@theokit/sdk 4.24.0 → 4.25.0

package/dist/auth/index.cjs

@@ -1,309 +1,9 @@
 'use strict';
 
-var crypto = require('crypto');
-var fs = require('fs');
-var path = require('path');
-var zod = require('zod');
-
-// src/internal/auth/credential-store.ts
-
-// src/errors.ts
-var TheokitAgentError = class extends Error {
-  name = "TheokitAgentError";
-  isRetryable;
-  code;
-  protoErrorCode;
-  metadata;
-  constructor(message, options = {}) {
-    super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
-    this.isRetryable = options.isRetryable ?? false;
-    if (options.code !== void 0) this.code = options.code;
-    if (options.protoErrorCode !== void 0) this.protoErrorCode = options.protoErrorCode;
-    if (options.metadata !== void 0) this.metadata = options.metadata;
-  }
-};
-var AuthenticationError = class extends TheokitAgentError {
-  name = "AuthenticationError";
-  constructor(message, options = {}) {
-    super(message, { ...options, isRetryable: false });
-  }
-};
-
-// src/internal/auth/credential-store.ts
-function credentialHome(config, env = {}) {
-  const override = config.homeEnvVar !== void 0 ? env[config.homeEnvVar]?.trim() : void 0;
-  return override !== void 0 && override.length > 0 ? override : path.join(config.home, config.dirName);
-}
-function authFilePath(config, env = {}) {
-  return path.join(credentialHome(config, env), config.fileName);
-}
-var CredentialError = class extends AuthenticationError {
-  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`
-  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the
-  // suite was green with the broken assignment because the transpiler strips the type.
-  name = "CredentialError";
-};
-var apiFileSchema = zod.z.object({
-  type: zod.z.literal("api").optional(),
-  provider: zod.z.string().min(1).optional(),
-  api_key: zod.z.string()
-}).strict();
-var oauthFileSchema = zod.z.object({
-  type: zod.z.literal("oauth"),
-  provider: zod.z.string().min(1),
-  access: zod.z.string().min(1),
-  refresh: zod.z.string().min(1),
-  expires: zod.z.number(),
-  account_id: zod.z.string().optional()
-}).strict();
-var fileSchema = zod.z.union([oauthFileSchema, apiFileSchema]);
-function assertSecureModes(dirPath, path) {
-  const dirMode = fs.statSync(dirPath).mode & 511;
-  if ((dirMode & 18) !== 0) {
-    throw new CredentialError(
-      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`
-    );
-  }
-  const mode = fs.statSync(path).mode & 511;
-  if ((mode & 63) !== 0) {
-    throw new CredentialError(
-      `${path} is readable by other users (mode ${mode.toString(8)}). A credential file must not be. Fix it with:  chmod 600 ${path}`
-    );
-  }
-}
-function describeUnionError(parsed, err, path) {
-  const looksOAuth = typeof parsed === "object" && parsed !== null && parsed.type === "oauth";
-  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);
-  let issue;
-  if (!specific.success) {
-    issue = specific.error.issues[0];
-  } else if (err instanceof zod.z.ZodError) {
-    issue = err.issues[0];
-  }
-  return new CredentialError(
-    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(".") || "root"}]`
-  );
-}
-function parseStoredFile(raw, path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new CredentialError(
-      `${path} is not valid JSON. Expected:  {"provider": "<name>", "api_key": "..."}`
-    );
-  }
-  try {
-    return fileSchema.parse(parsed);
-  } catch (err) {
-    throw describeUnionError(parsed, err, path);
-  }
-}
-function readAuthFile(config, env = {}) {
-  const path = authFilePath(config, env);
-  let raw;
-  try {
-    raw = fs.readFileSync(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return void 0;
-    throw new CredentialError(`cannot read ${path}: ${err.message}`);
-  }
-  assertSecureModes(credentialHome(config, env), path);
-  return parseStoredFile(raw, path);
-}
-function readStoredOAuth(config, env = {}) {
-  const stored = readAuthFile(config, env);
-  return stored !== void 0 && stored.type === "oauth" ? stored : void 0;
-}
-function isOAuthWrite(c) {
-  return "type" in c && c.type === "oauth";
-}
-function buildStorePayload(cred) {
-  if (isOAuthWrite(cred)) {
-    if (cred.access.length === 0 || cred.refresh.length === 0) {
-      throw new CredentialError(
-        "refusing to write an oauth credential with an empty access/refresh token"
-      );
-    }
-    return {
