@aventurevc/aventure-cli 0.7.295 → 0.7.297

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventurevc/aventure-cli",
-  "version": "0.7.295",
+  "version": "0.7.297",
   "private": false,
   "description": "Public aVenture CLI.",
   "license": "Apache-2.0",
@@ -32,9 +32,9 @@
   },
   "aventurePublicApi": {
     "repository": "aventurevc/aventure-docs",
-    "commit": "1096ae5d667a3291b4f51ffa1f9e204dffbbabe1",
+    "commit": "7e36fb07332c731d3f7af9c82cfb7d3135332106",
     "openapiPath": "openapi/openapi.json",
-    "openapiSha256": "7329b0be0a63b60365be9dc3f99d955d6e404e368f7832d27d001f3edf683d34"
+    "openapiSha256": "b389c60065d3cc764ad9ff6c92a7530c7e9d8fdc0fdc3fad1c1c2b683a84f5c0"
   },
   "scripts": {}
 }

package/dist/chunks/oauth-credential-BvaMUsLv.js

@@ -1,2 +0,0 @@
-import{A as e,a as t,g as n,k as r,r as i}from"./auth-DVA6KxqF.js";import{randomUUID as a}from"node:crypto";import{chmod as o,mkdir as s,readFile as c,rename as l,rm as u,writeFile as d}from"node:fs/promises";import{dirname as f,join as p}from"node:path";function m(e,t=[]){let r=e instanceof Error?e.message:String(e);return n(r,t)}function h(e,t=[]){let r=n(e.title,t),i=n(e.detail?.trim()??``,t);return`${e.status} ${r}${i?` — ${i}`:``}`}function g(e){let t=e.trim();if(t.length===0)throw Error(`API host must not be blank`);let n=new URL(y(t)?t:`${b(t)}://${t}`),r=x(n.hostname);if(n.protocol!==`https:`&&n.protocol!==`http:`||n.username.length>0||n.password.length>0||n.pathname!==`/`&&n.pathname!==``||n.search.length>0||n.hash.length>0)throw Error(`API host must contain only an HTTP(S) host and optional port`);if(n.protocol===`http:`&&!r)throw Error(`personal credentials require HTTPS except for loopback API hosts`);return{host:n.host.toLowerCase(),origin:n.origin,isLoopback:r}}function _(e){return{...e,host:g(e.host).origin}}function v(e){let t=g(e);if(t.isLoopback)return`http://localhost:3000`;if(t.host===`api.aventure.vc`)return`https://aventure.vc`;throw Error(`no first-party browser origin is configured for API host ${t.host}`)}function y(e){return/^[a-z][a-z\d+.-]*:\/\//iu.test(e)}function b(e){let t=e.split(`/`,1)[0]?.toLowerCase()??``;try{return x(new URL(`http://${t}`).hostname)?`http`:`https`}catch{return`https`}}function x(e){let t=e.toLowerCase();return t===`localhost`||t===`127.0.0.1`||t===`0.0.0.0`||t===`[::1]`}function S(){return p(f(r()),`credentials.json`)}function ee(e){return`OS keyring is unusable (${e}); the credential will be stored in ${S()} (mode 0600).\n`}async function C(e,t){let n;try{let n=await(await O(e,t)).getPassword()??void 0;if(n!==void 0)return{record:{provider:`keyring`,value:n}}}catch(e){n=D(e)}let r=(await k())[e]?.[t];return{...r===void 0?{}:{record:{provider:`file`,value:r}},...n===void 0?{}:{keyringFailure:n}}}async function w(e,t,n){let r;try{let i=await O(e,t);if(await i.setPassword(n),await i.getPassword()===n)return await A(e,t,void 0),`keyring`;r=`Error: keyring readback did not match`}catch(e){r=D(e,[n])}if(await A(e,t,n),(await k())[e]?.[t]!==n)throw Error(`credential storage did not confirm a durable write (keyring: ${r}; file: readback did not match)`);return`file`}async function T(e,t){let n=await O(e,t),r;try{await n.deleteCredential()}catch(e){r=e}let i;try{i=await n.getPassword()??void 0}catch(n){throw await A(e,t,void 0),Error(`OS keyring removal outcome is unknown (${D(r??n)})`,{cause:n})}if(await A(e,t,void 0),i!