requestshield 0.1.4 → 0.1.6

package/src/commands/agent-setup.mjs

@@ -1,185 +1,182 @@
-// @ts-check
-
-import { cp, lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { randomUUID } from "node:crypto";
-import { createInterface } from "node:readline/promises";
-import { CliError } from "../errors.mjs";
-import { detectAgents } from "../agent-detector.mjs";
-import { getAsset, isSea } from "node:sea";
-
-const skillAsset = "requestshield-skill.md";
-
-/**
- * @param {{ agent?: "codex" | "claude", force: boolean }} options
- * @param {{ env?: NodeJS.ProcessEnv, homeDir?: string, log: (message: string) => void, sourceDir?: string, executablePath?: string, detectAgents?: () => Promise<Array<"codex" | "claude">>, selectAgent?: (detected: Array<"codex" | "claude">) => Promise<"codex" | "claude"> }} deps
- */
-export async function setupAgent(options, deps) {
-  const agent = await resolveAgent(options.agent, deps);
-  const homeDir = deps.homeDir ?? os.homedir();
-
-  // Codex and Claude discover personal skills from different directories.
-  const skillsRoot = agent === "codex"
-    ? path.join(homeDir, ".agents", "skills")
-    : path.join(homeDir, ".claude", "skills");
-  const destination = path.join(skillsRoot, "requestshield");
-  await mkdir(skillsRoot, { recursive: true });
-
-  const exists = await pathExists(destination);
-  if (exists && !options.force) {
-    throw new CliError(`RequestShield skill already exists at ${destination}; use --force to replace it`, {
-      code: "SKILL_EXISTS",
-      exitCode: 2,
-    });
-  }
-
-  // Copy into a staging directory so an interrupted copy cannot leave a
-  // partially installed skill at the final destination.
-  const staging = path.join(skillsRoot, `.requestshield-${randomUUID()}.tmp`);
-  const backup = `${destination}.${randomUUID()}.backup`;
-  try {
-    if (deps.sourceDir) {
-      // Tests and alternate packagers can provide an explicit skill source.
-      await cp(deps.sourceDir, staging, {
-        recursive: true,
-        errorOnExist: true,
-      });
-    } else if (isSea()) {
-      // A single-executable build reads the skill from its embedded assets.
-      await mkdir(staging);
-
-      await writeFile(
-          path.join(staging, "SKILL.md"),
-          Buffer.from(getAsset(skillAsset)),
-      );
-    } else {
-      // Source, npm, and on-disk CJS builds keep the skill beside the program.
-      //
-      // src/main.mjs                 -> ../skills/requestshield
-      // dist/requestshield.cjs      -> ../skills/requestshield
-      // npm link and global npm installs expose a symlink in their bin folder.
-      // Follow it before resolving the adjacent packaged skills directory.
-      const executable = await realpath(deps.executablePath ?? process.argv[1]);
-      const executableDir = path.dirname(executable);
-      const source = path.resolve(
-          executableDir,
-          "../skills/requestshield",
-      );
-
-      await cp(source, staging, {
-        recursive: true,
-        errorOnExist: true,
-      });
-    }
-
-    // Keep the old installation recoverable until the staged copy is in place.
-    if (exists) await rename(destination, backup);
-    await rename(staging, destination);
-    if (exists) await rm(backup, { recursive: true, force: true });
-  } catch (error) {
-    await rm(staging, { recursive: true, force: true });
-    if (await pathExists(backup)) {
-      await rm(destination, { recursive: true, force: true });
-      await rename(backup, destination);
-    }
-    throw error;
-  }
-  const agentLabel = agent === "codex" ? "Codex" : "Claude";
-  deps.log(`Installed RequestShield skill for ${agentLabel} at ${destination}`);
-  deps.log(`Restart ${agentLabel} or start a new task before using the skill.`);
-}
-
-/**
- * Explicit selection bypasses detection. Automatic setup selects a single
- * detected agent or asks the user when both agents are present.
- *
- * @param {"codex" | "claude" | undefined} requested
- * @param {{ env?: NodeJS.ProcessEnv, homeDir?: string, detectAgents?: () => Promise<Array<"codex" | "claude">>, selectAgent?: (detected: Array<"codex" | "claude">) => Promise<"codex" | "claude"> }} deps
- * @returns {Promise<"codex" | "claude">}
- */
-async function resolveAgent(requested, deps) {
-  // A command-line choice is authoritative and avoids probing the machine.
-  if (requested) return requested;
-
-  const detected = deps.detectAgents
-    ? await deps.detectAgents()
-    : await detectAgents({ env: deps.env, homeDir: deps.homeDir });
-
-  if (detected.length === 1) return detected[0];
