@mastra/code-sdk 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/analytics.js

@@ -0,0 +1,163 @@
+import { randomUUID } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import os from "os";
+import path from "path";
+import { PostHog } from "posthog-node";
+//#region src/analytics.ts
+const POSTHOG_API_KEY = "phc_SBLpZVAB6jmHOct9CABq3PF0Yn5FU3G2FgT4xUr2XrT";
+const POSTHOG_HOST = "https://us.posthog.com";
+const MASTRA_SOURCE = "mastracode";
+const TRUTHY_DISABLED_VALUES = /* @__PURE__ */ new Set([
+	"1",
+	"true",
+	"yes",
+	"on"
+]);
+const ANALYTICS_CONFIG_PATH = path.join(os.homedir(), ".mastracode", "analytics.json");
+function createMastraAnalyticsDistinctId() {
+	return `mastra-${randomUUID()}`;
+}
+function isHostnameDerivedDistinctId(distinctId, hostname = os.hostname()) {
+	return distinctId === `mastra-${hostname}`;
+}
+function isValidMastraAnalyticsDistinctId(distinctId) {
+	return /^mastra-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(distinctId);
+}
+function writeAnalyticsConfig(distinctId, configPath = ANALYTICS_CONFIG_PATH) {
+	try {
+		mkdirSync(path.dirname(configPath), { recursive: true });
+		writeFileSync(configPath, JSON.stringify({ distinctId }));
+	} catch {}
+}
+function getMastraAnalyticsDistinctId(configPath = ANALYTICS_CONFIG_PATH) {
+	try {
+		if (existsSync(configPath)) {
+			const config = JSON.parse(readFileSync(configPath, "utf-8"));
+			if (config.distinctId && isValidMastraAnalyticsDistinctId(config.distinctId) && !isHostnameDerivedDistinctId(config.distinctId)) return config.distinctId;
+		}
+	} catch {}
+	const distinctId = createMastraAnalyticsDistinctId();
+	writeAnalyticsConfig(distinctId, configPath);
+	return distinctId;
+}
+function isAnalyticsDebugEnabled() {
+	return TRUTHY_DISABLED_VALUES.has(process.env.MASTRACODE_ANALYTICS_DEBUG?.trim().toLowerCase() ?? "");
+}
+function debugAnalytics(message, properties) {
+	if (!isAnalyticsDebugEnabled()) return;
+	const suffix = properties ? ` ${JSON.stringify(properties)}` : "";
+	process.stderr.write(`[mastracode analytics] ${message}${suffix}\n`);
+}
+var NoopMastraCodeAnalytics = class {
+	capture(event) {
+		debugAnalytics("capture skipped: telemetry disabled", { event });
+	}
+	trackCommand(command) {
+		debugAnalytics("command skipped: telemetry disabled", { command });
+	}
+	trackInteractivePrompt(promptType) {
+		debugAnalytics("interactive prompt skipped: telemetry disabled", { promptType });
+	}
+	async shutdown() {
+		debugAnalytics("shutdown skipped: telemetry disabled");
+	}
+	isEnabled() {
+		return false;
+	}
+};
+var PostHogMastraCodeAnalytics = class {
+	client;
+	distinctId;
+	sessionId = randomUUID();
+	version;
+	constructor({ version, apiKey = POSTHOG_API_KEY, host = POSTHOG_HOST }) {
+		this.version = version;
+		this.distinctId = getMastraAnalyticsDistinctId();
+		this.client = new PostHog(apiKey, {
+			host,
+			flushAt: 1,
+			flushInterval: 0,
+			disableGeoip: false
+		});
+		this.client.register({ mastraSource: MASTRA_SOURCE });
+		debugAnalytics("enabled", {
+			host,
+			distinctId: this.distinctId,
+			version
+		});
+	}
+	capture(event, properties) {
+		try {
+			const eventProperties = {
+				...this.getBaseProperties(),
+				...properties
+			};
+			debugAnalytics("capture", {
+				event,
+				properties: eventProperties
+			});
+			this.client.capture({
+				distinctId: this.distinctId,
+				event,
+				properties: eventProperties
+			});
+		} catch (error) {
+			debugAnalytics("capture failed", {
+				event,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	trackCommand(command, properties) {
+		this.capture("mastracode_command_used", {
+			command,
+			...properties
+		});
+	}
+	trackInteractivePrompt(promptType, properties) {
+		this.capture("mastracode_interactive_prompt_shown", {
+			promptType,
+			...properties
+		});
+	}
+	async shutdown() {
+		try {
+			debugAnalytics("shutdown start");
+			await this.client.shutdown();
+			debugAnalytics("shutdown complete");
+		} catch (error) {
+			debugAnalytics("shutdown failed", { error: error instanceof Error ? error.message : String(error) });
+		}
+	}
+	isEnabled() {
+		return true;
+	}
+	getBaseProperties() {
+		return {
+			mastraSource: MASTRA_SOURCE,
+			sessionId: this.sessionId,
+			version: this.version,
+			os: process.platform,
+			osVersion: os.release(),
+			nodeVersion: process.version,
+			platform: process.arch,
+			machineId: os.hostname()
+		};
+	}
+};
+function isTelemetryDisabled(env = process.env) {
+	const value = env.MASTRA_TELEMETRY_DISABLED;
+	if (!value) return false;
+	return TRUTHY_DISABLED_VALUES.has(value.trim().toLowerCase());
+}
+function createMastraCodeAnalytics(options) {
+	if (isTelemetryDisabled()) {
+		debugAnalytics("disabled by MASTRA_TELEMETRY_DISABLED", { value: process.env.MASTRA_TELEMETRY_DISABLED });
+		return new NoopMastraCodeAnalytics();
+	}
+	return new PostHogMastraCodeAnalytics(options);
+}
+//#endregion
+export { createMastraCodeAnalytics, getMastraAnalyticsDistinctId, isTelemetryDisabled };
+
+//# sourceMappingURL=analytics.js.map