==void 0)throw Error(`OS keyring did not confirm removal (${D(r)})`,r===void 0?void 0:{cause:r})}async function E(e,t){let n=`${t}:probe:${a()}`,r=`aventure-cli-credential-probe:${a()}`,i;try{let t=await O(e,n);await t.setPassword(r);let a=await(await O(e,n)).getPassword(),o=await t.deleteCredential(),s=await(await O(e,n)).getPassword()??void 0;if(a!==r)i=`Error: probe readback did not match`;else if(!o||s!==void 0)i=`Error: probe cleanup was not confirmed`;else return{provider:`keyring`}}catch(e){i=D(e,[r])}try{await A(e,n,r);let t=(await k())[e]?.[n];if(await A(e,n,void 0),t!==r)throw Error(`probe readback did not match`)}catch(e){throw Error(`credential storage is unavailable (keyring: ${i}; file ${S()}: ${D(e,[r])})`,{cause:e})}return{provider:`file`,keyringFailure:i}}function D(e,t=[]){if(!(e instanceof Error))return`Error`;let n=e.name||`Error`,[r=``]=m(e,t).trim().split(`
-`,1);return r&&r!==n?`${n}: ${r}`:n}async function O(e,t){let{AsyncEntry:n}=await import(`@napi-rs/keyring`);return new n(e,t)}async function k(){let t=S(),n;try{n=await c(t,`utf8`)}catch(t){if(e(t))return{};throw t}let r;try{r=JSON.parse(n)}catch(e){throw Error(`${t} is not a valid credential file`,{cause:e})}if(!j(r))throw Error(`${t} is not a valid credential file`);return r}async function A(e,t,n){let r=S(),i=await k(),a={...i[e]};if(n===void 0?delete a[t]:a[t]=n,Object.keys(a).length===0?delete i[e]:i[e]=a,Object.keys(i).length===0){await u(r,{force:!0});return}await s(f(r),{recursive:!0,mode:448});let c=`${r}.tmp`;await d(c,`${JSON.stringify(i,null,2)}\n`,{mode:384}),await o(c,384),await l(c,r)}function j(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`))}var M=`vc.aventure.aventure-cli.oauth`,te=`oauth:`,ne=6e4;function re(e,t){let n=X(t);return{client:e,expiresAt:ae(Z(n)),tokens:n}}async function ie(e,t){let n=V(e),r=G(n,t),i;try{i=await w(M,W(n),r)}catch(e){throw Error(`OAuth credential could not be stored — ${m(e,[r,...U(t.tokens)])}`,{cause:e})}return{host:n,provider:i,credential:K(n,r)}}async function N(e){let t=V(e),n;try{n=await C(M,W(t))}catch(e){return{state:`unavailable`,summary:m(e)}}let{record:r,keyringFailure:i}=n;return r===void 0?i===void 0?{state:`missing`}:{state:`missing`,keyringFailure:i}:{state:`found`,stored:{host:t,provider:r.provider,credential:K(t,r.value)}}}async function P(e){await T(M,W(V(e)))}async function F(e){try{return await N(e)}catch(e){return{state:`invalid`,summary:m(e)}}}async function I(e){let t=await F(e);if(t.state!==`missing`)return t;let n=await L(e);return n.state===`unavailable`?n:n.keyringFailure===void 0?{state:`missing`}:{state:`missing`,keyringFailure:n.keyringFailure}}async function L(e){let t=V(e);try{return{state:`available`,...await E(M,W(t))}}catch(e){return{state:`unavailable`,summary:m(e)}}}function R(e){return B(e.authorizationServer,`authorization server`)}function z(e){return B(e.resource,`resource`)}function B(e,t,n=!1){let r;try{r=new URL(e)}catch(e){throw Error(`OAuth ${t} is not a valid URL`,{cause:e})}if(r.protocol!==`https:`||r.username.length>0||r.password.length>0||!n&&r.search.length>0||r.hash.length>0)throw Error(`OAuth ${t} must be an HTTPS URL without credentials${n?