@vercel/cli-auth 0.0.1 → 0.1.0-canary.20260211173433.cdd2da6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vercel/cli-auth",
   "description": "Used by Vercel's CLIs to handle authentication",
-  "version": "0.0.1",
+  "version": "0.1.0-canary.20260211173433.cdd2da6",
   "publishConfig": {
     "access": "public"
   },
@@ -25,7 +25,7 @@
     "zod": "4.1.11"
   },
   "devDependencies": {
-    "@types/node": "22",
+    "@types/node": "20.11.0",
     "memfs": "4.14.0",
     "typescript": "5.9.2",
     "vite": "7.1.7",

package/credentials-store.d.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod/mini';
-declare const Credentials: z.ZodMiniObject<{
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    /**
-     * The absolute time (seconds) when the {@link Credentials.token} expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
-    skipWrite: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    '// Note': z.ZodMiniOptional<z.ZodMiniString<string>>;
-    '// Docs': z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strip>;
-export type Credentials = z.infer<typeof Credentials>;
-/**
- * Returns in which directory the config should be present
- * @internal Should only be used in {@link CredentialsStore} or tests.
- */
-export declare function getGlobalPathConfig(dir: string): string;
-export declare function CredentialsStore(dir: string): {
-    configPath: string;
-    get(): Credentials;
-    /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
-    update(config: Partial<Credentials>): void;
-};
-export {};

package/credentials-store.js

@@ -1,108 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGlobalPathConfig = getGlobalPathConfig;
-exports.CredentialsStore = CredentialsStore;
-const node_path_1 = __importDefault(require("node:path"));
-const fs = __importStar(require("node:fs"));
-const node_os_1 = require("node:os");
-// NOTE: We are pinned on v5 because newer versions behave differently
-// when there are dots in the application name, eg. `com.vercel.cli` becomes `com.vercel`
-const xdg_app_paths_1 = __importDefault(require("xdg-app-paths"));
-const mini_1 = require("zod/mini");
-const Credentials = mini_1.z.object({
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token: mini_1.z.optional(mini_1.z.string()),
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken: mini_1.z.optional(mini_1.z.string()),
-    /**
-     * The absolute time (seconds) when the {@link Credentials.token} expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt: mini_1.z.optional(mini_1.z.number()),
-    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
-    skipWrite: mini_1.z.optional(mini_1.z.boolean()),
-    '// Note': mini_1.z.optional(mini_1.z.string()),
-    '// Docs': mini_1.z.optional(mini_1.z.string()),
-});
-/** Returns whether a directory exists */
-function isDirectory(path) {
-    try {
-        return fs.lstatSync(path).isDirectory();
-    }
-    catch (_) {
-        // We don't care which kind of error occured, it isn't a directory anyway.
-        return false;
-    }
-}
-/**
- * Returns in which directory the config should be present
- * @internal Should only be used in {@link CredentialsStore} or tests.
- */
-function getGlobalPathConfig(dir) {
-    const vercelDirectories = (0, xdg_app_paths_1.default)(dir).dataDirs();
-    const possibleConfigPaths = [
-        ...vercelDirectories, // latest vercel directory
-        node_path_1.default.join((0, node_os_1.homedir)(), '.now'), // legacy config in user's home directory
-        ...(0, xdg_app_paths_1.default)('now').dataDirs(), // legacy XDG directory
-    ];
-    // The customPath flag is the preferred location,
-    // followed by the vercel directory,
-    // followed by the now directory.
-    // If none of those exist, use the vercel directory.
-    return (possibleConfigPaths.find(configPath => isDirectory(configPath)) ||
-        vercelDirectories[0]);
-}
-function CredentialsStore(dir) {
-    const configPath = node_path_1.default.join(getGlobalPathConfig(dir), 'auth.json');
-    return {
-        configPath,
-        get() {
-            return Credentials.parse(JSON.parse(fs.readFileSync(configPath, 'utf8')));
-        },
-        /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
-        update(config) {
-            if (config.skipWrite)
-                return;
-            const parsedConfig = Credentials.parse(config);
-            fs.mkdirSync(node_path_1.default.dirname(configPath), { recursive: true });
-            fs.writeFileSync(configPath, JSON.stringify(parsedConfig, null, 2) + '\n', { mode: 0o600 });
-        },
-    };
-}
-//# sourceMappingURL=credentials-store.js.map

