@aventurevc/aventure-cli 0.8.357 → 0.8.359

package/dist/chunks/oauth-bearer-credential-B3se79Pn.js

@@ -0,0 +1 @@
+export{t as materializeCliOAuthBearerCredential,n as materializeSavedCliOAuthBearerCredential}from"./oauth-bearer-credential-COLNUoER.js";

package/dist/chunks/{oauth-bearer-credential-D6SvsZlr.js → oauth-bearer-credential-COLNUoER.js}

@@ -1 +1 @@
-import{a as e}from"./package-DEeHDoOT.js";import{f as t,t as n}from"./env-CFzWAaru.js";import{o as r}from"./logging-CBFTXIXL.js";import{r as i}from"./api-target-vxev2RKl.js";import{i as a}from"./api-key-credential-LdCfwlmZ.js";import{t as o}from"./credential-redaction-BtlCCACb.js";import{a as s}from"./credential-store-CAamXkXE.js";import{t as c}from"./api-key-bearer-credential-C083He5o.js";import{a as l,f as u,h as d,n as f,o as p,t as m}from"./oauth-credential-BI-8dUCp.js";import"./http-credentials-BUPEQD7v.js";async function h(){let e=await a(i(t().host)).catch(()=>null);return e===null||e.state===`unavailable`||e.state===`found`&&e.stored.activation===`active`}async function g(a,s){if(S())return;let u=async(t,n,i,l=!1)=>{if(await c(s),!S())throw l?n:C(t,a,n,i);r({component:a??e().bin[0],event:`oauth_credential_bypassed`,message:`OAuth sign-in is unavailable (${t}); using the stored API key.`,...n===void 0?{}:{error:Error(o(n,x(i)))}})},d=async(t,n,i,s)=>{if(s){let e=await p(t.host).catch(()=>void 0);if(e?.state===`found`&&e.stored.credential.tokens.access_token!==t.credential.tokens.access_token)return await m(e.stored,!1)}try{await f(t.host)}catch(i){r({component:a??e().bin[0],event:`oauth_credential_retire_failed`,message:`the saved OAuth credential is dead (${n}) but could not be removed`,error:Error(o(i,x(t)))})}await u(n,i,t)},m=async(e,t)=>{let n=(n,r)=>d(e,n,r,t),r=e.credential;if(l(r)){if(r.tokens.refresh_token===void 0)return await n(`the saved OAuth credential has expired`);try{r=await v(e)}catch(t){let{OAuthError:r,OAuthErrorCode:i}=await import(`./dist-tIPA3BCL.js`),a=i.InvalidGrant;return t instanceof r&&t.code===a?await n(`aVenture sign-in rejected the saved refresh token`,t):await u(`the saved OAuth credential could not be renewed`,t,e,!(t instanceof r))}}if(t&&r===e.credential&&(y(r)||!await h()))return g(r);let i;try{let{verifyUserBearerToken:e}=await import(`./openapi-call-Jz01ShiX.js`);i=await e(r.tokens.access_token,new URL(r.client.resource))!==null}catch(t){let{errors:r}=await import(`./webapi-WYeLOETY.js`);return t instanceof r.JWTInvalid?await n(`the saved OAuth credential is malformed`,t):await u(`the saved OAuth credential could not be verified`,t,e,!0)}if(!i)return await n(`the saved OAuth credential was rejected`);await b(e.host,r,a),g(r)},g=e=>{S()||(process.env[n.authToken]=e.tokens.access_token,s?.(`oauth`))},_;try{_=i(t().host)}catch(e){throw C(`the API host could not select its OAuth credential`,a,e)}let w;try{w=await p(_)}catch(e){return await u(`the saved OAuth credential is invalid or expired`,e)}if(w.state!==`missing`){if(w.state===`unavailable`)return await u(`the saved OAuth credential could not be read`,Error(w.summary));await m(w.stored,!0)}}async function _(){if(S())return;let e=await p(i(t().host));e.state===`found`&&(process.env[n.authToken]=e.stored.credential.tokens.access_token)}async function v(t){return await s(async()=>{let n=await p(t.host),i=n.state===`found`?n.stored:t;if(!l(i.credential))return i.credential;let{renewOAuthTokens:a}=await import(`./oauth-login-DDPJxDeu.js`),s=m(i.credential.client,await a(i));try{await