@mastra/code-sdk 0.0.0-aggregate-trace-20261015182851

package/dist/auth/providers/xai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/xai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAyB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAwEjG;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,gBAAgB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgC5G;AAsDD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWxF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,EACpB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAgBD,eAAO,MAAM,gBAAgB,EAAE,sBA2B9B,CAAC"}

package/dist/auth/providers/xai.js

@@ -0,0 +1,226 @@
+import { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from "../device-code.js";
+//#region src/auth/providers/xai.ts
+/**
+* xAI OAuth flow (Grok)
+*
+* Ported from pi-mono's xAI OAuth implementation:
+* https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts
+*
+* xAI uses a standard RFC 8628 device authorization grant, so the flow needs
+* no inbound connection to the server. The primitives are split into
+* `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist
+* the JSON-serializable pending state between HTTP requests; the blocking
+* `loginXAI()` wraps them for TUI use.
+*/
+const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+const TOKEN_URL = "https://auth.x.ai/oauth2/token";
+const SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;
+const REQUEST_TIMEOUT_MS = 3e4;
+const REFRESH_SKEW_MS = 300 * 1e3;
+async function postForm(url, params, signal) {
+	const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	return fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(params).toString(),
+		signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
+	});
+}
+/** The verification URI is opened by the user; only accept https URLs. */
+function validateVerificationUri(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new Error("xAI device authorization returned an invalid verification_uri");
+	}
+	if (parsed.protocol !== "https:") throw new Error("xAI device authorization returned a non-https verification_uri");
+	return parsed.toString();
+}
+function credentialsFromTokenResponse(data, previousRefreshToken, previousIdToken) {
+	const record = data ?? {};
+	const access = record.access_token;
+	if (typeof access !== "string" || access.length === 0) throw new Error("xAI token response missing access_token");
+	const refresh = typeof record.refresh_token === "string" && record.refresh_token.length > 0 ? record.refresh_token : previousRefreshToken;
+	if (!refresh) throw new Error("xAI token response missing refresh_token");
+	const expiresIn = typeof record.expires_in === "number" && record.expires_in > 0 ? record.expires_in : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;
+	return {
+		access,
+		refresh,
+		expires: Date.now() + expiresIn * 1e3 - REFRESH_SKEW_MS,
+		idToken: typeof record.id_token === "string" && record.id_token.length > 0 ? record.id_token : previousIdToken
+	};
+}
+/**
+* Start an xAI device-code login: request a user code and return the
+* serializable pending state for subsequent polls.
+*/
+async function startXAIDeviceLogin(options) {
+	const response = await postForm(DEVICE_CODE_URL, {
+		client_id: CLIENT_ID,
+		scope: SCOPE
+	}, options?.signal);
+	if (!response.ok) throw new Error(`Failed to initiate xAI device authorization: ${response.status}`);
+	const data = await response.json();
+	if (!data.device_code || !data.user_code || !data.verification_uri) throw new Error("xAI device authorization response missing required fields");
+	const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);
+	return {
+		deviceCode: data.device_code,
+		userCode: data.user_code,
+		url,
+		instructions: `Enter code: ${data.user_code}`,
+		state: createDeviceCodePollState({
+			intervalSeconds: data.interval,
+			expiresInSeconds: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 600
+		})
+	};
+}
+async function pollXAITokenOnce(pending, signal) {
+	const response = await postForm(TOKEN_URL, {
+		grant_type: DEVICE_CODE_GRANT_TYPE,
+		device_code: pending.deviceCode,
+		client_id: CLIENT_ID
+	}, signal);
+	if (response.ok) {
+		const data = await response.json();
+		try {
+			return {
+				status: "complete",
+				result: credentialsFromTokenResponse(data)
+			};
+		} catch (error) {
+			return {
+				status: "failed",
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	const text = await response.text().catch(() => "");
+	let body = {};
+	try {
+		body = JSON.parse(text);
+	} catch {}
+	switch (body.error) {
+		case "authorization_pending": return {
+			status: "pending",
+			intervalSeconds: body.interval
+		};
+		case "slow_down": return {
+			status: "slow_down",
+			intervalSeconds: body.interval
+		};
+		case "access_denied":
+		case "authorization_denied": return {
+			status: "failed",
+			error: "xAI authorization was denied"
+		};
+		case "expired_token": return {
+			status: "failed",
+			error: "xAI device code expired before authorization completed"
+		};
+		default: return {
+			status: "failed",
+			error: `xAI device authorization failed: ${response.status}`
+		};
+	}
+}
+/**
+* Perform exactly one upstream poll for a pending xAI device login.