package/dist/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.js","names":[],"sources":["../src/analytics.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { PostHog } from 'posthog-node';\n\nconst POSTHOG_API_KEY = 'phc_SBLpZVAB6jmHOct9CABq3PF0Yn5FU3G2FgT4xUr2XrT';\nconst POSTHOG_HOST = 'https://us.posthog.com';\nconst MASTRA_SOURCE = 'mastracode';\nconst TRUTHY_DISABLED_VALUES = new Set(['1', 'true', 'yes', 'on']);\nconst ANALYTICS_CONFIG_PATH = path.join(os.homedir(), '.mastracode', 'analytics.json');\n\ninterface AnalyticsConfig {\n  distinctId?: string;\n}\n\nfunction createMastraAnalyticsDistinctId(): string {\n  return `mastra-${randomUUID()}`;\n}\n\nfunction isHostnameDerivedDistinctId(distinctId: string, hostname = os.hostname()): boolean {\n  return distinctId === `mastra-${hostname}`;\n}\n\nfunction isValidMastraAnalyticsDistinctId(distinctId: string): boolean {\n  return /^mastra-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(distinctId);\n}\n\nfunction writeAnalyticsConfig(distinctId: string, configPath = ANALYTICS_CONFIG_PATH): void {\n  try {\n    mkdirSync(path.dirname(configPath), { recursive: true });\n    writeFileSync(configPath, JSON.stringify({ distinctId }));\n  } catch {\n    // swallow analytics persistence errors\n  }\n}\n\nexport function getMastraAnalyticsDistinctId(configPath = ANALYTICS_CONFIG_PATH): string {\n  try {\n    if (existsSync(configPath)) {\n      const config = JSON.parse(readFileSync(configPath, 'utf-8')) as AnalyticsConfig;\n      if (\n        config.distinctId &&\n        isValidMastraAnalyticsDistinctId(config.distinctId) &&\n        !isHostnameDerivedDistinctId(config.distinctId)\n      ) {\n        return config.distinctId;\n      }\n    }\n  } catch {\n    // regenerate below\n  }\n\n  const distinctId = createMastraAnalyticsDistinctId();\n  writeAnalyticsConfig(distinctId, configPath);\n  return distinctId;\n}\n\nfunction isAnalyticsDebugEnabled(): boolean {\n  return TRUTHY_DISABLED_VALUES.has(process.env.MASTRACODE_ANALYTICS_DEBUG?.trim().toLowerCase() ?? '');\n}\n\nfunction debugAnalytics(message: string, properties?: Record<string, unknown>): void {\n  if (!isAnalyticsDebugEnabled()) {\n    return;\n  }\n\n  const suffix = properties ? ` ${JSON.stringify(properties)}` : '';\n  process.stderr.write(`[mastracode analytics] ${message}${suffix}\\n`);\n}\n\nexport type MastraCodeAnalyticsEvent =\n  | 'mastracode_session_started'\n  | 'mastracode_prompt_submitted'\n  | 'mastracode_thread_changed'\n  | 'mastracode_model_changed'\n  | 'mastracode_command_used'\n  | 'mastracode_interactive_prompt_shown';\n\nexport interface MastraCodeAnalytics {\n  capture(event: MastraCodeAnalyticsEvent, properties?: Record<string, unknown>): void;\n  trackCommand(command: string, properties?: Record<string, unknown>): void;\n  trackInteractivePrompt(promptType: string, properties?: Record<string, unknown>): void;\n  shutdown(): Promise<void>;\n  isEnabled(): boolean;\n}\n\ninterface MastraCodeAnalyticsOptions {\n  version: string;\n  host?: string;\n  apiKey?: string;\n}\n\nclass NoopMastraCodeAnalytics implements MastraCodeAnalytics {\n  capture(event: MastraCodeAnalyticsEvent): void {\n    debugAnalytics('capture skipped: telemetry disabled', { event });\n  }\n  trackCommand(command: string): void {\n    debugAnalytics('command skipped: telemetry disabled', { command });\n  }\n  trackInteractivePrompt(promptType: string): void {\n    debugAnalytics('interactive prompt skipped: telemetry disabled', { promptType });\n  }\n  async shutdown(): Promise<void> {\n    debugAnalytics('shutdown skipped: telemetry disabled');\n  }\n  isEnabled(): boolean {\n    return false;\n  }\n}\n\nclass PostHogMastraCodeAnalytics implements MastraCodeAnalytics {\n  private readonly client: PostHog;\n  private readonly distinctId: string;\n  private readonly sessionId = randomUUID();\n  private readonly version: string;\n\n  constructor({ version, apiKey = POSTHOG_API_KEY, host = POSTHOG_HOST }: MastraCodeAnalyticsOptions) {\n    this.version = version;\n    this.distinctId = getMastraAnalyticsDistinctId();\n    this.client = new PostHog(apiKey, {\n      host,\n      flushAt: 1,\n      flushInterval: 0,\n      disableGeoip: false,\n    });\n    this.client.register({ mastraSource: MASTRA_SOURCE });\n    debugAnalytics('enabled', { host, distinctId: this.distinctId, version });\n  }\n\n  capture(event: MastraCodeAnalyticsEvent, properties?: Record<string, unknown>): void {\n    try {\n      const eventProperties = {\n        ...this.getBaseProperties(),\n        ...properties,\n      };\n      debugAnalytics('capture', { event, properties: eventProperties });\n      this.client.capture({\n        distinctId: this.distinctId,\n        event,\n        