@crewx/sdk 0.9.0-rc.82 → 0.9.0-rc.83

package/dist/account/auth-client.d.ts

@@ -0,0 +1,61 @@
+export declare const DEVICE_CODE_PATH: "/auth/v1/oauth/device/code";
+export declare const TOKEN_PATH: "/auth/v1/oauth/token";
+export declare const REVOKE_PATH: "/auth/v1/oauth/revoke";
+export declare const OAUTH_CLIENT_ID: "crewx-cli";
+export declare const DEVICE_CODE_GRANT_TYPE: "urn:ietf:params:oauth:grant-type:device_code";
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval?: number;
+}
+export type DeviceCodeResult = DeviceCodeResponse;
+export interface AccountIdentity {
+    sub: string;
+    email: string;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type?: string;
+    scope?: string;
+    account: AccountIdentity;
+}
+export type TokenResponse = OAuthTokenResponse;
+export type AuthTokenGrant = {
+    grant_type: typeof DEVICE_CODE_GRANT_TYPE;
+    device_code: string;
+} | {
+    grant_type: 'refresh_token';
+    refresh_token: string;
+};
+export interface AuthClientOptions {
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare class AuthClient {
+    private readonly configuredBaseUrl?;
+    private readonly fetchImpl?;
+    private readonly timeoutMs;
+    constructor(options?: AuthClientOptions | string);
+    private baseUrl;
+    private signal;
+    private request;
+    requestDeviceCode(): Promise<DeviceCodeResponse>;
+    requestToken(grant: AuthTokenGrant): Promise<OAuthTokenResponse>;
+    exchangeDeviceCode(deviceCode: string): Promise<OAuthTokenResponse>;
+    refreshToken(refreshToken: string): Promise<OAuthTokenResponse>;
+    deviceCode(): Promise<DeviceCodeResponse>;
+    getDeviceCode(): Promise<DeviceCodeResponse>;
+    token(grant: AuthTokenGrant): Promise<OAuthTokenResponse>;
+    getToken(grant: AuthTokenGrant): Promise<OAuthTokenResponse>;
+    refresh(refreshToken: string): Promise<OAuthTokenResponse>;
+    refreshAccessToken(refreshToken: string): Promise<OAuthTokenResponse>;
+    revokeToken(refreshToken: string): Promise<void>;
+    revoke(refreshToken: string): Promise<void>;
+}

package/dist/account/auth-json-v2.d.ts

@@ -0,0 +1 @@
+export * from './auth-json';

package/dist/account/auth-json.d.ts

@@ -0,0 +1,30 @@
+export declare const AUTH_JSON_FILENAME: "auth.json";
+export declare const AUTH_JSON_VERSION: 2;
+export interface AuthJsonV2 {
+    version: 2;
+    sub: string;
+    email: string;
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+    updated_at: string;
+}
+export type AuthJson = AuthJsonV2;
+export type AuthSession = AuthJsonV2;
+export declare function isAuthJsonV2(value: unknown): value is AuthJsonV2;
+export declare function validateAuthJson(value: unknown): AuthJsonV2;
+export declare function parseAuthJson(raw: string): AuthJsonV2;
+export declare function authJsonPath(filePath?: string): string;
+export declare class AuthJsonStore {
+    private readonly configuredPath?;
+    constructor(options?: {
+        filePath?: string;
+    } | string);
+    path(): string;
+    read(): AuthJsonV2 | null;
+    write(value: AuthJsonV2): void;
+    clear(): void;
+}
+export declare function readAuthJson(filePath?: string): AuthJsonV2;
+export declare function writeAuthJson(value: AuthJsonV2, filePath?: string): void;
+export declare function clearAuthJson(filePath?: string): void;

package/dist/account/config.d.ts

@@ -0,0 +1,8 @@
+export declare const ACCOUNT_BASE_URL_ENV: "CREWX_ACCOUNT_BASE_URL";
+export declare const ACCOUNT_ISSUER_ENV: "CREWX_ACCOUNT_ISSUER";
+export declare const MARKETPLACE_URL_ENV: "CREWX_MARKETPLACE_URL";
+export type Environment = Readonly<Record<string, string | undefined>>;
+export declare function resolveAccountBaseUrl(env?: Environment): string;
+export declare function resolveMarketplaceUrl(env?: Environment): string;
+export declare function resolveAccountIssuer(env?: Environment): string;
+export declare function appendEndpoint(baseUrl: string, endpoint: string): string;

