@numa-tech/cli-auth 1.12.1

package/README.md

@@ -0,0 +1,35 @@
+# @numa-tech/cli-auth
+
+Shared Node.js OIDC authentication for Numa command-line applications.
+
+The package provides Authorization Code + PKCE browser login, private token
+caches, rotation-safe refresh, issuer/context validation, and authenticated
+fetch helpers. Refreshes are serialized by token-cache path so independently
+running Numa and Codex processes do not reuse a single-use refresh token.
+
+OAuth `invalid_grant` from a refresh request is exposed as `login_required`.
+Transport errors and identity-provider 5xx responses retain the last cache and
+remain retryable HTTP failures. The package never performs tenant business
+authorization; resource servers remain the authorization boundary.
+
+Applications supply resolved OIDC and cache settings:
+
+```ts
+import { ensureAccessToken, type AuthConfig } from "@numa-tech/cli-auth";
+
+const config: AuthConfig = {
+  discoveryUrl: "https://identity.example/realms/team/.well-known/openid-configuration",
+  issuerUrl: "https://identity.example/realms/team",
+  clientId: "public-cli",
+  scope: "openid profile offline_access",
+  tokenFile: "/private/config/keycloak-token.json",
+  redirectHost: "127.0.0.1",
+  redirectPort: 8765,
+  redirectPath: "/callback",
+  openBrowser: true
+};
+
+const accessToken = await ensureAccessToken(config);
+```
+
+Do not print or log the returned token or the token cache.

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+export type AuthErrorCode = "auth_error" | "http_error" | "invalid_discovery" | "issuer_mismatch" | "login_required" | (string & {});
+export interface AuthErrorOptions extends ErrorOptions {
+    status?: number;
+    oauthError?: string;
+    oauthDescription?: string;
+}
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly status?: number;
+    readonly oauthError?: string;
+    readonly oauthDescription?: string;
+    constructor(message: string, code?: AuthErrorCode, options?: AuthErrorOptions);
+}
+export declare class LoginRequiredError extends AuthError {
+    constructor(message?: string, options?: ErrorOptions);
+}

package/dist/errors.js

@@ -0,0 +1,21 @@
+export class AuthError extends Error {
+    code;
+    status;
+    oauthError;
+    oauthDescription;
+    constructor(message, code = "auth_error", options = {}) {
+        super(message, options);
+        this.code = code;
+        this.name = "AuthError";
+        this.status = options.status;
+        this.oauthError = options.oauthError;
+        this.oauthDescription = options.oauthDescription;
+    }
+}
+export class LoginRequiredError extends AuthError {
+    constructor(message = "No usable OIDC login is available.", options = {}) {
+        super(message, "login_required", options);
+        this.name = "LoginRequiredError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAOhB,IAAI;IANb,MAAM,CAAU;IAChB,UAAU,CAAU;IACpB,gBAAgB,CAAU;IAEnC,YACE,OAAe,EACC,IAAI,GAAkB,YAAY,EAClD,OAAO,GAAqB,EAAE;QAE9B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAHR,IAAI;QAIpB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,OAAO,GAAG,oCAAoC,EAAE,OAAO,GAAiB,EAAE;QACpF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./errors.js";
+export * from "./types.js";
+export * from "./oidc.js";
+export { withTokenFileLock, type TokenFileLockOptions } from "./token-lock.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from "./errors.js";
+export * from "./types.js";
+export * from "./oidc.js";
+export { withTokenFileLock } from "./token-lock.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAA6B,MAAM,iBAAiB,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,13 @@
+import type { AuthConfig, AuthDependencies, AuthenticatedFetchDependencies, BrowserLoginOptions, LoginSession, OidcDiscovery, TokenCache } from "./types.js";
+export declare function nowSeconds(): number;
+export declare function loadDiscovery(config: AuthConfig, dependencies?: AuthDependencies): Promise<OidcDiscovery>;
+export declare function readTokenCache(config: AuthConfig): Promise<TokenCache | undefined>;
+export declare function deleteTokenCache(config: AuthConfig): Promise<void>;
+export declare function refreshAccessToken(config: AuthConfig, cache: TokenCache, dependencies?: AuthDependencies): Promise<TokenCache>;
+export declare function ensureAccessToken(config: AuthConfig, forceRefresh?: boolean, dependencies?: AuthDependencies): Promise<string>;
+export declare function getUserinfo(config: AuthConfig, discovery: OidcDiscovery, accessToken: string, dependencies?: AuthDependencies): Promise<Record<string, unknown>>;
+export declare function fetchWithKeycloakIdentity(config: AuthConfig, url: string, requestFactory: () => RequestInit, dependencies?: AuthenticatedFetchDependencies): Promise<Response>;
+export declare function whoami(config: AuthConfig, forceRefresh?: boolean, dependencies?: AuthDependencies): Promise<Record<string, unknown>>;
+export declare function startBrowserLogin(config: AuthConfig, options?: BrowserLoginOptions, dependencies?: AuthDependencies): Promise<LoginSession>;
+export declare function completeBrowserLogin(config: AuthConfig, session: LoginSession, options?: BrowserLoginOptions, dependencies?: AuthDependencies): Promise<Record<string, unknown>>;
+export declare function blockingBrowserLogin(config: AuthConfig, options?: BrowserLoginOptions, dependencies?: AuthDependencies): Promise<Record<string, unknown>>;

