@noodleseed/one 0.62.0 → 0.63.0

package/dist/platform-support.js

@@ -0,0 +1,118 @@
+import { existsSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import { EXIT, printJsonFailure } from './commands/output.js';
+const DISCOVERY_COMMANDS = new Set(['--help', '-h', 'help', '--version', '-v', 'version']);
+const MOUNTED_WINDOWS_PATH = /^\/mnt\/[a-z](?:\/|$)/i;
+export function platformSupportFailure(argv, platform) {
+    if (platform !== 'win32' || DISCOVERY_COMMANDS.has(argv[0] ?? ''))
+        return undefined;
+    return {
+        code: 'unsupported_platform',
+        message: 'Noodle CLI commands run on macOS or Windows through WSL2.',
+        cause: 'Native Windows shells are not supported in this first slice.',
+        fix: 'Install WSL2 with Ubuntu and run Noodle from its Linux terminal.',
+        next: 'wsl --install -d Ubuntu',
+    };
+}
+export function enforcePlatformSupport(argv, platform) {
+    const failure = platformSupportFailure(argv, platform);
+    if (failure === undefined)
+        return undefined;
+    if (argv.includes('--json'))
+        return printJsonFailure(failure, EXIT.USAGE);
+    console.error([
+        `${failure.code}: ${failure.message}`,
+        `Cause: ${failure.cause}`,
+        `Fix: ${failure.fix}`,
+        `Next: ${failure.next}`,
+    ].join('\n'));
+    return EXIT.USAGE;
+}
+export function wslPlatformChecks(input) {
+    if (!isWsl(input.platform, input.env, input.kernelRelease))
+        return [];
+    const distro = input.env.WSL_DISTRO_NAME;
+    const isWsl2 = /wsl2/i.test(input.kernelRelease);
+    const isUbuntu = distro !== undefined && /^ubuntu(?:-|$)/i.test(distro);
+    const checks = [
+        !isWsl2
+            ? {
+                level: 'WARN',
+                name: 'Platform',
+                message: `WSL version 2 not detected${distro ? ` (${distro})` : ''}`,
+                cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                fix: 'Upgrade this distro to WSL2 from PowerShell.',
+                next: distro !== undefined
+                    ? `wsl.exe --set-version ${distro} 2`
+                    : 'wsl.exe --set-default-version 2',
+            }
+            : distro === undefined
+                ? {
+                    level: 'WARN',
+                    name: 'Platform',
+                    message: 'WSL2 distro could not be identified',
+                    cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                    fix: 'Run Noodle from an Ubuntu WSL2 terminal.',
+                    next: 'wsl.exe --list --verbose',
+                }
+                : !isUbuntu
+                    ? {
+                        level: 'WARN',
+                        name: 'Platform',
+                        message: `WSL2 distro is not Ubuntu (${distro})`,
+                        cause: 'The supported Windows environment is WSL2 with Ubuntu.',
+                        fix: 'Install the supported Ubuntu distro for Noodle CLI work.',
+                        next: 'wsl.exe --install -d Ubuntu',
+                    }
+                    : {
+                        level: 'PASS',
+                        name: 'Platform',
+                        message: `WSL2 (${distro})`,
+                    },
+    ];
+    if (isMountedWindowsPath(input.cwd)) {
+        checks.push({
+            level: 'WARN',
+            name: 'WSL workspace',
+            message: input.cwd,
+            cause: 'The project is on a mounted Windows drive, which makes Node file watching and installs slower and less reliable.',
+            fix: 'Move the repository into the WSL Linux filesystem, such as ~/src.',
+            next: 'mkdir -p ~/src',
+        });
+    }
+    if (isMountedWindowsPath(input.nodePath) || isMountedWindowsPath(input.npmPath)) {
+        checks.push({
+            level: 'WARN',
+            name: 'WSL runtime',
+            message: 'mounted Windows Node/npm detected',
+            cause: 'Node or npm resolves from /mnt, so the CLI is mixing Windows tools with the WSL environment.',
+            fix: 'Install Node 24 and npm inside WSL, then ensure the Linux binaries appear first on PATH.',
+            next: 'command -v node && command -v npm',
+        });
+    }
+    return checks;
+}
+export function findExecutableOnPath(name, pathValue) {
+    if (!pathValue)
+        return undefined;
+    for (const directory of pathValue.split(delimiter)) {
+        if (!directory)
+            continue;
+        for (const candidateName of [name, `${name}.cmd`, `${name}.exe`]) {
+            const candidate = join(directory, candidateName);
+            if (existsSync(candidate))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+function isWsl(platform, env, kernelRelease) {
