@oharness/engine 0.1.0

package/dist/auth/providers/account.js

@@ -0,0 +1,282 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { errorMessage } from "../../core/errors.js";
+import { userPath } from "../../paths.js";
+import { parseJson } from "../../util/json.js";
+/**
+ * Read once, and lazily: most runs of the CLI never sign in, and a synchronous
+ * read at module load would put a stat on the start-up path of all of them.
+ *
+ * `..` three times from either `src/auth/providers` or `dist/auth/providers`
+ * lands on the package root, which is why the file sits there — the same trick
+ * agent/skills.ts uses to find the skills directory.
+ */
+let packaged;
+let configured;
+function readJsonFile(file) {
+    try {
+        const parsed = parseJson(readFileSync(file, "utf8"));
+        return parsed.ok ? parsed.value : {};
+    }
+    catch {
+        // Absent or unreadable. Both are ordinary, and neither is this layer's
+        // business to complain about.
+        return {};
+    }
+}
+/** The ids this build was packaged with, if it was packaged with any. */
+function fromPackage() {
+    if (packaged)
+        return packaged;
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    packaged = readJsonFile(path.resolve(here, "..", "..", "..", "official.json"));
+    return packaged;
+}
+/** The `account` section of the user's own config file. */
+function fromUserConfig() {
+    if (configured)
+        return configured;
+    const file = readJsonFile(userPath("config.json"));
+    configured = file.account ?? {};
+    return configured;
+}
+function configuredUrl() {
+    const value = process.env["OHARNESS_SUPABASE_URL"] ||
+        fromUserConfig().supabaseUrl ||
+        fromPackage().supabaseUrl ||
+        "";
+    return value.replace(/\/+$/, "");
+}
+function configuredKey() {
+    return (process.env["OHARNESS_SUPABASE_ANON_KEY"] ||
+        fromUserConfig().supabaseAnonKey ||
+        fromPackage().supabaseAnonKey ||
+        "");
+}
+/** Whether this build knows an account project to talk to at all. */
+export function accountsConfigured() {
+    return Boolean(configuredUrl() && configuredKey());
+}
+// Names the config file first, because for anyone running their own fork that
+// is the answer, and an error that only mentions environment variables sends
+// them off to arrange an export that will not survive their next shell.
+const NO_ACCOUNTS = 'no account project is configured. Add {"account":{"supabaseUrl":"…","supabaseAnonKey":"…"}} to ~/.oharness/config.json, or set OHARNESS_SUPABASE_URL and OHARNESS_SUPABASE_ANON_KEY.';
+export function supabaseUrl() {
+    const url = configuredUrl();
+    if (!url)
+        throw new Error(NO_ACCOUNTS);
+    return url;
+}
+/**
+ * The OHarness site — where accounts are made, paid for, and signed into.
+ *
+ * A deployment moves it the same way it moves the gateway, and a local `next
+ * dev` on port 4000 is the reason this is not a constant.
+ */
+const DEFAULT_SITE_URL = "https://oharness.ai";
+export function siteUrl() {
+    // Same order as the project ids above, and it has to be: the browser sign-in
+    // hands a session back from whichever site owns those accounts, so a fork
+    // that moved the project and not the site would send people to ours to sign
+    // in to theirs.
+    const value = process.env["OHARNESS_SITE_URL"] ||
+        fromUserConfig().siteUrl ||
+        fromPackage().siteUrl ||
+        DEFAULT_SITE_URL;
+    return value.replace(/\/+$/, "");
+}
+/**
+ * Signing in by sending the user to the site, in their own browser.
+ *
+ * The emailed code below works from anywhere, which is why it is still here —
+ * a terminal over SSH has no browser to open. But on a machine that does have
+ * one, sending them to the site's own login is strictly better: it is the page
+ * that offers a password and Google, it is the page that knows how to sign
+ * someone *up*, and neither of those has to be reimplemented here to stay
+ * working.
+ *
+ * What comes back is a sealed code on a loopback redirect, traded for the
+ * session over HTTPS. The frontend owns the loopback listener because it is
+ * the one already running a local server; this pair of functions is the part
+ * that belongs to the account rather than to any one frontend.
