@aventurevc/aventure-cli 0.8.170 → 0.8.172

package/dist/chunks/oauth-bearer-credential-BpL4kmNW.js

@@ -0,0 +1 @@
+import{n as e,t}from"./oauth-bearer-credential-BFUl3_Ug.js";export{t as materializeCliOAuthBearerCredential,e as materializeSavedCliOAuthBearerCredential};

package/dist/chunks/{oauth-login-K5lDgqm3.js → oauth-login-70eTU7wt.js}

@@ -1,4 +1,4 @@
-import{Dr as e,Gt as t,Ir as n,Rr as r,Yt as i,jr as a}from"./dist-M0uo-DFP.js";import{c as o,i as s}from"./result-envelope-CkpirK9Q.js";import{l as c}from"./env-B6CxaFe-.js";import{t as l}from"./provider-catalog-DjYhSrTa.js";import{S as u,_ as d,b as ee,f as te,g as f,s as p,x as m}from"./api-key-bearer-credential-wwFYd_zb.js";import{_ as h,b as ne,c as re,f as g,g as _,h as v,i as y,l as b,m as x,o as S,p as C,r as w,u as T,v as E,x as ie,y as ae}from"./oauth-bearer-credential-Cl-uxBct.js";import{once as oe}from"node:events";import{stderr as D}from"node:process";import{setTimeout as se}from"node:timers/promises";import{createServer as ce}from"node:http";import{randomBytes as O,timingSafeEqual as k}from"node:crypto";var A=5e3,j=500,M=`Approval poll was interrupted; retrying.
+import{Dr as e,Gt as t,Ir as n,Rr as r,Yt as i,jr as a}from"./dist-qDRV1SWL.js";import{c as o,i as s}from"./result-envelope-DdrACXij.js";import{l as c}from"./env-CINNa4yR.js";import{t as l}from"./provider-catalog-Cc_es2z2.js";import{S as u,_ as d,b as ee,f as te,g as f,s as p,x as m}from"./api-key-bearer-credential-B_SbuDYs.js";import{_ as h,b as ne,c as re,f as g,g as _,h as v,i as y,l as b,m as x,o as S,p as C,r as w,u as T,v as E,x as ie,y as ae}from"./oauth-bearer-credential-BFUl3_Ug.js";import{once as oe}from"node:events";import{stderr as D}from"node:process";import{setTimeout as se}from"node:timers/promises";import{createServer as ce}from"node:http";import{randomBytes as O,timingSafeEqual as k}from"node:crypto";var A=5e3,j=500,M=`Approval poll was interrupted; retrying.
 `,N=`urn:ietf:params:oauth:grant-type:device_code`;function P(e){let t=Reflect.get(e,`device_authorization_endpoint`);if(typeof t!=`string`)throw Error(`OAuth authorization-server metadata lacks device_authorization_endpoint`);return _(t,`device authorization endpoint`,!0)}async function F(e,t){if(t.grant_types_supported?.includes(N)!==!0)throw Error(`OAuth authorization-server metadata must advertise the device authorization grant`);let n=await fetch(P(t),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:T(e),scope:C(e).join(` `),resource:g(e).toString()})});if(!n.ok)throw Error(`device authorization endpoint answered ${n.status}`);return L(await I(n,`device authorization`),Date.now())}async function I(e,t){try{return await e.json()}catch(n){throw Error(`${t} endpoint answered ${e.status} without a JSON body`,{cause:n})}}function L(e,t){if(typeof e!=`object`||!e)throw Error(`device authorization response is not an object`);let n=Reflect.get(e,`device_code`),r=Reflect.get(e,`user_code`),i=Reflect.get(e,`verification_uri_complete`),a=Reflect.get(e,`verification_uri`),o=Reflect.get(e,`expires_in`),s=Reflect.get(e,`interval`);if(typeof n!=`string`||typeof r!=`string`||n.length===0||r.length===0)throw Error(`device authorization response lacks device_code or user_code`);let c=typeof i==`string`&&i.length>0?i:a;if(typeof c!=`string`)throw Error(`device authorization response lacks a verification URI`);if(typeof o!