``:`, query`} or fragment`);return r}function V(e){return g(e).host}function H(e){return new Date(e.expiresAt).getTime()-ne<=Date.now()}function U(e){return[e.access_token,e.refresh_token,e.id_token]}function W(e){return`${te}${e}`}function G(e,t){return JSON.stringify({client:q(e,t.client),expiresAt:Q(t.expiresAt),tokens:X(t.tokens)})}function K(e,t){let n;try{n=JSON.parse(t)}catch(e){throw Error(`OS OAuth credential entry failed schema validation`,{cause:e})}if(!oe(n))throw Error(`OS OAuth credential entry failed schema validation`);return{client:q(e,J(n.client)),expiresAt:Q(n.expiresAt),tokens:X(Y(n.tokens))}}function q(e,t){if(V(t.resource)!==e)throw Error(`OAuth client resource must match the credential API host`);return t}function J(e){let n=t.safeParse(e);if(!n.success)throw Error(`OS OAuth credential entry failed canonical client validation`,{cause:n.error});return n.data}function Y(e){let t=i.safeParse(e);if(!t.success)throw Error(`OS OAuth credential entry failed OAuth token validation`,{cause:t.error});return t.data}function X(e){if(!$(e.access_token)||e.token_type.trim().toLowerCase()!==`bearer`)throw Error(`OAuth token response must contain a bearer access token`);if(e.refresh_token!==void 0&&!$(e.refresh_token))throw Error(`OAuth token response has an invalid refresh token`);return Z(e),e}function Z(e){let t=e.expires_in;if(typeof t!=`number`||!Number.isSafeInteger(t)||t<=0)throw Error(`OAuth token response must contain a positive expires_in`);return t}function ae(e){let t=new Date(Date.now()+e*1e3);if(!Number.isFinite(t.getTime()))throw Error(`OAuth token response has an expiry outside the supported date range`);return t.toISOString()}function Q(e){if(typeof e!=`string`)throw Error(`OS OAuth credential entry has an invalid absolute expiry`);let t=new Date(e);if(!Number.isFinite(t.getTime())||t.toISOString()!==e)throw Error(`OS OAuth credential entry has an invalid absolute expiry`);return e}function $(e){return e.trim()===e&&e.length>0}function oe(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{m as C,_ as S,C as _,I as a,g as b,R as c,L as d,B as f,E as g,ee as h,F as i,z as l,T as m,re as n,H as o,ie as p,P as r,N as s,V as t,U as u,w as v,h as w,x,v as y};

package/dist/chunks/oauth-login-BL08wbH6.js

@@ -1 +0,0 @@
-import{a as e}from"./oauth-login-DpbqrJ94.js";export{e as renewOAuthTokens};

package/dist/chunks/oauth-login-DpbqrJ94.js

@@ -1,2 +0,0 @@
-import{_ as e,et as t,h as n,i as r,it as i,n as a,o,q as s,r as c,rt as l,t as u,u as d}from"./auth-DVA6KxqF.js";import{C as f,S as p,c as m,d as h,f as g,h as ee,i as _,l as v,n as te,o as ne,p as re,t as ie,u as y,w as ae,x as b}from"./oauth-credential-BvaMUsLv.js";import{Y as x,n as S,r as C,t as oe,w as se}from"./index.node-DLQhh1RA.js";import{execFile as ce}from"node:child_process";import{randomBytes as le,timingSafeEqual as ue}from"node:crypto";import{platform as de}from"node:os";import{stderr as w,stdin as fe}from"node:process";import{once as pe}from"node:events";import{createServer as T}from"node:http";function E(e){return[`client_secret_basic`,`client_secret_post`,`none`].includes(e)}var D=`code`,O=`S256`;function k(e,t){let n=e.client_secret!==void 0;return`token_endpoint_auth_method`in e&&e.token_endpoint_auth_method&&E(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?n?`client_secret_basic`:`none`:n&&t.includes(`client_secret_basic`)?`client_secret_basic`:n&&t.includes(`client_secret_post`)?`client_secret_post`:t.includes(`none`)?`none`:n?