@nodetool-ai/runtime 0.7.0-rc.23 → 0.8.2

package/dist/providers/oauth/claude-code-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-login.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAMhE,OAAO,EACL,0BAA0B,EAE1B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAE3B,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzE;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzE,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,mBAAmB,CAAC;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA4B;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,IAAI,GAAE,mBAAwB,EAmBzC;IAED,sDAAsD;IACtD,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED;;;;OAIG;IACG,KAAK,CACT,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAyFjC;IAED,8CAA8C;IACxC,MAAM,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAsB5C;IAED;;;;;;;OAOG;IACG,OAAO,CACX,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACtD,OAAO,CAAC,wBAAwB,CAAC,CAenC;IAED,+EAA+E;IACzE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAE/B;YAEa,gBAAgB;CAyB/B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM;;;EAoBtB"}

package/dist/providers/oauth/claude-code-login.js

@@ -0,0 +1,230 @@
+/**
+ * ClaudeCodeLogin — orchestration for signing in with a Claude subscription,
+ * exactly as the `claude` CLI does it, and persisting the result where the
+ * Claude Agent SDK will find it.
+ *
+ * Two completion paths share one authorization request:
+ *
+ *  - **Loopback** — the browser is redirected to an ephemeral `127.0.0.1`
+ *    listener this process binds. Works when the browser runs on the same
+ *    machine as the server (desktop, local dev).
+ *  - **Manual** — the console shows a `<code>#<state>` string the user pastes
+ *    back. The only option on a headless or remote host.
+ *
+ * The two differ only in `redirect_uri`, which must match between the
+ * authorization request and the token exchange — hence the two URLs handed back
+ * from {@link ClaudeCodeLogin.begin} and the `manual` flag carried through to
+ * completion.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { CLAUDE_CODE_CALLBACK_PATH, CLAUDE_CODE_CALLBACK_PORT, CLAUDE_CODE_OAUTH_MANUAL_REDIRECT_URL } from "@nodetool-ai/protocol";
+import { ClaudeCodeCredentialsStore, isExpired } from "./claude-code-credentials.js";
+import { ClaudeCodeOAuthClient } from "./claude-code-oauth-client.js";
+import { NotAuthenticatedError, OAuthError, StateMismatchError } from "./errors.js";
+import { LocalCallbackServer } from "./local-callback-server.js";
+import { PKCEHelper } from "./pkce-helper.js";
+import { systemClock } from "./types.js";
+/** How long a started login stays completable before the listener is torn down. */
+export const CLAUDE_LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+export class ClaudeCodeLogin {
+    client;
+    credentials;
+    pkce;
+    callbackServerFactory;
+    clock;
+    logger;
+    constructor(deps = {}) {
+        this.logger =
+            deps.logger ?? createLogger("nodetool.runtime.oauth.claude-login");
+        this.client =
+            deps.client ?? new ClaudeCodeOAuthClient({ logger: this.logger });
+        this.credentials =
+            deps.credentials ??
+                new ClaudeCodeCredentialsStore({ logger: this.logger });
+        this.pkce = deps.pkce ?? new PKCEHelper();
+        this.callbackServerFactory =
+            deps.callbackServerFactory ??
+                (() => new LocalCallbackServer({
+                    host: "127.0.0.1",
+                    port: CLAUDE_CODE_CALLBACK_PORT,
+                    path: CLAUDE_CODE_CALLBACK_PATH,
+                    logger: this.logger
+                }));
+        this.clock = deps.clock ?? systemClock;
+    }
+    /** Where the credentials the SDK reads are stored. */
+    get credentialsPath() {
+        return this.credentials.path;
+    }
+    /**
+     * Start an authorization request. Binds the loopback listener (unless
+     * `manualOnly`) and returns both authorization URLs plus the handles to
+     * finish the flow. The caller owns teardown via `cancel()`.