package/dist/oidc.js

@@ -0,0 +1,448 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { rm } from "node:fs/promises";
+import { createServer } from "node:http";
+import open from "open";
+import { AuthError, LoginRequiredError } from "./errors.js";
+import { readJsonIfExists, writePrivateJson } from "./private-file.js";
+import { withTokenFileLock } from "./token-lock.js";
+const REFRESH_LEEWAY_SECONDS = 60;
+const LOGIN_SESSION_TTL_SECONDS = 300;
+export function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+function dependencyNow(dependencies) {
+    return (dependencies.now ?? nowSeconds)();
+}
+async function parseJsonResponse(response, url) {
+    const text = await response.text();
+    let parsed = {};
+    if (text) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = { raw: text };
+        }
+    }
+    if (!response.ok) {
+        const problem = parsed && typeof parsed === "object"
+            ? parsed
+            : {};
+        const oauthError = typeof problem.error === "string" ? problem.error : undefined;
+        const oauthDescription = typeof problem.error_description === "string"
+            ? problem.error_description
+            : undefined;
+        const detail = oauthDescription ?? oauthError
+            ?? (typeof problem.raw === "string" ? problem.raw : undefined)
+            ?? response.statusText;
+        throw new AuthError(`HTTP ${response.status} from ${url}: ${detail}`, "http_error", {
+            status: response.status,
+            oauthError,
+            oauthDescription
+        });
+    }
+    return parsed;
+}
+async function requestJson(dependencies, url, init) {
+    const fetchImpl = dependencies.fetch ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            ...init,
+            headers: {
+                Accept: "application/json",
+                ...(init?.body ? { "Content-Type": "application/x-www-form-urlencoded" } : {}),
+                ...(init?.headers ?? {})
+            }
+        });
+    }
+    catch (error) {
+        throw new AuthError(`Unable to reach OIDC endpoint ${url}.`, "http_error", { cause: error });
+    }
+    return parseJsonResponse(response, url);
+}
+function formBody(values) {
+    const body = new URLSearchParams();
+    for (const [key, value] of Object.entries(values)) {
+        if (value != null && value !== "")
+            body.set(key, value);
+    }
+    return body;
+}
+function addClientAuth(config, values) {
+    return formBody({
+        ...values,
+        client_id: config.clientId,
+        client_secret: config.clientSecret
+    });
+}
+function normalizeIssuer(value) {
+    return value.replace(/\/+$/u, "");
+}
+function validateOidcUrl(value, name) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new AuthError(`OIDC discovery ${name} is not a valid URL.`, "invalid_discovery");
+    }
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(url.hostname);
+    if (url.username || url.password || (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))) {
+        throw new AuthError(`OIDC discovery ${name} must use HTTPS without embedded credentials (loopback HTTP is allowed).`, "invalid_discovery");
+    }
+}
+export async function loadDiscovery(config, dependencies = {}) {
+    validateOidcUrl(config.discoveryUrl, "discovery URL");
+    const discovery = await requestJson(dependencies, config.discoveryUrl);
+    if (config.issuerUrl && normalizeIssuer(discovery.issuer) !== normalizeIssuer(config.issuerUrl)) {
+        throw new AuthError(`OIDC discovery issuer mismatch: expected ${config.issuerUrl}, received ${discovery.issuer}.`, "issuer_mismatch");
+    }
+    for (const [name, value] of [
+        ["issuer", discovery.issuer],
+        ["authorization_endpoint", discovery.authorization_endpoint],
+        ["token_endpoint", discovery.token_endpoint]
+    ]) {
+        validateOidcUrl(value, name);
+    }
+    if (discovery.userinfo_endpoint) {
+        validateOidcUrl(discovery.userinfo_endpoint, "userinfo_endpoint");
+    }
+    return discovery;
+}
+function issuerFromDiscoveryUrl(discoveryUrl) {
+    return discoveryUrl.replace(/\/\.well-known\/openid-configuration\/?$/u, "");
+}
+function normalizeCache(value, config) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const raw = value;
+    const token = raw.token;
+    if (!token || typeof token !== "object")
+        return undefined;
+    const tokenValue = token;
+    if (typeof raw.discoveryUrl !== "string"
+        || typeof raw.clientId !== "string"
+        || typeof raw.obtainedAt !== "number"
+        || typeof raw.expiresAt !== "number"
+        || typeof tokenValue.access_token !== "string")
+        return undefined;
+    const profileTenantId = typeof raw.profileTenantId === "string"
+        ? raw.profileTenantId
+        : typeof raw.tenantId === "string" ? raw.tenantId : undefined;
+    const resourceAudience = typeof raw.resourceAudience === "string"
+        ? raw.resourceAudience
+        : typeof raw.audience === "string" ? raw.audience : undefined;
+    const issuer = typeof raw.issuer === "string"
+        ? raw.issuer
+        : config.issuerUrl ?? issuerFromDiscoveryUrl(raw.discoveryUrl);
+    const scope = typeof raw.scope === "string"
+        ? raw.scope
+        : typeof tokenValue.scope === "string" ? tokenValue.scope : config.scope;
+    return {
+        schemaVersion: 1,
+        issuer,
+        discoveryUrl: raw.discoveryUrl,
