seamless-cli 0.5.2 → 0.7.0

package/dist/core/authClient.js

@@ -0,0 +1,113 @@
+import { getActiveProfile } from "./config.js";
+import { deleteTokens, getTokens, KeychainUnavailableError, saveTokens, } from "./keychain.js";
+import { apiRequest, joinUrl } from "./http.js";
+export class ReauthRequiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ReauthRequiredError";
+    }
+}
+export function tokensFromAuthResponse(data) {
+    if (!data)
+        return null;
+    const accessToken = typeof data.token === "string" ? data.token : undefined;
+    const refreshToken = typeof data.refreshToken === "string" ? data.refreshToken : undefined;
+    if (!accessToken || !refreshToken)
+        return null;
+    const now = Date.now();
+    const ttl = typeof data.ttl === "number" ? data.ttl : undefined;
+    const refreshTtl = typeof data.refreshTtl === "number" ? data.refreshTtl : undefined;
+    return {
+        accessToken,
+        refreshToken,
+        accessTokenExpiresAt: ttl !== undefined ? now + ttl * 1000 : undefined,
+        refreshTokenExpiresAt: refreshTtl !== undefined ? now + refreshTtl * 1000 : undefined,
+    };
+}
+export async function createAuthClient(opts = {}) {
+    const profile = getActiveProfile(opts);
+    if (!profile) {
+        throw new ReauthRequiredError("No active profile is configured. Add one with: seamless profile add <name> --instance-url <url>, then run seamless login.");
+    }
+    let tokens = await getTokens(profile);
+    if (!tokens || !tokens.refreshToken) {
+        throw new ReauthRequiredError(`No session for profile "${profile.name}". Run: seamless login.`);
+    }
+    const session = tokens;
+    const persist = async (next) => {
+        session.accessToken = next.accessToken;
+        session.refreshToken = next.refreshToken;
+        session.accessTokenExpiresAt = next.accessTokenExpiresAt;
+        session.refreshTokenExpiresAt = next.refreshTokenExpiresAt;
+        try {
+            await saveTokens(profile, next);
+        }
+        catch (err) {
+            if (!(err instanceof KeychainUnavailableError))
+                throw err;
+        }
+    };
+    const clearSession = async () => {
+        try {
+            await deleteTokens(profile);
+        }
+        catch (err) {
+            if (!(err instanceof KeychainUnavailableError))
+                throw err;
+        }
+    };
+    const refresh = async () => {
+        const res = await apiRequest(joinUrl(profile.instanceUrl, "/refresh"), {
+            method: "POST",
+            headers: { Authorization: `Bearer ${session.refreshToken}` },
+        });
+        if (!res.ok) {
+            await clearSession();
+            throw new ReauthRequiredError(`Your session for "${profile.name}" has expired or was revoked. Run: seamless login.`);
+        }
+        const next = tokensFromAuthResponse(res.data);
+        if (!next) {
+            await clearSession();
+            throw new ReauthRequiredError(`Received an unexpected refresh response from ${profile.instanceUrl}. Run: seamless login.`);
+        }
+        await persist(next);
+    };
+    const authedFetch = async (path, init = {}) => {
+        const build = () => ({
+            ...init,
+            headers: {
+                ...init.headers,
+                Authorization: `Bearer ${session.accessToken}`,
+            },
+        });
+        const url = joinUrl(profile.instanceUrl, path);
+        let res = await apiRequest(url, build());
+        if (res.status === 401 && session.refreshToken) {
+            await refresh();
+            res = await apiRequest(url, build());
+        }
+        return res;
+    };
+    return {
+        profile,
+        request: authedFetch,
+        get: (path, init = {}) => authedFetch(path, { ...init, method: "GET" }),
+        post: (path, body, init = {}) => {
+            const headers = {
+                ...init.headers,
+            };
+            let bodyInit = init.body;
+            if (body !== undefined) {
+                headers["Content-Type"] = "application/json";
+                bodyInit = JSON.stringify(body);
+            }
+            return authedFetch(path, {
+                ...init,
+                method: "POST",
+                headers,
+                body: bodyInit,
+            });
+        },
+    };
+}
+//# sourceMappingURL=authClient.js.map

