sitevision-cli 1.0.0-beta.6 → 1.0.0-beta.8

package/dist/commands/deploy.d.ts

@@ -8,10 +8,9 @@ interface DeployScreenProps {
     force: boolean;
     production: boolean;
     activate: boolean;
-    signingPassword?: string;
     onBack?: () => void;
     onRetryCredentials?: () => void;
 }
-export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }: DeployScreenProps): React.JSX.Element;
+export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, }: DeployScreenProps): React.JSX.Element;
 export declare const deployCommand: Command;
 export {};

package/dist/commands/deploy.js

@@ -8,12 +8,21 @@ import { zipExists } from '../utils/zip.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
 import { setDeployPassword, deleteSessionCookie } from '../utils/keychain.js';
 import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
-import { resolveSessionCookie } from '../utils/session-cookie-auth.js';
-export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }) {
+import { AuthLoginScreen } from '../components/AuthLoginScreen.js';
+export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, }) {
     const [state, setState] = React.useState({
         status: 'deploying',
         message: production ? 'Deploying to production...' : 'Deploying to dev...',
     });
+    // 'init' resolves cached credentials, 'login' shows the Ink login screen,
+    // 'deploy' runs the upload. Token/cookie login now happens here, so both the
+    // TUI and the standalone command reach it.
+    const [phase, setPhase] = React.useState('init');
+    const [credential, setCredential] = React.useState({
+        accessToken: devProperties.accessToken,
+        sessionCookie: devProperties.sessionCookie,
+    });
+    const deployStartedRef = React.useRef(false);
     useInput((input, key) => {
         if (state.status !== 'deploying') {
             if (onBack && (key.escape || input === 'q')) {
@@ -24,43 +33,48 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
             }
         }
     });
+    // Decide once whether we can deploy straight away or must log in first.
     React.useEffect(() => {
+        const authMethod = devProperties.authMethod ?? 'basic';
+        if (authMethod === 'basic' || devProperties.sessionCookie) {
+            setPhase('deploy');
+            return;
+        }
+        if (authMethod === 'cookie') {
+            // env/keychain cookie is already loaded in devProperties; none here.
+            setPhase('login');
+            return;
+        }
+        if (authMethod === 'oauth2') {
+            if (devProperties.accessToken) {
+                setPhase('deploy');
+                return;
+            }
+            void (async () => {
+                const token = await resolveOAuth2AccessToken(devProperties);
+                if (token) {
+                    setCredential({ accessToken: token });
+                    setPhase('deploy');
+                }
+                else {
+                    setPhase('login');
+                }
+            })();
+            return;
+        }
+        setPhase('deploy');
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    React.useEffect(() => {
+        if (phase !== 'deploy' || deployStartedRef.current)
+            return;
+        deployStartedRef.current = true;
         async function runDeploy() {
             try {
                 const appType = getAppType(manifest);
-                // Resolve an OAuth2 token silently (env/keychain refresh). A fresh
-                // browser login happens only in the direct `svc deploy` command, which
-                // sets accessToken before rendering — the Ink menu can't own the
-                // terminal for a login, so it resolves refresh-only here.
                 const authMethod = devProperties.authMethod ?? 'basic';
-                let accessToken = devProperties.accessToken;
-                if (authMethod === 'oauth2' && !accessToken) {
-                    accessToken =
-                        (await resolveOAuth2AccessToken(devProperties, {
-                            interactive: false,
-                        })) ?? undefined;
-                    if (!accessToken) {
-                        setState({
-                            status: 'error',
-                            error: 'No OAuth2 access token. Run `svc deploy` from a terminal to log in, or set SITEVISION_ACCESS_TOKEN.',
-                        });
-                        return;
-                    }
-                }
-                let sessionCookie = devProperties.sessionCookie;
-                if (authMethod === 'cookie' && !sessionCookie) {
-                    sessionCookie =
-                        (await resolveSessionCookie(devProperties, {
-                            interactive: false,
-                        })) ?? undefined;
-                    if (!sessionCookie) {
-                        setState({
