wldx-cli 1.0.0 → 1.2.0

package/src/phone/sip.mjs

@@ -13,8 +13,37 @@ const ALPHABET = 'abcdefghijklmnopqrstuvwxyz0123456789';
 export const randomToken = (n) => [...randomBytes(n)].map((b) => ALPHABET[b % ALPHABET.length]).join('');
 const md5 = (s) => createHash('md5').update(s).digest('hex');
 
-export const ALLOWED = ['ACK', 'BYE', 'CANCEL', 'INFO', 'INVITE', 'MESSAGE', 'NOTIFY', 'OPTIONS', 'PRACK', 'REFER', 'REGISTER', 'SUBSCRIBE'];
-const COMPACT = {i: 'call-id', f: 'from', t: 'to', v: 'via', m: 'contact', l: 'content-length', c: 'content-type', o: 'event', k: 'supported', u: 'allow-events', e: 'content-encoding', s: 'subject', r: 'refer-to', b: 'referred-by', x: 'session-expires'};
+export const ALLOWED = [
+  'ACK',
+  'BYE',
+  'CANCEL',
+  'INFO',
+  'INVITE',
+  'MESSAGE',
+  'NOTIFY',
+  'OPTIONS',
+  'PRACK',
+  'REFER',
+  'REGISTER',
+  'SUBSCRIBE',
+];
+const COMPACT = {
+  i: 'call-id',
+  f: 'from',
+  t: 'to',
+  v: 'via',
+  m: 'contact',
+  l: 'content-length',
+  c: 'content-type',
+  o: 'event',
+  k: 'supported',
+  u: 'allow-events',
+  e: 'content-encoding',
+  s: 'subject',
+  r: 'refer-to',
+  b: 'referred-by',
+  x: 'session-expires',
+};
 const TRANSACTION_TIMEOUT_MS = 32_000; // Timer F of RFC 3261
 
 // One SIP message from its text: {method, uri} for a request or {status, reason} for a response; header(name) gives
@@ -38,7 +67,8 @@ export function parseMessage(raw) {
   const msg = {headerList: [], body};
   let m;
   if ((m = /^SIP\/2\.0 (\d{3})(?: (.*))?$/.exec(first))) Object.assign(msg, {status: Number(m[1]), reason: m[2] ?? ''});
-  else if ((m = /^([A-Za-z]+) (\S+) SIP\/2\.0$/.exec(first))) Object.assign(msg, {method: m[1].toUpperCase(), uri: m[2]});
+  else if ((m = /^([A-Za-z]+) (\S+) SIP\/2\.0$/.exec(first)))
+    Object.assign(msg, {method: m[1].toUpperCase(), uri: m[2]});
   else throw new Error('not a SIP message');
   for (const l of lines) {
     const c = l.indexOf(':');
@@ -61,35 +91,50 @@ export const uriOf = (value) => {
 };
 export function paramOf(value, name) {
   // The display name and the URI may hold ";tag=" themselves: only the parameters after them count.
-  const v = String(value ?? '').replace(/^\s*"(?:[^"\\]|\\.)*"/, '').replace(/<[^>]*>/, '');
+  const v = String(value ?? '')
+    .replace(/^\s*"(?:[^"\\]|\\.)*"/, '')
+    .replace(/<[^>]*>/, '');
   const m = new RegExp(`;\\s*${name}\\s*=\\s*(?:"([^"]*)"|([^;,\\s]+))`, 'i').exec(v);
   return m ? (m[1] ?? m[2]) : undefined;
 }
 const branchOf = (via) => /;\s*branch=([^;,\s]+)/i.exec(via ?? '')?.[1];
-const splitList = (values) => values.flatMap((v) => v.split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)(?![^<]*>)/).map((x) => x.trim())).filter(Boolean);
+const splitList = (values) =>
+  values.flatMap((v) => v.split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)(?![^<]*>)/).map((x) => x.trim())).filter(Boolean);
 