-  if (detected.length === 0) {
-    throw new CliError(
-      [
-        "No supported coding agent detected.",
-        "",
-        "Choose one explicitly:",
-        "  requestshield agent setup --codex",
-        "  requestshield agent setup --claude",
-      ].join("\n"),
-      { code: "AGENT_NOT_FOUND", exitCode: 2 },
-    );
-  }
-
-  // Never choose silently when both agents are present. Interactive users get
-  // a prompt; non-interactive callers receive a stable conflict error.
-  const selectAgent = deps.selectAgent ?? promptForAgent;
-  const selected = await selectAgent(detected);
-  if (!detected.includes(selected)) {
-    throw new CliError(`Selected agent is not available: ${selected}`, {
-      code: "INVALID_AGENT",
-      exitCode: 2,
-    });
-  }
-  return selected;
-}
-
-/**
- * Ask an interactive user which detected agent should receive the skill.
- *
- * @returns {Promise<"codex" | "claude">}
- */
-async function promptForAgent() {
-  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
-    throw new CliError(
-      [
-        "Multiple coding agents detected.",
-        "",
-        "Choose one explicitly:",
-        "  requestshield agent setup --codex",
-        "  requestshield agent setup --claude",
-      ].join("\n"),
-      { code: "INSTALL_CONFLICT", exitCode: 2 },
-    );
-  }
-
-  const prompt = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-  try {
-    process.stdout.write(
-      "Multiple coding agents detected.\n\n  1. Codex\n  2. Claude\n\n",
-    );
-    while (true) {
-      const answer = (await prompt.question("Select an agent [1-2]: "))
-        .trim()
-        .toLowerCase();
-      if (answer === "1" || answer === "codex") return "codex";
-      if (answer === "2" || answer === "claude") return "claude";
-      process.stdout.write("Enter 1 for Codex or 2 for Claude.\n");
-    }
-  } finally {
-    prompt.close();
-  }
-}
-
-/** @param {string} target */
-async function pathExists(target) {
-  try {
-    await lstat(target);
-    return true;
-  } catch (error) {
-    if (/** @type {NodeJS.ErrnoException} */ (error).code === "ENOENT") return false;
-    throw error;
-  }
-}
+// @ts-check
+
+import { cp, lstat, mkdir, readFile, realpath, rename, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+import { CliError } from "../errors.mjs";
+import { detectAgents } from "../agent-detector.mjs";
+
+/**
+ * @param {{ agent?: "codex" | "claude", force: boolean }} options
+ * @param {{ env?: NodeJS.ProcessEnv, homeDir?: string, log: (message: string) => void, sourceDir?: string, executablePath?: string, detectAgents?: () => Promise<Array<"codex" | "claude">>, selectAgent?: (detected: Array<"codex" | "claude">) => Promise<"codex" | "claude"> }} deps
+ */
+export async function setupAgent(options, deps) {
+  const agent = await resolveAgent(options.agent, deps);
+  const homeDir = deps.homeDir ?? os.homedir();
+
+  // Codex and Claude discover personal skills from different directories.
+  const skillsRoot = agent === "codex"
+    ? path.join(homeDir, ".agents", "skills")
+    : path.join(homeDir, ".claude", "skills");
+  const destination = path.join(skillsRoot, "requestshield");
+  await mkdir(skillsRoot, { recursive: true });
+
+  const exists = await pathExists(destination);
+  if (exists && !options.force) {
+    throw new CliError(`RequestShield skill already exists at ${destination}; use --force to replace it`, {
+      code: "SKILL_EXISTS",
+      exitCode: 2,
+    });
+  }
+
+  // Copy into a staging directory so an interrupted copy cannot leave a
+  // partially installed skill at the final destination.
+  const staging = path.join(skillsRoot, `.requestshield-${randomUUID()}.tmp`);
+  const backup = `${destination}.${randomUUID()}.backup`;
+  try {
+    const source = deps.sourceDir ?? await resolveSkillSource(deps.executablePath);
+    await cp(source, staging, {
+      recursive: true,
+      errorOnExist: true,
+    });
+
+    // Keep the old installation recoverable until the staged copy is in place.
+    if (exists) await rename(destination, backup);
+    await rename(staging, destination);
+    if (exists) await rm(backup, { recursive: true, force: true });
+  } catch (error) {
+    await rm(staging, { recursive: true, force: true });
+    if (await pathExists(backup)) {
+      await rm(destination, { recursive: true, force: true });
+      await rename(backup, destination);
+    }
+    throw error;
+  }
+  const agentLabel = agent === "codex" ? "Codex" : "Claude";
