@theokit/sdk 0.0.0-compat-580-20260905204608

package/dist/auth/index.cjs

@@ -0,0 +1,306 @@
+'use strict';
+
+var chunkFRITRLZQ_cjs = require('../chunk-FRITRLZQ.cjs');
+var chunk4NLCWGH7_cjs = require('../chunk-4NLCWGH7.cjs');
+var chunkEXTRW7GW_cjs = require('../chunk-EXTRW7GW.cjs');
+var chunkHUFSABUZ_cjs = require('../chunk-HUFSABUZ.cjs');
+require('../chunk-J7J7J2GN.cjs');
+require('../chunk-6LHQPOMI.cjs');
+
+// src/internal/auth/oauth-device.ts
+var POLLING_SAFETY_MARGIN_MS = 3e3;
+async function parseJsonOrFail(res, code, what) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);
+  }
+}
+async function requestDeviceCode(config, deps) {
+  let res;
+  try {
+    res = await deps.fetch(config.deviceCodeEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        scope: config.scopes.join(" ")
+      }).toString()
+    });
+  } catch (err) {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `device request failed: ${err.message}`
+    );
+  }
+  if (!res.ok) {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `device endpoint returned HTTP ${res.status}`
+    );
+  }
+  const data = await parseJsonOrFail(
+    res,
+    "oauth_device_authorization_failed",
+    "device endpoint"
+  );
+  if (typeof data.device_code !== "string" || typeof data.user_code !== "string") {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      "device response missing device_code/user_code"
+    );
+  }
+  const verification = typeof data.verification_uri === "string" ? data.verification_uri : typeof data.verification_uri_complete === "string" ? data.verification_uri_complete : "";
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: verification,
+    interval: typeof data.interval === "number" && data.interval > 0 ? data.interval : 5,
+    expiresIn: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 900
+  };
+}
+async function pollDeviceToken(config, grant, deps) {
+  const deadline = deps.now() + grant.expiresIn * 1e3;
+  let intervalMs = grant.interval * 1e3;
+  while (deps.now() < deadline) {
+    let res;
+    try {
+      res = await deps.fetch(config.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          device_code: grant.deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        }).toString()
+      });
+    } catch (err) {
+      throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device token poll failed: ${err.message}`
+      );
+    }
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok && typeof data.error !== "string") {
+      throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device token endpoint returned HTTP ${res.status}`
+      );
+    }
+    if (typeof data.access_token === "string" && data.access_token.length > 0) {
+      const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 0;
+      const accountId = extractAccountId({
+        access_token: data.access_token,
+        id_token: data.id_token
+      });
+      return {
+        access: data.access_token,
+        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access
+        // token as the refresh handle.
+        refresh: data.refresh_token ?? data.access_token,
+        expires: deps.now() + expiresIn * 1e3,
+        ...accountId !== void 0 ? { accountId } : {}
+      };
+    }
+    if (data.error === "authorization_pending") {
+      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+      continue;
+    }
+    if (data.error === "slow_down") {
+      intervalMs = (typeof data.interval === "number" && data.interval > 0 ? data.interval : grant.interval + 5) * 1e3;
+      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+      continue;
+    }
+    if (typeof data.error === "string") {
+      throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device authorization rejected: ${data.error}`
+      );
+    }
+    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+  }
+  throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+    "oauth_device_code_expired",
+    "the device code expired before it was approved"
+  );
+}
+async function deviceLogin(config, deps, hooks) {
+  const grant = await requestDeviceCode(config, deps);
+  hooks.onPrompt({
+    userCode: grant.userCode,
+    verificationUri: grant.verificationUri,
+    expiresIn: grant.expiresIn
+  });
+  return pollDeviceToken(config, grant, deps);
+}
+async function requestOpenAIUsercode(config, deps) {
+  let res;
+  try {
+    res = await deps.fetch(config.deviceUsercodeEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ client_id: config.clientId })
+    });
+  } catch (err) {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `usercode request failed: ${err.message}`
+    );
+  }
+  if (!res.ok) {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `usercode endpoint returned HTTP ${res.status}`
+    );
+  }
+  const data = await parseJsonOrFail(
+    res,
+    "oauth_device_authorization_failed",
+    "usercode endpoint"
+  );
+  if (typeof data.device_auth_id !== "string" || typeof data.user_code !== "string") {
+    throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+      "oauth_device_authorization_failed",
+      "usercode response missing device_auth_id/user_code"
+    );
+  }
+  const interval = Math.max(
+    typeof data.interval === "string" ? parseInt(data.interval, 10) || 5 : 5,
+    1
+  );
