@ai-coders/installer 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# @ai-coders/installer
+
+## [0.3.0](https://github.com/vinilana/ai-coders-installers/compare/v0.2.0...v0.3.0) (2026-08-19)
+
+
+### Features
+
+* add Severino product support and refactor installer CLI ([339ee94](https://github.com/vinilana/ai-coders-installers/commit/339ee9460894ed835cde160aaa02bc13f94c4ccb))
+
+
+### Bug Fixes
+
+* run package audit through active npm CLI ([e5c6932](https://github.com/vinilana/ai-coders-installers/commit/e5c69327ce48cd7981602de40ae78eb04329ad48))
+
+## [0.2.0](https://github.com/vinilana/ai-coders-installers/compare/v0.1.0...v0.2.0) (2026-08-16)
+
+
+### Features
+
+* add initial release workflow, CI configuration, and update package metadata ([0fc19d4](https://github.com/vinilana/ai-coders-installers/commit/0fc19d46cafdec7a7b8366376b44412d77224127))
+* add skills for managing AI Coders installer products, including adding, developing, and releasing installers ([7b33f97](https://github.com/vinilana/ai-coders-installers/commit/7b33f97c4e93aaa8c1c901aec7de14e64c060742))
+
+## 0.1.0
+
+- Initial public CLI package for authenticated AI Coders product installers.

package/LICENSE

@@ -0,0 +1,18 @@
+Proprietary Software Notice
+
+Copyright (c) 2026 AI Coders. All rights reserved.
+
+This software is proprietary to AI Coders. Its availability through the public
+npm registry is solely intended to let authorized users execute the installer
+with npx.
+
+Except as expressly authorized by a separate written agreement or applicable
+AI Coders terms of service, this notice does not grant any license to use,
+copy, modify, distribute, sublicense, sell, reverse engineer, or create
+derivative works from this software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. TO THE MAXIMUM EXTENT
+PERMITTED BY LAW, AI CODERS SHALL NOT BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+OTHER LIABILITY ARISING FROM OR RELATED TO THE SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# AI Coders Installers
+
+This repository publishes the product-aware `@ai-coders/installer` CLI while
+keeping installation code separate from the project templates shared with AI
+Coders members.
+
+This is proprietary software. The package is published to the public npm
+registry only so authorized AI Coders users can execute it with `npx`.
+Registry availability does not make the project open source or grant reuse,
+modification, or redistribution rights. See [LICENSE](LICENSE).
+
+## Use
+
+Run the installer from the root of a supported product repository:
+
+```sh
+npx @ai-coders/installer second-brain
+npx @ai-coders/installer severino
+```
+
+The command always reads the product's contract from fixed files in the
+current directory — `./invokta.mcp.json` for Second Brain, `./package.json`
+for Severino — and does not accept a repository path or an alternate manifest
+file. The requested product must match the contract before any product
+installer starts. The installer then opens Clerk in the browser and starts the
+product only after a successful AI Coders sign-in.
+
+The public OAuth client configuration is bundled with the package, so members
+do not need to provide Clerk settings. Tokens and user credentials remain in
+memory for the current command and are never persisted. See
+[Installer authentication](docs/authentication.md) for the one-time Clerk
+application setup and security contract.
+
+## Develop
+
+```sh
+npm install
+npm run check
+npm start -- second-brain
+```
+
+The monorepo currently contains:
+
+- `src/`: public CLI, manifest validation, and product dispatch.
+- `packages/second-brain/`: the private Second Brain installer — node-side
+  pipeline under `src/`, plus a React + shadcn/Tailwind web UI under `ui/`
+  that Vite builds into `dist/products/second-brain/ui/`.
+- `packages/severino/`: the private Severino installer — node-side pipeline
+  under `src/`, plus a React + shadcn/Tailwind web UI under `ui/` that Vite
+  builds into `dist/products/severino/ui/`.
+- `packages/installer-ui/`: the private, source-only React + shadcn/Tailwind
+  kit shared by both product UIs through a Vite alias. It is not published.
+- `docs/adding-product.md`: the contract for adding another product installer.
+
+The public tarball contains the root CLI and compiled product implementations;
+the private workspace packages are not published independently.
+
+## Release
+
+Conventional Commit titles drive an automated Release PR with the version and
+changelog update. Merging that PR publishes `@ai-coders/installer` through npm
+trusted publishing without a long-lived npm token. See
+[Releases and npm publishing](docs/releases.md) for the maintainer workflow and
+one-time registry bootstrap.