d(t.host,s)}catch(t){r({component:e().bin[0],event:`oauth_credential_store_failed`,message:`renewed OAuth credential could not be stored; this command uses it and the next one falls back to the API key or sign-in`,error:Error(o(t,u(s.tokens)))})}return s})}function y(e){if(e.verifiedAt===void 0)return!1;let t=Date.now()-new Date(e.verifiedAt).getTime();return t>=0&&t<9e5}async function b(t,n,i){let a=new Date().toISOString();try{await s(async()=>{let e=await p(t);e.state===`found`&&e.stored.credential.tokens.access_token===n.tokens.access_token&&await d(t,{...e.stored.credential,verifiedAt:a})})}catch(t){r({component:i??e().bin[0],event:`oauth_credential_verification_unrecorded`,message:`the saved OAuth credential was verified but the verification could not be stored`,error:Error(o(t,u(n.tokens)))})}}function x(e){return e===void 0?[]:u(e.credential.tokens)}function S(){return(process.env[n.authToken]?.trim().length??0)>0}function C(t,n,r,i){let a=r===void 0?``:` — ${o(r,x(i))}`,s=n??e().bin[0];return Error(`OAuth sign-in is required: ${t}. Run \`${s} auth login\` before retrying.${a}`)}export{_ as n,v as r,g as t};
+import{a as e}from"./package-DEeHDoOT.js";import{f as t,t as n}from"./env-NNOxjaEI.js";import{o as r}from"./logging-BcbZVQxq.js";import{r as i}from"./api-target-vxev2RKl.js";import{i as a}from"./api-key-credential-dy6pu7RL.js";import{t as o}from"./credential-redaction-BpaNjjm9.js";import{a as s}from"./credential-store-D0YIGs_c.js";import{t as c}from"./api-key-bearer-credential-54DE5Jqj.js";import{a as l,f as u,h as d,n as f,o as p,t as m}from"./oauth-credential-CixAZZ6C.js";import"./http-credentials-BUPEQD7v.js";async function h(){let e=await a(i(t().host)).catch(()=>null);return e===null||e.state===`unavailable`||e.state===`found`&&e.stored.activation===`active`}async function g(a,s){if(S())return;let u=async(t,n,i,l=!1)=>{if(await c(s),!S())throw l?n:C(t,a,n,i);r({component:a??e().bin[0],event:`oauth_credential_bypassed`,message:`OAuth sign-in is unavailable (${t}); using the stored API key.`,...n===void 0?{}:{error:Error(o(n,x(i)))}})},d=async(t,n,i,s)=>{if(s){let e=await p(t.host).catch(()=>void 0);if(e?.state===`found`&&e.stored.credential.tokens.access_token!==t.credential.tokens.access_token)return await m(e.stored,!1)}try{await f(t.host)}catch(i){r({component:a??e().bin[0],event:`oauth_credential_retire_failed`,message:`the saved OAuth credential is dead (${n}) but could not be removed`,error:Error(o(i,x(t)))})}await u(n,i,t)},m=async(e,t)=>{let n=(n,r)=>d(e,n,r,t),r=e.credential;if(l(r)){if(r.tokens.refresh_token===void 0)return await n(`the saved OAuth credential has expired`);try{r=await v(e)}catch(t){let{OAuthError:r,OAuthErrorCode:i}=await import(`./dist-tIPA3BCL.js`),a=i.InvalidGrant;return t instanceof r&&t.code===a?await n(`aVenture sign-in rejected the saved refresh token`,t):await u(`the saved OAuth credential could not be renewed`,t,e,!(t instanceof r))}}if(t&&r===e.credential&&(y(r)||!await h()))return g(r);let i;try{let{verifyUserBearerToken:e}=await import(`./openapi-call-Ck0YiwPf.js`);i=await e(r.tokens.access_token,new URL(r.client.resource))!==null}catch(t){let{errors:r}=await import(`./webapi-WYeLOETY.js`);return t instanceof r.JWTInvalid?await n(`the saved OAuth credential is malformed`,t):await u(`the saved OAuth credential could not be verified`,t,e,!0)}if(!i)return await n(`the saved OAuth credential was rejected`);await b(e.host,r,a),g(r)},g=e=>{S()||(process.env[n.authToken]=e.tokens.access_token,s?.