seamless-cli 0.12.1 → 0.13.0

package/dist/commands/whoami.js

@@ -3,8 +3,10 @@ import { extractFlag } from "../core/args.js";
 import { createAuthClient, createPortalClient, ReauthRequiredError, } from "../core/authClient.js";
 import { fetchIdentity } from "../core/session.js";
 import { getPortalSession } from "../core/config.js";
+import { errorMessage } from "../core/errors.js";
 export async function runWhoami(args) {
-    const { value: profileFlag } = extractFlag(args, "profile");
+    const { value: profileFlag, rest } = extractFlag(args, "profile");
+    const json = rest.includes("--json");
     try {
         // Without --profile this reports the portal account. An instance profile is
         // still a useful answer when there is no portal session (a local-only or
@@ -15,17 +17,33 @@ export async function runWhoami(args) {
             ? await createAuthClient({ profileFlag })
             : await createPortalClient();
         const identity = await fetchIdentity(client);
-        printIdentity(portal ? "Seamless portal" : client.profile.name, client.profile, identity);
+        const account = portal ? "Seamless portal" : client.profile.name;
+        if (json) {
+            printIdentityJson(account, client.profile, identity);
+            return;
+        }
+        printIdentity(account, client.profile, identity);
     }
     catch (err) {
         if (err instanceof ReauthRequiredError) {
             console.log(kleur.yellow(err.message));
             process.exit(1);
         }
-        console.error(kleur.red(err.message));
+        console.error(kleur.red(errorMessage(err)));
         process.exit(1);
     }
 }
+// The same fields the table shows, as null rather than "(unknown)" when absent: a
+// script asking for JSON wants a missing value it can test, not prose.
+function printIdentityJson(account, profile, identity) {
+    console.log(JSON.stringify({
+        account,
+        instanceUrl: profile.instanceUrl,
+        sub: identity.sub ?? profile.sub ?? null,
+        email: identity.email ?? profile.email ?? null,
+        roles: identity.roles,
+    }, null, 2));
+}
 function printIdentity(target, profile, identity) {
     const line = (label, value) => console.log(kleur.dim(`${label}:`.padEnd(11)) + value);
     line("Account", target);

package/dist/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAiB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,mBAAmB,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,MAAM,GAAG,CAAC,WAAW,IAAI,gBAAgB,EAAE,KAAK,SAAS,CAAC;QAChE,MAAM,MAAM,GACV,WAAW,IAAI,CAAC,MAAM;YACpB,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;YACzC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7C,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,OAAgB,EAChB,QAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IAEzD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAiB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,CAAC;QACH,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,MAAM,GAAG,CAAC,WAAW,IAAI,gBAAgB,EAAE,KAAK,SAAS,CAAC;QAChE,MAAM,MAAM,GACV,WAAW,IAAI,CAAC,MAAM;YACpB,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC;YACzC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAEjE,IAAI,IAAI,EAAE,CAAC;YACT,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,uEAAuE;AACvE,SAAS,iBAAiB,CACxB,OAAe,EACf,OAAgB,EAChB,QAAkB;IAElB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,OAAO;QACP,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI;QACxC,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI;QAC9C,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,OAAgB,EAChB,QAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IAEzD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC"}

package/dist/core/admin.js

@@ -26,10 +26,17 @@ async function call(client, method, path, body) {
         throw new PermissionError();
     return res;
 }
-export async function listUsers(client) {
-    const res = await call(client, "GET", "/admin/users");
+export async function listUsers(client, opts = {}) {
+    const query = new URLSearchParams();
+    if (opts.limit !== undefined)
+        query.set("limit", String(opts.limit));
+    if (opts.offset !== undefined)
+        query.set("offset", String(opts.offset));
+    const suffix = query.size ? `?${query}` : "";
+    const res = await call(client, "GET", `/admin/users${suffix}`);
     if (!res.ok)
         throw new AdminApiError(`Could not list users (${res.status}).`);
+    // `total` counts every user, not just this page, so callers can report position.
     return { users: arr(res.data?.users), total: res.data?.total ?? 0 };
 }
 export async function deleteUser(client, id) {

