ticketlens 0.10.4 → 0.11.0

package/skills/jtb/scripts/lib/connection-tester.mjs

@@ -0,0 +1,54 @@
+/**
+ * Tests every configured profile's connection, one at a time with a spinner
+ * per profile — the same pattern init-wizard.mjs/config-wizard.mjs already
+ * use for a single profile, just looped across all of them.
+ */
+
+import { createSession } from './banner.mjs';
+import { classifyError } from './error-classifier.mjs';
+import { resolveAdapter } from './resolve-adapter.mjs';
+import { loadProfiles, loadCredentials } from './profile-resolver.mjs';
+import { DEFAULT_CONFIG_DIR } from './config.mjs';
+
+export async function testConnections({
+  configDir = DEFAULT_CONFIG_DIR,
+  stream = process.stderr,
+  resolveAdapterFn = resolveAdapter,
+} = {}) {
+  const config = loadProfiles(configDir);
+  const names = config ? Object.keys(config.profiles) : [];
+  const creds = loadCredentials(configDir);
+  const results = [];
+
+  for (const name of names) {
+    const profile = config.profiles[name];
+    const profileCreds = creds[name] || {};
+    const conn = {
+      baseUrl: profile.baseUrl,
+      auth: profile.auth,
+      email: profile.email,
+      apiToken: profileCreds.apiToken,
+      pat: profileCreds.pat,
+      allowPrivateIp: profile.allowPrivateIp,
+    };
+
+    const session = createSession(
+      { baseUrl: conn.baseUrl, profileName: name, email: conn.email || undefined, pat: conn.auth === 'pat' ? conn.pat : undefined },
+      { stream },
+    );
+    session.spin('Testing connection...');
+
+    try {
+      await resolveAdapterFn(conn).fetchCurrentUser();
+      session.connected();
+      results.push({ name, ok: true });
+    } catch (err) {
+      session.failed();
+      const classified = classifyError(err, { baseUrl: conn.baseUrl, profileName: name });
+      session.footer(classified.message, 'error', classified.hint);
+      results.push({ name, ok: false, error: classified.message });
+    }
+  }
+
+  return { results, failedCount: results.filter(r => !r.ok).length };
+}

package/skills/jtb/scripts/lib/error-classifier.mjs

@@ -18,6 +18,15 @@ export function classifyError(err, { baseUrl, profileName } = {}) {
   const profile = profileName || 'your profile';
   const code = getNetworkCode(err);
 
+  if (err.code === 'PRIVATE_IP_BLOCKED') {
+    const address = err.blockedAddress ? ` (${err.blockedAddress})` : '';
+    return {
+      message: `${err.blockedHostname} resolves to a private address${address}`,
+      hint: "This is expected if you're on a VPN connecting to an on-prem Jira instance. It could also mean something is wrong.",
+      privateIpBlocked: true,
+    };
+  }
+
   // Network-level errors (fetch threw before getting an HTTP response)
   if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
     return {

package/skills/jtb/scripts/lib/help.mjs

@@ -3,12 +3,11 @@
  */
 
 import { createStyler } from './ansi.mjs';
-import { getVersion } from './config.mjs';
+import { renderWordmark } from './wordmark.mjs';
 
 export function printHelp({ stream = process.stdout } = {}) {
   const isTTY = stream.isTTY;
   const s = createStyler({ isTTY });
-  const v = getVersion();
 
   // Column targets (visible chars):
   //   USAGE: command portion = 36, so descriptions always start at the same column
@@ -18,12 +17,11 @@ export function printHelp({ stream = process.stdout } = {}) {
   // ANSI codes (s.cyan, s.dim) add invisible bytes — they do NOT affect visible width.
 