package/dist/account/errors.d.ts

@@ -0,0 +1,24 @@
+export type AccountAuthErrorKind = 'configuration' | 'network' | 'server' | 'invalid_refresh' | 'pending' | 'denied' | 'expired' | 'http' | 'protocol';
+export declare class AccountAuthError extends Error {
+    readonly code: string;
+    readonly kind: AccountAuthErrorKind;
+    readonly status?: number;
+    constructor(code: string, kind: AccountAuthErrorKind, status?: number, message?: string);
+}
+export { AccountAuthError as AuthClientError, AccountAuthError as AuthError };
+export declare class LoginRequiredError extends Error {
+    readonly code: "LOGIN_REQUIRED";
+    constructor();
+}
+export declare class SessionManagerError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export type AuthJsonValidationCode = 'AUTH_JSON_LEGACY' | 'AUTH_JSON_INVALID';
+export declare class AuthJsonValidationError extends Error {
+    readonly code: AuthJsonValidationCode;
+    constructor(code: AuthJsonValidationCode, message?: string);
+}
+export declare class AccountConfigurationError extends AccountAuthError {
+    constructor(code: 'ACCOUNT_BASE_URL_MISSING' | 'ACCOUNT_BASE_URL_INVALID' | 'ACCOUNT_ISSUER_MISSING' | 'ACCOUNT_ISSUER_INVALID' | 'MARKETPLACE_URL_MISSING' | 'MARKETPLACE_URL_INVALID');
+}

package/dist/account/index.d.ts

@@ -0,0 +1,10 @@
+export { ACCOUNT_BASE_URL_ENV, ACCOUNT_ISSUER_ENV, MARKETPLACE_URL_ENV, appendEndpoint, resolveAccountBaseUrl, resolveAccountIssuer, resolveMarketplaceUrl, } from './config';
+export type { Environment } from './config';
+export { AccountAuthError, AuthClientError, AuthError, AccountConfigurationError, AuthJsonValidationError, LoginRequiredError, SessionManagerError, } from './errors';
+export type { AccountAuthErrorKind, AuthJsonValidationCode } from './errors';
+export { AUTH_JSON_FILENAME, AUTH_JSON_VERSION, AuthJsonStore, authJsonPath, clearAuthJson, isAuthJsonV2, parseAuthJson, readAuthJson, validateAuthJson, writeAuthJson, } from './auth-json';
+export type { AuthJson, AuthJsonV2, AuthSession } from './auth-json';
+export { AuthClient, DEVICE_CODE_GRANT_TYPE, DEVICE_CODE_PATH, OAUTH_CLIENT_ID, REVOKE_PATH, TOKEN_PATH, } from './auth-client';
+export type { AccountIdentity, AuthClientOptions, AuthTokenGrant, DeviceCodeResponse, DeviceCodeResult, OAuthTokenResponse, TokenResponse, } from './auth-client';
+export { SessionManager } from './session-manager';
+export type { AccountAuthClient, AuthJsonStorage, AuthSessionStore, SessionManagerOptions } from './session-manager';

