@remixmate/cli 0.9.72 → 0.9.73

package/skills/web-screenshot/scripts/_media_upload.py

@@ -1,19 +1,19 @@
 #!/usr/bin/env python3
-"""录屏产物收尾客户端 —— 把本地视频推给 ab-render 的 /finalize 端点。
 
-ab-render 侧（apps/ab-render/server/finalize.ts）负责：webm→mp4 转码 + 抽首帧封面
-+ 上传阿里云 VOD + 轮询拿到 CDN 播放地址。本模块只做 HTTP 层：POST 原始字节 +
-轮询 /finalizeStatus。纯标准库，不依赖 ffmpeg / OSS / 阿里云 SDK。
 
-与 render-video 的 remote_renderer_client 一样直连 ab-render：
-  Base URL 优先级：显式传入 > 环境变量 REMOTION_RENDER_API_URL > 默认生产地址。
 
-认证头（复用 X-Priv-Token 规范）：
-  X-Priv-Token: <PRIV_TOKEN>
-  x-invoke-skill:  web-record
-  x-invoke-agent:  <AGENT_NAME>   # optional
-  x-conversation-id: <CONVERSATION_ID>  # optional
-"""
+
+
+
+
+
+
+
+
+
+
+
+
 from __future__ import annotations
 
 import json
@@ -34,7 +34,7 @@ TERMINAL_FAILURE = {"failed", "cancelled"}
 
 
 class FinalizeError(RuntimeError):
-    """上传/收尾失败，交由调用方决定是否降级为「仅本地文件」。"""
+    pass
 
 
 def _base_url(explicit: Optional[str]) -> str:
@@ -75,7 +75,7 @@ def _submit(
     conversation_id: Optional[str],
     request_timeout: float,
 ) -> str:
-    """POST /finalize（原始字节 + query options）→ 返回 taskId。"""
+
     ext = Path(local_path).suffix.lstrip(".").lower() or "webm"
     query = {
         "transcode": "1" if transcode else "0",
@@ -83,12 +83,12 @@ def _submit(
         "coverAtSec": str(cover_at_sec),
         "resolveCdn": "1" if resolve_cdn else "0",
         "ext": ext,
-        # 素材角色：ab-api 按它落 file.role（录屏贡献 video_clip 能力、按成品保留）
+
         "role": "screen_record",
     }
     if title:
         query["title"] = title
-    # 端锚裁剪窗口：让 ab-render 在转码同一 pass 里切掉开头加载段（skill 侧不再裁）。
+
     if keep_tail_sec and keep_tail_sec > 0:
         query["keepTailSec"] = f"{keep_tail_sec:.3f}"
     url = f"{base_url}/finalize?{urllib.parse.urlencode(query)}"
@@ -133,7 +133,7 @@ def _poll(
     request_timeout: float,
     on_progress: Optional[Callable[[dict], None]],
 ) -> dict:
-    """POST /finalizeStatus 轮询直到 succeeded/failed/超时。成功返回 data dict。"""
+
     start = time.monotonic()
     consecutive_errors = 0
     while True:
@@ -192,17 +192,17 @@ def finalize_recording(
     poll_interval: float = 3.0,
     request_timeout: float = 300.0,
 ) -> dict:
-    """把本地视频推给 ab-render 收尾并轮询到终态。
 
-    keep_tail_sec：端锚裁剪窗口（保留视频尾部这么多秒，切掉开头加载段）；由 skill 测量的
-    内容窗口得出，None 表示不裁。裁剪与转码在 ab-render 合并成一次 pass。
 
-    返回 finalizeStatus 的 data dict，关键字段：
-      fileUrl（CDN 或 vod://）、vodRef、fileId、coverUrl、durationSec。
-    失败抛 FinalizeError，由调用方决定降级。
-    """
+
+
+
+
+
+
+
     base = _base_url(base_url)
-    # 诊断：明确打出实际请求的 ab-render 地址 + 裁剪窗口，便于排查「发去哪/有没有裁」。
+
     print(
         f"[record] finalize target: {base}  keepTailSec={keep_tail_sec}",
         file=sys.stderr,
@@ -234,15 +234,15 @@ def finalize_recording(
 