package/dist/core/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/core/admin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAID,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,MAAkB,EAClB,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,IAAI,GAAmB,CAAC;IACxB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,eAAe,EAAE,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAkB;IAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,cAAc,CACf,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,EAAU;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,EAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACzC,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,OAAO;QACL,IAAI,EAAG,IAAI,CAAC,IAAa,IAAI,IAAI;QACjC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,EAAU,EACV,IAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,8BAA8B,EACpE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CACvB,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CACrB,yCAAyC,GAAG,CAAC,MAAM,IAAI,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,sBAAsB,CACvB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACtF,OAAO;QACL,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3C,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAyC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,IAAI,CACL,CAAC;IACF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAkB,EAAE,EAAU;IACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACjD,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,EAAU,EACV,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,OAAO,EACP,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAChD,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAC5D,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuC;IACjE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,KAAa,EACb,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,MAAM,EACN,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAC3D,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,KAAa,EACb,MAAc,EACd,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,OAAO,EACP,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,EACzF,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,KAAa,EACb,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,QAAQ,EACR,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,4BAA4B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/core/admin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAID,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,MAAkB,EAClB,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,IAAI,GAAmB,CAAC;IACxB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,eAAe,EAAE,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,OAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,eAAe,MAAM,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9E,iFAAiF;IACjF,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,EAAU;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,EAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACzC,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,OAAO;QACL,IAAI,EAAG,IAAI,CAAC,IAAa,IAAI,IAAI;QACjC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,EAAU,EACV,IAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,8BAA8B,EACpE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CACvB,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CACrB,yCAAyC,GAAG,CAAC,MAAM,IAAI,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,sBAAsB,CACvB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACtF,OAAO;QACL,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3C,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAyC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,IAAI,CACL,CAAC;IACF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAkB,EAAE,EAAU;IACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACjD,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,EAAU,EACV,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,OAAO,EACP,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAChD,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,KAAK,EACL,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAC5D,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuC;IACjE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAkB,EAClB,KAAa,EACb,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,MAAM,EACN,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAC3D,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,KAAa,EACb,MAAc,EACd,IAAU;IAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,OAAO,EACP,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,EACzF,IAAI,CACL,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,KAAa,EACb,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,EACN,QAAQ,EACR,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,4BAA4B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACnF,CAAC"}