package/credentials-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["credentials-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,kDAiBC;AAED,4CAmBC;AA9ED,0DAA6B;AAC7B,4CAA8B;AAC9B,qCAAkC;AAClC,sEAAsE;AACtE,yFAAyF;AACzF,kEAAwC;AACxC,mCAA6B;AAE7B,MAAM,WAAW,GAAG,QAAC,CAAC,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,KAAK,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,6FAA6F;IAC7F,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,OAAO,EAAE,CAAC;IAClC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,yCAAyC;AACzC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,iBAAiB,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEtD,MAAM,mBAAmB,GAAG;QAC1B,GAAG,iBAAiB,EAAE,0BAA0B;QAChD,mBAAI,CAAC,IAAI,CAAC,IAAA,iBAAO,GAAE,EAAE,MAAM,CAAC,EAAE,yCAAyC;QACvE,GAAG,IAAA,uBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;KAC1D,CAAC;IAEF,iDAAiD;IACjD,oCAAoC;IACpC,iCAAiC;IACjC,oDAAoD;IACpD,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/D,iBAAiB,CAAC,CAAC,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,UAAU;QACV,GAAG;YACD,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,MAA4B;YACjC,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC7B,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,EAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,aAAa,CACd,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC5C,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/oauth.d.ts

@@ -1,207 +0,0 @@
-import * as z from 'zod/mini';
-declare const AuthorizationServerMetadata: z.ZodMiniObject<{
-    issuer: z.ZodMiniURL;
-    device_authorization_endpoint: z.ZodMiniURL;
-    token_endpoint: z.ZodMiniURL;
-    revocation_endpoint: z.ZodMiniURL;
-    jwks_uri: z.ZodMiniURL;
-    introspection_endpoint: z.ZodMiniURL;
-}, z.core.$strip>;
-export type AuthorizationServerMetadata = z.infer<typeof AuthorizationServerMetadata>;
-declare const IntrospectionResponse: z.ZodMiniObject<{
-    active: z.ZodMiniBoolean<boolean>;
-    client_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    session_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strip>;
-export declare function OAuth(config: {
-    issuer: URL;
-    clientId: string;
-    userAgent: string;
-}): {
-    init(): Promise<{
-        as: {
-            issuer: string;
-            device_authorization_endpoint: string;
-            token_endpoint: string;
-            revocation_endpoint: string;
-            jwks_uri: string;
-            introspection_endpoint: string;
-        };
-        init(): Promise</*elided*/ any>;
-        /**
-         * Returns the Authorization Server Metadata
-         *
-         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
-         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-         */
-        authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
-        /**
-         * Perform the Device Authorization Request
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-         */
-        deviceAuthorizationRequest(): Promise<{
-            /** The device verification code. */
-            device_code: string;
-            /** The end-user verification code. */
-            user_code: string;
-            /**
-             * The minimum amount of time in seconds that the client
-             * SHOULD wait between polling requests to the token endpoint.
-             */
-            interval: number;
-            /** The end-user verification URI on the authorization server. */
-            verification_uri: string;
-            /**
-             * The end-user verification URI on the authorization server,
-             * including the `user_code`, without redirection.
-             */
-            verification_uri_complete: string;
-            /**
-             * The absolute lifetime of the `device_code` and `user_code`.
-             * Calculated from `expires_in`.
-             */
-            expiresAt: number;
-        }>;
-        /**
-         * Perform the Device Access Token Request
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
-         */
-        deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
-        /**
-         * Process the Token request Response
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-         */
-        processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
-        /**
-         * Perform a Token Revocation Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
-         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
-         */
-        revokeToken(token: string): Promise<OAuthError | undefined>;
-        /**
-         * Perform Refresh Token Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
-         */
-        refreshToken(token: string): Promise<TokenSet>;
-        /**
-         * Perform Token Introspection Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
-         */
-        introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
-    }>;
-    /**
-     * Returns the Authorization Server Metadata
-     *
-     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
-     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-     */
-    authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
-    /**
-     * Perform the Device Authorization Request
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
-     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-     */
-    deviceAuthorizationRequest(): Promise<{
-        /** The device verification code. */
-        device_code: string;
-        /** The end-user verification code. */
-        user_code: string;
-        /**
-         * The minimum amount of time in seconds that the client
-         * SHOULD wait between polling requests to the token endpoint.
-         */
-        interval: number;
-        /** The end-user verification URI on the authorization server. */
-        verification_uri: string;
-        /**
-         * The end-user verification URI on the authorization server,
-         * including the `user_code`, without redirection.
-         */
-        verification_uri_complete: string;
-        /**
-         * The absolute lifetime of the `device_code` and `user_code`.
-         * Calculated from `expires_in`.
-         */
-        expiresAt: number;
-    }>;
-    /**
-     * Perform the Device Access Token Request
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
-     */
-    deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
-    /**
-     * Process the Token request Response
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-     */
-    processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
-    /**
-     * Perform a Token Revocation Request.
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
-     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
-     */
-    revokeToken(token: string): Promise<OAuthError | undefined>;
-    /**
-     * Perform Refresh Token Request.
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
-     */
-    refreshToken(token: string): Promise<TokenSet>;
-    /**
-     * Perform Token Introspection Request.
-     *
-     * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
-     */
-    introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
-};
-export type OAuth = ReturnType<typeof OAuth>;
-declare const TokenSet: z.ZodMiniObject<{
-    /** The access token issued by the authorization server. */
-    access_token: z.ZodMiniString<string>;
-    /** The type of the token issued */
-    token_type: z.ZodMiniLiteral<"Bearer">;
-    /** The lifetime in seconds of the access token. */
-    expires_in: z.ZodMiniNumber<number>;
-    /** The refresh token, which can be used to obtain new access tokens. */
-    refresh_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    /** The scope of the access token. */
-    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strip>;
-type TokenSet = z.infer<typeof TokenSet>;
-declare const OAuthErrorResponse: z.ZodMiniObject<{
-    error: z.ZodMiniEnum<{
-        invalid_request: "invalid_request";
-        invalid_client: "invalid_client";
-        invalid_grant: "invalid_grant";
-        unauthorized_client: "unauthorized_client";
-        unsupported_grant_type: "unsupported_grant_type";
-        invalid_scope: "invalid_scope";
-        server_error: "server_error";
-        authorization_pending: "authorization_pending";
-        slow_down: "slow_down";
-        access_denied: "access_denied";
-        expired_token: "expired_token";
-        unsupported_token_type: "unsupported_token_type";
-    }>;
-    error_description: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    error_uri: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strip>;
-type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
-declare class OAuthError extends Error {
-    name: string;
-    code: OAuthErrorResponse['error'];
-    cause: Error;
-    constructor(message: string, response: unknown);
-}
-export declare function isOAuthError(error: unknown): error is OAuthError;
-export {};

