@claude-flow/security 3.0.0-alpha.10 → 3.0.0-alpha.12

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,IAAI,kBAAkB,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}

package/dist/index.js

@@ -43,6 +43,16 @@ export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, } fro
 // Action-layer: SendMessage envelope + per-action scope check + MCP server
 // identity probe. Wraps the comms layer in P2; wraps the dispatcher in P3.
 export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, } from './authorization/propagator.js';
+// OAuth 2.0 + PKCE + OS Keychain (ADR-306)
+// A TypeScript port of meta-proxy's proven oauth/{client,pkce,browser,
+// callback_server}.rs — see src/oauth/client.ts for why this targets the
+// live auth.cognitum.one surface rather than ADR-308's unconfirmed spec.
+export { CLIENT_ID as OAUTH_CLIENT_ID, SCOPE as OAUTH_SCOPE, OOB_REDIRECT_URI, OAuthError, authorizeUrl, exchangeCode, refreshToken, exchangeManualCode, } from './oauth/client.js';
+export { generate as generatePkce, challengeFromVerifier } from './oauth/pkce.js';
+export { CallbackServer, CallbackTimeoutError } from './oauth/callback-server.js';
+export { openBrowser } from './oauth/browser.js';
+// OS Keychain Adapter (ADR-306)
+export { createKeychainAdapter, SessionOnlyKeychainAdapter, } from './keychain-adapter.js';
 // Plugin Integrity Verifier (ADR-145 P1 — ruvnet/ruflo#2254)
 // Install-layer: Ed25519 signature verification + trust-anchor allowlist.
 // Stage-2 semantic-intent scan (SCH defence) lands in P2.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,2CAA2C;AAC3C,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAoB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAuB,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,gCAAgC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}

package/dist/keychain-adapter.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Cross-platform OS keychain adapter (ADR-306) — macOS Keychain, Windows
+ * Credential Manager (DPAPI), Linux Secret Service (libsecret), backed by
+ * `@napi-rs/keyring` (prebuilt N-API binaries per platform, wraps the Rust
+ * `keyring-rs` crate — no node-gyp compile step, same "optional native
+ * binding" shape this monorepo already tolerates for `ruvector`).
+ *
+ * `keytar` was considered and rejected: archived by the Electron team,
+ * compiles from source via node-gyp at install time.
+ *
+ * ADR-306's refresh-token storage rule: OS keychain only, never plain-text
+ * config. When no keychain backend is reachable (typical headless Linux —
+ * the binding can be present but no D-Bus Secret Service running), the CLI
+ * falls back to session-only tokens (never persisted) rather than writing
+ * the secret to disk unencrypted — a deliberate usability cost, not a bug.
+ * `SessionOnlyKeychainAdapter` is that fallback, made explicit rather than
+ * silently degrading.
+ *
+ * @module v3/security/keychain-adapter
+ */
+export interface KeychainAdapter {
+    /**
+     * A real write+read+delete canary probe against a throwaway entry — not
+     * just "did the native module load". A headless box can have the binding
+     * present but no reachable Secret Service, which only a real round-trip
+     * reveals.
+     */
+    isAvailable(): Promise<boolean>;
+    setSecret(service: string, account: string, secret: string): Promise<void>;
+    getSecret(service: string, account: string): Promise<string | null>;
+    deleteSecret(service: string, account: string): Promise<void>;
+}
+/** In-memory-only fallback — the ADR-306-mandated degrade path, not an error state. */
+export declare class SessionOnlyKeychainAdapter implements KeychainAdapter {
+    private readonly store;
+    private key;
+    isAvailable(): Promise<boolean>;
+    setSecret(service: string, account: string, secret: string): Promise<void>;
+    getSecret(service: string, account: string): Promise<string | null>;
+    deleteSecret(service: string, account: string): Promise<void>;
+}
+/**
+ * Selects a real OS keychain when reachable, falling back to
+ * `SessionOnlyKeychainAdapter` otherwise. Always resolves — never throws —
+ * so callers can treat "no keychain" as a normal, expected outcome.
+ */
+export declare function createKeychainAdapter(): Promise<KeychainAdapter>;
+//# sourceMappingURL=keychain-adapter.d.ts.map

