method: "GET", path: "/keys" });
+            const current = list.keys.find((k) => k.current);
+            if (current) {
+                await c.request({ method: "DELETE", path: `/keys/${encodeURIComponent(current.key_id)}?reason=logout` });
+                revoked = current.key_id;
+            }
+        }
+        catch (e) {
+            const err = e;
+            warnings.push(`the key ${minted.keyId} was not revoked at ${(minted.apiUrl ?? DEFAULT_API_URL).replace(/\/+$/, "")} `
+                + `(${err.code ?? "error"}: ${err.message}); revoke it with \`${sh `promigence keys revoke ${minted.keyId}`}\` from another login to that API`);
+        }
+    }
+    const cleared = writeCredentials(undefined, creds.api_url);
+    forgetKeychainReads();
+    const after = readCredentialsWithStore();
+    if (after.creds.api_key || cleared.left.length > 0) {
+        const where = after.creds.api_key
+            ? (after.store === "file" || after.store === undefined ? path : storeLabel(after.store))
+            : storeLabel(cleared.left[0]);
+        throw usageError(`the sign-in stored in ${where} could not be removed, so this machine may still be signed in`
+            + (revoked ? ` (the key itself was revoked: ${revoked})` : ""), cleared.warnings[0] ?? `Remove it by hand, then run \`promigence logout\` again.`);
+    }
+    warnings.push(...cleared.warnings);
+    if (process.env["PROMIGENCE_API_KEY"]) {
+        warnings.push("PROMIGENCE_API_KEY is set in this environment, so commands are still signed in with it; unset it to sign out here");
+    }
+    const next = nexts(["promigence login", "sign in again"]);
+    const fields = {
+        credentials: path, store: heldIn ?? null, had_key: Boolean(creds.api_key), revoked_key_id: revoked ?? null,
+    };
+    if (warnings.length)
+        fields["warnings"] = warnings;
+    const from = heldIn === undefined || heldIn === "file" ? path : storeLabel(heldIn);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, fields, next), [
+        creds.api_key
+            ? `promigence logout: key removed from ${from}${revoked ? ` and revoked (${revoked})` : ""}`
+            : `promigence logout: no key in ${from}; nothing to do`,
+        ...warnings.map((w) => `  warning: ${w}`),
+    ], 0, ctx.pointer);
+};
+function keyClient(ctx) {
+    return new PromigenceClient({ ...clientOpts(ctx), onNotice: recordNotice });
+}
+function keyLine(k) {
+    const flags = [k.access && k.access !== "full" ? `${k.access} only` : "", k.current ? "current" : "", k.revoked_at ? `revoked ${k.revoked_at}` : "", k.minted_by ? `minted by ${k.minted_by}` : ""].filter(Boolean).join(", ");
+    return `  ${k.key_id}  ${k.prefix}…  ${JSON.stringify(k.name)}  created ${k.created_at}  last used ${k.last_used_at ?? "never"}  expires ${k.expires_at ?? "never"}${flags ? `  [${flags}]` : ""}`;
+}
+const keysList = async (ctx) => {
+    const all = bool(ctx, "--all");
+    const path = all ? "/keys?all=1" : "/keys";
+    const project = projectFlag(ctx);
+    let r;
+    const warnings = [];
+    if (project) {
+        const pk = await projectKeyClient(ctx, project);
+        try {
+            r = await pk.c.request({ method: "GET", path });
+        }
+        finally {
+            const w = await pk.done();
+            if (w)
+                warnings.push(w);
+        }
+        r = { ...r, keys: r.keys.filter((k) => k.key_id !== pk.keyId) };
+    }
+    else {
+        r = await keyClient(ctx).request({ method: "GET", path });
+    }
+    const next = project
+        ? (r.keys.length ? nexts([`${sh `promigence keys revoke KEY_ID --project ${project}`}${orgFlagTail(ctx)}`, "revoke one of them, its id from this list in place of KEY_ID (then `project delete` can go ahead)"]) : [])
+        : nexts(["promigence keys create --name NAME", "mint another key (shown once)"]);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { org_id: r.org_id, ...(project ? { project } : {}), keys: r.keys, ...(warnings.length ? { warnings } : {}) }, next), [
+        `promigence keys list: ${r.keys.length} key${r.keys.length === 1 ? "" : "s"} in ${r.org_id}${project ? `, project ${project}` : ""}`,