+     */
+    async begin(options = {}) {
+        const { verifier, challenge } = await this.pkce.createPkcePair();
+        const state = await this.pkce.createState();
+        const timeoutMs = options.timeoutMs ?? CLAUDE_LOGIN_TIMEOUT_MS;
+        let server = null;
+        let loopbackRedirectUri = null;
+        if (!options.manualOnly) {
+            server = this.callbackServerFactory();
+            let port;
+            try {
+                ({ port } = await server.listen());
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                throw new OAuthError("token_exchange_failed", `Could not bind the loopback listener on port ${CLAUDE_CODE_CALLBACK_PORT} (is a \`claude login\` already waiting?): ${message}`);
+            }
+            // The listener binds 127.0.0.1, but the registered redirect uses the
+            // `localhost` spelling the authorization server expects from the CLI.
+            loopbackRedirectUri = `http://localhost:${port}${CLAUDE_CODE_CALLBACK_PATH}`;
+        }
+        const manualAuthUrl = this.client.buildAuthorizationUrl({
+            codeChallenge: challenge,
+            state,
+            redirectUri: CLAUDE_CODE_OAUTH_MANUAL_REDIRECT_URL,
+            loginMethod: options.loginMethod
+        });
+        const authUrl = loopbackRedirectUri
+            ? this.client.buildAuthorizationUrl({
+                codeChallenge: challenge,
+                state,
+                redirectUri: loopbackRedirectUri,
+                loginMethod: options.loginMethod
+            })
+            : null;
+        const cancel = async () => {
+            const current = server;
+            server = null;
+            await current?.close().catch(() => { });
+        };
+        return {
+            authUrl,
+            redirectUri: loopbackRedirectUri,
+            manualAuthUrl,
+            state,
+            waitForRedirect: async (signal) => {
+                if (!server || !loopbackRedirectUri) {
+                    throw new OAuthError("callback_timeout", "This login was started without a loopback listener; paste the code instead");
+                }
+                try {
+                    const result = await server.waitForCode({
+                        expectedState: state,
+                        timeoutMs,
+                        signal
+                    });
+                    return await this.exchangeAndStore({
+                        code: result.code,
+                        state,
+                        codeVerifier: verifier,
+                        redirectUri: loopbackRedirectUri,
+                        signal
+                    });
+                }
+                finally {
+                    await cancel();
+                }
+            },
+            completeWithPastedCode: async (input) => {
+                const parsed = parsePastedCode(input, state);
+                try {
+                    return await this.exchangeAndStore({
+                        code: parsed.code,
+                        state: parsed.state,
+                        codeVerifier: verifier,
+                        redirectUri: CLAUDE_CODE_OAUTH_MANUAL_REDIRECT_URL
+                    });
+                }
+                finally {
+                    await cancel();
+                }
+            },
+            cancel
+        };
+    }
+    /** Non-secret summary of the stored login. */
+    async status() {
+        const stored = await this.credentials.read();
+        if (!stored) {
+            return {
+                connected: false,
+                expiresAt: null,
+                expired: false,
+                scopes: [],
+                subscriptionType: null,
+                rateLimitTier: null,
+                credentialsPath: this.credentials.path
+            };
+        }
+        return {
+            connected: true,
+            expiresAt: stored.expiresAt,
+            expired: isExpired(stored, this.clock.now()),
+            scopes: stored.scopes ?? [],
+            subscriptionType: stored.subscriptionType ?? null,
+            rateLimitTier: stored.rateLimitTier ?? null,
+            credentialsPath: this.credentials.path
+        };
+    }
+    /**
+     * Refresh the stored access token. Returns the credentials unchanged when
+     * they are still valid, unless `force` is set.
+     *
+     * The `claude` CLI refreshes on its own, so this is for callers that need a
+     * usable token *outside* the SDK (status display, `CLAUDE_CODE_OAUTH_TOKEN`)
+     * rather than a prerequisite for running the provider.