+  deps.log(`Installed RequestShield skill for ${agentLabel} at ${destination}`);
+  deps.log(`Restart ${agentLabel} or start a new task before using the skill.`);
+}
+
+/** @param {string} [executablePath] */
+async function resolveSkillSource(executablePath) {
+  // Resolve from this module, not the user's cwd or the shell's argv. Following
+  // the executable also supports explicitly supplied npm-link test fixtures.
+  const executable = await realpath(
+    executablePath ?? fileURLToPath(new URL("../main.mjs", import.meta.url)),
+  );
+  const packageRoot = path.resolve(path.dirname(executable), "..");
+  const bundled = path.join(packageRoot, "skills", "requestshield");
+  if (await pathExists(path.join(bundled, "SKILL.md"))) return bundled;
+
+  // Only a source checkout has both the private runner manifest and packaging
+  // script. Installed packages must never pick up an unrelated sibling skill.
+  const devManifestPath = path.join(packageRoot, "dev", "package.json");
+  if (await pathExists(devManifestPath)
+    && await pathExists(path.join(packageRoot, "scripts", "package-skill.mjs"))) {
+    const devManifest = JSON.parse(await readFile(devManifestPath, "utf8"));
+    const canonical = path.resolve(packageRoot, "../skills/requestshield");
+    if (devManifest.private === true
+      && devManifest.name === "@intellifend/requestshield-dev"
+      && await pathExists(path.join(canonical, "SKILL.md"))) return canonical;
+  }
+  throw new CliError("The RequestShield skill is missing. Restore this source checkout or reinstall the published package.", {
+    code: "SKILL_SOURCE_MISSING",
+  });
+}
+
+/**
+ * Explicit selection bypasses detection. Automatic setup selects a single
+ * detected agent or asks the user when both agents are present.
+ *
+ * @param {"codex" | "claude" | undefined} requested
+ * @param {{ env?: NodeJS.ProcessEnv, homeDir?: string, detectAgents?: () => Promise<Array<"codex" | "claude">>, selectAgent?: (detected: Array<"codex" | "claude">) => Promise<"codex" | "claude"> }} deps
+ * @returns {Promise<"codex" | "claude">}
+ */
+async function resolveAgent(requested, deps) {
+  // A command-line choice is authoritative and avoids probing the machine.
+  if (requested) return requested;
+
+  const detected = deps.detectAgents
+    ? await deps.detectAgents()
+    : await detectAgents({ env: deps.env, homeDir: deps.homeDir });
+
+  if (detected.length === 1) return detected[0];
+  if (detected.length === 0) {
+    throw new CliError(
+      [
+        "No supported coding agent detected.",
+        "",
+        "Choose one explicitly:",
+        "  requestshield agent setup --codex",
+        "  requestshield agent setup --claude",
+      ].join("\n"),
+      { code: "AGENT_NOT_FOUND", exitCode: 2 },
+    );
+  }
+
+  // Never choose silently when both agents are present. Interactive users get
+  // a prompt; non-interactive callers receive a stable conflict error.
+  const selectAgent = deps.selectAgent ?? promptForAgent;
+  const selected = await selectAgent(detected);
+  if (!detected.includes(selected)) {
+    throw new CliError(`Selected agent is not available: ${selected}`, {
+      code: "INVALID_AGENT",
+      exitCode: 2,
+    });
+  }
+  return selected;
+}
+
+/**
+ * Ask an interactive user which detected agent should receive the skill.
+ *
+ * @returns {Promise<"codex" | "claude">}
+ */
+async function promptForAgent() {
+  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    throw new CliError(
+      [
+        "Multiple coding agents detected.",
+        "",
+        "Choose one explicitly:",
+        "  requestshield agent setup --codex",
+        "  requestshield agent setup --claude",
+      ].join("\n"),
+      { code: "INSTALL_CONFLICT", exitCode: 2 },
+    );
+  }
+
+  const prompt = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  try {
+    process.stdout.write(
+      "Multiple coding agents detected.\n\n  1. Codex\n  2. Claude\n\n",
+    );
+    while (true) {
+      const answer = (await prompt.question("Select an agent [1-2]: "))
+        .trim()
+        .toLowerCase();
+      if (answer === "1" || answer === "codex") return "codex";
+      if (answer === "2" || answer === "claude") return "claude";
+      process.stdout.write("Enter 1 for Codex or 2 for Claude.\n");
+    }
+  } finally {
+    prompt.close();
+  }
+}
+
+/** @param {string} target */
+async function pathExists(target) {
+  try {
+    await lstat(target);
+    return true;
+  } catch (error) {
+    if (/** @type {NodeJS.ErrnoException} */ (error).code === "ENOENT") return false;
+    throw error;
+  }
+}