`client_secret_post`:`none`}function A(e,t,n,r){let{client_id:i,client_secret:a}=t;switch(e){case`client_secret_basic`:j(i,a,n);return;case`client_secret_post`:M(i,a,r);return;case`none`:N(i,r);return;default:throw Error(`Unsupported client authentication method: ${e}`)}}function j(e,t,n){if(!t)throw Error(`client_secret_basic authentication requires a client_secret`);let r=btoa(`${e}:${t}`);n.set(`Authorization`,`Basic ${r}`)}function M(e,t,n){n.set(`client_id`,e),t&&n.set(`client_secret`,t)}function N(e,t){t.set(`client_id`,e)}async function P(e){let t=e instanceof Response?e.status:void 0,n=e instanceof Response?await e.text():e;try{let{error:e,error_description:t,error_uri:r}=u.parse(JSON.parse(n));return new(S[e]||C)(t||``,r)}catch(e){let r=`${t?`HTTP ${t}: `:``}Invalid OAuth error response: ${e}. Raw body: ${n}`;return new C(r)}}async function F(e,t,n=fetch){try{return await n(e,{headers:t})}catch(r){if(r instanceof TypeError)return t?F(e,void 0,n):void 0;throw r}}function I(e){let t=typeof e==`string`?new URL(e):e,n=t.pathname!==`/`,r=[];if(!n)return r.push({url:new URL(`/.well-known/oauth-authorization-server`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration`,t.origin),type:`oidc`}),r;let i=t.pathname;return i.endsWith(`/`)&&(i=i.slice(0,-1)),r.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:`oidc`}),r.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:`oidc`}),r}async function L(e,{fetchFn:t=fetch,protocolVersion:n=se}={}){let i={"MCP-Protocol-Version":n,Accept:`application/json`},o=I(e);for(let{url:e,type:n}of o){let o=await F(e,i,t);if(o){if(!o.ok){if(await o.body?.cancel(),o.status>=400&&o.status<500)continue;throw Error(`HTTP ${o.status} trying to load ${n===`oauth`?`OAuth`:`OpenID provider`} metadata from ${e}`)}return n===`oauth`?a.parse(await o.json()):r.parse(await o.json())}}}async function R(e,{metadata:t,clientInformation:n,redirectUrl:r,scope:i,state:a,resource:o}){let s;if(t){if(s=new URL(t.authorization_endpoint),!t.response_types_supported.includes(D))throw Error(`Incompatible auth server: does not support response type ${D}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(O))throw Error(`Incompatible auth server: does not support code challenge method ${O}`)}else s=new URL(`/authorize`,e);let c=await oe(),l=c.code_verifier,u=c.code_challenge;return s.searchParams.set(`response_type`,D),s.searchParams.set(`client_id`,n.client_id),s.searchParams.set(`code_challenge`,u),s.searchParams.set(`code_challenge_method`,O),s.searchParams.set(`redirect_uri`,String(r)),a&&s.searchParams.set(`state`,a),i&&s.searchParams.set(`scope`,i),i?.includes(`offline_access`)&&s.searchParams.append(`prompt`,`consent`),o&&s.searchParams.set(`resource`,o.href),{authorizationUrl:s,codeVerifier:l}}function z(e,t,n){return new URLSearchParams({grant_type:`authorization_code`,code:e,code_verifier:t,redirect_uri:String(n)})}async function B(e,{metadata:t,tokenRequestParams:n,clientInformation:r,addClientAuthentication:i,resource:a,fetchFn:o}){let s=t?.token_endpoint?new URL(t.token_endpoint):new URL(`/token`,e),l=new Headers({"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`});a&&n.set(`resource`,a.href),i?await i(l,n,s,t):r&&A(k(r,t?.token_endpoint_auth_methods_supported??