   const lines = [
-    '',
-    `  ${s.bold(s.brand('◆ TicketLens'))} ${s.dim(`v${v}`)}`,
-    `  ${s.dim('Stop tab-switching. Start building.')}`,
     '',
     `  ${s.bold('USAGE')}`,
     '',
+    `    ${s.brand('tl')} ${s.dim('<anything>')}                       Shorthand for ${s.brand('ticketlens')}`,
+    '',
     // Alignment targets (visible chars before description):
     //   Groups 1–2 (auth/setup):          column 40  (command portion ≤ 24)
     //   Group 3 (daily use):              column 42  (longest: "review [--branch=BRANCH]" = 39)
@@ -56,6 +54,10 @@ export function printHelp({ stream = process.stdout } = {}) {
     `    ${s.brand('ticketlens')} cloud-keys ${s.dim('[add|remove|list|test]')}  Manage your encrypted AI provider keys  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} update-skill ${s.dim('[--dry-run]')}    Update /jtb skill in Claude Code and other AI assistants`,
     '',
+    `  ${s.bold('GLOBAL OPTIONS')}`,
+    '',
+    `    ${s.brand('--no-input')}          Force non-interactive behavior even in a terminal`,
+    '',
     `  ${s.bold('FETCH OPTIONS')}`,
     '',
     // visible widths: "--profile=NAME"=14, "--depth=N"=9, "--plain"=7, "--styled"=8,
@@ -125,7 +127,7 @@ export function printHelp({ stream = process.stdout } = {}) {
     '',
   ];
 
-  stream.write(lines.join('\n') + '\n');
+  stream.write(renderWordmark({ stream }) + lines.join('\n') + '\n');
 }
 
 export function printFetchHelp({ stream = process.stdout } = {}) {

package/skills/jtb/scripts/lib/init-wizard.mjs

@@ -14,8 +14,10 @@ import { loadProfiles, saveProfile, saveDefault } from './profile-resolver.mjs';
 import { resolveAdapter } from './resolve-adapter.mjs';
 import { promptSelect } from './select-prompt.mjs';
 import { runSwitch } from './profile-switcher.mjs';
-import { DEFAULT_CONFIG_DIR } from './config.mjs';
-import { visLen, SERVER_AUTH_TYPES, promptText, promptSecret, promptYN } from './prompt-helpers.mjs';
+import { renderWordmark } from './wordmark.mjs';
+import { printQuickStart } from './quick-start-panel.mjs';
+import { DEFAULT_CONFIG_DIR, hostnameOf } from './config.mjs';
+import { SERVER_AUTH_TYPES, promptText, promptSecret, promptYN } from './prompt-helpers.mjs';
 
 const RETRY_OPTIONS = [
   { label: 'Retry',             sublabel: 'Try again — same credentials (e.g. VPN just connected)', value: 'retry' },
@@ -51,7 +53,7 @@ async function probeProtocol(host, { stream, s }) {
 
 // ── Main wizard ───────────────────────────────────────────────────────────────
 
-export async function run({ configDir = DEFAULT_CONFIG_DIR } = {}) {
+export async function run({ configDir = DEFAULT_CONFIG_DIR, showBanner = true, showQuickStart = true } = {}) {
   const stream = process.stderr;
   const s = createStyler({ isTTY: stream.isTTY });
 
@@ -65,27 +67,22 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR } = {}) {
   process.on('SIGINT', onSigint);
 
   try {
-    await _run({ configDir, stream, s });
+    await _run({ configDir, stream, s, showBanner, showQuickStart });
   } finally {
     process.removeListener('SIGINT', onSigint);
   }
 }
 