properties: eventProperties,\n      });\n    } catch (error) {\n      debugAnalytics('capture failed', { event, error: error instanceof Error ? error.message : String(error) });\n      // swallow analytics errors\n    }\n  }\n\n  trackCommand(command: string, properties?: Record<string, unknown>): void {\n    this.capture('mastracode_command_used', { command, ...properties });\n  }\n\n  trackInteractivePrompt(promptType: string, properties?: Record<string, unknown>): void {\n    this.capture('mastracode_interactive_prompt_shown', { promptType, ...properties });\n  }\n\n  async shutdown(): Promise<void> {\n    try {\n      debugAnalytics('shutdown start');\n      await this.client.shutdown();\n      debugAnalytics('shutdown complete');\n    } catch (error) {\n      debugAnalytics('shutdown failed', { error: error instanceof Error ? error.message : String(error) });\n      // swallow analytics errors\n    }\n  }\n\n  isEnabled(): boolean {\n    return true;\n  }\n\n  private getBaseProperties(): Record<string, unknown> {\n    return {\n      mastraSource: MASTRA_SOURCE,\n      sessionId: this.sessionId,\n      version: this.version,\n      os: process.platform,\n      osVersion: os.release(),\n      nodeVersion: process.version,\n      platform: process.arch,\n      machineId: os.hostname(),\n    };\n  }\n}\n\nexport function isTelemetryDisabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  const value = env.MASTRA_TELEMETRY_DISABLED;\n  if (!value) {\n    return false;\n  }\n\n  return TRUTHY_DISABLED_VALUES.has(value.trim().toLowerCase());\n}\n\nexport function createMastraCodeAnalytics(options: MastraCodeAnalyticsOptions): MastraCodeAnalytics {\n  if (isTelemetryDisabled()) {\n    debugAnalytics('disabled by MASTRA_TELEMETRY_DISABLED', { value: process.env.MASTRA_TELEMETRY_DISABLED });\n    return new NoopMastraCodeAnalytics();\n  }\n\n  return new PostHogMastraCodeAnalytics(options);\n}\n"],"mappings":";;;;;;AAOA,MAAM,kBAAkB;AACxB,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,yCAAyB,IAAI,IAAI;CAAC;CAAK;CAAQ;CAAO;AAAI,CAAC;AACjE,MAAM,wBAAwB,KAAK,KAAK,GAAG,QAAQ,GAAG,eAAe,gBAAgB;AAMrF,SAAS,kCAA0C;CACjD,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,4BAA4B,YAAoB,WAAW,GAAG,SAAS,GAAY;CAC1F,OAAO,eAAe,UAAU;AAClC;AAEA,SAAS,iCAAiC,YAA6B;CACrE,OAAO,yEAAyE,KAAK,UAAU;AACjG;AAEA,SAAS,qBAAqB,YAAoB,aAAa,uBAA6B;CAC1F,IAAI;EACF,UAAU,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,cAAc,YAAY,KAAK,UAAU,EAAE,WAAW,CAAC,CAAC;CAC1D,QAAQ,CAER;AACF;AAEA,SAAgB,6BAA6B,aAAa,uBAA+B;CACvF,IAAI;EACF,IAAI,WAAW,UAAU,GAAG;GAC1B,MAAM,SAAS,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;GAC3D,IACE,OAAO,cACP,iCAAiC,OAAO,UAAU,KAClD,CAAC,4BAA4B,OAAO,UAAU,GAE9C,OAAO,OAAO;EAElB;CACF,QAAQ,CAER;CAEA,MAAM,aAAa,gCAAgC;CACnD,qBAAqB,YAAY,UAAU;CAC3C,OAAO;AACT;AAEA,SAAS,0BAAmC;CAC1C,OAAO,uBAAuB,IAAI,QAAQ,IAAI,4BAA4B,KAAK,CAAC,CAAC,YAAY,KAAK,EAAE;AACtG;AAEA,SAAS,eAAe,SAAiB,YAA4C;CACnF,IAAI,CAAC,wBAAwB,GAC3B;CAGF,MAAM,SAAS,aAAa,IAAI,KAAK,UAAU,UAAU,MAAM;CAC/D,QAAQ,OAAO,MAAM,0BAA0B,UAAU,OAAO,GAAG;AACrE;AAwBA,IAAM,0BAAN,MAA6D;CAC3D,QAAQ,OAAuC;EAC7C,eAAe,uCAAuC,EAAE,MAAM,CAAC;CACjE;CACA,aAAa,SAAuB;EAClC,eAAe,uCAAuC,EAAE,QAAQ,CAAC;CACnE;CACA,uBAAuB,YAA0B;EAC/C,eAAe,kDAAkD,EAAE,WAAW,CAAC;CACjF;CACA,MAAM,WAA0B;EAC9B,eAAe,sCAAsC;CACvD;CACA,YAAqB;EACnB,OAAO;CACT;AACF;AAEA,IAAM,6BAAN,MAAgE;CAC9D;CACA;CACA,YAA6B,WAAW;CACxC;CAEA,YAAY,EAAE,SAAS,SAAS,iBAAiB,OAAO,gBAA4C;EAClG,KAAK,UAAU;EACf,KAAK,aAAa,6BAA6B;EAC/C,KAAK,SAAS,IAAI,QAAQ,QAAQ;GAChC;GACA,SAAS;GACT,eAAe;GACf,cAAc;EAChB,CAAC;EACD,KAAK,OAAO,SAAS,EAAE,cAAc,cAAc,CAAC;EACpD,eAAe,WAAW;GAAE;GAAM,YAAY,KAAK;GAAY;EAAQ,CAAC;CAC1E;CAEA,QAAQ,OAAiC,YAA4C;EACnF,IAAI;GACF,MAAM,kBAAkB;IACtB,GAAG,KAAK,kBAAkB;IAC1B,GAAG;GACL;GACA,eAAe,WAAW;IAAE;IAAO,YAAY;GAAgB,CAAC;GAChE,KAAK,OAAO,QAAQ;IAClB,YAAY,KAAK;IACjB;IACA,YAAY;GACd,CAAC;EACH,SAAS,OAAO;GACd,eAAe,kBAAkB;IAAE;IAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE,CAAC;EAE3G;CACF;CAEA,aAAa,SAAiB,YAA4C;EACxE,KAAK,QAAQ,2BAA2B;GAAE;GAAS,GAAG;EAAW,CAAC;CACpE;CAEA,uBAAuB,YAAoB,YAA4C;EACrF,KAAK,QAAQ,uCAAuC;GAAE;GAAY,GAAG;EAAW,CAAC;CACnF;CAEA,MAAM,WAA0B;EAC9B,IAAI;GACF,eAAe,gBAAgB;GAC/B,MAAM,KAAK,OAAO,SAAS;GAC3B,eAAe,mBAAmB;EACpC,SAAS,OAAO;GACd,eAAe,mBAAmB,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;EAErG;CACF;CAEA,YAAqB;EACnB,OAAO;CACT;CAEA,oBAAqD;EACnD,OAAO;GACL,cAAc;GACd,WAAW,KAAK;GAChB,SAAS,KAAK;GACd,IAAI,QAAQ;GACZ,WAAW,GAAG,QAAQ;GACtB,aAAa,QAAQ;GACrB,UAAU,QAAQ;GAClB,WAAW,GAAG,SAAS;EACzB;CACF;AACF;AAEA,SAAgB,oBAAoB,MAAyB,QAAQ,KAAc;CACjF,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,uBAAuB,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC9D;AAEA,SAAgB,0BAA0B,SAA0D;CAClG,IAAI,oBAAoB,GAAG;EACzB,eAAe,yCAAyC,EAAE,OAAO,QAAQ,IAAI,0BAA0B,CAAC;EACxG,OAAO,IAAI,wBAAwB;CACrC;CAEA,OAAO,IAAI,2BAA2B,OAAO;AAC/C"}