-      type: "oauth",
-      provider: cred.provider,
-      access: cred.access,
-      refresh: cred.refresh,
-      expires: cred.expires,
-      ...cred.account_id !== void 0 ? { account_id: cred.account_id } : {}
-    };
-  }
-  if (typeof cred.apiKey !== "string" || cred.apiKey.length === 0) {
-    throw new CredentialError("refusing to write an empty API key");
-  }
-  return { provider: cred.provider, api_key: cred.apiKey };
-}
-function writeCredential(cred, config, env = {}) {
-  const payload = buildStorePayload(cred);
-  const dir = credentialHome(config, env);
-  fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs.chmodSync(dir, 448);
-  const path = authFilePath(config, env);
-  const tmp = `${path}.tmp-${crypto.randomBytes(8).toString("hex")}`;
-  try {
-    const fd = fs.openSync(tmp, "wx", 384);
-    try {
-      fs.writeFileSync(fd, `${JSON.stringify(payload, null, 2)}
-`);
-      fs.fsyncSync(fd);
-    } finally {
-      fs.closeSync(fd);
-    }
-    fs.chmodSync(tmp, 384);
-    fs.renameSync(tmp, path);
-  } catch (err) {
-    try {
-      fs.unlinkSync(tmp);
-    } catch {
-    }
-    throw new CredentialError(`cannot write ${path}: ${err.message}`);
-  }
-  return path;
-}
-
-// src/server/auth/errors.ts
-var AuthCallbackError = class extends Error {
-  name = "AuthCallbackError";
-  code;
-  constructor(code, message) {
-    super(message ?? `OAuth callback error: ${code}`);
-    this.code = code;
-  }
-};
-
-// src/internal/auth/oauth-engine.ts
-var REFRESH_SKEW_MS = 6e4;
-function parseTokenResponse(body, now) {
-  const b = body;
-  if (typeof b.access_token !== "string" || b.access_token.length === 0) {
-    throw new AuthCallbackError(
-      "oauth_token_exchange_failed",
-      "token response had no access_token"
-    );
-  }
-  if (typeof b.refresh_token !== "string" || b.refresh_token.length === 0) {
-    throw new AuthCallbackError(
-      "oauth_token_exchange_failed",
-      "token response had no refresh_token"
-    );
-  }
-  const expiresIn = typeof b.expires_in === "number" ? b.expires_in : 3600;
-  return {
-    access: b.access_token,
-    refresh: b.refresh_token,
-    expires: now + expiresIn * 1e3,
-    ...typeof b.account_id === "string" ? { accountId: b.account_id } : {}
-  };
-}
-async function postGrant(config, form, deps) {
-  let res;
-  try {
-    res = await deps.fetch(config.tokenEndpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-      body: new URLSearchParams(form).toString()
-    });
-  } catch (err) {
-    throw new AuthCallbackError(
-      "oauth_token_exchange_failed",
-      `token endpoint request failed: ${err.message}`
-    );
-  }
-  if (!res.ok) {
-    throw new AuthCallbackError(
-      "oauth_token_exchange_failed",
-      `token endpoint returned HTTP ${res.status}`
-    );
-  }
-  let json;
-  try {
-    json = await res.json();
-  } catch {
-    throw new AuthCallbackError("oauth_token_exchange_failed", "token response was not valid JSON");
-  }
-  return parseTokenResponse(json, deps.now());
-}
-function exchangeCode(config, input, deps) {
-  return postGrant(
-    config,
-    {
-      grant_type: "authorization_code",
-      code: input.code,
-      redirect_uri: config.redirectUri,
-      client_id: config.clientId,
-      code_verifier: input.verifier
-    },
-    deps
-  );
-}
-function refreshOAuthTokens(config, refresh, deps) {
-  return postGrant(
-    config,
-    { grant_type: "refresh_token", refresh_token: refresh, client_id: config.clientId },
-    deps
-  );
-}
-function persistOAuthTokens(provider, tokens, store, env = {}) {
-  return writeCredential(
-    {
-      type: "oauth",
-      provider,
-      access: tokens.access,
-      refresh: tokens.refresh,
-      expires: tokens.expires,
-      ...tokens.accountId !== void 0 ? { account_id: tokens.accountId } : {}
-    },
-    store,
-    env
-  );
-}
-var inFlightRefresh = /* @__PURE__ */ new Map();
-async function ensureFreshCredential(resolved, opts, deps) {
-  if (resolved.kind !== "oauth") return resolved;
-  const now = deps.now();
-  if (resolved.expiresAt !== void 0 && resolved.expiresAt > now + REFRESH_SKEW_MS) {
-    return resolved;
-  }
-  const env = opts.env ?? {};
-  const path = authFilePath(opts.store, env);
-  let refresh = inFlightRefresh.get(path);
-  if (refresh === void 0) {
-    refresh = (async () => {
-      const stored = readStoredOAuth(opts.store, env);
