@providerkit/core 0.17.2 → 0.21.0

package/README.md

@@ -88,14 +88,21 @@ const provider = createPresetProvider("opencode-go", { apiKey });
 
 By default it tries `mimo-v2.6-flash`, then `mimo-v2.5`, `glm-5.3-flash`,
 `qwen3.8-flash` and `longcat-2.0`. Pass `models: [...]` to set your own order, and
-`fallbacks` to add another provider after the last model. Muse Spark uses Go's Responses
-route instead:
+`fallbacks` to add another provider after the last model.
+
+Go serves three wires, and the preset picks one from the model id: `minimax-` and `qwen`
+models on Anthropic Messages, `gpt-`, `grok-` and `muse-spark-` models on Responses, and
+everything else on chat completions. A chain can mix them:
 
 ```ts
-const muse = createPresetProvider("opencode-go-responses", { apiKey });
+const provider = createPresetProvider("opencode-go", {
+  apiKey,
+  models: ["muse-spark-1.3-contributor", "mimo-v2.5"],
+});
 ```
 
-That preset defaults to `muse-spark-1.3-contributor`. It supports text, images, strict JSON
+A per-call `model` on a different wire than the provider's own is refused with an
+`invalid` error, before any request. Muse Contributor supports text, images, strict JSON
 Schema and parallel tools, but only automatic tool choice; `toolChoice: "none"` is encoded
 by sending no tools. Contributor requests may be used to improve Meta products and require
 the workspace to allow those endpoints.
@@ -124,6 +131,7 @@ drift.
 | [Tools](https://providerkit.dev/guides/tools/)                          | Tool kernel, truncated-argument salvage, zod     |
 | [Context and compaction](https://providerkit.dev/guides/context/)       | When to compact, and where to cut                |
 | [Usage and cost](https://providerkit.dev/guides/usage/)                 | Reconciling cache tokens, cost, savings          |
+| [Sign in to a subscription](https://providerkit.dev/guides/auth/)       | Device code and PKCE sign-in, token refresh      |
 | [Jev decisions](https://providerkit.dev/guides/jev/)                    | TypeSafe's decision model on four hosts          |
 
 The [API reference](https://providerkit.dev/reference/) is generated from the source, so it

package/dist/auth/device.d.ts

@@ -0,0 +1,34 @@
+import { type AuthHost } from "./oauth.ts";
+/** Where a vendor's device flow lives, and what it wants on the wire. */
+export interface DeviceEndpoint {
+    /** POST here to get a user code. */
+    deviceUrl: string;
+    /** POST here, again and again, until the user approves. */
+    tokenUrl: string;
+    clientId: string;
+    /** Sent with the code request, for vendors that want scopes. */
+    scope?: string;
+    /** Extra fields on the code request only (xAI wants a `referrer`). */
+    extra?: Record<string, string>;
+    encode: "form" | "json";
+}
+/** What the user must do, and how long we keep asking. */
+export interface DevicePrompt {
+    /** Show it as is: it must match what the vendor's page displays. */
+    userCode: string;
+    /** The approval page, with the code filled in when the vendor offers that. */
+    verificationUrl: string;
+    deviceCode: string;
+    intervalMs: number;
+    expiresAt: number;
+}
+/** Step 1: ask the vendor for a code the user can approve on the web. */
+export declare function requestDeviceCode(host: AuthHost, endpoint: DeviceEndpoint): Promise<DevicePrompt>;
+/**
+ * Step 2: poll until the user approves, and return the raw token body. Turning
+ * it into a credential is the caller's job, because the bodies differ: GitHub
+ * answers with a bare token and no expiry, Meta with an identity token that
+ * still has to be traded for a key.
+ */
+export declare function pollDeviceToken(host: AuthHost, endpoint: DeviceEndpoint, prompt: DevicePrompt, signal: AbortSignal): Promise<Record<string, unknown>>;
+//# sourceMappingURL=device.d.ts.map

package/dist/auth/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/auth/device.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuD,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAShG,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yEAAyE;AACzE,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,YAAY,CAAC,CA6BvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsClC"}