package/dist/core/authClient.js

@@ -1,5 +1,5 @@
 import { getActiveProfile, getPortalSession, } from "./config.js";
-import { deleteTokens, getTokens, KeychainUnavailableError, saveTokens, } from "./keychain.js";
+import { deleteTokens, getTokens, headlessRefreshToken, KeychainUnavailableError, saveTokens, } from "./keychain.js";
 import { apiRequest, joinUrl } from "./http.js";
 export class ReauthRequiredError extends Error {
     constructor(message) {
@@ -24,6 +24,40 @@ export function tokensFromAuthResponse(data) {
         refreshTokenExpiresAt: refreshTtl !== undefined ? now + refreshTtl * 1000 : undefined,
     };
 }
+/**
+ * Reads a `/refresh` response, keeping the current refresh token when the instance
+ * did not send a new one.
+ *
+ * Separate from `tokensFromAuthResponse` because the two answer different questions.
+ * A login must establish both tokens, and a response missing either is unusable. A
+ * refresh only has to produce a usable access token: the response schema marks both
+ * fields optional, so requiring the pair would wipe a session that is still valid
+ * the first time an instance rotates only the access token.
+ */
+export function tokensFromRefreshResponse(data, current) {
+    if (!data)
+        return null;
+    const accessToken = typeof data.token === "string" ? data.token : undefined;
+    if (!accessToken)
+        return null;
+    const rotated = typeof data.refreshToken === "string" && data.refreshToken
+        ? data.refreshToken
+        : undefined;
+    const now = Date.now();
+    const ttl = typeof data.ttl === "number" ? data.ttl : undefined;
+    const refreshTtl = typeof data.refreshTtl === "number" ? data.refreshTtl : undefined;
+    return {
+        accessToken,
+        refreshToken: rotated ?? current.refreshToken,
+        accessTokenExpiresAt: ttl !== undefined ? now + ttl * 1000 : undefined,
+        refreshTokenExpiresAt: refreshTtl !== undefined
+            ? now + refreshTtl * 1000
+            : // An unrotated token keeps the expiry it already had.
+                rotated
+                    ? undefined
+                    : current.refreshTokenExpiresAt,
+    };
+}
 // A client for an auth instance a developer administers, resolved from the active
 // profile. Portal calls use createPortalClient instead: the two sessions are
 // different accounts on different hosts and must never be interchanged.
@@ -57,11 +91,16 @@ async function createClientForProfile(profile, copy) {
         throw new ReauthRequiredError(`No session for ${copy.label}. Run: ${copy.reauthCommand}.`);
     }
     const session = tokens;
+    // A headless run reads SEAMLESS_REFRESH_TOKEN fresh every time, so the keychain is
+    // never consulted and writing a rotated token there only makes it look preserved.
+    const headless = headlessRefreshToken() !== undefined;
     const persist = async (next) => {
         session.accessToken = next.accessToken;
         session.refreshToken = next.refreshToken;
         session.accessTokenExpiresAt = next.accessTokenExpiresAt;
         session.refreshTokenExpiresAt = next.refreshTokenExpiresAt;
+        if (headless)
+            return;
         try {
             await saveTokens(profile, next);
         }
@@ -79,22 +118,37 @@ async function createClientForProfile(profile, copy) {
                 throw err;
         }
     };
-    const refresh = async () => {
+    const expiredMessage = () => headless
+        ? `The refresh token in SEAMLESS_REFRESH_TOKEN was rejected by ${copy.label}. The instance rotates the refresh token on every refresh and revokes the session if a spent one is sent again, so a token that has already been refreshed once cannot be reused on a later run. Issue a fresh one with: ${copy.reauthCommand}.`
+        : `Your session for ${copy.label} has expired or was revoked. Run: ${copy.reauthCommand}.`;
+    const runRefresh = async () => {
         const res = await apiRequest(joinUrl(profile.instanceUrl, "/refresh"), {
             method: "POST",
             headers: { Authorization: `Bearer ${session.refreshToken}` },
         });
         if (!res.ok) {
             await clearSession();
-            throw new ReauthRequiredError(`Your session for ${copy.label} has expired or was revoked. Run: ${copy.reauthCommand}.`);
+            throw new ReauthRequiredError(expiredMessage());
         }
-        const next = tokensFromAuthResponse(res.data);
+        const next = tokensFromRefreshResponse(res.data, session);
         if (!next) {
             await clearSession();
             throw new ReauthRequiredError(`Received an unexpected refresh response from ${profile.instanceUrl}. Run: ${copy.reauthCommand}.`);
         }
         await persist(next);
     };
+    // Single-flight. The instance rotates the refresh token on every call and reads a
+    // second use of the old one as theft, revoking the whole session chain, so two
+    // concurrent refreshes would not merely race: they would log the developer out.
+    let inFlight = null;
+    const refresh = () => {
+        if (!inFlight) {
+            inFlight = runRefresh().finally(() => {
+                inFlight = null;
+            });
+        }
+        return inFlight;
+    };
     const authedFetch = async (path, init = {}) => {
         const build = () => ({
             ...init,
@@ -104,10 +158,22 @@ async function createClientForProfile(profile, copy) {
             },
         });
         const url = joinUrl(profile.instanceUrl, path);
+        const sentWith = session.accessToken;
         let res = await apiRequest(url, build());
         if (res.status === 401 && session.refreshToken) {
-            await refresh();
+            // Only refresh if nothing else already did while this request was in flight.
+            // Otherwise a burst of 401s against one stale token would each rotate again.
+            if (session.accessToken === sentWith) {
+                await refresh();
+            }
             res = await apiRequest(url, build());
+            // A 401 on a freshly refreshed token is not something a caller can act on by
+            // retrying, and returning it verbatim left commands reporting an opaque failure
+            // instead of saying the session is gone.
+            if (res.status === 401) {
+                await clearSession();
+                throw new ReauthRequiredError(`Your session for ${copy.label} was rejected after refreshing it. Run: ${copy.reauthCommand}.`);
+            }
         }
         return res;
     };

