@vibe-commit/capture 0.4.5 → 0.5.0

package/dist/install.js

@@ -24,8 +24,8 @@
  * thing testable by handing in an `env`, which a subprocess-based version could
  * only fake by building a directory of shims.
  */
-import { accessSync, chmodSync, constants, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { accessSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { gitProbe } from "./git.js";
 /** The command name D55 kept. */
 const BIN = "vibecommit";
@@ -52,6 +52,33 @@ export function classifyInstall(env, selfPath) {
         return { kind: "ours" };
     return { kind: "foreign", resolved: other ?? found };
 }
+/** The file the plugin repo pins its vendored bundle with, next to `bin/` (`claude-plugin`). */
+const PLUGIN_BUNDLE_PIN = "capture-bundle.json";
+export function installChannel(env, selfPath) {
+    const self = realpathOrNull(selfPath);
+    if (self === null)
+        return { kind: "unknown", command: BIN };
+    if (classifyInstall(env, selfPath).kind === "ours")
+        return { kind: "npm", command: BIN };
+    if (existsSync(join(dirname(dirname(self)), PLUGIN_BUNDLE_PIN))) {
+        // Quoted only when it has to be: a plugin cache path can hold a space.
+        return { kind: "plugin", command: /[\s"'$`\\]/.test(self) ? `node "${self.replace(/(["$`\\])/g, "\\$1")}"` : `node ${self}` };
+    }
+    return { kind: "npm", command: BIN };
+}
+/** What a user types to replace this machine's credential, for THIS install: `<channel command> auth`. */
+export function authCommandFor(env, selfPath) {
+    return `${installChannel(env, selfPath).command} ${AUTH_VERB}`;
+}
+const AUTH_VERB = "auth";
+/**
+ * What a user types to run the device sign-in again, for THIS install (`CR-234d`): `<channel command>
+ * connect --device`. The same channel rule as `authCommandFor`, so a plugin-only machine — which has no
+ * `vibecommit` on PATH — is not told to run a command that does not exist.
+ */
+export function connectDeviceCommandFor(env, selfPath) {
+    return `${installChannel(env, selfPath).command} connect --device`;
+}
 /** The first executable `name` on PATH, or null. */
 export function resolveOnPath(env, name) {
     const raw = env.PATH;

package/dist/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvI,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAUpC,iCAAiC;AACjC,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB,EAAE,QAAgB;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE9C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,GAAsB,EAAE,IAAY;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC5C,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,kFAAkF;AAClF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAcvD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,QAAgB,EAAE,UAAmB;IACxE,MAAM,OAAO,GAAG,OAAO,QAAQ,GAAG,cAAc,GAAG,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;IAClD,OAAO;QACL,WAAW;QACX,KAAK,WAAW,EAAE;QAClB,4EAA4E;QAC5E,8BAA8B;QAC9B,mBAAmB;QACnB,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,eAAe,QAAQ,GAAG,cAAc,WAAW;QACnD,UAAU;YACR,CAAC,CAAC,+BAA+B,OAAO,oBAAoB;YAC5D,CAAC,CAAC,KAAK,OAAO,oBAAoB;QACpC,IAAI;QACJ,UAAU;YACR,CAAC,CAAC,6BAA6B,IAAI,+BAA+B;YAClE,CAAC,CAAC,GAAG,IAAI,0BAA0B;QACrC,cAAc;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IACrE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,wEAAwE;IACxE,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,2EAA2E;QAC7E,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,MAAc;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,kEAAkE;YAClE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,qEAAqE;YACrE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;YAChD,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvD,CAAC;QAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,UAAkB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9F,wEAAwE;IACxE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1B,uEAAuE;IACvE,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnJ,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAUpC,iCAAiC;AACjC,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB,EAAE,QAAgB;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE9C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAyBhD,MAAM,UAAU,cAAc,CAAC,GAAsB,EAAE,QAAgB;IACrE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC5D,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACzF,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAChE,uEAAuE;QACvE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACvC,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,GAAsB,EAAE,QAAgB;IACrE,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB,EAAE,QAAgB;IAC9E,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,OAAO,mBAAmB,CAAC;AACrE,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,GAAsB,EAAE,IAAY;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC5C,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,kFAAkF;AAClF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAcvD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,QAAgB,EAAE,UAAmB;IACxE,MAAM,OAAO,GAAG,OAAO,QAAQ,GAAG,cAAc,GAAG,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;IAClD,OAAO;QACL,WAAW;QACX,KAAK,WAAW,EAAE;QAClB,4EAA4E;QAC5E,8BAA8B;QAC9B,mBAAmB;QACnB,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,eAAe,QAAQ,GAAG,cAAc,WAAW;QACnD,UAAU;YACR,CAAC,CAAC,+BAA+B,OAAO,oBAAoB;YAC5D,CAAC,CAAC,KAAK,OAAO,oBAAoB;QACpC,IAAI;QACJ,UAAU;YACR,CAAC,CAAC,6BAA6B,IAAI,+BAA+B;YAClE,CAAC,CAAC,GAAG,IAAI,0BAA0B;QACrC,cAAc;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IACrE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,wEAAwE;IACxE,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,2EAA2E;QAC7E,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,MAAc;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,kEAAkE;YAClE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,qEAAqE;YACrE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;YAChD,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvD,CAAC;QAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,UAAkB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9F,wEAAwE;IACxE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1B,uEAAuE;IACvE,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/oauth/device.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The device-authorization client — RFC 8628 for the capture CLI, `CR-234d`, D219.
+ *
+ * ## What the grant is FOR
+ *
+ * A machine with no browser (an SSH box, a devcontainer) cannot run the loopback sign-in. Here the machine
+ * asks for a code, shows it, and polls while the person approves on a device that DOES have a browser.
+ * What approval yields is not a session: it is a single-use MINT TICKET (`vcmt_…`, R4) that buys exactly one
+ * ingest credential at the mint route. Nothing is written to `session.json`.
+ *
+ * ```
+ *   POST <device_authorization_endpoint>   { client_id, machine_label, org_id? }
+ *     200 { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval }
+ *     429 { error: "rate_limited", retry_after }  + Retry-After
+ *
+ *   POST <token_endpoint>   grant_type=urn:ietf:params:oauth:grant-type:device_code & device_code & client_id
+ *     400 authorization_pending | slow_down | access_denied | expired_token | invalid_grant | invalid_request
+ *     200 { access_token: "vcmt_…", token_type: "mint_ticket", expires_in, account, org_name }
+ * ```
+ *
+ * ⚠ The endpoint is DISCOVERED (`discovery.ts`), never built from the issuer. And a poll answer this client
+ * does not recognise is `malformed`, never a quiet "keep waiting" — a loop that cannot tell a new error from
+ * a pending one polls a dead code until its deadline.
+ *
+ * @provenance vibecommit-mcp src/oauth/device.ts — the device_authorization and device_code-grant request and response shapes, retyped
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/device_authorization and the device_code grant on /oauth/token, retyped
+ */
+import { DeviceCode, MintTicket } from "../credential.js";
+/** RFC 8628 §3.4. */
+export declare const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** The server's default poll spacing when it names none (RFC 8628 §3.2). */
+export declare const DEFAULT_INTERVAL_S = 5;
+/** `slow_down` adds this many seconds to the interval for the rest of the flow (RFC 8628 §3.5). */
+export declare const SLOW_DOWN_STEP_S = 5;
+/**
+ * The `user_code` as the person is shown it. Deliberately loose about the ALPHABET — the server owns that and
+ * a client copy of it is a second place for it to drift — but strict about the SHAPE, because this string is
+ * printed to a terminal: an escape sequence or a newline from a hostile server must never reach it.
+ */
+/**
+ * The server's `error_description` on an `access_denied` that is the 16C gate rather than a person's "no"
+ * (brief A7). Compared EXACTLY: a description this client does not recognise is an ordinary denial, which is
+ * the conservative reading — it shows the Denied block and changes nothing.