package/dist/auth/authorization-input.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Forgiving parser for user-pasted OAuth authorization input.
+ *
+ * Accepts, in order of preference:
+ *   - a full redirect URL (`https://.../callback?code=...&state=...`)
+ *   - the `code#state` form shown on Anthropic's hosted callback page
+ *   - a raw query string (`code=...&state=...`)
+ *   - a bare authorization code
+ *
+ * Ported from pi-mono's `parseAuthorizationInput`.
+ */
+export declare function parseAuthorizationInput(input: string): {
+    code?: string;
+    state?: string;
+};
+//# sourceMappingURL=authorization-input.d.ts.map

package/dist/auth/authorization-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-input.d.ts","sourceRoot":"","sources":["../../src/auth/authorization-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CA4BA"}

package/dist/auth/authorization-input.js

@@ -0,0 +1,42 @@
+//#region src/auth/authorization-input.ts
+/**
+* Forgiving parser for user-pasted OAuth authorization input.
+*
+* Accepts, in order of preference:
+*   - a full redirect URL (`https://.../callback?code=...&state=...`)
+*   - the `code#state` form shown on Anthropic's hosted callback page
+*   - a raw query string (`code=...&state=...`)
+*   - a bare authorization code
+*
+* Ported from pi-mono's `parseAuthorizationInput`.
+*/
+function parseAuthorizationInput(input) {
+	const value = input.trim();
+	if (!value) return {};
+	try {
+		const url = new URL(value);
+		return {
+			code: url.searchParams.get("code") ?? void 0,
+			state: url.searchParams.get("state") ?? void 0
+		};
+	} catch {}
+	if (value.includes("#")) {
+		const [code, state] = value.split("#", 2);
+		return {
+			code,
+			state
+		};
+	}
+	if (value.includes("code=")) {
+		const params = new URLSearchParams(value);
+		return {
+			code: params.get("code") ?? void 0,
+			state: params.get("state") ?? void 0
+		};
+	}
+	return { code: value };
+}
+//#endregion
+export { parseAuthorizationInput };
+
+//# sourceMappingURL=authorization-input.js.map

package/dist/auth/authorization-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-input.js","names":[],"sources":["../../src/auth/authorization-input.ts"],"sourcesContent":["/**\n * Forgiving parser for user-pasted OAuth authorization input.\n *\n * Accepts, in order of preference:\n *   - a full redirect URL (`https://.../callback?code=...&state=...`)\n *   - the `code#state` form shown on Anthropic's hosted callback page\n *   - a raw query string (`code=...&state=...`)\n *   - a bare authorization code\n *\n * Ported from pi-mono's `parseAuthorizationInput`.\n */\nexport function parseAuthorizationInput(input: string): {\n  code?: string;\n  state?: string;\n} {\n  const value = input.trim();\n  if (!value) return {};\n\n  try {\n    const url = new URL(value);\n    return {\n      code: url.searchParams.get('code') ?? undefined,\n      state: url.searchParams.get('state') ?? undefined,\n    };\n  } catch {\n    // not a URL\n  }\n\n  if (value.includes('#')) {\n    const [code, state] = value.split('#', 2);\n    return { code, state };\n  }\n\n  if (value.includes('code=')) {\n    const params = new URLSearchParams(value);\n    return {\n      code: params.get('code') ?? undefined,\n      state: params.get('state') ?? undefined,\n    };\n  }\n\n  return { code: value };\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,wBAAwB,OAGtC;CACA,MAAM,QAAQ,MAAM,KAAK;CACzB,IAAI,CAAC,OAAO,OAAO,CAAC;CAEpB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,OAAO;GACL,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK,KAAA;EAC1C;CACF,QAAQ,CAER;CAEA,IAAI,MAAM,SAAS,GAAG,GAAG;EACvB,MAAM,CAAC,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;EACxC,OAAO;GAAE;GAAM;EAAM;CACvB;CAEA,IAAI,MAAM,SAAS,OAAO,GAAG;EAC3B,MAAM,SAAS,IAAI,gBAAgB,KAAK;EACxC,OAAO;GACL,MAAM,OAAO,IAAI,MAAM,KAAK,KAAA;GAC5B,OAAO,OAAO,IAAI,OAAO,KAAK,KAAA;EAChC;CACF;CAEA,OAAO,EAAE,MAAM,MAAM;AACvB"}