+  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };
+}
+async function openaiDeviceLogin(config, deps, hooks) {
+  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);
+  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });
+  const intervalMs = interval * 1e3;
+  const deadline = deps.now() + 15 * 60 * 1e3;
+  while (deps.now() < deadline) {
+    let res;
+    try {
+      res = await deps.fetch(config.devicePollEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode })
+      });
+    } catch (err) {
+      throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device poll failed: ${err.message}`
+      );
+    }
+    if (res.ok) {
+      const data = await parseJsonOrFail(res, "oauth_token_exchange_failed", "device poll");
+      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
+        throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+          "oauth_token_exchange_failed",
+          "device poll returned no authorization_code"
+        );
+      }
+      const tokens = await chunk4NLCWGH7_cjs.exchangeCode(
+        config,
+        { code: data.authorization_code, verifier: data.code_verifier },
+        deps
+      );
+      return {
+        ...tokens,
+        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access })
+      };
+    }
+    if (res.status !== 403 && res.status !== 404) {
+      throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device poll returned HTTP ${res.status}`
+      );
+    }
+    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+  }
+  throw new chunkHUFSABUZ_cjs.AuthCallbackError(
+    "oauth_device_code_expired",
+    "the device authorization expired before approval"
+  );
+}
+function parseJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+  } catch {
+    return void 0;
+  }
+}
+function extractAccountId(tokens) {
+  for (const token of [tokens.id_token, tokens.access_token]) {
+    if (token === void 0) continue;
+    const claims = parseJwtClaims(token);
+    const id = claims?.chatgpt_account_id ?? claims?.["https://api.openai.com/auth"]?.chatgpt_account_id ?? claims?.organizations?.[0]?.id;
+    if (id !== void 0) return id;
+  }
+  return void 0;
+}
+
+Object.defineProperty(exports, "providerFromApiKeyPrefix", {
+  enumerable: true,
+  get: function () { return chunkFRITRLZQ_cjs.providerFromApiKeyPrefix; }
+});
+Object.defineProperty(exports, "ensureFreshCredential", {
+  enumerable: true,
+  get: function () { return chunk4NLCWGH7_cjs.ensureFreshCredential; }
+});
+Object.defineProperty(exports, "exchangeCode", {
+  enumerable: true,
+  get: function () { return chunk4NLCWGH7_cjs.exchangeCode; }
+});
+Object.defineProperty(exports, "persistOAuthTokens", {
+  enumerable: true,
+  get: function () { return chunk4NLCWGH7_cjs.persistOAuthTokens; }
+});
+Object.defineProperty(exports, "refreshOAuthTokens", {
+  enumerable: true,
+  get: function () { return chunk4NLCWGH7_cjs.refreshOAuthTokens; }
+});
+Object.defineProperty(exports, "resolveCredential", {
+  enumerable: true,
+  get: function () { return chunk4NLCWGH7_cjs.resolveCredential; }
+});
+Object.defineProperty(exports, "CredentialError", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.CredentialError; }
+});
+Object.defineProperty(exports, "assertSecureModes", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.assertSecureModes; }
+});
+Object.defineProperty(exports, "authFilePath", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.authFilePath; }
+});
+Object.defineProperty(exports, "credentialHome", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.credentialHome; }
+});
+Object.defineProperty(exports, "readAuthFile", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.readAuthFile; }
+});
+Object.defineProperty(exports, "readStoredOAuth", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.readStoredOAuth; }
+});
+Object.defineProperty(exports, "writeCredential", {
+  enumerable: true,
+  get: function () { return chunkEXTRW7GW_cjs.writeCredential; }
+});
+exports.deviceLogin = deviceLogin;
+exports.extractAccountId = extractAccountId;
+exports.openaiDeviceLogin = openaiDeviceLogin;
+exports.parseJwtClaims = parseJwtClaims;
+exports.pollDeviceToken = pollDeviceToken;
+exports.requestDeviceCode = requestDeviceCode;
+exports.requestOpenAIUsercode = requestOpenAIUsercode;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":["AuthCallbackError","exchangeCode"],"mappings":";;;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAIA,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAMC,8BAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAID,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/auth/index.d.cts

@@ -0,0 +1,34 @@
+/**
+ * `@theokit/sdk/auth` — the M42 auth subsystem: a hardened credential store (`api|oauth` discriminated
+ * union, atomic O_EXCL + rename + fsync write at 0600, 0700/0600 mode gates) plus an OAuth engine (RFC 8628
+ * device grant, OpenAI two-step headless flow, token exchange + transparent refresh with in-flight-refresh
+ * coalescing). Generalized to `provider: string` + a caller-supplied `CredentialStoreConfig` — no hardcoded
+ * client IDs. `resolveCredential(name)` returns a fresh (auto-refreshed) `ResolvedCredential`; an oauth
+ * provider composes it into its `ProviderProfile.transform.fetch` so the router obtains the fresh bearer at
+ * stream time.
