@arvoretech/pi-kiro-provider 0.8.1

package/dist/kiro-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-cli.d.ts","sourceRoot":"","sources":["../src/kiro-cli.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlE,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAmBrD;AAoED,wBAAgB,qBAAqB,IAAI,eAAe,GAAG,SAAS,CAoBnE;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAC9C,eAAe,GACf,SAAS,CAmBX;AAED,iBAAS,eAAe,CACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,cAAc,EAC1B,YAAY,UAAQ,GAClB,eAAe,GAAG,SAAS,CAuD7B;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,GAAG,SAAS,CAQnE;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,IAC9C,eAAe,GACf,SAAS,CAQX;AAOD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAgCnE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,eAAe,GAAG,SAAS,CAY/D"}

package/dist/kiro-cli.js

@@ -0,0 +1,271 @@
+// ABOUTME: Reads and writes credentials from the kiro-cli SQLite database.
+// ABOUTME: Provides fallback auth and write-back to keep kiro-cli in sync after refresh.
+import { execFileSync, execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+const require = createRequire(import.meta.url);
+export function getKiroCliDbPath() {
+    const p = platform();
+    let dbPath;
+    if (p === "win32")
+        dbPath = join(process.env.APPDATA || join(homedir(), "AppData", "Roaming"), "kiro-cli", "data.sqlite3");
+    else if (p === "darwin")
+        dbPath = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
+    else
+        dbPath = join(homedir(), ".local", "share", "kiro-cli", "data.sqlite3");
+    return existsSync(dbPath) ? dbPath : undefined;
+}
+function getNodeSqlite() {
+    try {
+        return require("node:sqlite");
+    }
+    catch {
+        return undefined;
+    }
+}
+function queryKiroCliDb(dbPath, sql) {
+    const sqlite = getNodeSqlite();
+    if (sqlite) {
+        try {
+            const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+            try {
+                const rows = db.prepare(sql).all();
+                const result = JSON.stringify(rows);
+                return result === "[]" ? undefined : result;
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch {
+            // Fall through to sqlite3 CLI fallback
+        }
+    }
+    try {
+        const result = execSync(`sqlite3 -json "${dbPath}" "${sql}"`, {
+            encoding: "utf-8",
+            timeout: 5000,
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        return result || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function execKiroCliDb(dbPath, sql) {
+    const sqlite = getNodeSqlite();
+    if (sqlite) {
+        try {
+            const db = new sqlite.DatabaseSync(dbPath);
+            try {
+                db.exec(sql);
+                return true;
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch {
+            // Fall through to sqlite3 CLI fallback
+        }
+    }
+    try {
+        execSync(`sqlite3 "${dbPath}"`, {
+            input: sql,
+            encoding: "utf-8",
+            timeout: 5000,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getKiroCliCredentials() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        // Try IDC token first (preferred — has clientId/clientSecret for refresh)
+        const idcCreds = tryKiroCliToken(dbPath, "kirocli:odic:token", "idc");
+        if (idcCreds)
+            return idcCreds;
+        // Fall back to desktop/social token
+        const desktopCreds = tryKiroCliToken(dbPath, "kirocli:social:token", "desktop");
+        if (desktopCreds)
+            return desktopCreds;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Like getKiroCliCredentials but returns credentials even when the access token
+ * is expired, as long as a refresh token exists. Used to attempt a token refresh
+ * before falling back to the full device code login flow.
+ */
+export function getKiroCliCredentialsAllowExpired() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        const idcCreds = tryKiroCliToken(dbPath, "kirocli:odic:token", "idc", true);
+        if (idcCreds)
+            return idcCreds;
+        const desktopCreds = tryKiroCliToken(dbPath, "kirocli:social:token", "desktop", true);
+        if (desktopCreds)
+            return desktopCreds;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function tryKiroCliToken(dbPath, tokenKey, authMethod, allowExpired = false) {
+    const tokenResult = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${tokenKey}'`);
+    if (!tokenResult)
+        return undefined;
+    const rows = JSON.parse(tokenResult);
+    if (!rows[0]?.value)
+        return undefined;
+    const tokenData = JSON.parse(rows[0].value);
+    if (!tokenData.access_token || !tokenData.refresh_token)
+        return undefined;
