@mastra/code-sdk 0.2.0-alpha.4 → 0.2.0-alpha.9

package/dist/auth/device-code.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Generic RFC 8628 (OAuth 2.0 Device Authorization Grant) polling helpers.
+ *
+ * Ported from pi-mono's device-code utility, restructured as a single-step
+ * API so the same poll semantics can be driven two ways:
+ *   - `pollDeviceCodeUntilComplete()` — blocking loop for TUI flows.
+ *   - `stepDeviceCodePoll()` — exactly one upstream poll per call, with a
+ *     JSON-serializable `DeviceCodePollState` so web routes can persist the
+ *     state between HTTP requests (any replica can continue the poll).
+ *
+ * Inspired by pi-mono:
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/device-code.ts
+ */
+/**
+ * Serializable poll-loop state. Safe to round-trip through JSON (e.g. a
+ * `pending jsonb` column) so device-code polling can span HTTP requests.
+ */
+export interface DeviceCodePollState {
+    /** ms epoch after which the device authorization is considered expired. */
+    deadlineAt: number;
+    /** Current base poll interval in ms (grows on slow_down responses). */
+    intervalMs: number;
+    /** Number of slow_down responses observed so far. */
+    slowDownResponses: number;
+}
+export declare function createDeviceCodePollState(options: {
+    /** Poll interval suggested by the server, in seconds. Defaults to 5 (RFC 8628). */
+    intervalSeconds?: number;
+    /** Lifetime of the device code, in seconds. */
+    expiresInSeconds: number;
+    /** Override "now" for tests. */
+    now?: number;
+}): DeviceCodePollState;
+/**
+ * Classified result of one upstream token-endpoint poll. Providers implement
+ * the HTTP request and map their response shape onto this union.
+ */
+export type DeviceCodePollOutcome<T> = {
+    status: 'complete';
+    result: T;
+} | {
+    status: 'pending';
+    intervalSeconds?: number;
+} | {
+    status: 'slow_down';
+    intervalSeconds?: number;
+} | {
+    status: 'failed';
+    error: string;
+};
+export type DeviceCodeStepResult<T> = {
+    status: 'complete';
+    result: T;
+    state: DeviceCodePollState;
+} | {
+    status: 'pending';
+    nextPollMs: number;
+    state: DeviceCodePollState;
+} | {
+    status: 'slow_down';
+    nextPollMs: number;
+    state: DeviceCodePollState;
+} | {
+    status: 'failed';
+    error: string;
+    state: DeviceCodePollState;
+};
+/**
+ * Delay to wait before the next poll, honoring slow_down growth and clamped
+ * to the remaining lifetime of the device code.
+ */
+export declare function nextPollDelayMs(state: DeviceCodePollState, now?: number): number;
+/**
+ * Perform exactly one upstream poll and fold the outcome into the poll state.
+ * Never throws for flow-level conditions — timeouts and provider errors are
+ * reported as `{ status: 'failed' }` so callers can persist/report them.
+ */
+export declare function stepDeviceCodePoll<T>(state: DeviceCodePollState, pollOnce: () => Promise<DeviceCodePollOutcome<T>>, now?: number): Promise<DeviceCodeStepResult<T>>;
+/** Sleep that can be interrupted by an AbortSignal. */
+export declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * Blocking poll loop for TUI flows: waits the appropriate interval between
+ * polls, honors slow_down growth, aborts on the signal, and throws on
+ * failure/timeout (with a clock-drift hint after slow_down responses).
+ */
+export declare function pollDeviceCodeUntilComplete<T>(options: {
+    state: DeviceCodePollState;
+    pollOnce: () => Promise<DeviceCodePollOutcome<T>>;
+    signal?: AbortSignal;
+    /** Override the sleep implementation for tests. */
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}): Promise<T>;
+//# sourceMappingURL=device-code.d.ts.map

package/dist/auth/device-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.d.ts","sourceRoot":"","sources":["../../src/auth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,mBAAmB,CAWtB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAC/B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,oBAAoB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAWpE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAK5F;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EACjD,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAiClC;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB9E;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,OAAO,EAAE;IAC5D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,CAAC,CAAC,CAwBb"}