+ *
+ * Exposed as a dedicated sub-entry (DTS built via tsc) — the same isolation the SDK uses for `messages` /
+ * `subscription` / `sanitize`, because rollup-plugin-dts cannot bundle these modules into the main barrel.
+ *
+ * @packageDocumentation
+ */
+/**
+ * "Which provider issued this key?" — the question a login flow asks before any profile exists.
+ *
+ * Made REACHABLE rather than written: the SDK already answered it, from a module no entry point
+ * exported, and a measured consumer wrote its own copy because it could not import ours. The lookup
+ * now derives its longest-first ordering instead of depending on the order the table happens to be
+ * typed in.
+ *
+ * NOTE — do not name the internal-visibility tag in this docblock. `tsconfig.base.json` sets
+ * `stripInternal: true`, and TypeScript matches the tag anywhere in an attached JSDoc, prose
+ * included. Mentioning it here deleted this very line from `dist/auth/index.d.ts`: the symbol
+ * shipped at runtime and could not be imported with types — the exact defect this export exists to
+ * fix, reintroduced by the comment explaining the fix (usetheodev/theokit-sdk#283).
+ */
+export { providerFromApiKeyPrefix } from "../internal/auth/api-key-prefix.js";
+export { assertSecureModes, authFilePath, CredentialError, credentialHome, readAuthFile, readStoredOAuth, writeCredential, } from "../internal/auth/credential-store.js";
+export { deviceLogin, extractAccountId, openaiDeviceLogin, parseJwtClaims, pollDeviceToken, requestDeviceCode, requestOpenAIUsercode, } from "../internal/auth/oauth-device.js";
+export { ensureFreshCredential, exchangeCode, persistOAuthTokens, refreshOAuthTokens, } from "../internal/auth/oauth-engine.js";
+export { type ResolveCredentialOptions, resolveCredential, } from "../internal/auth/resolve-credential.js";
+export type { CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, HttpDeps, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolvedCredential, StoredApiCredential, StoredCredential, StoredOAuthCredential, } from "../internal/auth/types.js";

package/dist/auth/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `@theokit/sdk/auth` — the M42 auth subsystem: a hardened credential store (`api|oauth` discriminated
+ * union, atomic O_EXCL + rename + fsync write at 0600, 0700/0600 mode gates) plus an OAuth engine (RFC 8628
+ * device grant, OpenAI two-step headless flow, token exchange + transparent refresh with in-flight-refresh
+ * coalescing). Generalized to `provider: string` + a caller-supplied `CredentialStoreConfig` — no hardcoded
+ * client IDs. `resolveCredential(name)` returns a fresh (auto-refreshed) `ResolvedCredential`; an oauth
+ * provider composes it into its `ProviderProfile.transform.fetch` so the router obtains the fresh bearer at
+ * stream time.
+ *
+ * Exposed as a dedicated sub-entry (DTS built via tsc) — the same isolation the SDK uses for `messages` /
+ * `subscription` / `sanitize`, because rollup-plugin-dts cannot bundle these modules into the main barrel.
+ *
+ * @packageDocumentation
+ */
+/**
+ * "Which provider issued this key?" — the question a login flow asks before any profile exists.