package/dist/auth/device-code.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Generic RFC 8628 (OAuth 2.0 Device Authorization Grant) polling helpers.
+ *
+ * Ported from pi-mono's device-code utility, restructured as a single-step
+ * API so the same poll semantics can be driven two ways:
+ *   - `pollDeviceCodeUntilComplete()` — blocking loop for TUI flows.
+ *   - `stepDeviceCodePoll()` — exactly one upstream poll per call, with a
+ *     JSON-serializable `DeviceCodePollState` so web routes can persist the
+ *     state between HTTP requests (any replica can continue the poll).
+ *
+ * Inspired by pi-mono:
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/device-code.ts
+ */
+/**
+ * Serializable poll-loop state. Safe to round-trip through JSON (e.g. a
+ * `pending jsonb` column) so device-code polling can span HTTP requests.
+ */
+export interface DeviceCodePollState {
+    /** ms epoch after which the device authorization is considered expired. */
+    deadlineAt: number;
+    /** Current base poll interval in ms (grows on slow_down responses). */
+    intervalMs: number;
+    /** Number of slow_down responses observed so far. */
+    slowDownResponses: number;
+}
+export declare function createDeviceCodePollState(options: {
+    /** Poll interval suggested by the server, in seconds. Defaults to 5 (RFC 8628). */
+    intervalSeconds?: number;
+    /** Lifetime of the device code, in seconds. */
+    expiresInSeconds: number;
+    /** Override "now" for tests. */
+    now?: number;
+}): DeviceCodePollState;
+/**
+ * Classified result of one upstream token-endpoint poll. Providers implement
+ * the HTTP request and map their response shape onto this union.
+ */
+export type DeviceCodePollOutcome<T> = {
+    status: 'complete';
+    result: T;
+} | {
+    status: 'pending';
+    intervalSeconds?: number;
+} | {
+    status: 'slow_down';
+    intervalSeconds?: number;
+} | {
+    status: 'failed';
+    error: string;
+};
+export type DeviceCodeStepResult<T> = {
+    status: 'complete';
+    result: T;
+    state: DeviceCodePollState;
+} | {
+    status: 'pending';
+    nextPollMs: number;
+    state: DeviceCodePollState;
+} | {
+    status: 'slow_down';
+    nextPollMs: number;
+    state: DeviceCodePollState;
+} | {
+    status: 'failed';
+    error: string;
+    state: DeviceCodePollState;
+};
+/**
+ * Delay to wait before the next poll, honoring slow_down growth and clamped
+ * to the remaining lifetime of the device code.
+ */
+export declare function nextPollDelayMs(state: DeviceCodePollState, now?: number): number;
+/**
+ * Perform exactly one upstream poll and fold the outcome into the poll state.
+ * Never throws for flow-level conditions — timeouts and provider errors are
+ * reported as `{ status: 'failed' }` so callers can persist/report them.
+ */
+export declare function stepDeviceCodePoll<T>(state: DeviceCodePollState, pollOnce: () => Promise<DeviceCodePollOutcome<T>>, now?: number): Promise<DeviceCodeStepResult<T>>;
+/** Sleep that can be interrupted by an AbortSignal. */
+export declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * Blocking poll loop for TUI flows: waits the appropriate interval between
+ * polls, honors slow_down growth, aborts on the signal, and throws on
+ * failure/timeout (with a clock-drift hint after slow_down responses).
+ */
+export declare function pollDeviceCodeUntilComplete<T>(options: {
+    state: DeviceCodePollState;
+    pollOnce: () => Promise<DeviceCodePollOutcome<T>>;
+    signal?: AbortSignal;
+    /** Override the sleep implementation for tests. */
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}): Promise<T>;
+//# sourceMappingURL=device-code.d.ts.map

package/dist/auth/device-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.d.ts","sourceRoot":"","sources":["../../src/auth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,mBAAmB,CAWtB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAC/B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,oBAAoB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAWpE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAK5F;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EACjD,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAiClC;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB9E;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,OAAO,EAAE;IAC5D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,CAAC,CAAC,CAwBb"}

package/dist/auth/device-code.js

@@ -0,0 +1,129 @@
+//#region src/auth/device-code.ts
+/**
+* Generic RFC 8628 (OAuth 2.0 Device Authorization Grant) polling helpers.
+*
+* Ported from pi-mono's device-code utility, restructured as a single-step
+* API so the same poll semantics can be driven two ways:
+*   - `pollDeviceCodeUntilComplete()` — blocking loop for TUI flows.
+*   - `stepDeviceCodePoll()` — exactly one upstream poll per call, with a
+*     JSON-serializable `DeviceCodePollState` so web routes can persist the
+*     state between HTTP requests (any replica can continue the poll).
+*
+* Inspired by pi-mono:
+* https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/device-code.ts
+*/
+const DEFAULT_INTERVAL_SECONDS = 5;
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5e3;
+function createDeviceCodePollState(options) {
+	const now = options.now ?? Date.now();
+	const intervalSeconds = typeof options.intervalSeconds === "number" && options.intervalSeconds > 0 ? options.intervalSeconds : DEFAULT_INTERVAL_SECONDS;
+	return {
+		deadlineAt: now + options.expiresInSeconds * 1e3,
+		intervalMs: Math.max(1e3, Math.floor(intervalSeconds * 1e3)),
+		slowDownResponses: 0
+	};
+}
+function timeoutMessage(state) {
+	if (state.slowDownResponses > 0) return "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+	return "Device flow timed out";
+}
+/**
+* Delay to wait before the next poll, honoring slow_down growth and clamped
+* to the remaining lifetime of the device code.
+*/
+function nextPollDelayMs(state, now = Date.now()) {
+	const multiplier = state.slowDownResponses > 0 ? SLOW_DOWN_POLL_INTERVAL_MULTIPLIER : INITIAL_POLL_INTERVAL_MULTIPLIER;
+	const remainingMs = Math.max(0, state.deadlineAt - now);
+	return Math.min(Math.ceil(state.intervalMs * multiplier), remainingMs);
+}
+/**
+* Perform exactly one upstream poll and fold the outcome into the poll state.
+* Never throws for flow-level conditions — timeouts and provider errors are
+* reported as `{ status: 'failed' }` so callers can persist/report them.
+*/
+async function stepDeviceCodePoll(state, pollOnce, now = Date.now()) {
+	if (now >= state.deadlineAt) return {
+		status: "failed",
+		error: timeoutMessage(state),
+		state
+	};
+	const outcome = await pollOnce();
+	switch (outcome.status) {
+		case "complete": return {
+			status: "complete",
+			result: outcome.result,
+			state
+		};
+		case "failed": return {
+			status: "failed",
+			error: outcome.error,
+			state
+		};
+		case "slow_down": {
+			const next = {
+				...state,
+				slowDownResponses: state.slowDownResponses + 1,
+				intervalMs: typeof outcome.intervalSeconds === "number" && outcome.intervalSeconds > 0 ? outcome.intervalSeconds * 1e3 : Math.max(1e3, state.intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS)
+			};
+			return {
+				status: "slow_down",
+				nextPollMs: nextPollDelayMs(next, now),
+				state: next
+			};
+		}
+		case "pending": {
+			const next = typeof outcome.intervalSeconds === "number" && outcome.intervalSeconds > 0 ? {
+				...state,
+				intervalMs: Math.max(1e3, outcome.intervalSeconds * 1e3)
+			} : state;
+			return {
+				status: "pending",
+				nextPollMs: nextPollDelayMs(next, now),
+				state: next
+			};
+		}
+	}
+}
+/** Sleep that can be interrupted by an AbortSignal. */
+function abortableSleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+			return;
+		}
+		let timeout;
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+		};
+		timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
+* Blocking poll loop for TUI flows: waits the appropriate interval between
+* polls, honors slow_down growth, aborts on the signal, and throws on
+* failure/timeout (with a clock-drift hint after slow_down responses).
+*/
+async function pollDeviceCodeUntilComplete(options) {
+	let state = options.state;
+	const sleep = options.sleep ?? abortableSleep;
+	while (true) {
+		if (options.signal?.aborted) throw new Error("Login cancelled");
+		if (Date.now() >= state.deadlineAt) throw new Error(timeoutMessage(state));
+		await sleep(nextPollDelayMs(state), options.signal);
+		const step = await stepDeviceCodePoll(state, options.pollOnce);
+		state = step.state;
+		if (step.status === "complete") return step.result;
+		if (step.status === "failed") throw new Error(step.error);
+	}
+}
+//#endregion
+export { abortableSleep, createDeviceCodePollState, nextPollDelayMs, pollDeviceCodeUntilComplete, stepDeviceCodePoll };
+
+//# sourceMappingURL=device-code.js.map