 // A digest challenge (WWW-Authenticate / Proxy-Authenticate) as {realm, nonce, qop, opaque, algorithm, stale}.
 export function parseChallenge(value) {
   const v = String(value ?? '');
   if (!/^\s*Digest\s/i.test(v)) return undefined;
   const out = {};
-  for (const m of v.replace(/^\s*Digest\s+/i, '').matchAll(/([A-Za-z-]+)\s*=\s*(?:"([^"]*)"|([^,\s]+))/g)) out[m[1].toLowerCase()] = m[2] ?? m[3];
+  for (const m of v.replace(/^\s*Digest\s+/i, '').matchAll(/([A-Za-z-]+)\s*=\s*(?:"([^"]*)"|([^,\s]+))/g))
+    out[m[1].toLowerCase()] = m[2] ?? m[3];
   return out;
 }
 
 // The Authorization value for a challenge (MD5; qop auth when offered), as sip.js computes it.
 export function digestAuthorization({username, password, method, uri, challenge, nc = 1, cnonce = randomToken(12)}) {
   const algorithm = challenge.algorithm ?? 'MD5';
-  if (algorithm.toUpperCase() !== 'MD5') throw new Error(`the PBX asks for a digest algorithm other than MD5: ${algorithm}`);
+  if (algorithm.toUpperCase() !== 'MD5')
+    throw new Error(`the PBX asks for a digest algorithm other than MD5: ${algorithm}`);
   if (!challenge.realm || !challenge.nonce) throw new Error('the PBX sent a digest challenge without realm or nonce');
   const qops = (challenge.qop ?? '').split(',').map((q) => q.trim());
   const qop = challenge.qop === undefined ? undefined : qops.includes('auth') ? 'auth' : undefined;
-  if (challenge.qop !== undefined && !qop) throw new Error(`the PBX asks for a digest qop other than auth: ${challenge.qop}`);
+  if (challenge.qop !== undefined && !qop)
+    throw new Error(`the PBX asks for a digest qop other than auth: ${challenge.qop}`);
   const ha1 = md5(`${username}:${challenge.realm}:${password}`);
   const ha2 = md5(`${method}:${uri}`);
   const ncHex = nc.toString(16).padStart(8, '0');
-  const response = qop ? md5(`${ha1}:${challenge.nonce}:${ncHex}:${cnonce}:${qop}:${ha2}`) : md5(`${ha1}:${challenge.nonce}:${ha2}`);
-  const parts = [`algorithm=MD5`, `username="${username}"`, `realm="${challenge.realm}"`, `nonce="${challenge.nonce}"`, `uri="${uri}"`, `response="${response}"`];
+  const response = qop
+    ? md5(`${ha1}:${challenge.nonce}:${ncHex}:${cnonce}:${qop}:${ha2}`)
+    : md5(`${ha1}:${challenge.nonce}:${ha2}`);
+  const parts = [
+    `algorithm=MD5`,
+    `username="${username}"`,
+    `realm="${challenge.realm}"`,
+    `nonce="${challenge.nonce}"`,
+    `uri="${uri}"`,
+    `response="${response}"`,
+  ];
   if (challenge.opaque !== undefined) parts.push(`opaque="${challenge.opaque}"`);
   if (qop) parts.push(`qop=${qop}`, `cnonce="${cnonce}"`, `nc=${ncHex}`);
   return `Digest ${parts.join(', ')}`;
@@ -99,7 +144,16 @@ export function digestAuthorization({username, password, method, uri, challenge,
 // onNotify), 'disconnect' (the socket closed). onNotify(request) returns true when the NOTIFY belongs to a
 // subscription (answered 200), false otherwise (481).
 export class SipUserAgent extends EventEmitter {
-  constructor({wsUrl, domain, extension, password, userAgent, WebSocketImpl = globalThis.WebSocket, keepAliveSeconds = 30, timeoutMs = TRANSACTION_TIMEOUT_MS}) {
+  constructor({
+    wsUrl,
+    domain,
+    extension,
+    password,
+    userAgent,
+    WebSocketImpl = globalThis.WebSocket,
+    keepAliveSeconds = 30,
+    timeoutMs = TRANSACTION_TIMEOUT_MS,
+  }) {
     super();
     this.wsUrl = wsUrl;
     this.domain = domain;
@@ -120,7 +174,8 @@ export class SipUserAgent extends EventEmitter {
 