package/dist/account/index.js

@@ -0,0 +1 @@
+'use strict';var crypto=require('crypto'),V=require('fs'),y=require('path'),R=require('os');function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var V__namespace=/*#__PURE__*/_interopNamespace(V);var y__namespace=/*#__PURE__*/_interopNamespace(y);var R__namespace=/*#__PURE__*/_interopNamespace(R);var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var p=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},d=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},u=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},c=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":"CREWX_MARKETPLACE_URL";super(e,"configuration",void 0,`${n} is missing or invalid \u2014 configure it and try again`),this.name="AccountConfigurationError";}};var x="CREWX_ACCOUNT_BASE_URL",b="CREWX_ACCOUNT_ISSUER",L="CREWX_MARKETPLACE_URL";function P(t,e,n,r=false){let o=t?.trim();if(!o)throw new c(e);try{let i=new URL(o);if(i.protocol!=="http:"&&i.protocol!=="https:"||i.username.length>0||i.password.length>0||i.hostname.length===0||i.search.length>0||i.hash.length>0||r&&i.pathname!=="/")throw new Error("invalid URL")}catch{throw new c(n)}return o.replace(/\/+$/,"")}function T(t=process.env){return P(t[x],"ACCOUNT_BASE_URL_MISSING","ACCOUNT_BASE_URL_INVALID",true)}function F(t=process.env){return P(t[L],"MARKETPLACE_URL_MISSING","MARKETPLACE_URL_INVALID")}function k(t=process.env){let e=t[b]?.trim();if(!e)throw new c("ACCOUNT_ISSUER_MISSING");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new c("ACCOUNT_ISSUER_INVALID")}return e}function C(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function D(){if(process.env.CREWX_HOME)try{return V__namespace.realpathSync(process.env.CREWX_HOME)}catch{return y__namespace.join(R__namespace.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?y__namespace.join(process.env.XDG_CONFIG_HOME,"crewx"):y__namespace.join(R__namespace.homedir(),".crewx")}var G="auth.json",N=2,H=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new u("AUTH_JSON_INVALID",t)}function re(){throw new u("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function oe(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function se(t){try{return A(t),!0}catch{return  false}}function A(t){if(!oe(t))return h();if(t.version===1)return re();if(t.version!==N)return h();let e=Object.keys(t);if(e.length!==H.length||e.some(r=>!H.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:N,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function B(t){let e;try{e=JSON.parse(t);}catch{return h()}return A(e)}function K(t){return t??y.join(D(),G)}var f=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return K(this.configuredPath)}read(){let e=this.path();if(!V.existsSync(e))return null;try{return B(V.readFileSync(e,"utf8"))}catch(n){throw n instanceof u?n:new u("AUTH_JSON_INVALID")}}write(e){let n=A(e),r=this.path(),o=y.dirname(r);V.mkdirSync(o,{recursive:true,mode:448});let i=`${r}.tmp.${process.pid}.${crypto.randomUUID()}`;try{V.writeFileSync(i,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),V.chmodSync(i,384),V.renameSync(i,r),V.chmodSync(r,384);}catch{try{V.existsSync(i)&&V.unlinkSync(i);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{V.existsSync(e)&&V.unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ie(t){let e=new f({filePath:t}).read();if(!e)throw new p;return e}function ce(t,e){new f({filePath:e}).write(t);}function ae(t){new f({filePath:t}).clear();}var j="/auth/v1/oauth/device/code",W="/auth/v1/oauth/token",X="/auth/v1/oauth/revoke",w="crewx-cli",g="urn:ietf:params:oauth:grant-type:device_code";function a(t){return typeof t=="string"&&t.trim().length>0}function m(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function ue(t){let e=m(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=m(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function he(t){let e=m(t);if(!e||!a(e.device_code)||!a(e.user_code)||!a(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!a(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function pe(t){let e=m(t),n=m(e?.account),r=e?.expires_in;if(!e||!a(e.access_token)||!a(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!a(n.sub)||!a(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var S=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:de(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:T()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let i=C(this.baseUrl(),e),U=this.fetchImpl??globalThis.fetch;if(typeof U!="function")throw new s("AUTH_NETWORK_ERROR","network");let l;try{l=await U(i,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!l.ok)throw q(l.status,null,r);return}let E=null;try{E=await l.json();}catch{E=null;}if(!l.ok)throw q(l.status,E,r);return E}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",w);let n=await this.request(j,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return he(n)}async requestToken(e){fe(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",w),e.grant_type===g?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(W,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return pe(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:g,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!a(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",w),await this.request(X,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function de(t){if(typeof t!="string"||!t.trim())throw new c("ACCOUNT_BASE_URL_MISSING");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new c("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function fe(t){if(!t||t.grant_type!==g&&t.grant_type!=="refresh_token"||t.grant_type===g&&!a(t.device_code)||t.grant_type==="refresh_token"&&!a(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function q(t,e,n){let r=ue(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===g){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var O=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=le(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new S,this.store=o.store??o.storage??n??new f,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=A(e);return $(n.access_token,n.sub),n}catch(e){throw e instanceof u?new p:e}}requireSession(){let e=this.readSession();if(!e)throw new p;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw Ae(n)?(this.store.clear(),new p):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new d("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new d("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");$(e.access_token,r.sub);let o=A({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function Ae(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function le(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function $(t,e){let n=k(),r=_e(t);if(r.iss!==n)throw new d("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new d("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function _e(t){if(typeof t!="string")throw v();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw v();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw v()}}function v(){return new d("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}exports.ACCOUNT_BASE_URL_ENV=x;exports.ACCOUNT_ISSUER_ENV=b;exports.AUTH_JSON_FILENAME=G;exports.AUTH_JSON_VERSION=N;exports.AccountAuthError=s;exports.AccountConfigurationError=c;exports.AuthClient=S;exports.AuthClientError=s;exports.AuthError=s;exports.AuthJsonStore=f;exports.AuthJsonValidationError=u;exports.DEVICE_CODE_GRANT_TYPE=g;exports.DEVICE_CODE_PATH=j;exports.LoginRequiredError=p;exports.MARKETPLACE_URL_ENV=L;exports.OAUTH_CLIENT_ID=w;exports.REVOKE_PATH=X;exports.SessionManager=O;exports.SessionManagerError=d;exports.TOKEN_PATH=W;exports.appendEndpoint=C;exports.authJsonPath=K;exports.clearAuthJson=ae;exports.isAuthJsonV2=se;exports.parseAuthJson=B;exports.readAuthJson=ie;exports.resolveAccountBaseUrl=T;exports.resolveAccountIssuer=k;exports.resolveMarketplaceUrl=F;exports.validateAuthJson=A;exports.writeAuthJson=ce;