package/dist/keychain-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-adapter.d.ts","sourceRoot":"","sources":["../src/keychain-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAKD,uFAAuF;AACvF,qBAAa,0BAA2B,YAAW,eAAe;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IAEnD,OAAO,CAAC,GAAG;IAIL,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpE;AAiED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,eAAe,CAAC,CAItE"}

package/dist/keychain-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-adapter.js","sourceRoot":"","sources":["../src/keychain-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,uFAAuF;AACvF,MAAM,OAAO,0BAA0B;IACpB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,MAAM,qBAAqB;IACjB,SAAS,CAAsC,CAAC,+BAA+B;IAE/E,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAA2C,CAAC;YACzF,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,8DAA8D;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;YACxD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,QAAQ,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,2EAA2E;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,4CAA4C;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC3C,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,IAAI,0BAA0B,EAAE,CAAC;AAC1C,CAAC"}

package/dist/oauth/browser.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Opens the system default browser for the `ruflo auth login` flow. A
+ * TypeScript port of meta-proxy's `src/oauth/browser.rs`.
+ *
+ * Deliberately does NOT go through `SafeExecutor.execute()`: `SafeExecutor`'s
+ * blocked-argument patterns (`safe-executor.ts`'s `DEFAULT_BLOCKED_PATTERNS`)
+ * include a bare `&`, which is meant to catch shell-metacharacter injection in
+ * command-line-style arguments — but it also appears in every real OAuth
+ * authorize URL's query string (`?a=1&b=2&...`), so passing one through would
+ * false-positive-reject on every real invocation. That blocklist is the wrong
+ * tool for a URL argument: with `shell: false` (used here, same as
+ * `SafeExecutor`), a single argv element containing `&` is inert — there's no
+ * shell to interpret it. The actual safety property that matters is "the URL
+ * was constructed by us from validated components, never from raw external
+ * input" (this module's `authorizeUrl()` in `client.ts` is the only caller),
+ * which `assertSafeUrl` below checks directly instead.
+ *
+ * @module v3/security/oauth/browser
+ */
+/**
+ * Attempts to open `url` in the system default browser. Resolves whether or
+ * not a browser window actually appeared — this cannot be confirmed in
+ * general, which is why the caller always also prints the URL as a fallback.
+ */
+export declare function openBrowser(url: string): Promise<void>;
+/** Pure command selection, exported for platform regression tests. */
+export declare function browserCommand(url: string, platform?: NodeJS.Platform): {
+    cmd: string;
+    args: string[];
+};
+//# sourceMappingURL=browser.d.ts.map

package/dist/oauth/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/oauth/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtD;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWzH"}