package/dist/auth/device-code.js

@@ -0,0 +1,97 @@
+const DEFAULT_INTERVAL_SECONDS = 5;
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5e3;
+function createDeviceCodePollState(options) {
+  const now = options.now ?? Date.now();
+  const intervalSeconds = typeof options.intervalSeconds === "number" && options.intervalSeconds > 0 ? options.intervalSeconds : DEFAULT_INTERVAL_SECONDS;
+  return {
+    deadlineAt: now + options.expiresInSeconds * 1e3,
+    intervalMs: Math.max(1e3, Math.floor(intervalSeconds * 1e3)),
+    slowDownResponses: 0
+  };
+}
+function timeoutMessage(state) {
+  if (state.slowDownResponses > 0) {
+    return "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+  }
+  return "Device flow timed out";
+}
+function nextPollDelayMs(state, now = Date.now()) {
+  const multiplier = state.slowDownResponses > 0 ? SLOW_DOWN_POLL_INTERVAL_MULTIPLIER : INITIAL_POLL_INTERVAL_MULTIPLIER;
+  const remainingMs = Math.max(0, state.deadlineAt - now);
+  return Math.min(Math.ceil(state.intervalMs * multiplier), remainingMs);
+}
+async function stepDeviceCodePoll(state, pollOnce, now = Date.now()) {
+  if (now >= state.deadlineAt) {
+    return { status: "failed", error: timeoutMessage(state), state };
+  }
+  const outcome = await pollOnce();
+  switch (outcome.status) {
+    case "complete":
+      return { status: "complete", result: outcome.result, state };
+    case "failed":
+      return { status: "failed", error: outcome.error, state };
+    case "slow_down": {
+      const next = {
+        ...state,
+        slowDownResponses: state.slowDownResponses + 1,
+        // RFC 8628 section 3.5: grow the interval by 5 seconds, unless the
+        // server told us the interval to use.
+        intervalMs: typeof outcome.intervalSeconds === "number" && outcome.intervalSeconds > 0 ? outcome.intervalSeconds * 1e3 : Math.max(1e3, state.intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS)
+      };
+      return { status: "slow_down", nextPollMs: nextPollDelayMs(next, now), state: next };
+    }
+    case "pending": {
+      const next = typeof outcome.intervalSeconds === "number" && outcome.intervalSeconds > 0 ? { ...state, intervalMs: Math.max(1e3, outcome.intervalSeconds * 1e3) } : state;
+      return { status: "pending", nextPollMs: nextPollDelayMs(next, now), state: next };
+    }
+  }
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Login cancelled"));
+      return;
+    }
+    let timeout;
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(new Error("Login cancelled"));
+    };
+    timeout = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollDeviceCodeUntilComplete(options) {
+  let state = options.state;
+  const sleep = options.sleep ?? abortableSleep;
+  while (true) {
+    if (options.signal?.aborted) {
+      throw new Error("Login cancelled");
+    }
+    if (Date.now() >= state.deadlineAt) {
+      throw new Error(timeoutMessage(state));
+    }
+    await sleep(nextPollDelayMs(state), options.signal);
+    const step = await stepDeviceCodePoll(state, options.pollOnce);
+    state = step.state;
+    if (step.status === "complete") {
+      return step.result;
+    }
+    if (step.status === "failed") {
+      throw new Error(step.error);
+    }
+  }
+}
+export {
+  abortableSleep,
+  createDeviceCodePollState,
+  nextPollDelayMs,
+  pollDeviceCodeUntilComplete,
+  stepDeviceCodePoll
+};
+//# sourceMappingURL=device-code.js.map