-async function _run({ configDir, stream, s }) {
-  // Welcome box
-  const headerLines = [
-    `${s.bold(s.cyan('◆ TicketLens'))} — Setup Wizard`,
-    `${s.dim("Let's configure your tracker connection.")}`,
-  ];
-  const innerWidth = headerLines.reduce((max, l) => Math.max(max, visLen(l)), 0) + 4;
-  const bc = s.cyan;
-  stream.write('\n');
-  stream.write(bc('╭' + '─'.repeat(innerWidth) + '╮') + '\n');
-  for (const line of headerLines) {
-    const pad = innerWidth - visLen(line) - 1;
-    stream.write(bc('│') + ' ' + line + ' '.repeat(Math.max(0, pad)) + bc('│') + '\n');
+async function _run({ configDir, stream, s, showBanner, showQuickStart }) {
+  // Welcome banner — same wordmark as --help/--version, so a brand-new user's
+  // very first output looks like the same product (Phase 1's renderWordmark()
+  // was built reusable for exactly this; not duplicating the art). Suppressed
+  // when invoked from the onboarding hub, which already showed its own banner
+  // — otherwise the user sees it twice in the fresh-install flow.
+  if (showBanner) {
+    stream.write(renderWordmark({ stream }));
+    stream.write(`\n${s.dim("Let's configure your tracker connection.")}\n`);
   }
-  stream.write(bc('╰' + '─'.repeat(innerWidth) + '╯') + '\n');
 
   let addedCount = 0;
   let addAnother = true;
@@ -331,6 +328,12 @@ async function _run({ configDir, stream, s }) {
     let baseUrl = '', authType = '', email = '', token = '';
     let env = {}, apiVersion = 2;
     let startFrom = 'url';
+    // Trust is bound to the exact hostname it was granted for — never a flat
+    // per-run boolean. Choosing "Edit from URL" after granting trust for one
+    // host must re-trigger the private-IP block and a fresh confirmation
+    // for the new host, not silently inherit trust.
+    let trustedHostname = null;
+    const isTrustedForCurrentUrl = () => trustedHostname !== null && hostnameOf(baseUrl) === trustedHostname;
 
     setupLoop: while (true) {
       // ── URL + auth type ────────────────────────────────────────────────────
@@ -435,7 +438,7 @@ async function _run({ configDir, stream, s }) {
       session.spin('Testing connection...');
 
       try {
-        await fetchCurrentUser({ env, apiVersion });
+        await fetchCurrentUser({ env, apiVersion, allowPrivateIp: isTrustedForCurrentUrl() });
         session.connected();
         connected = true;
         break setupLoop;
@@ -443,6 +446,15 @@ async function _run({ configDir, stream, s }) {
         session.failed();
         const classified = classifyError(err, { baseUrl, profileName });
         session.footer(classified.message, 'error', classified.hint);
+
+        if (classified.privateIpBlocked) {
+          const trust = await promptYN('Trust this connection?', { stream });
+          if (trust) {
+            trustedHostname = hostnameOf(baseUrl);
+            startFrom = 'retry';
+            continue setupLoop;
+          }
+        }
       }
 
       // ── Retry options ──────────────────────────────────────────────────────
@@ -506,7 +518,7 @@ async function _run({ configDir, stream, s }) {
 
       stream.write(`  ${s.dim('Validating statuses...')}\n`);
       try {
-        const available = await fetchStatuses({ env, apiVersion });
+        const available = await fetchStatuses({ env, apiVersion, allowPrivateIp: isTrustedForCurrentUrl() });
         const lowerMap = new Map(available.map(n => [n.toLowerCase(), n]));
         stream.write('\x1b[A\r\x1b[2K'); // clear "Validating..." line
         const corrected = [];
@@ -543,6 +555,7 @@ async function _run({ configDir, stream, s }) {
         ...(email ? { email } : {}),
         ...(ticketPrefixes.length > 0 ? { ticketPrefixes } : {}),
         ...(projectPaths.length > 0 ? { projectPaths } : {}),
+        ...(isTrustedForCurrentUrl() ? { allowPrivateIp: true } : {}),
         triageStatuses,
       };
       const credData = authType === 'pat' ? { pat: token } : { apiToken: token };
@@ -575,25 +588,9 @@ async function _run({ configDir, stream, s }) {
   const profileWord = addedCount === 1 ? '1 profile' : `${addedCount} profiles`;
   stream.write(`\n  ${s.green('✔')} ${profileWord} configured.\n\n`);
 