 DEFAULT_ABAPI_BASE_URL = "https://api-agent.remixmate.ai/api"
 
-# 分镜里承载「画面在讲什么」的文本字段（caption / title-card / type 等场景）
+
 _STORY_TEXT_KEYS = ("title", "subtitle", "text", "caption", "label", "content")
 
 
 def storyboard_text(story: Optional[dict]) -> str:
-    """把分镜里的可读文本收成一段：标题卡、字幕条、打字内容等，按场景顺序拼接。
 
-    录屏本身没有旁白，这段文本就是它最便宜的语义——生产者手上现成有，不需要 ASR。
-    """
+
+
+
     if not isinstance(story, dict):
         return ""
     parts: list[str] = []
@@ -268,11 +268,11 @@ def annotate_asset(
     duration_sec: Optional[float],
     request_timeout: float = 30.0,
 ) -> None:
-    """把录屏的语义写进 ab-api 素材库（POST /asset/annotate）：分镜文本 + 来源页面。
 
-    分镜里没有逐场景时间戳，整条录屏作为一个片段。失败抛 FinalizeError，调用方只记日志——
-    语义是附加信息，不能让「录屏已完成」失败。见 ab-platform/docs/product/creation/asset-semantic-library-design.md §6.1。
-    """
+
+
+
+
     if not private_token or not (file_id or file_url):
         return
     base = (os.environ.get("MM_API_BASE_URL") or DEFAULT_ABAPI_BASE_URL).rstrip("/")

package/skills/web-screenshot/scripts/read_page.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
-"""Playwright 正文抽取入口（薄壳，逻辑在 _media_screenshot.reader）。
 
-与 screenshot.py / record.py 同住一个 scripts/ 目录，因为三者共用
-`_media_screenshot/` 里的浏览器启动、等待、设备模拟与 cookie 处理。
-对外它是独立的 skill：`skills/web-read/skill.json` 指到这里。
-"""
+
+
+
+
+
 from __future__ import annotations
 
 import argparse
@@ -13,9 +13,9 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-from _media_screenshot import cli_args  # noqa: E402
-from _media_screenshot.reader import do_read  # noqa: E402
-from _media_screenshot.urlguard import assert_public_url  # noqa: E402
+from _media_screenshot import cli_args
+from _media_screenshot.reader import do_read
+from _media_screenshot.urlguard import assert_public_url
 
 DEFAULT_MAX_CHARS = 20000
 
@@ -61,7 +61,7 @@ def main() -> None:
 
     args = ap.parse_args()
 
-    # 内网地址守卫（见 urlguard.py：web_read 会把正文交给模型）。
+
     assert_public_url(args.url)
 
     storage_path, is_temp = cli_args.build_storage(args)
@@ -93,17 +93,17 @@ def main() -> None:
             except OSError:
                 pass
 
-    # 只在「基本没抽到东西」时报警。一篇文章页的整页文本本来就是正文的好几倍
-    # （导航、推荐、页脚），拿这个比例当告警条件会让警告天天响、从而没人再看。
+
+
     chars = result["charCount"]
     body_chars = result["bodyCharCount"]
     status = result.get("status")
-    # A targeted read of a counter/button can legitimately be one character.
-    # Empty scopes still deserve a warning; HTTP warnings remain independent.
+
+
     unexpectedly_short = chars < 100 and (not args.selector or chars == 0)
     if isinstance(status, int) and status >= 400:
-        # 错误页也有正文（"404 Not Found"），照读不误——但不说一声的话，调用方
-        # 会把一张错误页当成文章内容去写脚本。
+
+
         print(
             f"⚠️  服务器返回 HTTP {status}，下面读到的很可能是错误页而不是目标内容。",
             file=sys.stderr,

package/skills/web-screenshot/scripts/record.py

@@ -1,12 +1,12 @@
 #!/usr/bin/env python3
-"""Playwright 录屏入口（薄壳，逻辑在 _media_screenshot 包）。
-
-模式：
-  - 固定时长 / 条件停止（--duration / --stop-when-*）
-  - 自动滚动（--scroll-through）
-  - 自定义分镜（--storyboard <json>）
-  - 模板分镜（--template <name> --param k=v ...）
-"""
+
+
+
+
+
+
+
+
 from __future__ import annotations
 