package/dist/oauth/browser.js

@@ -0,0 +1,55 @@
+/**
+ * Opens the system default browser for the `ruflo auth login` flow. A
+ * TypeScript port of meta-proxy's `src/oauth/browser.rs`.
+ *
+ * Deliberately does NOT go through `SafeExecutor.execute()`: `SafeExecutor`'s
+ * blocked-argument patterns (`safe-executor.ts`'s `DEFAULT_BLOCKED_PATTERNS`)
+ * include a bare `&`, which is meant to catch shell-metacharacter injection in
+ * command-line-style arguments — but it also appears in every real OAuth
+ * authorize URL's query string (`?a=1&b=2&...`), so passing one through would
+ * false-positive-reject on every real invocation. That blocklist is the wrong
+ * tool for a URL argument: with `shell: false` (used here, same as
+ * `SafeExecutor`), a single argv element containing `&` is inert — there's no
+ * shell to interpret it. The actual safety property that matters is "the URL
+ * was constructed by us from validated components, never from raw external
+ * input" (this module's `authorizeUrl()` in `client.ts` is the only caller),
+ * which `assertSafeUrl` below checks directly instead.
+ *
+ * @module v3/security/oauth/browser
+ */
+import { execFile } from 'node:child_process';
+/** Throws if `url` isn't a well-formed https/http URL — the one check that matters here. */
+function assertSafeUrl(url) {
+    const parsed = new URL(url); // throws on malformed input
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`refusing to open non-http(s) URL scheme: ${parsed.protocol}`);
+    }
+}
+/**
+ * Attempts to open `url` in the system default browser. Resolves whether or
+ * not a browser window actually appeared — this cannot be confirmed in
+ * general, which is why the caller always also prints the URL as a fallback.
+ */
+export function openBrowser(url) {
+    assertSafeUrl(url);
+    const { cmd, args } = browserCommand(url);
+    return new Promise((resolve) => {
+        execFile(cmd, args, { shell: false, windowsHide: true }, () => resolve());
+    });
+}
+/** Pure command selection, exported for platform regression tests. */
+export function browserCommand(url, platform = process.platform) {
+    assertSafeUrl(url);
+    if (platform === 'darwin') {
+        return { cmd: 'open', args: [url] };
+    }
+    else if (platform === 'win32') {
+        // cmd.exe treats OAuth query-string `&` separators as command operators,
+        // truncating the URL before client_id. Use the URL handler without a shell.
+        return { cmd: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] };
+    }
+    else {
+        return { cmd: 'xdg-open', args: [url] };
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/oauth/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/oauth/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,4FAA4F;AAC5F,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACtF,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/oauth/callback-server.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Ephemeral-port localhost callback server for the browser-based OAuth flow
+ * (ADR-306). A minimal single-request HTTP server — deliberately not a full
+ * framework for one GET route that lives for one request and then shuts
+ * down. A TypeScript port of meta-proxy's `src/oauth/callback_server.rs`.
+ *
+ * @module v3/security/oauth/callback-server
+ */
+export interface CallbackResult {
+    code: string | null;
+    state: string | null;
+    error: string | null;
+}
+export declare class CallbackTimeoutError extends Error {
+    constructor();
+}
+export declare class CallbackServer {
+    private readonly server;
+    readonly redirectUri: string;
+    readonly port: number;
+    private constructor();
+    /**
+     * Binds `127.0.0.1:0` (OS-assigned ephemeral port) and returns the server
+     * plus the exact `redirect_uri` to send in the authorize request — must be
+     * the `http://127.0.0.1:<port>/oauth/callback` shape identity's
+     * `validate_redirect_uri` accepts.
+     */
+    static bind(): Promise<CallbackServer>;
+    /**
+     * Waits for exactly one `GET /oauth/callback?...` request, replies with the
+     * browser success page, closes the server, and returns the parsed query
+     * parameters. Times out after `waitForMs` so a login attempt the user
+     * abandons in the browser doesn't hang the CLI forever.
+     */
+    awaitCallback(waitForMs?: number): Promise<CallbackResult>;
+}
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/oauth/callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../src/oauth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAeD,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,MAAM;aACP,WAAW,EAAE,MAAM;aACnB,IAAI,EAAE,MAAM;IAH9B,OAAO;IAMP;;;;;OAKG;WACU,IAAI,IAAI,OAAO,CAAC,cAAc,CAAC;IAa5C;;;;;OAKG;IACG,aAAa,CAAC,SAAS,SAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;CA0B7E"}