(`oauth`))},_;try{_=i(t().host)}catch(e){throw C(`the API host could not select its OAuth credential`,a,e)}let w;try{w=await p(_)}catch(e){return await u(`the saved OAuth credential is invalid or expired`,e)}if(w.state!==`missing`){if(w.state===`unavailable`)return await u(`the saved OAuth credential could not be read`,Error(w.summary));await m(w.stored,!0)}}async function _(){if(S())return;let e=await p(i(t().host));e.state===`found`&&(process.env[n.authToken]=e.stored.credential.tokens.access_token)}async function v(t){return await s(async()=>{let n=await p(t.host),i=n.state===`found`?n.stored:t;if(!l(i.credential))return i.credential;let{renewOAuthTokens:a}=await import(`./oauth-login-BJoqHILK.js`),s=m(i.credential.client,await a(i));try{await d(t.host,s)}catch(t){r({component:e().bin[0],event:`oauth_credential_store_failed`,message:`renewed OAuth credential could not be stored; this command uses it and the next one falls back to the API key or sign-in`,error:Error(o(t,u(s.tokens)))})}return s})}function y(e){if(e.verifiedAt===void 0)return!1;let t=Date.now()-new Date(e.verifiedAt).getTime();return t>=0&&t<9e5}async function b(t,n,i){let a=new Date().toISOString();try{await s(async()=>{let e=await p(t);e.state===`found`&&e.stored.credential.tokens.access_token===n.tokens.access_token&&await d(t,{...e.stored.credential,verifiedAt:a})})}catch(t){r({component:i??e().bin[0],event:`oauth_credential_verification_unrecorded`,message:`the saved OAuth credential was verified but the verification could not be stored`,error:Error(o(t,u(n.tokens)))})}}function x(e){return e===void 0?[]:u(e.credential.tokens)}function S(){return(process.env[n.authToken]?.trim().length??0)>0}function C(t,n,r,i){let a=r===void 0?``:` — ${o(r,x(i))}`,s=n??e().bin[0];return Error(`OAuth sign-in is required: ${t}. Run \`${s} auth login\` before retrying.${a}`)}export{_ as n,v as r,g as t};

package/dist/chunks/{oauth-credential-BI-8dUCp.js → oauth-credential-CixAZZ6C.js}

@@ -1 +1 @@
-import{Yt as e}from"./auth-BNDyLTqp-GYAzJXBe.js";import{i as t}from"./webapi-B2JTupyg.js";import{n,r}from"./api-target-vxev2RKl.js";import{t as i}from"./credential-redaction-BtlCCACb.js";import{a,i as o,o as s,r as c,t as l}from"./credential-store-CAamXkXE.js";import{t as u}from"./client-BwCSrdti.js";import"./dist-DaW7WEqw.js";var d=u.omit({mcpResource:!0}),f=`vc.aventure.aventure-cli.oauth`,p=`oauth:`,m=6e4;function h(e,t){let n=L(t);return{client:e,expiresAt:z(R(n)),tokens:n}}async function g(e,t){let n=r(e),o=M(n,t),c;try{c=await a(async()=>await s(f,j(n),o))}catch(e){throw Error(`OAuth credential could not be stored — ${i(e,[o,...A(t.tokens)])}`,{cause:e})}return{host:n,provider:c,credential:N(n,o)}}async function _(e){let t=r(e),n;try{n=await o(f,j(t))}catch(e){return{state:`unavailable`,summary:i(e)}}let{record:a,keyringFailure:s}=n;return a===void 0?s===void 0?{state:`missing`}:{state:`missing`,keyringFailure:s}:{state:`found`,stored:{host:t,provider:a.provider,credential:N(t,a.value)}}}async function v(e){let t=r(e);await a(async()=>await l(f,j(t)))}async function y(e){try{return await _(e)}catch(e){return{state:`invalid`,summary:i(e)}}}async function b(e){let t=await y(e);if(t.state!==`missing`)return t;let n=await x(e);return n.state===`unavailable`?n:n.keyringFailure===void 0?