package/oauth.js

@@ -1,311 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuth = OAuth;
-exports.isOAuthError = isOAuthError;
-const z = __importStar(require("zod/mini"));
-const AuthorizationServerMetadata = z.object({
-    issuer: z.url(),
-    device_authorization_endpoint: z.url(),
-    token_endpoint: z.url(),
-    revocation_endpoint: z.url(),
-    jwks_uri: z.url(),
-    introspection_endpoint: z.url(),
-});
-const DeviceAuthorization = z.object({
-    device_code: z.string(),
-    user_code: z.string(),
-    verification_uri: z.url(),
-    verification_uri_complete: z.url(),
-    expires_in: z.number(),
-    interval: z.number(),
-});
-const IntrospectionResponse = z.object({
-    active: z.boolean(),
-    client_id: z.optional(z.string()),
-    session_id: z.optional(z.string()),
-});
-function OAuth(config) {
-    const { issuer, clientId, userAgent } = config;
-    let as;
-    function assertAs(as) {
-        if (as)
-            return;
-        throw new Error('Authorization Server Metadata not initialized. Call init() first.');
-    }
-    return {
-        async init() {
-            as ??= await this.authorizationServerMetadata();
-            return { ...this, as };
-        },
-        /**
-         * Returns the Authorization Server Metadata
-         *
-         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
-         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-         */
-        async authorizationServerMetadata() {
-            const response = await fetch(new URL('.well-known/openid-configuration', issuer), {
-                headers: {
-                    'Content-Type': 'application/json',
-                    'user-agent': userAgent,
-                },
-            });
-            const json = await response.json();
-            as = AuthorizationServerMetadata.parse(json);
-            if (as.issuer !== issuer.origin) {
-                throw new OAuthError(`Issuer mismatch: expected ${issuer}, got ${as.issuer}`, json);
-            }
-            return as;
-        },
-        /**
-         * Perform the Device Authorization Request
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-         */
-        async deviceAuthorizationRequest() {
-            assertAs(as);
-            const response = await fetch(as.device_authorization_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'user-agent': userAgent,
-                },
-                body: new URLSearchParams({
-                    client_id: clientId,
-                    scope: 'openid offline_access',
-                }),
-            });
-            const json = await response.json();
-            const parsed = DeviceAuthorization.safeParse(json);
-            if (!parsed.success) {
-                throw new OAuthError(`Failed to parse device authorization response: ${parsed.error.message}`, json);
-            }
-            return {
-                device_code: parsed.data.device_code,
-                user_code: parsed.data.user_code,
-                verification_uri: parsed.data.verification_uri,
-                verification_uri_complete: parsed.data.verification_uri_complete,
-                expiresAt: Date.now() + parsed.data.expires_in * 1000,
-                interval: parsed.data.interval,
-            };
-        },
-        /**
-         * Perform the Device Access Token Request
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
-         */
-        async deviceAccessTokenRequest(device_code) {
-            assertAs(as);
-            try {
-                return [
-                    null,
-                    await fetch(as.token_endpoint, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/x-www-form-urlencoded',
-                            'user-agent': userAgent,
-                        },
-                        body: new URLSearchParams({
-                            client_id: clientId,
-                            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                            device_code,
-                        }),
-                        signal: AbortSignal.timeout(10 * 1000),
-                    }),
-                ];
-            }
-            catch (error) {
-                if (error instanceof Error)
-                    return [error];
-                return [
-                    new Error('An unknown error occurred. See the logs for details.', {
-                        cause: error,
-                    }),
-                ];
-            }
-        },
-        /**
-         * Process the Token request Response
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-         */
-        async processTokenResponse(response) {
-            const json = await response.json();
-            const processed = TokenSet.safeParse(json);
