@oharness/engine 0.1.0

package/dist/auth/manager.js

@@ -0,0 +1,266 @@
+import { errorMessage } from "../core/errors.js";
+import { createLogger } from "../util/logger.js";
+import { anthropicAuth } from "./providers/anthropic.js";
+import { officialAuth } from "./providers/official.js";
+import { ottoportAuth } from "./providers/ottoport.js";
+import { apiKeyProvider } from "./providers/generic.js";
+import { AuthStore } from "./store.js";
+import { isExpired } from "./types.js";
+export const BUILTIN_AUTH_PROVIDERS = [
+    officialAuth,
+    anthropicAuth,
+    ottoportAuth,
+    apiKeyProvider({
+        id: "openai",
+        label: "OpenAI",
+        envVars: ["OPENAI_API_KEY"],
+        placeholder: "sk-…",
+    }),
+    apiKeyProvider({
+        id: "google",
+        label: "Google Gemini",
+        envVars: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+        header: "x-goog-api-key",
+        format: (key) => key,
+    }),
+];
+/**
+ * Owns credentials: stores them, resolves them per request, and refreshes
+ * OAuth tokens before they expire.
+ *
+ * Refresh is in-flight-deduplicated. Without that, a turn issuing several
+ * parallel tool calls fires several simultaneous refreshes, and providers that
+ * rotate the refresh token on use will invalidate each other's result.
+ */
+export class AuthManager {
+    store;
+    providers = new Map();
+    logger;
+    refreshing = new Map();
+    constructor(opts = {}) {
+        this.store = opts.store ?? new AuthStore();
+        this.logger = (opts.logger ?? createLogger("auth")).child("manager");
+        for (const provider of opts.providers ?? BUILTIN_AUTH_PROVIDERS)
+            this.register(provider);
+    }
+    register(provider) {
+        this.providers.set(provider.id, provider);
+        return this;
+    }
+    get(providerId) {
+        return this.providers.get(providerId);
+    }
+    list() {
+        return [...this.providers.values()];
+    }
+    /**
+     * Resolve credentials for a request. Safe to call on every request — that is
+     * the point, since a token valid at startup may not be valid an hour later.
+     */
+    async resolve(ctx) {
+        const provider = this.providers.get(ctx.providerId);
+        if (!provider)
+            return undefined;
+        let credential = await this.store.get(ctx.providerId);
+        if (credential?.type === "oauth" && isExpired(credential) && provider.refresh) {
+            credential = (await this.refreshOnce(ctx.providerId, provider, credential)) ?? credential;
+        }
+        if (!provider.loader)
+            return undefined;
+        try {
+            return await provider.loader(credential, ctx);
+        }
+        catch (err) {
+            this.logger.warn("credential resolution failed", {
+                provider: ctx.providerId,
+                error: errorMessage(err),
+            });
+            return undefined;
+        }
+    }
+    /**
+     * The current access token for an OAuth provider, refreshed if it has run
+     * out.
+     *
+     * Separate from `resolve` because the caller wants the token itself rather
+     * than the headers a model request would carry — sync sends it to a server
+     * that is not a model provider, and digging it back out of a header would
+     * depend on how that provider happens to spell authorization today.
+     *
+     * Read per use, never held: these last an hour, and something that cached
+     * one would work until it silently did not.
+     */
+    async accessToken(providerId) {
+        const provider = this.providers.get(providerId);
+        if (!provider)
+            return undefined;
+        let credential = await this.store.get(providerId);
+        if (credential?.type !== "oauth")
+            return undefined;
+        if (isExpired(credential) && provider.refresh) {
+            credential = (await this.refreshOnce(providerId, provider, credential)) ?? credential;
+        }
+        return credential.type === "oauth" && !isExpired(credential) ? credential.access : undefined;
+    }
+    /** Whether a provider has usable credentials, without making a request. */
+    async isAuthenticated(providerId) {
+        const resolved = await this.resolve({ providerId });
+        return resolved !== undefined;
+    }
+    async status() {
+        const out = [];
+        for (const provider of this.providers.values()) {
+            const credential = await this.store.get(provider.id);
+            const resolved = await this.resolve({ providerId: provider.id });
+            out.push({
+                providerId: provider.id,
+                label: provider.label,
+                authenticated: resolved !== undefined,
+                source: resolved?.source,
+                expiresAt: credential?.type === "oauth" ? credential.expires : undefined,
+                methods: provider.methods.map((method, index) => ({
+                    index,
+                    type: method.type,
+                    label: method.label,
+                })),
+            });
+        }
+        return out;
+    }
+    /**
+     * Which prompts apply given the answers collected so far. Conditional
+     * prompts let one method cover, say, public vs enterprise deployments
+     * without the CLI knowing anything about either.