package/dist/callback-page.d.ts

@@ -0,0 +1,11 @@
+export type AuthenticationCallbackStatus = "success" | "failure";
+export interface AuthenticationCallbackPageContent {
+    readonly language: string;
+    readonly title: string;
+    readonly status: AuthenticationCallbackStatus;
+    readonly statusLabel: string;
+    readonly heading: string;
+    readonly description: string;
+    readonly footer: string;
+}
+export declare function renderAuthenticationCallbackPage(content: AuthenticationCallbackPageContent): string;

package/dist/callback-page.js

@@ -0,0 +1,230 @@
+const aiCodersLogo = `<svg class="brand-logo" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 215 44" width="215" height="44" role="img" aria-label="AI Coders Academy">
+  <g transform="translate(0, 6)" fill="none" stroke="#FFFFFF">
+    <rect x="8" y="8" width="24" height="24" stroke-width="1"></rect>
+    <rect x="4" y="4" width="24" height="24" stroke-width="1.5"></rect>
+    <rect x="0" y="0" width="24" height="24" stroke-width="2"></rect>
+  </g>
+  <g font-family="Geist, Inter, ui-sans-serif, system-ui, sans-serif" letter-spacing="-0.6">
+    <text x="44" y="28" font-size="18" font-weight="600" fill="#FFFFFF">AI Coders <tspan font-weight="300" fill="#A1A1AA">Academy</tspan></text>
+  </g>
+</svg>`;
+const statusIcons = {
+    success: `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="m6.75 12.5 3.25 3.25 7.25-7.5"/></svg>`,
+    failure: `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="m8 8 8 8m0-8-8 8"/></svg>`,
+};
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+export function renderAuthenticationCallbackPage(content) {
+    const language = escapeHtml(content.language);
+    const title = escapeHtml(content.title);
+    const statusLabel = escapeHtml(content.statusLabel);
+    const heading = escapeHtml(content.heading);
+    const description = escapeHtml(content.description);
+    const footer = escapeHtml(content.footer);
+    return `<!doctype html>
+<html lang="${language}" data-auth-status="${content.status}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="dark">
+  <meta name="theme-color" content="#070707">
+  <title>${title}</title>
+  <style>
+    :root {
+      color: #fafafa;
+      background: #070707;
+      font-family: Geist, Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      font-synthesis: none;
+    }
+
+    * { box-sizing: border-box; }
+
+    body {
+      min-width: 320px;
+      min-height: 100vh;
+      min-height: 100svh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      overflow: hidden;
+      background:
+        radial-gradient(circle at 50% -12%, rgba(255, 255, 255, 0.14), transparent 36rem),
+        #070707;
+    }
+
+    body::before {
+      position: fixed;
+      inset: 0;
+      content: "";
+      pointer-events: none;
+      opacity: 0.16;
+      background-image:
+        linear-gradient(rgba(255, 255, 255, 0.08) 1px, transparent 1px),
+        linear-gradient(90deg, rgba(255, 255, 255, 0.08) 1px, transparent 1px);
+      background-size: 44px 44px;
+      mask-image: linear-gradient(to bottom, black, transparent 72%);
+    }
+
+    main {
+      position: relative;
+      width: min(100% - 32px, 680px);
+      margin: 32px auto;
+    }
+
+    .brand {
+      display: flex;
+      align-items: center;
+      margin: 0 0 28px 4px;
+    }
+
+    .brand-logo {
+      display: block;
+      width: min(215px, 72vw);
+      height: auto;
+      overflow: visible;
+    }
+
+    .panel {
+      position: relative;
+      overflow: hidden;
+      padding: clamp(32px, 7vw, 56px);
+      border: 1px solid #292929;
+      border-radius: 2px;
+      background: rgba(12, 12, 12, 0.94);
+      box-shadow: 0 32px 80px rgba(0, 0, 0, 0.48);
+    }
+
+    .panel::before,
+    .panel::after {
+      position: absolute;
+      width: 48px;
+      height: 48px;
+      content: "";
+      pointer-events: none;
+    }
+
+    .panel::before {
+      top: -24px;
+      right: -24px;
+      border: 1px solid #52525b;
+      box-shadow: -8px 8px 0 -1px #0c0c0c, -8px 8px 0 0 #3f3f46;
+    }
+
+    .panel::after {
+      right: 0;
+      bottom: 0;
+      border-right: 2px solid var(--status-color);
+      border-bottom: 2px solid var(--status-color);
+    }
+
+    html[data-auth-status="success"] { --status-color: #6ee7b7; }
+    html[data-auth-status="failure"] { --status-color: #fb7185; }
+
+    .status {
+      display: inline-flex;
+      align-items: center;
+      gap: 10px;
+      color: var(--status-color);
+      font-size: 12px;
+      font-weight: 650;
+      letter-spacing: 0.12em;
+      line-height: 1.4;
+      text-transform: uppercase;
+    }
+
+    .status-icon {
+      display: grid;
+      width: 28px;
+      height: 28px;
+      place-items: center;
+      border: 1px solid currentColor;
+    }
+
+    .status-icon svg {
+      width: 17px;
+      height: 17px;
+      fill: none;
+      stroke: currentColor;
+      stroke-linecap: square;
+      stroke-linejoin: miter;
+      stroke-width: 1.75;
+    }
+
+    h1 {
+      max-width: 12ch;
+      margin: 30px 0 16px;
+      font-size: clamp(36px, 8vw, 64px);
+      font-weight: 520;
+      letter-spacing: -0.055em;
+      line-height: 0.98;
+    }
+
+    .description {
+      max-width: 47ch;
+      margin: 0;
+      color: #a1a1aa;
+      font-size: clamp(16px, 2.5vw, 18px);
+      line-height: 1.65;
+    }
+
+    .footer {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+      margin-top: 40px;
+      padding-top: 20px;
+      border-top: 1px solid #27272a;
+      color: #71717a;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 11px;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+    }
+
+    .footer-mark {
+      width: 7px;
+      height: 7px;
+      border: 1px solid #a1a1aa;
+      box-shadow: 3px 3px 0 -1px #0c0c0c, 3px 3px 0 0 #71717a;
+    }
+
+    @media (max-width: 480px) {
+      main { width: min(100% - 24px, 680px); }
+      .brand { margin-bottom: 20px; }
+      .panel { padding: 28px 24px 30px; }
+      h1 { margin-top: 26px; }
+      .footer { margin-top: 32px; }
+    }
+
+    @media (prefers-reduced-motion: no-preference) {
+      .panel { animation: enter 420ms cubic-bezier(0.22, 1, 0.36, 1) both; }
+      @keyframes enter {
+        from { opacity: 0; transform: translateY(8px); }
+        to { opacity: 1; transform: translateY(0); }
+      }
+    }
+  </style>
+</head>
+<body>
+  <main aria-labelledby="callback-heading">
+    <div class="brand">${aiCodersLogo}</div>
+    <section class="panel">
+      <div class="status">
+        <span class="status-icon">${statusIcons[content.status]}</span>
+        <span>${statusLabel}</span>
+      </div>
+      <h1 id="callback-heading">${heading}</h1>
+      <p class="description">${description}</p>
+      <div class="footer"><span class="footer-mark" aria-hidden="true"></span>${footer}</div>
+    </section>
+  </main>
+</body>
+</html>`;
+}
+//# sourceMappingURL=callback-page.js.map

