@aventurevc/aventure-cli 0.8.387 → 0.8.389

package/dist/chunks/oauth-credential-D5ioBfGK.js

@@ -1 +0,0 @@
-import{Yt as e}from"./auth-BNDyLTqp-z6VNZXaE.js";import{i as t}from"./webapi-B2JTupyg.js";import{n,r}from"./api-target-vxev2RKl.js";import{t as i}from"./credential-redaction-Cl6Eny3X.js";import{a,i as o,o as s,r as c,t as l}from"./credential-store-xkwn77zF.js";import{t as u}from"./client-C-w059lW.js";import"./dist-oUS6BQ43.js";var d=u.omit({mcpResource:!0}),f=`vc.aventure.aventure-cli.oauth`,p=`oauth:`,m=6e4;function h(e,t){let n=L(t);return{client:e,expiresAt:z(R(n)),tokens:n}}async function g(e,t){let n=r(e),o=M(n,t),c;try{c=await a(async()=>await s(f,j(n),o))}catch(e){throw Error(`OAuth credential could not be stored — ${i(e,[o,...A(t.tokens)])}`,{cause:e})}return{host:n,provider:c,credential:N(n,o)}}async function _(e){let t=r(e),n;try{n=await o(f,j(t))}catch(e){return{state:`unavailable`,summary:i(e)}}let{record:a,keyringFailure:s}=n;return a===void 0?s===void 0?{state:`missing`}:{state:`missing`,keyringFailure:s}:{state:`found`,stored:{host:t,provider:a.provider,credential:N(t,a.value)}}}async function v(e){let t=r(e);await a(async()=>await l(f,j(t)))}async function y(e){try{return await _(e)}catch(e){return{state:`invalid`,summary:i(e)}}}async function b(e){let t=await y(e);if(t.state!==`missing`)return t;let n=await x(e);return n.state===`unavailable`?n:n.keyringFailure===void 0?{state:`missing`}:{state:`missing`,keyringFailure:n.keyringFailure}}async function x(e){let t=r(e);try{return{state:`available`,...await c(f,j(t))}}catch(e){return{state:`unavailable`,summary:i(e)}}}function S(e){return E(e.authorizationServer,`authorization server`)}function C(e){if(URL.canParse(e.resource)&&new URL(e.resource).protocol===`http:`){let t=n(e.resource);if(t.isLoopback)return new URL(t.origin)}return E(e.resource,`resource`)}function w(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function T(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}function E(e,t,n=!1){let r;try{r=new URL(e)}catch(e){throw Error(`OAuth ${t} is not a valid URL`,{cause:e})}if(r.protocol!==`https:`||r.username.length>0||r.password.length>0||!n&&r.search.length>0||r.hash.length>0)throw Error(`OAuth ${t} must be an HTTPS URL without credentials${n?``:`, query`} or fragment`);return r}function D(e){return new Date(e.expiresAt).getTime()-m<=Date.now()}function O(e){let t=k(e.tokens.id_token)??k(e.tokens.access_token),n=t?.email;return{subject:t?.sub??null,email:typeof n==`string`?n:null}}function k(e){if(e!==void 0)try{return t(e)}catch{return}}function A(e){return[e.access_token,e.refresh_token,e.id_token]}function j(e){return`${p}${e}`}function M(e,t){return JSON.stringify({client:P(e,t.client),expiresAt:B(t.expiresAt,`absolute expiry`),tokens:L(t.tokens),...t.verifiedAt===void 0?{}:{verifiedAt:B(t.verifiedAt,`verification time`)}})}function N(e,t){let n;try{n=JSON.parse(t)}catch(e){throw Error(`OS OAuth credential entry failed schema validation`,{cause:e})}if(!H(n))throw Error(`OS OAuth credential entry failed schema validation`);return{client:P(e,F(n.client)),expiresAt:B(n.expiresAt,`absolute expiry`),tokens:L(I(n.tokens)),...n.verifiedAt===void 0?{}:{verifiedAt:B(n.verifiedAt,`verification time`)}}}function P(e,t){let r=n(t.resource);if(r.host!==e&&!(r.isLoopback&&n(e).isLoopback))throw Error(`OAuth client resource must match the credential API host`);return t}function F(e){let t=d.safeParse(e);if(!t.success)throw Error(`OS OAuth credential entry failed canonical client validation`,{cause:t.error});return t.data}function I(t){let n=e.safeParse(t);if(!n.success)throw Error(`OS OAuth credential entry failed OAuth token validation`,{cause:n.error});return n.data}function L(e){if(!V(e.access_token)||e.token_type.trim().toLowerCase()!==`bearer`)throw Error(`OAuth token response must contain a bearer access token`);if(e.refresh_token!==void 0&&!V(e.refresh_token))throw Error(`OAuth token response has an invalid refresh token`);return R(e),e}function R(e){let t=e.expires_in;if(typeof t!=`number`||!Number.isSafeInteger(t)||t<=0)throw Error(`OAuth token response must contain a positive expires_in`);return t}function z(e){let t=new Date(Date.now()+e*1e3);if(!Number.isFinite(t.getTime()))throw Error(`OAuth token response has an expiry outside the supported date range`);return t.toISOString()}function B(e,t){if(typeof e!=`string`)throw Error(`OS OAuth credential entry has an invalid ${t}`);let n=new Date(e);if(!Number.isFinite(n.getTime())||n.toISOString()!==e)throw Error(`OS OAuth credential entry has an invalid ${t}`);return e}function V(e){return e.trim()===e&&e.length>0}function H(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{D as a,w as c,T as d,A as f,g as h,b as i,O as l,E as m,v as n,_ as o,x as p,y as r,S as s,h as t,C as u};