unfazed 0.6.0 → 0.6.1

package/dist/cli/login.js

@@ -0,0 +1,596 @@
+/// <reference types="node" />
+/**
+ * `npx unfazed login`, `whoami` and `logout`: the CLI behind the package's
+ * `unfazed` bin. Only `../cli.ts` loads this module — `import "unfazed"`
+ * never does — so it may use Node built-ins directly.
+ *
+ * Login is the OAuth 2.1 authorization code flow with PKCE against the
+ * platform's own authorization server (the one MCP clients sign in through):
+ *
+ *  - discovery: RFC 8414 metadata at `/.well-known/oauth-authorization-server`;
+ *  - a public client registered once per server (RFC 7591) with the loopback
+ *    redirect `http://127.0.0.1/callback`, cached beside the login. unfazed,
+ *    as RFC 8252 §7.3 asks, matches a loopback redirect on everything but the
+ *    port, so every login listens on a fresh random port under one client;
+ *  - PKCE S256 (RFC 7636), `state`, and RFC 9207's `iss` on the answer;
+ *  - a one-shot listener on 127.0.0.1 receives the code, which is exchanged
+ *    for an access and a refresh token, stored 0600 where the SDK reads them
+ *    (`../credentials.ts`);
+ *  - when the browser runs on another machine (SSH), the person pastes the
+ *    address it ended up on — the loopback URL that cannot load there.
+ *
+ * Logout revokes (RFC 7009) when the server advertises revocation, then
+ * deletes the login. Every request names itself in User-Agent: the
+ * platform's edge refuses some generic agents.
+ */
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { DEFAULT_ENDPOINT, ENDPOINT_ENV_VAR, TOKEN_ENV_VAR, UnfazedClient, VERSION } from "../client.js";
+import { LOGIN_COMMAND, credentialsDir, credentialsPath, deleteCredentials, oauthErrorText, postTokenForm, readCredentials, tokenFields, writeCredentials, } from "../credentials.js";
+import { UnfazedAuthError, UnfazedError, UnfazedHTTPError } from "../errors.js";
+export const USER_AGENT = `unfazed-cli/${VERSION} (+https://unfazed.dev/auth.md)`;
+/** What a login asks for: reading and deploying, like an MCP client. */
+export const DEFAULT_SCOPE = "unfz:read unfz:deploy";
+export const CLIENT_NAME = "unfazed CLI";
+export const CALLBACK_PATH = "/callback";
+/** The redirect registered once; each login uses it with its own port. */
+export const REGISTERED_REDIRECT_URI = `http://127.0.0.1${CALLBACK_PATH}`;
+/** Registered clients, per issuer, beside the login. */
+export const CLIENTS_FILE = "oauth-clients.json";
+/** How long a login waits for the browser. */
+export const LOGIN_TIMEOUT_MS = 10 * 60_000;
+/** A login that could not be completed; the message says why and what to do. */
+export class UnfazedLoginError extends UnfazedError {
+}
+const globalFetch = () => globalThis.fetch.bind(globalThis);
+/* ------------------------------------------------------------------ OAuth */
+/** The GraphQL endpoint: given, else `UNFZ_API_URL`, else unfazed.dev's; a bare origin gets `/query`. */
+export function resolveEndpoint(raw, env) {
+    const value = (raw ?? env[ENDPOINT_ENV_VAR] ?? DEFAULT_ENDPOINT).trim().replace(/\/+$/, "");
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new UnfazedLoginError(`unfazed: ${value} is not a URL. Pass the platform's address, e.g. --endpoint https://unfazed.dev`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+        throw new UnfazedLoginError(`unfazed: ${value} is not an http(s) URL.`);
+    // As the SDK reads UNFZ_API_URL: the full /query URL, or an origin.