   // Opens the WebSocket (subprotocol "sip"); rejects when it cannot.
   open() {
-    if (!this.WebSocketImpl) return Promise.reject(new Error('this Node.js has no WebSocket (Node 22 or newer is needed)'));
+    if (!this.WebSocketImpl)
+      return Promise.reject(new Error('this Node.js has no WebSocket (Node 22 or newer is needed)'));
     return new Promise((resolve, reject) => {
       let opened = false;
       const ws = new this.WebSocketImpl(this.wsUrl, 'sip');
@@ -134,7 +189,9 @@ export class SipUserAgent extends EventEmitter {
         }
         resolve();
       });
-      ws.addEventListener('message', (e) => this.receive(typeof e.data === 'string' ? e.data : Buffer.from(e.data).toString('utf8')));
+      ws.addEventListener('message', (e) =>
+        this.receive(typeof e.data === 'string' ? e.data : Buffer.from(e.data).toString('utf8')),
+      );
       ws.addEventListener('error', () => {
         if (!opened) reject(new Error(`the PBX did not open the SIP WebSocket (${new URL(this.wsUrl).host})`));
       });
@@ -168,7 +225,7 @@ export class SipUserAgent extends EventEmitter {
   }
 
   write(text) {
-    if (!this.ws || this.ws.readyState !== 1) throw new Error('the SIP connection is not open');
+    if (this.ws?.readyState !== 1) throw new Error('the SIP connection is not open');
     this.ws.send(text);
   }
 
@@ -186,7 +243,14 @@ export class SipUserAgent extends EventEmitter {
       if (!challenge || round >= (stale ? 2 : 1)) return res;
       const nc = (this.nc.get(challenge.nonce) ?? 0) + 1;
       this.nc.set(challenge.nonce, nc);
-      const value = digestAuthorization({username: this.extension, password: this.password, method, uri: o.ruri, challenge, nc});
+      const value = digestAuthorization({
+        username: this.extension,
+        password: this.password,
+        method,
+        uri: o.ruri,
+        challenge,
+        nc,
+      });
       auth = `${res.status === 401 ? 'Authorization' : 'Proxy-Authorization'}: ${value}`;
     }
   }
@@ -224,8 +288,14 @@ export class SipUserAgent extends EventEmitter {
       };
       this.transactions.set(branch, {
         method,
-        ok: (res) => (done(), resolve(res)),
-        fail: (e) => (done(), reject(e)),
+        ok: (res) => {
+          done();
+          resolve(res);
+        },
+        fail: (e) => {
+          done();
+          reject(e);
+        },
       });
       try {
         this.write(lines.join('\r\n'));

package/src/phone/xml.mjs

@@ -2,7 +2,8 @@
 // elements, attributes, text. No DTD, no external entities (a DOCTYPE is refused). Element names are matched
 // without their namespace prefix, as ltx does.
 
-const TOKEN = /<!--[\s\S]*?-->|<!\[CDATA\[([\s\S]*?)\]\]>|<\?[\s\S]*?\?>|<\/\s*([^\s>]+)\s*>|<([^\s/>!?]+)((?:\s+[^\s=/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*(\/?)>|([^<]+)/y;
+const TOKEN =
+  /<!--[\s\S]*?-->|<!\[CDATA\[([\s\S]*?)\]\]>|<\?[\s\S]*?\?>|<\/\s*([^\s>]+)\s*>|<([^\s/>!?]+)((?:\s+[^\s=/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*(\/?)>|([^<]+)/y;
 const ATTR = /([^\s=/>]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
 const NAMED = {lt: '<', gt: '>', amp: '&', quot: '"', apos: "'"};
 

package/src/stream.mjs

@@ -1,7 +1,7 @@
 // The Wildix stream service (chats): https://<region>.stream.wildix.com/api/v1, region eu-1 by default.
-import {UsageError} from './errors.mjs';
-import {request} from './http.mjs';
-import {streamUrl} from './services.mjs';
+import {UsageError} from 'wldx-core/errors';
+import {request} from 'wldx-core/http';
+import {streamUrl} from 'wldx-core/services';
 
 const ID = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
 
@@ -23,7 +23,11 @@ export function channelId(input) {
 
 // A message id from an id or from an inbox link to the message (the last path segment).
 export function messageId(input) {
-  const v = String(input).replace(/[?#].*$/s, '').replace(/\/+$/, '').split('/').pop();
+  const v = String(input)
+    .replace(/[?#].*$/s, '')
+    .replace(/\/+$/, '')
+    .split('/')
+    .pop();
   if (!valid(v)) throw new UsageError(`Not a message id: ${input}`);
   return v;
 }
@@ -31,6 +35,7 @@ export function messageId(input) {
 export function streamClient({token, env = process.env, fetchImpl}) {
   const api = `${streamBase(env)}/api/v1`;
   return {
-    call: (method, path, body, options = {}) => request(api + path, {method, token, body, fetchImpl, service: 'the stream service', ...options}),
+    call: (method, path, body, options = {}) =>
+      request(api + path, {method, token, body, fetchImpl, service: 'the stream service', ...options}),
   };
 }