package/dist/core/authClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"authClient.js","sourceRoot":"","sources":["../../src/core/authClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,wBAAwB,EACxB,UAAU,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAoB,MAAM,WAAW,CAAC;AAElE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAaD,MAAM,UAAU,sBAAsB,CACpC,IAAoC;IAEpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,OAAO;QACL,WAAW;QACX,YAAY;QACZ,oBAAoB,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACtE,qBAAqB,EACnB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,0IAA0I,CAC3I,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,YAAY,OAAO,CAAC,IAAI,GAAG;QAClC,aAAa,EAAE,0BAA0B,OAAO,CAAC,IAAI,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,8EAA8E;AAC9E,gFAAgF;AAChF,aAAa;AACb,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,qBAAqB;QAC5B,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;AACL,CAAC;AAOD,KAAK,UAAU,sBAAsB,CACnC,OAAgB,EAChB,IAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,aAAa,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC;IAEvB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;QACzD,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACzC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACzD,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EACxC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE;SAC7D,CACF,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,oBAAoB,IAAI,CAAC,KAAK,qCAAqC,IAAI,CAAC,aAAa,GAAG,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,gDAAgD,OAAO,CAAC,WAAW,UAAU,IAAI,CAAC,aAAa,GAAG,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,IAAY,EACZ,OAAoB,EAAE,EACG,EAAE;QAC3B,MAAM,KAAK,GAAG,GAAgB,EAAE,CAAC,CAAC;YAChC,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAI,IAAI,CAAC,OAA8C;gBACvD,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,OAAO,EAAE,CAAC;YAChB,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACvE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;YAC9B,MAAM,OAAO,GAA2B;gBACtC,GAAI,IAAI,CAAC,OAA8C;aACxD,CAAC;YACF,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,WAAW,CAAC,IAAI,EAAE;gBACvB,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authClient.js","sourceRoot":"","sources":["../../src/core/authClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,wBAAwB,EACxB,UAAU,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAoB,MAAM,WAAW,CAAC;AAElE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAaD,MAAM,UAAU,sBAAsB,CACpC,IAAoC;IAEpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,OAAO;QACL,WAAW;QACX,YAAY;QACZ,oBAAoB,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACtE,qBAAqB,EACnB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAoC,EACpC,OAAoB;IAEpB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY;QACxD,CAAC,CAAC,IAAI,CAAC,YAAY;QACnB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,OAAO;QACL,WAAW;QACX,YAAY,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY;QAC7C,oBAAoB,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACtE,qBAAqB,EACnB,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI;YACzB,CAAC,CAAC,sDAAsD;gBACtD,OAAO;oBACP,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,CAAC,qBAAqB;KACtC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,0IAA0I,CAC3I,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,YAAY,OAAO,CAAC,IAAI,GAAG;QAClC,aAAa,EAAE,0BAA0B,OAAO,CAAC,IAAI,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,8EAA8E;AAC9E,gFAAgF;AAChF,aAAa;AACb,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,qBAAqB;QAC5B,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;AACL,CAAC;AAOD,KAAK,UAAU,sBAAsB,CACnC,OAAgB,EAChB,IAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,aAAa,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC;IAEvB,mFAAmF;IACnF,kFAAkF;IAClF,MAAM,QAAQ,GAAG,oBAAoB,EAAE,KAAK,SAAS,CAAC;IAEtD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;QACzD,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACzC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACzD,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,GAAW,EAAE,CAClC,QAAQ;QACN,CAAC,CAAC,+DAA+D,IAAI,CAAC,KAAK,4NAA4N,IAAI,CAAC,aAAa,GAAG;QAC5T,CAAC,CAAC,oBAAoB,IAAI,CAAC,KAAK,qCAAqC,IAAI,CAAC,aAAa,GAAG,CAAC;IAE/F,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EACxC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE;SAC7D,CACF,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,gDAAgD,OAAO,CAAC,WAAW,UAAU,IAAI,CAAC,aAAa,GAAG,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,kFAAkF;IAClF,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAkB,EAAE;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,IAAY,EACZ,OAAoB,EAAE,EACG,EAAE;QAC3B,MAAM,KAAK,GAAG,GAAgB,EAAE,CAAC,CAAC;YAChC,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAI,IAAI,CAAC,OAA8C;gBACvD,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,6EAA6E;YAC7E,6EAA6E;YAC7E,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAExC,6EAA6E;YAC7E,gFAAgF;YAChF,yCAAyC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAC3B,oBAAoB,IAAI,CAAC,KAAK,2CAA2C,IAAI,CAAC,aAAa,GAAG,CAC/F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACvE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;YAC9B,MAAM,OAAO,GAA2B;gBACtC,GAAI,IAAI,CAAC,OAA8C;aACxD,CAAC;YACF,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,WAAW,CAAC,IAAI,EAAE;gBACvB,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/config.js