package/dist/account/session-manager.d.ts

@@ -0,0 +1,47 @@
+import { type OAuthTokenResponse } from './auth-client';
+import { type AuthJsonV2 } from './auth-json';
+export interface AuthSessionStore {
+    read(): AuthJsonV2 | null;
+    write(value: AuthJsonV2): void;
+    clear(): void;
+}
+export interface AccountAuthClient {
+    exchangeDeviceCode(deviceCode: string): Promise<OAuthTokenResponse>;
+    refreshToken(refreshToken: string): Promise<OAuthTokenResponse>;
+}
+export interface SessionManagerOptions {
+    client?: AccountAuthClient;
+    authClient?: AccountAuthClient;
+    store?: AuthSessionStore;
+    storage?: AuthSessionStore;
+    refreshSkewSeconds?: number;
+    now?: () => number;
+    nowSeconds?: () => number;
+}
+export type AuthJsonStorage = AuthSessionStore;
+export declare class SessionManager {
+    private readonly client;
+    private readonly store;
+    private readonly refreshSkewSeconds;
+    private readonly now;
+    private readonly nowSecondsOverride?;
+    private refreshPromise;
+    constructor(options?: SessionManagerOptions | AccountAuthClient, store?: AuthSessionStore);
+    getSession(): AuthJsonV2 | null;
+    isLoggedIn(): boolean;
+    getAccessToken(): Promise<string>;
+    getValidAccessToken(): Promise<string>;
+    getToken(): Promise<string>;
+    refresh(): Promise<AuthJsonV2>;
+    loginWithDeviceCode(deviceCode: string): Promise<AuthJsonV2>;
+    login(deviceCode: string): Promise<AuthJsonV2>;
+    setSession(token: OAuthTokenResponse): Promise<AuthJsonV2>;
+    clear(): void;
+    withAccessToken<T>(callback: (accessToken: string) => Promise<T>): Promise<T>;
+    private readSession;
+    private requireSession;
+    private epochSeconds;
+    private refreshSession;
+    private performRefresh;
+    private persistTokenResponse;
+}

package/dist/config/models.generated.d.ts

@@ -1,8 +1,8 @@
 import type { ModelApiPricing } from './pricing.types.js';
 export declare const MODEL_TIERS: readonly ["flagship", "balanced", "speed"];
 export type ModelTier = (typeof MODEL_TIERS)[number];
-export declare const MODEL_CATALOG_VERSION = 20;
-export declare const MODEL_CATALOG_UPDATED = "2026-08-19T00:00:00Z";
+export declare const MODEL_CATALOG_VERSION = 21;
+export declare const MODEL_CATALOG_UPDATED = "2026-09-02T00:00:00Z";
 export interface ModelCatalogEntry {
     id: string;
     name: string;