 import argparse
@@ -16,14 +16,14 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-from _media_screenshot import (  # noqa: E402
+from _media_screenshot import (
     cli_args,
     do_record,
     do_storyboard,
     template,
     trim,
 )
-from _media_upload import (  # noqa: E402
+from _media_upload import (
     FinalizeError,
     annotate_asset,
     finalize_recording,
@@ -44,7 +44,7 @@ def main() -> None:
         help="本地输出 .webm 路径（默认 recording.webm）",
     )
 
-    # plain recording stop conditions
+
     ap.add_argument("--duration", type=int, help="固定录制时长（毫秒）")
     ap.add_argument("--stop-when-selector", help="选择器出现就停")
     ap.add_argument("--stop-when-hidden", help="选择器消失就停")
@@ -53,7 +53,7 @@ def main() -> None:
         help="安全上限（ms），用 stop-when-* 时防挂死",
     )
 
-    # scroll-through
+
     ap.add_argument(
         "--scroll-through", action="store_true",
         help="录制时自动从顶部平滑滚到底部",
@@ -63,7 +63,7 @@ def main() -> None:
     ap.add_argument("--scroll-pause-top", type=int, default=800)
     ap.add_argument("--scroll-pause-bottom", type=int, default=1200)
 
-    # storyboard / template
+
     ap.add_argument("--storyboard", help="分镜 JSON 文件路径")
     ap.add_argument(
         "--template",
@@ -78,7 +78,7 @@ def main() -> None:
         help="列出可用模板并退出",
     )
 
-    # 收尾（transcode + 封面 + VOD 上传，默认开；委托 ab-render /finalize）
+
     ap.add_argument(
         "--no-upload", action="store_true",
         help="录完不上传 VOD，只保留本地 webm（默认会转码+封面+上传并返回 CDN 地址）",
@@ -202,15 +202,15 @@ def main() -> None:
 
     local_path = str(out)
 
-    # 端锚裁剪窗口：保留内容窗口 + 边距（与 _media_screenshot/trim.py 的常量一致）。
-    # 上传路径把它交给 ab-render 在转码同一 pass 里裁；--no-upload 单机路径才本地裁。
+
+
     keep_tail_sec = None
     if end_ms > start_ms:
         keep_tail_sec = ((end_ms - start_ms) + 80 + 200) / 1000.0
 
-    # ── 收尾：转码 + 封面 + 上传 VOD（默认开）───────────────────────────────
-    # ffmpeg / OSS 全部在 ab-render 侧完成，本 skill 只推文件 + 轮询状态。
-    # 环境缺失（如裸跑 CLI 无 PRIV_TOKEN）或收尾失败 → 优雅降级为「仅本地文件」。
+
+
+
     upload_enabled = not args.no_upload
     priv_token = os.environ.get("PRIV_TOKEN", "")
     if upload_enabled and not priv_token:
@@ -218,14 +218,14 @@ def main() -> None:
         upload_enabled = False
 
     if not upload_enabled:
-        # 单机 / 不上传：没有 ab-render 帮忙裁，就在本地尽力裁一刀（需系统 ffmpeg，
-        # 缺失则 trim.trim_video 保留原片并提示）。
+
+
         trim.trim_video(out, start_ms, end_ms)
         print(local_path)
         return
 
     def _on_progress(data: dict) -> None:
-        # finalizeStatus 的 phase/progress → __progress__，喂 ab-agent SSE 时间线
+
         line: dict = {"__progress__": True, "phase": data.get("phase")}
         prog = data.get("progress")
         if isinstance(prog, (int, float)):
@@ -247,7 +247,7 @@ def main() -> None:
             conversation_id=conversation_id,
             on_progress=_on_progress,
         )
-    except Exception as e:  # noqa: BLE001 — 收尾失败不应丢掉已录好的本地文件
+    except Exception as e:
         print(f"[record] VOD 上传收尾失败，降级为仅本地文件：{e}", file=sys.stderr)
         print(local_path)
         return
@@ -258,7 +258,7 @@ def main() -> None:
     vod_ref = result.get("vodRef") or ""
     file_id = result.get("fileId")
 