[]),r,l,n);let u=await(o??fetch)(s,{method:`POST`,headers:l,body:n});if(!u.ok)throw await P(u);return c.parse(await u.json())}async function me(e,{metadata:t,clientInformation:n,authorizationCode:r,codeVerifier:i,redirectUri:a,resource:o,addClientAuthentication:s,fetchFn:c}){return B(e,{metadata:t,tokenRequestParams:z(r,i,a),clientInformation:n,addClientAuthentication:s,resource:o,fetchFn:c})}async function he(e,{metadata:t,clientInformation:n,refreshToken:r,resource:i,addClientAuthentication:a,fetchFn:o}){return{refresh_token:r,...await B(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:`refresh_token`,refresh_token:r}),clientInformation:n,addClientAuthentication:a,resource:i,fetchFn:o})}}var V=2;function ge(e,t){return U(e,t).redactedUrl}async function _e(e,t,n){let r=U(e,t);return await H(new URL(r.openerUrl),n)}async function H(e,t){let n=t.environment??process.env,r=t.operatingSystem??de(),i=ve(t.noBrowser,n,r);if(i!==null)return{state:`skipped`,reason:i};let a=ye(r,e.toString());if(a===null)return{state:`failed`,reason:`unsupported browser-opening platform: ${r}`};try{return await be(a.command,a.arguments),{state:`opened`,reason:null}}catch{return{state:`failed`,reason:`browser opener failed`}}}function U(e,t){let{id:n,verificationUrl:r,pollSecret:i}=e,a,o;try{a=new URL(r),o=new URL(t)}catch{throw Error(`broker returned an invalid browser verification URL`)}if(o.username.length>0||o.password.length>0||o.pathname!==`/`||o.search.length>0||o.hash.length>0)throw Error(`configured browser origin must contain only an origin`);let s=b(o.hostname);if(o.protocol!==`https:`&&!(o.protocol===`http:`&&s))throw Error(`configured browser origin must use HTTPS except for loopback development`);let c=new URLSearchParams(a.hash.slice(1)),l=[...c.keys()],u=c.getAll(`cliAuthorizationId`),d=c.getAll(`browserSecret`),f=d[0]??``;if(a.origin!==o.origin||a.protocol!==o.protocol||a.username.length>0||a.password.length>0||a.pathname!==`/settings/developer`||a.search.length>0||l.length!==V||u.length!==1||u[0]!==n||d.length!==1||f.length===0||i.length===0||f===i)throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let p;try{p=decodeURIComponent(r)}catch{throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`)}if(r.includes(i)||p.includes(i))throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let m=new URL(a);return m.hash=new URLSearchParams({cliAuthorizationId:n,browserSecret:`<redacted>`}).toString(),{openerUrl:r,redactedUrl:m.toString()}}function ve(e,t,n){return e?`--no-browser was set`:n===`darwin`&&t.CODEX_SESSION_ID?`macOS Codex browser process boundary`:t.SSH_CONNECTION||t.SSH_CLIENT||t.SSH_TTY?`SSH/headless session detected`:(n===`linux`||n===`freebsd`)&&!t.DISPLAY&&!t.WAYLAND_DISPLAY?`no graphical display detected`:null}function ye(e,t){return e===`darwin`?{command:`open`,arguments:[t]}:e===`win32`?{command:`rundll32.exe`,arguments:[`url.dll,FileProtocolHandler`,t]}:e===`linux`||e===`freebsd`?{command:`xdg-open`,arguments:[t]}:null}function be(e,t){return new Promise((n,r)=>{ce(e,[...t],{timeout:5e3,windowsHide:!0},e=>e?r(e):n())})}var xe=3e5;async function Se(n,r){if(!fe.isTTY){let e=r??s().bin[0];return l(`${e} auth login requires an interactive TTY on stdin`,[`Use AUTH_TOKEN for non-interactive automation.`])}let a;try{a=ie(t().host)}catch(e){return l(`auth login: invalid API host — ${f(e)}`)}let o=await _(a);if(o.state===`missing`)return W(a,n);if(o.state===`unavailable`)return l(`auth login: ${o.summary}`);if(o.state===`invalid`)return W(a,n,`Saved OAuth credential cannot be read — ${o.summary}`);let{stored:c}=o;if(ne(c.credential))return await Ce(c,n);let u;try{u=await d(c.credential.tokens.access_token,v(c.credential.client))!==null}catch(t){return t instanceof e?W(a,n,`Saved OAuth credential was rejected`):l(`auth login: saved OAuth credential could not be verified — ${f(t,y(c.credential.tokens))}`)}return u?i(`OAuth CLI access token is already stored and verified.`,Q(c)):W(a,n,`Saved OAuth credential was rejected`)}async function Ce(e,t){let n=await h(e.host);if(n.state===`unavailable`)return l(`auth login: ${n.summary}`);let{client:r,tokens:i}=e.credential;if(i.refresh_token===void 0)return W(e.host,t,`Saved OAuth access token expired`,n);let a;try{a=await G(e)}catch(r){return W(e.host,t,`Saved OAuth credential could not be renewed — ${f(r,y(i))}`,n)}K(n);let o=await Y(r,a);return o.state===`failed`?l(`auth login: ${o.summary}`):o.state===`rejected`?W(e.host,t,`Renewed OAuth access token was rejected`,n):await X(e.host,o.credential,`OAuth CLI access token renewed and verified.`)}async function W(e,t,n,r){let i=r??await h(e);if(i.state===`unavailable`)return l(`auth login: ${i.summary}`);K(i),n!==void 0&&w.write(`${n}; continuing to browser sign-in.\n`);let a;try{let e=(await q()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);a=e}catch(e){return l(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let o;try{o=await J(a)}catch(e){return l(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}let s=le(32).toString(`base64url`),c;try{c=await Ee(we(a),s);let n=await R(m(a),{metadata:o,clientInformation:{client_id:Z(a)},redirectUrl:c.redirectUri,resource:v(a),scope:Te(a).join(` `),state:s}),r=await H(n.authorizationUrl,{noBrowser:t.noBrowser});if(r.state!==`opened`&&!w.isTTY)return l(`auth login: browser authorization requires an interactive terminal for manual handoff`);w.write(r.state===`opened`?`Browser sign-in opened. Waiting for the loopback callback...
-`:`Browser not opened automatically (${r.reason}).\nOpen this OAuth sign-in URL in your browser:\n${n.authorizationUrl.toString()}\n\n`);let i=await c.waitForAuthorizationCode();if(i.state===`timed-out`)return l(`auth login: browser authorization timed out before the loopback callback arrived`);if(i.state===`failed`)return l(`auth login: ${i.message}`);let u;try{u=await me(m(a),{metadata:o,clientInformation:{client_id:Z(a)},authorizationCode:i.authorizationCode,codeVerifier:n.codeVerifier,redirectUri:c.redirectUri,resource:v(a)})}catch(e){return l(`auth login: OAuth token exchange failed — ${f(e,[i.authorizationCode,n.codeVerifier])}`)}let d=await Y(a,u);return d.state===`failed`?l(`auth login: ${d.summary}`):d.state===`rejected`?l(`auth login: OAuth access token was rejected and was not stored`):await X(e,d.credential,`OAuth CLI access token stored and verified.`)}catch(e){return l(`auth login: OAuth browser authorization failed — ${f(e)}`)}finally{await c?.close()}}async function G(e){let{client:t,tokens:n}=e.credential;if(n.refresh_token===void 0)throw Error(`saved OAuth credential has no refresh token`);let r=await J(t);return await he(m(t),{metadata:r,clientInformation:{client_id:Z(t)},refreshToken:n.refresh_token,resource:v(t)})}function K(e){e.state===`available`&&e.provider===`file`&&w.write(ee(e.keyringFailure??`unknown failure`))}async function q(){let e=await n(p(t()),{method:`GET`,path:o(`getAuthProviderCatalog`,{}),headers:{}},x);if(!e.ok)throw Error(`provider catalog request failed: ${ae(e.problem)}`);return e.data}async function J(e){let t=await L(m(e));if(t===void 0||t.issuer!