+ */
+export function browserSignInUrl(opts) {
+    const url = new URL("/auth/desktop", `${siteUrl()}/`);
+    url.searchParams.set("state", opts.state);
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    if (opts.locale)
+        url.searchParams.set("locale", opts.locale);
+    return url.toString();
+}
+/** Trade a sealed handoff code for the session it stands for. */
+export async function exchangeHandoff(code, state) {
+    let response;
+    try {
+        response = await fetch(`${siteUrl()}/api/desktop/exchange`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify({ code, state }),
+        });
+    }
+    catch (err) {
+        // A site that cannot be reached is the common failure here — offline, or
+        // OHARNESS_SITE_URL pointing at a dev server that is not running — and it
+        // deserves better than "sign-in failed".
+        return { type: "failed", error: `could not reach ${siteUrl()}: ${errorMessage(err)}` };
+    }
+    const body = parseJson(await response.text());
+    if (!response.ok) {
+        return {
+            type: "failed",
+            error: (body.ok && body.value.error) || `the site refused the sign-in (HTTP ${response.status})`,
+        };
+    }
+    if (!body.ok || !body.value.access_token || !body.value.refresh_token) {
+        return { type: "failed", error: "the site returned no session" };
+    }
+    return {
+        type: "success",
+        access: body.value.access_token,
+        refresh: body.value.refresh_token,
+        expires: body.value.expires_at ?? 0,
+    };
+}
+function supabaseKey() {
+    const key = configuredKey();
+    if (!key)
+        throw new Error(NO_ACCOUNTS);
+    return key;
+}
+/** Every Supabase auth call carries the anon key as well as any bearer token. */
+export function supabaseHeaders() {
+    return {
+        apikey: supabaseKey(),
+        "content-type": "application/json",
+        accept: "application/json",
+    };
+}
+/** The emailed-code sign-in, as an OAuth method a provider can declare. */
+export function accountSignIn(label) {
+    return {
+        type: "oauth",
+        label,
+        prompts: [
+            {
+                type: "text",
+                key: "email",
+                message: "Email on your OHarness account",
+                placeholder: "you@example.com",
+                validate: (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? undefined : "that does not look like an email",
+            },
+        ],
+        async authorize(inputs) {
+            const email = (inputs["email"] ?? "").trim();
+            const response = await fetch(`${supabaseUrl()}/auth/v1/otp`, {
+                method: "POST",
+                headers: supabaseHeaders(),
+                // Signing up is the website's job: a subscription has to be paid for
+                // before it can be signed into, and silently creating an account
+                // here would hand out a login that cannot call anything.
+                body: JSON.stringify({ email, create_user: false }),
+            });
+            if (!response.ok) {
+                const detail = await failureDetail(response);
+                // GoTrue phrases "this address has no account" as a signup refusal,
+                // which reads as a bug in the client to anyone who does have one.
+                const noAccount = /signups? not allowed/i.test(detail);
+                throw new Error(noAccount
+                    ? `no OHarness account for ${email}. Sign up on the OHarness site first, then sign in here.`
+                    : `could not send the sign-in code to ${email}: ${detail}`);
+            }
+            return {
+                method: "code",
+                instructions: `We emailed a sign-in code to ${email}. Paste it here — the code, not the link.`,
+                // No page to open: the code arrives by email, and sending a browser
+                // to the login form would only invite a second, competing session.
+                async callback(code) {
+                    try {
+                        return await verifyOtp(email, code);
+                    }
+                    catch (err) {
+                        return { type: "failed", error: errorMessage(err) };
+                    }
+                },
+            };
+        },
+    };
+}
+/** Exchange the emailed code for a session. */
+export async function verifyOtp(email, code) {
+    const response = await fetch(`${supabaseUrl()}/auth/v1/verify`, {
+        method: "POST",
+        headers: supabaseHeaders(),
+        body: JSON.stringify({ email, token: code.trim(), type: "email" }),
+    });
+    if (!response.ok) {
+        return { type: "failed", error: await failureDetail(response) };
+    }
+    const session = parseJson(await response.text());
+    if (!session.ok || !session.value.access_token) {
+        return { type: "failed", error: "the sign-in returned no access token" };
+    }
+    const credential = toCredential(session.value);
+    return {
+        type: "success",
+        access: credential.access,
+        refresh: credential.refresh,
+        expires: credential.expires,
+    };
+}
+/** Trade a refresh token for a fresh session, or nothing if it is still good. */
+export async function refreshSession(credential) {
+    if (!credential.refresh)
+        return undefined;
+    // GoTrue takes the grant type in the query string and the body as JSON,
+    // so the generic form-encoded OAuth refresh does not fit.