-  // Quick-start panel
-  const cmds = [
-    ['ticketlens triage',   'Scan your assigned tickets'],
-    ['ticketlens <TICKET-KEY>', 'Fetch a specific ticket'],
-    ['ticketlens switch',   'Switch active profile'],
-    ['ticketlens --help',   'Full command reference'],
-  ];
-  const cmdWidth = cmds.reduce((max, [c]) => Math.max(max, c.length), 0);
-  const cmdRows = cmds.map(([cmd, desc]) =>
-    `  ${s.bold(s.cyan(cmd.padEnd(cmdWidth)))}   ${s.dim(desc)}`
-  );
-  const QTITLE = ' Quick start ';
-  const contentWidth = cmdRows.reduce((max, r) => Math.max(max, visLen(r)), 0);
-  const qWidth = Math.max(contentWidth + 2, QTITLE.length + 4);
-  const qPad = (r) => ' ' + r + ' '.repeat(Math.max(0, qWidth - visLen(r) - 1));
-  const qTitleFill = qWidth - 1 - QTITLE.length;
-  stream.write(bc('╭') + bc('─') + s.bold(s.cyan(QTITLE)) + bc('─'.repeat(Math.max(0, qTitleFill))) + bc('╮') + '\n');
-  stream.write(bc('│') + qPad('') + bc('│') + '\n');
-  for (const r of cmdRows) stream.write(bc('│') + qPad(r) + bc('│') + '\n');
-  stream.write(bc('│') + qPad('') + bc('│') + '\n');
-  stream.write(bc('╰') + bc('─'.repeat(qWidth)) + bc('╯') + '\n\n');
+  // Suppressed when invoked from the onboarding hub, which owns showing this
+  // exactly once after its own menu loop exits — otherwise the user sees it twice.
+  if (showQuickStart) {
+    printQuickStart({ stream, s });
+  }
 }

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -125,7 +125,14 @@ function normalizeHostname(hostname) {
   return hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
 }
 
-export function validateBaseUrl(url) {
+/**
+ * @param {string} url
+ * @param {boolean} [allowPrivateIp] - skip the private/internal blocklist check
+ *   for THIS hostname. Set only via explicit interactive user confirmation
+ *   during setup, persisted per-profile — never from synced/network data
+ *   (see team-jira-sync.mjs). HTTPS enforcement is never skippable.
+ */
+export function validateBaseUrl(url, allowPrivateIp = false) {
   let parsed;
   try { parsed = new URL(url); } catch {
     throw new Error(`JIRA_BASE_URL is not a valid URL: ${url}`);
@@ -133,9 +140,14 @@ export function validateBaseUrl(url) {
   if (parsed.protocol !== 'https:') {
     throw new Error(`JIRA_BASE_URL must use HTTPS (got ${parsed.protocol})`);
   }
+  if (allowPrivateIp) return;
   const hostname = normalizeHostname(parsed.hostname);
   if (BLOCKED_PATTERNS.some(re => re.test(hostname))) {
-    throw new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
+    const err = new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
+    err.code = 'PRIVATE_IP_BLOCKED';
+    err.blockedHostname = hostname;
+    err.blockedAddress = null;
+    throw err;
   }
 }
 