package/dist/auth/device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/device-code.ts"],"sourcesContent":["/**\n * Generic RFC 8628 (OAuth 2.0 Device Authorization Grant) polling helpers.\n *\n * Ported from pi-mono's device-code utility, restructured as a single-step\n * API so the same poll semantics can be driven two ways:\n *   - `pollDeviceCodeUntilComplete()` — blocking loop for TUI flows.\n *   - `stepDeviceCodePoll()` — exactly one upstream poll per call, with a\n *     JSON-serializable `DeviceCodePollState` so web routes can persist the\n *     state between HTTP requests (any replica can continue the poll).\n *\n * Inspired by pi-mono:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/device-code.ts\n */\n\nconst DEFAULT_INTERVAL_SECONDS = 5;\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\nconst SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;\n\n/**\n * Serializable poll-loop state. Safe to round-trip through JSON (e.g. a\n * `pending jsonb` column) so device-code polling can span HTTP requests.\n */\nexport interface DeviceCodePollState {\n  /** ms epoch after which the device authorization is considered expired. */\n  deadlineAt: number;\n  /** Current base poll interval in ms (grows on slow_down responses). */\n  intervalMs: number;\n  /** Number of slow_down responses observed so far. */\n  slowDownResponses: number;\n}\n\nexport function createDeviceCodePollState(options: {\n  /** Poll interval suggested by the server, in seconds. Defaults to 5 (RFC 8628). */\n  intervalSeconds?: number;\n  /** Lifetime of the device code, in seconds. */\n  expiresInSeconds: number;\n  /** Override \"now\" for tests. */\n  now?: number;\n}): DeviceCodePollState {\n  const now = options.now ?? Date.now();\n  const intervalSeconds =\n    typeof options.intervalSeconds === 'number' && options.intervalSeconds > 0\n      ? options.intervalSeconds\n      : DEFAULT_INTERVAL_SECONDS;\n  return {\n    deadlineAt: now + options.expiresInSeconds * 1000,\n    intervalMs: Math.max(1000, Math.floor(intervalSeconds * 1000)),\n    slowDownResponses: 0,\n  };\n}\n\n/**\n * Classified result of one upstream token-endpoint poll. Providers implement\n * the HTTP request and map their response shape onto this union.\n */\nexport type DeviceCodePollOutcome<T> =\n  | { status: 'complete'; result: T }\n  | { status: 'pending'; intervalSeconds?: number }\n  | { status: 'slow_down'; intervalSeconds?: number }\n  | { status: 'failed'; error: string };\n\nexport type DeviceCodeStepResult<T> =\n  | { status: 'complete'; result: T; state: DeviceCodePollState }\n  | { status: 'pending'; nextPollMs: number; state: DeviceCodePollState }\n  | { status: 'slow_down'; nextPollMs: number; state: DeviceCodePollState }\n  | { status: 'failed'; error: string; state: DeviceCodePollState };\n\nfunction timeoutMessage(state: DeviceCodePollState): string {\n  if (state.slowDownResponses > 0) {\n    // Repeated slow_down responses followed by a timeout usually means the\n    // local clock is behind the server's (common in WSL/VMs after sleep).\n    return 'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.';\n  }\n  return 'Device flow timed out';\n}\n\n/**\n * Delay to wait before the next poll, honoring slow_down growth and clamped\n * to the remaining lifetime of the device code.\n */\nexport function nextPollDelayMs(state: DeviceCodePollState, now: number = Date.now()): number {\n  const multiplier =\n    state.slowDownResponses > 0 ? SLOW_DOWN_POLL_INTERVAL_MULTIPLIER : INITIAL_POLL_INTERVAL_MULTIPLIER;\n  const remainingMs = Math.max(0, state.deadlineAt - now);\n  return Math.min(Math.ceil(state.intervalMs * multiplier), remainingMs);\n}\n\n/**\n * Perform exactly one upstream poll and fold the outcome into the poll state.\n * Never throws for flow-level conditions — timeouts and provider errors are\n * reported as `{ status: 'failed' }` so callers can persist/report them.\n */\nexport async function stepDeviceCodePoll<T>(\n  state: DeviceCodePollState,\n  pollOnce: () => Promise<DeviceCodePollOutcome<T>>,\n  now: number = Date.now(),\n): Promise<DeviceCodeStepResult<T>> {\n  if (now >= state.deadlineAt) {\n    return { status: 'failed', error: timeoutMessage(state), state };\n  }\n\n  const outcome = await pollOnce();\n\n  switch (outcome.status) {\n    case 'complete':\n      return { status: 'complete', result: outcome.result, state };\n    case 'failed':\n      return { status: 'failed', error: outcome.error, state };\n    case 'slow_down': {\n      const next: DeviceCodePollState = {\n        ...state,\n        slowDownResponses: state.slowDownResponses + 1,\n        // RFC 8628 section 3.5: grow the interval by 5 seconds, unless the\n        // server told us the interval to use.