@omniaseo/cli 0.1.0

package/README.md

@@ -0,0 +1,35 @@
+# `@omniaseo/cli`
+
+Node 24 CLI for initializing a non-secret Omnia Connect workspace and connecting supported MCP hosts.
+
+With Node 24 and Codex CLI installed, run the ready-to-use connection command from the Omniaseo Connect page. It downloads this CLI automatically, opens the native browser authorization and checks a workspace read; no manual OAuth settings are required. The command pins the release, for example:
+
+```bash
+npx --yes @omniaseo/cli@0.1.0 connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
+```
+
+Use the command supplied by your workspace so its server addresses are correct. Already-open Codex applications must restart after setup to load the connection settings.
+
+```bash
+omnia init --yes
+omnia connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
+omnia login
+omnia whoami
+omnia approval list
+omnia audit tail
+omnia doctor
+```
+
+First-party CLI OAuth requires explicit `OMNIA_CLI_*` public-client configuration and a native OS vault (Linux Secret Service, macOS Keychain or Windows Password Vault). Refresh rotation is serialized per profile, bearer/OAuth HTTP redirects fail closed, and logout retains the vault credential if remote revocation is incomplete unless `--local-only` is explicit. The CLI never accepts bearer tokens on the command line, reads Codex/browser OAuth storage, or writes credentials into `.omnia` or `.codex`. Public NPM or ChatGPT publication requires separate authorization.
+
+`omnia init` creates workspace files; it does not authenticate. `omnia connect codex` delegates registration and OAuth to Codex's native client and requests `offline_access` together with the selected tool scopes. `omnia login` instead uses the separately configured `OMNIA_CLI_OAUTH_CLIENT_ID`; it does not register a client or reuse Codex credentials. That public client must support both `authorization_code` and `refresh_token` grants. An older authorization-code-only registration cannot acquire offline access silently.
+
+Offline consent is separate from tool permissions. The Omnia issuer keeps access tokens at 900 seconds and rotates refresh tokens after every successful renewal. Renewal extends the 180-day inactivity window without an absolute authorization lifetime; revocation or loss of authority still blocks access immediately. Existing links without offline consent need that initial consent once, not periodic reauthorization.
+
+### Codex automatic renewal compatibility
+
+`omnia connect codex` checks the installed Codex feature capabilities before changing configuration or starting OAuth. For compatible versions it enables coordinated OAuth renewal automatically, with a backup of the existing config and preservation of unrelated settings and comments. Customers do not need to edit flags. Restart already-open Codex applications after setup so their existing connections adopt the setting. An unsupported Codex version receives an update instruction; an explicit conflicting preference is left unchanged and reported before login.
+
+The setting is Codex-wide (`features.mcp_oauth_refresh_coordination = true`), not limited to the Omniaseo server. Upstream still marks it experimental. Windows Codex `0.155.0-alpha.9.2` passed two real access-token expiry/renewal cycles, process restart and revocation with this setting; this is not a compatibility claim for every Codex release or other MCP hosts. The installer checks support rather than assuming it from a version number. Its immediate read-only smoke also enables coordination explicitly because the smoke deliberately ignores user configuration; that smoke alone does not repeat the timed renewal acceptance test.
+
+The CLI archive bundles its private contract dependency so installation does not require a repository checkout. Codex retains custody of all OAuth credentials; this compatibility setup changes only non-secret configuration. Public distribution does not establish compatibility with untested clients or authorize production promotion.

