@meshy-ai/cli 0.1.0

package/dist/internal/credentials.js

@@ -0,0 +1,297 @@
+/**
+ * Credential store — the on-disk half of `meshy auth`.
+ *
+ * Layout: ~/.config/meshy/credentials.json, one file holding named profiles so
+ * a user can keep several accounts side by side. `~/.config` is used on every
+ * platform (including macOS, where the native spot would be Application
+ * Support) because the file is meant to be scriptable and dotfile-friendly.
+ *
+ * Non-production hosts get their own file — credentials.dev.json — so pointing
+ * MESHY_BASE_URL_V1 at staging cannot overwrite the production login, and
+ * logging out of one leaves the other alone.
+ *
+ * Every mutation runs under a cross-process lock and lands via a temp file +
+ * rename, because several agents driving this CLI in parallel is the normal
+ * case, not the exception.
+ *
+ * This module deliberately knows nothing about config.ts — it takes the base
+ * URL it needs as an argument, so config can depend on it and not vice versa.
+ */
+import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const AUTH_VERSION = 1;
+export const DEFAULT_PROFILE = "default";
+export const PROD_API_HOST = "api.meshy.ai";
+const LOCK_TIMEOUT_MS = 30_000;
+/** A lock older than this is assumed to be a crashed process's leftover. */
+const LOCK_STALE_MS = 60_000;
+/** Thrown when the file exists but cannot be understood — never on a missing file. */
+export class CredentialsFileError extends Error {
+    path;
+    constructor(path, detail) {
+        super(`Invalid credentials file at ${path}: ${detail}`);
+        this.name = "CredentialsFileError";
+        this.path = path;
+    }
+}
+// ---------------------------------------------------------------------------
+// Paths
+// ---------------------------------------------------------------------------
+/** Root config directory. MESHY_CONFIG_DIR wins when set. */
+export function configDir(env = process.env) {
+    const override = env["MESHY_CONFIG_DIR"]?.trim();
+    if (override)
+        return override;
+    return join(homedir(), ".config", "meshy");
+}
+/**
+ * True when the given v1 base URL points somewhere other than production.
+ * An unparseable URL counts as non-production: a typo should not be able to
+ * touch the production credential file.
+ */
+export function isNonProdBaseUrl(baseUrlV1) {
+    if (!baseUrlV1)
+        return false;
+    try {
+        return new URL(baseUrlV1).host !== PROD_API_HOST;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Resolves the credentials file path.
+ *
+ * MESHY_CREDENTIALS_PATH is absolute and wins over everything, including the
+ * prod/dev split — a caller that names a file gets that exact file.
+ */
+export function credentialsPath(baseUrlV1, env = process.env) {
+    const explicit = env["MESHY_CREDENTIALS_PATH"]?.trim();
+    if (explicit)
+        return explicit;
+    const name = isNonProdBaseUrl(baseUrlV1) ? "credentials.dev.json" : "credentials.json";
+    return join(configDir(env), name);
+}
+function lockPathFor(file) {
+    return join(dirname(file), "locks", `${basenameOf(file)}.lock`);
+}
+function basenameOf(file) {
+    const parts = file.split(/[/\\]/);
+    return parts[parts.length - 1] || "credentials.json";
+}
+// ---------------------------------------------------------------------------
+// Locking
+// ---------------------------------------------------------------------------
+function sleepSync(ms) {
+    // Blocking sleep without a busy loop; the store API is synchronous by design.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Runs `fn` while holding an exclusive lock keyed to `file`.
+ *
+ * O_EXCL creation is the atomic primitive here — `flock` is not exposed by
+ * Node's fs module. A lock whose mtime is older than LOCK_STALE_MS is treated
+ * as abandoned and broken, so a killed process cannot wedge the CLI forever.
+ */
+export function withCredentialsLock(file, fn) {
+    const lock = lockPathFor(file);
+    mkdirSync(dirname(lock), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let fd;
+    for (;;) {
+        try {
+            fd = openSync(lock, "wx", 0o600);
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            try {
+                if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lock);
+                    continue;
+                }
+            }
+            catch {
+                // The holder released it between open and stat — retry immediately.
