@aventurevc/aventure-cli 0.7.296 → 0.7.301

package/dist/chunks/oauth-credential-CayH9z1e.js

@@ -1,2 +0,0 @@
-import{A as e,a as t,g as n,k as r,r as i}from"./auth-Bb-9biQe.js";import{randomUUID as a}from"node:crypto";import{chmod as o,mkdir as s,readFile as c,rename as l,rm as u,writeFile as d}from"node:fs/promises";import{dirname as f,join as p}from"node:path";function m(e,t=[]){let r=e instanceof Error?e.message:String(e);return n(r,t)}function h(e,t=[]){let r=n(e.title,t),i=n(e.detail?.trim()??``,t);return`${e.status} ${r}${i?` — ${i}`:``}`}function g(e){let t=e.trim();if(t.length===0)throw Error(`API host must not be blank`);let n=new URL(y(t)?t:`${b(t)}://${t}`),r=x(n.hostname);if(n.protocol!==`https:`&&n.protocol!==`http:`||n.username.length>0||n.password.length>0||n.pathname!==`/`&&n.pathname!==``||n.search.length>0||n.hash.length>0)throw Error(`API host must contain only an HTTP(S) host and optional port`);if(n.protocol===`http:`&&!r)throw Error(`personal credentials require HTTPS except for loopback API hosts`);return{host:n.host.toLowerCase(),origin:n.origin,isLoopback:r}}function _(e){return{...e,host:g(e.host).origin}}function v(e){let t=g(e);if(t.isLoopback)return`http://localhost:3000`;if(t.host===`api.aventure.vc`)return`https://aventure.vc`;throw Error(`no first-party browser origin is configured for API host ${t.host}`)}function y(e){return/^[a-z][a-z\d+.-]*:\/\//iu.test(e)}function b(e){let t=e.split(`/`,1)[0]?.toLowerCase()??``;try{return x(new URL(`http://${t}`).hostname)?`http`:`https`}catch{return`https`}}function x(e){let t=e.toLowerCase();return t===`localhost`||t===`127.0.0.1`||t===`0.0.0.0`||t===`[::1]`}function S(){return p(f(r()),`credentials.json`)}function ee(e){return`OS keyring is unusable (${e}); the credential will be stored in ${S()} (mode 0600).\n`}async function C(e,t){let n;try{let n=await(await O(e,t)).getPassword()??void 0;if(n!==void 0)return{record:{provider:`keyring`,value:n}}}catch(e){n=D(e)}let r=(await k())[e]?.[t];return{...r===void 0?{}:{record:{provider:`file`,value:r}},...n===void 0?{}:{keyringFailure:n}}}async function w(e,t,n){let r;try{let i=await O(e,t);if(await i.setPassword(n),await i.getPassword()===n)return await A(e,t,void 0),`keyring`;r=`Error: keyring readback did not match`}catch(e){r=D(e,[n])}if(await A(e,t,n),(await k())[e]?.[t]!==n)throw Error(`credential storage did not confirm a durable write (keyring: ${r}; file: readback did not match)`);return`file`}async function T(e,t){let n=await O(e,t),r;try{await n.deleteCredential()}catch(e){r=e}let i;try{i=await n.getPassword()??void 0}catch(n){throw await A(e,t,void 0),Error(`OS keyring removal outcome is unknown (${D(r??n)})`,{cause:n})}if(await A(e,t,void 0),i!==void 0)throw Error(`OS keyring did not confirm removal (${D(r)})`,r===void 0?void 0:{cause:r})}async function E(e,t){let n=`${t}:probe:${a()}`,r=`aventure-cli-credential-probe:${a()}`,i;try{let t=await O(e,n);await t.setPassword(r);let a=await(await O(e,n)).getPassword(),o=await t.deleteCredential(),s=await(await O(e,n)).getPassword()??void 0;if(a!==r)i=`Error: probe readback did not match`;else if(!o||s!==void 0)i=`Error: probe cleanup was not confirmed`;else return{provider:`keyring`}}catch(e){i=D(e,[r])}try{await A(e,n,r);let t=(await k())[e]?.[n];if(await A(e,n,void 0),t!==r)throw Error(`probe readback did not match`)}catch(e){throw Error(`credential storage is unavailable (keyring: ${i}; file ${S()}: ${D(e,[r])})`,{cause:e})}return{provider:`file`,keyringFailure:i}}function D(e,t=[]){if(!(e instanceof Error))return`Error`;let n=e.name||`Error`,[r=``]=m(e,t).trim().split(`