+    return /\/query$|\/graphql$/.test(value) ? value : `${value}/query`;
+}
+/** Whether a URL may carry tokens: https, or plain http to this machine only. */
+export function safeURL(raw) {
+    if (typeof raw !== "string")
+        return false;
+    try {
+        const url = new URL(raw);
+        if (url.protocol === "https:")
+            return true;
+        return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** Reads and checks the metadata of the server at `origin` (e.g. https://unfazed.dev). */
+export async function discover(origin, fetch) {
+    const url = `${origin}/.well-known/oauth-authorization-server`;
+    let status;
+    let text;
+    try {
+        const response = await fetch(url, { method: "GET", headers: { Accept: "application/json", "User-Agent": USER_AGENT } });
+        status = response.status;
+        text = await response.text();
+    }
+    catch (error) {
+        throw new UnfazedLoginError(`unfazed: could not reach ${origin} (${error.message}).`, { cause: error });
+    }
+    if (status !== 200)
+        throw new UnfazedLoginError(`unfazed: ${url} answered HTTP ${status}; is ${origin} an unfazed server?`);
+    let metadata;
+    try {
+        metadata = JSON.parse(text);
+    }
+    catch {
+        throw new UnfazedLoginError(`unfazed: ${url} is not JSON; is ${origin} an unfazed server?`);
+    }
+    // RFC 8414 §3.3: the issuer must be the one asked, or the metadata is not its.
+    if (typeof metadata.issuer !== "string" || metadata.issuer.replace(/\/+$/, "") !== origin) {
+        throw new UnfazedLoginError(`unfazed: ${url} names issuer ${JSON.stringify(metadata.issuer)}, not ${origin}.`);
+    }
+    for (const field of ["authorization_endpoint", "token_endpoint"]) {
+        if (!safeURL(metadata[field]))
+            throw new UnfazedLoginError(`unfazed: ${url} has no usable ${field}.`);
+    }
+    for (const field of ["registration_endpoint", "revocation_endpoint"]) {
+        if (metadata[field] !== undefined && !safeURL(metadata[field]))
+            delete metadata[field];
+    }
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256")) {
+        throw new UnfazedLoginError(`unfazed: ${origin} does not support PKCE S256, which the login requires.`);
+    }
+    if (metadata.response_types_supported && !metadata.response_types_supported.includes("code")) {
+        throw new UnfazedLoginError(`unfazed: ${origin} does not support the authorization code flow.`);
+    }
+    return { ...metadata, issuer: origin };
+}
+/** A PKCE verifier and its S256 challenge. */
+export function pkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+function clientsPath(env) {
+    const dir = credentialsDir(env);
+    return dir ? join(dir, CLIENTS_FILE) : undefined;
+}
+function readClients(env) {
+    const path = clientsPath(env);
+    if (!path)
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        // Missing or unreadable: register again, which costs one request.
+        return {};
+    }
+}
+function writeClients(env, clients) {
+    const path = clientsPath(env);
+    if (!path)
+        return;
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temp, JSON.stringify(clients, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+        chmodSync(temp, 0o600);
+        renameSync(temp, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temp);
+        }
+        catch {
+            // never created, or already renamed
+        }
+        throw error;
+    }
+}
+/** The cached client for `issuer` that may ask for `scope`, if any. */
+export function cachedClient(env, issuer, scope) {
+    const record = readClients(env)[issuer];
+    if (!record || typeof record.client_id !== "string" || record.redirect_uri !== REGISTERED_REDIRECT_URI)
+        return undefined;
+    const registered = new Set(String(record.scope ?? "").split(/\s+/));
+    return scope.split(/\s+/).every((s) => registered.has(s)) ? record : undefined;
+}
+function forgetClient(env, issuer) {
+    const clients = readClients(env);
+    if (!(issuer in clients))
+        return;
+    delete clients[issuer];
+    writeClients(env, clients);
+}
+/** Registers the CLI as a public client at the server (RFC 7591) and caches it. */
+async function registerClient(metadata, scope, env, fetch) {
+    if (!metadata.registration_endpoint) {
+        throw new UnfazedLoginError(`unfazed: ${metadata.issuer} offers no client registration, which the login needs.`);