package/dist/auth/device.js

@@ -0,0 +1,85 @@
+// RFC 8628 device authorization: the sign-in that shows a code instead of
+// bouncing through a redirect. Kimi, GitHub Copilot, xAI and Meta all use it.
+import { SignInError, authError, num, postToken, str, webUrl } from "./oauth.js";
+/** RFC 8628: a `slow_down` answer adds this to the poll interval. */
+const SLOW_DOWN_STEP_MS = 5000;
+/** The poll never goes faster than this, whatever the vendor says. */
+const MIN_INTERVAL_MS = 1000;
+/** A vendor that leaves out `expires_in` gets this. */
+const DEFAULT_EXPIRES_SEC = 900;
+/** Step 1: ask the vendor for a code the user can approve on the web. */
+export async function requestDeviceCode(host, endpoint) {
+    const body = await postToken(host, endpoint.deviceUrl, {
+        client_id: endpoint.clientId,
+        ...(endpoint.scope ? { scope: endpoint.scope } : {}),
+        ...endpoint.extra,
+    }, { encode: endpoint.encode });
+    const userCode = str(body.user_code);
+    const deviceCode = str(body.device_code);
+    // The complete URL carries the code, so there is nothing to type.
+    const verificationUrl = webUrl(str(body.verification_uri_complete)) ?? webUrl(str(body.verification_uri));
+    if (!userCode || !deviceCode || !verificationUrl) {
+        throw authError("device_response_invalid", "The sign-in server's reply has no code, device code or http(s) approval page.");
+    }
+    return {
+        userCode,
+        verificationUrl,
+        deviceCode,
+        intervalMs: Math.max(MIN_INTERVAL_MS, (num(body.interval) ?? 5) * 1000),
+        expiresAt: Date.now() + (num(body.expires_in) ?? DEFAULT_EXPIRES_SEC) * 1000,
+    };
+}
+/**
+ * Step 2: poll until the user approves, and return the raw token body. Turning
+ * it into a credential is the caller's job, because the bodies differ: GitHub
+ * answers with a bare token and no expiry, Meta with an identity token that
+ * still has to be traded for a key.
+ */
+export async function pollDeviceToken(host, endpoint, prompt, signal) {
+    let waitMs = prompt.intervalMs;
+    while (Date.now() < prompt.expiresAt) {
+        await sleep(waitMs, signal);
+        // Pending is the normal answer for most of the loop, and GitHub sends it
+        // as a 200 with an `error` field, so the body decides, never the status.
+        const body = await postToken(host, endpoint.tokenUrl, {
+            client_id: endpoint.clientId,
+            device_code: prompt.deviceCode,
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }, { encode: endpoint.encode, allowErrorBody: true });
+        if (str(body.access_token))
+            return body;
+        switch (str(body.error)) {
+            case "authorization_pending":
+                break;
+            case "slow_down":
+                // Honour the longer of our step and an interval the server names.
+                waitMs = Math.max(waitMs + SLOW_DOWN_STEP_MS, (num(body.interval) ?? 0) * 1000);
+                break;
+            case "access_denied":
+            case "authorization_denied":
+                throw new SignInError("denied");
+            case "expired_token":
+                throw new SignInError("expired");
+            default:
+                throw authError("token_refused", `The sign-in server refused the request: ${str(body.error_description) ?? str(body.error) ?? "no reason given"}`);
+        }
+    }
+    throw new SignInError("expired");
+}
+/** A delay that a cancelled sign-in cuts short. */
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted)
+            return reject(new SignInError("cancelled"));
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new SignInError("cancelled"));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=device.js.map

package/dist/auth/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../src/auth/device.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAiB,MAAM,YAAY,CAAC;AAEhG,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,sEAAsE;AACtE,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA2BhC,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAc,EACd,QAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,IAAI,EACJ,QAAQ,CAAC,SAAS,EAClB;QACE,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,QAAQ,CAAC,KAAK;KAClB,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,kEAAkE;IAClE,MAAM,eAAe,GACnB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,SAAS,CACb,yBAAyB,EACzB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ;QACR,eAAe;QACf,UAAU;QACV,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACvE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,GAAG,IAAI;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAc,EACd,QAAwB,EACxB,MAAoB,EACpB,MAAmB;IAEnB,IAAI,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,IAAI,EACJ,QAAQ,CAAC,QAAQ,EACjB;YACE,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,UAAU,EAAE,8CAA8C;SAC3D,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAClD,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAExC,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,uBAAuB;gBAC1B,MAAM;YACR,KAAK,WAAW;gBACd,kEAAkE;gBAClE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChF,MAAM;YACR,KAAK,eAAe,CAAC;YACrB,KAAK,sBAAsB;gBACzB,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClC,KAAK,eAAe;gBAClB,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;YACnC;gBACE,MAAM,SAAS,CACb,eAAe,EACf,2CAA2C,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,EAAE,CACjH,CAAC;QACN,CAAC;IACH,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,mDAAmD;AACnD,SAAS,KAAK,CAAC,EAAU,EAAE,MAAmB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/flows.d.ts