@@ -189,9 +201,17 @@ const dnsValidationCaches = new WeakMap();
  * `lookup` is null when the fetcher is mocked (tests) — no socket opens, so
  * there is nothing to protect. Production always uses globalThis.fetch, which
  * always gets the real resolver (see defaultLookupFor).
+ *
+ * `allowPrivateIp` skips the lookup entirely (not just the block) when a
+ * profile has an explicit, user-confirmed trust exception for this exact
+ * hostname — set only during interactive setup, never from synced/network
+ * data. Skipping the resolution outright (rather than resolving-then-
+ * ignoring) avoids the DNS round-trip and sidesteps any question of how the
+ * per-lookup-fn cache should key on a flag that no real caller varies
+ * concurrently for the same hostname.
  */
-export async function validateResolvedHost(hostname, lookup) {
-  if (!lookup) return;
+export async function validateResolvedHost(hostname, lookup, allowPrivateIp = false) {
+  if (!lookup || allowPrivateIp) return;
   let cache = dnsValidationCaches.get(lookup);
   if (!cache) {
     cache = new Map();
@@ -202,7 +222,11 @@ export async function validateResolvedHost(hostname, lookup) {
       const addresses = await lookup(hostname, { all: true });
       for (const { address } of addresses) {
         if (BLOCKED_PATTERNS.some(re => re.test(address))) {
-          throw new Error(`Hostname ${hostname} resolves to a blocked address (${address}) — refusing to connect`);
+          const err = new Error(`Hostname ${hostname} resolves to a blocked address (${address}) — refusing to connect`);
+          err.code = 'PRIVATE_IP_BLOCKED';
+          err.blockedHostname = hostname;
+          err.blockedAddress = address;
+          throw err;
         }
       }
     })();
@@ -223,8 +247,8 @@ export async function validateResolvedHost(hostname, lookup) {
  * Error message carries the redirect target's HOSTNAME only — Location values
  * can contain presigned tokens in path/query.
  */
-export async function guardedFetch(url, fetchOpts, { fetcher, lookup }) {
-  await validateResolvedHost(new URL(url).hostname, lookup);
+export async function guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp = false }) {
+  await validateResolvedHost(new URL(url).hostname, lookup, allowPrivateIp);
   const response = await fetcher(url, { ...fetchOpts, redirect: 'manual' });
   if (response.status >= 300 && response.status < 400) {
     let target = 'unknown host';
@@ -248,15 +272,15 @@ export function buildAuthHeader(env) {
 }
 
 export async function fetchCurrentUser(opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
-  validateBaseUrl(env.JIRA_BASE_URL);
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000, allowPrivateIp = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
   const url = `${baseUrl}/rest/api/${apiVersion}/myself`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching current user`);
@@ -274,15 +298,15 @@ export async function fetchCurrentUser(opts = {}) {
 }
 
 export async function fetchStatuses(opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
-  validateBaseUrl(env.JIRA_BASE_URL);
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000, allowPrivateIp = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
   const url = `${baseUrl}/rest/api/${apiVersion}/status`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching statuses`);
@@ -295,8 +319,8 @@ export async function fetchStatuses(opts = {}) {
 }
 
 export async function searchTickets(jql, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
-  validateBaseUrl(env.JIRA_BASE_URL);
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, allowPrivateIp = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -307,7 +331,7 @@ export async function searchTickets(jql, opts = {}) {
   const url = `${baseUrl}${endpoint}?${params}`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
 
   if (!response.ok) {
     let detail = '';
@@ -323,15 +347,15 @@ export async function searchTickets(jql, opts = {}) {
 }
 
 export async function fetchRemoteLinks(ticketKey, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000 } = opts;
-  validateBaseUrl(env.JIRA_BASE_URL);
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000, allowPrivateIp = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}/remotelink`;
 
   const fetchOpts = { headers: { ...buildAuthHeader(env), 'Content-Type': 'application/json' } };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
 
-  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
   if (!response.ok) return [];
 
   const raw = await response.json();
@@ -341,8 +365,8 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
 }
 
 export async function fetchTicket(ticketKey, opts = {}) {
-  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
-  validateBaseUrl(env.JIRA_BASE_URL);
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, allowPrivateIp = false, _visited = new Set(), _currentDepth = 0 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -350,7 +374,7 @@ export async function fetchTicket(ticketKey, opts = {}) {
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}${expand}`;
   const fetchOpts = { headers };
   if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
-  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup });
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
 
   if (!response.ok) {
     const err = new Error(`Jira API error ${response.status} fetching ${ticketKey}`);