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`timed out after ${LOCK_TIMEOUT_MS}ms waiting for the credentials lock at ${lock}. ` +
+                    `If no other meshy process is running, delete that file.`);
+            }
+            sleepSync(25);
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        closeSync(fd);
+        try {
+            unlinkSync(lock);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Read / write
+// ---------------------------------------------------------------------------
+function emptyFile() {
+    return { auth_version: AUTH_VERSION, active_profile: DEFAULT_PROFILE, profiles: {} };
+}
+/**
+ * Reads the credentials file. Returns null when it does not exist — that is
+ * "not logged in", not an error. A file that exists but is unreadable throws
+ * CredentialsFileError so the user hears about it instead of silently falling
+ * back to "no credentials".
+ */
+export function readCredentials(file) {
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new CredentialsFileError(file, err instanceof Error ? err.message : "unparseable JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new CredentialsFileError(file, "expected a JSON object");
+    }
+    const obj = parsed;
+    const profiles = obj["profiles"];
+    if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) {
+        throw new CredentialsFileError(file, "missing a 'profiles' object");
+    }
+    const active = typeof obj["active_profile"] === "string" ? obj["active_profile"] : DEFAULT_PROFILE;
+    const version = typeof obj["auth_version"] === "number" ? obj["auth_version"] : AUTH_VERSION;
+    return {
+        auth_version: version,
+        active_profile: active,
+        profiles: profiles,
+    };
+}
+/**
+ * Writes the file with 0600 via a temp file + rename, so a crash mid-write
+ * cannot leave a half-written credentials file behind. Callers that mutate
+ * existing state must hold the lock; see updateCredentials.
+ */
+export function writeCredentials(state, file) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    try {
+        renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+        throw err;
+    }
+    // rename preserves the temp file's mode, but an existing file's mode wins on
+    // some platforms — assert it either way.
+    chmodSync(file, 0o600);
+}
+/** Read-modify-write under the lock. The mutator may return a new state or mutate in place. */
+export function updateCredentials(file, mutate) {
+    return withCredentialsLock(file, () => {
+        const current = readCredentials(file) ?? emptyFile();
+        const next = mutate(current) ?? current;
+        writeCredentials(next, file);
+        return next;
+    });
+}
+// ---------------------------------------------------------------------------
+// Profile operations
+// ---------------------------------------------------------------------------
+export function saveProfile(file, name, profile, opts = {}) {
+    return updateCredentials(file, (state) => {
+        state.profiles[name] = { ...profile, created_at: profile.created_at ?? Date.now() };
+        if (opts.makeActive !== false)
+            state.active_profile = name;
+    });
+}
+/** Removes one profile. Returns false when it was not there to begin with. */
+export function removeProfile(file, name) {
+    let existed = false;
+    updateCredentials(file, (state) => {
+        existed = Object.prototype.hasOwnProperty.call(state.profiles, name);
+        delete state.profiles[name];
+        if (state.active_profile === name) {
+            // Fall back to any remaining profile so the store never points at a
+            // profile that isn't there.
+            state.active_profile = Object.keys(state.profiles)[0] ?? DEFAULT_PROFILE;
+        }
+    });
+    return existed;
+}
+export function setActiveProfile(file, name) {
+    updateCredentials(file, (state) => {
+        if (!Object.prototype.hasOwnProperty.call(state.profiles, name)) {
+            throw new Error(`no such profile '${name}'. Run: meshy auth list`);
+        }
+        state.active_profile = name;
+    });
+}
+/** Deletes the whole file. Returns false when there was nothing to delete. */
+export function deleteCredentialsFile(file) {
+    return withCredentialsLock(file, () => {
+        try {
+            unlinkSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return false;
+            throw err;
+        }
+    });
+}
+/**
+ * Returns the usable secret from the active profile, or null when there is no
+ * file, no active profile, or the profile carries nothing usable.