+    let expiresAt = Date.now() + 3600000;
+    if (tokenData.expires_at)
+        expiresAt = new Date(tokenData.expires_at).getTime();
+    if (!allowExpired && Date.now() >= expiresAt - 2 * 60 * 1000)
+        return undefined;
+    const region = tokenData.region || "us-east-1";
+    if (authMethod === "desktop") {
+        return {
+            refresh: `${tokenData.refresh_token}|desktop`,
+            access: tokenData.access_token,
+            expires: expiresAt,
+            clientId: "",
+            clientSecret: "",
+            region,
+            authMethod: "desktop",
+            profileArn: tokenData.profile_arn || tokenData.profileArn,
+        };
+    }
+    // IDC — need device registration credentials for refresh
+    let clientId = "";
+    let clientSecret = "";
+    // Match the device-registration key to the same prefix as the token key
+    const keyPrefix = tokenKey.split(":")[0]; // "kirocli" or "codewhisperer"
+    const deviceResult = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${keyPrefix}:odic:device-registration'`);
+    if (deviceResult) {
+        try {
+            const d = JSON.parse(JSON.parse(deviceResult)[0]?.value);
+            clientId = d.client_id || d.clientId || "";
+            clientSecret = d.client_secret || d.clientSecret || "";
+        }
+        catch { }
+    }
+    return {
+        refresh: `${tokenData.refresh_token}|${clientId}|${clientSecret}|idc`,
+        access: tokenData.access_token,
+        expires: expiresAt,
+        clientId,
+        clientSecret,
+        region,
+        authMethod: "idc",
+    };
+}
+// Re-export the internal function for use by getKiroCliSocialToken
+export { tryKiroCliToken };
+/**
+ * Get the social token (Google/GitHub) from kiro-cli if available.
+ * Returns undefined if no valid social token exists.
+ * This is used to prefer social login when the user has logged in that way.
+ */
+export function getKiroCliSocialToken() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        return tryKiroCliToken(dbPath, "kirocli:social:token", "desktop");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Like getKiroCliSocialToken but returns credentials even when the access token
+ * is expired, as long as a refresh token exists.
+ */
+export function getKiroCliSocialTokenAllowExpired() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        return tryKiroCliToken(dbPath, "kirocli:social:token", "desktop", true);
+    }
+    catch {
+        return undefined;
+    }
+}
+const TOKEN_KEY_BY_AUTH_METHOD = {
+    idc: ["kirocli:odic:token", "codewhisperer:odic:token"],
+    desktop: ["kirocli:social:token"],
+};
+export function saveKiroCliCredentials(creds) {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return;
+    const rawRefreshToken = creds.refresh.split("|")[0] ?? "";
+    // Our expires has a 5-min buffer subtracted; restore approximate actual expiry for kiro-cli
+    const expiresAt = new Date(creds.expires + 5 * 60 * 1000).toISOString();
+    const tokenKeys = TOKEN_KEY_BY_AUTH_METHOD[creds.authMethod] ?? [];
+    for (const key of tokenKeys) {
+        const existing = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${key}'`);
+        if (!existing)
+            continue;
+        try {
+            const rows = JSON.parse(existing);
+            if (!rows[0]?.value)
+                continue;
+            const tokenData = JSON.parse(rows[0].value);
+            tokenData.access_token = creds.access;
+            tokenData.refresh_token = rawRefreshToken;
+            tokenData.expires_at = expiresAt;
+            if (creds.region)
+                tokenData.region = creds.region;
+            if (creds.profileArn)
+                tokenData.profile_arn = creds.profileArn;
+            const escaped = JSON.stringify(tokenData).replace(/'/g, "''");
+            const sql = `UPDATE auth_kv SET value = '${escaped}' WHERE key = '${key}';`;
+            if (execKiroCliDb(dbPath, sql))
+                return;
+        }
+        catch { }
+    }
+}
+/**
+ * Ask kiro-cli to refresh its own tokens via `kiro-cli debug refresh-auth-token`,
+ * then re-read the SQLite DB for fresh credentials.
+ *
+ * Returns refreshed credentials on success, or undefined if kiro-cli is not
+ * installed, the command fails, or the DB still has no valid tokens afterward.
+ */
+export function refreshViaKiroCli() {
+    try {
+        execFileSync("kiro-cli", ["debug", "refresh-auth-token"], {
+            timeout: 15000,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return getKiroCliCredentials();
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.warn(`[pi-provider-kiro] kiro-cli refresh failed: ${msg}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=kiro-cli.js.map