package/dist/config/pricing.generated.d.ts

@@ -1,6 +1,6 @@
 import type { ModelPricing } from './pricing.types.js';
 export declare const MODEL_PRICING: Record<string, ModelPricing>;
-export declare const MODEL_PRICING_VERSION = 20;
-export declare const MODEL_PRICING_UPDATED = "2026-08-19T00:00:00Z";
+export declare const MODEL_PRICING_VERSION = 21;
+export declare const MODEL_PRICING_UPDATED = "2026-09-02T00:00:00Z";
 export declare const UNPUBLISHED_MODEL_IDS: ReadonlySet<string>;
 export declare const CATALOG_MODEL_IDS: ReadonlySet<string>;

package/dist/esm/account/index.js

@@ -0,0 +1 @@
+import {randomUUID}from'crypto';import*as D from'fs';import {existsSync,readFileSync,mkdirSync,writeFileSync,chmodSync,renameSync,unlinkSync}from'fs';import*as w from'path';import {join,dirname}from'path';import*as I from'os';var s=class extends Error{code;kind;status;constructor(e,n,r,o){super(o??`Account authentication request failed (${e})`),this.name="AccountAuthError",this.code=e,this.kind=n,this.status=r;}};var p=class extends Error{code="LOGIN_REQUIRED";constructor(){super("Login required \u2014 please log in again"),this.name="LoginRequiredError";}},d=class extends Error{code;constructor(e,n){super(n),this.name="SessionManagerError",this.code=e;}},u=class extends Error{code;constructor(e,n="auth.json is invalid \u2014 please log in again"){super(n),this.name="AuthJsonValidationError",this.code=e;}},c=class extends s{constructor(e){let n=e.startsWith("ACCOUNT_BASE_URL")?"CREWX_ACCOUNT_BASE_URL":e.startsWith("ACCOUNT_ISSUER")?"CREWX_ACCOUNT_ISSUER":"CREWX_MARKETPLACE_URL";super(e,"configuration",void 0,`${n} is missing or invalid \u2014 configure it and try again`),this.name="AccountConfigurationError";}};var b="CREWX_ACCOUNT_BASE_URL",L="CREWX_ACCOUNT_ISSUER",P="CREWX_MARKETPLACE_URL";function V(t,e,n,r=false){let o=t?.trim();if(!o)throw new c(e);try{let i=new URL(o);if(i.protocol!=="http:"&&i.protocol!=="https:"||i.username.length>0||i.password.length>0||i.hostname.length===0||i.search.length>0||i.hash.length>0||r&&i.pathname!=="/")throw new Error("invalid URL")}catch{throw new c(n)}return o.replace(/\/+$/,"")}function k(t=process.env){return V(t[b],"ACCOUNT_BASE_URL_MISSING","ACCOUNT_BASE_URL_INVALID",true)}function Y(t=process.env){return V(t[P],"MARKETPLACE_URL_MISSING","MARKETPLACE_URL_INVALID")}function C(t=process.env){let e=t[L]?.trim();if(!e)throw new c("ACCOUNT_ISSUER_MISSING");try{let n=new URL(e);if(n.protocol!=="http:"&&n.protocol!=="https:"||n.username.length>0||n.password.length>0||n.hostname.length===0||n.search.length>0||n.hash.length>0)throw new Error("invalid issuer")}catch{throw new c("ACCOUNT_ISSUER_INVALID")}return e}function R(t,e){return `${t.replace(/\/+$/,"")}/${e.replace(/^\/+/,"")}`}function J(){if(process.env.CREWX_HOME)try{return D.realpathSync(process.env.CREWX_HOME)}catch{return w.join(I.homedir(),".crewx")}return process.platform!=="win32"&&process.env.XDG_CONFIG_HOME?w.join(process.env.XDG_CONFIG_HOME,"crewx"):w.join(I.homedir(),".crewx")}var B="auth.json",v=2,G=["version","sub","email","access_token","refresh_token","expires_at","updated_at"];function h(t="auth.json is invalid \u2014 please log in again"){throw new u("AUTH_JSON_INVALID",t)}function oe(){throw new u("AUTH_JSON_LEGACY","auth.json uses an unsupported legacy format \u2014 please log in again")}function se(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function ie(t){try{return A(t),!0}catch{return  false}}function A(t){if(!se(t))return h();if(t.version===1)return oe();if(t.version!==v)return h();let e=Object.keys(t);if(e.length!==G.length||e.some(r=>!G.includes(r))||typeof t.sub!