package/dist/auth/credential-store.d.ts

@@ -0,0 +1,28 @@
+import type { CommandRunner } from '../process/runner.js';
+export type SessionCredential = {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: 'Bearer';
+    expiresAt: number;
+    scopes: readonly string[];
+    issuer: string;
+    clientId: string;
+    resource: string;
+};
+export interface CredentialStore {
+    get(profile: string): Promise<SessionCredential | null>;
+    set(profile: string, credential: SessionCredential): Promise<void>;
+    delete(profile: string): Promise<boolean>;
+    available(): Promise<boolean>;
+}
+/** Native OS keychain implementation. Secrets only cross stdin/stdout, never argv. */
+export declare class SystemCredentialStore implements CredentialStore {
+    private readonly runner;
+    private readonly platform;
+    constructor(runner: CommandRunner, platform?: NodeJS.Platform);
+    available(): Promise<boolean>;
+    get(profile: string): Promise<SessionCredential | null>;
+    set(profile: string, credential: SessionCredential): Promise<void>;
+    delete(profile: string): Promise<boolean>;
+}
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/auth/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../src/auth/credential-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACxD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/B;AA0ED,sFAAsF;AACtF,qBAAa,qBAAsB,YAAW,eAAe;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAiB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAhD,MAAM,EAAE,aAAa,EAAmB,QAAQ,kBAAmB;IAE1F,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAS7B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAcvD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBhD"}

package/dist/auth/credential-store.js

@@ -0,0 +1,138 @@
+import { CliError, EXIT } from '../errors.js';
+const PROFILE = /^[a-zA-Z0-9._-]{1,80}$/u;
+const SERVICE = 'com.omniaseo.omnia-cli';
+const POWERSHELL_ARGS = ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command'];
+const WINDOWS_PROBE = '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]';
+const WINDOWS_GET = [
+    '$p=ConvertFrom-Json ([Console]::In.ReadToEnd())',
+    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+    '$v=New-Object Windows.Security.Credentials.PasswordVault',
+    'try{$c=$v.Retrieve($p.resource,$p.userName);$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{exit 44}',
+].join(';');
+const WINDOWS_SET = [
+    '$p=ConvertFrom-Json ([Console]::In.ReadToEnd())',
+    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+    '$v=New-Object Windows.Security.Credentials.PasswordVault',
+    'try{$old=$v.Retrieve($p.resource,$p.userName);$v.Remove($old)}catch{}',
+    '$c=New-Object Windows.Security.Credentials.PasswordCredential($p.resource,$p.userName,$p.password)',
+    '$v.Add($c)',
+].join(';');
+const WINDOWS_DELETE = [
+    '$p=ConvertFrom-Json ([Console]::In.ReadToEnd())',
+    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+    '$v=New-Object Windows.Security.Credentials.PasswordVault',
+    'try{$c=$v.Retrieve($p.resource,$p.userName);$v.Remove($c)}catch{exit 44}',
+].join(';');
+function account(profile) {
+    if (!PROFILE.test(profile)) {
+        throw new CliError('Profile contains unsupported characters', 'PROFILE_INVALID', EXIT.USAGE);
+    }
+    return `profile:${profile}`;
+}
+function unavailable() {
+    return new CliError('A supported OS keychain is unavailable; credentials were not stored', 'KEYCHAIN_UNAVAILABLE', EXIT.DEPENDENCY_MISSING, { status: 'BLOCKED', platform: process.platform });
+}
+function parseCredential(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new CliError('Stored CLI credential is corrupt', 'CREDENTIAL_CORRUPT', EXIT.AUTH_BLOCKED);
+    }
+    if (!value || typeof value !== 'object')
+        throw new CliError('Stored CLI credential is corrupt', 'CREDENTIAL_CORRUPT', EXIT.AUTH_BLOCKED);
+    const data = value;
+    if (typeof data.accessToken !== 'string' || data.accessToken.length < 8 || data.accessToken.length > 131_072
+        || data.tokenType !== 'Bearer' || typeof data.expiresAt !== 'number'
+        || !Array.isArray(data.scopes) || !data.scopes.every((scope) => typeof scope === 'string')
+        || typeof data.issuer !== 'string' || typeof data.clientId !== 'string' || typeof data.resource !== 'string'
+        || (data.refreshToken !== undefined && typeof data.refreshToken !== 'string')) {
+        throw new CliError('Stored CLI credential is corrupt', 'CREDENTIAL_CORRUPT', EXIT.AUTH_BLOCKED);
+    }
+    return {
+        accessToken: data.accessToken,
+        ...(typeof data.refreshToken === 'string' ? { refreshToken: data.refreshToken } : {}),
+        tokenType: 'Bearer',
+        expiresAt: data.expiresAt,
+        scopes: data.scopes,
+        issuer: data.issuer,
+        clientId: data.clientId,
+        resource: data.resource,
+    };
+}
+/** Native OS keychain implementation. Secrets only cross stdin/stdout, never argv. */
+export class SystemCredentialStore {
+    runner;
+    platform;
+    constructor(runner, platform = process.platform) {
+        this.runner = runner;
+        this.platform = platform;
+    }
+    async available() {