package/dist/core/authClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authClient.js","sourceRoot":"","sources":["../../src/core/authClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,YAAY,EACZ,SAAS,EACT,wBAAwB,EACxB,UAAU,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAoB,MAAM,WAAW,CAAC;AAElE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAaD,MAAM,UAAU,sBAAsB,CACpC,IAAoC;IAEpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,OAAO;QACL,WAAW;QACX,YAAY;QACZ,oBAAoB,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QACtE,qBAAqB,EACnB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,OAAO,CAAC,IAAI,yBAAyB,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC;IAEvB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;QACzD,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACzC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACzD,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EACxC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE;SAC7D,CACF,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,qBAAqB,OAAO,CAAC,IAAI,oDAAoD,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,gDAAgD,OAAO,CAAC,WAAW,wBAAwB,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,IAAY,EACZ,OAAoB,EAAE,EACG,EAAE;QAC3B,MAAM,KAAK,GAAG,GAAgB,EAAE,CAAC,CAAC;YAChC,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAI,IAAI,CAAC,OAA8C;gBACvD,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,OAAO,EAAE,CAAC;YAChB,GAAG,GAAG,MAAM,UAAU,CAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACvE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;YAC9B,MAAM,OAAO,GAA2B;gBACtC,GAAI,IAAI,CAAC,OAA8C;aACxD,CAAC;YACF,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,WAAW,CAAC,IAAI,EAAE;gBACvB,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/config.js

@@ -0,0 +1,146 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+export const DEFAULT_PROFILE_NAME = "default";
+export function getConfigDir() {
+    const xdg = process.env.XDG_CONFIG_HOME?.trim();
+    const base = xdg ? xdg : path.join(os.homedir(), ".config");
+    return path.join(base, "seamless");
+}
+export function getConfigPath() {
+    return path.join(getConfigDir(), "config.json");
+}
+function emptyConfig() {
+    return { activeProfile: DEFAULT_PROFILE_NAME, profiles: {} };
+}
+function coerceProfile(name, value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const raw = value;
+    if (typeof raw.instanceUrl !== "string")
+        return undefined;
+    const profile = { name, instanceUrl: raw.instanceUrl };
+    if (typeof raw.sub === "string")
+        profile.sub = raw.sub;
+    if (typeof raw.email === "string")
+        profile.email = raw.email;
+    if (raw.identifierType === "email" || raw.identifierType === "phone") {
+        profile.identifierType = raw.identifierType;
+    }
+    return profile;
+}
+function normalizeLoaded(parsed) {
+    if (!parsed || typeof parsed !== "object")
+        return emptyConfig();
+    const raw = parsed;
+    const profiles = {};
+    if (raw.profiles && typeof raw.profiles === "object") {
+        for (const [name, value] of Object.entries(raw.profiles)) {
+            const profile = coerceProfile(name, value);
+            if (profile)
+                profiles[name] = profile;
+        }
+    }
+    const active = typeof raw.activeProfile === "string" && raw.activeProfile
+        ? raw.activeProfile
+        : DEFAULT_PROFILE_NAME;
+    return { activeProfile: active, profiles };
+}
+export function loadConfig() {
+    const file = getConfigPath();
+    if (!fs.existsSync(file))
+        return emptyConfig();
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf-8");
+    }
+    catch (err) {
+        throw new Error(`Unable to read config at ${file}: ${err.message}`);
+    }
+    try {
+        return normalizeLoaded(JSON.parse(raw));
+    }
+    catch {
+        throw new Error(`Config at ${file} is not valid JSON. Fix or remove it and try again.`);
+    }
+}
+export function saveConfig(config) {
+    const dir = getConfigDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = getConfigPath();
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+export function listProfiles(config = loadConfig()) {
+    return Object.values(config.profiles);
+}
+export function getProfile(name, config = loadConfig()) {
+    return config.profiles[name];
+}
+export function upsertProfile(profile) {
+    const config = loadConfig();
+    config.profiles[profile.name] = profile;
+    if (!config.profiles[config.activeProfile]) {
+        config.activeProfile = profile.name;
+    }
+    saveConfig(config);
+    return config;
+}
+export function removeProfile(name) {
+    const config = loadConfig();
+    if (!config.profiles[name]) {
+        throw new Error(`Profile "${name}" does not exist.`);
+    }
+    delete config.profiles[name];
+    if (config.activeProfile === name) {
+        config.activeProfile = Object.keys(config.profiles)[0] ?? DEFAULT_PROFILE_NAME;
+    }
+    saveConfig(config);
+    return config;
+}
+export function setActiveProfile(name) {
+    const config = loadConfig();
+    if (!config.profiles[name]) {
+        throw new Error(`Profile "${name}" does not exist. Add it with "seamless profile add ${name}".`);
+    }
+    config.activeProfile = name;
+    saveConfig(config);
+    return config;
+}
+export function resolveActiveProfileName(opts = {}, config = loadConfig()) {
+    return (opts.profileFlag?.trim() ||
+        process.env.SEAMLESS_PROFILE?.trim() ||
+        config.activeProfile ||
+        DEFAULT_PROFILE_NAME);
+}
+export function getActiveProfile(opts = {}) {
+    const config = loadConfig();
+    return config.profiles[resolveActiveProfileName(opts, config)];
+}
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+export function normalizeInstanceUrl(input) {
+    const trimmed = (input ?? "").trim();
+    if (!trimmed) {
+        throw new Error("Instance URL is required.");
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`Invalid instance URL: "${input}". Include the scheme, for example https://auth.example.com.`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error(`Instance URL must use http or https, got "${url.protocol}".`);
+    }
+    const host = url.hostname;
+    const isLocal = LOCAL_HOSTS.has(host) || host.endsWith(".localhost");
+    if (url.protocol === "http:" && !isLocal) {
+        throw new Error(`Instance URL must use https for non-local host "${host}".`);
+    }
+    url.hash = "";
+    url.search = "";
+    return url.toString().replace(/\/+$/, "");
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAiBxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,WAAW,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,GAAG,CAAC,QAAmC,CACxC,EAAE,CAAC;YACF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa;QACxD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,oBAAoB,CAAC;IAE3B,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,EAAE,CAAC;IAE/C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,qDAAqD,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAyB,UAAU,EAAE;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,SAAyB,UAAU,EAAE;IAErC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IACtC,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACjF,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,uDAAuD,IAAI,IAAI,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAiC,EAAE,EACnC,SAAyB,UAAU,EAAE;IAErC,OAAO,CACL,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACpC,MAAM,CAAC,aAAa;QACpB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,8DAA8D,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,QAAQ,IAAI,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,IAAI,CAC5D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/core/http.js

