@devdogsuga/devtools 0.1.26 → 0.1.28

package/dist/oauth/db.js

@@ -1,108 +0,0 @@
-import { createClient } from "@supabase/supabase-js";
-import { execFileSync } from "node:child_process";
-import { parse } from "dotenv";
-import { PROVIDER_SCOPES } from "./config.js";
-function runStatus(argv, cwd) {
-    return execFileSync(argv[0], argv.slice(1), {
-        cwd,
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-    });
-}
-/**
- * Runs `supabase status -o env` in `cwd` and extracts the local API URL and
- * service role key. Throws a descriptive error if Supabase isn't running or
- * the CLI isn't installed.
- *
- * Two invocations are tried, because this wizard runs in two different worlds:
- * a sibling project, where the Supabase CLI is normally installed globally, and
- * this monorepo, where it is a workspace devDependency and not on PATH at all.
- * A global install wins, since `pnpm exec` in a non-pnpm project would fail for
- * reasons that have nothing to do with Supabase.
- */
-export function detectLocalSupabase(cwd) {
-    let output;
-    try {
-        output = runStatus(["supabase", "status", "-o", "env"], cwd);
-    }
-    catch (first) {
-        try {
-            output = runStatus(["pnpm", "exec", "supabase", "status", "-o", "env"], cwd);
-        }
-        catch {
-            // The first failure is the one worth reporting: it is the one that says
-            // "not installed" rather than "pnpm could not find a workspace".
-            if (first.code === "ENOENT") {
-                throw new Error("supabase CLI not found — install it from https://supabase.com/docs/guides/cli");
-            }
-            const stderr = (first.stderr ?? "").trim();
-            throw new Error(stderr || (first instanceof Error ? first.message : String(first)));
-        }
-    }
-    const env = parse(output);
-    const apiUrl = env["API_URL"];
-    const serviceRoleKey = env["SERVICE_ROLE_KEY"];
-    if (!apiUrl || !serviceRoleKey) {
-        throw new Error("Could not find API_URL or SERVICE_ROLE_KEY in `supabase status` output");
-    }
-    return { apiUrl, serviceRoleKey };
-}
-/**
- * Looks up a custom auth provider on a local Supabase instance through the
- * Admin SDK, and reports whether it exists along with its name and issuer.
- *
- * A 404 means it does not exist yet. Any other error is real and rethrown.
- */
-export async function checkProvider({ apiUrl, serviceRoleKey }, identifier) {
-    const supabase = createClient(apiUrl, serviceRoleKey, {
-        auth: { autoRefreshToken: false, persistSession: false },
-    });
-    const { data, error } = await supabase.auth.admin.customProviders.getProvider(identifier);
-    if (error && error.status !== 404)
-        throw error;
-    return {
-        exists: !!data,
-        name: data?.name ?? undefined,
-        issuer: data?.issuer ?? undefined,
-    };
-}
-export async function upsertDevDogsProvider({ apiUrl, serviceRoleKey }, { identifier, name, clientId, clientSecret, issuer, }) {
-    const supabase = createClient(apiUrl, serviceRoleKey, {
-        auth: { autoRefreshToken: false, persistSession: false },
-    });
-    const { data: existing, error: getError } = await supabase.auth.admin.customProviders.getProvider(identifier);
-    // 404 just means the provider doesn't exist yet. Any other error is real.
-    if (getError && getError.status !== 404) {
-        throw getError;
-    }
-    if (existing) {
-        const { data, error } = await supabase.auth.admin.customProviders.updateProvider(identifier, {
-            name,
-            client_id: clientId,
-            client_secret: clientSecret,
-            issuer,
-            scopes: PROVIDER_SCOPES,
-            enabled: true,
-        });
-        if (error)
-            throw error;
-        if (!data)
-            throw new Error("updateProvider returned no data");
-        return { identifier: data.identifier, issuer: data.issuer ?? issuer };
-    }
-    const { data, error } = await supabase.auth.admin.customProviders.createProvider({
-        provider_type: "oidc",
-        identifier,
-        name,
-        client_id: clientId,
-        client_secret: clientSecret,
-        issuer,
-        scopes: PROVIDER_SCOPES,
-        enabled: true,
-    });
-    if (error)
-        throw error;
-    if (!data)
-        throw new Error("createProvider returned no data");
-    return { identifier: data.identifier, issuer: data.issuer ?? issuer };
-}