-                            status: 'error',
-                            error: 'No session cookie. Run `svc deploy` from a terminal to log in, or set SITEVISION_SESSION_COOKIE.',
-                        });
-                        return;
-                    }
-                }
+                // Credential resolved in the init effect / login screen.
+                const { accessToken, sessionCookie } = credential;
                 // A stale session fails without a clean 401 — clear the stored cookie
                 // so the next run re-authenticates. Skip when SITEVISION_SESSION_COOKIE
                 // is set: detection re-reads it first, so clearing would just replay
@@ -154,15 +168,25 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
             }
         }
         runDeploy();
-    }, [
-        projectRoot,
-        manifest,
-        devProperties,
-        force,
-        production,
-        activate,
-        signingPassword,
-    ]);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [phase]);
+    if (phase === 'login' && state.status !== 'error') {
+        return (_jsx(AuthLoginScreen, { method: (devProperties.authMethod ?? 'basic') === 'cookie'
+                ? 'cookie'
+                : 'oauth2', devProperties: devProperties, onComplete: cred => {
+                setCredential(cred);
+                setPhase('deploy');
+            }, onError: message => {
+                setState({ status: 'error', error: message });
+            }, onCancel: () => {
+                if (onBack) {
+                    onBack();
+                }
+                else {
+                    setState({ status: 'error', error: 'Login cancelled.' });
+                }
+            } }));
+    }
     return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: state.status === 'deploying' ? 'running' : state.status, label: state.status === 'deploying'
                         ? 'Deploying'
                         : state.status === 'success'
@@ -200,32 +224,11 @@ export const deployCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
-        // Resolve deploy credentials. A token/cookie from env/--flag (already
-        // loaded in detectProject / cli) short-circuits everything.
+        // Basic auth prompts for a password here; OAuth2 and cookie resolve or log
+        // in inside DeployScreen (Ink-native), so both the TUI and this command
+        // share one login path. env/--flag token/cookie are already loaded.
         const authMethod = project.devProperties.authMethod ?? 'basic';
-        if (project.devProperties.accessToken ||
-            project.devProperties.sessionCookie) {
-            // Nothing to acquire — a bearer token or session cookie is in hand.
-        }
-        else if (authMethod === 'oauth2') {
-            const token = await resolveOAuth2AccessToken(project.devProperties);
-            if (!token) {
-                console.log('\n\x1b[31mError: No OAuth2 access token available.\x1b[0m');
-                console.log('Set SITEVISION_ACCESS_TOKEN, pass --token, or configure the oauth2 endpoints in .dev_properties.json to log in.\n');
-                return;
-            }
-            project.devProperties.accessToken = token;
-        }
-        else if (authMethod === 'cookie') {
-            const cookie = await resolveSessionCookie(project.devProperties);
-            if (!cookie) {
-                console.log('\n\x1b[31mError: No session cookie available.\x1b[0m');
-                console.log('Log in when the browser opens, or set SITEVISION_SESSION_COOKIE / pass --cookie.\n');
-                return;
-            }
-            project.devProperties.sessionCookie = cookie;
-        }
-        else if (!project.devProperties.password) {
+        if (authMethod === 'basic' && !project.devProperties.password) {
             const { domain, username } = project.devProperties;
             console.log('');
             const password = await promptPassword(`Deploy password for ${username}@${domain}: `);
@@ -242,15 +245,8 @@ export const deployCommand = {
         const production = Boolean(flags['production']);
         const force = Boolean(flags['force']);
         const activate = Boolean(flags['activate']);
-        // For production, we need the signed zip, which requires signing credentials
-        let signingPassword;
-        if (production &&
-            project.hasSigningProperties &&
-            project.devProperties.signingUsername) {
-            // We already have a signed zip, no need to prompt for password here
-            // The sign command should have been run separately
-        }
-        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate, signingPassword: signingPassword }));
+        // Production deploys use the already-signed zip; `sign` is run separately.
+        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate }));
         await waitUntilExit();
     },
 };