+        clientId: raw.clientId,
+        ...(profileTenantId ? { profileTenantId } : {}),
+        ...(resourceAudience ? { resourceAudience } : {}),
+        scope,
+        obtainedAt: raw.obtainedAt,
+        expiresAt: raw.expiresAt,
+        ...(typeof raw.refreshExpiresAt === "number" ? { refreshExpiresAt: raw.refreshExpiresAt } : {}),
+        token: tokenValue,
+        ...(raw.userinfo && typeof raw.userinfo === "object"
+            ? { userinfo: raw.userinfo }
+            : {})
+    };
+}
+export async function readTokenCache(config) {
+    return normalizeCache(await readJsonIfExists(config.tokenFile), config);
+}
+async function removeTokenCache(config) {
+    await rm(config.tokenFile, { force: true });
+}
+export async function deleteTokenCache(config) {
+    await withTokenFileLock(config.tokenFile, () => removeTokenCache(config));
+}
+function cacheCompatible(cache, config) {
+    return cache.discoveryUrl === config.discoveryUrl
+        && cache.clientId === config.clientId
+        && (config.issuerUrl == null
+            || normalizeIssuer(cache.issuer) === normalizeIssuer(config.issuerUrl))
+        && (config.profileTenantId == null || cache.profileTenantId === config.profileTenantId)
+        && (config.resourceAudience == null || cache.resourceAudience === config.resourceAudience);
+}
+function requireCompatibleCache(cache, config) {
+    if (!cache)
+        throw new LoginRequiredError("No token cache exists. Start login first.");
+    if (!cacheCompatible(cache, config)) {
+        throw new LoginRequiredError("Token cache was created for a different issuer, client, profile tenant, or resource audience.");
+    }
+    return cache;
+}
+function cacheAdvanced(previous, current) {
+    return previous.obtainedAt !== current.obtainedAt
+        || previous.token.access_token !== current.token.access_token
+        || previous.token.refresh_token !== current.token.refresh_token;
+}
+function accessTokenFresh(cache, now, leewaySeconds = REFRESH_LEEWAY_SECONDS) {
+    return cache.expiresAt > now + leewaySeconds;
+}
+async function saveToken(config, discovery, token, previous, dependencies) {
+    const obtainedAt = dependencyNow(dependencies);
+    const refreshExpiresAt = token.refresh_expires_in && token.refresh_expires_in > 0
+        ? obtainedAt + token.refresh_expires_in
+        : previous?.refreshExpiresAt;
+    const cache = {
+        schemaVersion: 1,
+        issuer: discovery.issuer,
+        discoveryUrl: config.discoveryUrl,
+        clientId: config.clientId,
+        ...(config.profileTenantId ? { profileTenantId: config.profileTenantId } : {}),
+        ...(config.resourceAudience ? { resourceAudience: config.resourceAudience } : {}),
+        scope: token.scope ?? config.scope,
+        obtainedAt,
+        expiresAt: obtainedAt + (token.expires_in ?? 0),
+        ...(refreshExpiresAt ? { refreshExpiresAt } : {}),
+        token: {
+            ...token,
+            refresh_token: token.refresh_token ?? previous?.token.refresh_token
+        },
+        ...(previous?.userinfo ? { userinfo: previous.userinfo } : {})
+    };
+    await writePrivateJson(config.tokenFile, cache);
+    return cache;
+}
+function refreshRejected(error) {
+    return error instanceof AuthError && error.oauthError === "invalid_grant";
+}
+async function refreshAccessTokenLocked(config, cache, dependencies, allowAdvancedRetry) {
+    const refreshToken = cache.token.refresh_token;
+    if (!refreshToken) {
+        await removeTokenCache(config);
+        throw new LoginRequiredError("Saved token has no refresh token. Start login again.");
+    }
+    const discovery = await loadDiscovery(config, dependencies);
+    let refreshed;
+    try {
+        refreshed = await requestJson(dependencies, discovery.token_endpoint, {
+            method: "POST",
+            body: addClientAuth(config, {
+                grant_type: "refresh_token",
+                refresh_token: refreshToken
+            })
+        });
+    }
+    catch (error) {
+        if (!refreshRejected(error))
+            throw error;
+        const latest = await readTokenCache(config);
+        if (latest && cacheCompatible(latest, config) && cacheAdvanced(cache, latest)) {
+            if (accessTokenFresh(latest, dependencyNow(dependencies)))
+                return latest;
+            if (allowAdvancedRetry) {
+                return refreshAccessTokenLocked(config, latest, dependencies, false);
+            }
+        }
+        await removeTokenCache(config);
+        throw new LoginRequiredError("登录会话已失效，请重新登录。", { cause: error });
+    }
+    return saveToken(config, discovery, refreshed, cache, dependencies);
+}
+export async function refreshAccessToken(config, cache, dependencies = {}) {
+    return withTokenFileLock(config.tokenFile, async () => {
+        const latest = requireCompatibleCache(await readTokenCache(config), config);
+        if (cacheAdvanced(cache, latest) && accessTokenFresh(latest, dependencyNow(dependencies))) {
+            return latest;
+        }
+        return refreshAccessTokenLocked(config, latest, dependencies, true);
+    });
+}
+export async function ensureAccessToken(config, forceRefresh = false, dependencies = {}) {
+    const initial = requireCompatibleCache(await readTokenCache(config), config);
+    if (!forceRefresh && accessTokenFresh(initial, dependencyNow(dependencies))) {