package/dist/auth/device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.js","names":[],"sources":["../../src/auth/device-code.ts"],"sourcesContent":["/**\n * Generic RFC 8628 (OAuth 2.0 Device Authorization Grant) polling helpers.\n *\n * Ported from pi-mono's device-code utility, restructured as a single-step\n * API so the same poll semantics can be driven two ways:\n *   - `pollDeviceCodeUntilComplete()` — blocking loop for TUI flows.\n *   - `stepDeviceCodePoll()` — exactly one upstream poll per call, with a\n *     JSON-serializable `DeviceCodePollState` so web routes can persist the\n *     state between HTTP requests (any replica can continue the poll).\n *\n * Inspired by pi-mono:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/device-code.ts\n */\n\nconst DEFAULT_INTERVAL_SECONDS = 5;\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\nconst SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;\n\n/**\n * Serializable poll-loop state. Safe to round-trip through JSON (e.g. a\n * `pending jsonb` column) so device-code polling can span HTTP requests.\n */\nexport interface DeviceCodePollState {\n  /** ms epoch after which the device authorization is considered expired. */\n  deadlineAt: number;\n  /** Current base poll interval in ms (grows on slow_down responses). */\n  intervalMs: number;\n  /** Number of slow_down responses observed so far. */\n  slowDownResponses: number;\n}\n\nexport function createDeviceCodePollState(options: {\n  /** Poll interval suggested by the server, in seconds. Defaults to 5 (RFC 8628). */\n  intervalSeconds?: number;\n  /** Lifetime of the device code, in seconds. */\n  expiresInSeconds: number;\n  /** Override \"now\" for tests. */\n  now?: number;\n}): DeviceCodePollState {\n  const now = options.now ?? Date.now();\n  const intervalSeconds =\n    typeof options.intervalSeconds === 'number' && options.intervalSeconds > 0\n      ? options.intervalSeconds\n      : DEFAULT_INTERVAL_SECONDS;\n  return {\n    deadlineAt: now + options.expiresInSeconds * 1000,\n    intervalMs: Math.max(1000, Math.floor(intervalSeconds * 1000)),\n    slowDownResponses: 0,\n  };\n}\n\n/**\n * Classified result of one upstream token-endpoint poll. Providers implement\n * the HTTP request and map their response shape onto this union.\n */\nexport type DeviceCodePollOutcome<T> =\n  | { status: 'complete'; result: T }\n  | { status: 'pending'; intervalSeconds?: number }\n  | { status: 'slow_down'; intervalSeconds?: number }\n  | { status: 'failed'; error: string };\n\nexport type DeviceCodeStepResult<T> =\n  | { status: 'complete'; result: T; state: DeviceCodePollState }\n  | { status: 'pending'; nextPollMs: number; state: DeviceCodePollState }\n  | { status: 'slow_down'; nextPollMs: number; state: DeviceCodePollState }\n  | { status: 'failed'; error: string; state: DeviceCodePollState };\n\nfunction timeoutMessage(state: DeviceCodePollState): string {\n  if (state.slowDownResponses > 0) {\n    // Repeated slow_down responses followed by a timeout usually means the\n    // local clock is behind the server's (common in WSL/VMs after sleep).\n    return 'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.';\n  }\n  return 'Device flow timed out';\n}\n\n/**\n * Delay to wait before the next poll, honoring slow_down growth and clamped\n * to the remaining lifetime of the device code.\n */\nexport function nextPollDelayMs(state: DeviceCodePollState, now: number = Date.now()): number {\n  const multiplier =\n    state.slowDownResponses > 0 ? SLOW_DOWN_POLL_INTERVAL_MULTIPLIER : INITIAL_POLL_INTERVAL_MULTIPLIER;\n  const remainingMs = Math.max(0, state.deadlineAt - now);\n  return Math.min(Math.ceil(state.intervalMs * multiplier), remainingMs);\n}\n\n/**\n * Perform exactly one upstream poll and fold the outcome into the poll state.\n * Never throws for flow-level conditions — timeouts and provider errors are\n * reported as `{ status: 'failed' }` so callers can persist/report them.\n */\nexport async function stepDeviceCodePoll<T>(\n  state: DeviceCodePollState,\n  pollOnce: () => Promise<DeviceCodePollOutcome<T>>,\n  now: number = Date.now(),\n): Promise<DeviceCodeStepResult<T>> {\n  if (now >= state.deadlineAt) {\n    return { status: 'failed', error: timeoutMessage(state), state };\n  }\n\n  const outcome = await pollOnce();\n\n  switch (outcome.status) {\n    case 'complete':\n      return { status: 'complete', result: outcome.result, state };\n    case 'failed':\n      return { status: 'failed', error: outcome.error, state };\n    case 'slow_down': {\n      const next: DeviceCodePollState = {\n        ...state,\n        slowDownResponses: state.slowDownResponses + 1,\n        // RFC 8628 section 3.5: grow the interval by 5 seconds, unless the\n        // server told us the interval to use.