package/dist/oauth/callback-server.js

@@ -0,0 +1,86 @@
+/**
+ * Ephemeral-port localhost callback server for the browser-based OAuth flow
+ * (ADR-306). A minimal single-request HTTP server — deliberately not a full
+ * framework for one GET route that lives for one request and then shuts
+ * down. A TypeScript port of meta-proxy's `src/oauth/callback_server.rs`.
+ *
+ * @module v3/security/oauth/callback-server
+ */
+import { createServer } from 'node:http';
+const SUCCESS_PAGE = `<html>
+<body style="background:#0a0a0a; color:#f5f5f5; font-family:sans-serif;
+    display:flex; align-items:center; justify-content:center;
+    height:100vh; margin:0;">
+    <div style="text-align:center;">
+    <h1>&#10003; ruflo login successful</h1>
+    <p>You can close this tab and return to your terminal.</p>
+    </div>
+</body>
+</html>`;
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes, matches meta-proxy's CALLBACK_TIMEOUT
+export class CallbackTimeoutError extends Error {
+    constructor() {
+        super('timed out waiting for OAuth callback');
+        this.name = 'CallbackTimeoutError';
+    }
+}
+export class CallbackServer {
+    server;
+    redirectUri;
+    port;
+    constructor(server, redirectUri, port) {
+        this.server = server;
+        this.redirectUri = redirectUri;
+        this.port = port;
+    }
+    /**
+     * Binds `127.0.0.1:0` (OS-assigned ephemeral port) and returns the server
+     * plus the exact `redirect_uri` to send in the authorize request — must be
+     * the `http://127.0.0.1:<port>/oauth/callback` shape identity's
+     * `validate_redirect_uri` accepts.
+     */
+    static async bind() {
+        return new Promise((resolve, reject) => {
+            const server = createServer();
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', () => {
+                server.removeListener('error', reject);
+                const addr = server.address();
+                const redirectUri = `http://127.0.0.1:${addr.port}/oauth/callback`;
+                resolve(new CallbackServer(server, redirectUri, addr.port));
+            });
+        });
+    }
+    /**
+     * Waits for exactly one `GET /oauth/callback?...` request, replies with the
+     * browser success page, closes the server, and returns the parsed query
+     * parameters. Times out after `waitForMs` so a login attempt the user
+     * abandons in the browser doesn't hang the CLI forever.
+     */
+    async awaitCallback(waitForMs = DEFAULT_TIMEOUT_MS) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.server.close();
+                reject(new CallbackTimeoutError());
+            }, waitForMs);
+            this.server.once('request', (req, res) => {
+                clearTimeout(timer);
+                const url = new URL(req.url ?? '/oauth/callback', 'http://127.0.0.1');
+                const result = {
+                    code: url.searchParams.get('code'),
+                    state: url.searchParams.get('state'),
+                    error: url.searchParams.get('error'),
+                };
+                res.writeHead(200, {
+                    'content-type': 'text/html; charset=utf-8',
+                    connection: 'close',
+                });
+                res.end(SUCCESS_PAGE, () => {
+                    this.server.close();
+                    resolve(result);
+                });
+            });
+        });
+    }
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/oauth/callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../src/oauth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAStD,MAAM,YAAY,GAAG;;;;;;;;;QASb,CAAC;AAET,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,mDAAmD;AAE7F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAEN;IACD;IACA;IAHlB,YACmB,MAAc,EACf,WAAmB,EACnB,IAAY;QAFX,WAAM,GAAN,MAAM,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAQ;QACnB,SAAI,GAAJ,IAAI,CAAQ;IAC3B,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;gBAC7C,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,iBAAiB,CAAC;gBACnE,OAAO,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAS,GAAG,kBAAkB;QAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACrC,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACvC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAmB;oBAC7B,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;oBAClC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;oBACpC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,0BAA0B;oBAC1C,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/oauth/client.d.ts