+    }
+    const response = await fetch(metadata.registration_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": USER_AGENT },
+        body: JSON.stringify({
+            client_name: CLIENT_NAME,
+            redirect_uris: [REGISTERED_REDIRECT_URI],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+            application_type: "native",
+            scope,
+        }),
+    });
+    const body = parseObject(await response.text());
+    if (response.status !== 201 && response.status !== 200) {
+        throw new UnfazedLoginError(`unfazed: ${metadata.issuer} refused to register the CLI (${oauthErrorText(response.status, body)}).`);
+    }
+    if (typeof body["client_id"] !== "string" || !body["client_id"]) {
+        throw new UnfazedLoginError(`unfazed: ${metadata.issuer} registered the CLI without a client_id.`);
+    }
+    const record = {
+        client_id: body["client_id"],
+        redirect_uri: REGISTERED_REDIRECT_URI,
+        scope: typeof body["scope"] === "string" && body["scope"] ? body["scope"] : scope,
+        registered_at: new Date().toISOString(),
+    };
+    const clients = readClients(env);
+    clients[metadata.issuer] = record;
+    writeClients(env, clients);
+    return record;
+}
+function authorizeURL(metadata, params) {
+    const url = new URL(metadata.authorization_endpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", params.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("scope", params.scope);
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("code_challenge", params.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.toString();
+}
+/**
+ * One GET of the consent page before a browser sees it. A server that forgot
+ * the cached client, or refuses the redirect, answers 400 here, so the CLI can
+ * register again or say why instead of leaving the person on an error page.
+ */
+async function preflight(url, fetch) {
+    const response = await fetch(url, { method: "GET", headers: { Accept: "text/html", "User-Agent": USER_AGENT }, redirect: "manual" });
+    const text = await response.text();
+    if (response.status < 400)
+        return { ok: true };
+    return { ok: false, reason: oauthErrorText(response.status, parseObject(text)) };
+}
+async function exchangeCode(metadata, params, fetch) {
+    const { status, body } = await postTokenForm(fetch, metadata.token_endpoint, { grant_type: "authorization_code", code: params.code, redirect_uri: params.redirectUri, client_id: params.clientId, code_verifier: params.verifier }, USER_AGENT);
+    if (status !== 200 || typeof body["access_token"] !== "string" || !body["access_token"]) {
+        throw new UnfazedLoginError(`unfazed: ${metadata.issuer} did not issue tokens (${oauthErrorText(status, body)}). Run \`${LOGIN_COMMAND}\` again.`);
+    }
+    return body;
+}
+async function revokeToken(endpoint, params, fetch) {
+    try {
+        const { status } = await postTokenForm(fetch, endpoint, { token: params.token, token_type_hint: params.hint, client_id: params.clientId }, USER_AGENT);
+        return status === 200;
+    }
+    catch {
+        return false;
+    }
+}
+/** Signs in through the browser and stores the login. Resolves to it and where it was stored. */
+export async function login(options = {}) {
+    const env = options.env ?? process.env;
+    const fetch = options.fetch ?? globalFetch();
+    const log = options.log ?? ((line) => process.stderr.write(line + "\n"));
+    const scopes = (options.scope ?? DEFAULT_SCOPE).split(/[\s,]+/).filter(Boolean);
+    if (scopes.length === 0)
+        throw new UnfazedLoginError("unfazed: --scope names no scope.");
+    const scope = [...new Set(scopes)].join(" ");
+    const endpoint = resolveEndpoint(options.endpoint, env);
+    const origin = new URL(endpoint).origin;
+    const path = credentialsPath(env);
+    if (!path)
+        throw new UnfazedLoginError("unfazed: no home directory to store the login in (set HOME or XDG_CONFIG_HOME).");
+    const metadata = await discover(origin, fetch);
+    const listener = await listen();
+    try {
+        const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
+        const { verifier, challenge } = pkcePair();
+        const state = randomBytes(24).toString("base64url");
+        // A cached client the server no longer knows is registered again, once.