package/src/version.mjs

@@ -1,4 +1,3 @@
 import {readFileSync} from 'node:fs';
 
 export const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
-export const USER_AGENT = `wldx-cli/${VERSION}`;

package/src/auth.mjs

@@ -1,274 +0,0 @@
-// The Wildix login of the user (x-bees, x-hoppers, Collaboration 7): Cognito CUSTOM_AUTH with a one-time code sent
-// by e-mail. Shared with the wildix-auth agent skill: one file per profile (e-mail) in $WILDIX_CONFIG_DIR/tokens (default
-// ~/.wildix/tokens), named <e-mail with @ as _at_>.prod.json, holding the Cognito set {IdToken, AccessToken,
-// RefreshToken, ExpiresIn, email, savedAt}. An expired IdToken is renewed with the RefreshToken and written back in
-// the same format, so the skill and the CLI keep using one session.
-//
-// The tokens are never printed and never put on a command line or into the environment of a child process.
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import {AuthError} from './errors.mjs';
-import {USER_AGENT} from './version.mjs';
-
-export const CLIENT_ID = '2un9vsk5ghu0ocurajqe4a6l1e';
-export const COGNITO_URL = 'https://cognito-idp.eu-central-1.amazonaws.com/';
-const RENEW_EARLY_MS = 60_000;
-// Cognito keeps the session of a sign-in that waits for its code for 3 minutes.
-export const PENDING_TTL_MS = 3 * 60_000;
-export const LOGIN_HINT = 'Log in with: wx login <e-mail>';
-
-export const configDir = (env = process.env) => env.WILDIX_CONFIG_DIR || path.join(os.homedir(), '.wildix');
-export const tokensDir = (env = process.env) => path.join(configDir(env), 'tokens');
-
-const EMAIL = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/;
-
-export function checkEmail(email) {
-  if (typeof email !== 'string' || !EMAIL.test(email) || email.includes('..')) throw new AuthError(`Not a valid e-mail: ${email}`);
-  return email.toLowerCase();
-}
-
-// The e-mail becomes part of a file name: letters, digits and . _ % + - @ only, no "..".
-export function tokenFile(email, env = process.env) {
-  if (!/^[A-Za-z0-9._%+@-]+$/.test(email) || email.includes('..')) throw new AuthError(`Not a valid e-mail: ${email}`);
-  return path.join(tokensDir(env), `${email.replace(/@/g, '_at_')}.prod.json`);
-}
-
-// A sign-in that waits for its code (wx login --send-code, then --code): the Cognito session, privately.
-export const pendingFile = (email, env = process.env) => path.join(tokensDir(env), `.${email.replace(/@/g, '_at_')}.pending.json`);
-
-function readJson(file) {
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return undefined;
-  }
-}
-
-export function jwtClaims(token) {
-  try {
-    return JSON.parse(Buffer.from(String(token).split('.')[1], 'base64url').toString('utf8'));
-  } catch {
-    return {};
-  }
-}
-
-// When the IdToken of a saved set stops being valid, in ms: its `exp` claim, else savedAt + ExpiresIn, else 0.
-export function expiresAt(set) {
-  const exp = jwtClaims(set?.IdToken).exp;
-  if (Number.isFinite(exp)) return exp * 1000;
-  const saved = Date.parse(set?.savedAt ?? '');
-  return Number.isFinite(saved) && Number.isFinite(set?.ExpiresIn) ? saved + set.ExpiresIn * 1000 : 0;
-}
-
-// The saved sessions: [{email, expiresAt}], never the tokens.
-export function sessions(env = process.env) {
-  const dir = tokensDir(env);
-  let names;
-  try {
-    names = fs.readdirSync(dir).filter((n) => n.endsWith('.prod.json') && !n.startsWith('.')).sort();
-  } catch {
-    return [];
-  }
-  return names
-    .map((n) => readJson(path.join(dir, n)))
-    .filter((set) => typeof set?.email === 'string')
-    .map((set) => ({email: set.email, expiresAt: expiresAt(set)}));
-}
-
-// ── profiles ─────────────────────────────────────────────────────────────────────────────────────────────────
-// A profile is an e-mail logged in to Wildix. The default one is kept in $WILDIX_CONFIG_DIR/wx.json ({"defaultProfile":
-// e-mail}, 0600); the wildix-auth skill does not read it.
-export const settingsFile = (env = process.env) => path.join(configDir(env), 'wx.json');
-const readSettings = (env) => readJson(settingsFile(env)) ?? {};
-const sameEmail = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
-
-// The default profile, when it is still logged in; else undefined.
-export function defaultProfile(env = process.env) {
-  const wanted = readSettings(env).defaultProfile;
-  return wanted ? sessions(env).find((s) => sameEmail(s.email, wanted))?.email : undefined;
-}
-
-export function setDefaultProfile(email, env = process.env) {
-  const settings = readSettings(env);