{state:`missing`}:{state:`missing`,keyringFailure:n.keyringFailure}}async function x(e){let t=r(e);try{return{state:`available`,...await c(f,j(t))}}catch(e){return{state:`unavailable`,summary:i(e)}}}function S(e){return E(e.authorizationServer,`authorization server`)}function C(e){if(URL.canParse(e.resource)&&new URL(e.resource).protocol===`http:`){let t=n(e.resource);if(t.isLoopback)return new URL(t.origin)}return E(e.resource,`resource`)}function w(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function T(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}function E(e,t,n=!1){let r;try{r=new URL(e)}catch(e){throw Error(`OAuth ${t} is not a valid URL`,{cause:e})}if(r.protocol!==`https:`||r.username.length>0||r.password.length>0||!n&&r.search.length>0||r.hash.length>0)throw Error(`OAuth ${t} must be an HTTPS URL without credentials${n?``:`, query`} or fragment`);return r}function D(e){return new Date(e.expiresAt).getTime()-m<=Date.now()}function O(e){let t=k(e.tokens.id_token)??k(e.tokens.access_token),n=t?.email;return{subject:t?.sub??null,email:typeof n==`string`?n:null}}function k(e){if(e!==void 0)try{return t(e)}catch{return}}function A(e){return[e.access_token,e.refresh_token,e.id_token]}function j(e){return`${p}${e}`}function M(e,t){return JSON.stringify({client:P(e,t.client),expiresAt:B(t.expiresAt,`absolute expiry`),tokens:L(t.tokens),...t.verifiedAt===void 0?{}:{verifiedAt:B(t.verifiedAt,`verification time`)}})}function N(e,t){let n;try{n=JSON.parse(t)}catch(e){throw Error(`OS OAuth credential entry failed schema validation`,{cause:e})}if(!H(n))throw Error(`OS OAuth credential entry failed schema validation`);return{client:P(e,F(n.client)),expiresAt:B(n.expiresAt,`absolute expiry`),tokens:L(I(n.tokens)),...n.verifiedAt===void 0?{}:{verifiedAt:B(n.verifiedAt,`verification time`)}}}function P(e,t){let r=n(t.resource);if(r.host!==e&&!(r.isLoopback&&n(e).isLoopback))throw Error(`OAuth client resource must match the credential API host`);return t}function F(e){let t=d.safeParse(e);if(!t.success)throw Error(`OS OAuth credential entry failed canonical client validation`,{cause:t.error});return t.data}function I(t){let n=e.safeParse(t);if(!n.success)throw Error(`OS OAuth credential entry failed OAuth token validation`,{cause:n.error});return n.data}function L(e){if(!V(e.access_token)||e.token_type.trim().toLowerCase()!==`bearer`)throw Error(`OAuth token response must contain a bearer access token`);if(e.refresh_token!==void 0&&!V(e.refresh_token))throw Error(`OAuth token response has an invalid refresh token`);return R(e),e}function R(e){let t=e.expires_in;if(typeof t!=`number`||!Number.isSafeInteger(t)||t<=0)throw Error(`OAuth token response must contain a positive expires_in`);return t}function z(e){let t=new Date(Date.now()+e*1e3);if(!Number.isFinite(t.getTime()))throw Error(`OAuth token response has an expiry outside the supported date range`);return t.toISOString()}function B(e,t){if(typeof e!=`string`)throw Error(`OS OAuth credential entry has an invalid ${t}`);let n=new Date(e);if(!Number.isFinite(n.getTime())||n.toISOString()!==e)throw Error(`OS OAuth credential entry has an invalid ${t}`);return e}function V(e){return e.trim()===e&&e.length>0}function H(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{D as a,w as c,T as d,A as f,g as h,b as i,O as l,E as m,v as n,_ as o,x as p,y as r,S as s,h as t,C as u};