="string"||t.sub.length===0||typeof t.email!="string"||t.email.length===0||typeof t.access_token!="string"||t.access_token.length===0||typeof t.refresh_token!="string"||t.refresh_token.length===0)return h();let n=t.expires_at;return typeof n!="number"||!Number.isSafeInteger(n)||n<0||typeof t.updated_at!="string"||t.updated_at.length===0||Number.isNaN(Date.parse(t.updated_at))?h():{version:v,sub:t.sub,email:t.email,access_token:t.access_token,refresh_token:t.refresh_token,expires_at:n,updated_at:t.updated_at}}function K(t){let e;try{e=JSON.parse(t);}catch{return h()}return A(e)}function q(t){return t??join(J(),B)}var f=class{configuredPath;constructor(e={}){this.configuredPath=typeof e=="string"?e:e.filePath;}path(){return q(this.configuredPath)}read(){let e=this.path();if(!existsSync(e))return null;try{return K(readFileSync(e,"utf8"))}catch(n){throw n instanceof u?n:new u("AUTH_JSON_INVALID")}}write(e){let n=A(e),r=this.path(),o=dirname(r);mkdirSync(o,{recursive:true,mode:448});let i=`${r}.tmp.${process.pid}.${randomUUID()}`;try{writeFileSync(i,JSON.stringify(n,null,2),{encoding:"utf8",mode:384}),chmodSync(i,384),renameSync(i,r),chmodSync(r,384);}catch{try{existsSync(i)&&unlinkSync(i);}catch{}throw new Error("Could not persist auth.json securely")}}clear(){let e=this.path();try{existsSync(e)&&unlinkSync(e);}catch{throw new Error("Could not clear auth.json")}}};function ce(t){let e=new f({filePath:t}).read();if(!e)throw new p;return e}function ae(t,e){new f({filePath:e}).write(t);}function ue(t){new f({filePath:t}).clear();}var W="/auth/v1/oauth/device/code",X="/auth/v1/oauth/token",$="/auth/v1/oauth/revoke",T="crewx-cli",m="urn:ietf:params:oauth:grant-type:device_code";function a(t){return typeof t=="string"&&t.trim().length>0}function S(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)?t:null}function he(t){let e=S(t),n=e?.error??e?.code;if(typeof n=="string")return n.toLowerCase();let r=S(n),o=r?.code??r?.error;return typeof o=="string"?o.toLowerCase():void 0}function pe(t){let e=S(t);if(!e||!a(e.device_code)||!a(e.user_code)||!a(e.verification_uri))throw new s("AUTH_RESPONSE_INVALID","protocol");let n=e.expires_in,r=e.interval;if(typeof n!="number"||!Number.isSafeInteger(n)||n<=0)throw new s("AUTH_RESPONSE_INVALID","protocol");if(e.verification_uri_complete!==void 0&&!a(e.verification_uri_complete))throw new s("AUTH_RESPONSE_INVALID","protocol");if(r!==void 0&&(typeof r!="number"||!Number.isSafeInteger(r)||r<0))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={device_code:e.device_code,user_code:e.user_code,verification_uri:e.verification_uri,expires_in:n};return e.verification_uri_complete!==void 0&&(o.verification_uri_complete=e.verification_uri_complete),r!==void 0&&(o.interval=r),o}function de(t){let e=S(t),n=S(e?.account),r=e?.expires_in;if(!e||!a(e.access_token)||!a(e.refresh_token)||typeof r!="number"||!Number.isSafeInteger(r)||r<=0||!n||!a(n.sub)||!a(n.email))throw new s("AUTH_RESPONSE_INVALID","protocol");let o={access_token:e.access_token,refresh_token:e.refresh_token,expires_in:r,account:{sub:n.sub,email:n.email}};return typeof e.token_type=="string"&&e.token_type.length>0&&(o.token_type=e.token_type),typeof e.scope=="string"&&e.scope.length>0&&(o.scope=e.scope),o}var E=class{configuredBaseUrl;fetchImpl;timeoutMs;constructor(e={}){let n=typeof e=="string"?{baseUrl:e}:e;this.configuredBaseUrl=n.baseUrl===void 0?void 0:fe(n.baseUrl),this.fetchImpl=n.fetch??n.fetchImpl,this.timeoutMs=n.timeoutMs??1e4;}baseUrl(){return this.configuredBaseUrl!==void 0?this.configuredBaseUrl:k()}signal(e){if(!(e<=0||typeof AbortSignal>"u"||typeof AbortSignal.timeout!