-    # 语义入库：分镜文本 + 来源页面。失败只提示，不影响录屏结果。
+
     try:
         annotate_asset(
             private_token=priv_token,
@@ -271,7 +271,7 @@ def main() -> None:
     except FinalizeError as e:
         print(f"[record] 录屏语义写入素材库失败（不影响录屏）：{e}", file=sys.stderr)
 
-    # 上传成功，默认删本地 webm（VOD 已持有），除非 --keep-webm
+
     if not args.keep_webm:
         try:
             os.unlink(local_path)
@@ -285,7 +285,7 @@ def main() -> None:
         print(f"🖼️ 封面：{cover_url}")
     if isinstance(duration, (int, float)):
         print(f"🕐 时长：{duration:.1f}s")
-    # 结构化 asset 标记：ab-agent postcall 解析这一行下发前端播放器
+
     asset = {
         "url": cdn_url,
         "coverUrl": cover_url,

package/skills/web-screenshot/scripts/screenshot.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Playwright 截屏入口（薄壳，逻辑在 _media_screenshot 包）。"""
+
 from __future__ import annotations
 
 import argparse
@@ -8,7 +8,7 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-from _media_screenshot import cli_args, do_screenshot  # noqa: E402
+from _media_screenshot import cli_args, do_screenshot
 
 
 def main() -> None:
@@ -51,9 +51,9 @@ def main() -> None:
 
     args = ap.parse_args()
 
-    # 截屏只出图片。若 --output 是视频后缀，Playwright 的 page.screenshot() 会按扩展名
-    # 推断出 video/webm 并抛一串晦涩的 mime 错误。这里提前拦截，返回面向模型的清晰指引，
-    # 把请求导向 web_record（录屏入口）。
+
+
+
     video_exts = (".webm", ".mp4", ".mov", ".mkv", ".avi", ".gif")
     if args.output.lower().endswith(video_exts):
         ext = Path(args.output).suffix or "(video)"

package/dist/argv.d.ts

@@ -1,15 +0,0 @@
-/**
- * Argv parser shared by cli.ts and python passthrough.
- *
- * Convention (matches ab-agent's buildCliArgs):
- *   --foo-bar value     →  foo_bar: 'value'
- *   --foo-bar           →  foo_bar: true
- *   --foo-bar a --foo-bar b → foo_bar: ['a', 'b']
- *   -p value            →  short flags also supported as-is (kebab → snake)
- *
- * Booleans are detected when the next token starts with '--' or is absent.
- * Negative number values (-1.5) are NOT supported as flag values in this
- * parser — Python skills handle them via argparse downstream when needed.
- */
-export type ParsedArgs = Record<string, string | boolean | string[]>;
-export declare function parseArgv(argv: string[]): ParsedArgs;

package/dist/auth/auth-lock.d.ts

@@ -1,26 +0,0 @@
-/**
- * Cross-process file lock for the auto device-login flow.
- *
- * When several skill processes start without a token at the same time, only one
- * should drive the Device Flow (= open one browser). The rest wait for the
- * winner to write the credential, then read it. This lock coordinates that.
- *
- * The lock file lives next to the credential store, contains only non-secret
- * metadata, and self-heals: a lock left behind by a crashed process is reclaimed
- * once it is older than `staleMs` (Requirement 3.1/3.4/3.5).
- */
-export interface LockHandle {
-    release(): Promise<void>;
-}
-/**
- * Try to acquire the auth lock for `apiBaseUrl`.
- *   - Returns a handle when acquired.
- *   - Returns null when another live process holds it.
- *   - Reclaims a stale lock (older than `staleMs`) and retries once.
- */
-export declare function acquireLock(apiBaseUrl: string, staleMs: number): Promise<LockHandle | null>;
-/**
- * Poll the credential store until a usable credential for `apiBaseUrl` appears
- * or `timeoutMs` elapses. Used by processes that did NOT win the lock.
- */
-export declare function waitForCredential(apiBaseUrl: string, timeoutMs: number): Promise<boolean>;