-  if (email) settings.defaultProfile = email;
-  else delete settings.defaultProfile;
-  writePrivate(settingsFile(env), settings);
-}
-
-// Which profile, and why: --profile, else WILDIX_EMAIL, else the default profile, else the only one logged in.
-// Returns {email, by: 'option'|'environment'|'default'|'only'}.
-export function chooseProfile(env = process.env, profile) {
-  const list = sessions(env);
-  const given = profile || env.WILDIX_EMAIL;
-  // An e-mail given in another case is the saved session of that e-mail.
-  if (given) return {email: list.find((s) => sameEmail(s.email, given))?.email ?? given, by: profile ? 'option' : 'environment'};
-  if (!list.length) throw new AuthError(`Not logged in to Wildix. ${LOGIN_HINT}`);
-  const byDefault = defaultProfile(env);
-  if (byDefault) return {email: byDefault, by: 'default'};
-  if (list.length === 1) return {email: list[0].email, by: 'only'};
-  throw new AuthError(
-    `Several profiles are logged in and none is the default. Choose one for this command with --profile, or set the default: wx profile use <e-mail>\n${list.map((s) => `  ${s.email}`).join('\n')}`,
-  );
-}
-
-export const pickProfile = (env = process.env, profile) => chooseProfile(env, profile).email;
-
-// The format of the skill: whole seconds, no milliseconds (its bash parses it with `date -f %Y-%m-%dT%H:%M:%SZ`).
-export const stamp = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, 'Z');
-
-function writePrivate(file, data) {
-  const dir = path.dirname(file);
-  fs.mkdirSync(dir, {recursive: true, mode: 0o700});
-  try {
-    fs.chmodSync(dir, 0o700);
-  } catch {
-    // not ours to change: the file itself is still 0600
-  }
-  const tmp = path.join(dir, `.${path.basename(file)}.${crypto.randomBytes(6).toString('hex')}`);
-  fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, {mode: 0o600, flag: 'wx'});
-  fs.renameSync(tmp, file);
-}
-
-// Writes a token set privately (0600) and atomically; a set without IdToken, RefreshToken and ExpiresIn is refused.
-export function saveTokens(file, set) {
-  if (typeof set?.IdToken !== 'string' || typeof set?.RefreshToken !== 'string' || typeof set?.ExpiresIn !== 'number') {
-    throw new AuthError('The answer carried no complete set of tokens: nothing was saved.');
-  }
-  writePrivate(file, set);
-}
-
-// One call to the Cognito identity provider. Returns the answer; throws AuthError with Cognito's reason.
-export async function cognito(target, payload, fetchImpl = globalThis.fetch) {
-  const res = await fetchImpl(COGNITO_URL, {
-    method: 'POST',
-    headers: {
-      'user-agent': USER_AGENT,
-      'content-type': 'application/x-amz-json-1.1',
-      'cache-control': 'no-store',
-      'x-amz-target': `AWSCognitoIdentityProviderService.${target}`,
-    },
-    body: JSON.stringify(payload),
-    redirect: 'error',
-    signal: AbortSignal.timeout(30_000),
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || body?.__type) {
-    const err = new AuthError(body?.message || body?.__type || `HTTP ${res.status}`);
-    err.type = body?.__type;
-    throw err;
-  }
-  return body ?? {};
-}
-
-async function renew(email, set, {env, fetchImpl, now}) {
-  let body;
-  try {
-    body = await cognito('InitiateAuth', {AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: CLIENT_ID, AuthParameters: {REFRESH_TOKEN: set.RefreshToken}, ClientMetadata: {}}, fetchImpl);
-  } catch (e) {
-    if (e instanceof AuthError) throw new AuthError(`The session of ${email} could not be renewed (${e.message}). ${LOGIN_HINT}`);
-    throw e;
-  }
-  const result = body.AuthenticationResult;
-  if (typeof result?.IdToken !== 'string') throw new AuthError(`The session of ${email} could not be renewed. ${LOGIN_HINT}`);
-  // Cognito sends no new RefreshToken on a refresh unless rotation is on for the client: then the new one is kept,
-  // else the saved one.
-  const next = {...result, email, savedAt: stamp(now), RefreshToken: result.RefreshToken ?? set.RefreshToken, ExpiresIn: result.ExpiresIn ?? set.ExpiresIn};
-  saveTokens(tokenFile(email, env), next);
-  return next;
-}
-
-// The saved token set of the profile as it is (not renewed), or undefined.
-export function savedSession(email, env = process.env) {
-  const set = readJson(tokenFile(email, env));
-  return typeof set?.IdToken === 'string' ? set : undefined;
-}
-
-// The saved token set of the profile, renewed when its IdToken expires within a minute.
-export async function getSession({profile, env = process.env, fetchImpl = globalThis.fetch, now = Date.now()} = {}) {