\n        intervalMs:\n          typeof outcome.intervalSeconds === 'number' && outcome.intervalSeconds > 0\n            ? outcome.intervalSeconds * 1000\n            : Math.max(1000, state.intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS),\n      };\n      return { status: 'slow_down', nextPollMs: nextPollDelayMs(next, now), state: next };\n    }\n    case 'pending': {\n      const next: DeviceCodePollState =\n        typeof outcome.intervalSeconds === 'number' && outcome.intervalSeconds > 0\n          ? { ...state, intervalMs: Math.max(1000, outcome.intervalSeconds * 1000) }\n          : state;\n      return { status: 'pending', nextPollMs: nextPollDelayMs(next, now), state: next };\n    }\n  }\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nexport function abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Blocking poll loop for TUI flows: waits the appropriate interval between\n * polls, honors slow_down growth, aborts on the signal, and throws on\n * failure/timeout (with a clock-drift hint after slow_down responses).\n */\nexport async function pollDeviceCodeUntilComplete<T>(options: {\n  state: DeviceCodePollState;\n  pollOnce: () => Promise<DeviceCodePollOutcome<T>>;\n  signal?: AbortSignal;\n  /** Override the sleep implementation for tests. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n}): Promise<T> {\n  let state = options.state;\n  const sleep = options.sleep ?? abortableSleep;\n\n  while (true) {\n    if (options.signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n    if (Date.now() >= state.deadlineAt) {\n      throw new Error(timeoutMessage(state));\n    }\n\n    await sleep(nextPollDelayMs(state), options.signal);\n\n    const step = await stepDeviceCodePoll(state, options.pollOnce);\n    state = step.state;\n\n    if (step.status === 'complete') {\n      return step.result;\n    }\n    if (step.status === 'failed') {\n      throw new Error(step.error);\n    }\n  }\n}\n"],"mappings":"AAcA,MAAM,2BAA2B;AACjC,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,kCAAkC;AAejC,SAAS,0BAA0B,SAOlB;AACtB,QAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;AACpC,QAAM,kBACJ,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE,QAAQ,kBACR;AACN,SAAO;AAAA,IACL,YAAY,MAAM,QAAQ,mBAAmB;AAAA,IAC7C,YAAY,KAAK,IAAI,KAAM,KAAK,MAAM,kBAAkB,GAAI,CAAC;AAAA,IAC7D,mBAAmB;AAAA,EACrB;AACF;AAkBA,SAAS,eAAe,OAAoC;AAC1D,MAAI,MAAM,oBAAoB,GAAG;AAG/B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,gBAAgB,OAA4B,MAAc,KAAK,IAAI,GAAW;AAC5F,QAAM,aACJ,MAAM,oBAAoB,IAAI,qCAAqC;AACrE,QAAM,cAAc,KAAK,IAAI,GAAG,MAAM,aAAa,GAAG;AACtD,SAAO,KAAK,IAAI,KAAK,KAAK,MAAM,aAAa,UAAU,GAAG,WAAW;AACvE;AAOA,eAAsB,mBACpB,OACA,UACA,MAAc,KAAK,IAAI,GACW;AAClC,MAAI,OAAO,MAAM,YAAY;AAC3B,WAAO,EAAE,QAAQ,UAAU,OAAO,eAAe,KAAK,GAAG,MAAM;AAAA,EACjE;AAEA,QAAM,UAAU,MAAM,SAAS;AAE/B,UAAQ,QAAQ,QAAQ;AAAA,IACtB,KAAK;AACH,aAAO,EAAE,QAAQ,YAAY,QAAQ,QAAQ,QAAQ,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,QAAQ,UAAU,OAAO,QAAQ,OAAO,MAAM;AAAA,IACzD,KAAK,aAAa;AAChB,YAAM,OAA4B;AAAA,QAChC,GAAG;AAAA,QACH,mBAAmB,MAAM,oBAAoB;AAAA;AAAA;AAAA,QAG7C,YACE,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE,QAAQ,kBAAkB,MAC1B,KAAK,IAAI,KAAM,MAAM,aAAa,+BAA+B;AAAA,MACzE;AACA,aAAO,EAAE,QAAQ,aAAa,YAAY,gBAAgB,MAAM,GAAG,GAAG,OAAO,KAAK;AAAA,IACpF;AAAA,IACA,KAAK,WAAW;AACd,YAAM,OACJ,OAAO,QAAQ,oBAAoB,YAAY,QAAQ,kBAAkB,IACrE,EAAE,GAAG,OAAO,YAAY,KAAK,IAAI,KAAM,QAAQ,kBAAkB,GAAI,EAAE,IACvE;AACN,aAAO,EAAE,QAAQ,WAAW,YAAY,gBAAgB,MAAM,GAAG,GAAG,OAAO,KAAK;AAAA,IAClF;AAAA,EACF;AACF;AAGO,SAAS,eAAe,IAAY,QAAqC;AAC9E,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AACnC;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,UAAU,MAAM;AACpB,mBAAa,OAAO;AACpB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AAAA,IACrC;AAEA,cAAU,WAAW,MAAM;AACzB,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ;AAAA,IACV,GAAG,EAAE;AAEL,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AACH;AAOA,eAAsB,4BAA+B,SAMtC;AACb,MAAI,QAAQ,QAAQ;AACpB,QAAM,QAAQ,QAAQ,SAAS;AAE/B,SAAO,MAAM;AACX,QAAI,QAAQ,QAAQ,SAAS;AAC3B,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACnC;AACA,QAAI,KAAK,IAAI,KAAK,MAAM,YAAY;AAClC,YAAM,IAAI,MAAM,eAAe,KAAK,CAAC;AAAA,IACvC;AAEA,UAAM,MAAM,gBAAgB,KAAK,GAAG,QAAQ,MAAM;AAElD,UAAM,OAAO,MAAM,mBAAmB,OAAO,QAAQ,QAAQ;AAC7D,YAAQ,KAAK;AAEb,QAAI,KAAK,WAAW,YAAY;AAC9B,aAAO,KAAK;AAAA,IACd;AACA,QAAI,KAAK,WAAW,UAAU;AAC5B,YAAM,IAAI,MAAM,KAAK,KAAK;AAAA,IAC5B;AAAA,EACF;AACF;","names":[]}