+     */
+    async refresh(options = {}) {
+        const stored = await this.credentials.read();
+        if (!stored)
+            throw new NotAuthenticatedError("No stored Claude credentials");
+        if (!options.force && !isExpired(stored, this.clock.now()))
+            return stored;
+        if (!stored.refreshToken) {
+            throw new NotAuthenticatedError("Stored Claude credentials have no refresh token; sign in again");
+        }
+        const tokens = await this.client.refreshAccessToken(stored.refreshToken, options.signal);
+        return this.credentials.save({ tokens });
+    }
+    /** Remove the stored login. Returns false when there was nothing to remove. */
+    async logout() {
+        return this.credentials.clear();
+    }
+    async exchangeAndStore(params) {
+        const tokens = await this.client.exchangeAuthorizationCode(params);
+        const profile = await this.client.fetchProfile(tokens.accessToken, params.signal);
+        const saved = await this.credentials.save({
+            tokens,
+            subscriptionType: profile?.subscriptionType ?? null,
+            rateLimitTier: profile?.rateLimitTier ?? null
+        });
+        this.logger.info("Claude Code login completed", {
+            subscriptionType: saved.subscriptionType,
+            scopes: saved.scopes,
+            credentialsPath: this.credentials.path
+        });
+        return saved;
+    }
+}
+/**
+ * Parse what the console shows after a manual authorization: `<code>#<state>`.
+ * A bare code is accepted too, falling back to the state of the login it is
+ * completing — but a mismatched state is a CSRF signal and always rejected.
+ */
+export function parsePastedCode(input, expectedState) {
+    const trimmed = input.trim();
+    if (!trimmed) {
+        throw new OAuthError("authorization_denied", "No authorization code provided");
+    }
+    const [code, state] = trimmed.split("#", 2);
+    if (!code) {
+        throw new OAuthError("authorization_denied", "No authorization code provided");
+    }
+    if (state !== undefined && state !== expectedState) {
+        throw new StateMismatchError();
+    }
+    return { code, state: expectedState };
+}
+//# sourceMappingURL=claude-code-login.js.map

package/dist/providers/oauth/claude-code-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-login.js","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,SAAS,EAEV,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAErD,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4DtD,MAAM,OAAO,eAAe;IACT,MAAM,CAAwB;IAC9B,WAAW,CAA6B;IACxC,IAAI,CAAa;IACjB,qBAAqB,CAA4B;IACjD,KAAK,CAAQ;IACb,MAAM,CAAS;IAEhC,YAAY,IAAI,GAAwB,EAAE;QACxC,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,MAAM,IAAI,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW;YACd,IAAI,CAAC,WAAW;gBAChB,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,qBAAqB;YACxB,IAAI,CAAC,qBAAqB;gBAC1B,CAAC,GAAG,EAAE,CACJ,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,yBAAyB;oBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IACzC,CAAC;IAED,sDAAsD;IACtD,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,OAAO,GAA2B,EAAE;QAEpC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAE/D,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,UAAU,CAClB,uBAAuB,EACvB,gDAAgD,yBAAyB,8CAA8C,OAAO,EAAE,CACjI,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,mBAAmB,GAAG,oBAAoB,IAAI,GAAG,yBAAyB,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACtD,aAAa,EAAE,SAAS;YACxB,KAAK;YACL,WAAW,EAAE,qCAAqC;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,mBAAmB;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBAChC,aAAa,EAAE,SAAS;gBACxB,KAAK;gBACL,WAAW,EAAE,mBAAmB;gBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC;YACvB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC;QAEF,OAAO;YACL,OAAO;YACP,WAAW,EAAE,mBAAmB;YAChC,aAAa;YACb,KAAK;YACL,eAAe,EAAE,KAAK,EAAE,MAAoB,EAAE,EAAE;gBAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACpC,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,4EAA4E,CAC7E,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;wBACtC,aAAa,EAAE,KAAK;wBACpB,SAAS;wBACT,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC;wBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,KAAK;wBACL,YAAY,EAAE,QAAQ;wBACtB,WAAW,EAAE,mBAAmB;wBAChC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,MAAM,MAAM,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,sBAAsB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC;wBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,YAAY,EAAE,QAAQ;wBACtB,WAAW,EAAE,qCAAqC;qBACnD,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,MAAM,MAAM,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,MAAM;SACP,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;aACvC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,OAAO,GAA8C,EAAE;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,qBAAqB,CAC7B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CACjD,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,MAM9B;QACC,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAC5C,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACxC,MAAM;YACN,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,IAAI;YACnD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;SACvC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,aAAqB;IAErB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC"}

package/dist/providers/oauth/claude-code-oauth-client.d.ts

@@ -0,0 +1,111 @@
+/**
+ * ClaudeCodeOAuthClient — the protocol layer for the Claude Code login.