-`,1);return r&&r!==n?`${n}: ${r}`:n}async function O(e,t){let{AsyncEntry:n}=await import(`@napi-rs/keyring`);return new n(e,t)}async function k(){let t=S(),n;try{n=await c(t,`utf8`)}catch(t){if(e(t))return{};throw t}let r;try{r=JSON.parse(n)}catch(e){throw Error(`${t} is not a valid credential file`,{cause:e})}if(!j(r))throw Error(`${t} is not a valid credential file`);return r}async function A(e,t,n){let r=S(),i=await k(),a={...i[e]};if(n===void 0?delete a[t]:a[t]=n,Object.keys(a).length===0?delete i[e]:i[e]=a,Object.keys(i).length===0){await u(r,{force:!0});return}await s(f(r),{recursive:!0,mode:448});let c=`${r}.tmp`;await d(c,`${JSON.stringify(i,null,2)}\n`,{mode:384}),await o(c,384),await l(c,r)}function j(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.values(e).every(e=>typeof e==`string`))}var M=`vc.aventure.aventure-cli.oauth`,te=`oauth:`,ne=6e4;function re(e,t){let n=X(t);return{client:e,expiresAt:ae(Z(n)),tokens:n}}async function ie(e,t){let n=V(e),r=G(n,t),i;try{i=await w(M,W(n),r)}catch(e){throw Error(`OAuth credential could not be stored — ${m(e,[r,...U(t.tokens)])}`,{cause:e})}return{host:n,provider:i,credential:K(n,r)}}async function N(e){let t=V(e),n;try{n=await C(M,W(t))}catch(e){return{state:`unavailable`,summary:m(e)}}let{record:r,keyringFailure:i}=n;return r===void 0?i===void 0?{state:`missing`}:{state:`missing`,keyringFailure:i}:{state:`found`,stored:{host:t,provider:r.provider,credential:K(t,r.value)}}}async function P(e){await T(M,W(V(e)))}async function F(e){try{return await N(e)}catch(e){return{state:`invalid`,summary:m(e)}}}async function I(e){let t=await F(e);if(t.state!==`missing`)return t;let n=await L(e);return n.state===`unavailable`?n:n.keyringFailure===void 0?{state:`missing`}:{state:`missing`,keyringFailure:n.keyringFailure}}async function L(e){let t=V(e);try{return{state:`available`,...await E(M,W(t))}}catch(e){return{state:`unavailable`,summary:m(e)}}}function R(e){return B(e.authorizationServer,`authorization server`)}function z(e){return B(e.resource,`resource`)}function B(e,t,n=!1){let r;try{r=new URL(e)}catch(e){throw Error(`OAuth ${t} is not a valid URL`,{cause:e})}if(r.protocol!==`https:`||r.username.length>0||r.password.length>0||!n&&r.search.length>0||r.hash.length>0)throw Error(`OAuth ${t} must be an HTTPS URL without credentials${n?``:`, query`} or fragment`);return r}function V(e){return g(e).host}function H(e){return new Date(e.expiresAt).getTime()-ne<=Date.now()}function U(e){return[e.access_token,e.refresh_token,e.id_token]}function W(e){return`${te}${e}`}function G(e,t){return JSON.stringify({client:q(e,t.client),expiresAt:Q(t.expiresAt),tokens:X(t.tokens)})}function K(e,t){let n;try{n=JSON.parse(t)}catch(e){throw Error(`OS OAuth credential entry failed schema validation`,{cause:e})}if(!oe(n))throw Error(`OS OAuth credential entry failed schema validation`);return{client:q(e,J(n.client)),expiresAt:Q(n.expiresAt),tokens:X(Y(n.tokens))}}function q(e,t){if(V(t.resource)!