@@ -0,0 +1,36 @@
+import { type AuthHost, type Credential } from "./oauth.ts";
+/** What the user must do on the vendor's page to finish signing in. */
+export interface SignInPrompt {
+    /** The approval page. The host has already been asked to open it. */
+    url: string;
+    /** Device-code flows only: the code that page asks for. */
+    userCode?: string;
+}
+/** One vendor's two operations: sign in once, then renew. */
+export interface AuthFlow {
+    signIn(signal: AbortSignal, onPrompt: (prompt: SignInPrompt) => void): Promise<Credential>;
+    /** Trades the stored credential for a fresh one. Both tokens may rotate, so
+     *  save the result before you use it. */
+    refresh(credential: Credential): Promise<Credential>;
+}
+export type AuthFlowId = "chatgpt" | "kimi-plan" | "grok" | "github-copilot" | "meta" | "openrouter";
+export declare function createAuthFlow(id: AuthFlowId, host: AuthHost): AuthFlow;
+/** The authorize URL to open. Exported so a test can pin the exact params. */
+export declare function chatgptAuthorizeUrl(challenge: string, state: string): string;
+/** The `ChatGPT-Account-Id` the Codex backend requires. OpenAI puts it at
+ *  `chatgpt_account_id`, under `https://api.openai.com/auth`, or as
+ *  `organizations[0].id`, depending on the token. */
+export declare function chatgptAccountIdFromToken(token?: string): string | undefined;
+/** An individual seat's host. Other plans get their own, named by the token. */
+export declare const COPILOT_DEFAULT_BASE_URL = "https://api.individual.githubcopilot.com";
+/**
+ * The editor headers Copilot's gate wants on every call.
+ *
+ * `turn` matters for the bill. GitHub charges one premium request per
+ * user-started turn and lets the agent's own follow-ups ride free, and
+ * `X-Initiator` is how a client says which one this is. Leave it off and every
+ * tool call in a run bills as a new turn. The `github-copilot` preset sets it
+ * for you (`initiatorHeader`); this is for a call you make yourself.
+ */
+export declare function copilotHeaders(appName: string, turn: "user" | "agent"): Record<string, string>;
+//# sourceMappingURL=flows.d.ts.map

package/dist/auth/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../src/auth/flows.ts"],"names":[],"mappings":"AAMA,OAAO,EAaL,KAAK,QAAQ,EACb,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAGpB,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3F;6CACyC;IACzC,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,UAAU,GACpB,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,YAAY,CAAC;AAE9E,wBAAgB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAyBvE;AAwDD,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB5E;AA+DD;;qDAEqD;AACrD,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO5E;AAuED,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,6CAA6C,CAAC;AAEnF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU9F"}

