@drawcall/auth 0.1.0

package/README.md

@@ -0,0 +1,21 @@
+# @drawcall/auth
+
+Shared authentication for Drawcall command-line tools.
+
+```sh
+npx @drawcall/auth login
+npx @drawcall/auth status
+npx @drawcall/auth logout
+```
+
+Credentials live in the platform config directory under `drawcall/config.json`. Set
+`DRAWCALL_AUTH_TOKEN` to use an ephemeral token instead. Existing credentials from the former
+Market and Design config files migrate automatically.
+
+The Commander implementation is public for aggregate CLIs:
+
+```ts
+import { createAuthCommand } from "@drawcall/auth";
+
+program.addCommand(createAuthCommand());
+```

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { createAuthCommand } from "./command.js";
+const program = createAuthCommand({ name: "drawcall-auth" }).version(readPackageVersion());
+if (process.argv.length <= 2) {
+    program.outputHelp();
+}
+else {
+    program.parseAsync().catch((error) => {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    });
+}
+function readPackageVersion() {
+    const manifest = createRequire(import.meta.url)("../package.json");
+    if (!manifest ||
+        typeof manifest !== "object" ||
+        Array.isArray(manifest) ||
+        !("version" in manifest) ||
+        typeof manifest.version !== "string") {
+        throw new Error("@drawcall/auth package.json is missing a valid version");
+    }
+    return manifest.version;
+}

package/dist/command.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+import { type DeviceLoginOptions } from "./device-login.js";
+export interface AuthCommandOptions {
+    name?: string;
+    login?: DeviceLoginOptions;
+}
+export declare function createAuthCommand(options?: AuthCommandOptions): Command;

package/dist/command.js

@@ -0,0 +1,36 @@
+import { Command } from "commander";
+import { getConfigPath, resolveAuthToken, saveAuthToken, signOut } from "./config.js";
+import { runDeviceLogin } from "./device-login.js";
+export function createAuthCommand(options = {}) {
+    const command = new Command(options.name ?? "auth").description("Manage shared Drawcall authentication");
+    command
+        .command("login")
+        .description("Sign in with your Drawcall account")
+        .action(async () => {
+        const token = await runDeviceLogin(options.login);
+        await saveAuthToken(token);
+        console.log(`Signed in. Credentials saved to ${getConfigPath()}.`);
+    });
+    command
+        .command("logout")
+        .description("Sign out")
+        .action(async () => {
+        console.log((await signOut()) ? "Signed out." : "Already signed out.");
+    });
+    command
+        .command("status")
+        .description("Show the active authentication source")
+        .action(async () => {
+        const auth = await resolveAuthToken();
+        if (!auth) {
+            console.log("Not signed in.");
+            return;
+        }
+        if (auth.source === "environment") {
+            console.log("Signed in via DRAWCALL_AUTH_TOKEN.");
+            return;
+        }
+        console.log(`Signed in with credentials from ${getConfigPath()}.`);
+    });
+    return command;
+}

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+export interface AuthStorageOptions {
+    configHome?: string;
+    environment?: NodeJS.ProcessEnv;
+}
+export type AuthTokenSource = "environment" | "shared" | "legacy";
+export interface ResolvedAuthToken {
+    token: string;
+    source: AuthTokenSource;
+}
+export declare function resolveAuthToken(options?: AuthStorageOptions): Promise<ResolvedAuthToken | null>;
+export declare function getAuthToken(options?: AuthStorageOptions): Promise<string | undefined>;
+export declare function saveAuthToken(authToken: string, options?: AuthStorageOptions): Promise<void>;
+export declare function clearAuthToken(options?: AuthStorageOptions): Promise<boolean>;
+export declare function signOut(options?: AuthStorageOptions): Promise<boolean>;
+export declare function getConfigPath(options?: AuthStorageOptions): string;