package/dist/kiro-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-cli.js","sourceRoot":"","sources":["../src/kiro-cli.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yFAAyF;AAEzF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,UAAU,gBAAgB;IAC/B,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC,KAAK,OAAO;QAChB,MAAM,GAAG,IAAI,CACZ,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAC5D,UAAU,EACV,cAAc,CACd,CAAC;SACE,IAAI,CAAC,KAAK,QAAQ;QACtB,MAAM,GAAG,IAAI,CACZ,OAAO,EAAE,EACT,SAAS,EACT,qBAAqB,EACrB,UAAU,EACV,cAAc,CACd,CAAC;;QACE,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAC7E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,aAAa;IACrB,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAe,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACV,EAAE,CAAC,KAAK,EAAE,CAAC;YACZ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,uCAAuC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,MAAM,MAAM,GAAG,GAAG,EAAE;YAC7D,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,IAAI,SAAS,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IACjD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACJ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,IAAI,CAAC;YACb,CAAC;oBAAS,CAAC;gBACV,EAAE,CAAC,KAAK,EAAE,CAAC;YACZ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,uCAAuC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,QAAQ,CAAC,YAAY,MAAM,GAAG,EAAE;YAC/B,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACJ,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,oCAAoC;QACpC,MAAM,YAAY,GAAG,eAAe,CACnC,MAAM,EACN,sBAAsB,EACtB,SAAS,CACT,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC;IAGhD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,YAAY,GAAG,eAAe,CACnC,MAAM,EACN,sBAAsB,EACtB,SAAS,EACT,IAAI,CACJ,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAc,EACd,QAAgB,EAChB,UAA0B,EAC1B,YAAY,GAAG,KAAK;IAEpB,MAAM,WAAW,GAAG,cAAc,CACjC,MAAM,EACN,0CAA0C,QAAQ,GAAG,CACrD,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA6B,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,SAAS,CAAC,UAAU;QACvB,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAC3D,OAAO,SAAS,CAAC;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC;IAE/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,OAAO,EAAE,GAAG,SAAS,CAAC,aAAa,UAAU;YAC7C,MAAM,EAAE,SAAS,CAAC,YAAY;YAC9B,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,UAAU;SACzD,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,wEAAwE;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IACzE,MAAM,YAAY,GAAG,cAAc,CAClC,MAAM,EACN,0CAA0C,SAAS,4BAA4B,CAC/E,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3C,YAAY,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IACD,OAAO;QACN,OAAO,EAAE,GAAG,SAAS,CAAC,aAAa,IAAI,QAAQ,IAAI,YAAY,MAAM;QACrE,MAAM,EAAE,SAAS,CAAC,YAAY;QAC9B,OAAO,EAAE,SAAS;QAClB,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,UAAU,EAAE,KAAK;KACjB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACpC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACJ,OAAO,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC;IAGhD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACJ,OAAO,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,wBAAwB,GAAqC;IAClE,GAAG,EAAE,CAAC,oBAAoB,EAAE,0BAA0B,CAAC;IACvD,OAAO,EAAE,CAAC,sBAAsB,CAAC;CACjC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,KAAsB;IAC5D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,4FAA4F;IAC5F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAEnE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,cAAc,CAC9B,MAAM,EACN,0CAA0C,GAAG,GAAG,CAChD,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA6B,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK;gBAAE,SAAS;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAE5C,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;YACtC,SAAS,CAAC,aAAa,GAAG,eAAe,CAAC;YAC1C,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM;gBAAE,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAClD,IAAI,KAAK,CAAC,UAAU;gBAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;YAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,+BAA+B,OAAO,kBAAkB,GAAG,IAAI,CAAC;YAC5E,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO;QACxC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC;QACJ,YAAY,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE;YACzD,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC"}