+ *
+ * Anthropic's OAuth server does not follow RFC 6749's form-encoded token
+ * endpoint: the `claude` CLI posts a JSON body and echoes the CSRF `state` back
+ * in the code exchange, and the authorization URL carries an extra `code=true`
+ * flag. Those three deviations are why this is a sibling of {@link OAuthClient}
+ * rather than a configuration of it; everything else (typed errors, redaction,
+ * injected fetch/clock, never logging token material) is shared.
+ */
+import { type Logger } from "@nodetool-ai/config";
+import { type Clock } from "./types.js";
+/** Minimal `fetch` surface this client needs — satisfied by global `fetch`. */
+export type JsonFetchLike = (input: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    /** Decode the body as the caller's named response type. */
+    json<TBody>(): Promise<TBody>;
+}>;
+/** Which sign-in page the authorization URL points at. */
+export type ClaudeCodeLoginMethod = "claude-ai" | "console";
+/**
+ * A Claude Code token set. Shaped like the credential file's `claudeAiOauth`
+ * entry rather than {@link OAuthTokens}, because that file — not an in-memory
+ * session — is the thing this flow exists to produce.
+ */
+export interface ClaudeCodeTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string | null;
+    /** Absolute expiry in epoch ms, or null when the server sends no expiry. */
+    readonly expiresAt: number | null;
+    readonly scopes: readonly string[];
+    /** Account/organization identity echoed by the token endpoint, if any. */
+    readonly account: ClaudeCodeTokenAccount | null;
+}
+export interface ClaudeCodeTokenAccount {
+    readonly uuid: string | null;
+    readonly emailAddress: string | null;
+    readonly organizationUuid: string | null;
+}
+/** Non-secret account metadata used to label the connection in the UI. */
+export interface ClaudeCodeProfile {
+    /** "max" | "pro" | "team" | "enterprise", or null for API-billed orgs. */
+    readonly subscriptionType: string | null;
+    readonly rateLimitTier: string | null;
+    readonly emailAddress: string | null;
+    readonly displayName: string | null;
+    readonly organizationName: string | null;
+}
+export interface AuthorizationUrlOptions {
+    readonly codeChallenge: string;
+    readonly state: string;
+    /**
+     * Loopback redirect the browser is sent back to. Omit for the manual flow,
+     * where the console displays a `code#state` string for the user to paste.
+     */
+    readonly redirectUri: string;
+    /** claude.ai (subscription) or the console (API billing). Default claude.ai. */
+    readonly loginMethod?: ClaudeCodeLoginMethod;
+}
+interface ClaudeCodeOAuthClientOptions {
+    /** Override the published Claude Code client id. */
+    readonly clientId?: string;
+    readonly tokenEndpoint?: string;
+    readonly profileEndpoint?: string;
+    /** Injected fetch. Defaults to the global. */
+    readonly fetchFn?: JsonFetchLike;
+    readonly clock?: Clock;
+    readonly logger?: Logger;
+}
+export declare class ClaudeCodeOAuthClient {
+    private readonly clientId;
+    private readonly tokenEndpoint;
+    private readonly profileEndpoint;
+    private readonly fetchFn;
+    private readonly clock;
+    private readonly logger;
+    constructor(options?: ClaudeCodeOAuthClientOptions);
+    /** Build the authorization-endpoint URL the browser should open. */
+    buildAuthorizationUrl(options: AuthorizationUrlOptions): string;
+    /**
+     * Exchange an authorization code for a token set. `redirectUri` must be the
+     * exact value used in the authorization request, and `state` is echoed back
+     * in the body — Anthropic's token endpoint rejects the exchange without it.
+     */
+    exchangeAuthorizationCode(params: {
+        code: string;
+        state: string;
+        codeVerifier: string;
+        redirectUri: string;
+        signal?: AbortSignal;
+    }): Promise<ClaudeCodeTokens>;
+    /** Exchange a refresh token for a fresh access token. */
+    refreshAccessToken(refreshToken: string, signal?: AbortSignal): Promise<ClaudeCodeTokens>;
+    /**
+     * Best-effort account lookup for a friendly label. Returns null when the
+     * endpoint is unreachable or the token lacks `user:profile` — a missing
+     * label must never fail a login.