+        let cached = cachedClient(env, metadata.issuer, scope);
+        let client;
+        let url;
+        for (let attempt = 0;; attempt++) {
+            client = cached ?? (await registerClient(metadata, scope, env, fetch));
+            url = authorizeURL(metadata, { clientId: client.client_id, redirectUri, scope, state, challenge });
+            const checked = await preflight(url, fetch);
+            if (checked.ok)
+                break;
+            if (attempt > 0)
+                throw new UnfazedLoginError(`unfazed: ${metadata.issuer} refused the sign-in request (${checked.reason}).`);
+            forgetClient(env, metadata.issuer);
+            cached = undefined;
+        }
+        if (await options.openBrowser?.(url)) {
+            log(`Opening your browser to sign in to ${origin}.\nIf it does not open, visit:\n\n  ${url}\n`);
+        }
+        else {
+            log(`Open this URL in a browser to sign in to ${origin}:\n\n  ${url}\n`);
+        }
+        if (options.input) {
+            log(`Browser on another machine? Sign in there, then paste the address it ends up on\n` +
+                `(http://127.0.0.1:${listener.port}${CALLBACK_PATH}?…, which will not load there) here and press Enter.`);
+        }
+        log("Waiting for the sign-in…");
+        const callback = await waitForCallback(listener, state, options.input, options.timeoutMs ?? LOGIN_TIMEOUT_MS, log);
+        try {
+            const credentials = await finish(callback.params, { metadata, client, endpoint, redirectUri, verifier, fetch });
+            writeCredentials(path, credentials);
+            callback.respond?.(200, page("Signed in to unfazed", `as <b>${escapeHTML(accountName(credentials))}</b>. You can close this tab and return to the terminal.`));
+            return { credentials, path };
+        }
+        catch (error) {
+            callback.respond?.(400, page("Sign-in failed", `${escapeHTML(error.message)}<br>Return to the terminal.`));
+            throw error;
+        }
+    }
+    finally {
+        listener.close();
+    }
+}
+/** Checks the answer, exchanges the code, and asks the platform who signed in. */
+async function finish(params, ctx) {
+    const error = params.get("error");
+    if (error) {
+        const description = params.get("error_description");
+        throw new UnfazedLoginError(`unfazed: the sign-in was not completed (${description ? `${error}: ${description}` : error}).`);
+    }
+    // RFC 9207: a server that says it sends `iss` must send its own, which
+    // rules out a code from another server mixed into this flow.
+    const iss = params.get("iss");
+    if ((iss !== null || ctx.metadata.authorization_response_iss_parameter_supported) && iss?.replace(/\/+$/, "") !== ctx.metadata.issuer) {
+        throw new UnfazedLoginError(`unfazed: the sign-in answer came from ${JSON.stringify(iss)}, not ${ctx.metadata.issuer}.`);
+    }
+    const code = params.get("code");
+    if (!code)
+        throw new UnfazedLoginError("unfazed: the sign-in answer carries no code.");
+    const tokens = await exchangeCode(ctx.metadata, { code, redirectUri: ctx.redirectUri, clientId: ctx.client.client_id, verifier: ctx.verifier }, ctx.fetch);
+    const actor = await whoamiWith(new UnfazedClient({ token: tokens.access_token, endpoint: ctx.endpoint, login: false, userAgent: USER_AGENT, fetch: ctx.fetch }));
+    const now = new Date().toISOString();
+    return {
+        version: 1,
+        endpoint: ctx.endpoint,
+        issuer: ctx.metadata.issuer,
+        token_endpoint: ctx.metadata.token_endpoint,
+        ...(ctx.metadata.revocation_endpoint ? { revocation_endpoint: ctx.metadata.revocation_endpoint } : {}),
+        client_id: ctx.client.client_id,
+        ...tokenFields(tokens),
+        account: { kind: actor.kind, user_id: actor.userID, name: actor.name },
+        created_at: now,
+        updated_at: now,
+    };
+}
+async function whoamiWith(client) {
+    const data = await client.query("query UnfazedCliWhoami { whoami { kind userID name scopes } }");
+    return data.whoami;
+}
+/** Who the SDK acts as here: `UNFZ_API_TOKEN` when set, else the stored login (refreshed as needed). */
+export async function whoami(options = {}) {
+    const env = options.env ?? process.env;
+    const client = new UnfazedClient({ env, userAgent: USER_AGENT, ...(options.fetch ? { fetch: options.fetch } : {}) });
+    let actor;
+    try {
+        actor = await whoamiWith(client);
+    }
+    catch (error) {
+        if (error instanceof UnfazedHTTPError && error.status === 401) {
+            throw new UnfazedAuthError(client.authSource === "token"
+                ? `unfazed: the platform refused ${TOKEN_ENV_VAR}. Unset it to use your \`${LOGIN_COMMAND}\`.`
+                : `unfazed: the platform refused the stored login. Run \`${LOGIN_COMMAND}\` again.`, { cause: error });
+        }
+        throw error;
+    }
+    const path = client.authSource === "login" ? credentialsPath(env) : undefined;
+    return { actor, endpoint: client.endpoint, source: client.authSource, ...(path ? { path } : {}) };
+}
+/**
+ * Revokes the stored tokens when the server advertises revocation, then
+ * deletes the login. The endpoint is read from the server's metadata again,
+ * so one the server gained since the login is used.