+    return (platform === 'linux' &&
+        (env.WSL_DISTRO_NAME !== undefined ||
+            env.WSL_INTEROP !== undefined ||
+            /microsoft|wsl/i.test(kernelRelease)));
+}
+function isMountedWindowsPath(path) {
+    return path !== undefined && MOUNTED_WINDOWS_PATH.test(path);
+}
+//# sourceMappingURL=platform-support.js.map

package/dist/platform-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-support.js","sourceRoot":"","sources":["../src/platform-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAoBtD,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,QAAyB;IAEzB,IAAI,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,2DAA2D;QACpE,KAAK,EAAE,8DAA8D;QACrE,GAAG,EAAE,kEAAkE;QACvE,IAAI,EAAE,yBAAyB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,QAAyB;IAEzB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CACX;QACE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE;QACrC,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,QAAQ,OAAO,CAAC,GAAG,EAAE;QACrB,SAAS,OAAO,CAAC,IAAI,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAA0B;QACpC,CAAC,MAAM;YACL,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,6BAA6B,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,KAAK,EAAE,wDAAwD;gBAC/D,GAAG,EAAE,8CAA8C;gBACnD,IAAI,EACF,MAAM,KAAK,SAAS;oBAClB,CAAC,CAAC,yBAAyB,MAAM,IAAI;oBACrC,CAAC,CAAC,iCAAiC;aACxC;YACH,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC;oBACE,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,wDAAwD;oBAC/D,GAAG,EAAE,0CAA0C;oBAC/C,IAAI,EAAE,0BAA0B;iBACjC;gBACH,CAAC,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC;wBACE,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,UAAU;wBAChB,OAAO,EAAE,8BAA8B,MAAM,GAAG;wBAChD,KAAK,EAAE,wDAAwD;wBAC/D,GAAG,EAAE,0DAA0D;wBAC/D,IAAI,EAAE,6BAA6B;qBACpC;oBACH,CAAC,CAAC;wBACE,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,UAAU;wBAChB,OAAO,EAAE,SAAS,MAAM,GAAG;qBAC5B;KACV,CAAC;IAEF,IAAI,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EACH,kHAAkH;YACpH,GAAG,EAAE,mEAAmE;YACxE,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EACH,8FAA8F;YAChG,GAAG,EAAE,0FAA0F;YAC/F,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,KAAK,MAAM,aAAa,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CAAC,QAAyB,EAAE,GAAsB,EAAE,aAAqB;IACrF,OAAO,CACL,QAAQ,KAAK,OAAO;QACpB,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;YAChC,GAAG,CAAC,WAAW,KAAK,SAAS;YAC7B,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,OAAO,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAIA,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAqET;AAkCD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAIA,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAuIT;AA0CD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.js

@@ -3,6 +3,7 @@ import { clientRegistrationHandler } from '@modelcontextprotocol/sdk/server/auth
 import { revocationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/revoke.js';
 import { tokenHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/token.js';
 import express, {} from 'express';
+import { rateLimit as createRateLimit } from 'express-rate-limit';
 import { renderOAuthErrorPage } from './branding.js';
 export function createOAuthApp(provider, options = {}) {
     const app = express();
@@ -17,7 +18,64 @@ export function createOAuthApp(provider, options = {}) {
             xForwardedForHeader: false,
         },
     };
+    app.use(['/device_authorization', '/device', '/oauth/device/callback'], createRateLimit({
+        windowMs: 60_000,
+        limit: 30,
+        standardHeaders: true,
+        legacyHeaders: false,
+        ...rateLimit,
+    }), createRateLimit({
+        windowMs: 60_000,
+        limit: 600,
+        standardHeaders: false,
+        legacyHeaders: false,
+        keyGenerator: transportRateLimitKey,
+        validate: rateLimit.validate,
+    }));
+    const deviceTokenRateLimit = createRateLimit({
+        windowMs: 60_000,
+        limit: 30,
+        standardHeaders: true,
+        legacyHeaders: false,
+        ...rateLimit,
+    });
+    const deviceTokenTransportRateLimit = createRateLimit({
+        windowMs: 60_000,
+        limit: 600,
+        standardHeaders: false,
+        legacyHeaders: false,
+        keyGenerator: transportRateLimitKey,
+        validate: rateLimit.validate,
+    });
     app.use('/authorize', authorizationHandler({ provider, rateLimit }));
+    app.post('/device_authorization', express.urlencoded({ extended: false }), (req, res) => {
+        void provider.deviceAuthorizationFlow
+            .handleAuthorization(req, res)
+            .catch(() => failJson(res));
+    });
+    app.get('/device', (req, res) => {
+        provider.deviceAuthorizationFlow.handleVerificationPage(req, res);
+    });