package/dist/callback-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-page.js","sourceRoot":"","sources":["../src/callback-page.ts"],"names":[],"mappings":"AAYA,MAAM,YAAY,GAAG;;;;;;;;;OASd,CAAC;AAER,MAAM,WAAW,GAAiD;IAChE,OAAO,EAAE,6FAA6F;IACtG,OAAO,EAAE,gFAAgF;CAC1F,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;cACK,QAAQ,uBAAuB,OAAO,CAAC,MAAM;;;;;;WAMhD,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAmLS,YAAY;;;oCAGD,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC/C,WAAW;;kCAEO,OAAO;+BACV,WAAW;gFACsC,MAAM;;;;QAI9E,CAAC;AACT,CAAC"}

package/dist/clerk-auth.d.ts

@@ -0,0 +1,18 @@
+export declare const clerkOAuthIssuer = "https://clerk.aicoders.academy";
+export declare const clerkOAuthClientId = "g43bqqz4g6o6uEV7";
+type FetchImplementation = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export interface AuthenticatedClerkUser {
+    readonly id: string;
+    readonly email?: string;
+    readonly name?: string;
+}
+export interface AuthenticateWithClerkOptions {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly writeOutput: (value: string) => void;
+    readonly fetch?: FetchImplementation;
+    readonly openBrowser?: (url: string) => Promise<void>;
+    readonly callbackTimeoutMs?: number;
+}
+export declare function authenticateWithClerk(options: AuthenticateWithClerkOptions): Promise<AuthenticatedClerkUser>;
+export {};

