@cortexkit/opencode-anthropic-auth 1.23.0 → 2.0.1

package/dist/cli-failure.d.ts

@@ -0,0 +1,69 @@
+import { type ProviderErrorRedactor } from '@cortexkit/anthropic-auth-core';
+declare const STAGE_LABELS: {
+    readonly 'setup-activation': 'Vault custody setup';
+    readonly 'setup-opencode-config': 'OpenCode configuration';
+    readonly 'setup-pi-install': 'Pi extension installation';
+    readonly 'setup-pi': 'Pi setup';
+    readonly 'setup-process-check': 'Host process check';
+    readonly 'cli-setup': 'Setup';
+    readonly 'cli-login': 'Login';
+    readonly 'cli-api-add': 'API route setup';
+    readonly 'cli-list': 'Account listing';
+    readonly 'cli-relay-setup': 'Relay setup';
+    readonly 'cli-relay-workers-dev': 'Workers.dev enablement';
+    readonly 'cli-command': 'Command';
+};
+export type CliFailureStage = keyof typeof STAGE_LABELS;
+/** UTF-8 bytes of redacted detail kept per diagnostics file. */
+export declare const CLI_FAILURE_DETAIL_MAX_BYTES: number;
+export declare const CLI_FAILURE_OMITTED = "[output beyond the diagnostic limit omitted]";
+export declare const CLI_FAILURE_WITHHELD = "[output withheld: no line break within the inspected window]";
+export declare const CLI_FAILURE_SECRETS_UNREADABLE = "[detail withheld: the known credentials could not be read safely]";
+/**
+ * The text to show for a known failure, or undefined when the thrown value is
+ * not one. A message counts only when it equals a text in CLOSED_MESSAGES,
+ * equals "OAuth metadata read failed: <status>" for its own integer HTTP
+ * `status`, or equals what `new ProcessFenceViolationError(activeHosts)`
+ * produces from its own validated `activeHosts`.
+ */
+export declare function knownFailureMessage(error: unknown): string | undefined;
+/**
+ * Exact credentials a failing command may echo: the strings in `submitted`
+ * (the API key, OAuth code and tokens, or Cloudflare and relay tokens the CLI
+ * command handled) plus every environment value whose name Core's
+ * `isSecretKey` treats as secret (for example `*_TOKEN`, `*_API_KEY`,
+ * `*_SECRET`), since child processes receive that environment. Empty values are
+ * skipped; every other value counts, however short. Returns undefined when
+ * either input is a proxy, has accessors or non-string credentials, or is too
+ * large to inspect, so the caller can withhold detail instead of logging it
+ * with a credential left out.
+ */
+export declare function collectKnownSecrets(env: unknown, submitted?: unknown): string[] | undefined;
+/**
+ * Redact first, bound second. Raw text is only ever cut at a line break and
+ * the partial line is dropped, so a credential is never split before the
+ * redactor sees it whole. The redacted lines are then kept up to the byte
+ * limit; cutting already-redacted text cannot reveal anything new.
+ */
+export declare function boundRedactedDetail(text: string, redactor: Pick<ProviderErrorRedactor, 'redactText'>, keep: 'head' | 'tail'): string[];
+/**
+ * Private per-user directory for failure details:
+ * `$XDG_STATE_HOME/cortexkit/anthropic-auth/diagnostics`, falling back to
+ * `~/.local/state`, which also holds host enrollment files. Undefined when
+ * reading the environment would invoke caller code.
+ */
+export declare function cliDiagnosticsDirectory(env: unknown): string | undefined;
+/**
+ * Screen text for a thrown failure. A known failure is returned word for word
+ * and not recorded; anything else is recorded in a private diagnostics file
+ * and replaced by a fixed line naming that file. `env` supplies both the
+ * secret-named values to scrub and the diagnostics location; `submitted`
+ * holds the credentials the failing command handled.
+ */
+export declare function reportThrownFailure(stage: CliFailureStage, error: unknown, env: unknown, submitted?: unknown): Promise<string>;
+/** Screen text for a child process that exited unsuccessfully; its stderr tail goes to the diagnostics file. */
+export declare function reportInstallerFailure(stage: CliFailureStage, result: {
+    exitCode: number;
+    stderr: string;
+}, env: unknown): Promise<string>;
+export {};

package/dist/cli.d.ts

@@ -15,29 +15,34 @@ type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<
 export interface RelaySetupDeps {
     fetchImpl?: FetchLike;
     prompt?: (message: string) => Promise<string>;
+    /** Receives each credential this command handles, for redacting failure detail. */
+    secrets?: string[];
+    /** Prints a non-fatal warning; defaults to console.warn. */
+    warn?: (message: string) => void;
 }
 export declare function relaySetup(deps?: RelaySetupDeps): Promise<void>;
 /**
- * Dependencies the `login` command talks to the outside world through. All
- * default to the real implementations (the readline-backed prompt, and the
- * core authorize/exchange helpers) so the production `login` path is
- * unchanged; tests inject deterministic stubs to exercise the full login flow
- * in-process without a subprocess, real network, or stdin.
+ * Tests can supply prompts and OAuth responses without opening a browser.
+ * Login stores exchanged tokens in the shared account pool after validating
+ * the account identity. It never writes OpenCode's auth.json or old sidecars.
  */
 export interface LoginDeps {
     prompt?: (message: string) => Promise<string>;
     authorize?: typeof authorize;
     exchange?: typeof exchange;
+    /** Receives each credential this command handles, for redacting failure detail. */
+    secrets?: string[];
 }
 export declare function login(labelArg?: string, deps?: LoginDeps): Promise<void>;
 /**
- * Dependencies the `api add` command talks to the outside world through. The
- * prompt defaults to the real readline-backed prompt so the production
- * `api add` path is unchanged; tests inject canned answers to exercise the
- * full route-add flow in-process without a subprocess or stdin.
+ * Tests can supply prompts to check API keys and proxy route settings.
+ * New keys go to the shared account pool after migration has committed;
+ * OpenCode's auth.json and the old sidecar files remain unchanged.
  */
 export interface ApiAddDeps {
     prompt?: (message: string) => Promise<string>;
+    /** Receives each credential this command handles, for redacting failure detail. */
+    secrets?: string[];
 }
 export declare function addApiRoute(labelArg?: string, deps?: ApiAddDeps): Promise<void>;
 import { runSetupCommand } from './setup/command.ts';