+        if (this.platform === 'linux')
+            return this.runner.run('secret-tool', ['--version']).status === 0;
+        if (this.platform === 'darwin')
+            return this.runner.run('security', ['help']).status === 0;
+        if (this.platform === 'win32') {
+            return this.runner.run('powershell.exe', [...POWERSHELL_ARGS, WINDOWS_PROBE]).status === 0;
+        }
+        return false;
+    }
+    async get(profile) {
+        if (!await this.available())
+            throw unavailable();
+        const profileAccount = account(profile);
+        const result = this.platform === 'linux'
+            ? this.runner.run('secret-tool', ['lookup', 'service', SERVICE, 'account', profileAccount])
+            : this.platform === 'darwin'
+                ? this.runner.run('security', ['find-generic-password', '-s', SERVICE, '-a', profileAccount, '-w'])
+                : this.runner.run('powershell.exe', [...POWERSHELL_ARGS, WINDOWS_GET], {
+                    input: JSON.stringify({ resource: SERVICE, userName: profileAccount }),
+                });
+        if (result.status !== 0 || !result.stdout.trim())
+            return null;
+        return parseCredential(result.stdout.trim());
+    }
+    async set(profile, credential) {
+        if (!await this.available())
+            throw unavailable();
+        const serialized = JSON.stringify(credential);
+        const profileAccount = account(profile);
+        const result = this.platform === 'linux'
+            ? this.runner.run('secret-tool', ['store', '--label=Omnia CLI OAuth credential', 'service', SERVICE, 'account', profileAccount], { input: serialized })
+            : this.platform === 'darwin'
+                ? this.runner.run('security', ['add-generic-password', '-U', '-s', SERVICE, '-a', profileAccount, '-w'], { input: `${serialized}\n` })
+                : this.runner.run('powershell.exe', [...POWERSHELL_ARGS, WINDOWS_SET], {
+                    input: JSON.stringify({ resource: SERVICE, userName: profileAccount, password: serialized }),
+                });
+        if (result.status !== 0) {
+            throw new CliError('OS keychain rejected the credential', 'KEYCHAIN_WRITE_FAILED', EXIT.AUTH_BLOCKED);
+        }
+    }
+    async delete(profile) {
+        if (!await this.available())
+            throw unavailable();
+        const profileAccount = account(profile);
+        const existing = this.platform === 'linux'
+            ? this.runner.run('secret-tool', ['lookup', 'service', SERVICE, 'account', profileAccount])
+            : this.platform === 'darwin'
+                ? this.runner.run('security', ['find-generic-password', '-s', SERVICE, '-a', profileAccount, '-w'])
+                : this.runner.run('powershell.exe', [...POWERSHELL_ARGS, WINDOWS_GET], {
+                    input: JSON.stringify({ resource: SERVICE, userName: profileAccount }),
+                });
+        if (existing.status !== 0 || !existing.stdout.trim())
+            return false;
+        const result = this.platform === 'linux'
+            ? this.runner.run('secret-tool', ['clear', 'service', SERVICE, 'account', profileAccount])
+            : this.platform === 'darwin'
+                ? this.runner.run('security', ['delete-generic-password', '-s', SERVICE, '-a', profileAccount])
+                : this.runner.run('powershell.exe', [...POWERSHELL_ARGS, WINDOWS_DELETE], {
+                    input: JSON.stringify({ resource: SERVICE, userName: profileAccount }),
+                });
+        if (result.status !== 0)
+            throw new CliError('OS keychain could not delete the credential', 'KEYCHAIN_DELETE_FAILED', EXIT.AUTH_BLOCKED);
+        return true;
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/auth/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/auth/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAqB9C,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAC1C,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAU,CAAC;AAC1F,MAAM,aAAa,GAAG,4GAA4G,CAAC;AACnI,MAAM,WAAW,GAAG;IAClB,iDAAiD;IACjD,4GAA4G;IAC5G,0DAA0D;IAC1D,oHAAoH;CACrH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACZ,MAAM,WAAW,GAAG;IAClB,iDAAiD;IACjD,4GAA4G;IAC5G,0DAA0D;IAC1D,uEAAuE;IACvE,oGAAoG;IACpG,YAAY;CACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACZ,MAAM,cAAc,GAAG;IACrB,iDAAiD;IACjD,4GAA4G;IAC5G,0DAA0D;IAC1D,0EAA0E;CAC3E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,yCAAyC,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,WAAW,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,QAAQ,CACjB,qEAAqE,EACrE,sBAAsB,EACtB,IAAI,CAAC,kBAAkB,EACvB,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzI,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,OAAO;WACrG,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;WACjE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;WACvF,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;WACzG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAkB;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,qBAAqB;IACH;IAAwC;IAArE,YAA6B,MAAqB,EAAmB,WAAW,OAAO,CAAC,QAAQ;QAAnE,WAAM,GAAN,MAAM,CAAe;QAAmB,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IAEpG,