@@ -0,0 +1,57 @@
+/**
+ * HTTP client for `auth.cognitum.one`'s OAuth surface (ADR-306): authorize
+ * URL construction, `POST /oauth/token` (`authorization_code` and
+ * `refresh_token` grants), and `POST /v1/oauth/code-exchange` (OOB fallback).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/client.rs`
+ * (cognitum-one/meta-proxy) — same base URL, same endpoints, same
+ * form/query parameter names, confirmed live 2026-07-16 (a real
+ * `GET /oauth/authorize?...&client_id=meta-proxy&redirect_uri=<ruflo-controlled
+ * loopback>` returns a working consent page, not a redirect_uri-mismatch
+ * error — so this client reuses meta-proxy's registered `client_id` rather
+ * than requiring a new one).
+ *
+ * Deliberately NOT `api.cognitum.one/v1/auth/*` — that's what ruflo's own
+ * checked-in OpenAPI spec (v3/docs/api/cognitum-v1.openapi.yaml, ADR-308)
+ * describes, but it does not match what the real identity server serves.
+ * This client targets the proven, live surface instead.
+ *
+ * @module v3/security/oauth/client
+ */
+export declare const CLIENT_ID = "meta-proxy";
+export declare const SCOPE = "inference";
+/** RFC 8252 out-of-band sentinel — the OOB/manual-paste flow's `redirect_uri`. */
+export declare const OOB_REDIRECT_URI = "urn:ietf:wg:oauth:2.0:oob";
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    account_email?: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+export declare class OAuthError extends Error {
+    readonly code: 'network' | 'protocol' | 'unexpected_shape';
+    readonly oauthError?: string | undefined;
+    readonly oauthDescription?: string | undefined;
+    constructor(message: string, code: 'network' | 'protocol' | 'unexpected_shape', oauthError?: string | undefined, oauthDescription?: string | undefined);
+}
+/** Builds the `/oauth/authorize` URL for the standard loopback-redirect flow. */
+export declare function authorizeUrl(redirectUri: string, state: string, codeChallenge: string): string;
+/** `POST /oauth/token` with `grant_type=authorization_code`. */
+export declare function exchangeCode(code: string, codeVerifier: string, redirectUri: string, base?: string): Promise<TokenResponse>;
+/**
+ * `POST /oauth/token` with `grant_type=refresh_token`. identity rotates
+ * refresh tokens with reuse detection: presenting a refresh token returns a
+ * NEW refresh token and revokes the old one, and re-presenting a spent one
+ * revokes the whole session family. Callers MUST persist the returned
+ * `refresh_token` atomically before using the new access token, and must
+ * never retry a failed refresh with the same token.
+ */
+export declare function refreshToken(refreshTokenValue: string, base?: string): Promise<TokenResponse>;
+/**
+ * `POST /v1/oauth/code-exchange` — the OOB manual-entry fallback for
+ * headless/SSH/container environments where no browser round-trip to
+ * `127.0.0.1` is reachable.
+ */
+export declare function exchangeManualCode(code: string, codeVerifier: string, base?: string): Promise<TokenResponse>;
+//# sourceMappingURL=client.d.ts.map

package/dist/oauth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/oauth/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,eAAO,MAAM,KAAK,cAAc,CAAC;AACjC,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAO5D,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,qBAAa,UAAW,SAAQ,KAAK;aAGjB,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,kBAAkB;aACjD,UAAU,CAAC,EAAE,MAAM;aACnB,gBAAgB,CAAC,EAAE,MAAM;gBAHzC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,kBAAkB,EACjD,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,gBAAgB,CAAC,EAAE,MAAM,YAAA;CAK5C;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAU9F;AAsCD,gEAAgE;AAChE,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,SAAgB,GACnB,OAAO,CAAC,aAAa,CAAC,CAMxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,SAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAE1G;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,SAAgB,GACnB,OAAO,CAAC,aAAa,CAAC,CAYxB"}