package/src/commands/application-mutations.mjs

@@ -0,0 +1,33 @@
+// @ts-check
+import { parseApplicationResponse } from "./application-response.mjs";
+import { confirmAction, mutationKey, parseAccepted, printAccepted, validateHttpStatus, withMutationRecovery } from "./mutation-support.mjs";
+
+/** @typedef {import('./mutation-support.mjs').MutationResponse} MutationResponse */
+/** @typedef {import('./mutation-support.mjs').CommandOutput & {sessions: {loadToken(): Promise<string>}}} Dependencies */
+
+/** @param {{appKey: string, name: string, yes?: boolean, idempotencyKey?: string}} options
+ * @param {Dependencies & {api: {renameApp(token: string, appKey: string, options: {name: string, idempotencyKey: string}): Promise<MutationResponse>}}} deps
+ */
+export async function renameApp(options, deps) {
+  const idempotencyKey = mutationKey(options.idempotencyKey);
+  const token = await deps.sessions.loadToken();
+  const application = await withMutationRecovery(idempotencyKey, deps, async () => {
+    const result = await deps.api.renameApp(token, options.appKey, {name: options.name, idempotencyKey});
+    validateHttpStatus(result, 200);
+    return parseApplicationResponse(result.body, options.appKey);
+  });
+  deps.log(JSON.stringify({data: application}, null, 2));
+}
+
+/** @param {{appKey: string, enabled: boolean, yes?: boolean, idempotencyKey?: string}} options
+ * @param {Dependencies & {api: {setAppEnabled(token: string, appKey: string, options: {enabled: boolean, idempotencyKey: string}): Promise<MutationResponse>}}} deps
+ */
+export async function setAppEnabled(options, deps) {
+  if (!options.enabled) await confirmAction(options, deps, `Disable application ${options.appKey}?`, "DISABLE");
+  const idempotencyKey = mutationKey(options.idempotencyKey);
+  const token = await deps.sessions.loadToken();
+  await withMutationRecovery(idempotencyKey, deps, async () => {
+    parseAccepted(await deps.api.setAppEnabled(token, options.appKey, {enabled: options.enabled, idempotencyKey}));
+  });
+  printAccepted(options.enabled ? "Application enable" : "Application disable", options.appKey, deps);
+}