+ */
+export declare const GATE_OFF_DESCRIPTION = "code sign-in is off for this account";
+export interface DeviceHttp {
+    readonly fetch: typeof fetch;
+    readonly timeoutMs: number;
+}
+export interface DeviceGrant {
+    readonly deviceCode: DeviceCode;
+    /** `WDJB-MJHT`, upper case, as shown. */
+    readonly userCode: string;
+    /** The bare page. ALWAYS printed (RFC 8628 §3.3.1). */
+    readonly verificationUri: string;
+    /** The page with the code prefilled. Opened, never relied on. */
+    readonly verificationUriComplete: string;
+    readonly expiresInS: number;
+    readonly intervalS: number;
+}
+export type DeviceStart = {
+    readonly kind: "ok";
+    readonly grant: DeviceGrant;
+}
+/** 429. `retryAfterS` is the server's word, or null when it gave none. */
+ | {
+    readonly kind: "rate-limited";
+    readonly retryAfterS: number | null;
+}
+/** Any other refusal, with the server's code (`unauthorized_client`, `invalid_request`, `server_error`…). */
+ | {
+    readonly kind: "refused";
+    readonly status: number;
+    readonly error: string;
+} | {
+    readonly kind: "unreachable";
+} | {
+    readonly kind: "malformed";
+};
+export interface DeviceStartRequest {
+    readonly machineLabel: string;
+    /** The org the credential this machine replaces belongs to (15A) — a HINT; the approver decides. */
+    readonly orgId?: string;
+}
+/** Ask the server for a device code. */
+export declare function startDeviceAuthorization(endpoint: string, request: DeviceStartRequest, http: DeviceHttp): Promise<DeviceStart>;
+export type DevicePoll = {
+    readonly kind: "ticket";
+    readonly ticket: MintTicket;
+    readonly expiresInS: number | null;
+    /** The approver's GitHub handle, or null. Carried for the confirmation when whoami(new) is unanswered (A4 §3). */
+    readonly account: string | null;
+    /** The workspace the approver chose. */
+    readonly orgName: string | null;
+} | {
+    readonly kind: "pending";
+}
+/** RFC 8628 §3.5: add `SLOW_DOWN_STEP_S` to the interval, permanently. */
+ | {
+    readonly kind: "slow-down";
+} | {
+    readonly kind: "denied";
+}
+/**
+ * `access_denied` whose description says the account's code sign-in switch is off (16C, brief A7). The
+ * gate is enforced when the ticket is issued, so a switch turned off AFTER the approval lands here.
+ */
+ | {
+    readonly kind: "code-signin-off";
+} | {
+    readonly kind: "expired";
+}
+/** `invalid_grant`: the code is unknown or already spent — not something waiting longer fixes. */
+ | {
+    readonly kind: "invalid";
+} | {
+    readonly kind: "rate-limited";
+    readonly retryAfterS: number | null;
+}
+/** A server fault. The loop tolerates a few in a row, because a deploy is an ordinary reason for one. */
+ | {
+    readonly kind: "server-error";
+} | {
+    readonly kind: "unreachable";
+} | {
+    readonly kind: "malformed";
+};
+/** One poll of the token endpoint. */
+export declare function pollDeviceToken(tokenEndpoint: string, deviceCode: DeviceCode, http: DeviceHttp): Promise<DevicePoll>;

package/dist/oauth/device.js

@@ -0,0 +1,194 @@
+/**
+ * The device-authorization client — RFC 8628 for the capture CLI, `CR-234d`, D219.
+ *
+ * ## What the grant is FOR
+ *
+ * A machine with no browser (an SSH box, a devcontainer) cannot run the loopback sign-in. Here the machine
+ * asks for a code, shows it, and polls while the person approves on a device that DOES have a browser.
+ * What approval yields is not a session: it is a single-use MINT TICKET (`vcmt_…`, R4) that buys exactly one
+ * ingest credential at the mint route. Nothing is written to `session.json`.
+ *
+ * ```
+ *   POST <device_authorization_endpoint>   { client_id, machine_label, org_id? }
+ *     200 { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval }
+ *     429 { error: "rate_limited", retry_after }  + Retry-After
+ *
+ *   POST <token_endpoint>   grant_type=urn:ietf:params:oauth:grant-type:device_code & device_code & client_id
+ *     400 authorization_pending | slow_down | access_denied | expired_token | invalid_grant | invalid_request
+ *     200 { access_token: "vcmt_…", token_type: "mint_ticket", expires_in, account, org_name }
+ * ```
+ *
+ * ⚠ The endpoint is DISCOVERED (`discovery.ts`), never built from the issuer. And a poll answer this client
+ * does not recognise is `malformed`, never a quiet "keep waiting" — a loop that cannot tell a new error from
+ * a pending one polls a dead code until its deadline.