package/dist/auth/auto-login.d.ts

@@ -1,20 +0,0 @@
-/**
- * Automatic Device Flow orchestration triggered when a skill call finds no
- * token. Only ever invoked AFTER resolvePrivToken() has confirmed all three
- * sources (flag / env / credential store) are empty, so the env-injected
- * (cloud) path never reaches this module — guaranteeing zero regression there.
- *
- * Flow (see design.md):
- *   canAutoAuth gate → acquire lock
- *     ├─ won  : runDeviceFlow(short wait) → on approval re-read the store
- *     └─ lost : wait for whoever holds the lock to write a credential
- *
- * Always bounded by `maxWaitMs` so it can never block a host tool call forever.
- */
-import { type ResolvedToken } from './resolve.js';
-/**
- * Attempt to obtain a token via automatic browser authorization. Returns the
- * resolved token on success, or null when auto auth is not applicable / did not
- * complete in time (callers then fail fast with NOT_AUTHENTICATED_HINT).
- */
-export declare function attemptAutoLogin(apiBaseUrl: string): Promise<ResolvedToken | null>;

package/dist/auth/commands.d.ts

@@ -1,8 +0,0 @@
-/**
- * `remixmate login | logout | whoami` command implementations.
- *
- * Security: the PrivToken value is never printed. Identity is shown by label only.
- * Env/CI behavior: when PRIV_TOKEN is set, `login` does not start the device flow.
- */
-/** Dispatch an auth verb. Returns a process exit code. */
-export declare function runAuthCommand(verb: string, rest: string[]): Promise<number>;

package/dist/auth/credential-store.d.ts

@@ -1,60 +0,0 @@
-/**
- * Local credential store for the remixmate CLI.
- *
- * Design (see .kiro/specs/cli-device-login/design.md):
- *   - File store at ~/.config/remixmate/credentials.json (mode 0600) is the
- *     REQUIRED, always-present implementation. Entries are keyed by API base
- *     URL so multiple accounts / backends coexist without overwriting.
- *   - The OS keychain is an OPTIONAL enhancement loaded via dynamic import().
- *     When a keychain module is available we keep the secret PrivToken there
- *     and store only non-secret metadata (+ a location marker) in the file.
- *     When it is absent or fails at runtime, the PrivToken is stored in the
- *     file instead. Either way the PrivToken value is never logged.
- *
- * No new runtime dependency is added: keychain support activates only if a
- * compatible module (`keytar`) is already importable in the host environment.
- */
-export declare const CRED_DIR: string;
-export declare const CRED_FILE: string;
-/** A resolved credential as seen by callers (token always populated). */
-export interface StoredCredential {
-    privToken: string;
-    userLabel?: string;
-    createdAt: number;
-}
-/** Result of a remove, so callers (logout) can report partial failures. */
-export interface RemoveResult {
-    removedFile: boolean;
-    removedKeychain: boolean;
-    keychainError?: string;
-    fileError?: string;
-}
-/**
- * Persist a credential for `apiBaseUrl`. Prefers the keychain for the secret;
- * falls back to the file on absence or runtime failure. Returns whether the
- * keychain was used so callers can surface "keychain unavailable, used file".
- */
-export declare function setCredential(apiBaseUrl: string, cred: StoredCredential): Promise<{
-    usedKeychain: boolean;
-    keychainError?: string;
-}>;
-/** Read a credential for `apiBaseUrl`, or null when none is stored. */
-export declare function getCredential(apiBaseUrl: string): Promise<StoredCredential | null>;
-/** Non-secret summary of one stored entry, for diagnostics (`whoami`, `doctor`). */
-export interface CredentialSummary {
-    apiBaseUrl: string;
-    userLabel?: string;
-    createdAt: number;
-    secret: 'file' | 'keychain';
-}
-/**
- * List which backends have a stored credential, WITHOUT reading any secret.
- *
- * Credentials are keyed by API base URL, so "logged in" is per-backend. Without
- * this, a credential stored for a local dev backend while the CLI defaults to
- * production produced a bare "not logged in" — technically true, actively
- * misleading, and the exact confusion that motivated this work.
- */
-export declare function listCredentials(): Promise<CredentialSummary[]>;
-/** Remove a credential from both stores; reports per-store outcome. */
-export declare function removeCredential(apiBaseUrl: string): Promise<RemoveResult>;