package/dist/clerk-auth.js

@@ -0,0 +1,296 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { cliMessages } from "./i18n.js";
+export const clerkOAuthIssuer = "https://clerk.aicoders.academy";
+export const clerkOAuthClientId = "g43bqqz4g6o6uEV7";
+const clerkOAuthScopes = ["openid", "profile", "email"];
+const defaultCallbackTimeoutMs = 120_000;
+const clerkRequestTimeoutMs = 15_000;
+const successPage = cliMessages.authenticationCompletePage;
+const failurePage = cliMessages.authenticationFailedPage;
+function normalizeIssuer(value) {
+    const normalized = value.trim().replace(/\/+$/, "");
+    let url;
+    try {
+        url = new URL(normalized);
+    }
+    catch {
+        throw new Error(cliMessages.oauthIssuerInvalidUrl);
+    }
+    if (url.protocol !== "https:" &&
+        !(url.protocol === "http:" && url.hostname === "127.0.0.1")) {
+        throw new Error(cliMessages.oauthIssuerRequiresHttps);
+    }
+    if (url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        throw new Error(cliMessages.oauthIssuerUrlInvalid);
+    }
+    return normalized;
+}
+function secureEqual(received, expected) {
+    const receivedBuffer = Buffer.from(received);
+    const expectedBuffer = Buffer.from(expected);
+    return (receivedBuffer.length === expectedBuffer.length &&
+        timingSafeEqual(receivedBuffer, expectedBuffer));
+}
+function callbackHeaders(contentType) {
+    return {
+        "Cache-Control": "no-store",
+        Connection: "close",
+        "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'",
+        "Content-Type": contentType,
+        "X-Content-Type-Options": "nosniff",
+    };
+}
+function endHtml(response, status, html, afterResponse) {
+    response.writeHead(status, callbackHeaders("text/html; charset=utf-8"));
+    response.end(html, afterResponse);
+}
+async function startOAuthCallbackServer(options) {
+    let settled = false;
+    let timeout;
+    let resolveCode;
+    let rejectCode;
+    const codePromise = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    const server = createServer((request, response) => {
+        if (request.method !== "GET" || request.url === undefined) {
+            response.writeHead(404, callbackHeaders("text/plain; charset=utf-8"));
+            response.end(cliMessages.callbackNotFound);
+            return;
+        }
+        const url = new URL(request.url, "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            response.writeHead(404, callbackHeaders("text/plain; charset=utf-8"));
+            response.end(cliMessages.callbackNotFound);
+            return;
+        }
+        if (settled) {
+            response.writeHead(410, callbackHeaders("text/plain; charset=utf-8"));
+            response.end(cliMessages.callbackAlreadyHandled);
+            return;
+        }
+        const errorCode = url.searchParams.get("error");
+        const state = url.searchParams.get("state");
+        const code = url.searchParams.get("code");
+        const finish = (status, page, settlePromise) => {
+            settled = true;
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+            endHtml(response, status, page, () => {
+                settlePromise();
+                server.close();
+            });
+        };
+        if (errorCode !== null) {
+            finish(400, failurePage, () => {
+                const safeErrorCode = errorCode
+                    .replace(/[^a-z0-9_-]/gi, "_")
+                    .slice(0, 64);
+                rejectCode(new Error(cliMessages.authenticationNotApproved(safeErrorCode)));
+            });
+            return;
+        }
+        if (state === null || !secureEqual(state, options.expectedState)) {
+            finish(400, failurePage, () => {
+                rejectCode(new Error(cliMessages.callbackStateMismatch));
+            });
+            return;
+        }
+        if (code === null || code === "") {
+            finish(400, failurePage, () => {
+                rejectCode(new Error(cliMessages.callbackMissingCode));
+            });
+            return;
+        }
+        finish(200, successPage, () => {
+            resolveCode(code);
+        });
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+    }
+    catch {
+        throw new Error(cliMessages.callbackServerStartFailed);
+    }
+    const address = server.address();
+    timeout = setTimeout(() => {
+        if (settled)
+            return;
+        settled = true;
+        rejectCode(new Error(cliMessages.authenticationTimedOut));
+        server.close();
+    }, options.timeoutMs);
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}/callback`,
+        waitForCode: () => codePromise,
+        close() {
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+            if (!settled)
+                settled = true;