+* Returns the updated pending state so callers (e.g. web routes) can persist
+* slow_down interval growth between polls. Never throws for flow-level
+* conditions.
+*/
+async function pollXAIDeviceLogin(pending, options) {
+	const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));
+	switch (step.status) {
+		case "complete": return {
+			status: "complete",
+			credentials: step.result
+		};
+		case "failed": return {
+			status: "failed",
+			error: step.error
+		};
+		case "pending":
+		case "slow_down": return {
+			status: "pending",
+			nextPollMs: step.nextPollMs,
+			pending: {
+				...pending,
+				state: step.state
+			}
+		};
+	}
+}
+/**
+* Login with xAI OAuth (device-code flow), blocking until authorized.
+*/
+async function loginXAI(callbacks) {
+	const pending = await startXAIDeviceLogin({ signal: callbacks.signal });
+	callbacks.onAuth({
+		url: pending.url,
+		instructions: pending.instructions,
+		userCode: pending.userCode
+	});
+	callbacks.onProgress?.("Waiting for xAI device authorization...");
+	return pollDeviceCodeUntilComplete({
+		state: pending.state,
+		pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),
+		signal: callbacks.signal
+	});
+}
+/**
+* Refresh xAI OAuth token
+*/
+async function refreshXAIToken(refreshToken, signal, previousIdToken) {
+	const response = await postForm(TOKEN_URL, {
+		grant_type: "refresh_token",
+		client_id: CLIENT_ID,
+		refresh_token: refreshToken
+	}, signal);
+	if (!response.ok) throw new Error(`xAI token refresh failed: ${response.status}`);
+	return credentialsFromTokenResponse(await response.json(), refreshToken, previousIdToken);
+}
+/** Decode the email claim out of an id_token JWT payload (no verification). */
+function emailFromIdToken(idToken) {
+	if (typeof idToken !== "string") return void 0;
+	const parts = idToken.split(".");
+	if (parts.length !== 3) return void 0;
+	try {
+		const padded = (parts[1] ?? "").replace(/-/g, "+").replace(/_/g, "/");
+		const json = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+		return typeof json.email === "string" && json.email.length > 0 ? json.email : void 0;
+	} catch {
+		return;
+	}
+}
+const xaiOAuthProvider = {
+	id: "xai",
+	name: "xAI (Grok)",
+	async login(callbacks) {
+		return loginXAI(callbacks);
+	},
+	async refreshToken(credentials) {
+		return refreshXAIToken(credentials.refresh, void 0, credentials.idToken);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	},
+	getAccountLabel(credentials) {
+		return Promise.resolve(emailFromIdToken(credentials.idToken));
+	},
+	/**
+	* The account's email, read from the id token — one subscription per email,
+	* so this distinguishes two xAI accounts from a re-authorization of one.