+    const response = await fetch(`${supabaseUrl()}/auth/v1/token?grant_type=refresh_token`, {
+        method: "POST",
+        headers: supabaseHeaders(),
+        body: JSON.stringify({ refresh_token: credential.refresh }),
+    });
+    if (!response.ok) {
+        throw new Error(`subscription refresh failed: ${await failureDetail(response)}`);
+    }
+    const session = parseJson(await response.text());
+    if (!session.ok || !session.value.access_token) {
+        throw new Error("subscription refresh returned no access token");
+    }
+    return toCredential(session.value, credential);
+}
+export function toCredential(session, previous) {
+    return {
+        type: "oauth",
+        access: session.access_token,
+        // GoTrue rotates the refresh token on every use, but keep the previous one
+        // if a response ever omits it — dropping it ends the session at expiry.
+        refresh: session.refresh_token ?? previous?.refresh ?? "",
+        expires: session.expires_in ? Date.now() + session.expires_in * 1_000 : 0,
+        ...(previous?.baseUrl ? { baseUrl: previous.baseUrl } : {}),
+    };
+}
+/**
+ * GoTrue reports failures under several field names depending on the version
+ * and the error class. Probing them beats showing a bare status code, which is
+ * what "sign-in failed (400)" leaves the user debugging.
+ */
+export async function failureDetail(response) {
+    const text = await response.text();
+    const parsed = parseJson(text);
+    const detail = parsed.ok
+        ? (parsed.value.error_description ??
+            parsed.value.msg ??
+            parsed.value.message ??
+            parsed.value.error)
+        : undefined;
+    return `HTTP ${response.status}${detail ? `: ${detail}` : ` ${text.slice(0, 200)}`}`;
+}
+/** The bearer shape both account-backed providers resolve to. */
+export function bearer(token, source) {
+    return { headers: { authorization: `Bearer ${token}` }, source };
+}
+//# sourceMappingURL=account.js.map

package/dist/auth/providers/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/auth/providers/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA6D/C;;;;;;;GAOG;AACH,IAAI,QAAoC,CAAC;AACzC,IAAI,UAAsC,CAAC;AAE3C,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAiB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,8BAA8B;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW;IAClB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2DAA2D;AAC3D,SAAS,cAAc;IACrB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAiC,CAAC;IACnF,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACpC,cAAc,EAAE,CAAC,WAAW;QAC5B,WAAW,EAAE,CAAC,WAAW;QACzB,EAAE,CAAC;IACL,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzC,cAAc,EAAE,CAAC,eAAe;QAChC,WAAW,EAAE,CAAC,eAAe;QAC7B,EAAE,CACH,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,aAAa,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,WAAW,GACf,sLAAsL,CAAC;AAEzL,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,MAAM,UAAU,OAAO;IACrB,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,cAAc,EAAE,CAAC,OAAO;QACxB,WAAW,EAAE,CAAC,OAAO;QACrB,gBAAgB,CAAC;IACnB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAOhC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC/D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,EAAE,uBAAuB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,yCAAyC;QACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAKnB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACnE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,MAAM,EAAE,WAAW,EAAE;QACrB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;AACJ,CAAC;AAYD,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,OAAO;gBACZ,OAAO,EAAE,gCAAgC;gBACzC,WAAW,EAAE,iBAAiB;gBAC9B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC;aAC5F;SACF;QAED,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,cAAc,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,eAAe,EAAE;gBAC1B,qEAAqE;gBACrE,iEAAiE;gBACjE,yDAAyD;gBACzD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;aACpD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,SAAS;oBACP,CAAC,CAAC,2BAA2B,KAAK,0DAA0D;oBAC5F,CAAC,CAAC,sCAAsC,KAAK,KAAK,MAAM,EAAE,CAC7D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,YAAY,EAAE,gCAAgC,KAAK,2CAA2C;gBAC9F,oEAAoE;gBACpE,mEAAmE;gBACnE,KAAK,CAAC,QAAQ,CAAC,IAAY;oBACzB,IAAI,CAAC;wBACH,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACtC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtD,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,iBAAiB,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,eAAe,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA2B;IAE3B,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE1C,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,yCAAyC,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,eAAe,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAsB,EACtB,QAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAa;QAC7B,2EAA2E;QAC3E,wEAAwE;QACxE,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ,EAAE,OAAO,IAAI,EAAE;QACzD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAgB,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE;QACtB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG;YAChB,MAAM,CAAC,KAAK,CAAC,OAAO;YACpB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,QAAQ,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/auth/providers/anthropic.d.ts

@@ -0,0 +1,24 @@
+import type { AuthProvider } from "../types.ts";
+/**
+ * Anthropic authentication.
