@skillbuilder/minitool-cli-auth 0.0.0-beta-20261027053041051

package/types/auth-state.d.ts

@@ -0,0 +1,63 @@
+export type AuthMethod = "secret" | "device";
+export type CredentialSource = "local_file" | "os_keychain";
+export interface CreatorIdentity {
+    creatorId: string;
+    displayName: string;
+    avatarUrl?: string;
+    description?: string;
+}
+export interface AuthenticatedAuthState {
+    status: "authenticated";
+    method: AuthMethod;
+    source: CredentialSource;
+    identitySnapshot: CreatorIdentity | null;
+    expiresAt: string;
+}
+export interface AnonymousAuthState {
+    status: "anonymous";
+    reason: "not_logged_in" | "expired";
+}
+export interface UnavailableAuthState {
+    status: "unavailable";
+    reason: "credential_store_error";
+}
+export type AuthState = AuthenticatedAuthState | AnonymousAuthState | UnavailableAuthState;
+export interface LoginResult {
+    secretId?: string;
+    expiresAt: string;
+    creator?: CreatorIdentity;
+}
+export interface AuthStateProvider {
+    getAuthState(): Promise<AuthState>;
+}
+export interface AccessTokenProvider {
+    getAccessToken(): Promise<string>;
+}
+export interface DeviceAuthPrompt {
+    authorizeCommonUrl: string;
+    authorizeH5Url: string;
+    userCode: string;
+    expiresAt: string;
+}
+export interface QrLoginOptions {
+    onPrompt(prompt: DeviceAuthPrompt): void | Promise<void>;
+    signal?: AbortSignal;
+}
+export interface AuthService extends AuthStateProvider, AccessTokenProvider {
+    loginWithSecret(secretId: string, secretKey: string): Promise<LoginResult>;
+    whoAmI(): Promise<CreatorIdentity>;
+    logout(): Promise<void>;
+}
+export declare class CredentialStoreUnavailableError extends Error {
+    readonly code = "CREDENTIAL_STORE_UNAVAILABLE";
+    constructor(message?: string);
+}
+export declare class AuthenticationRequiredError extends Error {
+    readonly code = "AUTHENTICATION_REQUIRED";
+    constructor(message?: string);
+}
+export declare class CreatorIdentityUnavailableError extends Error {
+    readonly code = "CREATOR_IDENTITY_UNAVAILABLE";
+    constructor(message?: string);
+}
+export declare function requireAuthenticatedAuthState(state: AuthState): AuthenticatedAuthState;

package/types/credential-store.d.ts

@@ -0,0 +1,32 @@
+import type { AuthFileConfig, GlobalConfig } from "@skillbuilder/minitool-cli-config";
+import { ConfigFiles } from "@skillbuilder/minitool-cli-config";
+export type CredentialStorageMode = GlobalConfig["credentialStore"];
+export interface CredentialStore {
+    get(): AuthFileConfig | null;
+    update(config: AuthFileConfig): void;
+    delete(): void;
+}
+export interface CredentialStorageStatus {
+    configuredMode: CredentialStorageMode;
+    provider: string;
+    protection: "restricted_plaintext_file" | "os_protected_store";
+    keyringAvailable?: boolean;
+    keyringIssue?: "package_unavailable" | "access_error";
+}
+export interface CredentialStorageSwitchResult {
+    changed: boolean;
+    migrated: boolean;
+    sourceRetained: boolean;
+}
+export interface CredentialStorageController {
+    getMode(): CredentialStorageMode;
+    use(mode: CredentialStorageMode): CredentialStorageSwitchResult;
+    inspect(probeKeyring?: boolean): CredentialStorageStatus;
+}
+export declare class FileCredentialStore implements CredentialStore {
+    private readonly files;
+    constructor(files: ConfigFiles);
+    get(): AuthFileConfig | null;
+    update(config: AuthFileConfig): void;
+    delete(): void;
+}

package/types/credential-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/types/device-auth-api.d.ts