package/dist/auth/device-flow-runner.d.ts

@@ -1,58 +0,0 @@
-/**
- * Shared Device Flow orchestration used by BOTH `remixmate login` (interactive,
- * full device-code lifetime) and the automatic browser auth that kicks in when
- * a skill call finds no token (bounded by a short wait window).
- *
- * Centralizing the request → open browser → poll → persist sequence keeps the
- * two entry points byte-for-byte consistent (Requirement 4.1/4.2) and means the
- * credential written by auto-login is indistinguishable from `login`'s.
- *
- * Security: the PrivToken value is NEVER written to the provided sink.
- */
-import { type DeviceCodeResponse } from './device-flow.js';
-export declare function renderAuthBlock(apiBaseUrl: string, code: DeviceCodeResponse): string;
-/**
- * Emit the authorization prompt: a one-click link (device code pre-filled),
- * the manual fallback, and — for agent hosts — the machine-readable block.
- * Shared by `runDeviceFlow` and `login --start` so both entry points present
- * authorization identically.
- */
-export declare function writeAuthPrompt(write: (msg: string) => void, apiBaseUrl: string, code: DeviceCodeResponse): void;
-export interface DeviceFlowOptions {
-    /**
-     * Upper bound on how long to poll for approval. When omitted the device
-     * code's own `expiresIn` is the only bound (used by interactive `login`).
-     * When set (auto-login), a stop caused by this window is reported as
-     * `'timeout'` rather than `'expired'`.
-     */
-    maxWaitMs?: number;
-    /** Where human-facing progress text goes. Defaults to stderr. */
-    write?: (msg: string) => void;
-    /** Client label sent with the device-code request. */
-    clientLabel?: string;
-}
-export type DeviceFlowOutcome = {
-    status: 'approved';
-    userLabel?: string;
-} | {
-    status: 'timeout';
-} | {
-    status: 'denied';
-} | {
-    status: 'expired';
-} | {
-    status: 'error';
-    message: string;
-};
-/**
- * Persist an approved PrivToken. Shared by `runDeviceFlow` and `login --wait`
- * so a credential written by either is indistinguishable. The token value is
- * never written to `write`.
- */
-export declare function persistApproval(apiBaseUrl: string, privToken: string, userLabel: string | undefined, write: (msg: string) => void): Promise<void>;
-/**
- * Run one full Device Flow against `apiBaseUrl`. On approval the PrivToken is
- * persisted via setCredential (keychain or file, same as `login`) and only the
- * non-secret outcome is returned.
- */
-export declare function runDeviceFlow(apiBaseUrl: string, opts?: DeviceFlowOptions): Promise<DeviceFlowOutcome>;