+        ...r.keys.map(keyLine),
+        ...warnings.map((w) => `  warning: ${w}`),
+    ], 0, ctx.pointer);
+};
+function projectFlag(ctx) {
+    const project = str(ctx, "--project");
+    if (!project && str(ctx, "--org")) {
+        throw usageError("--org goes with --project", `Name the project too: promigence ${ctx.cmd.name} --project default --org ${shellArg(str(ctx, "--org"))}.`);
+    }
+    return project;
+}
+function orgFlagTail(ctx) {
+    const org = str(ctx, "--org");
+    return org ? ` --org ${shellArg(org)}` : "";
+}
+export function accessBody(ctx) {
+    const a = str(ctx, "--access");
+    if (a === undefined)
+        return {};
+    if (!["full", "run", "read"].includes(a)) {
+        throw usageError(`--access: '${a}' is not an access`, "Pass --access full | run | read (run: sandboxes only; read: lists and reports only).");
+    }
+    return { access: a };
+}
+export function accessNote(access) {
+    if (access === "run")
+        return " (run: sandboxes, runs, files; no secrets, deletes, billing or keys)";
+    if (access === "read")
+        return " (read: lists and reports only)";
+    return "";
+}
+const keysCreate = async (ctx) => {
+    if (str(ctx, "--org") || str(ctx, "--project") || bool(ctx, "--service"))
+        return keysCreateInOrg(ctx);
+    const name = str(ctx, "--name") ?? `cli@${hostname()}`;
+    const k = await keyClient(ctx).request({ method: "POST", path: "/keys", body: { name: name.slice(0, 64), ...expiryBody(ctx), ...accessBody(ctx) } });
+    const next = nexts(["promigence keys list", "confirm it is there"]);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { key: k }, next), [
+        `promigence keys create: ${k.key_id} "${k.name}"${accessNote(k.access)}`,
+        `  api_key: ${k.api_key}`,
+        "  This is the only time the secret is shown. Store it now (e.g. in your CI secret store).",
+        expiryLine(k.expires_at),
+    ], 0, ctx.pointer);
+};
+const keysRevoke = async (ctx) => {
+    const keyId = positional(ctx, "a key id", "promigence keys revoke key_0123abcd");
+    const path = `/keys/${encodeURIComponent(keyId)}`;
+    const project = projectFlag(ctx);
+    let k;
+    const warnings = [];
+    if (project) {
+        const pk = await projectKeyClient(ctx, project);
+        try {
+            k = await pk.c.request({ method: "DELETE", path });
+        }
+        finally {
+            const w = await pk.done();
+            if (w)
+                warnings.push(w);
+        }
+        k = { ...k, current: false };
+    }
+    else {
+        k = await keyClient(ctx).request({ method: "DELETE", path });
+    }
+    const next = nexts([project ? `promigence keys list --project ${shellArg(project)}${orgFlagTail(ctx)}` : "promigence keys list", "the keys that still work"]);
+    const lines = [`promigence keys revoke: ${k.key_id} (${k.prefix}…) revoked at ${k.revoked_at}`];
+    if (k.also_revoked?.length) {
+        lines.push(`  Also revoked, because this key had minted them: ${k.also_revoked.join(", ")}`);
+    }
+    if (k.current)
+        lines.push("  That was the key this CLI is using: run `promigence login` for a new one.");
+    lines.push(...warnings.map((w) => `  warning: ${w}`));
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { key: k, ...(warnings.length ? { warnings } : {}) }, next), lines, 0, ctx.pointer);
+};
+const billingCard = async (ctx) => {
+    const s = await keyClient(ctx).request({ method: "POST", path: "/billing/checkout", body: {} });
+    const next = nexts(["promigence me", "after checkout: card_on_file is true and your trial credits are still there"]);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { checkout: s }, next), [
+        "promigence billing card: open this page to add a card (nothing is charged now):",
+        `  ${s.url}`,
+        "  Remaining trial credits are used first; usage beyond them is billed to the card.",
+    ], 0, ctx.pointer);
+};
+export const LOGIN_HANDLERS = {
+    login,
+    signup,
+    logout,
+    "keys list": keysList,
+    "keys create": keysCreate,
+    "keys revoke": keysRevoke,
+    "billing card": billingCard,
+};