package/dist/kiro-ide.d.ts

@@ -0,0 +1,13 @@
+import type { KiroCredentials } from "./oauth.js";
+/**
+ * Returns valid (non-expired) Kiro IDE credentials read from
+ * ~/.aws/sso/cache/kiro-auth-token.json, or undefined if the IDE has not
+ * logged in or the token has already expired.
+ */
+export declare function getKiroIdeCredentials(): KiroCredentials | undefined;
+/**
+ * Like getKiroIdeCredentials but also returns expired tokens so the caller can
+ * attempt a silent OIDC refresh before falling back to the full login flow.
+ */
+export declare function getKiroIdeCredentialsAllowExpired(): KiroCredentials | undefined;
+//# sourceMappingURL=kiro-ide.d.ts.map

package/dist/kiro-ide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-ide.d.ts","sourceRoot":"","sources":["../src/kiro-ide.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAyElD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,GAAG,SAAS,CAEnE;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,IAC9C,eAAe,GACf,SAAS,CAEX"}

package/dist/kiro-ide.js

@@ -0,0 +1,74 @@
+// ABOUTME: Reads credentials written by the Kiro IDE.
+// ABOUTME: The IDE stores its auth token at ~/.aws/sso/cache/kiro-auth-token.json
+// ABOUTME: on all platforms (Windows, macOS, Linux) after every successful login,
+// ABOUTME: including IAM Identity Center (authMethod: "IdC") and Builder ID.
+// ABOUTME: A companion file, ~/.aws/sso/cache/{clientIdHash}.json, holds the
+// ABOUTME: OIDC clientId/clientSecret needed to silently refresh the access token
+// ABOUTME: via the standard AWS OIDC /token endpoint — no extra login flow needed.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// ~/.aws/sso/cache is the standard AWS SSO cache directory on all platforms.
+// Node's os.homedir() returns the correct home directory on Windows, macOS and Linux.
+const SSO_CACHE_DIR = join(homedir(), ".aws", "sso", "cache");
+const KIRO_IDE_TOKEN_PATH = join(SSO_CACHE_DIR, "kiro-auth-token.json");
+function readKiroIdeToken(allowExpired) {
+    try {
+        if (!existsSync(KIRO_IDE_TOKEN_PATH))
+            return undefined;
+        const tokenData = JSON.parse(readFileSync(KIRO_IDE_TOKEN_PATH, "utf-8"));
+        if (!tokenData.accessToken || !tokenData.refreshToken)
+            return undefined;
+        const expiresAt = new Date(tokenData.expiresAt).getTime();
+        if (!allowExpired && Date.now() >= expiresAt - 2 * 60 * 1000)
+            return undefined;
+        const region = tokenData.region ?? "us-east-1";
+        // Load the OIDC client registration so refreshKiroTokenDirect can call the
+        // AWS OIDC /token endpoint with a refresh_token grant without prompting the user.
+        let clientId = "";
+        let clientSecret = "";
+        if (tokenData.clientIdHash) {
+            const regPath = join(SSO_CACHE_DIR, `${tokenData.clientIdHash}.json`);
+            if (existsSync(regPath)) {
+                try {
+                    const reg = JSON.parse(readFileSync(regPath, "utf-8"));
+                    clientId = reg.clientId ?? "";
+                    clientSecret = reg.clientSecret ?? "";
+                }
+                catch {
+                    // Ignore — we can still use the token without a refresh client
+                }
+            }
+        }
+        return {
+            // Pack into the same pipe-delimited format used by the rest of the refresh chain
+            refresh: `${tokenData.refreshToken}|${clientId}|${clientSecret}|idc`,
+            access: tokenData.accessToken,
+            // Subtract 2-min buffer so we refresh before the actual AWS expiry
+            expires: expiresAt - 2 * 60 * 1000,
+            clientId,
+            clientSecret,
+            region,
+            authMethod: "idc",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Returns valid (non-expired) Kiro IDE credentials read from
+ * ~/.aws/sso/cache/kiro-auth-token.json, or undefined if the IDE has not
+ * logged in or the token has already expired.
+ */
+export function getKiroIdeCredentials() {
+    return readKiroIdeToken(false);
+}
+/**
+ * Like getKiroIdeCredentials but also returns expired tokens so the caller can
+ * attempt a silent OIDC refresh before falling back to the full login flow.
+ */
+export function getKiroIdeCredentialsAllowExpired() {
+    return readKiroIdeToken(true);
+}
+//# sourceMappingURL=kiro-ide.js.map