package/dist/components/AuthLoginScreen.d.ts

@@ -0,0 +1,21 @@
+import React from 'react';
+import type { DevProperties } from '../types/index.js';
+interface Credential {
+    accessToken?: string;
+    sessionCookie?: string;
+}
+interface Props {
+    method: 'oauth2' | 'cookie';
+    devProperties: DevProperties;
+    onComplete: (credential: Credential) => void;
+    onError: (message: string) => void;
+    onCancel: () => void;
+}
+/**
+ * Ink-native interactive login for OAuth2 and session-cookie auth. Drives the
+ * browser and (for cookie) the "press Enter to capture" handoff through Ink's
+ * own input, so it works inside the TUI as well as the standalone command —
+ * neither needs to own raw stdin the way the old console prompt did.
+ */
+export declare function AuthLoginScreen({ method, devProperties, onComplete, onError, onCancel, }: Props): React.JSX.Element;
+export {};

package/dist/components/AuthLoginScreen.js

@@ -0,0 +1,87 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React from 'react';
+import { Box, Text, useInput } from 'ink';
+import Spinner from 'ink-spinner';
+import { beginOAuth2Login, openBrowser } from '../utils/oauth2-auth.js';
+import { beginCookieLogin, } from '../utils/session-cookie-auth.js';
+/**
+ * Ink-native interactive login for OAuth2 and session-cookie auth. Drives the
+ * browser and (for cookie) the "press Enter to capture" handoff through Ink's
+ * own input, so it works inside the TUI as well as the standalone command —
+ * neither needs to own raw stdin the way the old console prompt did.
+ */
+export function AuthLoginScreen({ method, devProperties, onComplete, onError, onCancel, }) {
+    const [phase, setPhase] = React.useState('starting');
+    const [authUrl, setAuthUrl] = React.useState('');
+    const [note, setNote] = React.useState('');
+    const cookieRef = React.useRef(null);
+    const cancelOAuthRef = React.useRef(null);
+    React.useEffect(() => {
+        void (async () => {
+            if (method === 'oauth2') {
+                const session = beginOAuth2Login(devProperties);
+                if (!session) {
+                    onError('OAuth2 is not fully configured (authorization/token endpoint or client ID missing).');
+                    return;
+                }
+                cancelOAuthRef.current = session.cancel;
+                setAuthUrl(session.authUrl);
+                openBrowser(session.authUrl);
+                setPhase('awaiting');
+                const token = await session.complete();
+                cancelOAuthRef.current = null;
+                if (token) {
+                    onComplete({ accessToken: token });
+                }
+                else {
+                    onError('OAuth2 login failed, timed out, or was rejected.');
+                }
+            }
+            else {
+                const session = await beginCookieLogin(devProperties);
+                if (!session) {
+                    onError('Could not open a login browser (is Chrome installed?). Set SITEVISION_SESSION_COOKIE or pass --cookie with a cookie copied from your browser.');
+                    return;
+                }
+                cookieRef.current = session;
+                setPhase('awaiting');
+            }
+        })();
+        // Release resources if the screen unmounts before completing: close the
+        // browser (cookie) and the loopback server (oauth2, frees the port).
+        return () => {
+            void cookieRef.current?.close();
+            cookieRef.current = null;
+            cancelOAuthRef.current?.();
+            cancelOAuthRef.current = null;
+        };
+        // Run once: the parent mounts this fresh when a login is needed.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    useInput((_input, key) => {
+        if (key.escape) {
+            onCancel();
+            return;
+        }
+        if (method === 'cookie' && phase === 'awaiting' && key.return) {
+            const session = cookieRef.current;
+            if (!session)
+                return;
+            setPhase('capturing');
+            void (async () => {
+                const result = await session.capture();
+                if (result.cookie) {
+                    cookieRef.current = null;
+                    await session.close();
+                    onComplete({ sessionCookie: result.cookie });
+                }
+                else {
+                    // Keep the browser open so the user can navigate and retry.
+                    setNote(result.error ?? 'No session cookie found.');
+                    setPhase('awaiting');
+                }
+            })();
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: method === 'oauth2' ? 'OAuth2 login' : 'Session cookie login' }) }), method === 'oauth2' ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Waiting for you to finish login in the browser\u2026" })] }), authUrl && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "If the browser didn't open, visit:" }), _jsx(Text, { children: authUrl })] }))] })) : (_jsxs(Box, { flexDirection: "column", children: [phase === 'starting' && (_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Opening browser\u2026" })] })), phase === 'awaiting' && (_jsx(Text, { children: "Log in in the opened browser, then press Enter to capture the session." })), phase === 'capturing' && (_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Capturing session\u2026" })] })), note && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: note }) }))] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Press Esc to cancel." }) })] }));
+}