+ *
+ * Subscription/OAuth support here deliberately piggybacks on the official
+ * `ant` CLI rather than reimplementing a login flow: `ant auth login` already
+ * runs the browser flow, stores a profile under the Anthropic config
+ * directory, and refreshes tokens. Re-deriving that with a hardcoded client id
+ * would mean impersonating another application's OAuth registration.
+ *
+ * Credential precedence matches the documented SDK chain, first match wins:
+ *   ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → ant profile → stored API key
+ */
+export declare const anthropicAuth: AuthProvider;
+/** Sentinel meaning "the credential lives in the ant profile, go ask it". */
+export declare const ANT_PROFILE_MARKER = "__ant_cli_profile__";
+/**
+ * Ask the `ant` CLI for a short-lived access token.
+ *
+ * `print-credentials --access-token` prints a bare token and refreshes it if
+ * needed. Without the flag it prints the whole credentials JSON, which is a
+ * common way to end up sending a JSON blob as an Authorization header.
+ */
+export declare function antAccessToken(): Promise<string | undefined>;

package/dist/auth/providers/anthropic.js

@@ -0,0 +1,209 @@
+import { execFile } from "node:child_process";
+import { readFile, readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { parseJson } from "../../util/json.js";
+import { isExpired } from "../types.js";
+const run = promisify(execFile);
+/**
+ * The beta flag the API requires when authenticating with an OAuth bearer
+ * token instead of an API key. Without it `/v1/messages` rejects the request.
+ */
+const OAUTH_BETA = "oauth-2025-04-20";
+/**
+ * Anthropic authentication.
+ *
+ * Subscription/OAuth support here deliberately piggybacks on the official
+ * `ant` CLI rather than reimplementing a login flow: `ant auth login` already
+ * runs the browser flow, stores a profile under the Anthropic config
+ * directory, and refreshes tokens. Re-deriving that with a hardcoded client id
+ * would mean impersonating another application's OAuth registration.
+ *
+ * Credential precedence matches the documented SDK chain, first match wins:
+ *   ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → ant profile → stored API key
+ */
+export const anthropicAuth = {
+    id: "anthropic",
+    label: "Anthropic",
+    methods: [
+        {
+            type: "api",
+            label: "API key",
+            prompts: [
+                {
+                    type: "text",
+                    key: "key",
+                    message: "Anthropic API key",
+                    placeholder: "sk-ant-…",
+                    secret: true,
+                    validate: (value) => value.startsWith("sk-ant-") ? undefined : "expected a key starting with sk-ant-",
+                },
+            ],
+        },
+        {
+            type: "api",
+            label: "Subscription via the `ant` CLI (run `ant auth login` first)",
+            // No prompts: the credential lives in the ant profile, we just verify it.
+            async authorize() {
+                const token = await antAccessToken();
+                if (!token) {
+                    return {
+                        type: "failed",
+                        error: "no active `ant` credential found. Install the Anthropic CLI and run `ant auth login`, then retry.",
+                    };
+                }
+                // Store a marker rather than the token: `ant` owns refresh, and a copy
+                // here would go stale within the hour.
+                return { type: "success", key: ANT_PROFILE_MARKER, metadata: { source: "ant-cli" } };
+            },
+        },
+    ],
+    async loader(credential, ctx) {
+        void ctx;
+        // 1. An explicit API key in the environment outranks everything.
+        const envKey = process.env["ANTHROPIC_API_KEY"];
+        if (envKey)
+            return apiKeyAuth(envKey, "env:ANTHROPIC_API_KEY");
+        // 2. A bearer token in the environment. Never send both — the API rejects
+        //    a request carrying an API key and a bearer token together.
+        const envToken = process.env["ANTHROPIC_AUTH_TOKEN"];
+        if (envToken)
+            return bearerAuth(envToken, "env:ANTHROPIC_AUTH_TOKEN");
+        // 3. A credential we stored ourselves.
+        if (credential?.type === "oauth" && !isExpired(credential)) {
+            return bearerAuth(credential.access, "stored:oauth");
+        }
+        if (credential?.type === "api" && credential.key !== ANT_PROFILE_MARKER) {
+            return apiKeyAuth(credential.key, "stored:api");
+        }
+        // 4. The `ant` CLI profile. Asked last because the env vars shadow it, and
+        //    it costs a subprocess.