package/dist/kiro-ide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-ide.js","sourceRoot":"","sources":["../src/kiro-ide.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,mFAAmF;AAEnF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,6EAA6E;AAC7E,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAkBxE,SAAS,gBAAgB,CAAC,YAAqB;IAC9C,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,OAAO,SAAS,CAAC;QAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC3B,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CACtB,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAExE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAC3D,OAAO,SAAS,CAAC;QAElB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC;QAE/C,2EAA2E;QAC3E,kFAAkF;QAClF,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,YAAY,OAAO,CAAC,CAAC;YACtE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACrB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CACT,CAAC;oBACvB,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;oBAC9B,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACR,+DAA+D;gBAChE,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO;YACN,iFAAiF;YACjF,OAAO,EAAE,GAAG,SAAS,CAAC,YAAY,IAAI,QAAQ,IAAI,YAAY,MAAM;YACpE,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,mEAAmE;YACnE,OAAO,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,UAAU,EAAE,KAAK;SACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACpC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC;IAGhD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/login-ui.d.ts

@@ -0,0 +1,18 @@
+import { type ExtensionContext } from "@earendil-works/pi-coding-agent";
+export type LoginChoice = {
+    method: "builder-id";
+} | {
+    method: "idc";
+    startUrl: string;
+} | {
+    method: "google";
+} | {
+    method: "github";
+} | null;
+export declare function setExtensionContext(ctx: ExtensionContext): void;
+/**
+ * Show the login method selection UI using pi's native TUI components.
+ * Returns the user's choice or null if cancelled.
+ */
+export declare function showLoginUI(): Promise<LoginChoice>;
+//# sourceMappingURL=login-ui.d.ts.map

package/dist/login-ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ui.d.ts","sourceRoot":"","sources":["../src/login-ui.ts"],"names":[],"mappings":"AAQA,OAAO,EAEN,KAAK,gBAAgB,EACrB,MAAM,iCAAiC,CAAC;AASzC,MAAM,MAAM,WAAW,GACpB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB,IAAI,CAAC;AAIR,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,QAExD;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CA4HxD"}