@@ -162,7 +162,54 @@ export function clearPortalSession() {
     saveConfig(config);
     return config;
 }
-const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+const LOCAL_HOSTS = new Set(["localhost", "::1", "[::1]", "::", "[::]"]);
+/** An IPv4 dotted quad, as four numbers, or null when the host is not one. */
+function ipv4Octets(host) {
+    const parts = host.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = parts.map((part) => /^\d{1,3}$/.test(part) ? Number(part) : NaN);
+    return octets.every((n) => n >= 0 && n <= 255) ? octets : null;
+}
+function isPrivateIpv4(host) {
+    const octets = ipv4Octets(host);
+    if (!octets)
+        return false;
+    const [a, b] = octets;
+    if (a === 127)
+        return true; // loopback, the whole /8 rather than just .0.1
+    if (a === 0)
+        return true; // 0.0.0.0, what a dev server binds to for "every interface"
+    if (a === 10)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // /12, so not 172.32+
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 169 && b === 254)
+        return true; // link-local
+    return false;
+}
+function isPrivateIpv6(host) {
+    // URL.hostname keeps the brackets on an IPv6 literal.
+    const inner = host.startsWith("[") && host.endsWith("]")
+        ? host.slice(1, -1).toLowerCase()
+        : null;
+    if (!inner)
+        return false;
+    // fc00::/7 unique-local and fe80::/10 link-local. Matching on the leading group
+    // is enough here: a global address never opens with one of these.
+    return /^f[cd]/.test(inner) || /^fe[89ab]/.test(inner);
+}
+/**
+ * Whether a URL points at something on the developer's own machine or network.
+ *
+ * Gates two things: allowing plaintext http, and `--local` OTP delivery, which asks
+ * the instance to return the code in the response body. A dev instance is commonly
+ * reached at something other than localhost, a container bound to `0.0.0.0`, a LAN
+ * address from a phone on the same network, or an mDNS `.local` name, and refusing
+ * those forced https onto a box that has no certificate.
+ */
 export function isLocalInstanceUrl(input) {
     let url;
     try {
@@ -171,8 +218,13 @@ export function isLocalInstanceUrl(input) {
     catch {
         return false;
     }
-    const host = url.hostname;
-    return LOCAL_HOSTS.has(host) || host.endsWith(".localhost");
+    const host = url.hostname.toLowerCase();
+    return (LOCAL_HOSTS.has(host) ||
+        host.endsWith(".localhost") ||
+        host === "local" ||
+        host.endsWith(".local") ||
+        isPrivateIpv4(host) ||
+        isPrivateIpv6(host));
 }
 export function normalizeInstanceUrl(input) {
     const trimmed = (input ?? "").trim();

package/dist/core/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAqBxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,8EAA8E;AAC9E,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAE3E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,WAAW,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,GAAG,CAAC,QAAmC,CACxC,EAAE,CAAC;YACF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa;QACxD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,oBAAoB,CAAC;IAE3B,MAAM,MAAM,GAAmB,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAG,aAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,EAAE,CAAC;IAE/C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,qDAAqD,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAyB,UAAU,EAAE;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,SAAyB,UAAU,EAAE;IAErC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IACtC,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACjF,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,uDAAuD,IAAI,IAAI,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAiC,EAAE,EACnC,SAAyB,UAAU,EAAE;IAErC,OAAO,CACL,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACpC,MAAM,CAAC,aAAa;QACpB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,mBAAmB,kEAAkE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,UAAU,gBAAgB,CAC9B,SAAyB,UAAU,EAAE;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,MAAM,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC1D,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,8DAA8D,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,QAAQ,IAAI,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,IAAI,CAC5D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAqBxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,8EAA8E;AAC9E,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAE3E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,WAAW,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,GAAG,CAAC,QAAmC,CACxC,EAAE,CAAC;YACF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa;QACxD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,oBAAoB,CAAC;IAE3B,MAAM,MAAM,GAAmB,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAG,aAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,EAAE,CAAC;IAE/C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,qDAAqD,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAyB,UAAU,EAAE;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,SAAyB,UAAU,EAAE;IAErC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IACtC,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACjF,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,uDAAuD,IAAI,IAAI,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAiC,EAAE,EACnC,SAAyB,UAAU,EAAE;IAErC,OAAO,CACL,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACpC,MAAM,CAAC,aAAa;QACpB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,mBAAmB,kEAAkE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,UAAU,gBAAgB,CAC9B,SAAyB,UAAU,EAAE;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,MAAM,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC1D,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzE,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAC5C,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IAEtB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAC3E,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,4DAA4D;IACtF,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,sDAAsD;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACjC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,gFAAgF;IAChF,kEAAkE;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CACL,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,KAAK,OAAO;QAChB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,aAAa,CAAC,IAAI,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,8DAA8D,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,QAAQ,IAAI,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,IAAI,CAC5D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/core/errors.js