+	*/
+	getAccountIdentity(credentials) {
+		return emailFromIdToken(credentials.idToken);
+	}
+};
+//#endregion
+export { loginXAI, pollXAIDeviceLogin, refreshXAIToken, startXAIDeviceLogin, xaiOAuthProvider };
+
+//# sourceMappingURL=xai.js.map

package/dist/auth/providers/xai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.js","names":[],"sources":["../../../src/auth/providers/xai.ts"],"sourcesContent":["/**\n * xAI OAuth flow (Grok)\n *\n * Ported from pi-mono's xAI OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts\n *\n * xAI uses a standard RFC 8628 device authorization grant, so the flow needs\n * no inbound connection to the server. The primitives are split into\n * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist\n * the JSON-serializable pending state between HTTP requests; the blocking\n * `loginXAI()` wraps them for TUI use.\n */\n\nimport { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from '../device-code.js';\nimport type { DeviceCodePollOutcome, DeviceCodePollState } from '../device-code.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';\nconst DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code';\nconst TOKEN_URL = 'https://auth.x.ai/oauth2/token';\nconst SCOPE = 'openid profile email offline_access grok-cli:access api:access';\nconst DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\nconst REQUEST_TIMEOUT_MS = 30_000;\n// Refresh 5 minutes before actual expiry (same skew as Anthropic).\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nasync function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {\n  const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);\n  return fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams(params).toString(),\n    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,\n  });\n}\n\n/** The verification URI is opened by the user; only accept https URLs. */\nfunction validateVerificationUri(raw: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('xAI device authorization returned an invalid verification_uri');\n  }\n  if (parsed.protocol !== 'https:') {\n    throw new Error('xAI device authorization returned a non-https verification_uri');\n  }\n  return parsed.toString();\n}\n\nfunction credentialsFromTokenResponse(\n  data: unknown,\n  previousRefreshToken?: string,\n  previousIdToken?: string,\n): OAuthCredentials {\n  const record = (data ?? {}) as Record<string, unknown>;\n  const access = record.access_token;\n  if (typeof access !== 'string' || access.length === 0) {\n    throw new Error('xAI token response missing access_token');\n  }\n\n  // xAI may not rotate the refresh token on refresh; keep the previous one.\n  const refresh =\n    typeof record.refresh_token === 'string' && record.refresh_token.length > 0\n      ? record.refresh_token\n      : previousRefreshToken;\n  if (!refresh) {\n    throw new Error('xAI token response missing refresh_token');\n  }\n\n  const expiresIn =\n    typeof record.expires_in === 'number' && record.expires_in > 0\n      ? record.expires_in\n      : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;\n\n  return {\n    access,\n    refresh,\n    expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,\n    // Kept so the account label can resolve the email claim later; xAI's\n    // refresh responses re-issue it, and the previous one is carried forward\n    // when they don't.\n    idToken: typeof record.id_token === 'string' && record.id_token.length > 0 ? record.id_token : previousIdToken,\n  };\n}\n\n/**\n * Serializable pending state for an xAI device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests.\n */\nexport interface XAIDeviceLoginPending {\n  deviceCode: string;\n  userCode: string;\n  /** Verification URL for the user to open (https-only, validated). */\n  url: string;\n  instructions: string;\n  /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */\n  state: DeviceCodePollState;\n}\n\nexport type XAIDevicePollResult =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending: XAIDeviceLoginPending }\n  | { status: 'failed'; error: string };\n\n/**\n * Start an xAI device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startXAIDeviceLogin(options?: { signal?: AbortSignal }): Promise<XAIDeviceLoginPending> {\n  const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);\n\n  if (!response.ok) {\n    throw new Error(`Failed to initiate xAI device authorization: ${response.status}`);\n  }\n\n  const data = (await response.json()) as {\n    device_code?: string;\n    user_code?: string;\n    verification_uri?: string;\n    verification_uri_complete?: string;\n    interval?: number;\n    expires_in?: number;\n  };\n\n  if (!data.device_code || !data.user_code || !data.verification_uri) {\n    throw new Error('xAI device authorization response missing required fields');\n  }\n\n  const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);\n\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    url,\n    instructions: `Enter code: ${data.user_code}`,\n    state: createDeviceCodePollState({\n      intervalSeconds: data.interval,\n      expiresInSeconds: typeof data.expires_in === 'number' && data.expires_in > 0 ? data.expires_in : 600,\n    }),\n  };\n}\n\nasync function pollXAITokenOnce(\n  pending: XAIDeviceLoginPending,\n  signal?: AbortSignal,\n): Promise<DeviceCodePollOutcome<OAuthCredentials>> {\n  const response = await postForm(\n    TOKEN_URL,\n    {\n      grant_type: DEVICE_CODE_GRANT_TYPE,\n      device_code: pending.deviceCode,\n      client_id: CLIENT_ID,\n    },\n    signal,\n  );\n\n  if (response.ok) {\n    const data = (await response.json()) as unknown;\n    try {\n      return { status: 'complete', result: credentialsFromTokenResponse(data) };\n    } catch (error) {\n      return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n    }\n  }\n\n  const text = await response.text().catch(() => '');\n  let body: { error?: string; interval?: number } = {};\n  try {\n    body = JSON.parse(text) as { error?: string; interval?: number };\n  } catch {\n    // Non-JSON upstream bodies are intentionally omitted from user-visible errors.\n  }\n\n  switch (body.error) {\n    case 'authorization_pending':\n      return { status: 'pending', intervalSeconds: body.interval };\n    case 'slow_down':\n      return { status: 'slow_down', intervalSeconds: body.interval };\n    case 'access_denied':\n    case 'authorization_denied':\n      return { status: 'failed', error: 'xAI authorization was denied' };\n    case 'expired_token':\n      return { status: 'failed', error: 'xAI device code expired before authorization completed' };\n    default:\n      // Status only: `body.error` is untrusted upstream text (RFC 6749 does not\n      // constrain it), so echoing it would render provider-controlled content\n      // in the TUI. The known flow codes above are handled explicitly.\n      return {\n        status: 'failed',\n        error: `xAI device authorization failed: ${response.status}`,\n      };\n  }\n}\n\n/**\n * Perform exactly one upstream poll for a pending xAI device login.\n * Returns the updated pending state so callers (e.g. web routes) can persist\n * slow_down interval growth between polls. Never throws for flow-level\n * conditions.\n */\nexport async function pollXAIDeviceLogin(\n  pending: XAIDeviceLoginPending,\n  options?: { signal?: AbortSignal },\n): Promise<XAIDevicePollResult> {\n  const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));\n\n  switch (step.status) {\n    case 'complete':\n      return { status: 'complete', credentials: step.result };\n    case 'failed':\n      return { status: 'failed', error: step.error };\n    case 'pending':\n    case 'slow_down':\n      return {\n        status: 'pending',\n        nextPollMs: step.nextPollMs,\n        pending: { ...pending, state: step.state },\n      };\n  }\n}\n\n/**\n * Login with xAI OAuth (device-code flow), blocking until authorized.\n */\nexport async function loginXAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n  const pending = await startXAIDeviceLogin({ signal: callbacks.signal });\n\n  callbacks.onAuth({ url: pending.url, instructions: pending.instructions, userCode: pending.userCode });\n  callbacks.onProgress?.