package/dist/auth/flows.js

@@ -0,0 +1,392 @@
+// Each vendor's sign-in and renewal, built on the shared pieces in oauth.ts and
+// device.ts. The client ids are the public ones each vendor's own CLI ships.
+//
+// ponytail: public client ids and fixed redirect ports. The ceiling is that a
+// vendor can rotate a client id, add client attestation or refuse a port, and
+// that vendor's sign-in breaks. Its entry below is then the only thing to fix.
+import { accountFromToken, asRecord, authError, generatePKCE, jwtClaims, num, postToken, randomState, REFRESH_SKEW_MS, str, toCredential, webUrl, } from "./oauth.js";
+import { pollDeviceToken, requestDeviceCode } from "./device.js";
+export function createAuthFlow(id, host) {
+    switch (id) {
+        case "chatgpt":
+            return chatgptFlow(host);
+        case "kimi-plan":
+            return deviceFlow(host, KIMI_DEVICE, kimiCredential, kimiRefresh(host));
+        case "grok":
+            return deviceFlow(host, grokDevice(host), grokCredential, grokRefresh(host));
+        case "github-copilot":
+            return deviceFlow(host, GITHUB_DEVICE, (body) => mintCopilotCredential(host, body), (credential) => refreshCopilot(host, credential));
+        case "meta":
+            return deviceFlow(host, META_DEVICE, (body) => mintMetaCredential(host, body), (credential) => refreshMeta(host, credential));
+        case "openrouter":
+            return openrouterFlow(host);
+    }
+}
+/** A device-code sign-in: ask for the code, show it, open the approval page,
+ *  poll until the user approves, then turn the token body into a credential. */
+function deviceFlow(host, endpoint, toCredentialFrom, refresh) {
+    return {
+        async signIn(signal, onPrompt) {
+            const prompt = await requestDeviceCode(host, endpoint);
+            onPrompt({ url: prompt.verificationUrl, userCode: prompt.userCode });
+            // If the host can't open it, the code stays on screen as the fallback.
+            void Promise.resolve(host.openUrl(prompt.verificationUrl)).catch(() => { });
+            return toCredentialFrom(await pollDeviceToken(host, endpoint, prompt, signal));
+        },
+        refresh,
+    };
+}
+/** Refresh-token renewal that rotates both tokens, shared by Kimi and xAI. */
+function refreshWith(host, endpoint, toCredentialFrom) {
+    return async (credential) => toCredentialFrom(await postToken(host, endpoint.tokenUrl, {
+        client_id: endpoint.clientId,
+        grant_type: "refresh_token",
+        refresh_token: credential.refreshToken,
+    }, { encode: endpoint.encode }), credential.refreshToken);
+}
+// ── ChatGPT: PKCE through a redirect ──────────────────────────────────────
+const CHATGPT = {
+    clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+    authorizeUrl: "https://auth.openai.com/oauth/authorize",
+    tokenUrl: "https://auth.openai.com/oauth/token",
+    redirectUri: "http://localhost:1455/auth/callback",
+    // The `api.connectors.*` scopes unlock the subscription quota the Codex
+    // backend bills against.
+    scopes: "openid profile email offline_access api.connectors.read api.connectors.invoke",
+};
+/** The authorize URL to open. Exported so a test can pin the exact params. */
+export function chatgptAuthorizeUrl(challenge, state) {
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: CHATGPT.clientId,
+        redirect_uri: CHATGPT.redirectUri,
+        scope: CHATGPT.scopes,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        // The Codex CLI's own params: the simplified flow skips the consent page
+        // behind the subscription upsell.
+        codex_cli_simplified_flow: "true",
+        originator: "opencodex",
+        id_token_add_organizations: "true",
+    });
+    return `${CHATGPT.authorizeUrl}?${params.toString()}`;
+}
+function chatgptFlow(host) {
+    const tokenRequest = (params) => postToken(host, CHATGPT.tokenUrl, { client_id: CHATGPT.clientId, ...params }, { encode: "form" });
+    return {
+        async signIn(signal, onPrompt) {
+            const { verifier, challenge } = await generatePKCE();
+            const state = randomState();
+            const authorizeUrl = chatgptAuthorizeUrl(challenge, state);
+            onPrompt({ url: authorizeUrl });
+            const code = await host.captureRedirect({
+                authorizeUrl,
+                redirectUri: CHATGPT.redirectUri,
+                state,
+                signal,
+            });
+            return chatgptCredential(await tokenRequest({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: CHATGPT.redirectUri,
+                code_verifier: verifier,
+            }));