@@ -0,0 +1,32 @@
+import { scrubTokens } from "./redact.js";
+/**
+ * Renders a thrown value for display.
+ *
+ * `throw` accepts anything, so reading `.message` off it is a guess. When the guess
+ * was wrong the CLI printed "Error: undefined", which names neither the failure nor
+ * the fact that something unexpected was thrown.
+ *
+ * A thrown object is scrubbed before it is shown: it reaches here from a rejected
+ * request as often as from our own code, and a response body can carry a token.
+ */
+export function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message || err.name;
+    if (typeof err === "string")
+        return err;
+    if (err && typeof err === "object") {
+        const message = err.message;
+        if (typeof message === "string" && message)
+            return message;
+        try {
+            return JSON.stringify(scrubTokens(err));
+        }
+        catch {
+            // Circular, or something JSON cannot represent.
+            return String(err);
+        }
+    }
+    // null, undefined, and the other primitives, none of which say much on their own.
+    return `Unexpected error: ${String(err)}`;
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;QACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,OAAO,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5C,CAAC"}

package/dist/core/fetch.js

@@ -1,7 +1,23 @@
 import { SEAMLESS_AUTH_API_VERSION } from "./images.js";
+/**
+ * A GET whose connection-level failure says what it could not reach.
+ *
+ * When `fetch` never gets a response at all (offline, DNS, TLS, no route) it rejects
+ * with a bare `TypeError: fetch failed`, which reaches the top-level handler as
+ * "Error: fetch failed" and names neither the host nor what the CLI wanted from it.
+ * A non-ok response is left to the caller, which knows what its status means.
+ */
+export async function fetchRemote(url, purpose) {
+    try {
+        return await fetch(url);
+    }
+    catch (err) {
+        throw new Error(`Could not reach ${url} to ${purpose}. Check your network connection.`, { cause: err });
+    }
+}
 export async function fetchEnvExample() {
     const url = `https://raw.githubusercontent.com/fells-code/seamless-auth-api/${SEAMLESS_AUTH_API_VERSION}/.env.example`;
-    const res = await fetch(url);
+    const res = await fetchRemote(url, "read the auth server's env.example");
     if (!res.ok) {
         throw new Error("Failed to fetch auth env.example");
     }

package/dist/core/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/core/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GACP,kEAAkE,yBAAyB,eAAe,CAAC;IAE7G,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/core/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,OAAO,OAAO,kCAAkC,EACtE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GACP,kEAAkE,yBAAyB,eAAe,CAAC;IAE7G,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IAEzE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/core/images.js

@@ -6,6 +6,12 @@ export const SEAMLESS_AUTH_API_VERSION = "v0.7.1";
 export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`;
 export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.4.0";
 export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`;
+// `--admin=source` unpacks the dashboard from this repo at the same tag the image
+// above is built from, so both admin modes scaffold the same dashboard. Override
+// the ref with SEAMLESS_ADMIN_DASHBOARD_REF, or point at a local checkout with
+// SEAMLESS_ADMIN_DASHBOARD_DIR.
+export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REPO = "fells-code/seamless-auth-admin-dashboard";
+export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION;
 // The starter templates monorepo the CLI scaffolds from. Pinned to a tag so a given
 // CLI version always produces the same project. Override the ref with
 // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR.

package/dist/core/images.js.map

@@ -1 +1 @@
-{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/core/images.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wCAAwC,yBAAyB,EAAE,CAAC;AAE3G,MAAM,CAAC,MAAM,qCAAqC,GAAG,QAAQ,CAAC;AAE9D,MAAM,CAAC,MAAM,mCAAmC,GAAG,oDAAoD,qCAAqC,EAAE,CAAC;AAE/I,oFAAoF;AACpF,sEAAsE;AACtE,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/core/images.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wCAAwC,yBAAyB,EAAE,CAAC;AAE3G,MAAM,CAAC,MAAM,qCAAqC,GAAG,QAAQ,CAAC;AAE9D,MAAM,CAAC,MAAM,mCAAmC,GAAG,oDAAoD,qCAAqC,EAAE,CAAC;AAE/I,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,gCAAgC;AAChC,MAAM,CAAC,MAAM,kCAAkC,GAC7C,0CAA0C,CAAC;AAE7C,MAAM,CAAC,MAAM,iCAAiC,GAAG,qCAAqC,CAAC;AAEvF,oFAAoF;AACpF,sEAAsE;AACtE,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC"}