package/dist/auth/index.d.ts

@@ -6,4 +6,5 @@ export * from './storage.js';
 export { anthropicOAuthProvider } from './providers/anthropic.js';
 export { githubCopilotOAuthProvider } from './providers/github-copilot.js';
 export { openaiCodexOAuthProvider } from './providers/openai-codex.js';
+export { xaiOAuthProvider } from './providers/xai.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/index.js

@@ -3,9 +3,11 @@ export * from "./storage.js";
 import { anthropicOAuthProvider } from "./providers/anthropic.js";
 import { githubCopilotOAuthProvider } from "./providers/github-copilot.js";
 import { openaiCodexOAuthProvider } from "./providers/openai-codex.js";
+import { xaiOAuthProvider } from "./providers/xai.js";
 export {
   anthropicOAuthProvider,
   githubCopilotOAuthProvider,
-  openaiCodexOAuthProvider
+  openaiCodexOAuthProvider,
+  xaiOAuthProvider
 };
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["/**\n * OAuth credential management for AI providers.\n */\n\nexport * from './types.js';\nexport * from './storage.js';\nexport { anthropicOAuthProvider } from './providers/anthropic.js';\nexport { githubCopilotOAuthProvider } from './providers/github-copilot.js';\nexport { openaiCodexOAuthProvider } from './providers/openai-codex.js';\n"],"mappings":"AAIA,cAAc;AACd,cAAc;AACd,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;","names":[]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["/**\n * OAuth credential management for AI providers.\n */\n\nexport * from './types.js';\nexport * from './storage.js';\nexport { anthropicOAuthProvider } from './providers/anthropic.js';\nexport { githubCopilotOAuthProvider } from './providers/github-copilot.js';\nexport { openaiCodexOAuthProvider } from './providers/openai-codex.js';\nexport { xaiOAuthProvider } from './providers/xai.js';\n"],"mappings":"AAIA,cAAc;AACd,cAAc;AACd,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AACzC,SAAS,wBAAwB;","names":[]}

package/dist/auth/providers/anthropic.d.ts

@@ -3,10 +3,33 @@
  *
  * Inspired by pi-mono's OAuth implementation:
  * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts
+ *
+ * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted
+ * callback page which displays `code#state` for the user to paste back. That
+ * makes it deployable without any inbound connection to the server, so the
+ * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`
+ * which can span separate HTTP requests (only the PKCE verifier needs to be
+ * persisted in between).
  */
 import type { OAuthCredentials, OAuthProviderInterface } from '../types.js';
+export interface AnthropicLoginStart {
+    /** Authorization URL for the user to open. */
+    url: string;
+    /** PKCE code verifier — persist it to complete the login later. */
+    verifier: string;
+}
+/**
+ * Start an Anthropic login: generate PKCE state and build the authorization URL.
+ */
+export declare function startAnthropicLogin(): Promise<AnthropicLoginStart>;
+/**
+ * Complete an Anthropic login: parse the pasted authorization input
+ * (full URL, `code#state`, or query string), validate its state, and exchange
+ * it for tokens using the verifier from `startAnthropicLogin()`.
+ */
+export declare function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials>;
 /**
- * Login with Anthropic OAuth (device code flow)
+ * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.
  */
 export declare function loginAnthropic(onAuthUrl: (url: string) => void, onPromptCode: () => Promise<string>): Promise<OAuthCredentials>;
 /**

package/dist/auth/providers/anthropic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AASjG;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA6D3B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2B3F;AAED,eAAO,MAAM,sBAAsB,EAAE,sBAkBpC,CAAC"}
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAYjG,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAexE;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CvG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAU3B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2B3F;AAED,eAAO,MAAM,sBAAsB,EAAE,sBAkBpC,CAAC"}

package/dist/auth/providers/anthropic.js

@@ -1,3 +1,4 @@
+import { parseAuthorizationInput } from "../authorization-input.js";
 import { generatePKCE } from "../pkce.js";
 const decode = (s) => atob(s);
 const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
@@ -5,7 +6,7 @@ const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 const TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
 const REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
 const SCOPES = "org:create_api_key user:profile user:inference";
-async function loginAnthropic(onAuthUrl, onPromptCode) {
+async function startAnthropicLogin() {
   const { verifier, challenge } = await generatePKCE();
   const authParams = new URLSearchParams({
     code: "true",
@@ -17,12 +18,16 @@ async function loginAnthropic(onAuthUrl, onPromptCode) {
     code_challenge_method: "S256",
     state: verifier
   });
-  const authUrl = `${AUTHORIZE_URL}?${authParams.toString()}`;
-  onAuthUrl(authUrl);
-  const authCode = await onPromptCode();
-  const splits = authCode.split("#");
-  const code = splits[0];
-  const state = splits[1];
+  return { url: `${AUTHORIZE_URL}?${authParams.toString()}`, verifier };
+}
+async function completeAnthropicLogin(input, verifier) {
+  const { code, state } = parseAuthorizationInput(input);
+  if (!code) {
+    throw new Error("Missing authorization code");
+  }
+  if (!state || state !== verifier) {
+    throw new Error("Invalid authorization state");
+  }
   const tokenResponse = await fetch(TOKEN_URL, {
     method: "POST",
     headers: {
@@ -49,6 +54,12 @@ async function loginAnthropic(onAuthUrl, onPromptCode) {
     expires: expiresAt
   };
 }
+async function loginAnthropic(onAuthUrl, onPromptCode) {
+  const { url, verifier } = await startAnthropicLogin();
+  onAuthUrl(url);
+  const authCode = await onPromptCode();
+  return completeAnthropicLogin(authCode, verifier);
+}
 async function refreshAnthropicToken(refreshToken) {
   const response = await fetch(TOKEN_URL, {
     method: "POST",
@@ -88,7 +99,9 @@ const anthropicOAuthProvider = {
 };
 export {
   anthropicOAuthProvider,
+  completeAnthropicLogin,
   loginAnthropic,
-  refreshAnthropicToken
+  refreshAnthropicToken,
+  startAnthropicLogin
 };
 //# sourceMappingURL=anthropic.js.map