@@ -0,0 +1,34 @@
+export function joinUrl(base, path) {
+    if (/^https?:\/\//i.test(path))
+        return path;
+    return `${base}${path.startsWith("/") ? "" : "/"}${path}`;
+}
+export async function safeJson(res) {
+    const text = await res.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+export async function apiRequest(url, init = {}) {
+    const res = await fetch(url, init);
+    const data = await safeJson(res);
+    return { ok: res.ok, status: res.status, data, headers: res.headers };
+}
+export function isRateLimited(res) {
+    return res.status === 429;
+}
+export function jsonBody(method, body, headers = {}) {
+    const init = { method, headers: { ...headers } };
+    if (body !== undefined) {
+        init.headers["Content-Type"] =
+            "application/json";
+        init.body = JSON.stringify(body);
+    }
+    return init;
+}
+//# sourceMappingURL=http.js.map

package/dist/core/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,GAAa;IACvD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAI,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAgC;IAC5D,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,MAAc,EACd,IAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC;YACtD,kBAAkB,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/images.js

@@ -7,5 +7,5 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-
 // CLI version always produces the same project. Override the ref with
 // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR.
 export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates";
-export const SEAMLESS_TEMPLATES_REF = "v0.2.3";
+export const SEAMLESS_TEMPLATES_REF = "v0.2.4";
 //# sourceMappingURL=images.js.map