package/dist/login-ui.js

@@ -0,0 +1,124 @@
+// Feature 10b: Custom TUI login component
+//
+// Replaces multiple onPrompt calls with a single ctx.ui.custom() overlay
+// to work around pi's stacked-input bug (mirrored cursors on sequential prompts).
+//
+// Phase 1: SelectList — pick login method (Builder ID / IdC / Google / GitHub)
+// Phase 2: Input — enter IAM Identity Center start URL (only for option 2)
+import { DynamicBorder, } from "@earendil-works/pi-coding-agent";
+import { Container, Input, SelectList, Text, } from "@earendil-works/pi-tui";
+let _ctx;
+export function setExtensionContext(ctx) {
+    _ctx = ctx;
+}
+/**
+ * Show the login method selection UI using pi's native TUI components.
+ * Returns the user's choice or null if cancelled.
+ */
+export async function showLoginUI() {
+    if (!_ctx)
+        return null;
+    const ctx = _ctx;
+    return ctx.ui.custom((tui, theme, _kb, done) => {
+        const items = [
+            {
+                value: "builder-id",
+                label: "Builder ID",
+                description: "AWS Builder ID (default)",
+            },
+            {
+                value: "idc",
+                label: "Your organization",
+                description: "IAM Identity Center (SSO)",
+            },
+            {
+                value: "google",
+                label: "Google",
+                description: "Social login via kiro-cli",
+            },
+            {
+                value: "github",
+                label: "GitHub",
+                description: "Social login via kiro-cli",
+            },
+        ];
+        let phase = "select";
+        const container = new Container();
+        const border = new DynamicBorder((s) => theme.fg("accent", s));
+        const title = new Text(theme.fg("accent", theme.bold("Kiro Login")), 1, 0);
+        const hint = new Text(theme.fg("dim", "↑↓ navigate • enter select • esc cancel"), 1, 0);
+        const borderBottom = new DynamicBorder((s) => theme.fg("accent", s));
+        // Phase 1: SelectList
+        const selectList = new SelectList(items, items.length, {
+            selectedPrefix: (t) => theme.fg("accent", t),
+            selectedText: (t) => theme.fg("accent", t),
+            description: (t) => theme.fg("muted", t),
+            scrollInfo: (t) => theme.fg("dim", t),
+            noMatch: (t) => theme.fg("warning", t),
+        });
+        selectList.onSelect = (item) => {
+            if (item.value === "idc") {
+                switchToUrlInput();
+            }
+            else {
+                done({ method: item.value });
+            }
+        };
+        selectList.onCancel = () => done(null);
+        // Phase 2: URL Input
+        const urlLabel = new Text("Start URL (e.g. https://mycompany.awsapps.com/start)", 1, 0);
+        const urlInput = new Input();
+        const urlHint = new Text(theme.fg("dim", "enter submit • esc back"), 1, 0);
+        urlInput.onSubmit = (value) => {
+            const trimmed = value.trim();
+            if (trimmed?.startsWith("http")) {
+                done({ method: "idc", startUrl: trimmed });
+            }
+        };
+        urlInput.onEscape = () => {
+            switchToSelect();
+        };
+        function switchToUrlInput() {
+            phase = "url";
+            container.clear();
+            container.addChild(border);
+            container.addChild(new Text(theme.fg("accent", theme.bold("IAM Identity Center")), 1, 0));
+            container.addChild(urlLabel);
+            container.addChild(urlInput);
+            container.addChild(urlHint);
+            container.addChild(borderBottom);
+            tui.requestRender();
+        }
+        function switchToSelect() {
+            phase = "select";
+            urlInput.setValue("");
+            container.clear();
+            container.addChild(border);
+            container.addChild(title);
+            container.addChild(selectList);
+            container.addChild(hint);
+            container.addChild(borderBottom);
+            tui.requestRender();
+        }
+        // Initial state
+        switchToSelect();
+        return {
+            render(width) {
+                return container.render(width);
+            },
+            invalidate() {
+                container.invalidate();
+            },
+            handleInput(data) {
+                if (phase === "select") {
+                    selectList.handleInput(data);
+                }
+                else {
+                    urlInput.handleInput(data);
+                }
+                tui.requestRender();
+            },
+        };
+    });
+}
+//# sourceMappingURL=login-ui.js.map