+ */
+export function resolveStoredCredential(file) {
+    const state = readCredentials(file);
+    if (!state)
+        return null;
+    const name = state.active_profile;
+    const profile = state.profiles[name];
+    if (!profile)
+        return null;
+    if (profile.kind === "api_key") {
+        if (!profile.api_key)
+            return null;
+        return { profile: name, kind: "api_key", apiKey: profile.api_key };
+    }
+    if (!profile.access_token)
+        return null;
+    return {
+        profile: name,
+        kind: "oauth",
+        accessToken: profile.access_token,
+        expiresAt: profile.expires_at,
+    };
+}
+/** `msy_abcd…wxyz` — enough to tell two keys apart, not enough to use one. */
+export function maskSecret(secret) {
+    if (secret.length <= 12)
+        return `${secret.slice(0, 2)}…`;
+    return `${secret.slice(0, 8)}…${secret.slice(-4)}`;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/internal/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/internal/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,4EAA4E;AAC5E,MAAM,aAAa,GAAG,MAAM,CAAC;AAuB7B,sFAAsF;AACtF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,+BAA+B,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,SAAS,CAAC,EAAU;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAI,IAAY,EAAE,EAAW;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,IAAI,EAAU,CAAC;IACf,SAAS,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBACxD,UAAU,CAAC,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,eAAe,0CAA0C,IAAI,IAAI;oBAClF,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAS,SAAS;IAChB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACnG,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7F,OAAO;QACL,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,MAAM;QACtB,QAAQ,EAAE,QAA6C;KACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAsB,EAAE,IAAY;IACnE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,6EAA6E;IAC7E,yCAAyC;IACzC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAA0D;IAE1D,OAAO,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;QACpC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QACxC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAY,EACZ,OAA0B,EAC1B,OAAiC,EAAE;IAEnC,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QACvC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpF,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;YAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,oEAAoE;YACpE,4BAA4B;YAC5B,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACzD,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,yBAAyB,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACzD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/internal/device-state.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Device flow state persistence — stores in-flight device flows so they can
+ * be resumed across process invocations (--no-wait → --device-flow <id>).
+ *
+ * Layout: ~/.config/meshy/device-flows.json, chmod 600.
+ * Uses the SAME O_EXCL lock + temp-rename pattern as credentials.ts.
+ *
+ * Each entry is keyed by a random flow_id (b64url 12 bytes = 16 chars).
+ * Expired entries are GC'd on every write.
+ */
+export interface DeviceFlowEntry {
+    /** Random b64url 12-byte ID for this flow. */
+    flow_id: string;
+    device_code: string;
+    base_url_v1: string;
+    scope: string;
+    /** Polling interval in seconds. */
+    interval: number;
+    /** Unix ms when the device code expires. */
+    expires_at: number;
+    /** Unix ms when this entry was created. */
+    created_at: number;
+    user_code: string;
+    verification_uri_complete: string;
+}
+export declare function deviceFlowsPath(env?: NodeJS.ProcessEnv): string;
+/** Generate a new random flow_id (b64url 12 bytes = 16 chars). */
+export declare function generateFlowId(): string;
+/**
+ * Save a device flow entry. GCs expired entries on write.
+ */
+export declare function saveDeviceFlow(entry: DeviceFlowEntry, file?: string): void;
+/**
+ * Load a device flow by flow_id. Returns null if not found or expired.
+ */
+export declare function loadDeviceFlowByFlowId(flowId: string, file?: string): DeviceFlowEntry | null;
+/**
+ * Load a device flow by device_code (scans all values). Returns null if not found or expired.
+ */
+export declare function loadDeviceFlowByDeviceCode(deviceCode: string, file?: string): DeviceFlowEntry | null;
+/**
+ * Delete a device flow by flow_id. No-op if not found.
+ */
+export declare function deleteDeviceFlow(flowId: string, file?: string): void;
+//# sourceMappingURL=device-state.d.ts.map

package/dist/internal/device-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-state.d.ts","sourceRoot":"","sources":["../../src/internal/device-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAaD,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAqHD,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE,MAA0B,GAC/B,IAAI,CAIN;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAA0B,GAC/B,eAAe,GAAG,IAAI,CAMxB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAA0B,GAC/B,eAAe,GAAG,IAAI,CASxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAA0B,GAC/B,IAAI,CAIN"}

package/dist/internal/device-state.js

@@ -0,0 +1,180 @@
+/**
+ * Device flow state persistence — stores in-flight device flows so they can
+ * be resumed across process invocations (--no-wait → --device-flow <id>).