+            if (server.listening)
+                server.close();
+        },
+    };
+}
+function buildAuthorizationUrl(options) {
+    const url = new URL(`${options.issuer}/oauth/authorize`);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", options.clientId);
+    url.searchParams.set("redirect_uri", options.redirectUri);
+    url.searchParams.set("scope", clerkOAuthScopes.join(" "));
+    url.searchParams.set("state", options.state);
+    url.searchParams.set("code_challenge", options.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url;
+}
+async function openBrowserBestEffort(url) {
+    const command = process.platform === "darwin"
+        ? { file: "open", args: [url] }
+        : process.platform === "win32"
+            ? { file: "explorer.exe", args: [url] }
+            : { file: "xdg-open", args: [url] };
+    try {
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // Printing the URL is the reliable fallback on every platform.
+    }
+}
+async function exchangeAuthorizationCode(options) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: options.clientId,
+        code: options.code,
+        code_verifier: options.codeVerifier,
+        redirect_uri: options.redirectUri,
+    });
+    let response;
+    try {
+        response = await options.fetch(`${options.issuer}/oauth/token`, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: body.toString(),
+            signal: AbortSignal.timeout(clerkRequestTimeoutMs),
+        });
+    }
+    catch {
+        throw new Error(cliMessages.tokenRequestFailed);
+    }
+    if (!response.ok) {
+        throw new Error(cliMessages.authorizationCodeRejected(response.status));
+    }
+    let value;
+    try {
+        value = (await response.json());
+    }
+    catch {
+        throw new Error(cliMessages.tokenResponseInvalidJson);
+    }
+    if (typeof value.access_token !== "string" || value.access_token === "") {
+        throw new Error(cliMessages.tokenResponseMissingAccessToken);
+    }
+    return value.access_token;
+}
+async function fetchClerkUser(options) {
+    let response;
+    try {
+        response = await options.fetch(`${options.issuer}/oauth/userinfo`, {
+            headers: { Authorization: `Bearer ${options.accessToken}` },
+            signal: AbortSignal.timeout(clerkRequestTimeoutMs),
+        });
+    }
+    catch {
+        throw new Error(cliMessages.userInfoRequestFailed);
+    }
+    if (!response.ok) {
+        throw new Error(cliMessages.authenticatedSessionRejected(response.status));
+    }
+    let value;
+    try {
+        value = (await response.json());
+    }
+    catch {
+        throw new Error(cliMessages.userInfoResponseInvalidJson);
+    }
+    if (typeof value.sub !== "string" || value.sub === "") {
+        throw new Error(cliMessages.userInfoResponseMissingUserId);
+    }
+    return {
+        id: value.sub,
+        ...(typeof value.email === "string" && value.email !== ""
+            ? { email: value.email }
+            : {}),
+        ...(typeof value.name === "string" && value.name !== ""
+            ? { name: value.name }
+            : {}),
+    };
+}
+export async function authenticateWithClerk(options) {
+    const issuer = normalizeIssuer(options.issuer);
+    const clientId = options.clientId.trim();
+    if (clientId === "") {
+        throw new Error(cliMessages.oauthClientIdRequired);
+    }
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const callbackServer = await startOAuthCallbackServer({
+        expectedState: state,
+        timeoutMs: options.callbackTimeoutMs ?? defaultCallbackTimeoutMs,
+    });
+    try {
+        const authorizeUrl = buildAuthorizationUrl({
+            issuer,
+            clientId,
+            redirectUri: callbackServer.redirectUri,
+            state,
+            codeChallenge,
+        }).toString();
+        options.writeOutput(cliMessages.signInPrompt(authorizeUrl));
+        const [code] = await Promise.all([
+            callbackServer.waitForCode(),
+            (options.openBrowser ?? openBrowserBestEffort)(authorizeUrl),
+        ]);
+        const fetchImplementation = options.fetch ?? globalThis.fetch;
+        const accessToken = await exchangeAuthorizationCode({
+            fetch: fetchImplementation,
+            issuer,
+            clientId,
+            code,
+            codeVerifier,
+            redirectUri: callbackServer.redirectUri,
+        });
+        const user = await fetchClerkUser({
+            fetch: fetchImplementation,
+            issuer,
+            accessToken,
+        });
+        options.writeOutput(cliMessages.authenticatedAs(user.email ?? user.name ?? user.id));
+        return user;
+    }
+    finally {
+        callbackServer.close();
+    }
+}
+//# sourceMappingURL=clerk-auth.js.map