+ *
+ * @provenance vibecommit-mcp src/oauth/device.ts — the device_authorization and device_code-grant request and response shapes, retyped
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/device_authorization and the device_code grant on /oauth/token, retyped
+ */
+import { DeviceCode, MintTicket, isMintTicketShape } from "../credential.js";
+import { isAllowedIngestUrl } from "../post.js";
+import { CLIENT_ID } from "./token.js";
+/** RFC 8628 §3.4. */
+export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** The server's default poll spacing when it names none (RFC 8628 §3.2). */
+export const DEFAULT_INTERVAL_S = 5;
+/** `slow_down` adds this many seconds to the interval for the rest of the flow (RFC 8628 §3.5). */
+export const SLOW_DOWN_STEP_S = 5;
+/**
+ * The `user_code` as the person is shown it. Deliberately loose about the ALPHABET — the server owns that and
+ * a client copy of it is a second place for it to drift — but strict about the SHAPE, because this string is
+ * printed to a terminal: an escape sequence or a newline from a hostile server must never reach it.
+ */
+/**
+ * The server's `error_description` on an `access_denied` that is the 16C gate rather than a person's "no"
+ * (brief A7). Compared EXACTLY: a description this client does not recognise is an ordinary denial, which is
+ * the conservative reading — it shows the Denied block and changes nothing.
+ */
+export const GATE_OFF_DESCRIPTION = "code sign-in is off for this account";
+const USER_CODE_SHAPE = /^[A-Z0-9]{3,6}-[A-Z0-9]{3,6}$/;
+async function postWithTimeout(url, init, http) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), http.timeoutMs);
+    try {
+        const res = await http.fetch(url, {
+            method: "POST",
+            headers: { "content-type": init.contentType, accept: "application/json" },
+            body: init.body,
+            signal: controller.signal,
+            // Same reason as every other lane: a followed redirect carries the body somewhere unconfigured.
+            redirect: "error",
+        });
+        return { res };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function readJson(res) {
+    try {
+        const body = (await res.json());
+        return body !== null && typeof body === "object" && !Array.isArray(body) ? body : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** `Retry-After` as whole seconds, or null. `Number(null)` is 0, which is why this does not use it. */
+function retryAfterSeconds(res, body) {
+    const fromBody = body?.retry_after;
+    if (typeof fromBody === "number" && Number.isFinite(fromBody) && fromBody > 0)
+        return Math.ceil(fromBody);
+    const header = res.headers.get("retry-after");
+    if (header === null)
+        return null;
+    const n = Number(header);
+    return Number.isFinite(n) && n > 0 ? Math.ceil(n) : null;
+}
+function positiveInt(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : null;
+}
+/** Ask the server for a device code. */
+export async function startDeviceAuthorization(endpoint, request, http) {
+    const sent = await postWithTimeout(endpoint, {
+        contentType: "application/json",
+        body: JSON.stringify({
+            client_id: CLIENT_ID,
+            machine_label: request.machineLabel,
+            ...(request.orgId === undefined ? {} : { org_id: request.orgId }),
+        }),
+    }, http);
+    if (sent === null)
+        return { kind: "unreachable" };
+    const { res } = sent;
+    const doc = await readJson(res);
+    if (res.status === 429)
+        return { kind: "rate-limited", retryAfterS: retryAfterSeconds(res, doc) };
+    if (res.status !== 200) {
+        return { kind: "refused", status: res.status, error: typeof doc?.error === "string" ? doc.error : "" };
+    }
+    if (doc === null)
+        return { kind: "malformed" };
+    const { device_code, user_code, verification_uri, verification_uri_complete } = doc;
+    const expiresInS = positiveInt(doc.expires_in);
+    if (typeof device_code !== "string" ||
+        device_code === "" ||
+        typeof user_code !== "string" ||
+        !USER_CODE_SHAPE.test(user_code.toUpperCase()) ||
+        typeof verification_uri !== "string" ||
+        typeof verification_uri_complete !== "string" ||
+        expiresInS === null) {
+        return { kind: "malformed" };
+    }
+    // Both URIs are printed or opened on the person's machine: https, or http on a loopback, and nothing else.