+     */
+    fetchProfile(accessToken: string, signal?: AbortSignal): Promise<ClaudeCodeProfile | null>;
+    private tokenRequest;
+    private mapErrorResponse;
+    private normalizeTokens;
+}
+export {};
+//# sourceMappingURL=claude-code-oauth-client.d.ts.map

package/dist/providers/oauth/claude-code-oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-oauth-client.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAoBhE,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,KACE,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE5D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,UAAU,4BAA4B;IACpC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA0BD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,OAAO,GAAE,4BAAiC,EASrD;IAED,oEAAoE;IACpE,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAkB9D;IAED;;;;OAIG;IACG,yBAAyB,CAAC,MAAM,EAAE;QACtC,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa5B;IAED,yDAAyD;IACnD,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAa3B;IAED;;;;OAIG;IACG,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA2BnC;YAEa,YAAY;IAiC1B,OAAO,CAAC,gBAAgB;IAiCxB,OAAO,CAAC,eAAe;CA8BxB"}

package/dist/providers/oauth/claude-code-oauth-client.js

@@ -0,0 +1,207 @@
+/**
+ * ClaudeCodeOAuthClient — the protocol layer for the Claude Code login.
+ *
+ * Anthropic's OAuth server does not follow RFC 6749's form-encoded token
+ * endpoint: the `claude` CLI posts a JSON body and echoes the CSRF `state` back
+ * in the code exchange, and the authorization URL carries an extra `code=true`
+ * flag. Those three deviations are why this is a sibling of {@link OAuthClient}
+ * rather than a configuration of it; everything else (typed errors, redaction,
+ * injected fetch/clock, never logging token material) is shared.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { CLAUDE_CODE_OAUTH_AUTHORIZATION_URL, CLAUDE_CODE_OAUTH_CLIENT_ID, CLAUDE_CODE_OAUTH_CONSOLE_AUTHORIZATION_URL, CLAUDE_CODE_OAUTH_PROFILE_URL, CLAUDE_CODE_OAUTH_REFRESH_SCOPES, CLAUDE_CODE_OAUTH_SCOPES, CLAUDE_CODE_OAUTH_TOKEN_URL, isNonEmptyString, isNumber } from "@nodetool-ai/protocol";
+import { CredentialsRevokedError, InvalidRefreshTokenError, OAuthNetworkError, TokenExchangeError } from "./errors.js";
+import { redactObject } from "./redaction.js";
+import { systemClock } from "./types.js";
+const REQUEST_TIMEOUT_MS = 30_000;
+export class ClaudeCodeOAuthClient {
+    clientId;
+    tokenEndpoint;
+    profileEndpoint;
+    fetchFn;
+    clock;
+    logger;
+    constructor(options = {}) {
+        this.clientId = options.clientId ?? CLAUDE_CODE_OAUTH_CLIENT_ID;
+        this.tokenEndpoint = options.tokenEndpoint ?? CLAUDE_CODE_OAUTH_TOKEN_URL;
+        this.profileEndpoint =
+            options.profileEndpoint ?? CLAUDE_CODE_OAUTH_PROFILE_URL;
+        this.fetchFn = options.fetchFn ?? globalThis.fetch;
+        this.clock = options.clock ?? systemClock;
+        this.logger =
+            options.logger ?? createLogger("nodetool.runtime.oauth.claude-code");
+    }
+    /** Build the authorization-endpoint URL the browser should open. */
+    buildAuthorizationUrl(options) {
+        const base = options.loginMethod === "console"
+            ? CLAUDE_CODE_OAUTH_CONSOLE_AUTHORIZATION_URL
+            : CLAUDE_CODE_OAUTH_AUTHORIZATION_URL;
+        const url = new URL(base);
+        const q = url.searchParams;
+        // `code=true` asks the server for the paste-able code display in addition
+        // to the redirect — the CLI sets it on both variants of the URL.