+        return initial.token.access_token;
+    }
+    return withTokenFileLock(config.tokenFile, async () => {
+        const current = requireCompatibleCache(await readTokenCache(config), config);
+        if (accessTokenFresh(current, dependencyNow(dependencies))
+            && (!forceRefresh || cacheAdvanced(initial, current)))
+            return current.token.access_token;
+        return (await refreshAccessTokenLocked(config, current, dependencies, true)).token.access_token;
+    });
+}
+export async function getUserinfo(config, discovery, accessToken, dependencies = {}) {
+    if (!discovery.userinfo_endpoint) {
+        throw new AuthError("OIDC discovery does not provide a userinfo endpoint.", "invalid_discovery");
+    }
+    return requestJson(dependencies, discovery.userinfo_endpoint, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+    });
+}
+async function updateUserinfoIfCurrent(config, accessToken, userinfo) {
+    await withTokenFileLock(config.tokenFile, async () => {
+        const current = await readTokenCache(config);
+        if (current?.token.access_token !== accessToken)
+            return;
+        await writePrivateJson(config.tokenFile, { ...current, userinfo });
+    });
+}
+export async function fetchWithKeycloakIdentity(config, url, requestFactory, dependencies = {}) {
+    const fetchImpl = dependencies.fetch ?? fetch;
+    const tokenProvider = dependencies.tokenProvider
+        ?? ((providerConfig, forceRefresh) => ensureAccessToken(providerConfig, forceRefresh, dependencies));
+    const send = async (forceRefresh) => {
+        const token = await tokenProvider(config, forceRefresh);
+        const init = requestFactory();
+        const headers = new Headers(init.headers);
+        headers.set("Authorization", `Bearer ${token}`);
+        return fetchImpl(url, { ...init, headers });
+    };
+    let response = await send(false);
+    if (response.status === 401) {
+        await response.body?.cancel().catch(() => undefined);
+        response = await send(true);
+    }
+    return response;
+}
+export async function whoami(config, forceRefresh = false, dependencies = {}) {
+    const discovery = await loadDiscovery(config, dependencies);
+    if (forceRefresh)
+        await ensureAccessToken(config, true, dependencies);
+    const response = await fetchWithKeycloakIdentity(config, discovery.userinfo_endpoint ?? "", () => ({ headers: { Accept: "application/json" } }), dependencies);
+    const info = await parseJsonResponse(response, discovery.userinfo_endpoint ?? "");
+    const cache = await readTokenCache(config);
+    if (cache)
+        await updateUserinfoIfCurrent(config, cache.token.access_token, info);
+    return info;
+}
+function pkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export async function startBrowserLogin(config, options = {}, dependencies = {}) {
+    const discovery = await loadDiscovery(config, dependencies);
+    const { verifier, challenge } = pkcePair();
+    const state = randomBytes(24).toString("base64url");
+    const callback = `http://${config.redirectHost}:${config.redirectPort}${config.redirectPath}`;
+    const id = randomUUID();
+    let server;
+    const createdAt = dependencyNow(dependencies);
+    const session = {
+        id,
+        authorizationUrl: "",
+        redirectUri: callback,
+        codeVerifier: verifier,
+        state,
+        createdAt,
+        expiresAt: createdAt + LOGIN_SESSION_TTL_SECONDS,
+        close: async () => {
+            if (!server)
+                return;
+            await new Promise((resolve, reject) => {
+                server?.close((error) => error ? reject(error) : resolve());
+            });
+            server = undefined;
+        }
+    };
+    const authUrl = new URL(discovery.authorization_endpoint);
+    authUrl.searchParams.set("client_id", config.clientId);
+    authUrl.searchParams.set("redirect_uri", callback);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("scope", config.scope);
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    session.authorizationUrl = authUrl.toString();
+    server = createServer((request, response) => {
+        const requestUrl = new URL(request.url ?? "/", callback);
+        if (requestUrl.pathname !== config.redirectPath) {
+            response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+            response.end("Not found\n");
+            return;
+        }
+        const returnedState = requestUrl.searchParams.get("state");
+        if (returnedState !== state) {
+            session.error = "State mismatch";
+        }
+        else if (requestUrl.searchParams.get("error")) {
+            session.error = requestUrl.searchParams.get("error_description")
+                ?? requestUrl.searchParams.get("error")
+                ?? "Login failed";
+        }
+        else {
+            session.code = requestUrl.searchParams.get("code") ?? undefined;
+        }
+        const redirect = session.code ? options.successRedirectUrl : options.failureRedirectUrl;
+        if (redirect) {
+            response.writeHead(303, {
+                Location: redirect,
+                "Cache-Control": "no-store",
+                "Referrer-Policy": "no-referrer"
+            });
+            response.end();
+            return;
+        }
+        response.writeHead(session.code ? 200 : 400, {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-store"