\n        intervalMs:\n          typeof outcome.intervalSeconds === 'number' && outcome.intervalSeconds > 0\n            ? outcome.intervalSeconds * 1000\n            : Math.max(1000, state.intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS),\n      };\n      return { status: 'slow_down', nextPollMs: nextPollDelayMs(next, now), state: next };\n    }\n    case 'pending': {\n      const next: DeviceCodePollState =\n        typeof outcome.intervalSeconds === 'number' && outcome.intervalSeconds > 0\n          ? { ...state, intervalMs: Math.max(1000, outcome.intervalSeconds * 1000) }\n          : state;\n      return { status: 'pending', nextPollMs: nextPollDelayMs(next, now), state: next };\n    }\n  }\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nexport function abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Blocking poll loop for TUI flows: waits the appropriate interval between\n * polls, honors slow_down growth, aborts on the signal, and throws on\n * failure/timeout (with a clock-drift hint after slow_down responses).\n */\nexport async function pollDeviceCodeUntilComplete<T>(options: {\n  state: DeviceCodePollState;\n  pollOnce: () => Promise<DeviceCodePollOutcome<T>>;\n  signal?: AbortSignal;\n  /** Override the sleep implementation for tests. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n}): Promise<T> {\n  let state = options.state;\n  const sleep = options.sleep ?? abortableSleep;\n\n  while (true) {\n    if (options.signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n    if (Date.now() >= state.deadlineAt) {\n      throw new Error(timeoutMessage(state));\n    }\n\n    await sleep(nextPollDelayMs(state), options.signal);\n\n    const step = await stepDeviceCodePoll(state, options.pollOnce);\n    state = step.state;\n\n    if (step.status === 'complete') {\n      return step.result;\n    }\n    if (step.status === 'failed') {\n      throw new Error(step.error);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,2BAA2B;AACjC,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,kCAAkC;AAexC,SAAgB,0BAA0B,SAOlB;CACtB,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;CACpC,MAAM,kBACJ,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE,QAAQ,kBACR;CACN,OAAO;EACL,YAAY,MAAM,QAAQ,mBAAmB;EAC7C,YAAY,KAAK,IAAI,KAAM,KAAK,MAAM,kBAAkB,GAAI,CAAC;EAC7D,mBAAmB;CACrB;AACF;AAkBA,SAAS,eAAe,OAAoC;CAC1D,IAAI,MAAM,oBAAoB,GAG5B,OAAO;CAET,OAAO;AACT;;;;;AAMA,SAAgB,gBAAgB,OAA4B,MAAc,KAAK,IAAI,GAAW;CAC5F,MAAM,aACJ,MAAM,oBAAoB,IAAI,qCAAqC;CACrE,MAAM,cAAc,KAAK,IAAI,GAAG,MAAM,aAAa,GAAG;CACtD,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,aAAa,UAAU,GAAG,WAAW;AACvE;;;;;;AAOA,eAAsB,mBACpB,OACA,UACA,MAAc,KAAK,IAAI,GACW;CAClC,IAAI,OAAO,MAAM,YACf,OAAO;EAAE,QAAQ;EAAU,OAAO,eAAe,KAAK;EAAG;CAAM;CAGjE,MAAM,UAAU,MAAM,SAAS;CAE/B,QAAQ,QAAQ,QAAhB;EACE,KAAK,YACH,OAAO;GAAE,QAAQ;GAAY,QAAQ,QAAQ;GAAQ;EAAM;EAC7D,KAAK,UACH,OAAO;GAAE,QAAQ;GAAU,OAAO,QAAQ;GAAO;EAAM;EACzD,KAAK,aAAa;GAChB,MAAM,OAA4B;IAChC,GAAG;IACH,mBAAmB,MAAM,oBAAoB;IAG7C,YACE,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE,QAAQ,kBAAkB,MAC1B,KAAK,IAAI,KAAM,MAAM,aAAa,+BAA+B;GACzE;GACA,OAAO;IAAE,QAAQ;IAAa,YAAY,gBAAgB,MAAM,GAAG;IAAG,OAAO;GAAK;EACpF;EACA,KAAK,WAAW;GACd,MAAM,OACJ,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE;IAAE,GAAG;IAAO,YAAY,KAAK,IAAI,KAAM,QAAQ,kBAAkB,GAAI;GAAE,IACvE;GACN,OAAO;IAAE,QAAQ;IAAW,YAAY,gBAAgB,MAAM,GAAG;IAAG,OAAO;GAAK;EAClF;CACF;AACF;;AAGA,SAAgB,eAAe,IAAY,QAAqC;CAC9E,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS;GACnB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;GACnC;EACF;EAEA,IAAI;EACJ,MAAM,gBAAgB;GACpB,aAAa,OAAO;GACpB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;EACrC;EAEA,UAAU,iBAAiB;GACzB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EAEL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;;;;;AAOA,eAAsB,4BAA+B,SAMtC;CACb,IAAI,QAAQ,QAAQ;CACpB,MAAM,QAAQ,QAAQ,SAAS;CAE/B,OAAO,MAAM;EACX,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;EAEnC,IAAI,KAAK,IAAI,KAAK,MAAM,YACtB,MAAM,IAAI,MAAM,eAAe,KAAK,CAAC;EAGvC,MAAM,MAAM,gBAAgB,KAAK,GAAG,QAAQ,MAAM;EAElD,MAAM,OAAO,MAAM,mBAAmB,OAAO,QAAQ,QAAQ;EAC7D,QAAQ,KAAK;EAEb,IAAI,KAAK,WAAW,YAClB,OAAO,KAAK;EAEd,IAAI,KAAK,WAAW,UAClB,MAAM,IAAI,MAAM,KAAK,KAAK;CAE9B;AACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OAuth credential management for AI providers.
+ */
+export * from './types.js';
+export * from './storage.js';
+export { anthropicOAuthProvider } from './providers/anthropic.js';
+export { githubCopilotOAuthProvider } from './providers/github-copilot.js';
+export { openaiCodexOAuthProvider } from './providers/openai-codex.js';
+export { xaiOAuthProvider } from './providers/xai.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,6 @@
+import { anthropicOAuthProvider } from "./providers/anthropic.js";
+import { githubCopilotOAuthProvider } from "./providers/github-copilot.js";
+import { openaiCodexOAuthProvider } from "./providers/openai-codex.js";
+import { xaiOAuthProvider } from "./providers/xai.js";
+import { AuthStorage, PROVIDER_DEFAULT_MODELS, getOAuthProvider, getOAuthProviders } from "./storage.js";
+export { AuthStorage, PROVIDER_DEFAULT_MODELS, anthropicOAuthProvider, getOAuthProvider, getOAuthProviders, githubCopilotOAuthProvider, openaiCodexOAuthProvider, xaiOAuthProvider };