==e)throw Error(`OAuth client resource must match the credential API host`);return t}function J(e){let n=t.safeParse(e);if(!n.success)throw Error(`OS OAuth credential entry failed canonical client validation`,{cause:n.error});return n.data}function Y(e){let t=i.safeParse(e);if(!t.success)throw Error(`OS OAuth credential entry failed OAuth token validation`,{cause:t.error});return t.data}function X(e){if(!$(e.access_token)||e.token_type.trim().toLowerCase()!==`bearer`)throw Error(`OAuth token response must contain a bearer access token`);if(e.refresh_token!==void 0&&!$(e.refresh_token))throw Error(`OAuth token response has an invalid refresh token`);return Z(e),e}function Z(e){let t=e.expires_in;if(typeof t!=`number`||!Number.isSafeInteger(t)||t<=0)throw Error(`OAuth token response must contain a positive expires_in`);return t}function ae(e){let t=new Date(Date.now()+e*1e3);if(!Number.isFinite(t.getTime()))throw Error(`OAuth token response has an expiry outside the supported date range`);return t.toISOString()}function Q(e){if(typeof e!=`string`)throw Error(`OS OAuth credential entry has an invalid absolute expiry`);let t=new Date(e);if(!Number.isFinite(t.getTime())||t.toISOString()!==e)throw Error(`OS OAuth credential entry has an invalid absolute expiry`);return e}function $(e){return e.trim()===e&&e.length>0}function oe(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{m as C,_ as S,C as _,I as a,g as b,R as c,L as d,B as f,E as g,ee as h,F as i,z as l,T as m,re as n,H as o,ie as p,P as r,N as s,V as t,U as u,w as v,h as w,x,v as y};

package/dist/chunks/oauth-login-DXqj8AHE.js

@@ -1,3 +0,0 @@
-import{_ as e,et as t,h as n,i as r,it as i,n as a,o,q as s,r as c,rt as l,t as u,u as d}from"./auth-Bb-9biQe.js";import{C as f,S as p,c as m,d as h,f as g,h as _,i as ee,l as v,n as te,o as ne,p as re,t as y,u as b,w as ie,x}from"./oauth-credential-CayH9z1e.js";import{C as S,J as C,n as w,t as ae}from"./index.node-BBdAsEIu.js";import{execFile as oe}from"node:child_process";import{platform as se}from"node:os";import{stderr as T,stdin as ce}from"node:process";import{setTimeout as le}from"node:timers/promises";function ue(e){return[`client_secret_basic`,`client_secret_post`,`none`].includes(e)}function de(e,t){let n=e.client_secret!==void 0;return`token_endpoint_auth_method`in e&&e.token_endpoint_auth_method&&ue(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?n?`client_secret_basic`:`none`:n&&t.includes(`client_secret_basic`)?`client_secret_basic`:n&&t.includes(`client_secret_post`)?`client_secret_post`:t.includes(`none`)?`none`:n?`client_secret_post`:`none`}function E(e,t,n,r){let{client_id:i,client_secret:a}=t;switch(e){case`client_secret_basic`:D(i,a,n);return;case`client_secret_post`:O(i,a,r);return;case`none`:k(i,r);return;default:throw Error(`Unsupported client authentication method: ${e}`)}}function D(e,t,n){if(!t)throw Error(`client_secret_basic authentication requires a client_secret`);let r=btoa(`${e}:${t}`);n.set(`Authorization`,`Basic ${r}`)}function O(e,t,n){n.set(`client_id`,e),t&&n.set(`client_secret`,t)}function k(e,t){t.set(`client_id`,e)}async function A(e){let t=e instanceof Response?e.status:void 0,n=e instanceof Response?await e.text():e;try{let{error:e,error_description:t,error_uri:r}=u.parse(JSON.parse(n));return new(ae[e]||w)(t||``,r)}catch(e){let r=`${t?`HTTP ${t}: `:``}Invalid OAuth error response: ${e}. Raw body: ${n}`;return new w(r)}}async function j(e,t,n=fetch){try{return await n(e,{headers:t})}catch(r){if(r instanceof TypeError)return t?j(e,void 0,n):void 0;throw r}}function M(e){let t=typeof e==`string`?new URL(e):e,n=t.pathname!