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QACjG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,WAAW,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO;YACtC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBACnG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,EAAE;oBACrE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;iBACvE,CAAC,CAAC;QACP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,UAA6B;QACtD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,WAAW,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO;YACtC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACf,aAAa,EACb,CAAC,OAAO,EAAE,oCAAoC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,EAC9F,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB;YACD,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACf,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EACzE,EAAE,KAAK,EAAE,GAAG,UAAU,IAAI,EAAE,CAC7B;gBACD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,EAAE;oBACrE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;iBAC7F,CAAC,CAAC;QACP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,WAAW,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO;YACxC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBACnG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,EAAE;oBACrE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;iBACvE,CAAC,CAAC;QACP,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO;YACtC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAC1F,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC/F,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,cAAc,CAAC,EAAE;oBACxE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;iBACvE,CAAC,CAAC;QACP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,64 @@
+import type { CommandRunner } from '../process/runner.js';
+import type { CliConfig } from '../config/cli.js';
+import type { CredentialStore, SessionCredential } from './credential-store.js';
+export interface BrowserOpener {
+    open(url: string): Promise<void>;
+}
+export declare class SystemBrowserOpener implements BrowserOpener {
+    private readonly runner;
+    private readonly platform;
+    constructor(runner: CommandRunner, platform?: NodeJS.Platform);
+    open(url: string): Promise<void>;
+}
+export type OAuthClientOptions = {
+    config: CliConfig;
+    store: CredentialStore;
+    browser: BrowserOpener;
+    fetchFn?: typeof fetch;
+    timeoutMs?: number;
+    now?: () => number;
+};
+export declare class OAuthClient {
+    private readonly options;
+    private readonly fetchFn;
+    private readonly timeoutMs;
+    private readonly now;
+    constructor(options: OAuthClientOptions);
+    private fetchMetadata;
+    private metadata;
+    private waitForCode;
+    login(profile: string): Promise<{
+        profile: string;
+        expiresAt: number;
+        scopes: readonly string[];
+    }>;
+    private revokeCredential;
+    logout(profile: string, options?: {
+        localOnly?: boolean;
+    }): Promise<{
+        profile: string;
+        hadCredential: boolean;
+        localDeleted: boolean;
+        remoteRevocation: 'completed' | 'unsupported' | 'failed' | 'skipped_local_only';
+    }>;
+    refresh(profile: string): Promise<SessionCredential>;
+}
+export declare class SessionManager {
+    private readonly store;
+    private readonly profile;
+    private readonly now;
+    private readonly refresh?;
+    private readonly expected?;
+    private refreshInFlight;
+    constructor(store: CredentialStore, profile?: string, now?: () => number, refresh?: (() => Promise<SessionCredential>) | undefined, expected?: {
+        issuer: string;
+        clientId: string;
+        resource: string;
+        scopes: readonly string[];
+    } | undefined);
+    private refreshOnce;
+    private assertBinding;
+    accessToken(): Promise<string>;
+    session(): Promise<Omit<SessionCredential, 'accessToken' | 'refreshToken'> | null>;
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAmBhF,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,qBAAa,mBAAoB,YAAW,aAAa;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAiB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAhD,MAAM,EAAE,aAAa,EAAmB,QAAQ,kBAAmB;IAC1F,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYvC;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AA+CF,qBAAa,WAAW;IAKV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,OAAO,EAAE,kBAAkB;YAM1C,aAAa;YAcb,QAAQ;IAkCtB,OAAO,CAAC,WAAW;IA2Db,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;YA4E1F,gBAAgB;IAqCxB,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GACpC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAiBzJ,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAyD3D;AAED,qBAAa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAP5B,OAAO,CAAC,eAAe,CAAyC;gBAG7C,KAAK,EAAE,eAAe,EACtB,OAAO,SAAY,EACnB,GAAG,GAAE,MAAM,MAAiB,EAC5B,OAAO,CAAC,GAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,aAAA,EAC1C,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,YAAA;YAGjG,WAAW;IAUzB,OAAO,CAAC,aAAa;IAWf,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAc9B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC;CAMzF"}