==e.authorizationServer)throw Error(`OAuth authorization-server metadata issuer must match its configured server`);if(!t.response_types_supported.includes(`code`)||t.code_challenge_methods_supported?.includes(`S256`)!==!0)throw Error(`OAuth authorization-server metadata must advertise authorization-code and PKCE S256 support`);return g(t.authorization_endpoint,`authorization endpoint`,!0),g(t.token_endpoint,`token endpoint`,!0),t}async function Y(t,n){let r;try{r=te(t,n)}catch(e){return{state:`failed`,summary:`OAuth token response is invalid — ${f(e,y(n))}`}}let i;try{i=await d(r.tokens.access_token,v(r.client))!==null}catch(t){return t instanceof e?{state:`rejected`}:{state:`failed`,summary:`OAuth access token could not be verified — ${f(t,y(r.tokens))}`}}return i?{state:`accepted`,credential:r}:{state:`rejected`}}async function X(e,t,n){try{let r=await re(e,t);return i(n,Q(r))}catch(e){return l(`auth login: OAuth credential could not be durably stored — ${f(e,y(t.tokens))}`)}}function we(e){let t;try{t=new URL(e.redirectUri)}catch(e){throw Error(`OAuth callback configuration is not a valid URL`,{cause:e})}if(t.protocol!==`http:`||t.hostname!==`127.0.0.1`||t.port.length>0||t.pathname!==`/callback`||t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0)throw Error(`OAuth callback configuration must be http://127.0.0.1/callback without a port, query, or fragment`);return t}function Z(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function Te(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}async function Ee(e,t){let n,r=new Promise(e=>{n=e}),i=T((r,i)=>{i.setHeader(`Cache-Control`,`no-store`),i.setHeader(`Content-Type`,`text/plain; charset=utf-8`);let a=new URL(r.url??`/`,e);if(r.method!==`GET`||a.pathname!==e.pathname){i.statusCode=404,i.end(`OAuth callback not found.`);return}let o=a.searchParams.getAll(`state`),s=Buffer.from(o[0]??``),c=Buffer.from(t);if(o.length!==1||s.length!==c.length||!ue(s,c)){i.statusCode=400,i.end(`OAuth callback state did not match. Return to the CLI and retry.`);return}if(a.searchParams.has(`error`)){i.statusCode=400,i.end(`OAuth authorization was not completed. Return to the CLI.`),n({state:`failed`,message:`OAuth authorization server returned an error`});return}let l=a.searchParams.getAll(`code`),u=l[0]?.trim();if(l.length!==1||u===void 0||u.length===0){i.statusCode=400,i.end(`OAuth callback did not include an authorization code.`);return}i.statusCode=200,i.end(`OAuth authorization completed. Return to the CLI.`),n({state:`code`,authorizationCode:u})});i.on(`error`,e=>n({state:`failed`,message:`OAuth callback listener failed: ${f(e)}`}));try{let t=pe(i,`listening`);i.listen({host:`127.0.0.1`,port:0}),await t;let n=i.address();if(n===null||typeof n==`string`||n.port<=0)throw Error(`OAuth callback listener did not receive an ephemeral loopback port`);let a=new URL(e);return a.port=String(n.port),{redirectUri:a,waitForAuthorizationCode:async()=>{let e;return await Promise.race([r,new Promise(t=>{e=setTimeout(()=>t({state:`timed-out`}),xe)})]).finally(()=>{e!==void 0&&clearTimeout(e)})},close:async()=>await $(i)}}catch(e){throw i.listening&&await $(i),e}}function Q(e){return{host:e.host,provider:e.provider,expiresAt:e.credential.expiresAt,client:e.credential.client}}function $(e){return new Promise((t,n)=>{e.close(e=>e===void 0?t():n(e))})}export{G as a,Z as i,q as n,_e as o,Se as r,ge as s,J as t};