-            if (!processed.success) {
-                return [
-                    new OAuthError(`Failed to parse token response: ${processed.error.message}`, json),
-                ];
-            }
-            return [null, processed.data];
-        },
-        /**
-         * Perform a Token Revocation Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
-         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
-         */
-        async revokeToken(token) {
-            assertAs(as);
-            const response = await fetch(as.revocation_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'user-agent': userAgent,
-                },
-                body: new URLSearchParams({ token, client_id: clientId }),
-            });
-            if (response.ok)
-                return;
-            const json = await response.json();
-            return new OAuthError('Revocation request failed', json);
-        },
-        /**
-         * Perform Refresh Token Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
-         */
-        async refreshToken(token) {
-            assertAs(as);
-            const response = await fetch(as.token_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'user-agent': userAgent,
-                },
-                body: new URLSearchParams({
-                    client_id: clientId,
-                    grant_type: 'refresh_token',
-                    refresh_token: token,
-                }),
-            });
-            const [tokensError, tokenSet] = await this.processTokenResponse(response);
-            if (tokensError)
-                throw tokensError;
-            return tokenSet;
-        },
-        /**
-         * Perform Token Introspection Request.
-         *
-         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
-         */
-        async introspectToken(token) {
-            assertAs(as);
-            const response = await fetch(as.introspection_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'user-agent': userAgent,
-                },
-                body: new URLSearchParams({ token }),
-            });
-            const json = await response.json();
-            const processed = IntrospectionResponse.safeParse(json);
-            if (!processed.success) {
-                throw new OAuthError(`Failed to parse introspection response: ${processed.error.message}`, json);
-            }
-            return processed.data;
-        },
-    };
-}
-const TokenSet = z.object({
-    /** The access token issued by the authorization server. */
-    access_token: z.string(),
-    /** The type of the token issued */
-    token_type: z.literal('Bearer'),
-    /** The lifetime in seconds of the access token. */
-    expires_in: z.number(),
-    /** The refresh token, which can be used to obtain new access tokens. */
-    refresh_token: z.optional(z.string()),
-    /** The scope of the access token. */
-    scope: z.optional(z.string()),
-});
-const OAuthErrorResponse = z.object({
-    error: z.enum([
-        'invalid_request',
-        'invalid_client',
-        'invalid_grant',
-        'unauthorized_client',
-        'unsupported_grant_type',
-        'invalid_scope',
-        'server_error',
-        // Device Authorization Response Errors
-        'authorization_pending',
-        'slow_down',
-        'access_denied',
-        'expired_token',
-        // Revocation Response Errors
-        'unsupported_token_type',
-    ]),
-    error_description: z.optional(z.string()),
-    error_uri: z.optional(z.string()),
-});
-function processOAuthErrorResponse(json) {
-    try {
-        return OAuthErrorResponse.parse(json);
-    }
-    catch (error) {
-        if (error instanceof z.core.$ZodError) {
-            return new TypeError(`Invalid OAuth error response: ${error.message}`);
-        }
-        return new TypeError('Failed to parse OAuth error response');
-    }
-}
-class OAuthError extends Error {
-    constructor(message, response) {
-        super(message);
-        this.name = 'OAuthError';
-        const error = processOAuthErrorResponse(response);
-        if (error instanceof TypeError) {
-            const message = `Unexpected server response: ${JSON.stringify(response)}`;
-            this.cause = new Error(message, { cause: error });
-            this.code = 'server_error';
-            return;
-        }
-        let cause = error.error;
-        if (error.error_description)
-            cause += `: ${error.error_description}`;
-        if (error.error_uri)
-            cause += ` (${error.error_uri})`;
-        this.cause = new Error(cause.toString());
-        this.code = error.error;
-    }
-}
-function isOAuthError(error) {
-    return error instanceof OAuthError;
-}
-//# sourceMappingURL=oauth.js.map