+    app.post('/device', express.urlencoded({ extended: false }), (req, res) => {
+        void provider.deviceAuthorizationFlow.handleVerification(req, res).catch(() => failPlain(res));
+    });
+    app.get('/oauth/device/callback', (req, res) => {
+        void provider.deviceAuthorizationFlow.handleCallback(req, res).catch(() => failPlain(res));
+    });
+    app.use(express.urlencoded({ extended: false }));
+    app.use('/token', allowCors);
+    app.use('/token', (req, res, next) => {
+        const body = (req.body ?? {});
+        if (body.grant_type !== 'urn:ietf:params:oauth:grant-type:device_code') {
+            next();
+            return;
+        }
+        deviceTokenTransportRateLimit(req, res, () => {
+            deviceTokenRateLimit(req, res, () => {
+                void provider.deviceAuthorizationFlow.handleToken(req, res).catch(() => failJson(res));
+            });
+        });
+    });
     app.use('/token', tokenHandler({ provider, rateLimit }));
     app.use('/revoke', revocationHandler({ provider, rateLimit }));
     app.use('/register', clientRegistrationHandler({ clientsStore: provider.clientsStore, rateLimit }));
@@ -63,6 +121,10 @@ function failPlain(res) {
     if (!res.headersSent)
         res.status(500).type('text/html').send(renderOAuthErrorPage());
 }
+function failJson(res) {
+    if (!res.headersSent)
+        res.status(500).json({ error: 'server_error' });
+}
 function rateLimitKey(req, trustProxy) {
     if (trustProxy) {
         const forwarded = firstForwardedFor(req.headers.forwarded);
@@ -74,6 +136,9 @@ function rateLimitKey(req, trustProxy) {
     }
     return req.ip ?? req.socket.remoteAddress ?? 'unknown';
 }
+function transportRateLimitKey(req) {
+    return req.socket.remoteAddress ?? 'unknown';
+}
 function firstForwardedFor(value) {
     const raw = firstHeaderValue(value);
     if (!raw)

package/node_modules/@noodle-borg/service/dist/oauth/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,OAAO,EAAE,EAA6C,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgBrD,MAAM,UAAU,cAAc,CAC5B,QAA6B,EAC7B,UAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;QAC9E,QAAQ,EAAE;YACR,eAAe,EAAE,KAAK;YACtB,sBAAsB,EAAE,KAAK;YAC7B,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CACL,WAAW,EACX,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAC9E,CAAC;IAEF,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,mCAAmC,EACnC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB;IAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,UAAmB;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,OAAO,EAAE,EAA6C,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgBrD,MAAM,UAAU,cAAc,CAC5B,QAA6B,EAC7B,UAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG;QAChB,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;QAC9E,QAAQ,EAAE;YACR,eAAe,EAAE,KAAK;YACtB,sBAAsB,EAAE,KAAK;YAC7B,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,CAAC,uBAAuB,EAAE,SAAS,EAAE,wBAAwB,CAAC,EAC9D,eAAe,CAAC;QACd,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,GAAG,SAAS;KACb,CAAC,EACF,eAAe,CAAC;QACd,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,GAAG;QACV,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,oBAAoB,GAAG,eAAe,CAAC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,GAAG,SAAS;KACb,CAAC,CAAC;IACH,MAAM,6BAA6B,GAAG,eAAe,CAAC;QACpD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,GAAG;QACV,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,uBAAuB;aAClC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACjD,QAAQ,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3F,KAAK,QAAQ,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,uBAAuB,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,IAAI,CAAC,UAAU,KAAK,8CAA8C,EAAE,CAAC;YACvE,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;gBAClC,KAAK,QAAQ,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CACL,WAAW,EACX,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAC9E,CAAC;IAEF,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,mCAAmC,EACnC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,KAAK,QAAQ,CAAC,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB;IAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,UAAmB;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.d.ts

@@ -0,0 +1,20 @@
+import type { Request, Response } from 'express';
+import type { NoodleOAuthProvider } from './provider.js';
+import type { OAuthStore } from './store.js';
+export declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** RFC 8628 endpoints, backed by the existing authorization-code consent path in the browser. */
+export declare class DeviceAuthorizationFlow {
+    #private;
+    constructor(input: {
+        readonly issuer: string;
+        readonly store: OAuthStore;