package/dist/auth/providers/anthropic.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/providers/anthropic.ts"],"sourcesContent":["/**\n * Anthropic OAuth flow (Claude Pro/Max)\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts\n */\n\nimport { generatePKCE } from '../pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');\nconst AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';\nconst TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';\nconst REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';\nconst SCOPES = 'org:create_api_key user:profile user:inference';\n\n/**\n * Login with Anthropic OAuth (device code flow)\n */\nexport async function loginAnthropic(\n  onAuthUrl: (url: string) => void,\n  onPromptCode: () => Promise<string>,\n): Promise<OAuthCredentials> {\n  const { verifier, challenge } = await generatePKCE();\n\n  // Build authorization URL\n  const authParams = new URLSearchParams({\n    code: 'true',\n    client_id: CLIENT_ID,\n    response_type: 'code',\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPES,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state: verifier,\n  });\n\n  const authUrl = `${AUTHORIZE_URL}?${authParams.toString()}`;\n\n  // Notify caller with URL to open\n  onAuthUrl(authUrl);\n\n  // Wait for user to paste authorization code (format: code#state)\n  const authCode = await onPromptCode();\n  const splits = authCode.split('#');\n  const code = splits[0];\n  const state = splits[1];\n\n  // Exchange code for tokens\n  const tokenResponse = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code: code,\n      state: state,\n      redirect_uri: REDIRECT_URI,\n      code_verifier: verifier,\n    }),\n  });\n\n  if (!tokenResponse.ok) {\n    const error = await tokenResponse.text();\n    throw new Error(`Token exchange failed: ${error}`);\n  }\n\n  const tokenData = (await tokenResponse.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  // Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n  const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n  return {\n    refresh: tokenData.refresh_token,\n    access: tokenData.access_token,\n    expires: expiresAt,\n  };\n}\n\n/**\n * Refresh Anthropic OAuth token\n */\nexport async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  });\n\n  if (!response.ok) {\n    const error = await response.text();\n    throw new Error(`Anthropic token refresh failed: ${error}`);\n  }\n\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  return {\n    refresh: data.refresh_token,\n    access: data.access_token,\n    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n  };\n}\n\nexport const anthropicOAuthProvider: OAuthProviderInterface = {\n  id: 'anthropic',\n  name: 'Anthropic (Claude Pro/Max)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginAnthropic(\n      url => callbacks.onAuth({ url }),\n      () => callbacks.onPrompt({ message: 'Paste the authorization code:' }),\n    );\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshAnthropicToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":"AAOA,SAAS,oBAAoB;AAG7B,MAAM,SAAS,CAAC,MAAc,KAAK,CAAC;AACpC,MAAM,YAAY,OAAO,kDAAkD;AAC3E,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,SAAS;AAKf,eAAsB,eACpB,WACA,cAC2B;AAC3B,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,aAAa;AAGnD,QAAM,aAAa,IAAI,gBAAgB;AAAA,IACrC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe;AAAA,IACf,cAAc;AAAA,IACd,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,uBAAuB;AAAA,IACvB,OAAO;AAAA,EACT,CAAC;AAED,QAAM,UAAU,GAAG,aAAa,IAAI,WAAW,SAAS,CAAC;AAGzD,YAAU,OAAO;AAGjB,QAAM,WAAW,MAAM,aAAa;AACpC,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,OAAO,OAAO,CAAC;AACrB,QAAM,QAAQ,OAAO,CAAC;AAGtB,QAAM,gBAAgB,MAAM,MAAM,WAAW;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,cAAc,IAAI;AACrB,UAAM,QAAQ,MAAM,cAAc,KAAK;AACvC,UAAM,IAAI,MAAM,0BAA0B,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,YAAa,MAAM,cAAc,KAAK;AAO5C,QAAM,YAAY,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO,IAAI,KAAK;AAEtE,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,QAAQ,UAAU;AAAA,IAClB,SAAS;AAAA,EACX;AACF;AAKA,eAAsB,sBAAsB,cAAiD;AAC3F,QAAM,WAAW,MAAM,MAAM,WAAW;AAAA,IACtC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,UAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;AAAA,EAC5D;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAMlC,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,IAAI,KAAK;AAAA,EAC1D;AACF;AAEO,MAAM,yBAAiD;AAAA,EAC5D,IAAI;AAAA,EACJ,MAAM;AAAA,EAEN,MAAM,MAAM,WAA2D;AACrE,WAAO;AAAA,MACL,SAAO,UAAU,OAAO,EAAE,IAAI,CAAC;AAAA,MAC/B,MAAM,UAAU,SAAS,EAAE,SAAS,gCAAgC,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,WAAO,sBAAsB,YAAY,OAAO;AAAA,EAClD;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}
+{"version":3,"sources":["../../../src/auth/providers/anthropic.ts"],"sourcesContent":["/**\n * Anthropic OAuth flow (Claude Pro/Max)\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts\n *\n * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted\n * callback page which displays `code#state` for the user to paste back. That\n * makes it deployable without any inbound connection to the server, so the\n * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`\n * which can span separate HTTP requests (only the PKCE verifier needs to be\n * persisted in between).\n */\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');\nconst AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';\n// pi-mono uses `https://platform.claude.com/v1/oauth/token` with extra scopes\n// (user:sessions:claude_code, user:mcp_servers, user:file_upload); we keep the\n// console.anthropic.com endpoints that are known to work for our scope set.