package/dist/config.js

@@ -0,0 +1,119 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { z } from "zod";
+const authConfigSchema = z.object({ authToken: z.string().min(1) });
+const legacyConfigSchema = z.record(z.string(), z.unknown());
+const legacyConfigDirectories = ["drawcall-market", "drawcall-design"];
+export async function resolveAuthToken(options = {}) {
+    const environmentToken = (options.environment ?? process.env).DRAWCALL_AUTH_TOKEN;
+    if (environmentToken)
+        return { token: environmentToken, source: "environment" };
+    const config = await loadAuthConfig(options);
+    if (config)
+        return { token: config.authToken, source: "shared" };
+    const token = await readLegacyAuthToken(options);
+    if (!token)
+        return null;
+    await saveAuthToken(token, options);
+    return { token, source: "legacy" };
+}
+export async function getAuthToken(options = {}) {
+    return (await resolveAuthToken(options))?.token;
+}
+export async function saveAuthToken(authToken, options = {}) {
+    const config = authConfigSchema.parse({ authToken });
+    await writePrivateJson(getConfigPath(options), config);
+    await clearLegacyAuthTokens(options);
+}
+export async function clearAuthToken(options = {}) {
+    const removedSharedConfig = await removeFile(getConfigPath(options));
+    const removedLegacyTokens = await clearLegacyAuthTokens(options);
+    return removedSharedConfig || removedLegacyTokens;
+}
+export async function signOut(options = {}) {
+    if ((options.environment ?? process.env).DRAWCALL_AUTH_TOKEN) {
+        throw new Error("Authentication comes from DRAWCALL_AUTH_TOKEN. Unset it to sign out.");
+    }
+    return clearAuthToken(options);
+}
+export function getConfigPath(options = {}) {
+    return path.join(configHome(options), "drawcall", "config.json");
+}
+async function loadAuthConfig(options) {
+    try {
+        return authConfigSchema.parse(JSON.parse(await fs.readFile(getConfigPath(options), "utf8")));
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return null;
+        throw error;
+    }
+}
+async function readLegacyAuthToken(options) {
+    const tokens = [];
+    for (const file of legacyConfigPaths(options)) {
+        const config = await readLegacyConfig(file);
+        if (typeof config?.authToken === "string" && config.authToken.length > 0) {
+            tokens.push({ token: config.authToken, modifiedAt: (await fs.stat(file)).mtimeMs });
+        }
+    }
+    tokens.sort((left, right) => right.modifiedAt - left.modifiedAt);
+    return tokens[0]?.token;
+}
+async function clearLegacyAuthTokens(options) {
+    const results = await Promise.all(legacyConfigPaths(options).map(clearLegacyAuthToken));
+    return results.some(Boolean);
+}
+async function clearLegacyAuthToken(file) {
+    const config = await readLegacyConfig(file);
+    if (!config || !("authToken" in config))
+        return false;
+    const entries = Object.entries(config).filter(([key]) => key !== "authToken");
+    if (entries.length === 0)
+        return removeFile(file);
+    await writePrivateJson(file, Object.fromEntries(entries));
+    return true;
+}
+async function readLegacyConfig(file) {
+    try {
+        return legacyConfigSchema.parse(JSON.parse(await fs.readFile(file, "utf8")));
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return null;
+        throw error;
+    }
+}
+async function writePrivateJson(file, value) {
+    const directory = path.dirname(file);
+    await fs.mkdir(directory, { recursive: true });
+    await fs.chmod(directory, 0o700);
+    await fs.writeFile(file, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    await fs.chmod(file, 0o600);
+}
+async function removeFile(file) {
+    try {
+        await fs.unlink(file);
+        return true;
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return false;
+        throw error;
+    }
+}
+function legacyConfigPaths(options) {
+    return legacyConfigDirectories.map((directory) => path.join(configHome(options), directory, "config.json"));
+}
+function configHome(options) {
+    if (options.configHome)
+        return options.configHome;
+    const environment = options.environment ?? process.env;
+    if (process.platform === "win32" && environment.APPDATA)
+        return environment.APPDATA;
+    return environment.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config");
+}
+function isMissingFile(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}

package/dist/device-login.d.ts

@@ -0,0 +1,9 @@
+export declare const DEFAULT_AUTH_ISSUER_URL = "https://auth.drawcall.ai/api/auth";
+export declare const DEFAULT_DEVICE_CLIENT_ID = "drawcall-cli";
+export declare const DEFAULT_AUTH_SCOPES: readonly ["design", "market"];
+export interface DeviceLoginOptions {
+    issuerUrl?: string;
+    clientId?: string;
+    scopes?: readonly string[];
+}
+export declare function runDeviceLogin(options?: DeviceLoginOptions): Promise<string>;

package/dist/device-login.js

@@ -0,0 +1,28 @@
+export const DEFAULT_AUTH_ISSUER_URL = "https://auth.drawcall.ai/api/auth";
+export const DEFAULT_DEVICE_CLIENT_ID = "drawcall-cli";
+export const DEFAULT_AUTH_SCOPES = ["design", "market"];
+export async function runDeviceLogin(options = {}) {
+    const [{ default: open }, oauth] = await Promise.all([import("open"), import("openid-client")]);
+    const issuerUrl = options.issuerUrl ?? DEFAULT_AUTH_ISSUER_URL;
+    const clientId = options.clientId ?? DEFAULT_DEVICE_CLIENT_ID;
+    const scopes = options.scopes ?? DEFAULT_AUTH_SCOPES;
+    const configuration = await oauth.discovery(new URL(issuerUrl), clientId, undefined, oauth.None());
+    const authorization = await oauth.initiateDeviceAuthorization(configuration, {
+        scope: scopes.join(" "),
+    });
+    const verificationUrl = authorization.verification_uri_complete ?? authorization.verification_uri;
+    console.log(`Open ${verificationUrl}`);
+    console.log(`Code: ${authorization.user_code}`);
+    try {
+        await open(verificationUrl);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`Could not open a browser automatically: ${message}`);
+    }
+    const tokens = await oauth.pollDeviceAuthorizationGrant(configuration, authorization);
+    if (!tokens.access_token) {
+        throw new Error("Device login completed without an access token.");
+    }
+    return tokens.access_token;
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createAuthCommand, type AuthCommandOptions } from "./command.js";
+export { clearAuthToken, getAuthToken, getConfigPath, resolveAuthToken, saveAuthToken, signOut, type AuthStorageOptions, type AuthTokenSource, type ResolvedAuthToken, } from "./config.js";
+export { DEFAULT_AUTH_ISSUER_URL, DEFAULT_AUTH_SCOPES, DEFAULT_DEVICE_CLIENT_ID, runDeviceLogin, type DeviceLoginOptions, } from "./device-login.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createAuthCommand } from "./command.js";
+export { clearAuthToken, getAuthToken, getConfigPath, resolveAuthToken, saveAuthToken, signOut, } from "./config.js";
+export { DEFAULT_AUTH_ISSUER_URL, DEFAULT_AUTH_SCOPES, DEFAULT_DEVICE_CLIENT_ID, runDeviceLogin, } from "./device-login.js";

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@drawcall/auth",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "description": "Shared authentication for Drawcall command-line tools.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/drawcall-ai/auth.git",
+    "directory": "packages/auth"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "drawcall-auth": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^14.0.3",
+    "open": "^10.2.0",
+    "openid-client": "^6.8.4",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "build": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/cli.js', 0o755)\"",
+    "test": "tsx --test tests/*.test.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}