-  const email = pickProfile(env, profile);
-  const set = readJson(tokenFile(email, env));
-  if (typeof set?.IdToken !== 'string') throw new AuthError(`No saved session for ${email}. ${LOGIN_HINT}`);
-  if (expiresAt(set) - RENEW_EARLY_MS > now) return set;
-  if (typeof set.RefreshToken !== 'string') throw new AuthError(`The session of ${email} has expired. ${LOGIN_HINT}`);
-  return renew(email, set, {env, fetchImpl, now});
-}
-
-// A valid IdToken of the profile: WILDIX_ID_TOKEN as given (tests, CI), else the saved session (renewed).
-export async function getToken(options = {}) {
-  const env = options.env ?? process.env;
-  if (env.WILDIX_ID_TOKEN) return env.WILDIX_ID_TOKEN;
-  return (await getSession(options)).IdToken;
-}
-
-// ── signing in ───────────────────────────────────────────────────────────────────────────────────────────────
-// Starts a sign-in: Wildix sends a one-time code to the e-mail. Returns the Cognito session that the code answers.
-export async function startLogin(email, fetchImpl = globalThis.fetch) {
-  let body;
-  try {
-    body = await cognito('InitiateAuth', {AuthFlow: 'CUSTOM_AUTH', ClientId: CLIENT_ID, AuthParameters: {USERNAME: email}, ClientMetadata: {}}, fetchImpl);
-  } catch (e) {
-    if (e instanceof AuthError) throw new AuthError(`Wildix did not start a sign-in for ${email}: ${e.message}`);
-    throw e;
-  }
-  if (typeof body.Session !== 'string') throw new AuthError(`Wildix did not start a sign-in for ${email}.`);
-  return body.Session;
-}
-
-// Answers the code. Returns {saved: true} with the session stored, or {saved: false, session} when the code was not
-// accepted (Cognito answers a wrong code with a new challenge and a new session, which takes the next try).
-export async function finishLogin(email, session, code, {env = process.env, fetchImpl = globalThis.fetch, now = Date.now()} = {}) {
-  let body;
-  try {
-    body = await cognito('RespondToAuthChallenge', {
-      ChallengeName: 'CUSTOM_CHALLENGE',
-      ChallengeResponses: {USERNAME: email, ANSWER: code},
-      ClientId: CLIENT_ID,
-      Session: session,
-    }, fetchImpl);
-  } catch (e) {
-    if (e instanceof AuthError) throw new AuthError(`The sign-in of ${email} failed: ${e.message}. Start again: wx login ${email}`);
-    throw e;
-  }
-  const result = body.AuthenticationResult;
-  if (typeof result?.IdToken !== 'string') return {saved: false, session: body.Session};
-  saveTokens(tokenFile(email, env), {...result, email, savedAt: stamp(now)});
-  // The first profile becomes the default one; a second login does not change it.
-  const isDefault = !defaultProfile(env) || sameEmail(defaultProfile(env), email);
-  if (!defaultProfile(env)) setDefaultProfile(email, env);
-  return {saved: true, isDefault};
-}
-
-export function savePending(email, session, {env = process.env, now = Date.now()} = {}) {
-  writePrivate(pendingFile(email, env), {email, session, startedAt: now});
-}
-
-// The waiting sign-in of the e-mail, or undefined when there is none or it is older than Cognito keeps it.
-export function readPending(email, {env = process.env, now = Date.now()} = {}) {
-  const p = readJson(pendingFile(email, env));
-  if (typeof p?.session !== 'string' || !(now - p.startedAt < PENDING_TTL_MS)) return undefined;
-  return p;
-}
-
-export function dropPending(email, env = process.env) {
-  fs.rmSync(pendingFile(email, env), {force: true});
-}
-
-// ── signing out ──────────────────────────────────────────────────────────────────────────────────────────────
-// Revokes the refresh token of the profile (this device) and deletes its local session. With everywhere, signs the
-// profile out of every device (GlobalSignOut, which needs a valid AccessToken). An error leaves the local session
-// as it was: it is still valid, and the call can be repeated.
-export async function logout(email, {everywhere = false, env = process.env, fetchImpl = globalThis.fetch, now = Date.now()} = {}) {
-  const file = tokenFile(email, env);
-  const set = readJson(file);
-  if (!set) throw new AuthError(`No saved session for ${email}.`);
-  if (everywhere) {
-    const fresh = await getSession({profile: email, env, fetchImpl, now});
-    await cognito('GlobalSignOut', {AccessToken: fresh.AccessToken}, fetchImpl);
-  } else {
-    await cognito('RevokeToken', {Token: set.RefreshToken, ClientId: CLIENT_ID}, fetchImpl);
-  }
-  fs.rmSync(file, {force: true});
-  if (sameEmail(readSettings(env).defaultProfile ?? '', email)) setDefaultProfile(undefined, env);
-}

