@pyai/sdk 0.4.0 → 0.5.0

package/dist/cli-web-auth.js

@@ -0,0 +1,154 @@
+/** Browser approval with outbound-only polling, suitable for local and SSH terminals. */
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { CliError } from "./cli-http.js";
+import { normalizeBaseURL, validateApiKey } from "./cli-config.js";
+/** No shell interpolation, URL handlers, or incoming callback listener. */
+export async function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    return new Promise(resolve => {
+        try {
+            const child = spawn(command, args, { detached: true, stdio: "ignore", shell: false });
+            child.once("error", () => resolve(false));
+            child.once("spawn", () => { child.unref(); resolve(true); });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+function invalidResponse() {
+    throw new CliError("invalid_response", "The API returned an invalid browser authorization response", 1);
+}
+function verificationURLs(data, baseURL) {
+    const code = data.user_code;
+    if (typeof code !== "string" || !/^[A-Za-z0-9-]{6,24}$/.test(code))
+        invalidResponse();
+    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0 || data.expires_in > 3600)
+        invalidResponse();
+    let plain;
+    let complete;
+    try {
+        plain = new URL(String(data.verification_uri));
+        complete = new URL(String(data.verification_uri_complete));
+    }
+    catch {
+        invalidResponse();
+    }
+    // Never hand a custom protocol or a credential-bearing URL to the OS browser launcher.
+    try {
+        normalizeBaseURL(plain.origin);
+        normalizeBaseURL(complete.origin);
+    }
+    catch {
+        invalidResponse();
+    }
+    if (plain.username || plain.password || plain.search || plain.hash || plain.pathname !== "/cli/login"
+        || complete.username || complete.password || complete.hash || complete.origin !== plain.origin
+        || complete.pathname !== "/cli/login" || complete.searchParams.get("user_code") !== code
+        || [...complete.searchParams.keys()].some(key => key !== "user_code")
+        || complete.searchParams.getAll("user_code").length !== 1)
+        invalidResponse();
+    if (new URL(baseURL).origin === "https://api.pyai.com" && plain.origin !== "https://console.pyai.com")
+        invalidResponse();
+    return { event: "authorization_required", verification_uri: plain.href,
+        verification_uri_complete: complete.href, user_code: code, expires_in: data.expires_in };
+}
+function redact(error, secrets) {
+    if (!(error instanceof CliError))
+        return error;
+    const safe = (value) => {
+        if (typeof value === "string")
+            return secrets.reduce((v, s) => s ? v.split(s).join("[REDACTED]").split(encodeURIComponent(s)).join("[REDACTED]") : v, value);
+        if (Array.isArray(value))
+            return value.map(safe);
+        if (value && typeof value === "object")
+            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, safe(v)]));
+        return value;
+    };
+    return new CliError(safe(error.code), safe(error.message), error.exitCode, safe(error.details));
+}
+export async function browserLogin(options) {
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    const duration = options.timeoutMs ?? 600_000;
+    if (!Number.isFinite(duration) || duration <= 0 || duration > 3_600_000)
+        throw new CliError("invalid_arguments", "Login timeout must be between 0 and 3600 seconds", 2);
+    const started = now();
+    const verifier = randomBytes(32).toString("base64url");
+    const secrets = [verifier];
+    options.onSecret?.(verifier);
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    try {
+        let grant;
+        try {
+            grant = await options.http.json("POST", "/auth/cli/device", { auth: false,
+                timeoutMs: Math.min(duration, options.requestTimeoutMs ?? 30_000),
+                json: { client_name: "PyAI CLI", code_challenge: challenge, code_challenge_method: "S256" } });
+        }
+        catch (error) {
+            if (error instanceof CliError && error.details?.status === 404) {
+                throw new CliError("browser_login_unavailable", "Browser login is not available on this deployment yet. Use auth login --key-stdin or deploy the CLI login API and console page.", 1);
+            }
+            throw error;