package/dist/login-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ui.js","sourceRoot":"","sources":["../src/login-ui.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,yEAAyE;AACzE,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAE3E,OAAO,EACN,aAAa,GAEb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,SAAS,EACT,KAAK,EAEL,UAAU,EACV,IAAI,GACJ,MAAM,wBAAwB,CAAC;AAShC,IAAI,IAAkC,CAAC;AAEvC,MAAM,UAAU,mBAAmB,CAAC,GAAqB;IACxD,IAAI,GAAG,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC;IAEjB,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,CAAc,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAiB;YAC3B;gBACC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,0BAA0B;aACvC;YACD;gBACC,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,2BAA2B;aACxC;YACD;gBACC,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,QAAQ;gBACf,WAAW,EAAE,2BAA2B;aACxC;YACD;gBACC,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,QAAQ;gBACf,WAAW,EAAE,2BAA2B;aACxC;SACD,CAAC;QAEF,IAAI,KAAK,GAAqB,QAAQ,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,IAAI,CACpB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,yCAAyC,CAAC,EAC1D,CAAC,EACD,CAAC,CACD,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,aAAa,CAAC,CAAC,CAAS,EAAE,EAAE,CACpD,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CACrB,CAAC;QAEF,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YACtD,cAAc,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,WAAW,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;SAC9C,CAAC,CAAC;QAEH,UAAU,CAAC,QAAQ,GAAG,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC1B,gBAAgB,EAAE,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAA2C,EAAE,CAAC,CAAC;YACpE,CAAC;QACF,CAAC,CAAC;QACF,UAAU,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvC,qBAAqB;QACrB,MAAM,QAAQ,GAAG,IAAI,IAAI,CACxB,sDAAsD,EACtD,CAAC,EACD,CAAC,CACD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3E,QAAQ,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC,CAAC;QACF,QAAQ,CAAC,QAAQ,GAAG,GAAG,EAAE;YACxB,cAAc,EAAE,CAAC;QAClB,CAAC,CAAC;QAEF,SAAS,gBAAgB;YACxB,KAAK,GAAG,KAAK,CAAC;YACd,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3B,SAAS,CAAC,QAAQ,CACjB,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACjC,GAAG,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC;QAED,SAAS,cAAc;YACtB,KAAK,GAAG,QAAQ,CAAC;YACjB,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtB,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACjC,GAAG,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC;QAED,gBAAgB;QAChB,cAAc,EAAE,CAAC;QAEjB,OAAO;YACN,MAAM,CAAC,KAAa;gBACnB,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,UAAU;gBACT,SAAS,CAAC,UAAU,EAAE,CAAC;YACxB,CAAC;YACD,WAAW,CAAC,IAAY;gBACvB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACP,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBACD,GAAG,CAAC,aAAa,EAAE,CAAC;YACrB,CAAC;SACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
+/**
+ * Interactive login fallback — shown when no existing credentials are available.
+ *
+ * Uses pi's native TUI components (SelectList + Input) via ctx.ui.custom()
+ * when available, falling back to a single onPrompt call otherwise.
+ * This avoids pi's stacked-input bug where sequential onPrompt calls
+ * render simultaneously with mirrored cursors.
+ */
+export declare function interactiveLogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+/**
+ * Delegate Google/GitHub social login to kiro-cli.
+ * Requires kiro-cli to be installed and in PATH.
+ */
+export declare function loginViaKiroCli(callbacks: OAuthLoginCallbacks, provider: "google" | "github"): Promise<OAuthCredentials>;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACX,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,uBAAuB,CAAC;AAuD/B;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACrC,SAAS,EAAE,mBAAmB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAoC3B;AA8KD;;;GAGG;AACH,wBAAsB,eAAe,CACpC,SAAS,EAAE,mBAAmB,EAC9B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA+B3B"}