package/dist/oauth/device.d.ts

@@ -1,93 +0,0 @@
-/**
- * The device-code fallback for the one-click connect flow (TASK-352): for a
- * contributor whose terminal cannot open a browser tab that can complete a
- * loopback redirect back to THIS machine — SSH, a Codespace, a dev container,
- * or any environment where the loopback listener itself fails to start (see
- * `transport.ts`) — this trades a short user code, approved in a browser
- * running anywhere, for the same OAuth client credentials `exchange.ts`
- * hands back. The server side of this (TASK-352) lives in the DevDogsUGA
- * repo, at `apps/platform/src/app/(site)/tools/oauth/device/` — this is the
- * fixed wire contract the two sides agreed on:
- *
- *   POST <platform>/tools/oauth/device/code
- *   { "label", "callback_uri" }
- *
- *   200 { "device_code", "user_code", "verification_uri",
- *         "verification_uri_complete", "expires_in", "interval" }
- *   400 { "error": "invalid_request", "error_description" }
- *   429 { "error": "rate_limited" }  (+ Retry-After header)
- *
- *   POST <platform>/tools/oauth/device/token
- *   { "device_code" }
- *
- *   200 { "client_id", "client_secret", "issuer" }
- *   400 { "error": "authorization_pending" | "slow_down" | "access_denied" |
- *                   "expired_token" | "invalid_grant" | "invalid_request",
- *         "error_description" }
- *   429 { "error": "rate_limited" }  (+ Retry-After header)
- *
- * `requestDeviceCode` mints the code; `pollForToken` polls `.../token` on
- * the server's own cadence until it settles one way or the other. Both take
- * an injectable `fetchImpl` so tests never touch the network, and
- * `pollForToken` additionally takes injectable `sleep`/`now` so tests never
- * touch the wall clock either.
- */
-import type { ExchangeResult } from "./exchange.js";
-export type DeviceErrorKind = "invalid_request" | "rate_limited" | "network" | "malformed";
-export declare class DeviceError extends Error {
-    readonly kind: DeviceErrorKind;
-    readonly retryAfterSeconds?: number | undefined;
-    constructor(kind: DeviceErrorKind, message: string, retryAfterSeconds?: number | undefined);
-}
-export interface DeviceCodeResult {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete: string;
-    expiresIn: number;
-    interval: number;
-}
-/** The `/token` endpoint's terminal (non-retryable) outcomes, plus `network`/`malformed`. */
-export type PollErrorKind = "access_denied" | "expired_token" | "invalid_grant" | "invalid_request" | "network" | "malformed";
-export declare class PollError extends Error {
-    readonly kind: PollErrorKind;
-    constructor(kind: PollErrorKind, message: string);
-}
-/**
- * Requests a device code. Mirrors `exchange.ts`'s `exchangeCode` in shape:
- * every failure is a distinct `DeviceError` kind, a 429 carries
- * `Retry-After` when the platform sent one, and a 200 whose body is not
- * valid JSON or is missing a required field is `malformed` rather than
- * handing the caller `undefined` fields.
- */
-export declare function requestDeviceCode({ platformUrl, label, callbackUri, fetchImpl, }: {
-    platformUrl: string;
-    label: string;
-    callbackUri: string;
-    fetchImpl?: typeof fetch;
-}): Promise<DeviceCodeResult>;
-/**
- * Polls `.../tools/oauth/device/token` on the server's cadence until the
- * user approves (or denies) the request in their browser, the device code
- * expires, or the server rejects it outright.
- *
- * `authorization_pending` keeps polling at the current interval;
- * `slow_down` adds 5 seconds to it and keeps polling (per the wire
- * contract); a 429 waits out `Retry-After` (or the current interval, if the
- * platform sent none) and keeps polling; every other error is terminal.
- * Local expiry (`now() - start >= expiresInSeconds`) is reported the same
- * way as the server's own `expired_token` — the caller does not need to
- * tell the two apart.
- *
- * A network failure while polling retries with backoff up to
- * `MAX_NETWORK_RETRIES` times before it is reported as `PollError("network")`.
- */
-export declare function pollForToken({ platformUrl, deviceCode, intervalSeconds, expiresInSeconds, fetchImpl, sleep, now, }: {
-    platformUrl: string;
-    deviceCode: string;
-    intervalSeconds: number;
-    expiresInSeconds: number;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    now?: () => number;
-}): Promise<ExchangeResult>;