package/src/commands/application-response.mjs

@@ -0,0 +1,55 @@
+// @ts-check
+import { CliError } from "../errors.mjs";
+
+export const APPLICATION_STATUSES = new Set(["attention_required", "pending", "disabled", "revoked", "enabled"]);
+
+/** @typedef {{appKey: string, name: string, status: string, createdAt: string, updatedAt: string}} Application */
+
+/** Construct metadata from the implemented API schema; never relay extra fields.
+ * @param {unknown} value @param {string} [requestedAppKey] @returns {Application}
+ */
+export function parseApplication(value, requestedAppKey) {
+  const data = responseObject(value);
+  const {appKey, name, status, createdAt, updatedAt} = data;
+  if (typeof appKey !== "string" || !/^[A-Za-z0-9._~-]{1,128}$/.test(appKey)) {
+    throw invalidResponse("The application response contained an invalid App Key");
+  }
+  if (requestedAppKey !== undefined && appKey !== requestedAppKey) {
+    throw invalidResponse("The application response did not match the requested App Key");
+  }
+  if (typeof name !== "string" || !name.trim() || [...name].length > 100 || /[\p{Cc}\p{Cs}]/u.test(name)) {
+    throw invalidResponse("The application response contained an invalid name");
+  }
+  if (typeof status !== "string" || !APPLICATION_STATUSES.has(status)) {
+    throw invalidResponse("The application response contained an unsupported status");
+  }
+  if (!isTimestamp(createdAt) || !isTimestamp(updatedAt)) {
+    throw invalidResponse("The application response contained invalid timestamps");
+  }
+  return {appKey, name, status, createdAt, updatedAt};
+}
+
+/** @param {unknown} body @param {string} requestedAppKey */
+export function parseApplicationResponse(body, requestedAppKey) {
+  return parseApplication(responseObject(body).data, requestedAppKey);
+}
+
+/** @param {unknown} value @returns {Record<string, unknown>} */
+export function responseObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidResponse("The API response did not contain the expected object");
+  }
+  return /** @type {Record<string, unknown>} */ (value);
+}
+
+/** @param {unknown} value @returns {value is string} */
+function isTimestamp(value) {
+  return typeof value === "string"
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
+    && Number.isFinite(Date.parse(value));
+}
+
+/** @param {string} message */
+export function invalidResponse(message) {
+  return new CliError(message, {code: "INVALID_RESPONSE"});
+}

package/src/commands/apps-get.mjs

@@ -0,0 +1,20 @@
+// @ts-check
+
+import { parseApplicationResponse } from "./application-response.mjs";
+
+/**
+ * @param {{ appKey: string }} options
+ * @param {{ api: { getApp(accessToken: string, appKey: string): Promise<{body: unknown}> }, sessions: { loadToken(): Promise<string> }, log: (message: string) => void }} deps
+ */
+export async function getApp(options, deps) {
+  const accessToken =
+    await deps.sessions.loadToken();
+  
+  const result =
+    await deps.api.getApp(accessToken, options.appKey);
+  
+  const app =
+    parseApplicationResponse(result.body, options.appKey);
+  
+  deps.log(JSON.stringify({ data: app }, null, 2));
+}