=`number`||o<=0)throw Error(`device authorization response lacks a positive expires_in`);return{deviceCode:n,userCode:r,verificationUri:_(c,`verification URI`,!0),expiresAt:t+o*1e3,intervalMilliseconds:(typeof s==`number`&&s>=0?s:5)*1e3}}async function R(e,n,r){let a=_(n.token_endpoint,`token endpoint`,!0),o=r.intervalMilliseconds,s=null;for(;Date.now()<r.expiresAt;){await se(o);let n;try{n=await fetch(a,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:T(e),grant_type:N,device_code:r.deviceCode})})}catch(e){s=`the token endpoint was unreachable — ${f(e)}`,D.write(M);continue}if(n.status>=j){await n.body?.cancel(),s=`the token endpoint answered ${n.status}`,D.write(M);continue}s=null;let c=await I(n,`token`);if(n.ok){let e=i.safeParse(c);if(!e.success)throw Error(`token endpoint returned an invalid token response`);return e.data}let l=t.safeParse(c),u=l.success?l.data.error:`HTTP ${n.status}`;if(u!==`authorization_pending`){if(u===`slow_down`){o+=A;continue}throw Error(u===`access_denied`?`the sign-in was denied in the browser`:u===`expired_token`?`the device code expired before approval`:`token endpoint answered ${u}`)}}throw Error(s===null?`the device code expired before approval`:`the device code expired before approval — last failure: ${s}`)}var z=3e5;function B(e){let t;try{t=new URL(e.redirectUri)}catch(e){throw Error(`OAuth callback configuration is not a valid URL`,{cause:e})}if(t.protocol!==`http:`||t.hostname!==`127.0.0.1`||t.port.length>0||t.pathname!==`/callback`||t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0)throw Error(`OAuth callback configuration must be http://127.0.0.1/callback without a port, query, or fragment`);return t}async function V(e,t){let n,r=new Promise(e=>{n=e}),i=ce((r,i)=>{i.setHeader(`Cache-Control`,`no-store`),i.setHeader(`Content-Type`,`text/plain; charset=utf-8`);let a=new URL(r.url??`/`,e);if(r.method!==`GET`||a.pathname!==e.pathname){i.statusCode=404,i.end(`OAuth callback not found.`);return}let o=a.searchParams.getAll(`state`),s=Buffer.from(o[0]??``),c=Buffer.from(t);if(o.length!==1||s.length!==c.length||!k(s,c)){i.statusCode=400,i.end(`OAuth callback state did not match. Return to the CLI and retry.`);return}if(a.searchParams.has(`error`)){i.statusCode=400,i.end(`OAuth authorization was not completed. Return to the CLI.`),n({state:`failed`,message:`OAuth authorization server returned an error`});return}let l=a.searchParams.getAll(`code`),u=l[0]?.trim();if(l.length!==1||u===void 0||u.length===0){i.statusCode=400,i.end(`OAuth callback did not include an authorization code.`);return}let d=a.searchParams.getAll(`iss`);if(d.length>1){i.statusCode=400,i.end(`OAuth callback named more than one issuer.`);return}i.statusCode=200,i.end(`OAuth authorization completed. Return to the CLI.`),n({state:`code`,authorizationCode:u,iss:d[0]})});i.on(`error`,e=>n({state:`failed`,message:`OAuth callback listener failed: ${f(e)}`}));try{let t=oe(i,`listening`);i.listen({host:`127.0.0.1`,port:0}),await t;let n=i.address();if(n===null||typeof n==`string`||n.port<=0)throw Error(`OAuth callback listener did not receive an ephemeral loopback port`);let a=new URL(e);return a.port=String(n.port),{redirectUri:a,waitForAuthorizationCode:async()=>{let e;return await Promise.race([r,new Promise(t=>{e=setTimeout(()=>t({state:`timed-out`}),z)})]).finally(()=>{e!==void 0&&clearTimeout(e)})},close:async()=>await H(i)}}catch(e){throw i.listening&&await H(i),e}}function H(e){return new Promise((t,n)=>{e.close(e=>e===void 0?t():n(e))})}var U=`the OAuth credential is valid, but the API refused this account (HTTP 403); signing in again will not change that`;async function W(e){let t;try{t=m(c().host)}catch(e){return s(`auth login: invalid API host — ${f(e)}`)}let r=await S(t);if(r.state===`missing`)return G(t,e);if(r.state===`unavailable`)return s(`auth login: ${r.summary}`);if(r.state===`invalid`)return G(t,e,`Saved OAuth credential cannot be read — ${r.summary}`);let{stored:i}=r;if(re(i.credential))return await le(i,e);let l;try{l=await a(i.credential.tokens.access_token,g(i.credential.client))}catch(r){return r instanceof n?G(t,e,`Saved OAuth credential was rejected`):s(`auth login: saved OAuth credential could not be verified — ${f(r,x(i.credential.tokens))}`)}return l===`forbidden`?s(`auth login: ${U}`):l===null?G(t,e,`Saved OAuth credential was rejected`):o(`OAuth CLI access token is already stored and verified.