==`/`,r=[];if(!n)return r.push({url:new URL(`/.well-known/oauth-authorization-server`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration`,t.origin),type:`oidc`}),r;let i=t.pathname;return i.endsWith(`/`)&&(i=i.slice(0,-1)),r.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:`oidc`}),r.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:`oidc`}),r}async function N(e,{fetchFn:t=fetch,protocolVersion:n=S}={}){let i={"MCP-Protocol-Version":n,Accept:`application/json`},o=M(e);for(let{url:e,type:n}of o){let o=await j(e,i,t);if(o){if(!o.ok){if(await o.body?.cancel(),o.status>=400&&o.status<500)continue;throw Error(`HTTP ${o.status} trying to load ${n===`oauth`?`OAuth`:`OpenID provider`} metadata from ${e}`)}return n===`oauth`?a.parse(await o.json()):r.parse(await o.json())}}}async function P(e,{metadata:t,tokenRequestParams:n,clientInformation:r,addClientAuthentication:i,resource:a,fetchFn:o}){let s=t?.token_endpoint?new URL(t.token_endpoint):new URL(`/token`,e),l=new Headers({"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`});a&&n.set(`resource`,a.href),i?await i(l,n,s,t):r&&E(de(r,t?.token_endpoint_auth_methods_supported??[]),r,l,n);let u=await(o??fetch)(s,{method:`POST`,headers:l,body:n});if(!u.ok)throw await A(u);return c.parse(await u.json())}async function F(e,{metadata:t,clientInformation:n,refreshToken:r,resource:i,addClientAuthentication:a,fetchFn:o}){return{refresh_token:r,...await P(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:`refresh_token`,refresh_token:r}),clientInformation:n,addClientAuthentication:a,resource:i,fetchFn:o})}}var I=2;function L(e,t){return B(e,t).redactedUrl}async function R(e,t,n){let r=B(e,t);return await z(new URL(r.openerUrl),n)}async function z(e,t){let n=t.environment??process.env,r=t.operatingSystem??se(),i=fe(t.noBrowser,n,r);if(i!==null)return{state:`skipped`,reason:i};let a=V(r,e.toString());if(a===null)return{state:`failed`,reason:`unsupported browser-opening platform: ${r}`};try{return await pe(a.command,a.arguments),{state:`opened`,reason:null}}catch{return{state:`failed`,reason:`browser opener failed`}}}function B(e,t){let{id:n,verificationUrl:r,pollSecret:i}=e,a,o;try{a=new URL(r),o=new URL(t)}catch{throw Error(`broker returned an invalid browser verification URL`)}if(o.username.length>0||o.password.length>0||o.pathname!==`/`||o.search.length>0||o.hash.length>0)throw Error(`configured browser origin must contain only an origin`);let s=x(o.hostname);if(o.protocol!==`https:`&&!(o.protocol===`http:`&&s))throw Error(`configured browser origin must use HTTPS except for loopback development`);let c=new URLSearchParams(a.hash.slice(1)),l=[...c.keys()],u=c.getAll(`cliAuthorizationId`),d=c.getAll(`browserSecret`),f=d[0]??``;if(a.origin!==o.origin||a.protocol!==o.protocol||a.username.length>0||a.password.length>0||a.pathname!==`/settings/developer`||a.search.length>0||l.length!==I||u.length!==1||u[0]!==n||d.length!==1||f.length===0||i.length===0||f===i)throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let p;try{p=decodeURIComponent(r)}catch{throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`)}if(r.includes(i)||p.includes(i))throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let m=new URL(a);return m.hash=new URLSearchParams({cliAuthorizationId:n,browserSecret:`<redacted>`}).toString(),{openerUrl:r,redactedUrl:m.toString()}}function fe(e,t,n){return e?