="function"))return AbortSignal.timeout(e)}async request(e,n,r,o={}){let i=R(this.baseUrl(),e),x=this.fetchImpl??globalThis.fetch;if(typeof x!="function")throw new s("AUTH_NETWORK_ERROR","network");let l;try{l=await x(i,{...n,signal:n.signal??this.signal(o.timeoutMs??this.timeoutMs)});}catch{throw new s("AUTH_NETWORK_ERROR","network")}if(o.parseBody===false){if(!l.ok)throw j(l.status,null,r);return}let y=null;try{y=await l.json();}catch{y=null;}if(!l.ok)throw j(l.status,y,r);return y}async requestDeviceCode(){let e=new URLSearchParams;e.set("client_id",T);let n=await this.request(W,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e.toString()});return pe(n)}async requestToken(e){Ae(e);let n=new URLSearchParams;n.set("grant_type",e.grant_type),n.set("client_id",T),e.grant_type===m?n.set("device_code",e.device_code):n.set("refresh_token",e.refresh_token);let r=await this.request(X,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},e);return de(r)}async exchangeDeviceCode(e){return this.requestToken({grant_type:m,device_code:e})}async refreshToken(e){return this.requestToken({grant_type:"refresh_token",refresh_token:e})}async deviceCode(){return this.requestDeviceCode()}async getDeviceCode(){return this.requestDeviceCode()}async token(e){return this.requestToken(e)}async getToken(e){return this.requestToken(e)}async refresh(e){return this.refreshToken(e)}async refreshAccessToken(e){return this.refreshToken(e)}async revokeToken(e){if(!a(e))throw new s("AUTH_INPUT_INVALID","protocol");let n=new URLSearchParams;n.set("token",e),n.set("token_type_hint","refresh_token"),n.set("client_id",T),await this.request($,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()},void 0,{parseBody:false,timeoutMs:3e3});}async revoke(e){return this.revokeToken(e)}};function fe(t){if(typeof t!="string"||!t.trim())throw new c("ACCOUNT_BASE_URL_MISSING");try{let e=new URL(t.trim());if(e.protocol!=="http:"&&e.protocol!=="https:"||e.username.length>0||e.password.length>0||e.hostname.length===0||e.pathname!=="/"||e.search.length>0||e.hash.length>0)throw new Error("invalid URL")}catch{throw new c("ACCOUNT_BASE_URL_INVALID")}return t.trim().replace(/\/+$/,"")}function Ae(t){if(!t||t.grant_type!==m&&t.grant_type!=="refresh_token"||t.grant_type===m&&!a(t.device_code)||t.grant_type==="refresh_token"&&!a(t.refresh_token))throw new s("AUTH_INPUT_INVALID","protocol")}function j(t,e,n){let r=he(e);if(t>=500)return new s("AUTH_SERVER_ERROR","server",t);if(n?.grant_type==="refresh_token"&&(r==="invalid_grant"||t===401))return new s("INVALID_REFRESH_TOKEN","invalid_refresh",t);if(n?.grant_type===m){if(r==="authorization_pending")return new s("AUTHORIZATION_PENDING","pending",t);if(r==="slow_down")return new s("SLOW_DOWN","pending",t);if(r==="access_denied")return new s("ACCESS_DENIED","denied",t);if(r==="expired_token")return new s("EXPIRED_TOKEN","expired",t)}return new s("AUTH_HTTP_ERROR","http",t)}var U=class{client;store;refreshSkewSeconds;now;nowSecondsOverride;refreshPromise=null;constructor(e={},n){let r=_e(e)?e:void 0,o=r?{}:e;this.client=r??o.client??o.authClient??new E,this.store=o.store??o.storage??n??new f,this.refreshSkewSeconds=o.refreshSkewSeconds??60,this.now=o.now??(()=>Date.now()),this.nowSecondsOverride=o.nowSeconds;}getSession(){return this.readSession()}isLoggedIn(){return this.readSession()!