package/dist/core/keychain.js

@@ -0,0 +1,112 @@
+const SERVICE = "seamless-cli";
+export class KeychainUnavailableError extends Error {
+    constructor(cause) {
+        super("No OS keychain is available. Set SEAMLESS_REFRESH_TOKEN to authenticate in a headless environment, or run on a machine with a keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service).");
+        this.name = "KeychainUnavailableError";
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+export function accountKey(profile) {
+    return `${profile.name}::${profile.instanceUrl}`;
+}
+function isNoEntry(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return /no (matching )?entry/i.test(message) || /not found/i.test(message);
+}
+let backend = null;
+async function loadBackend() {
+    if (backend)
+        return backend;
+    let Entry;
+    try {
+        ({ Entry } = await import("@napi-rs/keyring"));
+    }
+    catch (err) {
+        throw new KeychainUnavailableError(err);
+    }
+    backend = {
+        get(account) {
+            try {
+                return new Entry(SERVICE, account).getPassword();
+            }
+            catch (err) {
+                if (isNoEntry(err))
+                    return null;
+                throw new KeychainUnavailableError(err);
+            }
+        },
+        set(account, secret) {
+            try {
+                new Entry(SERVICE, account).setPassword(secret);
+            }
+            catch (err) {
+                throw new KeychainUnavailableError(err);
+            }
+        },
+        delete(account) {
+            try {
+                return new Entry(SERVICE, account).deletePassword();
+            }
+            catch (err) {
+                if (isNoEntry(err))
+                    return false;
+                throw new KeychainUnavailableError(err);
+            }
+        },
+    };
+    return backend;
+}
+export function setBackendForTesting(fake) {
+    backend = fake;
+}
+export async function saveTokens(profile, bundle) {
+    const b = await loadBackend();
+    b.set(accountKey(profile), JSON.stringify(bundle));
+}
+export async function getTokens(profile) {
+    const envRefresh = process.env.SEAMLESS_REFRESH_TOKEN?.trim();
+    if (envRefresh) {
+        return { accessToken: "", refreshToken: envRefresh };
+    }
+    const b = await loadBackend();
+    const raw = b.get(accountKey(profile));
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function deleteTokens(profile) {
+    const b = await loadBackend();
+    return b.delete(accountKey(profile));
+}
+export function redactToken(value) {
+    return value ? "[redacted]" : "(none)";
+}
+const TOKEN_KEYS = new Set([
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "verificationtoken",
+    "authorization",
+]);
+export function scrubTokens(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => scrubTokens(item));
+    }
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, val] of Object.entries(value)) {
+            out[key] = TOKEN_KEYS.has(key.toLowerCase())
+                ? redactToken(typeof val === "string" ? val : String(val))
+                : scrubTokens(val);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/core/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/core/keychain.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,cAAc,CAAC;AAS/B,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,KAAe;QACzB,KAAK,CACH,+MAA+M,CAChN,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,CAAC;CACF;AAQD,MAAM,UAAU,UAAU,CACxB,OAA8C;IAE9C,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,IAAI,OAAO,GAA2B,IAAI,CAAC;AAE3C,KAAK,UAAU,WAAW;IACxB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,IAAI,KAA8C,CAAC;IACnD,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG;QACR,GAAG,CAAC,OAAO;YACT,IAAI,CAAC;gBACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAChC,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,GAAG,CAAC,OAAO,EAAE,MAAM;YACjB,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,OAAO;YACZ,IAAI,CAAC;gBACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjC,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA4B;IAC/D,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA8C,EAC9C,MAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA8C;IAE9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA8C;IAE9C,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAqB;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,OAAO;IACP,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAI,KAAQ;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAiB,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC1C,CAAC,CAAC,WAAW,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1D,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/loginFlow.js