+ */
+export async function logout(options = {}) {
+    const env = options.env ?? process.env;
+    const fetch = options.fetch ?? globalFetch();
+    const none = { signedOut: false, revoked: false, revocationSupported: false };
+    const path = credentialsPath(env);
+    if (!path)
+        return none;
+    let credentials;
+    try {
+        credentials = readCredentials(path);
+    }
+    catch {
+        // An unreadable login is removed all the same.
+        return { ...none, signedOut: deleteCredentials(path) };
+    }
+    if (!credentials)
+        return none;
+    let endpoint = credentials.revocation_endpoint;
+    try {
+        endpoint = (await discover(credentials.issuer, fetch)).revocation_endpoint;
+    }
+    catch {
+        // Offline or gone: what the login recorded.
+    }
+    let revoked = false;
+    if (endpoint) {
+        const results = [];
+        if (credentials.refresh_token) {
+            results.push(await revokeToken(endpoint, { token: credentials.refresh_token, hint: "refresh_token", clientId: credentials.client_id }, fetch));
+        }
+        results.push(await revokeToken(endpoint, { token: credentials.access_token, hint: "access_token", clientId: credentials.client_id }, fetch));
+        revoked = results.every(Boolean);
+    }
+    deleteCredentials(path);
+    return { signedOut: true, issuer: credentials.issuer, revoked, revocationSupported: Boolean(endpoint) };
+}
+export function accountName(credentials) {
+    return credentials.account?.name || credentials.account?.user_id || "your account";
+}
+/* ---------------------------------------------------------------- browser */
+/**
+ * Whether a browser can be expected here. Over SSH, or on Linux without a
+ * display, the login prints the URL instead (and takes the pasted answer).
+ */
+export function canOpenBrowser(env, platform = process.platform) {
+    const custom = env["BROWSER"]?.trim();
+    if (custom)
+        return custom !== "none";
+    if (env["SSH_CONNECTION"] || env["SSH_TTY"])
+        return false;
+    if (platform === "darwin" || platform === "win32")
+        return true;
+    return Boolean(env["DISPLAY"] || env["WAYLAND_DISPLAY"]);
+}
+/** The command that opens `url` — `$BROWSER`, `open`, `xdg-open` or the Windows URL handler — as argv, never a shell line. */
+export function browserCommand(url, env, platform = process.platform) {
+    const custom = env["BROWSER"]?.trim();
+    if (custom) {
+        const parts = custom.split(/\s+/);
+        return parts.some((p) => p.includes("%s")) ? parts.map((p) => p.replaceAll("%s", url)) : [...parts, url];
+    }
+    if (platform === "darwin")
+        return ["open", url];
+    if (platform === "win32")
+        return ["rundll32", "url.dll,FileProtocolHandler", url];
+    return ["xdg-open", url];
+}
+/** Starts the browser on `url`. Resolves to whether it could be started. */
+export function openBrowser(url, env = process.env, platform = process.platform) {
+    if (!canOpenBrowser(env, platform))
+        return Promise.resolve(false);
+    const [command, ...args] = browserCommand(url, env, platform);
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(command, args, { stdio: "ignore", detached: true, env: env });
+            child.once("error", () => resolve(false));
+            child.once("spawn", () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/** A one-shot HTTP listener on 127.0.0.1 and a port the OS picks. */
+async function listen() {
+    const queue = [];
+    let waiter;
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (request.method !== "GET" || url.pathname !== CALLBACK_PATH) {
+            response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" }).end("not found");
+            return;
+        }
+        let answered = false;
+        const callback = {
+            params: url.searchParams,
+            respond: (status, html) => {
+                if (answered)
+                    return;
+                answered = true;
+                response
+                    .writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", Connection: "close" })
+                    .end(html);
+            },
+        };
+        const w = waiter;
+        waiter = undefined;
+        if (w)
+            w(callback);
+        else
+            queue.push(callback);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    return {
+        port: server.address().port,
+        next: () => {
+            const queued = queue.shift();
+            return queued ? Promise.resolve(queued) : new Promise((resolve) => (waiter = resolve));
+        },
+        close: () => {
+            // Stop listening and drop idle keep-alive sockets (a browser's
+            // preconnects); a page still being sent finishes first, and anything
+            // left is cut after a moment rather than holding the process open.