package/dist/oauth/device.js

@@ -1,198 +0,0 @@
-export class DeviceError extends Error {
-    kind;
-    retryAfterSeconds;
-    constructor(kind, message, retryAfterSeconds) {
-        super(message);
-        this.kind = kind;
-        this.retryAfterSeconds = retryAfterSeconds;
-        this.name = "DeviceError";
-    }
-}
-export class PollError extends Error {
-    kind;
-    constructor(kind, message) {
-        super(message);
-        this.kind = kind;
-        this.name = "PollError";
-    }
-}
-function deviceCodeUrl(platformUrl) {
-    return `${platformUrl.replace(/\/+$/, "")}/tools/oauth/device/code`;
-}
-function deviceTokenUrl(platformUrl) {
-    return `${platformUrl.replace(/\/+$/, "")}/tools/oauth/device/token`;
-}
-function retryAfterSecondsFrom(response) {
-    const header = response.headers.get("retry-after");
-    const seconds = header ? Number(header) : undefined;
-    return Number.isFinite(seconds) ? seconds : undefined;
-}
-/**
- * Requests a device code. Mirrors `exchange.ts`'s `exchangeCode` in shape:
- * every failure is a distinct `DeviceError` kind, a 429 carries
- * `Retry-After` when the platform sent one, and a 200 whose body is not
- * valid JSON or is missing a required field is `malformed` rather than
- * handing the caller `undefined` fields.
- */
-export async function requestDeviceCode({ platformUrl, label, callbackUri, fetchImpl = fetch, }) {
-    const url = deviceCodeUrl(platformUrl);
-    let response;
-    try {
-        response = await fetchImpl(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ label, callback_uri: callbackUri }),
-        });
-    }
-    catch (err) {
-        throw new DeviceError("network", `Could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (response.status === 429) {
-        const retryAfterSeconds = retryAfterSecondsFrom(response);
-        throw new DeviceError("rate_limited", `${url} is rate-limited` +
-            (retryAfterSeconds !== undefined
-                ? ` — retry after ${retryAfterSeconds}s.`
-                : "."), retryAfterSeconds);
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        throw new DeviceError("malformed", `${url} did not return valid JSON (status ${response.status}).`);
-    }
-    if (!response.ok) {
-        const errBody = (body ?? {});
-        const description = typeof errBody.error_description === "string"
-            ? errBody.error_description
-            : undefined;
-        const code = typeof errBody.error === "string"
-            ? errBody.error
-            : `HTTP ${response.status}`;
-        throw new DeviceError("invalid_request", description ? `${code}: ${description}` : code);
-    }
-    const result = (body ?? {});
-    if (typeof result.device_code !== "string" ||
-        typeof result.user_code !== "string" ||
-        typeof result.verification_uri !== "string" ||
-        typeof result.verification_uri_complete !== "string" ||
-        typeof result.expires_in !== "number" ||
-        typeof result.interval !== "number") {
-        throw new DeviceError("malformed", `${url} returned 200 but was missing a required device-code field.`);
-    }
-    return {
-        deviceCode: result.device_code,
-        userCode: result.user_code,
-        verificationUri: result.verification_uri,
-        verificationUriComplete: result.verification_uri_complete,
-        expiresIn: result.expires_in,
-        interval: result.interval,
-    };
-}
-/** Network failures while polling get this many retries before `pollForToken` gives up. */
-const MAX_NETWORK_RETRIES = 3;
-/** Exponential backoff for a network retry, capped well under the poll interval's own cadence. */
-function networkBackoffSeconds(attempt) {
-    return Math.min(2 ** attempt, 30);
-}
-/**
- * Polls `.../tools/oauth/device/token` on the server's cadence until the
- * user approves (or denies) the request in their browser, the device code
- * expires, or the server rejects it outright.
- *
- * `authorization_pending` keeps polling at the current interval;
- * `slow_down` adds 5 seconds to it and keeps polling (per the wire
- * contract); a 429 waits out `Retry-After` (or the current interval, if the