+        });
+        response.end(session.code
+            ? "Login complete. You may close this tab.\n"
+            : `Login failed: ${session.error}\n`);
+    });
+    await new Promise((resolve, reject) => {
+        server?.once("error", reject);
+        server?.listen(config.redirectPort, config.redirectHost, resolve);
+    });
+    if (config.openBrowser) {
+        await (dependencies.openBrowser ?? open)(session.authorizationUrl).catch(() => undefined);
+    }
+    return session;
+}
+export async function completeBrowserLogin(config, session, options = {}, dependencies = {}) {
+    if (session.error)
+        throw new AuthError(session.error, "login_failed");
+    if (!session.code) {
+        if (session.expiresAt <= dependencyNow(dependencies)) {
+            await session.close();
+            throw new AuthError("Login session expired before callback was received.", "login_expired");
+        }
+        throw new AuthError("Login callback has not been received yet.", "login_pending");
+    }
+    const discovery = await loadDiscovery(config, dependencies);
+    const token = await requestJson(dependencies, discovery.token_endpoint, {
+        method: "POST",
+        body: addClientAuth(config, {
+            grant_type: "authorization_code",
+            code: session.code,
+            redirect_uri: session.redirectUri,
+            code_verifier: session.codeVerifier
+        })
+    });
+    const saved = await withTokenFileLock(config.tokenFile, () => saveToken(config, discovery, token, undefined, dependencies));
+    if (options.loadUserinfo === false) {
+        await session.close();
+        return {};
+    }
+    const info = await getUserinfo(config, discovery, saved.token.access_token, dependencies);
+    await updateUserinfoIfCurrent(config, saved.token.access_token, info);
+    await session.close();
+    return info;
+}
+export async function blockingBrowserLogin(config, options = {}, dependencies = {}) {
+    const session = await startBrowserLogin(config, options, dependencies);
+    process.stderr.write(`Open this URL to log in:\n${session.authorizationUrl}\n`);
+    try {
+        while (!session.code && !session.error && session.expiresAt > dependencyNow(dependencies)) {
+            await new Promise((resolve) => setTimeout(resolve, 500));
+        }
+        return await completeBrowserLogin(config, session, options, dependencies);
+    }
+    finally {
+        await session.close().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAYpD,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,YAA8B;IACnD,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAI,QAAkB,EAAE,GAAW;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAAY,EAAE,CAAC;IACzB,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAClD,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,gBAAgB,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;YACpE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,gBAAgB,IAAI,UAAU;eACxC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;eAC3D,QAAQ,CAAC,UAAU,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,GAAG,KAAK,MAAM,EAAE,EAAE,YAAY,EAAE;YAClF,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU;YACV,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,YAA8B,EAC9B,GAAW,EACX,IAAkB;IAElB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;aACzB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,iCAAiC,GAAG,GAAG,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,iBAAiB,CAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,MAA0C;IAC1D,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,MAAkB,EAClB,MAA0C;IAE1C,OAAO,QAAQ,CAAC;QACd,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,kBAAkB,IAAI,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CACjB,kBAAkB,IAAI,0EAA0E,EAChG,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,YAAY,GAAqB,EAAE;IAEnC,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAgB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CACjB,4CAA4C,MAAM,CAAC,SAAS,cAAc,SAAS,CAAC,MAAM,GAAG,EAC7F,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;QAC5B,CAAC,wBAAwB,EAAE,SAAS,CAAC,sBAAsB,CAAC;QAC5D,CAAC,gBAAgB,EAAE,SAAS,CAAC,cAAc,CAAC;KACpC,EAAE,CAAC;QACX,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,eAAe,CAAC,SAAS,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB;IAClD,OAAO,YAAY,CAAC,OAAO,CAAC,2CAA2C,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,MAAkB;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAgC,CAAC;IACpD,IACE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;WACjC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;WAChC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;WAClC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;WACjC,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC9C,OAAO,SAAS,CAAC;IACnB,MAAM,eAAe,GAAG,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QAC7D,CAAC,CAAC,GAAG,CAAC,eAAe;QACrB,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,gBAAgB,GAAG,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QAC/D,CAAC,CAAC,GAAG,CAAC,gBAAgB;QACtB,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC3C,CAAC,CAAC,GAAG,CAAC,MAAM;QACZ,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QACzC,CAAC,CAAC,GAAG,CAAC,KAAK;QACX,CAAC,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3E,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,KAAK,EAAE,UAA2