package/dist/utils/oauth2-auth.d.ts

@@ -6,15 +6,22 @@ export declare function createPkcePair(): {
     verifier: string;
     challenge: string;
 };
+export declare function openBrowser(url: string): void;
 /**
- * Return a usable OAuth2 access token, or null if one can't be obtained.
- *
- * Order: silent refresh from the keychain refresh token, then (when
- * `interactive`) a browser login. The access token is never persisted; the
- * refresh token is stored in the keychain for next time. Pass
- * `interactive: false` from contexts that can't own the terminal (the Ink
- * menu) to get refresh-only resolution with no browser.
+ * Start an interactive OAuth2 login. Returns the authorize URL to open and a
+ * `complete()` that awaits the loopback redirect, exchanges the code, stores the
+ * refresh token, and resolves the access token. UI-agnostic, so an Ink screen
+ * can drive it without owning the terminal.
  */
-export declare function resolveOAuth2AccessToken(dev: DevProperties, options?: {
-    interactive?: boolean;
-}): Promise<string | null>;
+export declare function beginOAuth2Login(dev: DevProperties): {
+    authUrl: string;
+    complete: () => Promise<string | null>;
+    cancel: () => void;
+} | null;
+/**
+ * Silently resolve an access token by refreshing the keychain refresh token.
+ * Returns null when there's no refresh token or it's expired/revoked (in which
+ * case the stale token is dropped). Interactive login lives in `beginOAuth2Login`,
+ * driven by the Ink login screen — the access token is never persisted.
+ */
+export declare function resolveOAuth2AccessToken(dev: DevProperties): Promise<string | null>;