('Waiting for xAI device authorization...');\n\n  return pollDeviceCodeUntilComplete({\n    state: pending.state,\n    pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),\n    signal: callbacks.signal,\n  });\n}\n\n/**\n * Refresh xAI OAuth token\n */\nexport async function refreshXAIToken(\n  refreshToken: string,\n  signal?: AbortSignal,\n  previousIdToken?: string,\n): Promise<OAuthCredentials> {\n  const response = await postForm(\n    TOKEN_URL,\n    {\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    },\n    signal,\n  );\n\n  if (!response.ok) {\n    throw new Error(`xAI token refresh failed: ${response.status}`);\n  }\n\n  return credentialsFromTokenResponse((await response.json()) as unknown, refreshToken, previousIdToken);\n}\n\n/** Decode the email claim out of an id_token JWT payload (no verification). */\nfunction emailFromIdToken(idToken: string | undefined): string | undefined {\n  if (typeof idToken !== 'string') return undefined;\n  const parts = idToken.split('.');\n  if (parts.length !== 3) return undefined;\n  try {\n    const padded = (parts[1] ?? '').replace(/-/g, '+').replace(/_/g, '/');\n    const json = JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as { email?: unknown };\n    return typeof json.email === 'string' && json.email.length > 0 ? json.email : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport const xaiOAuthProvider: OAuthProviderInterface = {\n  id: 'xai',\n  name: 'xAI (Grok)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginXAI(callbacks);\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshXAIToken(credentials.refresh, undefined, credentials.idToken as string | undefined);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n\n  getAccountLabel(credentials: OAuthCredentials): Promise<string | undefined> {\n    return Promise.resolve(emailFromIdToken(credentials.idToken as string | undefined));\n  },\n\n  /**\n   * The account's email, read from the id token — one subscription per email,\n   * so this distinguishes two xAI accounts from a re-authorization of one.\n   */\n  getAccountIdentity(credentials: OAuthCredentials): string | undefined {\n    return emailFromIdToken(credentials.idToken as string | undefined);\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,qBAAqB;AAE3B,MAAM,kBAAkB,MAAS;AAEjC,eAAe,SAAS,KAAa,QAAgC,QAAyC;CAC5G,MAAM,gBAAgB,YAAY,QAAQ,kBAAkB;CAC5D,OAAO,MAAM,KAAK;EAChB,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB,MAAM,CAAC,CAAC,SAAS;EAC3C,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,aAAa,CAAC,IAAI;CAC9D,CAAC;AACH;;AAGA,SAAS,wBAAwB,KAAqB;CACpD,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,+DAA+D;CACjF;CACA,IAAI,OAAO,aAAa,UACtB,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO,OAAO,SAAS;AACzB;AAEA,SAAS,6BACP,MACA,sBACA,iBACkB;CAClB,MAAM,SAAU,QAAQ,CAAC;CACzB,MAAM,SAAS,OAAO;CACtB,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,MAAM,IAAI,MAAM,yCAAyC;CAI3D,MAAM,UACJ,OAAO,OAAO,kBAAkB,YAAY,OAAO,cAAc,SAAS,IACtE,OAAO,gBACP;CACN,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,YACJ,OAAO,OAAO,eAAe,YAAY,OAAO,aAAa,IACzD,OAAO,aACP;CAEN,OAAO;EACL;EACA;EACA,SAAS,KAAK,IAAI,IAAI,YAAY,MAAO;EAIzC,SAAS,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW;CACjG;AACF;;;;;AAyBA,eAAsB,oBAAoB,SAAoE;CAC5G,MAAM,WAAW,MAAM,SAAS,iBAAiB;EAAE,WAAW;EAAW,OAAO;CAAM,GAAG,SAAS,MAAM;CAExG,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,gDAAgD,SAAS,QAAQ;CAGnF,MAAM,OAAQ,MAAM,SAAS,KAAK;CASlC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,kBAChD,MAAM,IAAI,MAAM,2DAA2D;CAG7E,MAAM,MAAM,wBAAwB,KAAK,6BAA6B,KAAK,gBAAgB;CAE3F,OAAO;EACL,YAAY,KAAK;EACjB,UAAU,KAAK;EACf;EACA,cAAc,eAAe,KAAK;EAClC,OAAO,0BAA0B;GAC/B,iBAAiB,KAAK;GACtB,kBAAkB,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,IAAI,KAAK,aAAa;EACnG,CAAC;CACH;AACF;AAEA,eAAe,iBACb,SACA,QACkD;CAClD,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,aAAa,QAAQ;EACrB,WAAW;CACb,GACA,MACF;CAEA,IAAI,SAAS,IAAI;EACf,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,IAAI;GACF,OAAO;IAAE,QAAQ;IAAY,QAAQ,6BAA6B,IAAI;GAAE;EAC1E,SAAS,OAAO;GACd,OAAO;IAAE,QAAQ;IAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC3F;CACF;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,IAAI,OAA8C,CAAC;CACnD,