+    if (!isAllowedIngestUrl(verification_uri) || !isAllowedIngestUrl(verification_uri_complete)) {
+        return { kind: "malformed" };
+    }
+    return {
+        kind: "ok",
+        grant: {
+            deviceCode: new DeviceCode(device_code),
+            userCode: user_code.toUpperCase(),
+            verificationUri: verification_uri,
+            verificationUriComplete: verification_uri_complete,
+            expiresInS,
+            intervalS: positiveInt(doc.interval) ?? DEFAULT_INTERVAL_S,
+        },
+    };
+}
+/** One poll of the token endpoint. */
+export async function pollDeviceToken(tokenEndpoint, deviceCode, http) {
+    const sent = await postWithTimeout(tokenEndpoint, {
+        contentType: "application/x-www-form-urlencoded",
+        body: new URLSearchParams({
+            grant_type: DEVICE_GRANT_TYPE,
+            // The request boundary — the one place this secret's plaintext is used.
+            device_code: deviceCode.expose(),
+            client_id: CLIENT_ID,
+        }).toString(),
+    }, http);
+    if (sent === null)
+        return { kind: "unreachable" };
+    const { res } = sent;
+    const doc = await readJson(res);
+    if (res.status === 429)
+        return { kind: "rate-limited", retryAfterS: retryAfterSeconds(res, doc) };
+    if (res.status >= 500)
+        return { kind: "server-error" };
+    if (res.status === 200) {
+        if (doc === null)
+            return { kind: "malformed" };
+        const token = doc.access_token;
+        // Both halves of the class check: the prefix, and the type the server says it is. A bearer that is
+        // not a mint ticket must never be spent at the mint route as one.
+        if (typeof token !== "string" || !isMintTicketShape(token) || doc.token_type !== "mint_ticket") {
+            return { kind: "malformed" };
+        }
+        const text = (v) => (typeof v === "string" && v !== "" ? v : null);
+        return {
+            kind: "ticket",
+            ticket: new MintTicket(token),
+            expiresInS: positiveInt(doc.expires_in),
+            account: text(doc.account),
+            orgName: text(doc.org_name),
+        };
+    }
+    switch (typeof doc?.error === "string" ? doc.error : "") {
+        case "authorization_pending":
+            return { kind: "pending" };
+        case "slow_down":
+            return { kind: "slow-down" };
+        case "access_denied":
+            return doc?.error_description === GATE_OFF_DESCRIPTION ? { kind: "code-signin-off" } : { kind: "denied" };
+        case "expired_token":
+            return { kind: "expired" };
+        case "invalid_grant":
+            return { kind: "invalid" };
+        default:
+            // `invalid_request`, `unauthorized_client`, a body with no `error`, a 3xx/4xx nobody documented.
+            return { kind: "malformed" };
+    }
+}
+//# sourceMappingURL=device.js.map

package/dist/oauth/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../src/oauth/device.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,qBAAqB;AACrB,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAEhF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAE3E,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAkCxD,KAAK,UAAU,eAAe,CAC5B,GAAW,EACX,IAA6D,EAC7D,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACzE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,gGAAgG;YAChG,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,iBAAiB,CAAC,GAAa,EAAE,IAAoC;IAC5E,MAAM,QAAQ,GAAG,IAAI,EAAE,WAAW,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrG,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,OAA2B,EAC3B,IAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,QAAQ,EACR;QACE,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SAClE,CAAC;KACH,EACD,IAAI,CACL,CAAC;IACF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAE/C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,GAAG,GAAG,CAAC;IACpF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,EAAE;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,gBAAgB,KAAK,QAAQ;QACpC,OAAO,yBAAyB,KAAK,QAAQ;QAC7C,UAAU,KAAK,IAAI,EACnB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,2GAA2G;IAC3G,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,UAAU,EAAE,IAAI,UAAU,CAAC,WAAW,CAAC;YACvC,QAAQ,EAAE,SAAS,CAAC,WAAW,EAAE;YACjC,eAAe,EAAE,gBAAgB;YACjC,uBAAuB,EAAE,yBAAyB;YAClD,UAAU;YACV,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,kBAAkB;SAC3D;KACF,CAAC;AACJ,CAAC;AA8BD,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,UAAsB,EACtB,IAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,aAAa,EACb;QACE,WAAW,EAAE,mCAAmC;QAChD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,iBAAiB;YAC7B,wEAAwE;YACxE,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE;YAChC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,QAAQ,EAAE;KACd,EACD,IAAI,CACL,CAAC;IACF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAEvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;QAC/B,mGAAmG;QACnG,kEAAkE;QAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YAC/F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC;YAC7B,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxD,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,GAAG,EAAE,iBAAiB,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5G,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B;YACE,iGAAiG;YACjG,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/oauth/discovery.d.ts

@@ -59,6 +59,11 @@ export interface AuthorizationServerMetadata {
     readonly issuer: string;
     readonly authorization_endpoint: string;
     readonly token_endpoint: string;
+    /**
+     * RFC 8628 §4, `CR-234`. OPTIONAL: a server that predates the device grant does not publish it, and
+     * the browser flow does not need it. Like the other two it is DISCOVERED, never built from the issuer.