package/dist/utils/oauth2-auth.js

@@ -44,7 +44,7 @@ async function postToken(config, params, secret) {
         return null;
     }
 }
-function openBrowser(url) {
+export function openBrowser(url) {
     const isWin = process.platform === 'win32';
     const cmd = process.platform === 'darwin' ? 'open' : isWin ? 'cmd' : 'xdg-open';
     const args = isWin ? ['/c', 'start', '', url] : [url];
@@ -55,106 +55,118 @@ function openBrowser(url) {
         // Fall back to the printed URL.
     }
 }
-/** Serve the loopback redirect once, resolving the authorization code. */
-function waitForCode(port, state) {
-    return new Promise(resolve => {
-        let settled = false;
-        const finish = (code) => {
+/**
+ * Serve the loopback redirect once. Returns the awaited code and a `close()`
+ * that shuts the server down (freeing the port) if the login is cancelled — so
+ * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ */
+function startLoopback(port, state) {
+    let finish;
+    let settled = false;
+    const code = new Promise(resolve => {
+        finish = (value) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timer);
             server.close();
-            resolve(code);
+            resolve(value);
         };
-        const server = http.createServer((req, res) => {
-            const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
-            if (url.pathname !== '/callback') {
-                res.writeHead(404).end();
-                return;
-            }
-            const ok = url.searchParams.get('state') === state;
-            const code = url.searchParams.get('code');
-            const message = ok && code
-                ? 'Login complete. You can close this window and return to the terminal.'
-                : 'Login failed. Check the terminal.';
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
-            finish(ok ? code : null);
-        });
-        const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
-        server.on('error', () => finish(null));
-        server.listen(port, '127.0.0.1');
     });
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        if (url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const ok = url.searchParams.get('state') === state;
+        const authCode = url.searchParams.get('code');
+        const message = ok && authCode
+            ? 'Login complete. You can close this window and return to the terminal.'
+            : 'Login failed. Check the terminal.';
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
+        finish(ok ? authCode : null);
+    });
+    const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
+    server.on('error', () => finish(null));
+    server.listen(port, '127.0.0.1');
+    return { code, close: () => finish(null) };
 }
-async function interactiveLogin(config, secret) {
+/**
+ * Start an interactive OAuth2 login. Returns the authorize URL to open and a
+ * `complete()` that awaits the loopback redirect, exchanges the code, stores the
+ * refresh token, and resolves the access token. UI-agnostic, so an Ink screen
+ * can drive it without owning the terminal.
+ */
+export function beginOAuth2Login(dev) {
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
     const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
     const redirectUri = `http://127.0.0.1:${port}/callback`;
     const { verifier, challenge } = createPkcePair();
     const state = base64url(crypto.randomBytes(16));
-    const authUrl = new URL(config.authorizationEndpoint);
-    authUrl.searchParams.set('response_type', 'code');
-    authUrl.searchParams.set('client_id', config.clientId);
-    authUrl.searchParams.set('redirect_uri', redirectUri);
-    authUrl.searchParams.set('state', state);
-    authUrl.searchParams.set('code_challenge', challenge);
-    authUrl.searchParams.set('code_challenge_method', 'S256');
+    const url = new URL(config.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', config.clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
     if (config.scopes?.length) {
-        authUrl.searchParams.set('scope', config.scopes.join(' '));
+        url.searchParams.set('scope', config.scopes.join(' '));
     }
-    const codePromise = waitForCode(port, state);
-    openBrowser(authUrl.href);
-    console.log(`\nOpening browser to log in. If it doesn't open, visit:\n${authUrl.href}\n`);
-    const code = await codePromise;
-    if (!code)
-        return null;
-    return postToken(config, {
-        grant_type: 'authorization_code',
-        code,
-        redirect_uri: redirectUri,
-        client_id: config.clientId,
-        code_verifier: verifier,
-    }, secret);
+    const loopback = startLoopback(port, state);
+    const complete = async () => {
+        const code = await loopback.code;
+        if (!code)
+            return null;
+        const tokens = await postToken(config, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: config.clientId,
+            code_verifier: verifier,
+        }, secret);
+        if (!tokens?.access_token)
+            return null;
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return tokens.access_token;
+    };
+    return { authUrl: url.href, complete, cancel: loopback.close };
 }
 /**
- * Return a usable OAuth2 access token, or null if one can't be obtained.
- *
- * Order: silent refresh from the keychain refresh token, then (when
- * `interactive`) a browser login. The access token is never persisted; the
- * refresh token is stored in the keychain for next time. Pass
- * `interactive: false` from contexts that can't own the terminal (the Ink
- * menu) to get refresh-only resolution with no browser.
+ * Silently resolve an access token by refreshing the keychain refresh token.
+ * Returns null when there's no refresh token or it's expired/revoked (in which
+ * case the stale token is dropped). Interactive login lives in `beginOAuth2Login`,
+ * driven by the Ink login screen — the access token is never persisted.
  */
-export async function resolveOAuth2AccessToken(dev, options = {}) {
-    const { interactive = true } = options;
+export async function resolveOAuth2AccessToken(dev) {
     const config = dev.oauth2;
     if (!hasOAuth2Config(config))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
-    if (storedRefresh) {
-        const tokens = await postToken(config, {
-            grant_type: 'refresh_token',
-            refresh_token: storedRefresh,
-            client_id: config.clientId,
-        }, secret);
-        if (tokens?.access_token) {
-            if (tokens.refresh_token) {
-                setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
-            }
-            return tokens.access_token;
-        }
-        // Stale/expired refresh token — drop it and log in fresh.
-        deleteOAuth2RefreshToken(domain, config.clientId);
-    }
-    if (!interactive || !process.stdin.isTTY)
-        return null;
-    const tokens = await interactiveLogin(config, secret);
-    if (!tokens?.access_token)
+    if (!storedRefresh)
         return null;
-    if (tokens.refresh_token) {
-        setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+    const tokens = await postToken(config, {
+        grant_type: 'refresh_token',
+        refresh_token: storedRefresh,
+        client_id: config.clientId,
+    }, secret);
+    if (tokens?.access_token) {
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return tokens.access_token;
     }
-    return tokens.access_token;
+    // Stale/expired refresh token — drop it so the next run logs in fresh.
+    deleteOAuth2RefreshToken(domain, config.clientId);
+    return null;
 }