+ *
+ * Layout: ~/.config/meshy/device-flows.json, chmod 600.
+ * Uses the SAME O_EXCL lock + temp-rename pattern as credentials.ts.
+ *
+ * Each entry is keyed by a random flow_id (b64url 12 bytes = 16 chars).
+ * Expired entries are GC'd on every write.
+ */
+import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+import { configDir } from "./credentials.js";
+// ---------------------------------------------------------------------------
+// Paths and locking
+// ---------------------------------------------------------------------------
+const LOCK_TIMEOUT_MS = 30_000;
+const LOCK_STALE_MS = 60_000;
+export function deviceFlowsPath(env = process.env) {
+    return join(configDir(env), "device-flows.json");
+}
+function lockPathFor(file) {
+    const parts = file.split(/[/\\]/);
+    const base = parts[parts.length - 1] || "device-flows.json";
+    return join(dirname(file), "locks", `${base}.lock`);
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withDeviceFlowsLock(file, fn) {
+    const lock = lockPathFor(file);
+    mkdirSync(dirname(lock), { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let fd;
+    for (;;) {
+        try {
+            fd = openSync(lock, "wx", 0o600);
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            try {
+                if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lock);
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`timed out after ${LOCK_TIMEOUT_MS}ms waiting for the device-flows lock at ${lock}. ` +
+                    `If no other meshy process is running, delete that file.`);
+            }
+            sleepSync(25);
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        closeSync(fd);
+        try {
+            unlinkSync(lock);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Read / write
+// ---------------------------------------------------------------------------
+function readDeviceFlows(file) {
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { flows: {} };
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || !parsed.flows)
+            return { flows: {} };
+        return parsed;
+    }
+    catch {
+        return { flows: {} };
+    }
+}
+function writeDeviceFlows(state, file) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    try {
+        renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+        throw err;
+    }
+    chmodSync(file, 0o600);
+}
+/** GC expired entries. Mutates the state in place. */
+function gcExpired(state) {
+    const now = Date.now();
+    for (const [id, entry] of Object.entries(state.flows)) {
+        if (entry.expires_at <= now) {
+            delete state.flows[id];
+        }
+    }
+}
+function updateDeviceFlows(file, mutate) {
+    return withDeviceFlowsLock(file, () => {
+        const current = readDeviceFlows(file);
+        gcExpired(current);
+        const result = mutate(current);
+        writeDeviceFlows(current, file);
+        return result;
+    });
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/** Generate a new random flow_id (b64url 12 bytes = 16 chars). */
+export function generateFlowId() {
+    return randomBytes(12).toString("base64url");
+}
+/**
+ * Save a device flow entry. GCs expired entries on write.
+ */
+export function saveDeviceFlow(entry, file = deviceFlowsPath()) {
+    updateDeviceFlows(file, (state) => {
+        state.flows[entry.flow_id] = entry;
+    });
+}
+/**
+ * Load a device flow by flow_id. Returns null if not found or expired.
+ */
+export function loadDeviceFlowByFlowId(flowId, file = deviceFlowsPath()) {
+    const state = readDeviceFlows(file);
+    const entry = state.flows[flowId];
+    if (!entry)
+        return null;
+    if (entry.expires_at <= Date.now())
+        return null;
+    return entry;
+}
+/**
+ * Load a device flow by device_code (scans all values). Returns null if not found or expired.
+ */
+export function loadDeviceFlowByDeviceCode(deviceCode, file = deviceFlowsPath()) {
+    const state = readDeviceFlows(file);
+    const now = Date.now();
+    for (const entry of Object.values(state.flows)) {
+        if (entry.device_code === deviceCode && entry.expires_at > now) {
+            return entry;
+        }
+    }
+    return null;
+}
+/**
+ * Delete a device flow by flow_id. No-op if not found.