package/dist/auth/device-flow.d.ts

@@ -1,52 +0,0 @@
-/**
- * OAuth 2.0 Device Authorization Grant (RFC 8628) client for `remixmate login`.
- *
- * The device/code and device/token endpoints are PUBLIC (no auth), so this uses
- * plain fetch against the ab-api base URL rather than the authenticated mmPost.
- * On approval the backend returns the user's existing PrivToken (Route B).
- */
-export interface DeviceCodeResponse {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete?: string;
-    interval: number;
-    expiresIn: number;
-}
-/** Device-token poll sub-states (mirrors backend model.DeviceTokenStatus*). */
-export type TokenStatus = 'authorization_pending' | 'slow_down' | 'approved' | 'access_denied' | 'expired_token' | 'invalid_grant';
-export interface TokenResult {
-    status: TokenStatus;
-    privToken?: string;
-    userLabel?: string;
-    /**
-     * Set when polling stopped because the caller-supplied `maxWaitMs` window
-     * elapsed BEFORE the device code's own expiry. Lets callers distinguish a
-     * short-wait timeout ("authorize then re-run") from a real expired code.
-     */
-    timedOut?: boolean;
-}
-export declare class DeviceFlowError extends Error {
-}
-/** Request a fresh device_code/user_code. 30s timeout, no retries here. */
-export declare function requestDeviceCode(apiBaseUrl: string, clientLabel: string): Promise<DeviceCodeResponse>;
-/**
- * Try to open `url` in the default browser. Returns false when no opener is
- * available (caller then prints the URL for manual entry).
- */
-export declare function openBrowser(url: string): boolean;
-/**
- * Poll device/token until a terminal outcome. Honors `interval` (+5s on
- * slow_down), retries transient network failures up to 3 consecutive times, and
- * bounds total time by the device code's `expiresIn`.
- *
- * When `opts.maxWaitMs` is supplied, polling also stops once that window
- * elapses (whichever comes first). A stop caused by `maxWaitMs` returns
- * `{ status: 'expired_token', timedOut: true }` so callers can tell a
- * short-wait timeout apart from a genuinely expired device code.
- *
- * Resolves with the final TokenResult (status 'approved' carries the token).
- */
-export declare function pollForToken(apiBaseUrl: string, code: DeviceCodeResponse, opts?: {
-    maxWaitMs?: number;
-}): Promise<TokenResult>;

package/dist/auth/ensure.d.ts

@@ -1,55 +0,0 @@
-/**
- * The single authorization entry point for every skill invocation.
- *
- * Before this module the CLI resolved PrivTokens in three unrelated places:
- * `resolveHttpContext` (4 TS handlers, with credential store + auto device
- * login), `registry_loader.py` (1 Python skill, with its own credential-file
- * reader), and plain `os.environ["PRIV_TOKEN"]` (the other 7 Python skills,
- * which therefore ignored `remixmate login` entirely). Auto browser auth only
- * ever covered the first group.
- *
- * Now `runner.ts` calls `ensureAuth()` once, before dispatch, for every skill —
- * so the credential store, the OS keychain and the device flow exist in exactly
- * one place (Node), and Python scripts only ever read an injected `PRIV_TOKEN`.
- */
-import { type CredentialSource } from './resolve.js';
-/**
- * Per-skill authorization requirement, declared as `auth` in skill.json.
- *
- *  - `required`: no token → run the device flow; still no token → abort (exit 4).
- *  - `optional`: inject a token when one is already available, otherwise carry
- *                on silently. Never opens a browser — these skills degrade to a
- *                reduced mode (e.g. web-record keeps the file locally instead of
- *                uploading), and popping an auth window for that would be rude.
- *  - `none`:     purely local, never touches ab-api (e.g. web-screenshot).
- */
-export type AuthMode = 'required' | 'optional' | 'none';
-export declare const AUTH_MODE_VALUES: readonly ["required", "optional", "none"];
-export interface AuthPreflight {
-    /** Backend the invocation is bound to; injected so Python derives the same one. */
-    apiBaseUrl: string;
-    /** Absent only for `none`, or for `optional` with no credential available. */
-    token?: string;
-    source?: CredentialSource;
-    userLabel?: string;
-}
-/**
- * Resolve (and if necessary acquire) a PrivToken for one skill invocation.
- * Throws SkillError(exit 4) when `mode === 'required'` and no token could be
- * obtained; the message is the shared NOT_AUTHENTICATED_HINT.
- */
-export declare function ensureAuth(opts: {
-    mode: AuthMode;
-    apiBaseUrl?: string;
-    flagToken?: string;
-}): Promise<AuthPreflight>;
-/**
- * Environment overrides handed to a spawned Python skill.
- *
- * `MM_API_BASE_URL` is always set so the child resolves the same backend the
- * preflight authenticated against — otherwise a `--api-base-url` flag or a
- * credential bound to a staging backend would silently disagree with the URL
- * the Python side derives. `PRIV_TOKEN` is only set when non-empty, so an
- * `optional` skill without a credential keeps inheriting whatever the host set.
- */
-export declare function authChildEnv(pre: AuthPreflight): Record<string, string>;