\nconst TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';\nconst REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';\nconst SCOPES = 'org:create_api_key user:profile user:inference';\n\nexport interface AnthropicLoginStart {\n  /** Authorization URL for the user to open. */\n  url: string;\n  /** PKCE code verifier — persist it to complete the login later. */\n  verifier: string;\n}\n\n/**\n * Start an Anthropic login: generate PKCE state and build the authorization URL.\n */\nexport async function startAnthropicLogin(): Promise<AnthropicLoginStart> {\n  const { verifier, challenge } = await generatePKCE();\n\n  const authParams = new URLSearchParams({\n    code: 'true',\n    client_id: CLIENT_ID,\n    response_type: 'code',\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPES,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state: verifier,\n  });\n\n  return { url: `${AUTHORIZE_URL}?${authParams.toString()}`, verifier };\n}\n\n/**\n * Complete an Anthropic login: parse the pasted authorization input\n * (full URL, `code#state`, or query string), validate its state, and exchange\n * it for tokens using the verifier from `startAnthropicLogin()`.\n */\nexport async function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials> {\n  const { code, state } = parseAuthorizationInput(input);\n  if (!code) {\n    throw new Error('Missing authorization code');\n  }\n  if (!state || state !== verifier) {\n    throw new Error('Invalid authorization state');\n  }\n\n  const tokenResponse = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code,\n      state,\n      redirect_uri: REDIRECT_URI,\n      code_verifier: verifier,\n    }),\n  });\n\n  if (!tokenResponse.ok) {\n    const error = await tokenResponse.text();\n    throw new Error(`Token exchange failed: ${error}`);\n  }\n\n  const tokenData = (await tokenResponse.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  // Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n  const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n  return {\n    refresh: tokenData.refresh_token,\n    access: tokenData.access_token,\n    expires: expiresAt,\n  };\n}\n\n/**\n * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.\n */\nexport async function loginAnthropic(\n  onAuthUrl: (url: string) => void,\n  onPromptCode: () => Promise<string>,\n): Promise<OAuthCredentials> {\n  const { url, verifier } = await startAnthropicLogin();\n\n  // Notify caller with URL to open\n  onAuthUrl(url);\n\n  // Wait for user to paste authorization code (format: code#state)\n  const authCode = await onPromptCode();\n\n  return completeAnthropicLogin(authCode, verifier);\n}\n\n/**\n * Refresh Anthropic OAuth token\n */\nexport async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  });\n\n  if (!response.ok) {\n    const error = await response.text();\n    throw new Error(`Anthropic token refresh failed: ${error}`);\n  }\n\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  return {\n    refresh: data.refresh_token,\n    access: data.access_token,\n    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n  };\n}\n\nexport const anthropicOAuthProvider: OAuthProviderInterface = {\n  id: 'anthropic',\n  name: 'Anthropic (Claude Pro/Max)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginAnthropic(\n      url => callbacks.onAuth({ url }),\n      () => callbacks.onPrompt({ message: 'Paste the authorization code:' }),\n    );\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshAnthropicToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":"AAcA,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAG7B,MAAM,SAAS,CAAC,MAAc,KAAK,CAAC;AACpC,MAAM,YAAY,OAAO,kDAAkD;AAC3E,MAAM,gBAAgB;AAItB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,SAAS;AAYf,eAAsB,sBAAoD;AACxE,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,aAAa;AAEnD,QAAM,aAAa,IAAI,gBAAgB;AAAA,IACrC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe;AAAA,IACf,cAAc;AAAA,IACd,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,uBAAuB;AAAA,IACvB,OAAO;AAAA,EACT,CAAC;AAED,SAAO,EAAE,KAAK,GAAG,aAAa,IAAI,WAAW,SAAS,CAAC,IAAI,SAAS;AACtE;AAOA,eAAsB,uBAAuB,OAAe,UAA6C;AACvG,QAAM,EAAE,MAAM,MAAM,IAAI,wBAAwB,KAAK;AACrD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,MAAI,CAAC,SAAS,UAAU,UAAU;AAChC,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,QAAM,gBAAgB,MAAM,MAAM,WAAW;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,cAAc,IAAI;AACrB,UAAM,QAAQ,MAAM,cAAc,KAAK;AACvC,UAAM,IAAI,MAAM,0BAA0B,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,YAAa,MAAM,cAAc,KAAK;AAO5C,QAAM,YAAY,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO,IAAI,KAAK;AAEtE,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,QAAQ,UAAU;AAAA,IAClB,SAAS;AAAA,EACX;AACF;AAKA,eAAsB,eACpB,WACA,cAC2B;AAC3B,QAAM,EAAE,KAAK,SAAS,IAAI,MAAM,oBAAoB;AAGpD,YAAU,GAAG;AAGb,QAAM,WAAW,MAAM,aAAa;AAEpC,SAAO,uBAAuB,UAAU,QAAQ;AAClD;AAKA,eAAsB,sBAAsB,cAAiD;AAC3F,QAAM,WAAW,MAAM,MAAM,WAAW;AAAA,IACtC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,UAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;AAAA,EAC5D;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAMlC,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,IAAI,KAAK;AAAA,EAC1D;AACF;AAEO,MAAM,yBAAiD;AAAA,EAC5D,IAAI;AAAA,EACJ,MAAM;AAAA,EAEN,MAAM,MAAM,WAA2D;AACrE,WAAO;AAAA,MACL,SAAO,UAAU,OAAO,EAAE,IAAI,CAAC;AAAA,MAC/B,MAAM,UAAU,SAAS,EAAE,SAAS,gCAAgC,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,WAAO,sBAAsB,YAAY,OAAO;AAAA,EAClD;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}