@@ -0,0 +1,40 @@
+import type { DeviceAuthPrompt } from "./auth-state";
+export declare const DEVICE_AUTH_PATHS: Readonly<{
+    create: "/api/sns/v1/creator/red_skill/create_cli_oauth_device_code";
+    poll: "/api/sns/v1/creator/red_skill/poll_cli_oauth_device_token";
+    exchange: "/api/sns/v1/creator/red_skill/exchange_cli_oauth_token";
+    refresh: "/api/sns/v1/creator/red_skill/refresh_cli_oauth_token";
+}>;
+export declare const DEVICE_AUTH_SCOPES: readonly ["base_info", "skill_publish"];
+export interface DeviceCode extends Omit<DeviceAuthPrompt, "expiresAt"> {
+    deviceCode: string;
+    expiresInSeconds: number;
+    pollIntervalSeconds: number;
+}
+export interface PollResult {
+    status: "pending" | "approved" | "denied" | "expired" | "cancelled";
+    authorizationCode?: string;
+}
+export interface DeviceAuthApi {
+    readonly apiBaseUrl: string;
+    create(codeChallenge: string, signal?: AbortSignal): Promise<DeviceCode>;
+    poll(deviceCode: string, signal?: AbortSignal): Promise<PollResult>;
+    exchange(code: string, verifier: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    refresh(token: string): Promise<Record<string, unknown>>;
+}
+export declare class DeviceAuthError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function authRecord(value: unknown): value is Record<string, unknown>;
+export declare function authText(value: unknown): string;
+export declare class HttpDeviceAuthApi implements DeviceAuthApi {
+    private readonly request;
+    readonly apiBaseUrl: string;
+    constructor(baseUrl: string, request?: typeof fetch);
+    private call;
+    create(codeChallenge: string, signal?: AbortSignal): Promise<DeviceCode>;
+    poll(deviceCode: string, signal?: AbortSignal): Promise<PollResult>;
+    exchange(code: string, verifier: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    refresh(token: string): Promise<Record<string, unknown>>;
+}

package/types/device-auth.d.ts

@@ -0,0 +1,34 @@
+import { type ConfigFiles } from "@skillbuilder/minitool-cli-config";
+import { type AuthService, type AuthState, type CreatorIdentity, type LoginResult, type QrLoginOptions } from "./auth-state";
+import type { CredentialStorageController, CredentialStore } from "./credential-store";
+import { type DeviceAuthApi } from "./device-auth-api";
+type PendingStore = Pick<ConfigFiles, "readPendingAuth" | "writePendingAuth" | "clearPendingAuth">;
+export interface DeviceAuthClock {
+    now(): number;
+    sleep(milliseconds: number, signal?: AbortSignal): Promise<void>;
+}
+/** 扫码 PKCE 与续期生命周期；UI 回调只接收公开授权链接，不接收设备码和 verifier。 */
+export declare class DeviceAuthService implements AuthService {
+    private readonly store;
+    private readonly api;
+    private readonly storage;
+    private readonly pending;
+    private readonly secretAuth?;
+    private readonly clock;
+    private refreshPromise?;
+    constructor(store: CredentialStore, api: DeviceAuthApi, storage: Pick<CredentialStorageController, "getMode">, pending: PendingStore, secretAuth?: AuthService | undefined, clock?: DeviceAuthClock);
+    loginWithSecret(id: string, key: string): Promise<LoginResult>;
+    private read;
+    private owns;
+    private canRefresh;
+    private identity;
+    getAuthState(): Promise<AuthState>;
+    getAccessToken(): Promise<string>;
+    private tokenCredential;
+    private refresh;
+    loginWithQr(options: QrLoginOptions): Promise<LoginResult>;
+    cancelLogin(): Promise<void>;
+    whoAmI(): Promise<CreatorIdentity>;
+    logout(): Promise<void>;
+}
+export {};

package/types/device-auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/types/index.d.ts

@@ -0,0 +1,11 @@
+export { AuthenticationRequiredError, CredentialStoreUnavailableError, CreatorIdentityUnavailableError, requireAuthenticatedAuthState, } from "./auth-state";
+export type { AccessTokenProvider, AuthMethod, AuthService, AuthState, AuthStateProvider, AuthenticatedAuthState, AnonymousAuthState, CreatorIdentity, CredentialSource, LoginResult, UnavailableAuthState, } from "./auth-state";
+export { HttpSecretAuthApi, SecretAuthService } from "./secret-auth";
+export type { CheckStatusResponse, SecretAuthApi, } from "./secret-auth";
+export type { CredentialStorageController, CredentialStorageMode, CredentialStorageStatus, CredentialStorageSwitchResult, CredentialStore, } from "./credential-store";
+export { ManagedCredentialStore } from "./managed-credential-store";
+export { DeviceAuthService } from "./device-auth";
+export type { DeviceAuthClock } from "./device-auth";
+export { HttpDeviceAuthApi, DeviceAuthError, DEVICE_AUTH_PATHS } from "./device-auth-api";
+export type { DeviceAuthApi, DeviceCode, PollResult } from "./device-auth-api";
+export type { DeviceAuthPrompt, QrLoginOptions } from "./auth-state";