+import{Yt as e}from"./auth-BNDyLTqp-GYAzJXBe.js";import{i as t}from"./webapi-B2JTupyg.js";import{n,r}from"./api-target-vxev2RKl.js";import{t as i}from"./credential-redaction-BpaNjjm9.js";import{a,i as o,o as s,r as c,t as l}from"./credential-store-D0YIGs_c.js";import{t as u}from"./client-BwCSrdti.js";import"./dist-DaW7WEqw.js";var d=u.omit({mcpResource:!0}),f=`vc.aventure.aventure-cli.oauth`,p=`oauth:`,m=6e4;function h(e,t){let n=L(t);return{client:e,expiresAt:z(R(n)),tokens:n}}async function g(e,t){let n=r(e),o=M(n,t),c;try{c=await a(async()=>await s(f,j(n),o))}catch(e){throw Error(`OAuth credential could not be stored — ${i(e,[o,...A(t.tokens)])}`,{cause:e})}return{host:n,provider:c,credential:N(n,o)}}async function _(e){let t=r(e),n;try{n=await o(f,j(t))}catch(e){return{state:`unavailable`,summary:i(e)}}let{record:a,keyringFailure:s}=n;return a===void 0?s===void 0?{state:`missing`}:{state:`missing`,keyringFailure:s}:{state:`found`,stored:{host:t,provider:a.provider,credential:N(t,a.value)}}}async function v(e){let t=r(e);await a(async()=>await l(f,j(t)))}async function y(e){try{return await _(e)}catch(e){return{state:`invalid`,summary:i(e)}}}async function b(e){let t=await y(e);if(t.state!==`missing`)return t;let n=await x(e);return n.state===`unavailable`?n:n.keyringFailure===void 0?{state:`missing`}:{state:`missing`,keyringFailure:n.keyringFailure}}async function x(e){let t=r(e);try{return{state:`available`,...await c(f,j(t))}}catch(e){return{state:`unavailable`,summary:i(e)}}}function S(e){return E(e.authorizationServer,`authorization server`)}function C(e){if(URL.canParse(e.resource)&&new URL(e.resource).protocol===`http:`){let t=n(e.resource);if(t.isLoopback)return new URL(t.origin)}return E(e.resource,`resource`)}function w(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function T(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}function E(e,t,n=!1){let r;try{r=new URL(e)}catch(e){throw Error(`OAuth ${t} is not a valid URL`,{cause:e})}if(r.protocol!==`https:`||r.username.length>0||r.password.length>0||!n&&r.search.length>0||r.hash.length>0)throw Error(`OAuth ${t} must be an HTTPS URL without credentials${n?``:`, query`} or fragment`);return r}function D(e){return new Date(e.expiresAt).getTime()-m<=Date.now()}function O(e){let t=k(e.tokens.id_token)??k(e.tokens.access_token),n=t?.email;return{subject:t?.sub??null,email:typeof n==`string`?n:null}}function k(e){if(e!==void 0)try{return t(e)}catch{return}}function A(e){return[e.access_token,e.refresh_token,e.id_token]}function j(e){return`${p}${e}`}function M(e,t){return JSON.stringify({client:P(e,t.client),expiresAt:B(t.expiresAt,`absolute expiry`),tokens:L(t.tokens),...t.verifiedAt===void 0?{}:{verifiedAt:B(t.verifiedAt,`verification time`)}})}function N(e,t){let n;try{n=JSON.parse(t)}catch(e){throw Error(`OS OAuth credential entry failed schema validation`,{cause:e})}if(!H(n))throw Error(`OS OAuth credential entry failed schema validation`);return{client:P(e,F(n.client)),expiresAt:B(n.expiresAt,`absolute expiry`),tokens:L(I(n.tokens)),...n.verifiedAt===void 0?{}:{verifiedAt:B(n.verifiedAt,`verification time`)}}}function P(e,t){let r=n(t.resource);if(r.host!==e&&!(r.isLoopback&&n(e).isLoopback))throw Error(`OAuth client resource must match the credential API host`);return t}function F(e){let t=d.safeParse(e);if(!t.success)throw Error(`OS OAuth credential entry failed canonical client validation`,{cause:t.error});return t.data}function I(t){let n=e.safeParse(t);if(!n.success)throw Error(`OS OAuth credential entry failed OAuth token validation`,{cause:n.error});return n.data}function L(e){if(!V(e.access_token)||e.token_type.trim().toLowerCase()!==`bearer`)throw Error(`OAuth token response must contain a bearer access token`);if(e.refresh_token!==void 0&&!V(e.refresh_token))throw Error(`OAuth token response has an invalid refresh token`);return R(e),e}function R(e){let t=e.expires_in;if(typeof t!