B;QAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAmC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,OAAO,cAAc,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,MAAkB;IAC5D,OAAO,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WAC5C,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WAClC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI;eACvB,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;WACtE,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,CAAC;WACpF,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA6B,EAC7B,MAAkB;IAElB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAC1B,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,QAAoB,EAAE,OAAmB;IAC9D,OAAO,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;WAC5C,QAAQ,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,YAAY;WAC1D,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiB,EACjB,GAAW,EACX,aAAa,GAAG,sBAAsB;IAEtC,OAAO,KAAK,CAAC,SAAS,GAAG,GAAG,GAAG,aAAa,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAAkB,EAClB,SAAwB,EACxB,KAAoB,EACpB,QAAgC,EAChC,YAA8B;IAE9B,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC;QAC/E,CAAC,CAAC,UAAU,GAAG,KAAK,CAAC,kBAAkB;QACvC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAC/B,MAAM,KAAK,GAAe;QACxB,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;QAClC,UAAU;QACV,SAAS,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,KAAK,EAAE;YACL,GAAG,KAAK;YACR,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,EAAE,KAAK,CAAC,aAAa;SACpE;QACD,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,MAAM,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,eAAe,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAkB,EAClB,KAAiB,EACjB,YAA8B,EAC9B,kBAA2B;IAE3B,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,WAAW,CAAgB,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE;gBAC1B,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9E,IAAI,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC;YACzE,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAiB,EACjB,YAAY,GAAqB,EAAE;IAEnC,OAAO,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAkB,EAClB,YAAY,GAAG,KAAK,EACpB,YAAY,GAAqB,EAAE;IAEnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;IACpC,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7E,IACE,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;eACnD,CAAC,CAAC,YAAY,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACpC,OAAO,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,SAAwB,EACxB,WAAmB,EACnB,YAAY,GAAqB,EAAE;IAEnC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,sDAAsD,EAAE,mBAAmB,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,WAAW,CAA0B,YAAY,EAAE,SAAS,CAAC,iBAAiB,EAAE;QACrF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAAkB,EAClB,WAAmB,EACnB,QAAiC;IAEjC,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,WAAW;YAAE,OAAO;QACxD,MAAM,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAkB,EAClB,GAAW,EACX,cAAiC,EACjC,YAAY,GAAmC,EAAE;IAEjD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9C,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa;WAC3C,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,KAAK,EAAE,YAAqB,EAAqB,EAAE;QAC9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAkB,EAClB,YAAY,GAAG,KAAK,EACpB,YAAY,GAAqB,EAAE;IAEnC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,YAAY;QAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,MAAM,EACN,SAAS,CAAC,iBAAiB,IAAI,EAAE,EACjC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,EACnD,YAAY,CACb,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,QAAQ,EACR,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAClC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK;QAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAkB,EAClB,OAAO,GAAwB,EAAE,EACjC,YAAY,GAAqB,EAAE;IAEnC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9F,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,MAA0B,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAiB;QAC5B,EAAE;QACF,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,QAAQ;QACtB,KAAK;QACL,SAAS;QACT,SAAS,EAAE,SAAS,GAAG,yBAAyB;QAChD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE9C,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACzE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC;QACnC,CAAC;aAAM,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC;mBAC3D,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;mBACpC,cAAc,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,UAAU;gBAC3B,iBAAiB,EAAE,aAAa;aACjC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YAC3C,cAAc,EAAE,2BAA2B;YAC3C,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI;YACvB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,iBAAiB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,YAAY,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,OAAqB,EACrB,OAAO,GAAwB,EAAE,EACjC,YAAY,GAAqB,EAAE;IAEnC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,qDAAqD,EAAE,eAAe,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,2CAA2C,EAAE,eAAe,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAgB,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE;YAC1B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAC3D,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1F,MAAM,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,OAAO,GAAwB,EAAE,EACjC,YAAY,GAAqB,EAAE;IAEnC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/private-file.d.ts