-      if (stored === void 0) {
-        throw new AuthCallbackError(
-          "oauth_token_exchange_failed",
-          "no stored oauth credential to refresh"
-        );
-      }
-      const fresh2 = await refreshOAuthTokens(opts.config, stored.refresh, deps);
-      const merged = {
-        ...fresh2,
-        accountId: fresh2.accountId ?? stored.account_id
-      };
-      persistOAuthTokens(resolved.provider, merged, opts.store, env);
-      return merged;
-    })();
-    inFlightRefresh.set(path, refresh);
-    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {
-    });
-  }
-  const fresh = await refresh;
-  return {
-    kind: "oauth",
-    provider: resolved.provider,
-    apiKey: fresh.access,
-    source: resolved.source,
-    inferred: false,
-    expiresAt: fresh.expires
-  };
-}
+var chunkHFPGOTVF_cjs = require('../chunk-HFPGOTVF.cjs');
+var chunkC6Y6CWYD_cjs = require('../chunk-C6Y6CWYD.cjs');
+require('../chunk-A44COQJJ.cjs');
+require('../chunk-BEURCLDV.cjs');
 
 // src/internal/auth/oauth-device.ts
 var POLLING_SAFETY_MARGIN_MS = 3e3;
@@ -319,20 +19,20 @@ async function requestDeviceCode(config, deps) {
       }).toString()
     });
   } catch (err) {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       `device request failed: ${err.message}`
     );
   }
   if (!res.ok) {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       `device endpoint returned HTTP ${res.status}`
     );
   }
   const data = await res.json();
   if (typeof data.device_code !== "string" || typeof data.user_code !== "string") {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       "device response missing device_code/user_code"
     );
@@ -365,14 +65,14 @@ async function pollDeviceToken(config, grant, deps) {
         }).toString()
       });
     } catch (err) {
-      throw new AuthCallbackError(
+      throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
         "oauth_token_exchange_failed",
         `device token poll failed: ${err.message}`
       );
     }
     const data = await res.json().catch(() => ({}));
     if (!res.ok && typeof data.error !== "string") {
-      throw new AuthCallbackError(
+      throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
         "oauth_token_exchange_failed",
         `device token endpoint returned HTTP ${res.status}`
       );
@@ -402,14 +102,14 @@ async function pollDeviceToken(config, grant, deps) {
       continue;
     }
     if (typeof data.error === "string") {
-      throw new AuthCallbackError(
+      throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
         "oauth_token_exchange_failed",
         `device authorization rejected: ${data.error}`
       );
     }
     await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
   }
-  throw new AuthCallbackError(
+  throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
     "oauth_device_code_expired",
     "the device code expired before it was approved"
   );
@@ -432,20 +132,20 @@ async function requestOpenAIUsercode(config, deps) {
       body: JSON.stringify({ client_id: config.clientId })
     });
   } catch (err) {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       `usercode request failed: ${err.message}`
     );
   }
   if (!res.ok) {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       `usercode endpoint returned HTTP ${res.status}`
     );
   }
   const data = await res.json();
   if (typeof data.device_auth_id !== "string" || typeof data.user_code !== "string") {
-    throw new AuthCallbackError(
+    throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
       "oauth_device_authorization_failed",
       "usercode response missing device_auth_id/user_code"
     );
@@ -470,7 +170,7 @@ async function openaiDeviceLogin(config, deps, hooks) {
         body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode })
       });
     } catch (err) {
-      throw new AuthCallbackError(
+      throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
         "oauth_token_exchange_failed",
         `device poll failed: ${err.message}`
       );
@@ -478,12 +178,12 @@ async function openaiDeviceLogin(config, deps, hooks) {
     if (res.ok) {
       const data = await res.json();
       if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
-        throw new AuthCallbackError(
+        throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