package/dist/utils/session-cookie-auth.d.ts

@@ -1,9 +1,34 @@
 import type { DevProperties } from '../types/index.js';
+interface RawCookie {
+    name: string;
+    value: string;
+    domain: string;
+}
+export interface CaptureResult {
+    cookie?: string;
+    note?: string;
+    error?: string;
+}
+export interface CookieLoginSession {
+    capture: () => Promise<CaptureResult>;
+    close: () => Promise<void>;
+}
 /**
- * Return a usable session cookie, or null. Order: keychain (a prior capture),
- * then (when `interactive`) a browser login. Pass `interactive: false` from the
- * Ink menu, which can't own the terminal for the "press Enter" handoff.
+ * Pick the session from a cookie jar: find JSESSIONID (preferring the deploy
+ * host), then return every cookie on that host as a `Cookie:` header. On miss,
+ * return diagnostics naming the domains actually seen. Pure — no keychain, no
+ * browser — so it's unit-testable.
  */
-export declare function resolveSessionCookie(dev: DevProperties, options?: {
-    interactive?: boolean;
-}): Promise<string | null>;
+export declare function selectSessionCookie(all: RawCookie[], siteDomain: string): CaptureResult;
+/**
+ * Launch a real browser at the login URL for an interactive SAML/SSO login and
+ * return handles to capture the session and close the browser. UI-agnostic: the
+ * Ink login screen decides when to `capture()` (on the user's keypress) and
+ * `close()`. Returns null if the browser can't be launched.
+ *
+ * `capture()` reads the whole cookie jar via CDP (httponly and secure included),
+ * stores the session in the keychain on success, and otherwise returns
+ * diagnostics naming the cookie domains it actually saw.
+ */
+export declare function beginCookieLogin(dev: DevProperties): Promise<CookieLoginSession | null>;
+export {};