+     */
+    promptsFor(method, answers = {}) {
+        return (method.prompts ?? []).filter((prompt) => {
+            if (!prompt.when)
+                return true;
+            const actual = answers[prompt.when.key];
+            return prompt.when.op === "eq"
+                ? actual === prompt.when.value
+                : actual !== prompt.when.value;
+        });
+    }
+    /** Validate collected answers. Returns the first failure, if any. */
+    validate(method, answers) {
+        for (const prompt of this.promptsFor(method, answers)) {
+            if (prompt.type !== "text" || !prompt.validate)
+                continue;
+            const value = answers[prompt.key];
+            if (value === undefined)
+                continue;
+            const error = prompt.validate(value);
+            if (error)
+                return { field: prompt.key, message: error };
+        }
+        return undefined;
+    }
+    /** Begin an OAuth login. The caller drives the returned flow. */
+    async authorize(providerId, methodIndex, answers = {}) {
+        const { provider, method } = this.methodAt(providerId, methodIndex);
+        if (method.type !== "oauth") {
+            throw new Error(`method ${methodIndex} of ${provider.id} is not an OAuth method`);
+        }
+        const invalid = this.validate(method, answers);
+        if (invalid)
+            throw new Error(`${invalid.field}: ${invalid.message}`);
+        return method.authorize(answers);
+    }
+    /** Complete an API-key login (or an OAuth method's non-interactive variant). */
+    async submit(providerId, methodIndex, answers) {
+        const { provider, method } = this.methodAt(providerId, methodIndex);
+        const invalid = this.validate(method, answers);
+        if (invalid)
+            throw new Error(`${invalid.field}: ${invalid.message}`);
+        if (method.type === "api" && method.authorize) {
+            const result = await method.authorize(answers);
+            if (result.type !== "success") {
+                throw new Error(result.error ?? "authentication failed");
+            }
+            return this.persist(provider.id, result);
+        }
+        if (method.type === "api") {
+            const key = answers["key"];
+            if (!key)
+                throw new Error("no key provided");
+            const metadata = Object.fromEntries(Object.entries(answers).filter(([field]) => field !== "key"));
+            const credential = {
+                type: "api",
+                key,
+                ...(Object.keys(metadata).length ? { metadata } : {}),
+            };
+            await this.store.set(provider.id, credential);
+            return credential;
+        }
+        throw new Error(`method ${methodIndex} of ${provider.id} requires the OAuth flow`);
+    }
+    /** Store the result of a completed OAuth callback. */
+    async complete(providerId, result) {
+        if (result.type !== "success") {
+            throw new Error(result.error ?? "authentication failed");
+        }
+        return this.persist(providerId, result);
+    }
+    async logout(providerId) {
+        return this.store.remove(providerId);
+    }
+    async persist(providerId, result) {
+        const credential = "access" in result
+            ? {
+                type: "oauth",
+                access: result.access,
+                refresh: result.refresh,
+                expires: result.expires,
+                ...(result.accountId ? { accountId: result.accountId } : {}),
+                ...(result.baseUrl ? { baseUrl: result.baseUrl } : {}),
+                ...(result.metadata ? { metadata: result.metadata } : {}),
+            }
+            : {
+                type: "api",
+                key: result.key,
+                ...(result.metadata ? { metadata: result.metadata } : {}),
+            };
+        await this.store.set(providerId, credential);
+        return credential;
+    }
+    methodAt(providerId, index) {
+        const provider = this.providers.get(providerId);
+        if (!provider)
+            throw new Error(`unknown auth provider: ${providerId}`);
+        const method = provider.methods[index];
+        if (!method) {
+            throw new Error(`${providerId} has no auth method ${index} (it has ${provider.methods.length})`);
+        }
+        return { provider, method };
+    }
+    /** Collapse concurrent refreshes of the same provider into one exchange. */
+    refreshOnce(providerId, provider, credential) {
+        const inFlight = this.refreshing.get(providerId);
+        if (inFlight)
+            return inFlight;
+        const task = (async () => {
+            try {
+                const refreshed = await provider.refresh(credential);
+                if (refreshed) {
+                    await this.store.set(providerId, refreshed);
+                    this.logger.debug("refreshed credential", { provider: providerId });
+                }
+                return refreshed;
+            }
+            catch (err) {
+                this.logger.warn("token refresh failed", {
+                    provider: providerId,
+                    error: errorMessage(err),
+                });
+                return undefined;
+            }
+            finally {
+                this.refreshing.delete(providerId);
+            }
+        })();
+        this.refreshing.set(providerId, task);