package/dist/core/interactiveLogin.js

@@ -32,23 +32,19 @@ export async function promptLogin(opts) {
             requireInteractive("Enter the code we sent you", "A one-time code cannot be supplied ahead of time, so this step needs a terminal.");
             const answer = await text({
                 message: resent ? "Enter the new code" : "Enter the code we sent you",
+                // A hint, not a rule: the code format belongs to the instance, so the
+                // prompt only refuses an empty answer and lets the server judge the rest.
+                // Encoding today's shape here would reject a valid code from an instance
+                // that ever issues a different one, with no way to override it.
                 placeholder: email ? "ABCDEF" : "123456",
-                validate: (value) => {
-                    const code = (value ?? "").trim();
-                    if (email) {
-                        return /^[A-Za-z]{6}$/.test(code)
-                            ? undefined
-                            : "Enter the 6-letter code from the email.";
-                    }
-                    return /^\d{4,8}$/.test(code)
-                        ? undefined
-                        : "Enter the numeric code from the message.";
-                },
+                validate: (value) => (value ?? "").trim() ? undefined : "A code is required",
             });
             if (isCancel(answer))
                 return null;
-            const code = answer.trim();
-            return email ? code.toUpperCase() : code;
+            // Sent as typed apart from surrounding whitespace. The instance normalizes
+            // case for email codes itself, so uppercasing here would only corrupt a
+            // case-sensitive one.
+            return answer.trim();
         },
         notify: (event) => {
             switch (event.type) {
@@ -58,6 +54,9 @@ export async function promptLogin(opts) {
                     // know.
                     console.log(kleur.dim(`If an account exists for ${resolved}, a code is on its way.`));
                     break;
+                case "code_expired":
+                    console.log(kleur.yellow("That code was not sent: the five minute login window lapsed while you were typing."));
+                    break;
                 case "code_resent":
                     console.log(kleur.dim("Your previous code expired, so we sent a new one."));
                     break;

package/dist/core/interactiveLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"interactiveLogin.js","sourceRoot":"","sources":["../../src/core/interactiveLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAe9C,uEAAuE;AACvE,4EAA4E;AAC5E,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAA6B;IAE7B,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,kBAAkB,CAChB,gBAAgB,EAChB,iEAAiE,CAClE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,iBAAiB;YACjD,YAAY,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YACnC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B;SAClE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,UAAU,GAAI,MAAiB,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;QAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC;YAClC,yEAAyE;YACzE,qEAAqE;YACrE,kBAAkB,CAChB,4BAA4B,EAC5B,kFAAkF,CACnF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,4BAA4B;gBACrE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACxC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;oBAClB,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClC,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;4BAC/B,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,yCAAyC,CAAC;oBAChD,CAAC;oBACD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC3B,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,0CAA0C,CAAC;gBACjD,CAAC;aACF,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,IAAI,GAAI,MAAiB,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,yEAAyE;oBACzE,8EAA8E;oBAC9E,QAAQ;oBACR,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,4BAA4B,QAAQ,yBAAyB,CAAC,CACzE,CAAC;oBACF,MAAM;gBACR,KAAK,aAAa;oBAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAC/D,CAAC;oBACF,MAAM;gBACR,KAAK,iBAAiB;oBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;oBACpE,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,+BAA+B,KAAK,CAAC,YAAY,WAC/C,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAClC,QAAQ,CACT,CACF,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"interactiveLogin.js","sourceRoot":"","sources":["../../src/core/interactiveLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAe9C,uEAAuE;AACvE,4EAA4E;AAC5E,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAA6B;IAE7B,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,kBAAkB,CAChB,gBAAgB,EAChB,iEAAiE,CAClE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,iBAAiB;YACjD,YAAY,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YACnC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B;SAClE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,UAAU,GAAI,MAAiB,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;QAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC;YAClC,yEAAyE;YACzE,qEAAqE;YACrE,kBAAkB,CAChB,4BAA4B,EAC5B,kFAAkF,CACnF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,4BAA4B;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,yEAAyE;gBACzE,gEAAgE;gBAChE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACxC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;aAC1D,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,sBAAsB;YACtB,OAAQ,MAAiB,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,yEAAyE;oBACzE,8EAA8E;oBAC9E,QAAQ;oBACR,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,4BAA4B,QAAQ,yBAAyB,CAAC,CACzE,CAAC;oBACF,MAAM;gBACR,KAAK,cAAc;oBACjB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,oFAAoF,CACrF,CACF,CAAC;oBACF,MAAM;gBACR,KAAK,aAAa;oBAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAC/D,CAAC;oBACF,MAAM;gBACR,KAAK,iBAAiB;oBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;oBACpE,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,+BAA+B,KAAK,CAAC,YAAY,WAC/C,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAClC,QAAQ,CACT,CACF,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}