package/dist/auth/pkce.d.ts

@@ -0,0 +1,13 @@
+/**
+ * PKCE utilities using Web Crypto API.
+ * Works in both Node.js 20+ and browsers.
+ */
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAaD"}

package/dist/auth/pkce.js

@@ -0,0 +1,32 @@
+//#region src/auth/pkce.ts
+/**
+* PKCE utilities using Web Crypto API.
+* Works in both Node.js 20+ and browsers.
+*/
+/**
+* Encode bytes as base64url string.
+*/
+function base64urlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+/**
+* Generate PKCE code verifier and challenge.
+* Uses Web Crypto API for cross-platform compatibility.
+*/
+async function generatePKCE() {
+	const verifierBytes = /* @__PURE__ */ new Uint8Array(32);
+	crypto.getRandomValues(verifierBytes);
+	const verifier = base64urlEncode(verifierBytes);
+	const data = new TextEncoder().encode(verifier);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+	return {
+		verifier,
+		challenge: base64urlEncode(new Uint8Array(hashBuffer))
+	};
+}
+//#endregion
+export { generatePKCE };
+
+//# sourceMappingURL=pkce.js.map

package/dist/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","names":[],"sources":["../../src/auth/pkce.ts"],"sourcesContent":["/**\n * PKCE utilities using Web Crypto API.\n * Works in both Node.js 20+ and browsers.\n */\n\n/**\n * Encode bytes as base64url string.\n */\nfunction base64urlEncode(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n * Uses Web Crypto API for cross-platform compatibility.\n */\nexport async function generatePKCE(): Promise<{\n  verifier: string;\n  challenge: string;\n}> {\n  // Generate random verifier\n  const verifierBytes = new Uint8Array(32);\n  crypto.getRandomValues(verifierBytes);\n  const verifier = base64urlEncode(verifierBytes);\n\n  // Compute SHA-256 challenge\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n  const challenge = base64urlEncode(new Uint8Array(hashBuffer));\n\n  return { verifier, challenge };\n}\n"],"mappings":";;;;;;;;AAQA,SAAS,gBAAgB,OAA2B;CAClD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,MAAM,EAAE;AAC9E;;;;;AAMA,eAAsB,eAGnB;CAED,MAAM,gCAAgB,IAAI,WAAW,EAAE;CACvC,OAAO,gBAAgB,aAAa;CACpC,MAAM,WAAW,gBAAgB,aAAa;CAI9C,MAAM,OAAO,IADO,YACD,CAAC,CAAC,OAAO,QAAQ;CACpC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAG7D,OAAO;EAAE;EAAU,WAFD,gBAAgB,IAAI,WAAW,UAAU,CAEhC;CAAE;AAC/B"}

package/dist/auth/providers/anthropic.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Anthropic OAuth flow (Claude Pro/Max)
+ *
+ * Inspired by pi-mono's OAuth implementation:
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts
+ *
+ * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted
+ * callback page which displays `code#state` for the user to paste back. That
+ * makes it deployable without any inbound connection to the server, so the
+ * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`
+ * which can span separate HTTP requests (only the PKCE verifier needs to be
+ * persisted in between).
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from '../types.js';
+export interface AnthropicLoginStart {
+    /** Authorization URL for the user to open. */
+    url: string;
+    /** PKCE code verifier — persist it to complete the login later. */
+    verifier: string;
+}
+/**
+ * Start an Anthropic login: generate PKCE state and build the authorization URL.
+ */
+export declare function startAnthropicLogin(): Promise<AnthropicLoginStart>;
+/**
+ * Complete an Anthropic login: parse the pasted authorization input
+ * (full URL, `code#state`, or query string), validate its state, and exchange
+ * it for tokens using the verifier from `startAnthropicLogin()`.
+ */
+export declare function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials>;
+/**
+ * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.
+ */
+export declare function loginAnthropic(onAuthUrl: (url: string) => void, onPromptCode: () => Promise<string>): Promise<OAuthCredentials>;
+/**
+ * Refresh Anthropic OAuth token
+ */
+export declare function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials>;
+export declare const anthropicOAuthProvider: OAuthProviderInterface;
+//# sourceMappingURL=anthropic.d.ts.map

package/dist/auth/providers/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAYjG,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAexE;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+CvG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAU3B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4B3F;AAED,eAAO,MAAM,sBAAsB,EAAE,sBAkBpC,CAAC"}