package/skills/jtb/scripts/lib/login-flow.mjs

@@ -0,0 +1,98 @@
+/**
+ * ticketlens login — connect the CLI to a TicketLens account.
+ * Extracted out of bin/ticketlens.mjs so the onboarding hub can reuse it
+ * without duplicating the browser/manual flow or token verification.
+ */
+
+import { createStyler } from './ansi.mjs';
+import { promptSecret } from './prompt-helpers.mjs';
+import { browserLogin } from './browser-login.mjs';
+import { saveCliToken } from './cli-auth.mjs';
+import { getApiBase, getConsoleBase } from './sync.mjs';
+import { applyTeamConfigOnLogin } from './team-jira-sync.mjs';
+
+export async function runLogin({
+  manual = false,
+  stream = process.stderr,
+  showSyncHint = true,
+  browserLoginFn = browserLogin,
+  fetchFn = globalThis.fetch,
+  promptSecretFn = promptSecret,
+  saveCliTokenFn = saveCliToken,
+  applyTeamConfigOnLoginFn = applyTeamConfigOnLogin,
+} = {}) {
+  const s = createStyler({ isTTY: stream.isTTY });
+
+  let token;
+
+  if (manual) {
+    // ── manual paste flow (CI / headless environments) ──────────────────
+    stream.write(`\n  ${s.bold('TicketLens Login')}\n`);
+    stream.write(`  ${s.dim('─'.repeat(44))}\n`);
+    stream.write(`  ${s.dim(`Generate a CLI token at ${s.cyan(`${getConsoleBase()}/console/account`)}`)}\n`);
+    stream.write(`  ${s.dim('then paste it below.')}\n\n`);
+
+    token = await promptSecretFn(`CLI Token ${s.dim('(tl_…)')}:`, { stream });
+    if (!token.startsWith('tl_')) {
+      stream.write(`  ${s.red('✖')} Token must start with ${s.dim('tl_')}\n`);
+      process.exitCode = 1;
+      return;
+    }
+  } else {
+    // ── browser flow (default) ────────────────────────────────────────
+    stream.write(`\n  ${s.bold('TicketLens Login')}\n`);
+    stream.write(`  ${s.dim('─'.repeat(44))}\n`);
+    stream.write(`  Opening browser to authorize…\n\n`);
+    stream.write(`  ${s.dim('○ Waiting for authorization (120s)…')}\n`);
+
+    try {
+      token = await browserLoginFn();
+    } catch (err) {
+      const cancelled = err.message === 'Authorization cancelled';
+      stream.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} ${cancelled ? 'Login cancelled.' : err.message}\n`);
+      if (!cancelled) {
+        stream.write(`\n  ${s.dim(`Try ${s.cyan('ticketlens login --manual')} to paste a token instead.`)}\n\n`);
+      }
+      process.exitCode = cancelled ? 0 : 1;
+      return;
+    }
+  }
+
+  // ── verify token against API (both flows) ─────────────────────────
+  stream.write(`\n  ${s.dim('○ Verifying token…')}\n`);
+  let res;
+  try {
+    res = await fetchFn(`${getApiBase()}/v1/profiles`, {
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(15000),
+    });
+  } catch {
+    stream.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Could not reach ${getApiBase()} — check your connection.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (res.status === 401) {
+    stream.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Invalid token — check the value and try again.\n`);
+    process.exitCode = 1;
+    return;
+  }
+  if (!res.ok) {
+    stream.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Server returned ${res.status}. Try again later.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  saveCliTokenFn(token);
+  stream.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Logged in.\n`);
+
+  // Flow 1: pull team Jira config for Pro/Team members (silently skipped for Free)
+  const tcLogin = await applyTeamConfigOnLoginFn().catch(() => null);
+  if (tcLogin?.ok) {
+    stream.write(`  ${s.dim(`○ Team Jira config applied for ${s.cyan(tcLogin.groupName)}.`)}\n`);
+  }
+
+  if (showSyncHint) {
+    stream.write(`\n  Run ${s.cyan('ticketlens sync')} to pull your connections.\n\n`);
+  }
+}