+            const s = server;
+            server.close();
+            s.closeIdleConnections?.();
+            setTimeout(() => s.closeAllConnections?.(), 2_000).unref();
+        },
+    };
+}
+/**
+ * The first answer that belongs to this sign-in, from the browser or pasted.
+ * An answer with another `state` (an older tab, a forgery) is turned away and
+ * the wait goes on.
+ */
+async function waitForCallback(listener, state, input, timeoutMs, log) {
+    let timer;
+    const lines = input ? createInterface({ input, terminal: false }) : undefined;
+    const pasted = [];
+    let wakePasted;
+    lines?.on("line", (line) => {
+        const params = pastedParams(line);
+        if (!params) {
+            if (line.trim())
+                log(`That is not the address the browser ended up on (it starts with http://127.0.0.1:${listener.port}${CALLBACK_PATH}?).`);
+            return;
+        }
+        pasted.push({ params });
+        wakePasted?.();
+    });
+    try {
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new UnfazedLoginError(`unfazed: no sign-in within ${Math.max(1, Math.round(timeoutMs / 60_000))} min. Run \`${LOGIN_COMMAND}\` again.`)), timeoutMs);
+        });
+        for (;;) {
+            const fromPaste = new Promise((resolve) => {
+                const take = () => {
+                    const next = pasted.shift();
+                    if (next)
+                        resolve(next);
+                };
+                wakePasted = take;
+                take();
+            });
+            const callback = await Promise.race([listener.next(), fromPaste, timeout]);
+            if (sameState(callback.params.get("state"), state))
+                return callback;
+            log("Ignored a sign-in answer that belongs to another attempt (its state does not match).");
+            callback.respond?.(400, page("Not this sign-in", "This answer belongs to another sign-in attempt. Use the link the terminal printed last."));
+        }
+    }
+    finally {
+        clearTimeout(timer);
+        lines?.close();
+    }
+}
+function pastedParams(line) {
+    try {
+        const url = new URL(line.trim());
+        if (url.pathname !== CALLBACK_PATH || (!url.searchParams.has("code") && !url.searchParams.has("error")))
+            return undefined;
+        return url.searchParams;
+    }
+    catch {
+        return undefined;
+    }
+}
+function sameState(got, want) {
+    if (got === null)
+        return false;
+    const a = Buffer.from(got);
+    const b = Buffer.from(want);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function parseObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function page(title, body) {
+    return (`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
+        `<title>${escapeHTML(title)} · unfazed</title>` +
+        `<style>body{font:16px/1.5 system-ui,-apple-system,sans-serif;max-width:34rem;margin:18vh auto;padding:0 1.5rem;color:#111;background:#fff}` +
+        `h1{font-size:1.4rem;margin:0 0 .5rem}p{color:#444}@media(prefers-color-scheme:dark){body{color:#eee;background:#111}p{color:#bbb}}</style>` +
+        `</head><body><h1>${escapeHTML(title)}</h1><p>${body}</p></body></html>`);
+}
+function escapeHTML(text) {
+    return text.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+//# sourceMappingURL=login.js.map