- * platform sent none) and keeps polling; every other error is terminal.
- * Local expiry (`now() - start >= expiresInSeconds`) is reported the same
- * way as the server's own `expired_token` — the caller does not need to
- * tell the two apart.
- *
- * A network failure while polling retries with backoff up to
- * `MAX_NETWORK_RETRIES` times before it is reported as `PollError("network")`.
- */
-export async function pollForToken({ platformUrl, deviceCode, intervalSeconds, expiresInSeconds, fetchImpl = fetch, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = () => Date.now(), }) {
-    const url = deviceTokenUrl(platformUrl);
-    const deadline = now() + expiresInSeconds * 1000;
-    let interval = intervalSeconds;
-    let networkFailures = 0;
-    // Set only by a branch that already slept its own wait (a network retry's
-    // backoff, or a 429's Retry-After) — skips the ordinary top-of-loop
-    // interval sleep so those waits are not doubled up with it.
-    let skipIntervalSleep = false;
-    while (true) {
-        if (now() >= deadline) {
-            throw new PollError("expired_token", "The device code expired before it was approved. Run the command again.");
-        }
-        if (!skipIntervalSleep)
-            await sleep(interval * 1000);
-        skipIntervalSleep = false;
-        let response;
-        try {
-            response = await fetchImpl(url, {
-                method: "POST",
-                headers: { "content-type": "application/json" },
-                body: JSON.stringify({ device_code: deviceCode }),
-            });
-        }
-        catch (err) {
-            networkFailures += 1;
-            if (networkFailures > MAX_NETWORK_RETRIES) {
-                throw new PollError("network", `Could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`);
-            }
-            await sleep(networkBackoffSeconds(networkFailures) * 1000);
-            skipIntervalSleep = true;
-            continue;
-        }
-        networkFailures = 0;
-        if (response.status === 429) {
-            const retryAfterSeconds = retryAfterSecondsFrom(response);
-            await sleep((retryAfterSeconds ?? interval) * 1000);
-            skipIntervalSleep = true;
-            continue;
-        }
-        let body;
-        try {
-            body = await response.json();
-        }
-        catch {
-            throw new PollError("malformed", `${url} did not return valid JSON (status ${response.status}).`);
-        }
-        if (response.ok) {
-            const result = (body ?? {});
-            if (typeof result.client_id !== "string" ||
-                typeof result.client_secret !== "string" ||
-                typeof result.issuer !== "string") {
-                throw new PollError("malformed", `${url} returned 200 but was missing client_id, client_secret, or issuer.`);
-            }
-            return {
-                clientId: result.client_id,
-                clientSecret: result.client_secret,
-                issuer: result.issuer,
-            };
-        }
-        const errBody = (body ?? {});
-        const errorCode = typeof errBody.error === "string" ? errBody.error : undefined;
-        const description = typeof errBody.error_description === "string"
-            ? errBody.error_description
-            : undefined;
-        switch (errorCode) {
-            case "authorization_pending":
-                continue;
-            case "slow_down":
-                interval += 5;
-                continue;
-            case "access_denied":
-                throw new PollError("access_denied", description ?? "Connection declined in the browser.");
-            case "expired_token":
-                throw new PollError("expired_token", description ?? "The device code expired. Run the command again.");
-            case "invalid_grant":
-                throw new PollError("invalid_grant", description ?? "invalid_grant");
-            case "invalid_request":
-            default: {
-                const code = errorCode ?? `HTTP ${response.status}`;
-                throw new PollError("invalid_request", description ? `${code}: ${description}` : code);
-            }
-        }
-    }
-}