+ */
+export function deleteDeviceFlow(flowId, file = deviceFlowsPath()) {
+    updateDeviceFlows(file, (state) => {
+        delete state.flows[flowId];
+    });
+}
+//# sourceMappingURL=device-state.js.map

package/dist/internal/device-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-state.js","sourceRoot":"","sources":["../../src/internal/device-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AA0B7C,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,mBAAmB,CAAC;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,mBAAmB,CAAI,IAAY,EAAE,EAAW;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,IAAI,EAAU,CAAC;IACf,SAAS,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBACxD,UAAU,CAAC,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,eAAe,2CAA2C,IAAI,IAAI;oBACnF,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC3E,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAsB,EAAE,IAAY;IAC5D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,MAAqC;IAErC,OAAO,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;QACpC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,kEAAkE;AAClE,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,OAAe,eAAe,EAAE;IAEhC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,OAAe,eAAe,EAAE;IAEhC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,OAAe,eAAe,EAAE;IAEhC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAe,eAAe,EAAE;IAEhC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/device.d.ts

@@ -0,0 +1,79 @@
+/**
+ * OAuth 2.0 Device Authorization Grant (RFC 8628) helpers.
+ *
+ * Implements:
+ *   - deviceAuthorization(): POST /oauth/device_authorization
+ *   - pollDeviceToken(): polling loop for /oauth/token with device_code grant
+ *   - ensureRequestedScopesGranted(): scope verification
+ */
+import { HintedError } from "./errors.js";
+import type { TokenResponse } from "./oauth.js";
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface PollDeviceTokenOpts {
+    /** Initial polling interval in seconds (from server; clamped to ≥1 → 5). */
+    interval: number;
+    /** Token lifetime in seconds (from server). */
+    expiresIn: number;
+    /** Optional callback called on each authorization_pending response. */
+    onPending?: () => void;
+    /** Optional hard deadline override (unix ms). Defaults to now + expiresIn*1000. */
+    deadline?: number;
+}
+/**
+ * Thrown when the /oauth/device_authorization endpoint returns 404.
+ * Indicates the meshyd deployment does not support device flow yet.
+ */
+export declare class DeviceFlowNotSupportedError extends HintedError {
+    constructor();
+}
+/**
+ * An error from the device token polling endpoint that carries the machine
+ * error code from the OAuth response body.
+ */
+export declare class DeviceFlowError extends HintedError {
+    readonly oauthErrorCode: string;
+    constructor(params: {
+        message: string;
+        code: string;
+        oauthErrorCode: string;
+        hint?: string;
+    });
+}
+/**
+ * POST /oauth/device_authorization to start a device flow.
+ *
+ * @throws DeviceFlowNotSupportedError on 404
+ * @throws HintedError on other non-200 responses
+ */
+export declare function deviceAuthorization(baseUrlV1: string, scope?: string): Promise<DeviceAuthorizationResponse>;
+/**
+ * Poll the device token endpoint until the user approves, denies, or the
+ * token expires.
+ *
+ * Implements RFC 8628 §3.5 polling semantics:
+ *   - authorization_pending → wait current interval
+ *   - slow_down or HTTP 429 → interval += 5s (capped at 60s), wait
+ *   - expired_token or deadline exceeded → throw oauth_timeout
+ *   - access_denied → throw AUTH error
+ *   - invalid_grant → throw AUTH error (already consumed)
+ *   - 5xx / network → retry up to 3 consecutive, then throw
+ */
+export declare function pollDeviceToken(baseUrlV1: string, deviceCode: string, opts: PollDeviceTokenOpts): Promise<TokenResponse>;
+/**
+ * Verify that all requested scopes were granted.
+ *
+ * Both `requested` and `granted` are space-separated scope strings.
+ * Today both are "" — this trivially passes. Implemented generically for
+ * future use.
+ *
+ * @throws HintedError listing missing scopes if any requested scope is absent.
+ */
+export declare function ensureRequestedScopesGranted(requested: string, granted: string | undefined): void;
+//# sourceMappingURL=device.d.ts.map

package/dist/internal/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/internal/device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMhD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;;CAc3D;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;CAKF;AAQD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,2BAA2B,CAAC,CAgGtC;AAwGD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,aAAa,CAAC,CAkHxB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,IAAI,CAcN"}