`--no-browser was set`:n===`darwin`&&t.CODEX_SESSION_ID?`macOS Codex browser process boundary`:t.SSH_CONNECTION||t.SSH_CLIENT||t.SSH_TTY?`SSH/headless session detected`:(n===`linux`||n===`freebsd`)&&!t.DISPLAY&&!t.WAYLAND_DISPLAY?`no graphical display detected`:null}function V(e,t){return e===`darwin`?{command:`open`,arguments:[t]}:e===`win32`?{command:`rundll32.exe`,arguments:[`url.dll,FileProtocolHandler`,t]}:e===`linux`||e===`freebsd`?{command:`xdg-open`,arguments:[t]}:null}function pe(e,t){return new Promise((n,r)=>{oe(e,[...t],{timeout:5e3,windowsHide:!0},e=>e?r(e):n())})}var me=5e3,H=`urn:ietf:params:oauth:grant-type:device_code`;async function he(n,r){if(!ce.isTTY){let e=r??s().bin[0];return l(`${e} auth login requires an interactive TTY on stdin`,[`Use AUTH_TOKEN for non-interactive automation.`])}let a;try{a=y(t().host)}catch(e){return l(`auth login: invalid API host — ${f(e)}`)}let o=await ee(a);if(o.state===`missing`)return U(a,n);if(o.state===`unavailable`)return l(`auth login: ${o.summary}`);if(o.state===`invalid`)return U(a,n,`Saved OAuth credential cannot be read — ${o.summary}`);let{stored:c}=o;if(ne(c.credential))return await ge(c,n);let u;try{u=await d(c.credential.tokens.access_token,v(c.credential.client))!==null}catch(t){return t instanceof e?U(a,n,`Saved OAuth credential was rejected`):l(`auth login: saved OAuth credential could not be verified — ${f(t,b(c.credential.tokens))}`)}return u?i(`OAuth CLI access token is already stored and verified.`,$(c)):U(a,n,`Saved OAuth credential was rejected`)}async function ge(e,t){let n=await h(e.host);if(n.state===`unavailable`)return l(`auth login: ${n.summary}`);let{client:r,tokens:i}=e.credential;if(i.refresh_token===void 0)return U(e.host,t,`Saved OAuth access token expired`,n);let a;try{a=await G(e)}catch(r){return U(e.host,t,`Saved OAuth credential could not be renewed — ${f(r,b(i))}`,n)}K(n);let o=await X(r,a);return o.state===`failed`?l(`auth login: ${o.summary}`):o.state===`rejected`?U(e.host,t,`Renewed OAuth access token was rejected`,n):await Z(e.host,o.credential,`OAuth CLI access token renewed and verified.`)}async function U(e,t,n,r){let i=r??await h(e);if(i.state===`unavailable`)return l(`auth login: ${i.summary}`);K(i),n!==void 0&&T.write(`${n}; continuing to browser sign-in.\n`);let a;try{let e=(await q()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);a=e}catch(e){return l(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let o;try{o=await J(a)}catch(e){return l(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}let s;try{s=await _e(a,o)}catch(e){return l(`auth login: OAuth device authorization request failed — ${f(e)}`)}let c=await z(s.verificationUri,{noBrowser:t.noBrowser});if(c.state!==`opened`&&!T.isTTY)return l(`auth login: browser authorization requires an interactive terminal for manual handoff`);T.write([c.state===`opened`?`Browser sign-in opened.`:`Browser not opened automatically (${c.reason}).`,`Sign-in URL (works on any device): ${s.verificationUri.toString()}`,`Confirm that the page shows code ${s.userCode} before approving.`,`The page uses the account already signed in at that address; to choose another account, open the URL in a private window or sign out there first.`,`Waiting for approval...