package/dist/oauth/discovery.d.ts

@@ -1,28 +0,0 @@
-/**
- * OIDC discovery for the DevDogs OAuth server.
- *
- * The wizard used to build the issuer it registered with Supabase as
- * `${baseUrl}/auth/v1` — an assumption, not a fact. Supabase Auth's own
- * discovery document at that same base advertises a DIFFERENT issuer (its
- * project ref host, e.g. `https://<ref>.supabase.co/auth/v1`, rather than
- * the custom domain a caller reaches it through), and Supabase's OIDC
- * provider refuses to register a custom provider whose declared issuer
- * disagrees with what discovery reports for it. Reading the issuer FROM
- * discovery, rather than constructing it, keeps this correct regardless of
- * which host the platform's own discovery document happens to advertise —
- * including once the platform starts advertising its custom domain instead
- * of the underlying project host.
- */
-/** Thrown when discovery cannot be fetched or does not shape up as expected. */
-export declare class DiscoveryError extends Error {
-}
-/**
- * Fetches `${baseUrl}/auth/v1/.well-known/openid-configuration` and returns
- * the `issuer` it advertises.
- *
- * Every failure names the discovery URL it was trying to reach — a network
- * failure, a non-2xx response, unparsable JSON, and a missing/non-string
- * `issuer` field are each reported distinctly, so the wizard can print
- * something more useful than "fetch failed".
- */
-export declare function fetchIssuer(baseUrl: string): Promise<string>;

package/dist/oauth/discovery.js

@@ -1,54 +0,0 @@
-/**
- * OIDC discovery for the DevDogs OAuth server.
- *
- * The wizard used to build the issuer it registered with Supabase as
- * `${baseUrl}/auth/v1` — an assumption, not a fact. Supabase Auth's own
- * discovery document at that same base advertises a DIFFERENT issuer (its
- * project ref host, e.g. `https://<ref>.supabase.co/auth/v1`, rather than
- * the custom domain a caller reaches it through), and Supabase's OIDC
- * provider refuses to register a custom provider whose declared issuer
- * disagrees with what discovery reports for it. Reading the issuer FROM
- * discovery, rather than constructing it, keeps this correct regardless of
- * which host the platform's own discovery document happens to advertise —
- * including once the platform starts advertising its custom domain instead
- * of the underlying project host.
- */
-/** Thrown when discovery cannot be fetched or does not shape up as expected. */
-export class DiscoveryError extends Error {
-}
-/**
- * Fetches `${baseUrl}/auth/v1/.well-known/openid-configuration` and returns
- * the `issuer` it advertises.
- *
- * Every failure names the discovery URL it was trying to reach — a network
- * failure, a non-2xx response, unparsable JSON, and a missing/non-string
- * `issuer` field are each reported distinctly, so the wizard can print
- * something more useful than "fetch failed".
- */
-export async function fetchIssuer(baseUrl) {
-    const discoveryUrl = `${baseUrl}/auth/v1/.well-known/openid-configuration`;
-    let response;
-    try {
-        response = await fetch(discoveryUrl);
-    }
-    catch (err) {
-        throw new DiscoveryError(`Could not reach ${discoveryUrl}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (!response.ok) {
-        throw new DiscoveryError(`${discoveryUrl} returned ${response.status} ${response.statusText}`);
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        throw new DiscoveryError(`${discoveryUrl} did not return valid JSON`);
-    }
-    const issuer = body && typeof body === "object"
-        ? body.issuer
-        : undefined;
-    if (typeof issuer !== "string" || issuer.length === 0) {
-        throw new DiscoveryError(`${discoveryUrl} response had no "issuer" field`);
-    }
-    return issuer;
-}