+        }
+        if (!grant || typeof grant !== "object" || typeof grant.device_code !== "string"
+            || grant.device_code.length < 32 || grant.device_code.length > 512 || /[\s\x00-\x1f\x7f]/.test(grant.device_code))
+            invalidResponse();
+        secrets.push(grant.device_code);
+        options.onSecret?.(grant.device_code);
+        const notice = verificationURLs(grant, options.baseURL);
+        if (typeof grant.interval !== "number" || !Number.isFinite(grant.interval) || grant.interval < 1 || grant.interval > 60)
+            invalidResponse();
+        let interval = grant.interval * 1000;
+        const deadline = Math.min(started + duration, now() + notice.expires_in * 1000);
+        options.onAuthorization(notice);
+        if (!options.noBrowser && !(await (options.open ?? openBrowser)(notice.verification_uri_complete)))
+            options.onBrowserUnavailable?.();
+        for (;;) {
+            const remaining = deadline - now();
+            if (remaining <= interval) {
+                if (remaining > 0)
+                    await sleep(remaining);
+                throw new CliError("login_timeout", "Browser login expired before completion. Run pyai auth login again.", 4);
+            }
+            await sleep(interval);
+            try {
+                const result = await options.http.json("POST", "/auth/cli/device/token", { auth: false,
+                    timeoutMs: Math.min(deadline - now(), options.requestTimeoutMs ?? 30_000),
+                    json: { device_code: grant.device_code, code_verifier: verifier } });
+                if (!result || typeof result.api_key !== "string")
+                    invalidResponse();
+                secrets.push(result.api_key);
+                options.onSecret?.(result.api_key);
+                validateApiKey(result.api_key);
+                if (!["key_id", "org_id", "project_id"].every(key => typeof result[key] === "string" && result[key].length > 0)
+                    || !["test", "live"].includes(result.environment) || !Array.isArray(result.scopes) || !result.scopes.every((s) => typeof s === "string")
+                    || typeof result.expires_at !== "number" || !Number.isFinite(result.expires_at) || result.expires_at <= now())
+                    invalidResponse();
+                return result;
+            }
+            catch (error) {
+                if (!(error instanceof CliError))
+                    throw error;
+                // Only protocol-level pending responses are safe to poll again. A lost
+                // success is ambiguous: do not replay a potentially consumed grant.
+                if (error.details?.status === 400 && error.code === "authorization_pending")
+                    continue;
+                if (error.details?.status === 400 && error.code === "slow_down") {
+                    interval += 5000;
+                    continue;
+                }
+                if (error.code === "access_denied")
+                    throw new CliError("access_denied", "Browser login was declined. No credentials were saved.", 3);
+                if (["expired_token", "invalid_grant"].includes(error.code))
+                    throw new CliError(error.code, "This login request has expired or was already used. Run pyai auth login again.", 3);
+                throw error;
+            }
+        }
+    }
+    catch (error) {
+        throw redact(error, secrets);
+    }
+}

package/dist/cli.d.ts

@@ -1,18 +1,2 @@
 #!/usr/bin/env node
-/**
- * pyai, CLI for the PyAI API: proves your key, the endpoint, and audio in one
- * command (`smoke`) or runs a deeper diagnosis with remediation hints (`doctor`).
- *
- * Commands:
- *   pyai doctor                         diagnose key/scopes + endpoint + Speak→Hear round-trip
- *   pyai smoke [--tolerate-upstream]    run models+voices+speak and report PASS/FAIL
- *                                       (--tolerate-upstream: transient 5xx/429 → WARN, not FAIL)
- *   pyai models                         list models
- *   pyai voices [--gender g --region r] list voices
- *   pyai speak --text T [--voice V] [--out f.wav]
- *   pyai transcribe --url U [--diarize] [--poll]
- *
- * Auth: PYAI_API_KEY env (or --api-key). Base URL: PYAI_BASE_URL (or --base-url).
- * Zero deps, uses the bundled SDK.
- */
-export {};
+import "./cli-runtime.ts";