package/dist/oauth/client.js

@@ -0,0 +1,120 @@
+/**
+ * HTTP client for `auth.cognitum.one`'s OAuth surface (ADR-306): authorize
+ * URL construction, `POST /oauth/token` (`authorization_code` and
+ * `refresh_token` grants), and `POST /v1/oauth/code-exchange` (OOB fallback).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/client.rs`
+ * (cognitum-one/meta-proxy) — same base URL, same endpoints, same
+ * form/query parameter names, confirmed live 2026-07-16 (a real
+ * `GET /oauth/authorize?...&client_id=meta-proxy&redirect_uri=<ruflo-controlled
+ * loopback>` returns a working consent page, not a redirect_uri-mismatch
+ * error — so this client reuses meta-proxy's registered `client_id` rather
+ * than requiring a new one).
+ *
+ * Deliberately NOT `api.cognitum.one/v1/auth/*` — that's what ruflo's own
+ * checked-in OpenAPI spec (v3/docs/api/cognitum-v1.openapi.yaml, ADR-308)
+ * describes, but it does not match what the real identity server serves.
+ * This client targets the proven, live surface instead.
+ *
+ * @module v3/security/oauth/client
+ */
+export const CLIENT_ID = 'meta-proxy';
+export const SCOPE = 'inference';
+/** RFC 8252 out-of-band sentinel — the OOB/manual-paste flow's `redirect_uri`. */
+export const OOB_REDIRECT_URI = 'urn:ietf:wg:oauth:2.0:oob';
+function authBaseUrl() {
+    const override = process.env.COGNITUM_AUTH_URL;
+    return override && override.trim() ? override : 'https://auth.cognitum.one';
+}
+export class OAuthError extends Error {
+    code;
+    oauthError;
+    oauthDescription;
+    constructor(message, code, oauthError, oauthDescription) {
+        super(message);
+        this.code = code;
+        this.oauthError = oauthError;
+        this.oauthDescription = oauthDescription;
+        this.name = 'OAuthError';
+    }
+}
+/** Builds the `/oauth/authorize` URL for the standard loopback-redirect flow. */
+export function authorizeUrl(redirectUri, state, codeChallenge) {
+    const url = new URL(`${authBaseUrl()}/oauth/authorize`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', CLIENT_ID);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', SCOPE);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    return url.toString();
+}
+async function parseTokenResponse(resp) {
+    if (resp.ok) {
+        try {
+            return (await resp.json());
+        }
+        catch {
+            throw new OAuthError('unexpected response shape from the server', 'unexpected_shape');
+        }
+    }
+    try {
+        const body = (await resp.json());
+        throw new OAuthError(`oauth error: ${body.error} — ${body.error_description}`, 'protocol', body.error, body.error_description);
+    }
+    catch (e) {
+        if (e instanceof OAuthError)
+            throw e;
+        throw new OAuthError('unexpected response shape from the server', 'unexpected_shape');
+    }
+}
+async function postForm(path, form, base = authBaseUrl()) {
+    let resp;
+    try {
+        resp = await fetch(`${base}${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(form).toString(),
+        });
+    }
+    catch (e) {
+        throw new OAuthError(`network error: ${e instanceof Error ? e.message : String(e)}`, 'network');
+    }
+    return parseTokenResponse(resp);
+}
+/** `POST /oauth/token` with `grant_type=authorization_code`. */
+export async function exchangeCode(code, codeVerifier, redirectUri, base = authBaseUrl()) {
+    return postForm('/oauth/token', { grant_type: 'authorization_code', code, code_verifier: codeVerifier, client_id: CLIENT_ID, redirect_uri: redirectUri }, base);
+}
+/**
+ * `POST /oauth/token` with `grant_type=refresh_token`. identity rotates
+ * refresh tokens with reuse detection: presenting a refresh token returns a
+ * NEW refresh token and revokes the old one, and re-presenting a spent one
+ * revokes the whole session family. Callers MUST persist the returned
+ * `refresh_token` atomically before using the new access token, and must
+ * never retry a failed refresh with the same token.
+ */
+export async function refreshToken(refreshTokenValue, base = authBaseUrl()) {
+    return postForm('/oauth/token', { grant_type: 'refresh_token', refresh_token: refreshTokenValue, client_id: CLIENT_ID }, base);
+}
+/**
+ * `POST /v1/oauth/code-exchange` — the OOB manual-entry fallback for
+ * headless/SSH/container environments where no browser round-trip to
+ * `127.0.0.1` is reachable.
+ */
+export async function exchangeManualCode(code, codeVerifier, base = authBaseUrl()) {
+    let resp;
+    try {
+        resp = await fetch(`${base}/v1/oauth/code-exchange`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, code_verifier: codeVerifier, client_id: CLIENT_ID }),
+        });
+    }
+    catch (e) {
+        throw new OAuthError(`network error: ${e instanceof Error ? e.message : String(e)}`, 'network');
+    }
+    return parseTokenResponse(resp);
+}
+//# sourceMappingURL=client.js.map