+ *
+ * Made REACHABLE rather than written: the SDK already answered it, from a module no entry point
+ * exported, and a measured consumer wrote its own copy because it could not import ours. The lookup
+ * now derives its longest-first ordering instead of depending on the order the table happens to be
+ * typed in.
+ *
+ * NOTE — do not name the internal-visibility tag in this docblock. `tsconfig.base.json` sets
+ * `stripInternal: true`, and TypeScript matches the tag anywhere in an attached JSDoc, prose
+ * included. Mentioning it here deleted this very line from `dist/auth/index.d.ts`: the symbol
+ * shipped at runtime and could not be imported with types — the exact defect this export exists to
+ * fix, reintroduced by the comment explaining the fix (usetheodev/theokit-sdk#283).
+ */
+export { providerFromApiKeyPrefix } from "../internal/auth/api-key-prefix.js";
+export { assertSecureModes, authFilePath, CredentialError, credentialHome, readAuthFile, readStoredOAuth, writeCredential, } from "../internal/auth/credential-store.js";
+export { deviceLogin, extractAccountId, openaiDeviceLogin, parseJwtClaims, pollDeviceToken, requestDeviceCode, requestOpenAIUsercode, } from "../internal/auth/oauth-device.js";
+export { ensureFreshCredential, exchangeCode, persistOAuthTokens, refreshOAuthTokens, } from "../internal/auth/oauth-engine.js";
+export { type ResolveCredentialOptions, resolveCredential, } from "../internal/auth/resolve-credential.js";
+export type { CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, HttpDeps, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolvedCredential, StoredApiCredential, StoredCredential, StoredOAuthCredential, } from "../internal/auth/types.js";

package/dist/auth/index.js

@@ -0,0 +1,247 @@
+export { providerFromApiKeyPrefix } from '../chunk-NAF4L3T6.js';
+import { exchangeCode } from '../chunk-JMDDYA22.js';
+export { ensureFreshCredential, exchangeCode, persistOAuthTokens, refreshOAuthTokens, resolveCredential } from '../chunk-JMDDYA22.js';
+export { CredentialError, assertSecureModes, authFilePath, credentialHome, readAuthFile, readStoredOAuth, writeCredential } from '../chunk-V22DZIXO.js';
+import { AuthCallbackError } from '../chunk-NJWYQWDL.js';
+import '../chunk-ALUN2B4W.js';
+import '../chunk-CZJ6Q7CW.js';
+
+// src/internal/auth/oauth-device.ts
+var POLLING_SAFETY_MARGIN_MS = 3e3;
+async function parseJsonOrFail(res, code, what) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);
+  }
+}
+async function requestDeviceCode(config, deps) {
+  let res;
+  try {
+    res = await deps.fetch(config.deviceCodeEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        scope: config.scopes.join(" ")
+      }).toString()
+    });
+  } catch (err) {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `device request failed: ${err.message}`
+    );
+  }
+  if (!res.ok) {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `device endpoint returned HTTP ${res.status}`
+    );
+  }
+  const data = await parseJsonOrFail(
+    res,
+    "oauth_device_authorization_failed",
+    "device endpoint"
+  );
+  if (typeof data.device_code !== "string" || typeof data.user_code !== "string") {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      "device response missing device_code/user_code"
+    );
+  }
+  const verification = typeof data.verification_uri === "string" ? data.verification_uri : typeof data.verification_uri_complete === "string" ? data.verification_uri_complete : "";
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: verification,
+    interval: typeof data.interval === "number" && data.interval > 0 ? data.interval : 5,
+    expiresIn: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 900
+  };
+}
+async function pollDeviceToken(config, grant, deps) {
+  const deadline = deps.now() + grant.expiresIn * 1e3;
+  let intervalMs = grant.interval * 1e3;
+  while (deps.now() < deadline) {
+    let res;
+    try {
+      res = await deps.fetch(config.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          device_code: grant.deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        }).toString()
+      });
+    } catch (err) {
+      throw new AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device token poll failed: ${err.message}`
+      );
+    }
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok && typeof data.error !== "string") {
+      throw new AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device token endpoint returned HTTP ${res.status}`
+      );
+    }
+    if (typeof data.access_token === "string" && data.access_token.length > 0) {
+      const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 0;
+      const accountId = extractAccountId({
+        access_token: data.access_token,
+        id_token: data.id_token
+      });
+      return {
+        access: data.access_token,
+        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access
+        // token as the refresh handle.