+        },
+        async refresh(credential) {
+            const body = await tokenRequest({
+                grant_type: "refresh_token",
+                refresh_token: credential.refreshToken,
+            });
+            return chatgptCredential(body, credential.refreshToken, credential.chatgptAccountId);
+        },
+    };
+}
+function chatgptCredential(body, fallbackRefresh, fallbackAccountId) {
+    const credential = toCredential(body, fallbackRefresh);
+    // The id token has the richer claims. The access token covers a refresh
+    // response that leaves it out.
+    const idToken = str(body.id_token);
+    const account = accountFromToken(idToken, "email") ?? accountFromToken(credential.accessToken, "email");
+    const chatgptAccountId = chatgptAccountIdFromToken(idToken) ??
+        chatgptAccountIdFromToken(credential.accessToken) ??
+        fallbackAccountId;
+    return {
+        ...credential,
+        ...(account ? { account } : {}),
+        ...(chatgptAccountId ? { chatgptAccountId } : {}),
+    };
+}
+/** The `ChatGPT-Account-Id` the Codex backend requires. OpenAI puts it at
+ *  `chatgpt_account_id`, under `https://api.openai.com/auth`, or as
+ *  `organizations[0].id`, depending on the token. */
+export function chatgptAccountIdFromToken(token) {
+    const claims = jwtClaims(token);
+    if (!claims)
+        return undefined;
+    const nested = asRecord(claims["https://api.openai.com/auth"]);
+    const orgs = claims.organizations;
+    const firstOrg = Array.isArray(orgs) ? asRecord(orgs[0]) : {};
+    return str(claims.chatgpt_account_id) ?? str(nested.chatgpt_account_id) ?? str(firstOrg.id);
+}
+// ── Kimi and Grok: device code, then a plain refresh token ────────────────
+const KIMI_DEVICE = {
+    clientId: "17e5f671-d194-4dfb-9706-5516cb48c098",
+    deviceUrl: "https://auth.kimi.ai/api/oauth/device_authorization",
+    tokenUrl: "https://auth.kimi.ai/api/oauth/token",
+    encode: "form",
+};
+function kimiCredential(body, fallbackRefresh) {
+    const credential = toCredential(body, fallbackRefresh);
+    const account = accountFromToken(credential.accessToken, "email", "user_id", "sub");
+    return account ? { ...credential, account } : credential;
+}
+const kimiRefresh = (host) => refreshWith(host, KIMI_DEVICE, kimiCredential);
+function grokDevice(host) {
+    return {
+        clientId: "b1a00492-073a-47ea-816f-4c329264a828",
+        deviceUrl: "https://auth.x.ai/oauth2/device/code",
+        tokenUrl: "https://auth.x.ai/oauth2/token",
+        scope: "openid profile email offline_access grok-cli:access api:access",
+        // Names the app instead of claiming to be the Grok CLI.
+        extra: { referrer: host.appName },
+        encode: "form",
+    };
+}
+/** xAI leaves `expires_in` out of some responses. An hour is what its tokens
+ *  carry when it does send one. A guess that is too short costs one extra
+ *  refresh, while no expiry would be a credential nothing ever renews. */
+const GROK_DEFAULT_LIFETIME_SEC = 3600;
+function grokCredential(body, fallbackRefresh) {
+    const credential = toCredential({ ...body, expires_in: num(body.expires_in) ?? GROK_DEFAULT_LIFETIME_SEC }, fallbackRefresh);
+    const account = accountFromToken(credential.accessToken, "email", "sub");
+    return account ? { ...credential, account } : credential;
+}
+const grokRefresh = (host) => refreshWith(host, grokDevice(host), grokCredential);
+// ── GitHub Copilot: device code, then a mint ──────────────────────────────
+// GitHub's device flow ends in a long-lived GitHub token that the Copilot API
+// does not accept. It is traded at `copilot_internal/v2/token` for a Copilot
+// token that lasts about 25 minutes, and trading again IS the refresh. So
+// `refreshToken` holds the GitHub token and `accessToken` the Copilot one.
+//
+// ponytail: github.com only. A GitHub Enterprise Server tenant serves these
+// endpoints on its own domain. Supporting it means threading one domain through
+// these constants.
+const GITHUB_DEVICE = {
+    // VS Code's Copilot Chat client id. GitHub issues no self-service Copilot
+    // client id, so every third-party client uses this one, and the consent page
+    // says "GitHub Copilot Chat". Swap this constant for your own OAuth app's.
+    clientId: "Iv1.b507a08c87ecfe98",
+    deviceUrl: "https://github.com/login/device/code",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    // Enough to read the account name. Copilot itself is entitled by the account.
+    scope: "read:user",
+    encode: "form",
+};
+const COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+const GITHUB_USER_URL = "https://api.github.com/user";