=`number`||!Number.isSafeInteger(t)||t<=0)throw Error(`OAuth token response must contain a positive expires_in`);return t}function z(e){let t=new Date(Date.now()+e*1e3);if(!Number.isFinite(t.getTime()))throw Error(`OAuth token response has an expiry outside the supported date range`);return t.toISOString()}function B(e,t){if(typeof e!=`string`)throw Error(`OS OAuth credential entry has an invalid ${t}`);let n=new Date(e);if(!Number.isFinite(n.getTime())||n.toISOString()!==e)throw Error(`OS OAuth credential entry has an invalid ${t}`);return e}function V(e){return e.trim()===e&&e.length>0}function H(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{D as a,w as c,T as d,A as f,g as h,b as i,O as l,E as m,v as n,_ as o,x as p,y as r,S as s,h as t,C as u};

package/dist/chunks/{oauth-credential-EzxD4m3r.js → oauth-credential-DEQJ2kVM.js}

@@ -1 +1 @@
-export{i as inspectOAuthCredentialStorage}from"./oauth-credential-BI-8dUCp.js";
+export{i as inspectOAuthCredentialStorage}from"./oauth-credential-CixAZZ6C.js";

package/dist/chunks/{oauth-login-DDPJxDeu.js → oauth-login-BJoqHILK.js}

@@ -1 +1 @@
-export{n as fetchAuthProviderCatalog,r as loginOAuthCredential,i as renewOAuthTokens}from"./oauth-login-DrJwZyZt.js";
+export{n as fetchAuthProviderCatalog,r as loginOAuthCredential,i as renewOAuthTokens}from"./oauth-login-xA37taTL.js";

package/dist/chunks/{oauth-login-DrJwZyZt.js → oauth-login-xA37taTL.js}

@@ -1,4 +1,4 @@
-import{Gt as e,Yt as t}from"./auth-BNDyLTqp-GYAzJXBe.js";import{f as n}from"./env-CFzWAaru.js";import{c as r,r as i}from"./result-envelope-DnsIr3gF.js";import{a,n as o,s}from"./openapi-call-nDQnfSQ7.js";import{R as c}from"./webapi-B2JTupyg.js";import{a as l,r as u}from"./api-target-vxev2RKl.js";import{n as d,t as f}from"./credential-redaction-BtlCCACb.js";import{n as p,s as ee}from"./credential-store-CAamXkXE.js";import"./dist-DaW7WEqw.js";import{a as te,c as m,d as h,f as g,h as ne,m as _,p as v,r as y,s as b,t as x,u as S}from"./oauth-credential-BI-8dUCp.js";import{t as C}from"./provider-catalog-k5VPfOoO.js";import{f as w,o as T,s as E,u as re}from"./dist-DL7QmxmX.js";import{r as ie}from"./oauth-bearer-credential-D6SvsZlr.js";import{once as ae}from"node:events";import{stderr as D}from"node:process";import{setTimeout as oe}from"node:timers/promises";import{createServer as se}from"node:http";import{randomBytes as ce,timingSafeEqual as O}from"node:crypto";var k=5e3,A=500,j=`Approval poll was interrupted; retrying.
+import{Gt as e,Yt as t}from"./auth-BNDyLTqp-GYAzJXBe.js";import{f as n}from"./env-NNOxjaEI.js";import{c as r,r as i}from"./result-envelope-CiOoDKaK.js";import{a,n as o,s}from"./openapi-call-DFcI7xZD.js";import{R as c}from"./webapi-B2JTupyg.js";import{a as l,r as u}from"./api-target-vxev2RKl.js";import{n as d,t as f}from"./credential-redaction-BpaNjjm9.js";import{n as p,s as ee}from"./credential-store-D0YIGs_c.js";import"./dist-DaW7WEqw.js";import{a as te,c as m,d as h,f as g,h as ne,m as _,p as v,r as y,s as b,t as x,u as S}from"./oauth-credential-CixAZZ6C.js";import{t as C}from"./provider-catalog-k5VPfOoO.js";import{f as w,o as T,s as E,u as re}from"./dist-DL7QmxmX.js";import{r as ie}from"./oauth-bearer-credential-COLNUoER.js";import{once as ae}from"node:events";import{stderr as D}from"node:process";import{setTimeout as oe}from"node:timers/promises";import{createServer as se}from"node:http";import{randomBytes as ce,timingSafeEqual as O}from"node:crypto";var k=5e3,A=500,j=`Approval poll was interrupted; retrying.