package/src/commands/login.mjs

@@ -1,126 +0,0 @@
-// wx login, wx logout: the Wildix login of the user (a one-time code sent by e-mail).
-import {createInterface} from 'node:readline/promises';
-import {
-  PENDING_TTL_MS,
-  checkEmail,
-  defaultProfile,
-  dropPending,
-  finishLogin,
-  logout as signOut,
-  pickProfile,
-  readPending,
-  savePending,
-  startLogin,
-} from '../auth.mjs';
-import {AuthError, UsageError} from '../errors.mjs';
-
-const TRIES = 3;
-
-// The answer of a login: the profile, and whether it is the default one (the first login makes it so).
-const loggedIn = (ctx, email, r) => ({profile: email, loggedIn: true, default: r.isDefault, defaultProfile: defaultProfile(ctx.env) ?? null});
-
-function checkCode(code) {
-  const c = String(code).trim();
-  if (!/^[A-Za-z0-9]{4,12}$/.test(c)) throw new UsageError(`Not a code from the e-mail: ${code}`);
-  return c;
-}
-
-// The prompt goes to stderr (stdout is data); the answer is the next line of stdin (lines are buffered, so typed
-// ahead or piped answers are not lost).
-async function ask(lines, ctx, question) {
-  ctx.stderr.write(question);
-  const next = await lines.next();
-  if (next.done) throw new AuthError('No answer: stdin was closed. Nothing was saved.');
-  return next.value.trim();
-}
-
-async function interactive(ctx, emailArg) {
-  const rl = createInterface({input: ctx.stdin, terminal: false});
-  const lines = rl[Symbol.asyncIterator]();
-  try {
-    const email = checkEmail(emailArg ?? (await ask(lines, ctx, 'E-mail of your Wildix account: ')));
-    let session = await startLogin(email, ctx.fetch);
-    ctx.info(`A code was sent to ${email}.`);
-    for (let attempt = 1; attempt <= TRIES; attempt += 1) {
-      const code = checkCode(await ask(lines, ctx, 'Code from the e-mail: '));
-      const r = await finishLogin(email, session, code, {env: ctx.env, fetchImpl: ctx.fetch, now: ctx.clock()});
-      if (r.saved) return loggedIn(ctx, email, r);
-      session = r.session;
-      if (!session) break;
-      if (attempt < TRIES) ctx.info('The code was not accepted. Try again.');
-    }
-    throw new AuthError(`The code was not accepted. Start again: wx login ${email}`);
-  } finally {
-    rl.close();
-  }
-}
-
-export const login = {
-  summary: 'log in with a one-time code sent to your e-mail',
-  usage: 'wx login [<e-mail>] [--send-code | --code CODE]',
-  details: [
-    'In a terminal, wx login asks for the code and waits. Without one (scripts, agents), sign in in two steps:',
-    '  wx login <e-mail> --send-code      Wildix e-mails a code',
-    '  wx login <e-mail> --code <code>    within 3 minutes',
-    'The session is shared with the wildix-auth agent skill (~/.wildix/tokens).',
-  ].join('\n'),
-  options: {
-    'send-code': {type: 'boolean', description: 'only send the code; finish later with --code'},
-    code: {type: 'string', placeholder: 'CODE', description: 'the code from the e-mail, after --send-code'},
-  },