+/** An individual seat's host. Other plans get their own, named by the token. */
+export const COPILOT_DEFAULT_BASE_URL = "https://api.individual.githubcopilot.com";
+/**
+ * The editor headers Copilot's gate wants on every call.
+ *
+ * `turn` matters for the bill. GitHub charges one premium request per
+ * user-started turn and lets the agent's own follow-ups ride free, and
+ * `X-Initiator` is how a client says which one this is. Leave it off and every
+ * tool call in a run bills as a new turn. The `github-copilot` preset sets it
+ * for you (`initiatorHeader`); this is for a call you make yourself.
+ */
+export function copilotHeaders(appName, turn) {
+    return {
+        "Copilot-Integration-Id": "vscode-chat",
+        "Editor-Version": appName,
+        "Editor-Plugin-Version": appName,
+        "X-GitHub-Api-Version": "2026-06-01",
+        "Openai-Intent": "conversation-edits",
+        "Copilot-Vision-Request": "true",
+        "X-Initiator": turn,
+    };
+}
+async function mintCopilotToken(host, githubToken) {
+    const res = await (host.fetchImpl ?? fetch)(COPILOT_TOKEN_URL, {
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${githubToken}`,
+            ...copilotHeaders(host.appName, "user"),
+        },
+    });
+    const text = await res.text().catch(() => "");
+    const record = asRecord(parseJson(text));
+    if (!res.ok) {
+        throw authError("token_refused", `GitHub refused the Copilot token request: ${str(record.message) ?? res.status}`, { status: res.status, body: text.slice(0, 2_000) });
+    }
+    const accessToken = str(record.token);
+    // Absolute epoch seconds here, not the `expires_in` every other vendor sends.
+    const expiresAtSec = num(record.expires_at);
+    if (!accessToken || expiresAtSec === undefined) {
+        throw authError("token_incomplete", "GitHub's Copilot token reply has no token or expiry.");
+    }
+    return {
+        accessToken,
+        refreshToken: githubToken,
+        expiresAt: expiresAtSec * 1000 - REFRESH_SKEW_MS,
+        baseUrl: copilotApiHost(record.endpoints) ??
+            copilotHostFromToken(accessToken) ??
+            COPILOT_DEFAULT_BASE_URL,
+    };
+}
+async function mintCopilotCredential(host, body) {
+    const githubToken = str(body.access_token);
+    if (!githubToken)
+        throw authError("token_incomplete", "GitHub's reply has no access token.");
+    const credential = await mintCopilotToken(host, githubToken);
+    const account = await githubLogin(host, githubToken);
+    return account ? { ...credential, account } : credential;
+}
+async function refreshCopilot(host, credential) {
+    const fresh = await mintCopilotToken(host, credential.refreshToken);
+    return credential.account ? { ...fresh, account: credential.account } : fresh;
+}
+/** The login for display. A sign-in that worked must not fail because this
+ *  lookup did, so any failure means no name. */
+async function githubLogin(host, githubToken) {
+    try {
+        const res = await (host.fetchImpl ?? fetch)(GITHUB_USER_URL, {
+            headers: { Accept: "application/json", Authorization: `Bearer ${githubToken}` },
+        });
+        return res.ok ? str(asRecord(await res.json()).login) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The host a current token response names outright. */
+function copilotApiHost(endpoints) {
+    return apiBase(str(asRecord(endpoints).api));
+}
+/** The same host read off the token, for a response with no endpoint map. A
+ *  Copilot token is a `;`-joined field list with
+ *  `proxy-ep=proxy.<plan>.githubcopilot.com`, and the API host is that with
+ *  `proxy.` swapped for `api.`. */
+function copilotHostFromToken(token) {
+    const proxy = /(?:^|;)proxy-ep=([^;]+)/.exec(token)?.[1];
+    return proxy ? apiBase(`https://${proxy.replace(/^proxy\./, "api.")}`) : undefined;
+}
+const apiBase = (url) => webUrl(url, ["https:"])?.replace(/\/$/, "");
+// ── Meta Muse: device code, then a key mint ───────────────────────────────
+// The device flow's identity token proves who you are and buys nothing. It is
+// traded for a Model API key that lasts about a day, and trading again IS the
+// refresh. The identity token itself cannot be renewed, so a 401 or 403 from
+// the mint means the session is over and the user must sign in again.
+const META_DEVICE = {
+    // The Muse Code CLI's client id. Meta issues no self-service one.
+    clientId: "1031625952748946",
+    deviceUrl: "https://auth.meta.com/oidc/device/authorization/",
+    tokenUrl: "https://auth.meta.com/oidc/device/token/",
+    encode: "form",
+};
+const META_KEY_URL = "https://api.meta.ai/muse-code/key";