package/dist/utils/session-cookie-auth.js

@@ -1,72 +1,99 @@
-import { getSessionCookie, setSessionCookie } from './keychain.js';
-import { promptEnter } from './password-prompt.js';
-/** Match cookies set on the site host or any parent domain. */
-function domainMatches(cookieDomain, siteDomain) {
-    const bare = cookieDomain.replace(/^\./, '');
-    return siteDomain === bare || siteDomain.endsWith(`.${bare}`);
+import { setSessionCookie } from './keychain.js';
+function bareDomain(domain) {
+    return domain.replace(/^\./, '');
+}
+/** Related if either host is the other or a subdomain of it (both directions). */
+function domainRelated(a, b) {
+    const x = bareDomain(a);
+    const y = bareDomain(b);
+    return x === y || x.endsWith(`.${y}`) || y.endsWith(`.${x}`);
+}
+/**
+ * Pick the session from a cookie jar: find JSESSIONID (preferring the deploy
+ * host), then return every cookie on that host as a `Cookie:` header. On miss,
+ * return diagnostics naming the domains actually seen. Pure — no keychain, no
+ * browser — so it's unit-testable.
+ */
+export function selectSessionCookie(all, siteDomain) {
+    const sessions = all.filter(c => c.name === 'JSESSIONID');
+    if (sessions.length === 0) {
+        const domains = [...new Set(all.map(c => bareDomain(c.domain)))];
+        return {
+            error: `No JSESSIONID among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
+        };
+    }
+    const chosen = sessions.find(c => domainRelated(c.domain, siteDomain)) ?? sessions[0];
+    const cookies = all.filter(c => domainRelated(c.domain, chosen.domain));
+    return {
+        cookie: cookies.map(c => `${c.name}=${c.value}`).join('; '),
+        note: `Captured session on ${bareDomain(chosen.domain)} (${cookies.length} cookies).`,
+    };
+}
+/** Read every cookie in the browser jar (httponly and secure included). */
+async function readAllCookies(browser, page) {
+    // puppeteer >= 22 exposes the whole jar directly.
+    if (typeof browser.cookies === 'function') {
+        try {
+            return (await browser.cookies());
+        }
+        catch {
+            // Fall through to CDP.
+        }
+    }
+    const client = await page.createCDPSession();
+    const { cookies } = await client.send('Network.getAllCookies');
+    return cookies;
 }
 /**
- * Open a real browser at the login URL, let the user complete SSO, then read
- * the session cookies (JSESSIONID and any siblings) via CDP — which returns
- * httponly cookies that page JavaScript can't see. Returns a `Cookie:` header
- * value, or null if capture failed.
+ * Launch a real browser at the login URL for an interactive SAML/SSO login and
+ * return handles to capture the session and close the browser. UI-agnostic: the
+ * Ink login screen decides when to `capture()` (on the user's keypress) and
+ * `close()`. Returns null if the browser can't be launched.
+ *
+ * `capture()` reads the whole cookie jar via CDP (httponly and secure included),
+ * stores the session in the keychain on success, and otherwise returns
+ * diagnostics naming the cookie domains it actually saw.
  */
-async function captureViaBrowser(loginUrl, siteDomain) {
+export async function beginCookieLogin(dev) {
+    const { domain, username } = dev;
+    if (!domain || !username)
+        return null;
     let puppeteer;
     try {
         ({ default: puppeteer } = await import('puppeteer-core'));
     }
     catch {
-        console.log('\x1b[31mpuppeteer-core is not installed. Run `npm i puppeteer-core`, or pass --cookie / set SITEVISION_SESSION_COOKIE.\x1b[0m');
         return null;
     }
     let browser;
     try {
         browser = await puppeteer.launch({ headless: false, channel: 'chrome' });
         const page = await browser.newPage();
+        const loginUrl = dev.sessionLoginUrl || `https://${domain}/`;
         await page.goto(loginUrl, { waitUntil: 'domcontentloaded' }).catch(() => {
             // A SAML redirect may abort the initial navigation — that's fine.
         });
-        await promptEnter('\nLog in in the opened browser, then press Enter here to capture the session: ');
-        const client = await page.createCDPSession();
-        const { cookies } = await client.send('Network.getAllCookies');
-        const wanted = cookies.filter(c => domainMatches(c.domain, siteDomain));
-        if (wanted.every(c => c.name !== 'JSESSIONID')) {
-            console.log('\x1b[31mNo JSESSIONID found for this site. Was the login completed?\x1b[0m');
-            return null;
-        }
-        return wanted.map(c => `${c.name}=${c.value}`).join('; ');
-    }
-    catch (error) {
-        console.log(`\x1b[31mBrowser login failed: ${error instanceof Error ? error.message : String(error)}\x1b[0m`);
-        return null;
+        const capture = async () => {
+            const all = await readAllCookies(browser, page);
+            const result = selectSessionCookie(all, domain);
+            if (result.cookie) {
+                setSessionCookie(domain, username, result.cookie);
+            }
+            return result;
+        };
+        const close = async () => {
+            await browser.close().catch(() => {
+                // Best-effort close.
+            });
+        };
+        return { capture, close };
     }
-    finally {
+    catch {
         if (browser) {
             await browser.close().catch(() => {
                 // Best-effort close.
             });
         }
-    }
-}
-/**
- * Return a usable session cookie, or null. Order: keychain (a prior capture),
- * then (when `interactive`) a browser login. Pass `interactive: false` from the
- * Ink menu, which can't own the terminal for the "press Enter" handoff.
- */
-export async function resolveSessionCookie(dev, options = {}) {
-    const { interactive = true } = options;
-    const { domain, username } = dev;
-    if (!domain || !username)
-        return null;
-    const stored = getSessionCookie(domain, username);
-    if (stored)
-        return stored;
-    if (!interactive || !process.stdin.isTTY)
         return null;
-    const loginUrl = dev.sessionLoginUrl || `https://${domain}/`;
-    const cookie = await captureViaBrowser(loginUrl, domain);
-    if (cookie)
-        setSessionCookie(domain, username, cookie);
-    return cookie;
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.0-beta.6",
+	"version": "1.0.0-beta.8",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"