+        q.set("code", "true");
+        q.set("client_id", this.clientId);
+        q.set("response_type", "code");
+        q.set("redirect_uri", options.redirectUri);
+        q.set("scope", CLAUDE_CODE_OAUTH_SCOPES.join(" "));
+        q.set("code_challenge", options.codeChallenge);
+        q.set("code_challenge_method", "S256");
+        q.set("state", options.state);
+        return url.toString();
+    }
+    /**
+     * Exchange an authorization code for a token set. `redirectUri` must be the
+     * exact value used in the authorization request, and `state` is echoed back
+     * in the body — Anthropic's token endpoint rejects the exchange without it.
+     */
+    async exchangeAuthorizationCode(params) {
+        return this.tokenRequest({
+            grant_type: "authorization_code",
+            code: params.code,
+            redirect_uri: params.redirectUri,
+            client_id: this.clientId,
+            code_verifier: params.codeVerifier,
+            state: params.state
+        }, params.signal, "exchange");
+    }
+    /** Exchange a refresh token for a fresh access token. */
+    async refreshAccessToken(refreshToken, signal) {
+        const tokens = await this.tokenRequest({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: this.clientId,
+            scope: CLAUDE_CODE_OAUTH_REFRESH_SCOPES.join(" ")
+        }, signal, "refresh");
+        // The server may omit `refresh_token` on refresh; the old one stays valid.
+        return tokens.refreshToken ? tokens : { ...tokens, refreshToken };
+    }
+    /**
+     * Best-effort account lookup for a friendly label. Returns null when the
+     * endpoint is unreachable or the token lacks `user:profile` — a missing
+     * label must never fail a login.
+     */
+    async fetchProfile(accessToken, signal) {
+        try {
+            const res = await this.fetchFn(this.profileEndpoint, {
+                method: "GET",
+                headers: {
+                    authorization: `Bearer ${accessToken}`,
+                    accept: "application/json"
+                },
+                signal: signal ?? AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+            });
+            if (!res.ok)
+                return null;
+            const body = await res.json();
+            return {
+                subscriptionType: subscriptionTypeOf(body.organization?.organization_type),
+                rateLimitTier: str(body.organization?.rate_limit_tier),
+                emailAddress: str(body.account?.email_address),
+                displayName: str(body.account?.display_name),
+                organizationName: str(body.organization?.name)
+            };
+        }
+        catch (err) {
+            this.logger.debug("Claude Code profile lookup failed", {
+                error: err instanceof Error ? err.message : String(err)
+            });
+            return null;
+        }
+    }
+    async tokenRequest(body, signal, kind) {
+        let res;
+        try {
+            res = await this.fetchFn(this.tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    accept: "application/json"
+                },
+                body: JSON.stringify(body),
+                signal: signal ?? AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+            });
+        }
+        catch (err) {
+            throw new OAuthNetworkError(`Network error during token ${kind}`, {
+                cause: err
+            });
+        }
+        let payload;
+        try {
+            payload = await res.json();
+        }
+        catch {
+            payload = {};
+        }
+        if (!res.ok)
+            throw this.mapErrorResponse(res.status, payload, kind);
+        return this.normalizeTokens(payload, kind);
+    }
+    mapErrorResponse(status, payload, kind) {
+        const code = str(payload.error);
+        // Never include the raw body in the message; log a redacted copy instead.