+        const token = await antAccessToken();
+        if (token)
+            return bearerAuth(token, "ant-cli");
+        return undefined;
+    },
+    async refresh(credential) {
+        // Tokens sourced from the ant profile are refreshed by ant itself; the
+        // loader re-reads them on every request, so there is nothing to do here.
+        void credential;
+        return undefined;
+    },
+    async discover() {
+        const envKey = process.env["ANTHROPIC_API_KEY"];
+        if (envKey)
+            return { credential: { type: "api", key: envKey }, source: "env:ANTHROPIC_API_KEY" };
+        const token = await antAccessToken();
+        if (token) {
+            return {
+                credential: { type: "api", key: ANT_PROFILE_MARKER, metadata: { source: "ant-cli" } },
+                source: "ant-cli",
+            };
+        }
+        return undefined;
+    },
+};
+/** Sentinel meaning "the credential lives in the ant profile, go ask it". */
+export const ANT_PROFILE_MARKER = "__ant_cli_profile__";
+function apiKeyAuth(key, source) {
+    return {
+        headers: { "x-api-key": key },
+        // Strip any bearer header a previous resolution may have set.
+        removeHeaders: ["authorization"],
+        source,
+    };
+}
+function bearerAuth(token, source) {
+    return {
+        headers: {
+            authorization: `Bearer ${token}`,
+            // OAuth bearer auth is gated behind this beta flag.
+            "anthropic-beta": OAUTH_BETA,
+        },
+        // Sending x-api-key alongside a bearer token is rejected.
+        removeHeaders: ["x-api-key"],
+        source,
+    };
+}
+/**
+ * Ask the `ant` CLI for a short-lived access token.
+ *
+ * `print-credentials --access-token` prints a bare token and refreshes it if
+ * needed. Without the flag it prints the whole credentials JSON, which is a
+ * common way to end up sending a JSON blob as an Authorization header.
+ */
+export async function antAccessToken() {
+    const args = ["auth", "print-credentials", "--access-token"];
+    const profile = process.env["ANTHROPIC_PROFILE"];
+    if (profile)
+        args.push("--profile", profile);
+    try {
+        const { stdout } = await run("ant", args, { timeout: 10_000, encoding: "utf8" });
+        const token = stdout.trim();
+        // Guard against the no-flag JSON output sneaking through.
+        return token && !token.startsWith("{") ? token : undefined;
+    }
+    catch {
+        // ant not installed, or no active credential — fall back to the file.
+        return antTokenFromDisk();
+    }
+}
+/**
+ * Best-effort read of the credential file the `ant` CLI writes, for hosts
+ * where the binary is unavailable but the profile exists. Field names are
+ * probed rather than assumed, and an expired token is treated as absent since
+ * we cannot refresh it without the CLI.
+ */
+async function antTokenFromDisk() {
+    const dir = antConfigDir();
+    const profile = process.env["ANTHROPIC_PROFILE"];
+    const candidates = [];
+    if (profile)
+        candidates.push(path.join(dir, "credentials", `${profile}.json`));
+    candidates.push(path.join(dir, "credentials", "default.json"));
+    try {
+        for (const name of await readdir(path.join(dir, "credentials"))) {
+            if (name.endsWith(".json"))
+                candidates.push(path.join(dir, "credentials", name));
+        }
+    }
+    catch {
+        // No credentials directory: nothing to read.
+    }
+    for (const file of candidates) {
+        let raw;
+        try {
+            raw = await readFile(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const parsed = parseJson(raw);
+        if (!parsed.ok)
+            continue;
+        const token = parsed.value.access_token ?? parsed.value.accessToken;
+        if (typeof token !== "string" || token === "")
+            continue;
+        const expiry = parsed.value.expires_at ?? parsed.value.expiresAt;
+        if (expiry !== undefined) {
+            const at = typeof expiry === "number" ? expiry : Date.parse(String(expiry));
+            // Values may be seconds or milliseconds; normalize before comparing.