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ,CAER;CAEA,QAAQ,KAAK,OAAb;EACE,KAAK,yBACH,OAAO;GAAE,QAAQ;GAAW,iBAAiB,KAAK;EAAS;EAC7D,KAAK,aACH,OAAO;GAAE,QAAQ;GAAa,iBAAiB,KAAK;EAAS;EAC/D,KAAK;EACL,KAAK,wBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAA+B;EACnE,KAAK,iBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAyD;EAC7F,SAIE,OAAO;GACL,QAAQ;GACR,OAAO,oCAAoC,SAAS;EACtD;CACJ;AACF;;;;;;;AAQA,eAAsB,mBACpB,SACA,SAC8B;CAC9B,MAAM,OAAO,MAAM,mBAAmB,QAAQ,aAAa,iBAAiB,SAAS,SAAS,MAAM,CAAC;CAErG,QAAQ,KAAK,QAAb;EACE,KAAK,YACH,OAAO;GAAE,QAAQ;GAAY,aAAa,KAAK;EAAO;EACxD,KAAK,UACH,OAAO;GAAE,QAAQ;GAAU,OAAO,KAAK;EAAM;EAC/C,KAAK;EACL,KAAK,aACH,OAAO;GACL,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,GAAG;IAAS,OAAO,KAAK;GAAM;EAC3C;CACJ;AACF;;;;AAKA,eAAsB,SAAS,WAA2D;CACxF,MAAM,UAAU,MAAM,oBAAoB,EAAE,QAAQ,UAAU,OAAO,CAAC;CAEtE,UAAU,OAAO;EAAE,KAAK,QAAQ;EAAK,cAAc,QAAQ;EAAc,UAAU,QAAQ;CAAS,CAAC;CACrG,UAAU,aAAa,yCAAyC;CAEhE,OAAO,4BAA4B;EACjC,OAAO,QAAQ;EACf,gBAAgB,iBAAiB,SAAS,UAAU,MAAM;EAC1D,QAAQ,UAAU;CACpB,CAAC;AACH;;;;AAKA,eAAsB,gBACpB,cACA,QACA,iBAC2B;CAC3B,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,WAAW;EACX,eAAe;CACjB,GACA,MACF;CAEA,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,6BAA6B,SAAS,QAAQ;CAGhE,OAAO,6BAA8B,MAAM,SAAS,KAAK,GAAe,cAAc,eAAe;AACvG;;AAGA,SAAS,iBAAiB,SAAiD;CACzE,IAAI,OAAO,YAAY,UAAU,OAAO,KAAA;CACxC,MAAM,QAAQ,QAAQ,MAAM,GAAG;CAC/B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;CAC/B,IAAI;EACF,MAAM,UAAU,MAAM,MAAM,GAAA,CAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACpE,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;EACtE,OAAO,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IAAI,KAAK,QAAQ,KAAA;CAChF,QAAQ;EACN;CACF;AACF;AAEA,MAAa,mBAA2C;CACtD,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,SAAS,SAAS;CAC3B;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,gBAAgB,YAAY,SAAS,KAAA,GAAW,YAAY,OAA6B;CAClG;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;CAEA,gBAAgB,aAA4D;EAC1E,OAAO,QAAQ,QAAQ,iBAAiB,YAAY,OAA6B,CAAC;CACpF;;;;;CAMA,mBAAmB,aAAmD;EACpE,OAAO,iBAAiB,YAAY,OAA6B;CACnE;AACF"}

package/dist/auth/storage.d.ts

@@ -0,0 +1,214 @@
+/**
+ * Credential storage for API keys and OAuth tokens.
+ * Handles loading, saving, and refreshing credentials from auth.json.
+ */
+import type { AuthCredential, OAuthAccountRecord, OAuthCredentialSnapshot, OAuthCredentials, OAuthLoginCallbacks, OAuthProviderId, OAuthProviderInterface } from './types.js';
+/**
+ * Best/default models for each OAuth provider.
+ * Used when auto-selecting a model after login.
+ */
+export declare const PROVIDER_DEFAULT_MODELS: Record<OAuthProviderId, string>;
+/**
+ * Get an OAuth provider by ID
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Get all registered OAuth providers
+ */
+export declare function getOAuthProviders(): OAuthProviderInterface[];
+/**
+ * Credential storage backed by a JSON file.
+ */
+export declare class AuthStorage {
+    private authPath;
+    private data;
+    private refreshPromises;
+    constructor(authPath?: string);
+    /**
+     * Reload credentials from disk.
+     */
+    reload(): void;
+    /**
+     * Bring auth.json up to the multi-account registry format. Runs on every
+     * load; saves only when something actually changed.
+     *
+     * 1. A legacy OAuth slot with no registry gets one adopted active entry
+     *    (the slot's tokens stay put — the entry mirrors them).
+     * 2. When the slot's refresh token differs from the active entry's, an
+     *    external writer (older build, another worktree) owns the slot — the
+     *    slot wins and its tokens are adopted onto the active entry.
+     * 3. A registry with no active entry (hand-edited) self-heals to its first
+     *    entry; malformed `accounts:` values are skipped, never fatal.
+     * 4. A registry whose legacy slot disappeared (partial write, an external
+     *    hand-edit) self-heals by mirroring the active entry's tokens back into
+     *    the slot, so `isLoggedIn()`/`getOAuthCredential()` keep agreeing with
+     *    `listAccounts()`. `remove()`/`logout()` clear the registry with the
+     *    slot, so they never leave the shape this heals.