+        this.logger.warn("Claude token endpoint returned an error", {
+            status,
+            kind,
+            error: code,
+            body: redactObject(payload)
+        });
+        const message = `Token ${kind} failed: ${code ?? status}`;
+        if (code === "invalid_grant" || status === 401) {
+            return kind === "refresh"
+                ? new InvalidRefreshTokenError(message)
+                : new TokenExchangeError("Authentication failed: invalid or expired authorization code");
+        }
+        if (code === "access_denied" || code === "invalid_client") {
+            return new CredentialsRevokedError(message);
+        }
+        if (status >= 500) {
+            return new OAuthNetworkError(`Token ${kind} failed: server error ${status}`);
+        }
+        return new TokenExchangeError(message);
+    }
+    normalizeTokens(payload, kind) {
+        const accessToken = str(payload.access_token);
+        if (!accessToken) {
+            throw new TokenExchangeError(`Token ${kind} response missing access_token`);
+        }
+        const expiresIn = isNumber(payload.expires_in) ? payload.expires_in : null;
+        const scope = str(payload.scope);
+        const accountUuid = str(payload.account?.uuid);
+        const email = str(payload.account?.email_address);
+        const orgUuid = str(payload.organization?.uuid);
+        return {
+            accessToken,
+            refreshToken: str(payload.refresh_token),
+            expiresAt: expiresIn != null ? this.clock.now() + expiresIn * 1000 : null,
+            scopes: scope ? scope.split(" ").filter(Boolean) : [],
+            account: accountUuid || email || orgUuid
+                ? {
+                    uuid: accountUuid,
+                    emailAddress: email,
+                    organizationUuid: orgUuid
+                }
+                : null
+        };
+    }
+}
+/** Map the API's organization type onto the plan label the CLI displays. */
+function subscriptionTypeOf(organizationType) {
+    switch (organizationType) {
+        case "claude_max":
+            return "max";
+        case "claude_pro":
+            return "pro";
+        case "claude_team":
+            return "team";
+        case "claude_enterprise":
+            return "enterprise";
+        default:
+            return null;
+    }
+}
+function str(value) {
+    return isNonEmptyString(value) ? value : null;
+}
+//# sourceMappingURL=claude-code-oauth-client.js.map

package/dist/providers/oauth/claude-code-oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-oauth-client.js","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAC3B,2CAA2C,EAC3C,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EAExB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAc,WAAW,EAAE,MAAM,YAAY,CAAC;AAiGrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,qBAAqB;IACf,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,eAAe,CAAS;IACxB,OAAO,CAAgB;IACvB,KAAK,CAAQ;IACb,MAAM,CAAS;IAEhC,YAAY,OAAO,GAAiC,EAAE;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,2BAA2B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,2BAA2B,CAAC;QAC1E,IAAI,CAAC,eAAe;YAClB,OAAO,CAAC,eAAe,IAAI,6BAA6B,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM;YACT,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACzE,CAAC;IAED,oEAAoE;IACpE,qBAAqB,CAAC,OAAgC;QACpD,MAAM,IAAI,GACR,OAAO,CAAC,WAAW,KAAK,SAAS;YAC/B,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QAC3B,0EAA0E;QAC1E,iEAAiE;QACjE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAM/B;QACC,OAAO,IAAI,CAAC,YAAY,CACtB;YACE,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,EACD,MAAM,CAAC,MAAM,EACb,UAAU,CACX,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,MAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC;YACE,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;SAClD,EACD,MAAM,EACN,SAAS,CACV,CAAC;QACF,2EAA2E;QAC3E,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE;gBACnD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;YACrD,OAAO;gBACL,gBAAgB,EAAE,kBAAkB,CAClC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CACrC;gBACD,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;gBACtD,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC;gBAC9C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;gBAC5C,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;aAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBACrD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAA4B,EAC5B,MAA+B,EAC/B,IAA4B;QAE5B,IAAI,GAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,IAAI,EAAE,EAAE;gBAChE,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAA4B,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,OAA4B,EAC5B,IAAY;QAEZ,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YAC1D,MAAM;YACN,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,SAAS,IAAI,YAAY,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI,wBAAwB,CAAC,OAAO,CAAC;gBACvC,CAAC,CAAC,IAAI,kBAAkB,CACpB,8DAA8D,CAC/D,CAAC;QACR,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC1D,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,OAAO,IAAI,iBAAiB,CAC1B,SAAS,IAAI,yBAAyB,MAAM,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe,CACrB,OAA4B,EAC5B,IAAY;QAEZ,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAC1B,SAAS,IAAI,gCAAgC,CAC9C,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO;YACL,WAAW;YACX,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACxC,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YACzE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;YACrD,OAAO,EACL,WAAW,IAAI,KAAK,IAAI,OAAO;gBAC7B,CAAC,CAAC;oBACE,IAAI,EAAE,WAAW;oBACjB,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,OAAO;iBAC1B;gBACH,CAAC,CAAC,IAAI;SACX,CAAC;IACJ,CAAC;CACF;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,gBAAyB;IACnD,QAAQ,gBAAgB,EAAE,CAAC;QACzB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;QACf,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC;QAChB,KAAK,mBAAmB;YACtB,OAAO,YAAY,CAAC;QACtB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC"}

package/dist/providers/oauth/errors.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Typed error hierarchy for the OAuth subsystem.