package/dist/oauth/env-file.d.ts

@@ -1,6 +0,0 @@
-/**
- * Writes `values` into `.env.local` in `cwd`, updating any existing
- * `KEY=...` lines in place and appending keys that aren't present yet.
- * Leaves all other lines (comments, unrelated vars) untouched.
- */
-export declare function upsertEnvLocal(cwd: string, values: Record<string, string>): void;

package/dist/oauth/env-file.js

@@ -1,35 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-/**
- * Writes `values` into `.env.local` in `cwd`, updating any existing
- * `KEY=...` lines in place and appending keys that aren't present yet.
- * Leaves all other lines (comments, unrelated vars) untouched.
- */
-export function upsertEnvLocal(cwd, values) {
-    const path = join(cwd, ".env.local");
-    const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
-    const lines = existing.length > 0 ? existing.split("\n") : [];
-    const remaining = new Map(Object.entries(values));
-    const updated = lines.map((line) => {
-        const match = /^([A-Za-z_][A-Za-z0-9_]*)=/.exec(line);
-        if (!match)
-            return line;
-        // The regex has exactly one capture group, so a match always fills it;
-        // noUncheckedIndexedAccess can't see that, hence the explicit guard.
-        const key = match[1];
-        if (key === undefined)
-            return line;
-        const value = remaining.get(key);
-        if (value === undefined)
-            return line;
-        remaining.delete(key);
-        return `${key}=${formatValue(value)}`;
-    });
-    for (const [key, value] of remaining) {
-        updated.push(`${key}=${formatValue(value)}`);
-    }
-    writeFileSync(path, `${updated.join("\n").replace(/\n*$/, "")}\n`);
-}
-function formatValue(value) {
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}

package/dist/oauth/exchange.d.ts

@@ -1,43 +0,0 @@
-/**
- * The token exchange half of the one-click connect flow: trades the
- * authorization `code` the loopback listener caught, plus the PKCE
- * verifier that matches the challenge sent up front, for the OAuth client
- * credentials the platform minted — see `commands.ts`'s `oauth` node and
- * this repo's launch instructions for the full wire contract this speaks:
- *
- *   POST <platform>/tools/oauth/connect/exchange
- *   { "code", "code_verifier" }
- *
- *   200 { "client_id", "client_secret", "issuer" }
- *   400 { "error": "invalid_request" | "invalid_grant", "error_description" }
- *   429 { "error": "rate_limited" }  (+ Retry-After header)
- */
-export type ExchangeErrorKind = "invalid_request" | "invalid_grant" | "rate_limited" | "network" | "malformed";
-export declare class ExchangeError extends Error {
-    readonly kind: ExchangeErrorKind;
-    readonly retryAfterSeconds?: number | undefined;
-    constructor(kind: ExchangeErrorKind, message: string, retryAfterSeconds?: number | undefined);
-}
-export interface ExchangeResult {
-    clientId: string;
-    clientSecret: string;
-    issuer: string;
-}
-/**
- * Exchanges `code` + `codeVerifier` for OAuth client credentials.
- *
- * Every failure is a distinct `ExchangeError` kind so the caller (the
- * wizard) can print something specific rather than a bare "request
- * failed": a network failure names the URL and underlying error, a 429
- * carries `Retry-After` when the platform sent one, a 400 distinguishes
- * `invalid_grant` (the code was wrong, expired, or already used — the
- * ordinary "try the flow again" case) from any other `invalid_request`, and
- * a 200 with a body that is not valid JSON or is missing a required field
- * is reported as `malformed` rather than silently returning `undefined`
- * fields to the caller.
- */
-export declare function exchangeCode({ platformUrl, code, codeVerifier, }: {
-    platformUrl: string;
-    code: string;
-    codeVerifier: string;
-}): Promise<ExchangeResult>;