+        readonly provider: NoodleOAuthProvider;
+        readonly now?: () => number;
+    });
+    handleAuthorization(req: Request, res: Response): Promise<void>;
+    handleVerificationPage(req: Request, res: Response): void;
+    handleVerification(req: Request, res: Response): Promise<void>;
+    handleCallback(req: Request, res: Response): Promise<void>;
+    handleToken(req: Request, res: Response): Promise<void>;
+}
+//# sourceMappingURL=device-flow.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/oauth/device-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,eAAO,MAAM,YAAY,iDAAiD,CAAC;AAI3E,iGAAiG;AACjG,qBAAa,uBAAuB;;gBAMtB,KAAK,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KAC7B;IAOK,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDrE,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAKnD,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC9D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1D,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAwD9D"}

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.js

@@ -0,0 +1,239 @@
+import { randomBytes } from 'node:crypto';
+import { renderOAuthPage } from './branding.js';
+import { hashToken, randomToken } from './tokens.js';
+export const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEVICE_TTL_SECONDS = 600;
+const DEVICE_POLL_INTERVAL_SECONDS = 5;
+/** RFC 8628 endpoints, backed by the existing authorization-code consent path in the browser. */
+export class DeviceAuthorizationFlow {
+    #issuer;
+    #store;
+    #provider;
+    #nowSeconds;
+    constructor(input) {
+        this.#issuer = input.issuer.replace(/\/+$/, '');
+        this.#store = input.store;
+        this.#provider = input.provider;
+        this.#nowSeconds = input.now ?? (() => Math.floor(Date.now() / 1000));
+    }
+    async handleAuthorization(req, res) {
+        const body = formBody(req);
+        const clientId = stringField(body, 'client_id');
+        const resource = stringField(body, 'resource');
+        const scope = optionalStringField(body, 'scope');
+        if (clientId === undefined || resource === undefined || !this.#validResource(resource)) {
+            sendOAuthError(res, 'invalid_request');
+            return;
+        }
+        const client = await this.#store.getClient(clientId);
+        const callback = this.#callbackUrl();
+        if (client === undefined ||
+            client.token_endpoint_auth_method !== 'none' ||
+            !client.grant_types?.includes(DEVICE_GRANT) ||
+            !client.redirect_uris.includes(callback)) {
+            sendOAuthError(res, 'invalid_client', 401);
+            return;
+        }
+        const rawDeviceCode = randomToken();
+        const rawUserCode = userCode();
+        const now = this.#nowSeconds();
+        await this.#store.createDeviceAuthorization({
+            deviceCode: hashToken(rawDeviceCode),
+            userCode: hashToken(normalizeUserCode(rawUserCode)),
+            clientId,
+            resource: normalizeUrl(resource),
+            ...(scope !== undefined ? { scope } : {}),
+            status: 'pending',
+            expiresAt: now + DEVICE_TTL_SECONDS,
+            nextPollAt: now,
+            intervalSeconds: DEVICE_POLL_INTERVAL_SECONDS,
+        });
+        const verificationUri = `${this.#issuer}/device`;
+        const complete = new URL(verificationUri);
+        complete.searchParams.set('user_code', rawUserCode);
+        res.setHeader('cache-control', 'no-store');
+        res.json({
+            device_code: rawDeviceCode,
+            user_code: rawUserCode,
+            verification_uri: verificationUri,
+            verification_uri_complete: complete.href,
+            expires_in: DEVICE_TTL_SECONDS,
+            interval: DEVICE_POLL_INTERVAL_SECONDS,
+        });
+    }
+    handleVerificationPage(req, res) {
+        const code = typeof req.query.user_code === 'string' ? req.query.user_code : '';
+        res.status(200).type('html').send(renderDeviceCodePage(code));
+    }
+    async handleVerification(req, res) {
+        const rawUserCode = stringField(formBody(req), 'user_code');
+        const normalized = rawUserCode === undefined ? undefined : normalizeUserCode(rawUserCode);
+        const device = normalized === undefined
+            ? undefined
+            : await this.#store.getDeviceAuthorizationByUserCode(hashToken(normalized));
+        if (device === undefined) {
+            res
+                .status(400)
+                .type('html')
+                .send(renderDeviceCodePage(rawUserCode ?? '', true));
+            return;
+        }
+        const rawState = randomToken();
+        const challenge = randomToken();
+        await this.#store.createDeviceBrowserSession({