+/** Meta doesn't say how long a key lasts. */
+const META_KEY_LIFETIME_MS = 24 * 60 * 60 * 1000;
+async function mintMetaKey(host, identityToken) {
+    const res = await (host.fetchImpl ?? fetch)(META_KEY_URL, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${identityToken}`,
+            "x-api-version": "1.0.0",
+        },
+        body: "{}",
+    });
+    const text = await res.text().catch(() => "");
+    const record = asRecord(parseJson(text));
+    if (!res.ok) {
+        throw authError("token_refused", `Meta refused the key request: ${str(record.error_description) ?? str(record.detail) ?? res.status}`, { status: res.status, body: text.slice(0, 2_000) });
+    }
+    const apiKey = str(record.api_key);
+    if (!apiKey) {
+        // Meta answers 200 with no key when the account exists but Muse was never
+        // set up on it. `action_url` points at the page to do that.
+        const actionUrl = webUrl(str(record.action_url), ["https:"]);
+        throw authError("setup_required", actionUrl
+            ? `Muse isn't set up on this Meta account. Set it up at ${actionUrl}, then sign in again.`
+            : "Muse isn't set up on this Meta account. Set it up with Meta, then sign in again.");
+    }
+    return {
+        accessToken: apiKey,
+        refreshToken: identityToken,
+        expiresAt: Date.now() + META_KEY_LIFETIME_MS - REFRESH_SKEW_MS,
+    };
+}
+async function mintMetaCredential(host, body) {
+    const identityToken = str(body.access_token);
+    if (!identityToken)
+        throw authError("token_incomplete", "Meta's reply has no identity token.");
+    const credential = await mintMetaKey(host, identityToken);
+    // The minted key is opaque. The identity token is the one with claims.
+    const account = accountFromToken(identityToken, "email", "preferred_username", "sub");
+    return account ? { ...credential, account } : credential;
+}
+async function refreshMeta(host, credential) {
+    const fresh = await mintMetaKey(host, credential.refreshToken);
+    return credential.account ? { ...fresh, account: credential.account } : fresh;
+}
+// ── OpenRouter: PKCE, ending in an API key ────────────────────────────────
+// The code is traded for an ordinary API key on the user's own account. It
+// never expires and the user can revoke it at openrouter.ai, so there is
+// nothing to refresh. There is no client id: PKCE is the whole proof.
+//
+// ponytail: a fixed redirect port. If something else on the machine serves
+// 54546 it sees the code first. The exchange then fails and the user starts
+// over, which is the right end for a code we can no longer trust.
+const OPENROUTER = {
+    authorizeUrl: "https://openrouter.ai/auth",
+    keysUrl: "https://openrouter.ai/api/v1/auth/keys",
+    redirectUri: "http://localhost:54546/callback",
+};
+/** A key doesn't expire, so its `expiresAt` is as far out as a number goes. */
+const NEVER = Number.MAX_SAFE_INTEGER;
+function openrouterFlow(host) {
+    return {
+        async signIn(signal, onPrompt) {
+            const { verifier, challenge } = await generatePKCE();
+            const authorizeUrl = `${OPENROUTER.authorizeUrl}?${new URLSearchParams({
+                callback_url: OPENROUTER.redirectUri,
+                code_challenge: challenge,
+                code_challenge_method: "S256",
+            })}`;
+            onPrompt({ url: authorizeUrl });
+            // No `state`: OpenRouter's authorize endpoint takes none.
+            const code = await host.captureRedirect({
+                authorizeUrl,
+                redirectUri: OPENROUTER.redirectUri,
+                signal,
+            });
+            const res = await (host.fetchImpl ?? fetch)(OPENROUTER.keysUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", Accept: "application/json" },
+                body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" }),
+            });
+            const text = await res.text().catch(() => "");
+            const record = asRecord(parseJson(text));
+            const key = str(record.key);
+            if (!key) {
+                throw authError("token_refused", `OpenRouter refused the key request: ${str(record.message) ?? str(record.error) ?? res.status}`, { status: res.status, body: text.slice(0, 2_000) });
+            }
+            return { accessToken: key, refreshToken: "", expiresAt: NEVER };
+        },
+        // Nothing to renew. A revoked key shows up as the call's own 401, and
+        // signing in again mints a new one.
+        refresh: (credential) => Promise.resolve(credential),
+    };
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=flows.js.map