@@ -0,0 +1,143 @@
+import { apiRequest, isRateLimited, joinUrl, jsonBody } from "./http.js";
+import { tokensFromAuthResponse } from "./authClient.js";
+export const EPHEMERAL_WINDOW_MS = 5 * 60 * 1000;
+export const DEFAULT_MAX_ATTEMPTS = 3;
+export class LoginError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "LoginError";
+    }
+}
+function apiMessage(data) {
+    if (data && typeof data === "object") {
+        const record = data;
+        if (typeof record.error === "string")
+            return record.error;
+        if (typeof record.message === "string")
+            return record.message;
+    }
+    return undefined;
+}
+async function request(instanceUrl, url, init) {
+    try {
+        return await apiRequest(url, init);
+    }
+    catch {
+        throw new LoginError(`Could not reach ${instanceUrl}. Check the instance URL and your connection.`);
+    }
+}
+async function startLogin(instanceUrl, identifier, now) {
+    const res = await request(instanceUrl, joinUrl(instanceUrl, "/login"), jsonBody("POST", { identifier }));
+    if (isRateLimited(res)) {
+        throw new LoginError("The instance is rate limiting requests. Wait a few minutes and try again.");
+    }
+    if (!res.ok) {
+        const message = apiMessage(res.data) ?? "";
+        if (res.status === 401 && /verify/i.test(message)) {
+            throw new LoginError(`The account for ${identifier} is not verified yet. Finish registration, then log in.`);
+        }
+        if (res.status === 400) {
+            throw new LoginError(`"${identifier}" is not a valid email or phone number.`);
+        }
+        if (res.status === 401 || res.status === 403) {
+            throw new LoginError(`No account was found for ${identifier}, or login is not permitted.`);
+        }
+        throw new LoginError(`Login request failed (${res.status}).`);
+    }
+    const data = res.data ?? {};
+    const ephemeralToken = typeof data.token === "string" ? data.token : "";
+    if (!ephemeralToken) {
+        throw new LoginError("The instance did not return a login token.");
+    }
+    const loginMethods = Array.isArray(data.loginMethods)
+        ? data.loginMethods.filter((m) => typeof m === "string")
+        : [];
+    const channel = data.identifierType === "phone" ? "phone" : "email";
+    const sub = typeof data.sub === "string" ? data.sub : undefined;
+    return {
+        ephemeralToken,
+        loginMethods,
+        channel,
+        sub,
+        deadline: now() + EPHEMERAL_WINDOW_MS,
+    };
+}
+async function sendCode(instanceUrl, started) {
+    const path = started.channel === "email"
+        ? "/otp/generate-login-email-otp"
+        : "/otp/generate-login-phone-otp";
+    const res = await request(instanceUrl, joinUrl(instanceUrl, path), {
+        method: "GET",
+        headers: { Authorization: `Bearer ${started.ephemeralToken}` },
+    });
+    if (isRateLimited(res)) {
+        throw new LoginError("Too many code requests. The instance limits OTP to 10 per 15 minutes per IP. Wait and try again.");
+    }
+    if (!res.ok) {
+        if (res.status === 403) {
+            const label = started.channel === "email" ? "Email" : "Phone";
+            throw new LoginError(`${label} OTP login is disabled on this instance.`);
+        }
+        const message = apiMessage(res.data);
+        throw new LoginError(message ? `Could not send a code: ${message}` : "Could not send a login code.");
+    }
+    const refreshed = typeof res.data?.token === "string" ? res.data.token : undefined;
+    if (refreshed)
+        started.ephemeralToken = refreshed;
+}
+async function verifyCode(instanceUrl, started, code) {
+    const path = started.channel === "email"
+        ? "/otp/verify-login-email-otp"
+        : "/otp/verify-login-phone-otp";
+    return request(instanceUrl, joinUrl(instanceUrl, path), jsonBody("POST", { verificationToken: code }, { Authorization: `Bearer ${started.ephemeralToken}` }));
+}
+export async function completeLogin(opts) {
+    const now = opts.now ?? (() => Date.now());
+    const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    const notify = opts.notify ?? (() => { });
+    let started = await startLogin(opts.instanceUrl, opts.identifier, now);
+    const channel = started.channel;
+    const required = channel === "email" ? "email_otp" : "phone_otp";
+    if (started.loginMethods.length > 0 && !started.loginMethods.includes(required)) {
+        throw new LoginError(`This account cannot use ${required.replace("_", " ")} login. Available methods: ${started.loginMethods.join(", ")}.`);
+    }
+    await sendCode(opts.instanceUrl, started);
+    notify({ type: "code_sent", channel });
+    let attempt = 0;
+    let resent = false;
+    while (attempt < maxAttempts) {
+        const code = await opts.getCode({ attempt: attempt + 1, resent });
+        resent = false;
+        if (code === null)
+            return null;
+        if (now() >= started.deadline) {
+            started = await startLogin(opts.instanceUrl, opts.identifier, now);
+            await sendCode(opts.instanceUrl, started);
+            resent = true;
+            notify({ type: "code_resent", channel });
+            continue;
+        }
+        notify({ type: "verifying" });
+        const res = await verifyCode(opts.instanceUrl, started, code);
+        if (res.status === 200 && res.data) {
+            const tokens = tokensFromAuthResponse(res.data);
+            if (!tokens) {
+                throw new LoginError("The instance returned an unexpected verification response.");
+            }
+            const email = typeof res.data.email === "string" ? res.data.email : undefined;
+            const sub = typeof res.data.sub === "string" ? res.data.sub : started.sub;
+            return {
+                tokens,
+                identity: { sub, email, identifierType: channel },
+                channel,
+            };
+        }
+        if (isRateLimited(res)) {
+            throw new LoginError("Too many attempts. The instance limits OTP to 10 per 15 minutes per IP. Wait and try again.");
+        }
+        attempt++;
+        notify({ type: "incorrect", attemptsLeft: maxAttempts - attempt });
+    }
+    throw new LoginError("Could not verify a code. Run seamless login to try again.");
+}
+//# sourceMappingURL=loginFlow.js.map