package/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,sBAmPC;AA6ED,oCAEC;AAhWD,4CAA8B;AAE9B,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,6BAA6B,EAAE,CAAC,CAAC,GAAG,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE;CAChC,CAAC,CAAC;AAMH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,SAAgB,KAAK,CAAC,MAIrB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,EAA2C,CAAC;IAEhD,SAAS,QAAQ,CAAC,EAAW;QAC3B,IAAI,EAAE;YAAE,OAAO;QACf,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,EAAE,KAAK,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,2BAA2B;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,EACnD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,SAAS;iBACxB;aACF,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAClB,6BAA6B,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,EACvD,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,0BAA0B;YAuB9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACxE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;gBAC9C,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB;gBAChE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC;QACJ,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,wBAAwB,CAC5B,WAAmB;YAEnB,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO;oBACL,IAAI;oBACJ,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;wBAC7B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,mCAAmC;4BACnD,YAAY,EAAE,SAAS;yBACxB;wBACD,IAAI,EAAE,IAAI,eAAe,CAAC;4BACxB,SAAS,EAAE,QAAQ;4BACnB,UAAU,EAAE,8CAA8C;4BAC1D,WAAW;yBACZ,CAAC;wBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;qBACvC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,OAAO;oBACL,IAAI,KAAK,CAAC,sDAAsD,EAAE;wBAChE,KAAK,EAAE,KAAK;qBACb,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,oBAAoB,CACxB,QAAkB;YAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,UAAU,CACZ,mCAAmC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAC5D,IAAI,CACL;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,mBAAmB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO;YACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,OAAO,IAAI,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,KAAK;iBACrB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC1E,IAAI,WAAW;gBAAE,MAAM,WAAW,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,eAAe,CACnB,KAAa;YAEb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,sBAAsB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;aACrC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAClB,2CAA2C,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,qCAAqC;IACrC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAIH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,qBAAqB;QACrB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,uCAAuC;QACvC,uBAAuB;QACvB,WAAW;QACX,eAAe;QACf,eAAe;QACf,6BAA6B;QAC7B,wBAAwB;KACzB,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,SAAS,yBAAyB,CAChC,IAAa;IAEb,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,SAAS,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAI5B,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,YAAY,CAAC;QAKlB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;QAEtD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,CAAC;AACrC,CAAC"}