package/dist/auth/flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.js","sourceRoot":"","sources":["../../src/auth/flows.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,GAAG,EACH,SAAS,EACT,WAAW,EACX,eAAe,EACf,GAAG,EACH,YAAY,EACZ,MAAM,GAGP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAuB,MAAM,aAAa,CAAC;AAqBtF,MAAM,UAAU,cAAc,CAAC,EAAc,EAAE,IAAc;IAC3D,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,KAAK,gBAAgB;YACnB,OAAO,UAAU,CACf,IAAI,EACJ,aAAa,EACb,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,EAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CACjD,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,UAAU,CACf,IAAI,EACJ,WAAW,EACX,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EACxC,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAC9C,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;gFACgF;AAChF,SAAS,UAAU,CACjB,IAAc,EACd,QAAwB,EACxB,gBAAqF,EACrF,OAA4B;IAE5B,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ;YAC3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvD,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,uEAAuE;YACvE,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,gBAAgB,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAClB,IAAc,EACd,QAAwB,EACxB,gBAAwF;IAExF,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE,CAC1B,gBAAgB,CACd,MAAM,SAAS,CACb,IAAI,EACJ,QAAQ,CAAC,QAAQ,EACjB;QACE,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;KACvC,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,EACD,UAAU,CAAC,YAAY,CACxB,CAAC;AACN,CAAC;AAED,6EAA6E;AAE7E,MAAM,OAAO,GAAG;IACd,QAAQ,EAAE,8BAA8B;IACxC,YAAY,EAAE,yCAAyC;IACvD,QAAQ,EAAE,qCAAqC;IAC/C,WAAW,EAAE,qCAAqC;IAClD,wEAAwE;IACxE,yBAAyB;IACzB,MAAM,EAAE,+EAA+E;CAC/E,CAAC;AAEX,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,KAAa;IAClE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,yEAAyE;QACzE,kCAAkC;QAClC,yBAAyB,EAAE,MAAM;QACjC,UAAU,EAAE,WAAW;QACvB,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;IACH,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAE,EAAE,CACtD,SAAS,CACP,IAAI,EACJ,OAAO,CAAC,QAAQ,EAChB,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,MAAM,EAAE,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;IACJ,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ;YAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC3D,QAAQ,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;gBACtC,YAAY;gBACZ,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK;gBACL,MAAM;aACP,CAAC,CAAC;YACH,OAAO,iBAAiB,CACtB,MAAM,YAAY,CAAC;gBACjB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,aAAa,EAAE,QAAQ;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,UAAU;YACtB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;gBAC9B,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;aACvC,CAAC,CAAC;YACH,OAAO,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B,EAC7B,eAAwB,EACxB,iBAA0B;IAE1B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACvD,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,OAAO,GACX,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GACpB,yBAAyB,CAAC,OAAO,CAAC;QAClC,yBAAyB,CAAC,UAAU,CAAC,WAAW,CAAC;QACjD,iBAAiB,CAAC;IACpB,OAAO;QACL,GAAG,UAAU;QACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,6EAA6E;AAE7E,MAAM,WAAW,GAAmB;IAClC,QAAQ,EAAE,sCAAsC;IAChD,SAAS,EAAE,qDAAqD;IAChE,QAAQ,EAAE,sCAAsC;IAChD,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,SAAS,cAAc,CAAC,IAA6B,EAAE,eAAwB;IAC7E,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAEvF,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO;QACL,QAAQ,EAAE,sCAAsC;QAChD,SAAS,EAAE,sCAAsC;QACjD,QAAQ,EAAE,gCAAgC;QAC1C,KAAK,EAAE,gEAAgE;QACvE,wDAAwD;QACxD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;0EAE0E;AAC1E,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC,SAAS,cAAc,CAAC,IAA6B,EAAE,eAAwB;IAC7E,MAAM,UAAU,GAAG,YAAY,CAC7B,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,yBAAyB,EAAE,EAC1E,eAAe,CAChB,CAAC;IACF,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAE5F,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,mBAAmB;AAEnB,MAAM,aAAa,GAAmB;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,QAAQ,EAAE,sBAAsB;IAChC,SAAS,EAAE,sCAAsC;IACjD,QAAQ,EAAE,6CAA6C;IACvD,8EAA8E;IAC9E,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;AAC7E,MAAM,eAAe,GAAG,6BAA6B,CAAC;AACtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAsB;IACpE,OAAO;QACL,wBAAwB,EAAE,aAAa;QACvC,gBAAgB,EAAE,OAAO;QACzB,uBAAuB,EAAE,OAAO;QAChC,sBAAsB,EAAE,YAAY;QACpC,eAAe,EAAE,oBAAoB;QACrC,wBAAwB,EAAE,MAAM;QAChC,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAc,EAAE,WAAmB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,iBAAiB,EAAE;QAC7D,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;SACxC;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,CACb,eAAe,EACf,6CAA6C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAChF,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,8EAA8E;IAC9E,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,SAAS,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,WAAW;QACX,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,eAAe;QAChD,OAAO,EACL,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YAChC,oBAAoB,CAAC,WAAW,CAAC;YACjC,wBAAwB;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAc,EACd,IAA6B;IAE7B,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,MAAM,SAAS,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,UAAsB;IAClE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED;gDACgD;AAChD,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,WAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,eAAe,EAAE;YAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,cAAc,CAAC,SAAkB;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;mCAGmC;AACnC,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAEzF,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,sEAAsE;AAEtE,MAAM,WAAW,GAAmB;IAClC,kEAAkE;IAClE,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,kDAAkD;IAC7D,QAAQ,EAAE,0CAA0C;IACpD,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,aAAqB;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,YAAY,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,aAAa,EAAE;YACxC,eAAe,EAAE,OAAO;SACzB;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,CACb,eAAe,EACf,iCAAiC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EACpG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,MAAM,SAAS,CACb,gBAAgB,EAChB,SAAS;YACP,CAAC,CAAC,wDAAwD,SAAS,uBAAuB;YAC1F,CAAC,CAAC,kFAAkF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,YAAY,EAAE,aAAa;QAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,eAAe;KAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAc,EACd,IAA6B;IAE7B,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa;QAAE,MAAM,SAAS,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1D,uEAAuE;IACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,UAAsB;IAC/D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,kEAAkE;AAElE,MAAM,UAAU,GAAG;IACjB,YAAY,EAAE,4BAA4B;IAC1C,OAAO,EAAE,wCAAwC;IACjD,WAAW,EAAE,iCAAiC;CACtC,CAAC;AAEX,+EAA+E;AAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAEtC,SAAS,cAAc,CAAC,IAAc;IACpC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ;YAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACrD,MAAM,YAAY,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,IAAI,eAAe,CAAC;gBACrE,YAAY,EAAE,UAAU,CAAC,WAAW;gBACpC,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;YAChC,0DAA0D;YAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;gBACtC,YAAY;gBACZ,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM;aACP,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;aACvF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,SAAS,CACb,eAAe,EACf,uCAAuC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAC/F,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CACnD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QACD,sEAAsE;QACtE,oCAAoC;QACpC,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./oauth.ts";
+export * from "./device.ts";
+export * from "./flows.ts";
+export * from "./token-source.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+// `@providerkit/core/auth`: sign in to a subscription and keep the token fresh.
+// Fetch only. The app supplies what a browser or a window must do (open a page,
+// catch a redirect) and where tokens are stored; this package does the protocol.
+export * from "./oauth.js";
+export * from "./device.js";
+export * from "./flows.js";
+export * from "./token-source.js";
+//# sourceMappingURL=index.js.map