`,$(i))}async function le(e,t){let n=await v(e.host);if(n.state===`unavailable`)return s(`auth login: ${n.summary}`);let{tokens:r}=e.credential;if(r.refresh_token===void 0)return G(e.host,t,`Saved OAuth access token expired`,n);let i;try{i=await w(e)}catch(i){return G(e.host,t,`Saved OAuth credential could not be renewed — ${f(i,x(r))}`,n)}J(n);let a=await Q(e.host,i,`OAuth CLI access token renewed and verified.`);if(!a.ok)return a;let o=await Z(i);return o.state===`failed`?s(`auth login: ${o.summary}`):o.state===`rejected`?G(e.host,t,`Renewed OAuth access token was rejected`,n):a}async function G(e,t,n,r){let i=ee(c().host);if(i.isLoopback)return s(`auth login: ${i.host} reuses the ${e} sign-in; run auth login with API_URL=https://${e} first`);let a=r??await v(e);if(a.state===`unavailable`)return s(`auth login: ${a.summary}`);J(a),n!==void 0&&D.write(`${n}; continuing to browser sign-in.\n`);let o;try{let e=(await Y()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);o=e}catch(e){return s(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let l;try{l=await X(o)}catch(e){return s(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}if(t.noBrowser)return await K(e,o,l);let u=O(32).toString(`base64url`),d;try{d=await V(B(o),u);let t=await ie(b(o),{metadata:l,clientInformation:{client_id:T(o)},redirectUrl:d.redirectUri,resource:g(o),scope:C(o).join(` `),state:u}),n=await te(t.authorizationUrl,{noBrowser:!1});if(n.state!==`opened`)return await d.close(),d=void 0,D.write(`Browser not opened automatically (${n.reason}).\n`),await K(e,o,l);D.write(`Browser sign-in opened: choose the account, then approve. Waiting for the loopback callback...
 `);let r=await d.waitForAuthorizationCode();if(r.state===`timed-out`)return await d.close(),d=void 0,D.write(`Browser sign-in was not completed; continuing with a device code.
 `),await K(e,o,l);if(r.state===`failed`)return s(`auth login: ${r.message}`);let i;try{i=await ae(b(o),{metadata:l,clientInformation:{client_id:T(o)},authorizationCode:r.authorizationCode,...r.iss===void 0?{}:{iss:r.iss},codeVerifier:t.codeVerifier,redirectUri:d.redirectUri,resource:g(o)})}catch(e){return s(`auth login: OAuth token exchange failed — ${f(e,[r.authorizationCode,t.codeVerifier])}`)}return await q(e,o,i)}catch(e){return s(`auth login: OAuth browser authorization failed — ${f(e)}`)}finally{await d?.close()}}async function K(e,t,n){let r;try{r=await F(t,n)}catch(e){return s(`auth login: OAuth device authorization request failed — ${f(e)}`)}D.write([`Sign-in URL (works on any device): ${r.verificationUri.toString()}`,`Confirm that the page shows code ${r.userCode} before approving.`,"That page approves with the account already signed in there; to pick an account, run `auth login` on a machine with a browser.",`Waiting for approval...

package/dist/chunks/oauth-login-BgymTtqY.js

@@ -0,0 +1 @@
+import{i as e}from"./oauth-login-70eTU7wt.js";export{e as renewOAuthTokens};

package/dist/chunks/openapi-commands-1MuBOSgO.js

@@ -0,0 +1 @@
+import{t as e}from"./openapi-commands-DTwHrPHN.js";export{e as GENERATED_OPENAPI_COMMAND_SPECS};