 `,M=`urn:ietf:params:oauth:grant-type:device_code`;function N(e){let t=Reflect.get(e,`device_authorization_endpoint`);if(typeof t!=`string`)throw Error(`OAuth authorization-server metadata lacks device_authorization_endpoint`);return _(t,`device authorization endpoint`,!0)}async function P(e,t){if(t.grant_types_supported?.includes(M)!==!0)throw Error(`OAuth authorization-server metadata must advertise the device authorization grant`);let n=await fetch(N(t),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:m(e),scope:h(e).join(` `),resource:S(e).toString()})});if(!n.ok)throw Error(`device authorization endpoint answered ${n.status}`);return I(await F(n,`device authorization`),Date.now())}async function F(e,t){try{return await e.json()}catch(n){throw Error(`${t} endpoint answered ${e.status} without a JSON body`,{cause:n})}}function I(e,t){if(typeof e!=`object`||!e)throw Error(`device authorization response is not an object`);let n=Reflect.get(e,`device_code`),r=Reflect.get(e,`user_code`),i=Reflect.get(e,`verification_uri_complete`),a=Reflect.get(e,`verification_uri`),o=Reflect.get(e,`expires_in`),s=Reflect.get(e,`interval`);if(typeof n!=`string`||typeof r!=`string`||n.length===0||r.length===0)throw Error(`device authorization response lacks device_code or user_code`);let c=typeof i==`string`&&i.length>0?i:a;if(typeof c!=`string`)throw Error(`device authorization response lacks a verification URI`);if(typeof o!=`number`||o<=0)throw Error(`device authorization response lacks a positive expires_in`);return{deviceCode:n,userCode:r,verificationUri:_(c,`verification URI`,!0),expiresAt:t+o*1e3,intervalMilliseconds:(typeof s==`number`&&s>=0?s:5)*1e3}}async function L(n,r,i){let a=_(r.token_endpoint,`token endpoint`,!0),o=i.intervalMilliseconds,s=null;for(;Date.now()<i.expiresAt;){await oe(o);let r;try{r=await fetch(a,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:m(n),grant_type:M,device_code:i.deviceCode})})}catch(e){s=`the token endpoint was unreachable — ${f(e)}`,D.write(j);continue}if(r.status>=A){await r.body?.cancel(),s=`the token endpoint answered ${r.status}`,D.write(j);continue}s=null;let c=await F(r,`token`);if(r.ok){let e=t.safeParse(c);if(!e.success)throw Error(`token endpoint returned an invalid token response`);return e.data}let l=e.safeParse(c),u=l.success?l.data.error:`HTTP ${r.status}`;if(u!==`authorization_pending`){if(u===`slow_down`)o+=k;else throw Error(u===`access_denied`?`the sign-in was denied in the browser`:u===`expired_token`?`the device code expired before approval`:`token endpoint answered ${u}`)}}throw Error(s===null?`the device code expired before approval`:`the device code expired before approval — last failure: ${s}`)}var R=3e5;function z(e){let t;try{t=new URL(e.redirectUri)}catch(e){throw Error(`OAuth callback configuration is not a valid URL`,{cause:e})}if(t.protocol!==`http:`||t.hostname!==`127.0.0.1`||t.port.length>0||t.pathname!==`/callback`||t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0)throw Error(`OAuth callback configuration must be http://127.0.0.1/callback without a port, query, or fragment`);return t}async function B(e,t){let n,r=new Promise(e=>{n=e}),i=se((r,i)=>{i.setHeader(`Cache-Control`,`no-store`),i.setHeader(`Content-Type`,`text/plain; charset=utf-8`);let a=new URL(r.url??`/`,e);if(r.method!==`GET`||a.pathname!==e.pathname){i.statusCode=404,i.end(`OAuth callback not found.`);return}let o=a.searchParams.getAll(`state`),s=Buffer.from(o[0]??``),c=Buffer.from(t);if(o.length!==1||s.length!==c.length||!O(s,c)){i.statusCode=400,i.end(`OAuth callback state did not match. Return to the CLI and retry.`);return}if(a.searchParams.has(`error`)){i.statusCode=400,i.end(`OAuth authorization was not completed. Return to the CLI.`),n({state:`failed`,message:`OAuth authorization server returned an error`});return}let l=a.searchParams.getAll(`code`),u=l[0]?.trim();if(l.length!==1||u===void 0||u.length===0){i.statusCode=400,i.end(`OAuth callback did not include an authorization code.`);return}let d=a.searchParams.getAll(`iss`);d.length>1?