package/dist/auth/providers/github-copilot.d.ts

@@ -33,6 +33,60 @@ export declare function normalizeDomain(input: string): string | null;
  * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.
  */
 export declare function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string;
+/**
+ * Serializable pending state for a Copilot device-code login. Safe to persist
+ * (e.g. a `pending jsonb` column) so polling can span HTTP requests/replicas.
+ */
+export interface CopilotDeviceLoginPending {
+    /** GitHub host performing the flow (`github.com` or an Enterprise hostname). */
+    domain: string;
+    /** Enterprise hostname, or undefined for github.com. Recorded on the final credentials. */
+    enterpriseDomain?: string;
+    deviceCode: string;
+    userCode: string;
+    /** Verification URL for the user to open. */
+    url: string;
+    instructions: string;
+    /** Current base poll interval in ms (grows on slow_down). */
+    intervalMs: number;
+    /** Safety margin applied to intervalMs when computing the next wait. */
+    intervalMultiplier: number;
+    /** Number of slow_down responses seen (used for the clock-drift hint). */
+    slowDownCount: number;
+    /** ms epoch after which the device authorization expires. */
+    deadlineAt: number;
+}
+export type CopilotDevicePollResult = {
+    status: 'complete';
+    credentials: GitHubCopilotCredentials;
+} | {
+    status: 'pending';
+    pending: CopilotDeviceLoginPending;
+    nextPollMs: number;
+} | {
+    status: 'failed';
+    error: string;
+};
+/** Delay to wait before the next upstream poll for a pending Copilot device login. */
+export declare function copilotNextPollDelayMs(pending: CopilotDeviceLoginPending): number;
+/**
+ * Start a Copilot device-code login: request a user code and return the
+ * serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`
+ * before the first poll.
+ */
+export declare function startGitHubCopilotDeviceLogin(enterpriseDomain?: string, options?: {
+    signal?: AbortSignal;
+}): Promise<CopilotDeviceLoginPending>;
+/**
+ * Perform exactly one upstream poll for a pending Copilot device login.
+ * On success, exchanges the GitHub OAuth token for a Copilot bearer token and
+ * returns full credentials. Never throws for flow-level conditions; network
+ * errors from fetch still propagate.
+ */
+export declare function pollGitHubCopilotDeviceLogin(pending: CopilotDeviceLoginPending, options?: {
+    signal?: AbortSignal;
+    onProgress?: (message: string) => void;
+}): Promise<CopilotDevicePollResult>;
 /**
  * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.
  *

package/dist/auth/providers/github-copilot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-copilot.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/github-copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAyBX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AA0BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzF;AA0JD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAsCnC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,QAAQ,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA+BpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA8D/B;AAED,eAAO,MAAM,0BAA0B,EAAE,sBAqBxC,CAAC"}
+{"version":3,"file":"github-copilot.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/github-copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAyBX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AA0BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzF;AAmFD;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE,GAC7D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,yBAAyB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAEjF;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAgBpC;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACzE,OAAO,CAAC,uBAAuB,CAAC,CA4DlC;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAsCnC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,QAAQ,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwCpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA8D/B;AAED,eAAO,MAAM,0BAA0B,EAAE,sBAqBxC,CAAC"}