+        return task;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/auth/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/auth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAWvC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc,CAAC;QACb,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,cAAc,CAAC;QACb,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC7C,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;KACrB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACb,KAAK,CAAY;IACT,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,MAAM,CAAS;IACf,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;IAEtF,YAAY,OAA2E,EAAE;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,sBAAsB;YAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IAED,QAAQ,CAAC,QAAsB;QAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,GAAgB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEtD,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9E,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC/C,QAAQ,EAAE,GAAG,CAAC,UAAU;gBACxB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;aACzB,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9C,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC;QACxF,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,OAAO,QAAQ,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,QAAQ,KAAK,SAAS;gBACrC,MAAM,EAAE,QAAQ,EAAE,MAAM;gBACxB,SAAS,EAAE,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACxE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChD,KAAK;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,MAAkB,EAAE,UAAkC,EAAE;QACjE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI;gBAC5B,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC9B,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,QAAQ,CACN,MAAkB,EAClB,OAA+B;QAE/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,WAAmB,EACnB,UAAkC,EAAE;QAEpC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,UAAU,WAAW,OAAO,QAAQ,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,WAAmB,EACnB,OAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAErE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAC7D,CAAC;YACF,MAAM,UAAU,GAAe;gBAC7B,IAAI,EAAE,KAAK;gBACX,GAAG;gBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAC9C,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,UAAU,WAAW,OAAO,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACrF,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,QAAQ,CACZ,UAAkB,EAClB,MAAwD;QAExD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,UAAkB,EAClB,MAAsF;QAEtF,MAAM,UAAU,GACd,QAAQ,IAAI,MAAM;YAChB,CAAC,CAAC;gBACE,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QAER,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,QAAQ,CACd,UAAkB,EAClB,KAAa;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,uBAAuB,KAAK,YAAY,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,4EAA4E;IACpE,WAAW,CACjB,UAAkB,EAClB,QAAsB,EACtB,UAA2B;QAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC;gBACtD,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACvC,QAAQ,EAAE,UAAU;oBACpB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,83 @@
+import type { AuthorizeResult, OAuthCredential } from "./types.ts";
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+}
+/** RFC 7636 S256 challenge. */
+export declare function createPkce(): Pkce;
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+    token_type?: string;
+    [key: string]: unknown;
+}
+export interface TokenExchangeOptions {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    /** `client_secret_post` puts the secret in the body; `basic` uses the header. */
+    clientAuth?: "none" | "basic" | "post";
+    params: Record<string, string>;
+    headers?: Record<string, string>;
+}
+export declare function exchangeToken(opts: TokenExchangeOptions): Promise<TokenResponse>;
+export declare function toCredential(token: TokenResponse, previousRefresh?: string): OAuthCredential;
+/** The credential body without the `type` discriminant, for spreading into results. */
+export declare function credentialFields(token: TokenResponse, previousRefresh?: string): Omit<OAuthCredential, "type">;
+export declare function refreshCredential(credential: OAuthCredential, opts: Omit<TokenExchangeOptions, "params"> & {
+    scope?: string;
+    /** Params the server also requires when refreshing, e.g. `resource`. */
+    tokenParams?: Record<string, string>;
+}): Promise<OAuthCredential | undefined>;
+export interface DeviceFlowOptions {
+    deviceCodeUrl: string;
+    tokenUrl: string;
+    clientId: string;
+    scope?: string;
+    headers?: Record<string, string>;
+    /** Guard against a server that never returns a terminal state. */
+    maxAttempts?: number;
+}
+/**
+ * Start a device flow. The returned `callback()` polls until the user finishes
+ * authorizing in their browser.
+ */
+export declare function startDeviceFlow(opts: DeviceFlowOptions): Promise<AuthorizeResult>;
+export interface AuthCodeFlowOptions {
+    authorizeUrl: string;
+    tokenUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    scope?: string;
+    /** Extra query params for the authorize URL. */
+    extraParams?: Record<string, string>;
+    /**
+     * Extra params for the token request. Separate from `extraParams` because
+     * some are required in both places and mean different things in each —
+     * RFC 8707's `resource` is the case that forced this apart.
+     */
+    tokenParams?: Record<string, string>;
+    headers?: Record<string, string>;
+}
+/**
+ * Authorization-code + PKCE where the user pastes the code back.
+ *
+ * Used when we cannot listen on a loopback port (remote shells, containers),
+ * which is common enough that it is worth having as the simpler default.
+ */
+export declare function startAuthCodeFlow(opts: AuthCodeFlowOptions & {
+    redirectUri: string;
+}): AuthorizeResult;
+/**
+ * Authorization-code + PKCE with a loopback listener, so the browser redirect
+ * completes the flow without the user copying anything.
+ *
+ * `prepare` exists for dynamic client registration: the redirect URI has to be
+ * named when the client is registered, and its port is not known until the
+ * listener is up. So the port is claimed first, the caller gets a chance to go
+ * register against it, and only then is the browser sent anywhere.
+ */
+export declare function startLoopbackFlow(opts: AuthCodeFlowOptions & {
+    prepare?(redirectUri: string): Promise<Partial<AuthCodeFlowOptions>>;
+}): Promise<AuthorizeResult>;