package/types/keyring-credential-store.d.ts

@@ -0,0 +1,30 @@
+import type { AuthFileConfig } from "@skillbuilder/minitool-cli-config";
+import type { CredentialStore } from "./credential-store";
+export interface KeyringCredentialStorePort extends CredentialStore {
+    probe(): void;
+}
+export interface KeyringEntry {
+    getPassword(): string | null;
+    setPassword(password: string): void;
+    deleteCredential(): boolean;
+}
+export type KeyringEntryFactory = (service: string, account: string) => KeyringEntry;
+export declare class KeyringUnavailableError extends Error {
+    readonly code = "KEYRING_UNAVAILABLE";
+    constructor();
+}
+export declare class KeyringAccessError extends Error {
+    readonly code = "KEYRING_ACCESS_FAILED";
+    constructor(operation: "读取" | "写入" | "删除");
+}
+export declare function getSystemCredentialStoreName(platform?: NodeJS.Platform): string;
+/** 每个配置目录使用独立系统凭据条目。 */
+export declare class KeyringCredentialStore implements KeyringCredentialStorePort {
+    private readonly entryFactory;
+    private readonly account;
+    constructor(authPath: string, entryFactory?: KeyringEntryFactory);
+    probe(): void;
+    get(): AuthFileConfig | null;
+    update(config: AuthFileConfig): void;
+    delete(): void;
+}

package/types/managed-credential-store.d.ts

@@ -0,0 +1,21 @@
+import type { AuthFileConfig } from "@skillbuilder/minitool-cli-config";
+import { ConfigFiles } from "@skillbuilder/minitool-cli-config";
+import { type CredentialStorageController, type CredentialStorageMode, type CredentialStorageStatus, type CredentialStorageSwitchResult, type CredentialStore } from "./credential-store";
+import { type KeyringCredentialStorePort } from "./keyring-credential-store";
+/** 文件与系统凭据库之间的显式存储策略。 */
+export declare class ManagedCredentialStore implements CredentialStore, CredentialStorageController {
+    private readonly files;
+    private readonly file;
+    private readonly keyring;
+    constructor(files: ConfigFiles, file?: CredentialStore, keyring?: KeyringCredentialStorePort);
+    getMode(): CredentialStorageMode;
+    inspect(probeKeyring?: boolean): CredentialStorageStatus;
+    get(): AuthFileConfig | null;
+    update(config: AuthFileConfig): void;
+    delete(): void;
+    use(mode: CredentialStorageMode): CredentialStorageSwitchResult;
+    private store;
+    private setMode;
+    private inspectKeyring;
+    private writeVerified;
+}

package/types/secret-auth.d.ts

@@ -0,0 +1,52 @@
+import { type AuthService, type AuthState, type CreatorIdentity, type LoginResult } from "./auth-state";
+import type { CredentialStorageController, CredentialStore } from "./credential-store";
+export interface CreatorUserInfo {
+    nick?: string;
+    nickname?: string;
+    user_id?: string;
+    avatar?: string;
+    desc?: string;
+    [key: string]: unknown;
+}
+/** 平台 cli_auth 的真实响应不回传 secret_id；持久化时使用已验证的请求值补齐。 */
+export interface SecretAuthResponseData {
+    secret_id?: string;
+    cli_token: string;
+    create_at: number;
+    expire_in_sec: number;
+    userInfo?: CreatorUserInfo | null;
+}
+export interface CheckStatusRequest {
+    secret_id: string;
+    nonce: string;
+    cli_token: string;
+}
+export interface CheckStatusResponse {
+    code: number;
+    msg: string;
+    data: SecretAuthResponseData | null;
+}
+export interface SecretAuthApi {
+    check(request: CheckStatusRequest): Promise<CheckStatusResponse>;
+}
+export declare class HttpSecretAuthApi implements SecretAuthApi {
+    private readonly endpointUrl;
+    private readonly request;
+    constructor(endpointUrl: string | undefined, request?: typeof fetch);
+    check(payload: CheckStatusRequest): Promise<CheckStatusResponse>;
+}
+/** Secret Key 仅用于一次签名，永不进入 CredentialStore。 */
+export declare class SecretAuthService implements AuthService {
+    private readonly store;
+    private readonly api;
+    private readonly storage;
+    private readonly now;
+    constructor(store: CredentialStore, api: SecretAuthApi, storage: Pick<CredentialStorageController, "getMode">, now?: () => number);
+    private createProof;
+    loginWithSecret(secretId: string, secretKey: string): Promise<LoginResult>;
+    private readStoredCredential;
+    getAuthState(): Promise<AuthState>;
+    getAccessToken(): Promise<string>;
+    whoAmI(): Promise<CreatorIdentity>;
+    logout(): Promise<void>;
+}

package/types/secret-auth.test.d.ts

@@ -0,0 +1 @@
+export {};