           "oauth_token_exchange_failed",
           "device poll returned no authorization_code"
         );
       }
-      const tokens = await exchangeCode(
+      const tokens = await chunkHFPGOTVF_cjs.exchangeCode(
         config,
         { code: data.authorization_code, verifier: data.code_verifier },
         deps
@@ -494,14 +194,14 @@ async function openaiDeviceLogin(config, deps, hooks) {
       };
     }
     if (res.status !== 403 && res.status !== 404) {
-      throw new AuthCallbackError(
+      throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
         "oauth_token_exchange_failed",
         `device poll returned HTTP ${res.status}`
       );
     }
     await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);
   }
-  throw new AuthCallbackError(
+  throw new chunkC6Y6CWYD_cjs.AuthCallbackError(
     "oauth_device_code_expired",
     "the device authorization expired before approval"
   );
@@ -525,60 +225,56 @@ function extractAccountId(tokens) {
   return void 0;
 }
 
-// src/internal/auth/resolve-credential.ts
-async function resolveOAuth(stored, path, opts, env) {
-  if (stored.provider !== opts.provider) return void 0;
-  const base = {
-    kind: "oauth",
-    provider: opts.provider,
-    apiKey: stored.access,
-    source: path,
-    inferred: false,
-    expiresAt: stored.expires
-  };
-  if (opts.oauth === void 0) return base;
-  const deps = {
-    fetch: opts.deps?.fetch ?? fetch,
-    now: opts.deps?.now ?? (() => Date.now())
-  };
-  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);
-}
-async function resolveCredential(opts) {
-  const env = opts.env ?? {};
-  const stored = readAuthFile(opts.store, env);
-  if (stored === void 0) return void 0;
-  const path = authFilePath(opts.store, env);
-  if (stored.type === "oauth") {
-    return resolveOAuth(stored, path, opts, env);
-  }
-  if (stored.api_key.length === 0) return void 0;
-  if (stored.provider !== opts.provider) return void 0;
-  return {
-    kind: "api",
-    provider: opts.provider,
-    apiKey: stored.api_key,
-    source: path,
-    inferred: false
-  };
-}
-
-exports.CredentialError = CredentialError;
-exports.authFilePath = authFilePath;
-exports.credentialHome = credentialHome;
+Object.defineProperty(exports, "CredentialError", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.CredentialError; }
+});
+Object.defineProperty(exports, "authFilePath", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.authFilePath; }
+});
+Object.defineProperty(exports, "credentialHome", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.credentialHome; }
+});
+Object.defineProperty(exports, "ensureFreshCredential", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.ensureFreshCredential; }
+});
+Object.defineProperty(exports, "exchangeCode", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.exchangeCode; }
+});
+Object.defineProperty(exports, "persistOAuthTokens", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.persistOAuthTokens; }
+});
+Object.defineProperty(exports, "readAuthFile", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.readAuthFile; }
+});
+Object.defineProperty(exports, "readStoredOAuth", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.readStoredOAuth; }
+});
+Object.defineProperty(exports, "refreshOAuthTokens", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.refreshOAuthTokens; }
+});
+Object.defineProperty(exports, "resolveCredential", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.resolveCredential; }
+});
+Object.defineProperty(exports, "writeCredential", {
+  enumerable: true,
+  get: function () { return chunkHFPGOTVF_cjs.writeCredential; }
+});
 exports.deviceLogin = deviceLogin;
-exports.ensureFreshCredential = ensureFreshCredential;
-exports.exchangeCode = exchangeCode;
 exports.extractAccountId = extractAccountId;
 exports.openaiDeviceLogin = openaiDeviceLogin;
 exports.parseJwtClaims = parseJwtClaims;
-exports.persistOAuthTokens = persistOAuthTokens;
 exports.pollDeviceToken = pollDeviceToken;
-exports.readAuthFile = readAuthFile;
-exports.readStoredOAuth = readStoredOAuth;
-exports.refreshOAuthTokens = refreshOAuthTokens;
 exports.requestDeviceCode = requestDeviceCode;
 exports.requestOpenAIUsercode = requestOpenAIUsercode;
-exports.resolveCredential = resolveCredential;
-exports.writeCredential = writeCredential;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map