+     */
+    private migrate;
+    /**
+     * Save credentials to disk.
+     */
+    private save;
+    /**
+     * Get credential for a provider. Registry entries (type 'oauth-account')
+     * live under `accounts:` keys and never surface here.
+     */
+    get(provider: string): AuthCredential | undefined;
+    /**
+     * Set credential for a provider.
+     */
+    set(provider: string, credential: AuthCredential): void;
+    /**
+     * Remove credential for a provider, including its account registry.
+     * Clearing only the slot would leave the registry behind, and the next
+     * load's migration would heal the slot back from it — resurrecting the
+     * provider the caller just signed out.
+     */
+    remove(provider: string): void;
+    /**
+     * List all providers with credentials.
+     */
+    list(): string[];
+    /**
+     * Check if credentials exist for a provider.
+     */
+    has(provider: string): boolean;
+    /**
+     * Check if logged in via OAuth for a provider.
+     */
+    isLoggedIn(provider: string): boolean;
+    /**
+     * Check if a stored API key exists for a provider.
+     * Keys are stored under `apikey:<provider>` in auth.json.
+     */
+    hasStoredApiKey(provider: string): boolean;
+    /**
+     * Get a stored API key for a provider, if any.
+     */
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Store an API key for a provider.
+     * Also sets the corresponding environment variable so model resolution can find it.
+     */
+    setStoredApiKey(provider: string, key: string, envVar?: string): void;
+    /**
+     * Load all stored API keys into process.env.
+     * Called at startup so model resolution can find stored keys.
+     * Only sets env vars that aren't already set (env vars take precedence).
+     */
+    loadStoredApiKeysIntoEnv(providerEnvVars: Record<string, string | undefined>): void;
+    /**
+     * Login to an OAuth provider. Resolves to the registered account record.
+     * Pass `activate: false` to add the account without making it active (the
+     * first account for a provider is always activated — a provider with
+     * accounts must have an active one).
+     */
+    login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks, opts?: {
+        replaceAccountId?: string;
+        activate?: boolean;
+    }): Promise<OAuthAccountRecord>;
+    /**
+     * Logout from a provider: remove the legacy slot and every registered account.
+     */
+    logout(provider: string): void;
+    private accountPrefixFor;
+    private accountKeyFor;
+    /** Registry entries for a provider in JSON insertion order (malformed values skipped). */
+    private accountEntries;
+    /** Adopt a legacy slot credential as the registry's first active entry. */
+    private adoptSlot;
+    /**
+     * Registered OAuth accounts for a provider, in insertion order. Copies —
+     * callers cannot corrupt unsaved storage state by mutating a record.
+     */
+    listAccounts(providerId: string): OAuthAccountRecord[];
+    /**
+     * The provider's active registry entry, if a registry exists. A copy.
+     */
+    getActiveAccount(providerId: string): OAuthAccountRecord | undefined;
+    /**
+     * Register OAuth credentials as an account for a provider, making it active
+     * unless `activate: false` is passed.
+     *
+     * With `replaceAccountId` (re-authentication of a picked account), the
+     * target entry's tokens are replaced in place — id re-keyed to the new
+     * refresh-token hash, label/position/addedAt preserved — because providers
+     * rotate refresh tokens per authorization, so the picked account's old id
+     * never matches the new token hash. Re-authentication keeps the target's
+     * active state: an inactive account stays inactive and the currently active
+     * account keeps the legacy slot. Otherwise, when the new credentials
+     * hash to an existing entry's id (same refresh token), that entry is
+     * updated in place; a genuinely new account is appended and activated.
+     *
+     * `activate: false` only applies to the plain add path: the new/updated entry
+     * keeps the active state it had, and the previously active account stays
+     * active. The first account of a provider is activated regardless.
+     */
+    addAccount(providerId: string, creds: OAuthCredentials, opts?: {
+        label?: string;
+        replaceAccountId?: string;
+        activate?: boolean;
+    }): Promise<OAuthAccountRecord>;
+    /**
+     * Activate an account: move the active tokens out of the legacy slot back
+     * into the previously active entry, and the target's tokens into the slot
+     * (never copy — one home per token set). With no `instanceId`, rotate to
+     * the next entry in insertion order, wrapping once to the front; returns
+     * undefined when there is no other entry to rotate to.