(i.statusCode=400,i.end(`OAuth callback named more than one issuer.`)):(i.statusCode=200,i.end(`OAuth authorization completed. Return to the CLI.`),n({state:`code`,authorizationCode:u,iss:d[0]}))});i.on(`error`,e=>n({state:`failed`,message:`OAuth callback listener failed: ${f(e)}`}));try{let t=ae(i,`listening`);i.listen({host:`127.0.0.1`,port:0}),await t;let n=i.address();if(n===null||typeof n==`string`||n.port<=0)throw Error(`OAuth callback listener did not receive an ephemeral loopback port`);let a=new URL(e);return a.port=String(n.port),{redirectUri:a,waitForAuthorizationCode:async()=>{let e;return await Promise.race([r,new Promise(t=>{e=setTimeout(()=>t({state:`timed-out`}),R)})]).finally(()=>{e!==void 0&&clearTimeout(e)})},close:async()=>await V(i)}}catch(e){throw i.listening&&await V(i),e}}function V(e){return new Promise((t,n)=>{e.close(e=>e===void 0?t():n(e))})}var H=`the OAuth credential is valid, but the API refused this account (HTTP 403); signing in again will not change that`;async function U(e){let t;try{t=u(n().host)}catch(e){return i(`auth login: invalid API host — ${f(e)}`)}let o=await y(t);if(o.state===`missing`)return G(t,e);if(o.state===`unavailable`)return i(`auth login: ${o.summary}`);if(o.state===`invalid`)return G(t,e,`Saved OAuth credential cannot be read — ${o.summary}`);let{stored:s}=o;if(te(s.credential))return await W(s,e);let l;try{l=await a(s.credential.tokens.access_token,S(s.credential.client))}catch(n){return n instanceof c?G(t,e,`Saved OAuth credential was rejected`):i(`auth login: saved OAuth credential could not be verified — ${f(n,g(s.credential.tokens))}`)}return l===`forbidden`?i(`auth login: ${H}`):l===null?G(t,e,`Saved OAuth credential was rejected`):r(`OAuth CLI access token is already stored and verified.`,$(s))}async function W(e,t){let n=await v(e.host);if(n.state===`unavailable`)return i(`auth login: ${n.summary}`);let{tokens:r}=e.credential;if(r.refresh_token===void 0)return G(e.host,t,`Saved OAuth access token expired`,n);let a;try{a=await ie(e)}catch(i){return G(e.host,t,`Saved OAuth credential could not be renewed — ${f(i,g(r))}`,n)}J(n);let o=await Q(e.host,a,`OAuth CLI access token renewed and verified.`);if(!o.ok)return o;let s=await Z(a);return s.state===`failed`?i(`auth login: ${s.summary}`):s.state===`rejected`?G(e.host,t,`Renewed OAuth access token was rejected`,n):o}async function G(e,t,n,r){let a=r??await v(e);if(a.state===`unavailable`)return i(`auth login: ${a.summary}`);J(a),n!==void 0&&D.write(`${n}; continuing to browser sign-in.\n`);let o;try{let e=(await Y()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);o=e}catch(e){return i(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let s;try{s=await X(o)}catch(e){return i(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}if(t.noBrowser)return await K(e,o,s);let c=ce(32).toString(`base64url`),l;try{l=await B(z(o),c);let t=await w(b(o),{metadata:s,clientInformation:{client_id:m(o)},redirectUrl:l.redirectUri,resource:S(o),scope:h(o).join(` `),state:c});t.authorizationUrl.searchParams.delete(`prompt`);let n=await ee(t.authorizationUrl,{noBrowser:!1});n.state===`opened`?D.write(`Browser sign-in opened: choose the account, then approve. Waiting for the loopback callback...
 `):D.write(`Browser not opened automatically (${n.reason}).\nOpen this private sign-in URL in a browser that can reach this machine's loopback callback:
 ${t.authorizationUrl.toString()}\nWaiting for the loopback callback...\n`);let r=await l.waitForAuthorizationCode();if(r.state===`timed-out`)return await l.close(),l=void 0,D.write(`Browser sign-in was not completed; continuing with a device code.

package/dist/chunks/{openapi-call-Jz01ShiX.js → openapi-call-Ck0YiwPf.js}

@@ -1 +1 @@
-export{t as BearerVerificationUnavailableError,n as buildOpenApiPath,r as resolveOpenApiOperationSelector,i as runOpenApiCall,a as verifyUserBearerToken}from"./openapi-call-nDQnfSQ7.js";
+export{t as BearerVerificationUnavailableError,n as buildOpenApiPath,r as resolveOpenApiOperationSelector,i as runOpenApiCall,a as verifyUserBearerToken}from"./openapi-call-DFcI7xZD.js";