+            state: hashToken(rawState),
+            deviceCode: device.deviceCode,
+            clientId: device.clientId,
+            resource: device.resource,
+            codeChallenge: challenge,
+            expiresAt: device.expiresAt,
+        });
+        const authorize = new URL(`${this.#issuer}/authorize`);
+        authorize.searchParams.set('client_id', device.clientId);
+        authorize.searchParams.set('redirect_uri', this.#callbackUrl());
+        authorize.searchParams.set('response_type', 'code');
+        authorize.searchParams.set('code_challenge', challenge);
+        authorize.searchParams.set('code_challenge_method', 'S256');
+        authorize.searchParams.set('state', rawState);
+        authorize.searchParams.set('resource', device.resource);
+        if (device.scope !== undefined)
+            authorize.searchParams.set('scope', device.scope);
+        res.redirect(302, authorize.href);
+    }
+    async handleCallback(req, res) {
+        const rawState = typeof req.query.state === 'string' ? req.query.state : undefined;
+        const session = rawState === undefined
+            ? undefined
+            : await this.#store.consumeDeviceBrowserSession(hashToken(rawState));
+        if (session === undefined) {
+            res.status(400).type('html').send(renderCompletionPage(false));
+            return;
+        }
+        if (typeof req.query.error === 'string') {
+            await this.#store.denyDeviceAuthorization(session.deviceCode);
+            res.status(200).type('html').send(renderCompletionPage(false));
+            return;
+        }
+        const code = typeof req.query.code === 'string' ? req.query.code : undefined;
+        const approved = code !== undefined && (await this.#provider.completeDeviceAuthorization(session, code));
+        res
+            .status(approved ? 200 : 400)
+            .type('html')
+            .send(renderCompletionPage(approved));
+    }
+    async handleToken(req, res) {
+        const body = formBody(req);
+        const clientId = stringField(body, 'client_id');
+        const rawDeviceCode = stringField(body, 'device_code');
+        const resource = optionalStringField(body, 'resource');
+        if (clientId === undefined || rawDeviceCode === undefined) {
+            sendOAuthError(res, 'invalid_request');
+            return;
+        }
+        const client = await this.#store.getClient(clientId);
+        if (client === undefined ||
+            client.token_endpoint_auth_method !== 'none' ||
+            !client.grant_types?.includes(DEVICE_GRANT)) {
+            sendOAuthError(res, 'invalid_client', 401);
+            return;
+        }
+        const result = await this.#store.pollDeviceAuthorization({
+            deviceCode: hashToken(rawDeviceCode),
+            clientId,
+            ...(resource !== undefined ? { resource: normalizeUrl(resource) } : {}),
+            nowSeconds: this.#nowSeconds(),
+        });
+        if (result.status !== 'approved') {
+            sendOAuthError(res, result.status);
+            return;
+        }
+        const tokens = await this.#provider.issueDeviceTokens(result.record);
+        if (!(await this.#store.completeDeviceTokenIssuance(result.record.deviceCode, result.record.clientId))) {
+            sendOAuthError(res, 'expired_token');
+            return;
+        }
+        res.setHeader('cache-control', 'no-store');
+        res.json(tokens);
+    }
+    #callbackUrl() {
+        return `${this.#issuer}/oauth/device/callback`;
+    }
+    #validResource(resource) {
+        try {
+            const normalized = normalizeUrl(resource);
+            return (normalized === normalizeUrl(this.#issuer) || normalized === `${this.#issuer}/developer/cli`);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function formBody(req) {
+    return (req.body ?? {});
+}
+function stringField(body, name) {
+    const value = body[name];
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function optionalStringField(body, name) {
+    return stringField(body, name);
+}
+function normalizeUrl(value) {
+    const url = new URL(value);
+    url.hash = '';
+    url.search = '';
+    return url.href;
+}
+function normalizeUserCode(value) {
+    return value.toUpperCase().replace(/[^A-Z2-9]/g, '');
+}
+function userCode() {
+    const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+    const bytes = randomBytes(8);
+    let value = '';
+    for (let index = 0; index < 8; index += 1) {
+        value += alphabet[(bytes[index] ?? 0) % alphabet.length];
+    }
+    return `${value.slice(0, 4)}-${value.slice(4)}`;
+}
+function sendOAuthError(res, error, status = 400) {
+    res.setHeader('cache-control', 'no-store');
+    res.status(status).json({ error });