+     */
+    activateAccount(providerId: string, instanceId?: string): OAuthAccountRecord | undefined;
+    /**
+     * Activate an account in memory only — the caller owns reload/save. Move the
+     * active tokens out of the legacy slot back into the previously active
+     * entry, and the target's tokens into the slot (never copy — one home per
+     * token set). With no `instanceId`, rotate to the next entry in insertion
+     * order, wrapping once to the front; returns undefined when there is no
+     * other entry to rotate to.
+     */
+    private activateInMemory;
+    /**
+     * Remove an account from the registry. If it was active, the next entry in
+     * insertion order is activated; when it was the last one, the legacy slot
+     * is removed too (full sign-out for that provider).
+     */
+    removeAccount(providerId: string, instanceId: string): void;
+    /**
+     * Rename an account's label.
+     */
+    renameAccount(providerId: string, instanceId: string, label: string): void;
+    /**
+     * Persist refreshed credentials for the account that initiated the refresh.
+     * The legacy slot is updated only if that account is still active when the
+     * refresh completes; otherwise a delayed refresh could overwrite a newer
+     * activation.
+     */
+    private persistRefreshedCredential;
+    /**
+     * Refresh one account instance through the per-instance dedupe map. Used
+     * for sibling refreshes during the rotation walk, so a concurrent
+     * `getApiKey` that reloads storage mid-walk (after the candidate was
+     * activated but before its refresh resolves) joins the same refresh
+     * instead of double-spending a single-use refresh token.
+     */
+    private refreshInstance;
+    /**
+     * Get a ready-to-use OAuth credential snapshot, auto-refreshing if needed.
+     * A failed refresh leaves the active account unchanged and returns undefined;
+     * the account-rotation processor owns switching so it can persist a visible
+     * account-switch notice with the request that triggered the change.
+     */
+    getOAuthCredential(providerId: string, accountInstanceId?: string): Promise<OAuthCredentialSnapshot | undefined>;
+    /** Get API key for a provider, refreshing OAuth tokens if needed. */
+    getApiKey(providerId: string, accountInstanceId?: string): Promise<string | undefined>;
+    /**
+     * Force one refresh of the active OAuth account's tokens, regardless of
+     * expiry. The account-rotation error processor calls this when a provider
+     * rejects a not-yet-expired token (401/403) — server-side clock skew and
+     * refresh-token races surface that way. Returns the fresh access token, or
+     * undefined when the refresh fails or there is no OAuth credential.
+     * Shares the per-instance refresh dedupe with `getApiKey`.
+     */
+    forceRefreshActiveAccount(providerId: string, accountInstanceId?: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EACV,cAAc,EAEd,kBAAkB,EAElB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CASnE,CAAC;AAWF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,sBAAsB,GAAG,SAAS,CAExF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,sBAAsB,EAAE,CAE5D;AAyED;;GAEG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ;IAH5B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,eAAe,CAA4D;gBAE/D,QAAQ,GAAE,MAA2C;IAIzE;;OAEG;IACH,MAAM,IAAI,IAAI;IAad;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,OAAO;IAsFf;;OAEG;IACH,OAAO,CAAC,IAAI;IAmBZ;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAKjD;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI;IAMvD;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAU9B;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE;IAIhB;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKrC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAK1C;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAOrE;;;;OAIG;IACH,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI;IAWnF;;;;;OAKG;IACG,KAAK,CACT,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,mBAAmB,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACvD,OAAO,CAAC,kBAAkB,CAAC;IAa9B;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAQ9B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,aAAa;IAIrB,0FAA0F;IAC1F,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,OAAO,CAAC,SAAS;IAiBjB;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAItD;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAKpE;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACvE,OAAO,CAAC,kBAAkB,CAAC;IAyJ9B;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAOxF;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA+CxB;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA8B3D;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAS1E;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;OAMG;YACW,eAAe;IA2B7B;;;;;OAKG;IACG,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAsE/C,qEAAqE;IAC/D,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAc5F;;;;;;;OAOG;IACG,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA8C7G"}