==null}async getAccessToken(){let e=this.requireSession();return e.expires_at>this.epochSeconds()+this.refreshSkewSeconds?e.access_token:(await this.refreshSession(e)).access_token}async getValidAccessToken(){return this.getAccessToken()}async getToken(){return this.getAccessToken()}async refresh(){return this.refreshSession(this.requireSession())}async loginWithDeviceCode(e){let n=await this.client.exchangeDeviceCode(e);return this.persistTokenResponse(n)}async login(e){return this.loginWithDeviceCode(e)}async setSession(e){return this.persistTokenResponse(e)}clear(){this.store.clear();}async withAccessToken(e){return e(await this.getAccessToken())}readSession(){try{let e=this.store.read();if(e===null)return null;let n=A(e);return F(n.access_token,n.sub),n}catch(e){throw e instanceof u?new p:e}}requireSession(){let e=this.readSession();if(!e)throw new p;return e}epochSeconds(){return this.nowSecondsOverride?.()??Math.floor(this.now()/1e3)}refreshSession(e){if(this.refreshPromise)return this.refreshPromise;let n;return n=this.performRefresh(e).finally(()=>{this.refreshPromise===n&&(this.refreshPromise=null);}),this.refreshPromise=n,n}async performRefresh(e){try{let n=await this.client.refreshToken(e.refresh_token);return this.persistTokenResponse(n,e.sub)}catch(n){throw le(n)?(this.store.clear(),new p):n}}persistTokenResponse(e,n){let r=e?.account;if(!e||typeof e.access_token!="string"||e.access_token.length===0||typeof e.refresh_token!="string"||e.refresh_token.length===0||!Number.isSafeInteger(e.expires_in)||e.expires_in<=0||!r||typeof r.sub!="string"||r.sub.length===0||typeof r.email!="string"||r.email.length===0)throw new d("AUTH_RESPONSE_INVALID","Account token response is malformed");if(n!==void 0&&r.sub!==n)throw new d("ACCOUNT_SUB_MISMATCH","Account subject changed during token refresh \u2014 please log in again");F(e.access_token,r.sub);let o=A({version:2,sub:r.sub,email:r.email,access_token:e.access_token,refresh_token:e.refresh_token,expires_at:this.epochSeconds()+e.expires_in,updated_at:new Date(this.now()).toISOString()});return this.store.write(o),o}};function le(t){return t instanceof s?t.kind==="invalid_refresh":typeof t=="object"&&t!==null&&(t.kind==="invalid_refresh"||t.code==="INVALID_REFRESH_TOKEN")}function _e(t){return typeof t.exchangeDeviceCode=="function"&&typeof t.refreshToken=="function"}function F(t,e){let n=C(),r=ge(t);if(r.iss!==n)throw new d("ACCOUNT_ISSUER_MISMATCH","Access token issuer does not match the configured account issuer \u2014 please log in again");if(r.sub!==e)throw new d("ACCOUNT_SUB_MISMATCH","Access token subject does not match the account session \u2014 please log in again")}function ge(t){if(typeof t!="string")throw O();let e=t.split(".");if(e.length!==3||e.some(n=>!/^[A-Za-z0-9_-]+$/.test(n)))throw O();try{let n=JSON.parse(Buffer.from(e[1],"base64url").toString("utf8"));if(typeof n!="object"||n===null||Array.isArray(n)||typeof n.iss!="string"||n.iss.length===0||typeof n.sub!="string"||n.sub.length===0)throw new Error("missing identity claims");return {iss:n.iss,sub:n.sub}}catch{throw O()}}function O(){return new d("ACCESS_TOKEN_INVALID","Access token identity could not be verified \u2014 please log in again")}export{b as ACCOUNT_BASE_URL_ENV,L as ACCOUNT_ISSUER_ENV,B as AUTH_JSON_FILENAME,v as AUTH_JSON_VERSION,s as AccountAuthError,c as AccountConfigurationError,E as AuthClient,s as AuthClientError,s as AuthError,f as AuthJsonStore,u as AuthJsonValidationError,m as DEVICE_CODE_GRANT_TYPE,W as DEVICE_CODE_PATH,p as LoginRequiredError,P as MARKETPLACE_URL_ENV,T as OAUTH_CLIENT_ID,$ as REVOKE_PATH,U as SessionManager,d as SessionManagerError,X as TOKEN_PATH,R as appendEndpoint,q as authJsonPath,ue as clearAuthJson,ie as isAuthJsonV2,K as parseAuthJson,ce as readAuthJson,k as resolveAccountBaseUrl,C as resolveAccountIssuer,Y as resolveMarketplaceUrl,A as validateAuthJson,ae as writeAuthJson};