-`].join(`
-`));let u;try{u=await ye(a,o,s)}catch(e){return l(`auth login: OAuth device authorization did not complete — ${f(e,[s.deviceCode])}`)}let d=await X(a,u);return d.state===`failed`?l(`auth login: ${d.summary}`):d.state===`rejected`?l(`auth login: OAuth access token was rejected and was not stored`):await Z(e,d.credential,`OAuth CLI access token stored and verified.`)}async function _e(e,t){let n=await fetch(Y(t),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:Q(e),scope:be(e).join(` `),resource:v(e).toString()})});if(!n.ok)throw Error(`device authorization endpoint answered ${n.status}`);return ve(await W(n,`device authorization`),Date.now())}async function W(e,t){try{return await e.json()}catch(n){throw Error(`${t} endpoint answered ${e.status} without a JSON body`,{cause:n})}}function ve(e,t){if(typeof e!=`object`||!e)throw Error(`device authorization response is not an object`);let n=Reflect.get(e,`device_code`),r=Reflect.get(e,`user_code`),i=Reflect.get(e,`verification_uri_complete`),a=Reflect.get(e,`verification_uri`),o=Reflect.get(e,`expires_in`),s=Reflect.get(e,`interval`);if(typeof n!=`string`||typeof r!=`string`||n.length===0||r.length===0)throw Error(`device authorization response lacks device_code or user_code`);let c=typeof i==`string`&&i.length>0?i:a;if(typeof c!=`string`)throw Error(`device authorization response lacks a verification URI`);if(typeof o!=`number`||o<=0)throw Error(`device authorization response lacks a positive expires_in`);return{deviceCode:n,userCode:r,verificationUri:g(c,`verification URI`,!0),expiresAt:t+o*1e3,intervalMilliseconds:(typeof s==`number`&&s>=0?s:5)*1e3}}async function ye(e,t,n){let r=g(t.token_endpoint,`token endpoint`,!0),i=n.intervalMilliseconds;for(;Date.now()<n.expiresAt;){await le(i);let t=await fetch(r,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:Q(e),grant_type:H,device_code:n.deviceCode})}),a=await W(t,`token`);if(t.ok){let e=c.safeParse(a);if(!e.success)throw Error(`token endpoint returned an invalid token response`);return e.data}let o=u.safeParse(a),s=o.success?o.data.error:`HTTP ${t.status}`;if(s!==`authorization_pending`){if(s===`slow_down`){i+=me;continue}throw Error(s===`access_denied`?`the sign-in was denied in the browser`:s===`expired_token`?`the device code expired before approval`:`token endpoint answered ${s}`)}}throw Error(`the device code expired before approval`)}async function G(e){let{client:t,tokens:n}=e.credential;if(n.refresh_token===void 0)throw Error(`saved OAuth credential has no refresh token`);let r=await J(t);return await F(m(t),{metadata:r,clientInformation:{client_id:Q(t)},refreshToken:n.refresh_token,resource:v(t)})}function K(e){e.state===`available`&&e.provider===`file`&&T.write(_(e.keyringFailure??`unknown failure`))}async function q(){let e=await n(p(t()),{method:`GET`,path:o(`getAuthProviderCatalog`,{}),headers:{}},C);if(!e.ok)throw Error(`provider catalog request failed: ${ie(e.problem)}`);return e.data}async function J(e){let t=await N(m(e));if(t===void 0||t.issuer!==e.authorizationServer)throw Error(`OAuth authorization-server metadata issuer must match its configured server`);if(t.grant_types_supported?.includes(H)!==!0)throw Error(`OAuth authorization-server metadata must advertise the device authorization grant`);return Y(t),g(t.token_endpoint,`token endpoint`,!0),t}function Y(e){let t=Reflect.get(e,`device_authorization_endpoint`);if(typeof t!=`string`)throw Error(`OAuth authorization-server metadata lacks device_authorization_endpoint`);return g(t,`device authorization endpoint`,!0)}async function X(t,n){let r;try{r=te(t,n)}catch(e){return{state:`failed`,summary:`OAuth token response is invalid — ${f(e,b(n))}`}}let i;try{i=await d(r.tokens.access_token,v(r.client))!==null}catch(t){return t instanceof e?{state:`rejected`}:{state:`failed`,summary:`OAuth access token could not be verified — ${f(t,b(r.tokens))}`}}return i?{state:`accepted`,credential:r}:{state:`rejected`}}async function Z(e,t,n){try{let r=await re(e,t);return i(n,$(r))}catch(e){return l(`auth login: OAuth credential could not be durably stored — ${f(e,b(t.tokens))}`)}}function Q(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function be(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}function $(e){return{host:e.host,provider:e.provider,expiresAt:e.credential.expiresAt,client:e.credential.client}}export{G as a,Q as i,q as n,R as o,he as r,L as s,J as t};

package/dist/chunks/oauth-login-eW2jq0F0.js

@@ -1 +0,0 @@
-import{a as e}from"./oauth-login-DXqj8AHE.js";export{e as renewOAuthTokens};