package/dist/oauth/exchange.js

@@ -1,93 +0,0 @@
-/**
- * The token exchange half of the one-click connect flow: trades the
- * authorization `code` the loopback listener caught, plus the PKCE
- * verifier that matches the challenge sent up front, for the OAuth client
- * credentials the platform minted — see `commands.ts`'s `oauth` node and
- * this repo's launch instructions for the full wire contract this speaks:
- *
- *   POST <platform>/tools/oauth/connect/exchange
- *   { "code", "code_verifier" }
- *
- *   200 { "client_id", "client_secret", "issuer" }
- *   400 { "error": "invalid_request" | "invalid_grant", "error_description" }
- *   429 { "error": "rate_limited" }  (+ Retry-After header)
- */
-export class ExchangeError extends Error {
-    kind;
-    retryAfterSeconds;
-    constructor(kind, message, retryAfterSeconds) {
-        super(message);
-        this.kind = kind;
-        this.retryAfterSeconds = retryAfterSeconds;
-        this.name = "ExchangeError";
-    }
-}
-function exchangeUrl(platformUrl) {
-    return `${platformUrl.replace(/\/+$/, "")}/tools/oauth/connect/exchange`;
-}
-/**
- * Exchanges `code` + `codeVerifier` for OAuth client credentials.
- *
- * Every failure is a distinct `ExchangeError` kind so the caller (the
- * wizard) can print something specific rather than a bare "request
- * failed": a network failure names the URL and underlying error, a 429
- * carries `Retry-After` when the platform sent one, a 400 distinguishes
- * `invalid_grant` (the code was wrong, expired, or already used — the
- * ordinary "try the flow again" case) from any other `invalid_request`, and
- * a 200 with a body that is not valid JSON or is missing a required field
- * is reported as `malformed` rather than silently returning `undefined`
- * fields to the caller.
- */
-export async function exchangeCode({ platformUrl, code, codeVerifier, }) {
-    const url = exchangeUrl(platformUrl);
-    let response;
-    try {
-        response = await fetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ code, code_verifier: codeVerifier }),
-        });
-    }
-    catch (err) {
-        throw new ExchangeError("network", `Could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (response.status === 429) {
-        const retryAfterHeader = response.headers.get("retry-after");
-        const retryAfterSeconds = retryAfterHeader
-            ? Number(retryAfterHeader)
-            : undefined;
-        throw new ExchangeError("rate_limited", `${url} is rate-limited` +
-            (Number.isFinite(retryAfterSeconds)
-                ? ` — retry after ${retryAfterSeconds}s.`
-                : "."), Number.isFinite(retryAfterSeconds) ? retryAfterSeconds : undefined);
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        throw new ExchangeError("malformed", `${url} did not return valid JSON (status ${response.status}).`);
-    }
-    if (!response.ok) {
-        const errBody = (body ?? {});
-        const kind = errBody.error === "invalid_grant" ? "invalid_grant" : "invalid_request";
-        const description = typeof errBody.error_description === "string"
-            ? errBody.error_description
-            : undefined;
-        const code = typeof errBody.error === "string"
-            ? errBody.error
-            : `HTTP ${response.status}`;
-        throw new ExchangeError(kind, description ? `${code}: ${description}` : code);
-    }
-    const result = (body ?? {});
-    if (typeof result.client_id !== "string" ||
-        typeof result.client_secret !== "string" ||
-        typeof result.issuer !== "string") {
-        throw new ExchangeError("malformed", `${url} returned 200 but was missing client_id, client_secret, or issuer.`);
-    }
-    return {
-        clientId: result.client_id,
-        clientSecret: result.client_secret,
-        issuer: result.issuer,
-    };
-}

package/dist/oauth/label.d.ts

@@ -1 +0,0 @@
-export declare function defaultLabel(cwd: string): string;