package/dist/core/loginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/core/loginFlow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAItC,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AA+BD,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC1D,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,WAAmB,EACnB,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAA0B,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,mBAAmB,WAAW,+CAA+C,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAmB,EACnB,UAAkB,EAClB,GAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,WAAW,EACX,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,EAC9B,QAAQ,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CACjC,CAAC;IAEF,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,UAAU,CAClB,mBAAmB,UAAU,yDAAyD,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,IAAI,UAAU,yCAAyC,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAClB,4BAA4B,UAAU,8BAA8B,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhE,OAAO;QACL,cAAc;QACd,YAAY;QACZ,OAAO;QACP,GAAG;QACH,QAAQ,EAAE,GAAG,EAAE,GAAG,mBAAmB;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,WAAmB,EACnB,OAAqB;IAErB,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,OAAO;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,+BAA+B,CAAC;IAEtC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,cAAc,EAAE,EAAE;KAC/D,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,UAAU,CAClB,OAAO,CAAC,CAAC,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,SAAS;QAAE,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAmB,EACnB,OAAqB,EACrB,IAAY;IAEZ,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,OAAO;QACzB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,6BAA6B,CAAC;IAEpC,OAAO,OAAO,CACZ,WAAW,EACX,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAC1B,QAAQ,CACN,MAAM,EACN,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAC3B,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,cAAc,EAAE,EAAE,CACtD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEzC,IAAI,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAClB,2BAA2B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,8BAA8B,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,OAAO,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,GAAG,KAAK,CAAC;QACf,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9B,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACnE,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QAED,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1E,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE;gBACjD,OAAO;aACR,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,2DAA2D,CAAC,CAAC;AACpF,CAAC"}

package/dist/core/output.js

@@ -79,6 +79,52 @@ export function printSuccessOutput(config) {
     console.log(kleur.dim("Docs: ") + kleur.cyan("https://docs.seamlessauth.com\n"));
     console.log(kleur.bold().green("Setup complete.\n"));
 }
+export function printManagedSuccessOutput(config) {
+    const { projectName, webFramework, apiFramework, authServerUrl, appName } = config;
+    const title = kleur.bold().cyan("SEAMLESS");
+    console.log(`
+╔════════════════════════════════════════╗
+║          ${title}                      ║
+╚════════════════════════════════════════╝
+`);
+    console.log(kleur.green("Project connected to a managed instance.\n"));
+    console.log(kleur.dim("Managed application: ") + kleur.bold(appName));
+    console.log(kleur.dim("Auth server:         ") + kleur.cyan(authServerUrl));
+    console.log("");
+    if (projectName) {
+        console.log(kleur.dim("Project directory: ") + kleur.bold(projectName));
+        console.log(kleur.cyan(`cd ${projectName}\n`));
+    }
+    console.log(kleur.bold("Included services:\n"));
+    if (webFramework) {
+        console.log("  • " +
+            kleur.white("Web application") +
+            kleur.dim(` (${formatFramework(webFramework)})`));
+    }
+    if (apiFramework) {
+        console.log("  • " +
+            kleur.white("API server") +
+            kleur.dim(` (${formatFramework(apiFramework)})`));
+    }
+    console.log("  • " + kleur.white("Auth server") + kleur.dim(" (managed instance)"));
+    console.log("");
+    console.log(kleur.bold("Next steps:\n"));
+    if (apiFramework) {
+        console.log(kleur.dim("  # API server"));
+        console.log("  cd api && npm install && npm run dev\n");
+    }
+    if (webFramework) {
+        console.log(kleur.dim("  # Web app"));
+        console.log("  cd web && npm install && npm run dev\n");
+    }
+    console.log("  Sign in from the web app to confirm the session resolves.\n");
+    console.log(kleur.bold("Notes:\n"));
+    console.log(kleur.dim("  • The API service token was written to api/.env. Keep it out of version control."));
+    console.log(kleur.dim("  • Auth, users, and OAuth providers are managed from the dashboard, not locally."));
+    console.log(kleur.dim("  • Rotate the service token anytime with the dashboard.\n"));
+    console.log(kleur.dim("Docs: ") + kleur.cyan("https://docs.seamlessauth.com\n"));
+    console.log(kleur.bold().green("Setup complete.\n"));
+}
 function formatFramework(name) {
     const map = {
         react: "React",