-  args: [0, 1],
-  async run(ctx) {
-    const {values, positionals} = ctx;
-    if (values['send-code'] && values.code) throw new UsageError('Give --send-code or --code, not both', ctx.usage());
-    if (values['send-code'] || values.code) {
-      if (!positionals[0]) throw new UsageError('The e-mail is needed', ctx.usage());
-      const email = checkEmail(positionals[0]);
-      const now = ctx.clock();
-      if (values['send-code']) {
-        savePending(email, await startLogin(email, ctx.fetch), {env: ctx.env, now});
-        return {profile: email, codeSent: true, expiresAt: new Date(now + PENDING_TTL_MS).toISOString()};
-      }
-      const code = checkCode(values.code);
-      const pending = readPending(email, {env: ctx.env, now});
-      if (!pending) throw new AuthError(`No sign-in waits for a code for ${email} (or it is older than 3 minutes). Start with: wx login ${email} --send-code`);
-      const r = await finishLogin(email, pending.session, code, {env: ctx.env, fetchImpl: ctx.fetch, now});
-      if (r.saved) {
-        dropPending(email, ctx.env);
-        return loggedIn(ctx, email, r);
-      }
-      if (r.session) savePending(email, r.session, {env: ctx.env, now: pending.startedAt});
-      else dropPending(email, ctx.env);
-      throw new AuthError(`The code was not accepted.${r.session ? ` Try again: wx login ${email} --code <code>` : ` Start again: wx login ${email} --send-code`}`);
-    }
-    if (!ctx.stdin.isTTY) {
-      throw new UsageError('No terminal to ask for the code: use wx login <e-mail> --send-code, then wx login <e-mail> --code <code>', ctx.usage());
-    }
-    return interactive(ctx, positionals[0]);
-  },
-  text(r) {
-    if (r.codeSent) return `A code was sent to ${r.profile}. Finish before ${r.expiresAt}: wx login ${r.profile} --code <code>`;
-    if (r.default) return `Logged in as ${r.profile} (the default profile)`;
-    return [`Logged in as ${r.profile}. The default profile stays ${r.defaultProfile}.`, `Use it with --profile ${r.profile}, or make it the default: wx profile use ${r.profile}`];
-  },
-};
-
-export const logout = {
-  summary: 'log out: revoke the session of this device, or of every device',
-  usage: 'wx logout [--profile EMAIL] [--everywhere]',
-  options: {
-    everywhere: {type: 'boolean', description: 'sign out of every device and app, not only this one'},
-  },
-  args: [0, 0],
-  async run(ctx) {
-    const email = pickProfile(ctx.env, ctx.values.profile);
-    const everywhere = Boolean(ctx.values.everywhere);
-    try {
-      await signOut(email, {everywhere, env: ctx.env, fetchImpl: ctx.fetch, now: ctx.clock()});
-    } catch (e) {
-      if (e instanceof AuthError) throw new AuthError(`${email} was NOT logged out (${e.message}). The local session is kept.`);
-      throw e;
-    }
-    return {profile: email, loggedOut: true, everywhere};
-  },
-  text: (r) => `Logged out ${r.profile} (${r.everywhere ? 'every device' : 'this device'})`,
-};