package/src/commands/apps-list.mjs

@@ -0,0 +1,94 @@
+// @ts-check
+
+import { CliError } from "../errors.mjs";
+import { getCommandInvocation } from "../config.mjs";
+import { invalidResponse, parseApplication, responseObject } from "./application-response.mjs";
+
+const HEADERS = ["APP KEY", "NAME", "STATUS"];
+const MAX_PAGES = 100;
+
+/** @typedef {{ appKey: string, name: string, status: string, createdAt: string, updatedAt: string }} App */
+
+/**
+ * @param {{json: boolean, limit?: number, cursor?: string, all?: boolean}} options
+ * @param {{api: {listApps(accessToken: string, options: {limit?: number, cursor?: string}): Promise<{body: unknown}>}, sessions: {loadToken(): Promise<string>}, log: (message: string) => void, profile?: import('../config.mjs').Profile}} deps
+ */
+export async function listApps(options, deps) {
+  /** @type {App[]} */
+  const apps = [];
+  let cursor = options.cursor;
+  let nextCursor = null;
+  const seen = new Set(cursor ? [cursor] : []);
+  for (let page = 0; page < MAX_PAGES; page++) {
+    // Long traversals can cross token expiry; each page may refresh safely.
+    const accessToken = await deps.sessions.loadToken();
+    const result = await deps.api.listApps(accessToken, {
+      ...(options.limit !== undefined ? {limit: options.limit} : {}),
+      ...(cursor !== undefined ? {cursor} : {}),
+    });
+    const parsed = parseApps(result.body);
+    if (parsed.data.length > (options.limit ?? 50)) throw invalidResponse("The applications response exceeded the requested page size");
+    apps.push(...parsed.data);
+    nextCursor = parsed.nextCursor;
+    if (nextCursor !== null && seen.has(nextCursor)) {
+      throw new CliError("The API repeated an application cursor; pagination stopped without returning partial results", {code: "PAGINATION_STALLED"});
+    }
+    if (!options.all || nextCursor === null) break;
+    seen.add(nextCursor);
+    cursor = nextCursor;
+    if (page === MAX_PAGES - 1) {
+      throw new CliError("Application pagination exceeded 100 pages; use --limit and --cursor to retrieve individual pages", {code: "PAGINATION_LIMIT"});
+    }
+  }
+
+  if (options.json) {
+    deps.log(JSON.stringify({ data: apps, nextCursor }, null, 2));
+    return;
+  }
+
+  if (apps.length === 0) {
+    deps.log(nextCursor === null && !options.cursor
+      ? "No applications are available to this account."
+      : "No applications were returned on this page.");
+  } else {
+    for (const line of formatTable(apps)) deps.log(line);
+  }
+  if (nextCursor !== null) deps.log(`More applications are available. Continue with \`${getCommandInvocation(deps.profile)} apps list --cursor ${nextCursor}\` or use --all.`);
+}
+
+/** @param {unknown} body @returns {{ data: App[], nextCursor: string | null }} */
+function parseApps(body) {
+  const {data, nextCursor} = responseObject(body);
+
+  if (!Array.isArray(data)) {
+    throw new CliError("The applications response did not contain a data array", {
+      code: "INVALID_RESPONSE",
+    });
+  }
+
+  if (nextCursor !== null && (typeof nextCursor !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(nextCursor))) {
+    throw new CliError("The applications response contained an invalid nextCursor", {
+      code: "INVALID_RESPONSE",
+    });
+  }
+
+  // Rebuild every item from approved metadata so unexpected API fields never reach output.
+  const apps = data.map(entry => parseApplication(entry));
+
+  return { data: apps, nextCursor };
+}
+
+/** @param {App[]} apps @returns {string[]} */
+function formatTable(apps) {
+  const rows = [HEADERS, ...apps.map((app) =>
+    [app.appKey, app.name, app.status])];
+  
+  const widths = HEADERS.map((_, column) =>
+    Math.max(...rows.map((row) => row[column].length)));
+  
+  return rows.map((row) =>
+    row
+      .map((cell, column) => (column === HEADERS.length - 1 ? cell : cell.padEnd(widths[column])))
+      .join("  "),
+  );
+}

package/src/commands/auth-status.mjs

@@ -0,0 +1,37 @@
+// @ts-check
+
+/** @param {{json?: boolean}} options
+ * @param {{sessions: {status(): Promise<import('../session-store.mjs').SessionStatus>}, log: (message: string) => void}} deps
+ */
+export async function showAuthStatus({ json = false }, deps) {
+  const status = await deps.sessions.status();
+  // Rebuild the output so future storage fields can never expose credentials.
+  const result = {
+    profile: status.profile, apiUrl: status.apiUrl, issuer: status.issuer,
+    clientId: status.clientId, state: status.state, localOnly: true,
+    ...(["valid", "expired", "refresh_uncertain"].includes(status.state) ? {
+      expiresAt: status.expiresAt, scopes: status.scopes ? [...status.scopes] : [],
+    } : {}),
+  };
+  if (json) {
+    deps.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  const descriptions = {
+    signed_out: "signed out",
+    valid: "locally valid",
+    expired: "access token expired; the next authenticated command will attempt refresh",
+    refresh_uncertain: "refresh outcome uncertain; sign in again",
+    config_mismatch: "saved session belongs to different configuration; sign in again",
+    invalid: "saved session is invalid; sign in again",
+    configuration_error: "selected profile configuration is incomplete or invalid",
+  };
+  deps.log(`Profile: ${result.profile}`);
+  deps.log(`Session (local): ${descriptions[result.state]}`);
+  deps.log(`API: ${result.apiUrl ?? "not configured"}`);
+  deps.log(`OAuth issuer: ${result.issuer ?? "not configured"}`);
+  deps.log(`OAuth client: ${result.clientId ?? "not configured"}`);
+  if (result.expiresAt !== undefined) deps.log(`Access token expires at: ${new Date(result.expiresAt).toUTCString()}`);
+  if (result.scopes) deps.log(`Granted scopes: ${result.scopes.join(" ")}`);
+  deps.log("This is local status; provider validity was not checked.");
+}