+}
+function renderDeviceCodePage(code, invalid = false) {
+    return renderOAuthPage({
+        title: 'Sign in — Noodle Seed',
+        kicker: 'CLI sign in',
+        heading: 'Enter your device code',
+        contentHtml: `${invalid ? '<p class="ns-lede">That code is invalid or expired. Try the code again.</p>' : ''}${code === ''
+            ? ''
+            : `<p class="ns-lede">Confirm <strong>${escapeHtml(code)}</strong> matches the code shown in your terminal.</p>`}<form method="post" action="/device">
+      <label for="user_code">Device code</label>
+      <input id="user_code" name="user_code" value="${escapeHtml(code)}" autocomplete="one-time-code" required />
+      <div class="btn-glow"><button class="btn btn-primary" type="submit">Continue</button></div>
+    </form>`,
+    });
+}
+function renderCompletionPage(approved) {
+    return renderOAuthPage({
+        title: `${approved ? 'Signed in' : 'Sign-in denied'} — Noodle Seed`,
+        kicker: approved ? 'Complete' : 'Not completed',
+        heading: approved ? 'You are signed in' : 'Sign-in was not completed',
+        contentHtml: approved
+            ? '<p class="ns-lede">You can return to your terminal. This window can now be closed.</p>'
+            : '<p class="ns-lede">Return to your terminal and start sign-in again if you still want to continue.</p>',
+    });
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (character) => {
+        const entities = {
+            '&': '&amp;',
+            '<': '&lt;',
+            '>': '&gt;',
+            '"': '&quot;',
+            "'": '&#39;',
+        };
+        return entities[character] ?? character;
+    });
+}
+//# sourceMappingURL=device-flow.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/oauth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAC3E,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC,iGAAiG;AACjG,MAAM,OAAO,uBAAuB;IACzB,OAAO,CAAS;IAChB,MAAM,CAAa;IACnB,SAAS,CAAsB;IAC/B,WAAW,CAAe;IAEnC,YAAY,KAKX;QACC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvF,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,0BAA0B,KAAK,MAAM;YAC5C,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC3C,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC1C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;YACpC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACnD,QAAQ;YACR,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;YAChC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG,GAAG,kBAAkB;YACnC,UAAU,EAAE,GAAG;YACf,eAAe,EAAE,4BAA4B;SAC9C,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,OAAO,SAAS,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACpD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,WAAW,EAAE,aAAa;YAC1B,SAAS,EAAE,WAAW;YACtB,gBAAgB,EAAE,eAAe;YACjC,yBAAyB,EAAE,QAAQ,CAAC,IAAI;YACxC,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,4BAA4B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB,CAAC,GAAY,EAAE,GAAa;QAChD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAClD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC1F,MAAM,MAAM,GACV,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,oBAAoB,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC;YAC3C,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAChE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACxD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QAC9C,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,QAAQ,GACZ,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1F,GAAG;aACA,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;aAC5B,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1D,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,0BAA0B,KAAK,MAAM;YAC5C,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC3C,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACvD,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;YACpC,QAAQ;YACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,EACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CAAC,EACF,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAED,YAAY;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO,CACL,UAAU,KAAK,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAC5F,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B,EAAE,IAAY;IACtE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,GAAa,EAAE,KAAa,EAAE,MAAM,GAAG,GAAG;IAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IACzD,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,GACX,OAAO,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC,CAAC,EAC5F,GACE,IAAI,KAAK,EAAE;YACT,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,sCAAsC,UAAU,CAAC,IAAI,CAAC,wDAC5D;;sDAEkD,UAAU,CAAC,IAAI,CAAC;;YAE1D;KACT,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,gBAAgB;QACnE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe;QAC/C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,2BAA2B;QACrE,WAAW,EAAE,QAAQ;YACnB,CAAC,CAAC,wFAAwF;YAC1F,CAAC,CAAC,uGAAuG;KAC5G,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAA2B;YACvC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO;SACb,CAAC;QACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