+ *
+ * Every failure mode in the spec maps to a concrete subclass so callers can
+ * branch on `instanceof` (or on the stable `code`) rather than string-matching
+ * messages. Error messages NEVER contain token material — see `redaction.ts`.
+ */
+export type OAuthErrorCode = "invalid_refresh_token" | "session_expired" | "browser_launch_failed" | "callback_timeout" | "network_error" | "credentials_revoked" | "state_mismatch" | "authorization_denied" | "token_exchange_failed" | "not_authenticated";
+/** Base class for everything thrown by the OAuth subsystem. */
+export declare class OAuthError extends Error {
+    readonly code: OAuthErrorCode;
+    constructor(code: OAuthErrorCode, message: string, options?: ErrorOptions);
+}
+/** The stored refresh token was rejected by the server (invalid_grant). */
+export declare class InvalidRefreshTokenError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** No usable credentials in the store / access token expired with no refresh. */
+export declare class SessionExpiredError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** The default browser could not be launched for the authorization request. */
+export declare class BrowserLaunchError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** The user did not complete the browser flow within the allotted time. */
+export declare class CallbackTimeoutError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** A network-level failure (DNS, TLS, connection reset) talking to the server. */
+export declare class OAuthNetworkError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** The credentials were revoked server-side (access_denied / revoked grant). */
+export declare class CredentialsRevokedError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** CSRF guard: the `state` returned to the callback did not match. */
+export declare class StateMismatchError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** The user denied the authorization request in the browser. */
+export declare class AuthorizationDeniedError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** The authorization-code → token exchange failed for a non-network reason. */
+export declare class TokenExchangeError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** A request requiring authentication was made before login completed. */
+export declare class NotAuthenticatedError extends OAuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/providers/oauth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,GAClB,eAAe,GACf,qBAAqB,GACrB,gBAAgB,GAChB,sBAAsB,GACtB,uBAAuB,GACvB,mBAAmB,CAAC;AAExB,+DAA+D;AAC/D,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,YAAY,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAMxE;CACF;AAED,2EAA2E;AAC3E,qBAAa,wBAAyB,SAAQ,UAAU;IACtD,YAAY,OAAO,SAAwC,EAAE,OAAO,CAAC,EAAE,YAAY,EAElF;CACF;AAED,iFAAiF;AACjF,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,YAAY,OAAO,SAAgD,EAAE,OAAO,CAAC,EAAE,YAAY,EAE1F;CACF;AAED,+EAA+E;AAC/E,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,SAAkD,EAAE,OAAO,CAAC,EAAE,YAAY,EAE5F;CACF;AAED,2EAA2E;AAC3E,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,OAAO,SAA6C,EAAE,OAAO,CAAC,EAAE,YAAY,EAEvF;CACF;AAED,kFAAkF;AAClF,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,SAAuC,EAAE,OAAO,CAAC,EAAE,YAAY,EAEjF;CACF;AAED,gFAAgF;AAChF,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,YAAY,OAAO,SAA6B,EAAE,OAAO,CAAC,EAAE,YAAY,EAEvE;CACF;AAED,sEAAsE;AACtE,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,SAAyC,EAAE,OAAO,CAAC,EAAE,YAAY,EAEnF;CACF;AAED,gEAAgE;AAChE,qBAAa,wBAAyB,SAAQ,UAAU;IACtD,YAAY,OAAO,SAA6B,EAAE,OAAO,CAAC,EAAE,YAAY,EAEvE;CACF;AAED,+EAA+E;AAC/E,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAO,SAAqD,EAAE,OAAO,CAAC,EAAE,YAAY,EAE/F;CACF;AAED,0EAA0E;AAC1E,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,YAAY,OAAO,SAA0C,EAAE,OAAO,CAAC,EAAE,YAAY,EAEpF;CACF"}