package/sso.d.ts

@@ -1,24 +0,0 @@
-import * as z from 'zod/mini';
-import type { OAuth } from './oauth';
-import type { Credentials } from './credentials-store';
-/**
- * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
- * the SSO flow. Use when the user's SSO session has expired or missing.
- *
- */
-export declare function reauthorizeTeam(params: {
-    /** The team's slug that requires re-authorization */
-    team: string;
-    /** The current access token that needs to be re-authorized */
-    token: Credentials['token'];
-    oauth: OAuth;
-}): Promise<void>;
-declare const SSOError: z.ZodMiniObject<{
-    code: z.ZodMiniString<string>;
-    message: z.ZodMiniString<string>;
-    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    enforced: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-}, z.core.$strip>;
-/** Parse an error-like object to determine if SSO re-authorization is required. */
-export declare function parseSSOError(error: unknown): z.infer<typeof SSOError> | undefined;
-export {};

package/sso.js

@@ -1,136 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.reauthorizeTeam = reauthorizeTeam;
-exports.parseSSOError = parseSSOError;
-const node_http_1 = __importDefault(require("node:http"));
-const async_listen_1 = require("async-listen");
-const open_1 = __importDefault(require("open"));
-const z = __importStar(require("zod/mini"));
-/**
- * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
- * the SSO flow. Use when the user's SSO session has expired or missing.
- *
- */
-async function reauthorizeTeam(params) {
-    const { team, token, oauth } = params;
-    if (!token) {
-        throw new TypeError('Token is missing, cannot initiate SSO re-authorization. Please log in again.');
-    }
-    const introspection = await oauth.introspectToken(token);
-    const { active, session_id, client_id } = introspection;
-    if (!active || !session_id || !client_id) {
-        throw new Error('Introspection failed. Token is either expired or otherwise invalid. Please log in again.');
-    }
-    const verificationToken = await waitForVerification({
-        team,
-        session_id,
-        client_id,
-    });
-    await fetch(`https://api.vercel.com/registration/verify?${new URLSearchParams({ token: verificationToken })}`);
-}
-/**
- * Get a verification token by spawning a localhost HTTP server
- * that gets redirected to as the OAuth callback URL.
- *
- * The token returned can be sent back to the Vercel API to complete
- * the SSO re-authorization.
- */
-async function waitForVerification(params) {
-    const { team, session_id, client_id } = params;
-    const server = node_http_1.default.createServer();
-    const { port } = await (0, async_listen_1.listen)(server, 0, '127.0.0.1');
-    const initSSOUrl = new URL(`/sso/${team}?${new URLSearchParams({
-        session_id,
-        client_id,
-        next: `http://localhost:${port}`,
-    })}`, `https://vercel.com`);
-    try {
-        const [query] = await Promise.all([
-            new Promise((resolve, reject) => {
-                server.once('request', (req, res) => {
-                    // Close the HTTP connection to prevent `server.close()` from hanging
-                    res.setHeader('connection', 'close');
-                    const { searchParams } = new URL(req.url || '/', 'http://localhost');
-                    resolve(searchParams);
-                    // Redirect the user back to the Vercel login notification page
-                    res.statusCode = 302;
-                    res.setHeader('location', getNotificationUrl(searchParams)).end();
-                });
-                server.once('error', reject);
-            }),
-            (0, open_1.default)(initSSOUrl.href),
-        ]);
-        const loginError = query.get('loginError');
-        if (loginError) {
-            const error = new Error('Login failed.');
-            error.cause = JSON.parse(loginError);
-            throw error;
-        }
-        const token = query.get('token');
-        if (!token) {
-            throw new TypeError('Could not get verification token. Please contact support.');
-        }
-        return token;
-    }
-    finally {
-        server.close();
-    }
-}
-function getNotificationUrl(params) {
-    const loginState = params.has('loginError')
-        ? 'failed'
-        : params.has('ssoEmail')
-            ? 'incomplete'
-            : 'success';
-    return `https://vercel.com/notifications/cli-login-${loginState}?${params}`;
-}
-const SSOError = z.object({
-    code: z.string(),
-    message: z.string(),
-    scope: z.optional(z.string()),
-    enforced: z.optional(z.boolean()),
-});
-/** Parse an error-like object to determine if SSO re-authorization is required. */
-function parseSSOError(error) {
-    const { data } = SSOError.safeParse(error);
-    if (!data?.enforced)
-        return;
-    return data;
-}
-//# sourceMappingURL=sso.js.map