package/dist/core/jwksKid.js

@@ -0,0 +1,40 @@
+import { apiRequest, joinUrl } from "./http.js";
+/**
+ * The signing key id a managed instance is actually publishing.
+ *
+ * Instances pin their kid per tier (`trialkey1`, `paidkey1`), so a scaffold that
+ * hardcodes the dev default writes a value the instance never uses. Nothing verifies
+ * against it, adapters resolve the key from the token header's `kid` through the
+ * remote JWKS, but they also warn on boot when it is left at the dev default, so a
+ * managed scaffold otherwise ships an app that complains it is misconfigured.
+ *
+ * Returns undefined rather than throwing: the kid is cosmetic today, and an instance
+ * that is slow to come up should not fail a scaffold over it.
+ */
+export async function fetchActiveJwksKid(instanceUrl) {
+    let res;
+    try {
+        res = await apiRequest(joinUrl(instanceUrl, "/.well-known/jwks.json"), { method: "GET" });
+    }
+    catch {
+        return undefined;
+    }
+    if (!res.ok || !Array.isArray(res.data?.keys))
+        return undefined;
+    // Take the first RS256 signing key. The endpoint lists the active key first, and
+    // a set carrying a retired key alongside it keeps that one later in the array.
+    for (const key of res.data.keys) {
+        if (!key || typeof key !== "object")
+            continue;
+        const record = key;
+        if (typeof record.kid !== "string" || !record.kid)
+            continue;
+        if (record.use !== undefined && record.use !== "sig")
+            continue;
+        if (record.alg !== undefined && record.alg !== "RS256")
+            continue;
+        return record.kid;
+    }
+    return undefined;
+}
+//# sourceMappingURL=jwksKid.js.map

package/dist/core/jwksKid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwksKid.js","sourceRoot":"","sources":["../../src/core/jwksKid.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CACpB,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAC9C,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhE,iFAAiF;IACjF,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,SAAS;QAC5D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;YAAE,SAAS;QAC/D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;YAAE,SAAS;QACjE,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/keychain.js

@@ -64,8 +64,20 @@ export async function saveTokens(profile, bundle) {
     const b = await loadBackend();
     b.set(accountKey(profile), JSON.stringify(bundle));
 }
+/**
+ * The refresh token supplied by the environment, for a run with no keychain (CI).
+ *
+ * Worth knowing about separately from `getTokens`, because it is read fresh on every
+ * run: the instance rotates the refresh token on every `/refresh` and treats a second
+ * use of a spent one as theft, revoking the whole session chain. So a rotated token
+ * cannot be persisted anywhere this will read it back, and a run that rotates leaves
+ * the environment holding a token that must not be sent again.
+ */
+export function headlessRefreshToken() {
+    return process.env.SEAMLESS_REFRESH_TOKEN?.trim() || undefined;
+}
 export async function getTokens(profile) {
-    const envRefresh = process.env.SEAMLESS_REFRESH_TOKEN?.trim();
+    const envRefresh = headlessRefreshToken();
     if (envRefresh) {
         return { accessToken: "", refreshToken: envRefresh };
     }
@@ -84,29 +96,4 @@ export async function deleteTokens(profile) {
     const b = await loadBackend();
     return b.delete(accountKey(profile));
 }
-export function redactToken(value) {
-    return value ? "[redacted]" : "(none)";
-}
-const TOKEN_KEYS = new Set([
-    "token",
-    "accesstoken",
-    "refreshtoken",
-    "verificationtoken",
-    "authorization",
-]);
-export function scrubTokens(value) {
-    if (Array.isArray(value)) {
-        return value.map((item) => scrubTokens(item));
-    }
-    if (value && typeof value === "object") {
-        const out = {};
-        for (const [key, val] of Object.entries(value)) {
-            out[key] = TOKEN_KEYS.has(key.toLowerCase())
-                ? redactToken(typeof val === "string" ? val : String(val))
-                : scrubTokens(val);
-        }
-        return out;
-    }
-    return value;
-}
 //# sourceMappingURL=keychain.js.map