package/dist/oauth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oauth/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AACtC,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC;AACjC,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,OAAO,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC;AAC9E,CAAC;AAeD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAiD,EACjD,UAAmB,EACnB,gBAAyB;QAEzC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA6C;QACjD,eAAU,GAAV,UAAU,CAAS;QACnB,qBAAgB,GAAhB,gBAAgB,CAAS;QAGzC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,KAAa,EAAE,aAAqB;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,kBAAkB,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;QACnD,MAAM,IAAI,UAAU,CAClB,gBAAgB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,iBAAiB,EAAE,EACxD,UAAU,EACV,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,UAAU;YAAE,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,kBAAkB,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAA4B,EAAE,IAAI,GAAG,WAAW,EAAE;IACtF,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,YAAoB,EACpB,WAAmB,EACnB,IAAI,GAAG,WAAW,EAAE;IAEpB,OAAO,QAAQ,CACb,cAAc,EACd,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,EACxH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,iBAAyB,EAAE,IAAI,GAAG,WAAW,EAAE;IAChF,OAAO,QAAQ,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACjI,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,YAAoB,EACpB,IAAI,GAAG,WAAW,EAAE;IAEpB,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,yBAAyB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OAuth 2.0 + PKCE (RFC 7636) client-side generation (ADR-306).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/pkce.rs` (cognitum-one/meta-proxy,
+ * itself ported from `dashboard/apps/cli/src/pkce.rs`) so a verifier generated
+ * here validates against the same `services/identity` authorization server
+ * meta-proxy already talks to successfully — same byte lengths, same encoding,
+ * same hash. Intentionally duplicated rather than imported from
+ * `@claude-flow/mcp/src/oauth.ts` (a different, unrelated OAuth client in this
+ * monorepo) — ADR-306 assigns PKCE ownership to this package specifically.
+ *
+ * @module v3/security/oauth/pkce
+ */
+export interface PkceRequest {
+    state: string;
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function challengeFromVerifier(verifier: string): string;
+/**
+ * Generates a fresh `state` + PKCE verifier/challenge pair for one login
+ * attempt.
+ */
+export declare function generate(): PkceRequest;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,QAAQ,IAAI,WAAW,CAKtC"}

package/dist/oauth/pkce.js

@@ -0,0 +1,36 @@
+/**
+ * OAuth 2.0 + PKCE (RFC 7636) client-side generation (ADR-306).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/pkce.rs` (cognitum-one/meta-proxy,
+ * itself ported from `dashboard/apps/cli/src/pkce.rs`) so a verifier generated
+ * here validates against the same `services/identity` authorization server
+ * meta-proxy already talks to successfully — same byte lengths, same encoding,
+ * same hash. Intentionally duplicated rather than imported from
+ * `@claude-flow/mcp/src/oauth.ts` (a different, unrelated OAuth client in this
+ * monorepo) — ADR-306 assigns PKCE ownership to this package specifically.
+ *
+ * @module v3/security/oauth/pkce
+ */
+import { randomBytes, createHash } from 'crypto';
+/**
+ * 32 random bytes, base64url-encoded (no padding) — comfortably within RFC
+ * 7636's 43-128 character verifier length requirement (32 bytes -> 43 chars).
+ * Matches the Rust port's `random_url_safe_token(32)` exactly.
+ */
+function randomUrlSafeToken(byteLen) {
+    return randomBytes(byteLen).toString('base64url');
+}
+export function challengeFromVerifier(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Generates a fresh `state` + PKCE verifier/challenge pair for one login
+ * attempt.
+ */
+export function generate() {
+    const state = randomUrlSafeToken(32);
+    const codeVerifier = randomUrlSafeToken(32);
+    const codeChallenge = challengeFromVerifier(codeVerifier);
+    return { state, codeVerifier, codeChallenge };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAQjD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAChD,CAAC"}