package/sso.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["sso.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAiCC;AAmFD,sCAMC;AAtID,0DAA6B;AAC7B,+CAAsC;AACtC,gDAAwB;AACxB,4CAA8B;AAI9B;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,MAMrC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CACjB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IAExD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,IAAI;QACJ,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,KAAK,CACT,8CAA8C,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAClG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAIlC;IACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,mBAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,qBAAM,EAAC,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,QAAQ,IAAI,IAAI,IAAI,eAAe,CAAC;QAClC,UAAU;QACV,SAAS;QACT,IAAI,EAAE,oBAAoB,IAAI,EAAE;KACjC,CAAC,EAAE,EACJ,oBAAoB,CACrB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChC,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAClC,qEAAqE;oBACrE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBAErC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;oBACrE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAEtB,+DAA+D;oBAC/D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpE,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC,CAAC;YACF,IAAA,cAAI,EAAC,UAAU,CAAC,IAAI,CAAC;SACtB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,8CAA8C,UAAU,IAAI,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,mFAAmF;AACnF,SAAgB,aAAa,CAC3B,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/user-agent.d.ts

@@ -1,13 +0,0 @@
-/**
- * Get the user agent string for the current environment.
- *
- * @exapmle
- * ```
- * getUserAgent({ name: 'my-cli', version: '1.0.0' });
- * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
- * ```
- */
-export declare function getUserAgent(pkg: {
-    name: string;
-    version: string;
-}): string;

package/user-agent.js

@@ -1,20 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserAgent = getUserAgent;
-const node_os_1 = __importDefault(require("node:os"));
-/**
- * Get the user agent string for the current environment.
- *
- * @exapmle
- * ```
- * getUserAgent({ name: 'my-cli', version: '1.0.0' });
- * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
- * ```
- */
-function getUserAgent(pkg) {
-    return `${node_os_1.default.hostname()} @ ${pkg.name} ${pkg.version} node-${process.version} ${node_os_1.default.platform()} (${node_os_1.default.arch()})`;
-}
-//# sourceMappingURL=user-agent.js.map

package/user-agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-agent.js","sourceRoot":"","sources":["user-agent.ts"],"names":[],"mappings":";;;;;AAWA,oCAIC;AAfD,sDAAyB;AAEzB;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,GAAsC;IACjE,OAAO,GAAG,iBAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,SAClD,OAAO,CAAC,OACV,IAAI,iBAAE,CAAC,QAAQ,EAAE,KAAK,iBAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AACrC,CAAC"}