+        refresh: data.refresh_token ?? data.access_token,
+        expires: deps.now() + expiresIn * 1e3,
+        ...accountId !== void 0 ? { accountId } : {}
+      };
+    }
+    if (data.error === "authorization_pending") {
+      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+      continue;
+    }
+    if (data.error === "slow_down") {
+      intervalMs = (typeof data.interval === "number" && data.interval > 0 ? data.interval : grant.interval + 5) * 1e3;
+      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+      continue;
+    }
+    if (typeof data.error === "string") {
+      throw new AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device authorization rejected: ${data.error}`
+      );
+    }
+    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+  }
+  throw new AuthCallbackError(
+    "oauth_device_code_expired",
+    "the device code expired before it was approved"
+  );
+}
+async function deviceLogin(config, deps, hooks) {
+  const grant = await requestDeviceCode(config, deps);
+  hooks.onPrompt({
+    userCode: grant.userCode,
+    verificationUri: grant.verificationUri,
+    expiresIn: grant.expiresIn
+  });
+  return pollDeviceToken(config, grant, deps);
+}
+async function requestOpenAIUsercode(config, deps) {
+  let res;
+  try {
+    res = await deps.fetch(config.deviceUsercodeEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ client_id: config.clientId })
+    });
+  } catch (err) {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `usercode request failed: ${err.message}`
+    );
+  }
+  if (!res.ok) {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      `usercode endpoint returned HTTP ${res.status}`
+    );
+  }
+  const data = await parseJsonOrFail(
+    res,
+    "oauth_device_authorization_failed",
+    "usercode endpoint"
+  );
+  if (typeof data.device_auth_id !== "string" || typeof data.user_code !== "string") {
+    throw new AuthCallbackError(
+      "oauth_device_authorization_failed",
+      "usercode response missing device_auth_id/user_code"
+    );
+  }
+  const interval = Math.max(
+    typeof data.interval === "string" ? parseInt(data.interval, 10) || 5 : 5,
+    1
+  );
+  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };
+}
+async function openaiDeviceLogin(config, deps, hooks) {
+  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);
+  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });
+  const intervalMs = interval * 1e3;
+  const deadline = deps.now() + 15 * 60 * 1e3;
+  while (deps.now() < deadline) {
+    let res;
+    try {
+      res = await deps.fetch(config.devicePollEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode })
+      });
+    } catch (err) {
+      throw new AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device poll failed: ${err.message}`
+      );
+    }
+    if (res.ok) {
+      const data = await parseJsonOrFail(res, "oauth_token_exchange_failed", "device poll");
+      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
+        throw new AuthCallbackError(
+          "oauth_token_exchange_failed",
+          "device poll returned no authorization_code"
+        );
+      }
+      const tokens = await exchangeCode(
+        config,
+        { code: data.authorization_code, verifier: data.code_verifier },
+        deps
+      );
+      return {
+        ...tokens,
+        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access })
+      };
+    }
+    if (res.status !== 403 && res.status !== 404) {
+      throw new AuthCallbackError(
+        "oauth_token_exchange_failed",
+        `device poll returned HTTP ${res.status}`
+      );
+    }
+    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
+  }
+  throw new AuthCallbackError(
+    "oauth_device_code_expired",
+    "the device authorization expired before approval"
+  );
+}
+function parseJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+  } catch {
+    return void 0;
+  }
+}
+function extractAccountId(tokens) {
+  for (const token of [tokens.id_token, tokens.access_token]) {
+    if (token === void 0) continue;
+    const claims = parseJwtClaims(token);
+    const id = claims?.chatgpt_account_id ?? claims?.["https://api.openai.com/auth"]?.chatgpt_account_id ?? claims?.organizations?.[0]?.id;
+    if (id !== void 0) return id;
+  }
+  return void 0;
+}
+
+export { deviceLogin, extractAccountId, openaiDeviceLogin, parseJwtClaims, pollDeviceToken, requestDeviceCode, requestOpenAIUsercode };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map