@@ -0,0 +1,2 @@
+export declare function readJsonIfExists(path: string): Promise<unknown | undefined>;
+export declare function writePrivateJson(path: string, value: unknown): Promise<void>;

package/dist/private-file.js

@@ -0,0 +1,28 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+export async function readJsonIfExists(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+export async function writePrivateJson(path, value) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+            flag: "wx",
+            mode: 0o600
+        });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=private-file.js.map

package/dist/private-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-file.js","sourceRoot":"","sources":["../src/private-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAChE,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/token-lock.d.ts

@@ -0,0 +1,8 @@
+export interface TokenFileLockOptions {
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+    pollMilliseconds?: number;
+    timeoutMilliseconds?: number;
+    staleMilliseconds?: number;
+}
+export declare function withTokenFileLock<T>(tokenFile: string, task: () => Promise<T>, options?: TokenFileLockOptions): Promise<T>;

package/dist/token-lock.js

@@ -0,0 +1,105 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { AuthError } from "./errors.js";
+const DEFAULT_POLL_MILLISECONDS = 25;
+const DEFAULT_TIMEOUT_MILLISECONDS = 30_000;
+const DEFAULT_STALE_MILLISECONDS = 120_000;
+function defaultSleep(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function processIsAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+async function readOwner(lockDirectory) {
+    try {
+        const value = JSON.parse(await readFile(`${lockDirectory}/owner.json`, "utf8"));
+        return typeof value.id === "string"
+            && Number.isInteger(value.pid)
+            && typeof value.createdAt === "number"
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function reclaim(lockDirectory) {
+    const staleDirectory = `${lockDirectory}.stale.${process.pid}.${randomUUID()}`;
+    try {
+        await rename(lockDirectory, staleDirectory);
+    }
+    catch (error) {
+        if (["ENOENT", "EEXIST", "ENOTEMPTY"].includes(error.code ?? "")) {
+            return false;
+        }
+        throw error;
+    }
+    await rm(staleDirectory, { recursive: true, force: true });
+    return true;
+}
+async function mayReclaim(lockDirectory, now, staleMilliseconds) {
+    const owner = await readOwner(lockDirectory);
+    if (owner)
+        return !processIsAlive(owner.pid);
+    try {
+        const lockStat = await stat(lockDirectory);
+        return now - lockStat.mtimeMs >= staleMilliseconds;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export async function withTokenFileLock(tokenFile, task, options = {}) {
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? defaultSleep;
+    const pollMilliseconds = options.pollMilliseconds ?? DEFAULT_POLL_MILLISECONDS;
+    const timeoutMilliseconds = options.timeoutMilliseconds ?? DEFAULT_TIMEOUT_MILLISECONDS;
+    const staleMilliseconds = options.staleMilliseconds ?? DEFAULT_STALE_MILLISECONDS;
+    const lockDirectory = `${tokenFile}.lock`;
+    const ownerId = randomUUID();
+    const deadline = now() + timeoutMilliseconds;
+    await mkdir(dirname(tokenFile), { recursive: true, mode: 0o700 });
+    while (true) {
+        try {
+            await mkdir(lockDirectory, { mode: 0o700 });
+            await writeFile(`${lockDirectory}/owner.json`, `${JSON.stringify({ id: ownerId, pid: process.pid, createdAt: now() })}\n`, { flag: "wx", mode: 0o600 });
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST") {
+                await rm(lockDirectory, { recursive: true, force: true }).catch(() => undefined);
+                throw error;
+            }
+            if (await mayReclaim(lockDirectory, now(), staleMilliseconds)) {
+                await reclaim(lockDirectory);
+                continue;
+            }
+            if (now() >= deadline) {
+                throw new AuthError("Timed out waiting for the OIDC token cache lock.");
+            }
+            await sleep(pollMilliseconds);
+        }
+    }
+    try {
+        return await task();
+    }
+    finally {
+        const owner = await readOwner(lockDirectory);
+        if (owner?.id === ownerId) {
+            await rm(lockDirectory, { recursive: true, force: true });
+        }
+    }
+}
+//# sourceMappingURL=token-lock.js.map