+import type { OAuthStore } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+export declare function completeDeviceAuthorization(input: {
+    readonly store: OAuthStore;
+    readonly issuer: string;
+    readonly session: DeviceBrowserSessionRecord;
+    readonly authorizationCode: string;
+}): Promise<boolean>;
+export declare function issueDeviceTokens(input: {
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly record: DeviceAuthorizationRecord;
+}): Promise<OAuthTokens>;
+//# sourceMappingURL=device-provider.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-provider.d.ts","sourceRoot":"","sources":["../../src/oauth/device-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBnB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvB"}

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.js

@@ -0,0 +1,45 @@
+import { InvalidGrantError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { storedOAuthOwnerPreferences } from './identity-preferences.js';
+import { hashToken } from './tokens.js';
+export async function completeDeviceAuthorization(input) {
+    const record = await input.store.redeemAuthorizationCode(hashToken(input.authorizationCode));
+    if (record === undefined ||
+        record.clientId !== input.session.clientId ||
+        record.redirectUri !== `${input.issuer.replace(/\/+$/, '')}/oauth/device/callback` ||
+        record.resource !== input.session.resource ||
+        record.codeChallenge !== input.session.codeChallenge) {
+        return false;
+    }
+    return input.store.approveDeviceAuthorization(input.session.deviceCode, {
+        ownerSubject: record.ownerSubject,
+        ...(record.ownerEmail !== undefined ? { ownerEmail: record.ownerEmail } : {}),
+        ...storedOAuthOwnerPreferences({
+            locale: record.ownerLocale,
+            timeZone: record.ownerTimeZone,
+        }),
+        ...(record.identityKind !== undefined ? { identityKind: record.identityKind } : {}),
+        ...(record.identityProvider !== undefined ? { identityProvider: record.identityProvider } : {}),
+        ...(record.developerGrantId !== undefined ? { developerGrantId: record.developerGrantId } : {}),
+    });
+}
+export function issueDeviceTokens(input) {
+    const record = input.record;
+    if (record.ownerSubject === undefined) {
+        throw new InvalidGrantError('device authorization is missing an approved identity');
+    }
+    return input.tokenIssuer.issueTokens({
+        clientId: record.clientId,
+        ownerSubject: record.ownerSubject,
+        resource: record.resource,
+        ...(record.ownerEmail !== undefined ? { ownerEmail: record.ownerEmail } : {}),
+        ...storedOAuthOwnerPreferences({
+            locale: record.ownerLocale,
+            timeZone: record.ownerTimeZone,
+        }),
+        ...(record.scope !== undefined ? { scope: record.scope } : {}),
+        ...(record.identityKind !== undefined ? { identityKind: record.identityKind } : {}),
+        ...(record.identityProvider !== undefined ? { identityProvider: record.identityProvider } : {}),
+        ...(record.developerGrantId !== undefined ? { developerGrantId: record.developerGrantId } : {}),
+    });
+}
+//# sourceMappingURL=device-provider.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-provider.js","sourceRoot":"","sources":["../../src/oauth/device-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7F,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC1C,MAAM,CAAC,WAAW,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClF,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC1C,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,aAAa,EACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;QACtE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,2BAA2B,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC/B,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,2BAA2B,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC/B,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.d.ts

@@ -0,0 +1,3 @@
+import type { Pool } from 'pg';
+export declare function ensureDeviceAuthorizationSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=device-store-postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store-postgres-schema.d.ts","sourceRoot":"","sources":["../../src/oauth/device-store-postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/E"}