+            const ms = Number.isFinite(at) ? (at < 1e12 ? at * 1_000 : at) : undefined;
+            if (ms !== undefined && ms <= Date.now())
+                continue;
+        }
+        return token;
+    }
+    return undefined;
+}
+function antConfigDir() {
+    const explicit = process.env["ANTHROPIC_CONFIG_DIR"];
+    if (explicit)
+        return explicit;
+    if (process.platform === "win32") {
+        return path.join(process.env["APPDATA"] ?? homedir(), "Anthropic");
+    }
+    return path.join(homedir(), ".config", "anthropic");
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/auth/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/auth/providers/anthropic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAO/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,WAAW;IAElB,OAAO,EAAE;QACP;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,KAAK;oBACV,OAAO,EAAE,mBAAmB;oBAC5B,WAAW,EAAE,UAAU;oBACvB,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAsC;iBACnF;aACF;SACF;QACD;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,6DAA6D;YACpE,0EAA0E;YAC1E,KAAK,CAAC,SAAS;gBACb,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;gBACrC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO;wBACL,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,mGAAmG;qBACtG,CAAC;gBACJ,CAAC;gBACD,uEAAuE;gBACvE,uCAAuC;gBACvC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;YACvF,CAAC;SACF;KACF;IAED,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG;QAC1B,KAAK,GAAG,CAAC;QAET,iEAAiE;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,UAAU,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAE/D,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAEtE,uCAAuC;QACvC,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,UAAU,EAAE,IAAI,KAAK,KAAK,IAAI,UAAU,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACxE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QACrC,IAAI,KAAK;YAAE,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAE/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAA2B;QACvC,uEAAuE;QACvE,yEAAyE;QACzE,KAAK,UAAU,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAEjG,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBACrF,MAAM,EAAE,SAAS;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc;IAC7C,OAAO;QACL,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;QAC7B,8DAA8D;QAC9D,aAAa,EAAE,CAAC,eAAe,CAAC;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,OAAO;QACL,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,oDAAoD;YACpD,gBAAgB,EAAE,UAAU;SAC7B;QACD,0DAA0D;QAC1D,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,0DAA0D;QAC1D,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB;IAC7B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;YAChE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAoB,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,SAAS;QAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QAExD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,qEAAqE;YACrE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,SAAS;QACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC"}

package/dist/auth/providers/generic.d.ts

@@ -0,0 +1,57 @@
+import type { AuthProvider } from "../types.ts";
+/** Build a plain API-key auth provider. */
+export declare function apiKeyProvider(opts: {
+    id: string;
+    label: string;
+    /** Env vars consulted in order before falling back to stored credentials. */
+    envVars?: string[];
+    /** Header carrying the key. Defaults to `authorization: Bearer <key>`. */
+    header?: string;
+    /** Format the header value. Defaults to `Bearer <key>`. */
+    format?: (key: string) => string;
+    placeholder?: string;
+    validate?(value: string): string | undefined;
+    /**
+     * Where this vendor's API lives, when the environment has moved it.
+     *
+     * Returning `undefined` is the normal answer and leaves the catalog's own
+     * `baseUrl` in place — which matters, because a user catalog is the other
+     * way to move an endpoint and an override that fired unconditionally would
+     * quietly outrank it.
+     */
+    baseUrl?: () => string | undefined;
+}): AuthProvider;
+export interface OAuthProviderOptions {
+    id: string;
+    label: string;
+    /**
+     * OAuth client id. Deliberately required rather than bundled: shipping
+     * another application's registered client id would mean authenticating as
+     * that application. Register your own, or supply one your vendor gave you.
+     */
+    clientId: string;
+    clientSecret?: string;
+    scope?: string;
+    /** Device authorization grant (RFC 8628). */
+    deviceCodeUrl?: string;
+    /** Authorization-code endpoints. */
+    authorizeUrl?: string;
+    tokenUrl: string;
+    /** Force the paste-the-code flow instead of a loopback listener. */
+    preferPasteCode?: boolean;
+    extraParams?: Record<string, string>;
+    headers?: Record<string, string>;
+    /** Header carrying the access token. Defaults to `authorization`. */
+    header?: string;
+    format?: (token: string) => string;
+    /** Headers to strip once the bearer token is applied. */
+    removeHeaders?: string[];
+    /** Extra headers every authenticated request needs. */
+    extraHeaders?: Record<string, string>;
+    envVars?: string[];
+}
+/**
+ * Build an OAuth auth provider covering the flows a terminal app can actually
+ * complete: device code, loopback redirect, or paste-the-code.
+ */
+export declare function oauthProvider(opts: OAuthProviderOptions): AuthProvider;