package/dist/token-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-lock.js","sourceRoot":"","sources":["../src/token-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAgB3C,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,aAAa,aAAa,EAAE,MAAM,CAAC,CAAuB,CAAC;QACtG,OAAO,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;eAC9B,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;eAC3B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACtC,CAAC,CAAC,KAAkB;YACpB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,aAAqB;IAC1C,MAAM,cAAc,GAAG,GAAG,aAAa,UAAU,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,aAAqB,EACrB,GAAW,EACX,iBAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,iBAAiB,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,IAAsB,EACtB,OAAO,GAAyB,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IAC/E,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,4BAA4B,CAAC;IACxF,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,CAAC;IAClF,MAAM,aAAa,GAAG,GAAG,SAAS,OAAO,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,mBAAmB,CAAC;IAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5C,MAAM,SAAS,CACb,GAAG,aAAa,aAAa,EAC7B,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,EAC1E,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5B,CAAC;YACF,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACjF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,MAAM,UAAU,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,72 @@
+export interface OidcDiscovery {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    device_authorization_endpoint?: string;
+    end_session_endpoint?: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type?: string;
+    expires_in?: number;
+    refresh_token?: string;
+    refresh_expires_in?: number;
+    id_token?: string;
+    scope?: string;
+    [name: string]: unknown;
+}
+export interface TokenCache {
+    schemaVersion: 1;
+    issuer: string;
+    discoveryUrl: string;
+    clientId: string;
+    profileTenantId?: string;
+    resourceAudience?: string;
+    scope: string;
+    obtainedAt: number;
+    expiresAt: number;
+    refreshExpiresAt?: number;
+    token: TokenResponse;
+    userinfo?: Record<string, unknown>;
+}
+export interface AuthConfig {
+    discoveryUrl: string;
+    issuerUrl?: string;
+    clientId: string;
+    profileTenantId?: string;
+    resourceAudience?: string;
+    clientSecret?: string;
+    scope: string;
+    tokenFile: string;
+    redirectHost: string;
+    redirectPort: number;
+    redirectPath: string;
+    openBrowser: boolean;
+}
+export interface LoginSession {
+    id: string;
+    authorizationUrl: string;
+    redirectUri: string;
+    codeVerifier: string;
+    state: string;
+    createdAt: number;
+    expiresAt: number;
+    code?: string;
+    error?: string;
+    close: () => Promise<void>;
+}
+export interface BrowserLoginOptions {
+    successRedirectUrl?: string;
+    failureRedirectUrl?: string;
+    loadUserinfo?: boolean;
+}
+export interface AuthDependencies {
+    fetch?: typeof fetch;
+    now?: () => number;
+    openBrowser?: (url: string) => Promise<unknown>;
+}
+export type AccessTokenProvider = (config: AuthConfig, forceRefresh?: boolean) => Promise<string>;
+export interface AuthenticatedFetchDependencies extends AuthDependencies {
+    tokenProvider?: AccessTokenProvider;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@numa-tech/cli-auth",
+  "version": "1.12.1",
+  "description": "Shared rotation-safe OIDC authentication for Numa command-line clients.",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "node --import tsx --test src/*.test.ts",
+    "check": "npm run typecheck && npm test",
+    "pack:check": "npm pack --dry-run --json --ignore-scripts",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "open": "^10.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.0",
+    "tsx": "^4.21.0",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "node": ">=20.12.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}