+     */
+    readonly device_authorization_endpoint?: string;
     readonly code_challenge_methods_supported?: readonly string[];
 }
 export type Discovery = {

package/dist/oauth/discovery.js

@@ -144,6 +144,11 @@ export async function discover(resourceUrl, deps) {
             return { kind: "malformed", url: asUrl, detail: "insecure_endpoint" };
         }
     }
+    // Optional, but if it is published it takes the same rule: the person's machine code and label go there.
+    const deviceEndpoint = doc.device_authorization_endpoint;
+    if (deviceEndpoint !== undefined && (typeof deviceEndpoint !== "string" || !isAllowedIngestUrl(deviceEndpoint))) {
+        return { kind: "malformed", url: asUrl, detail: "insecure_endpoint" };
+    }
     // Absent means "unstated", and RFC 8414 §2 says a client that needs S256 must
     // not assume it. We need it: it is the only method this client can produce.
     const methods = doc.code_challenge_methods_supported;
@@ -156,6 +161,7 @@ export async function discover(resourceUrl, deps) {
             issuer,
             authorization_endpoint: doc.authorization_endpoint,
             token_endpoint: doc.token_endpoint,
+            ...(typeof deviceEndpoint === "string" ? { device_authorization_endpoint: deviceEndpoint } : {}),
             code_challenge_methods_supported: methods,
         },
     };

package/dist/oauth/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,qBAAqB;AACrB,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AAC/E,mBAAmB;AACnB,MAAM,CAAC,MAAM,yBAAyB,GAAG,yCAAyC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,wFAAwF;AACxF,MAAM,UAAU,MAAM,CAAC,GAAsB;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,eAAe,CAAC;IAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AA0CD,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,IAAmB;IAEnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,uEAAuE;YACvE,sEAAsE;YACtE,mCAAmC;YACnC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,WAAmB,EAAE,IAAmB;IACrE,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAEzD,MAAM,OAAO,GAAI,GAAG,CAAC,IAA4C,CAAC,qBAAqB,CAAC;IACxF,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/E,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,sCAAsC;IACtC,EAAE;IACF,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,EAAE,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAG,EAAE,CAAC,IAA4C,CAAC;IAE5D,kEAAkE;IAClE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE/F,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,GAAG,CAAC,sBAAsB,KAAK,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACxE,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,sEAAsE;IACtE,+EAA+E;IAC/E,+EAA+E;IAC/E,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE;YACR,MAAM;YACN,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;YAClD,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,gCAAgC,EAAE,OAAO;SAC1C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,qBAAqB;AACrB,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AAC/E,mBAAmB;AACnB,MAAM,CAAC,MAAM,yBAAyB,GAAG,yCAAyC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,wFAAwF;AACxF,MAAM,UAAU,MAAM,CAAC,GAAsB;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,eAAe,CAAC;IAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AA+CD,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,IAAmB;IAEnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,uEAAuE;YACvE,sEAAsE;YACtE,mCAAmC;YACnC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,WAAmB,EAAE,IAAmB;IACrE,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAEzD,MAAM,OAAO,GAAI,GAAG,CAAC,IAA4C,CAAC,qBAAqB,CAAC;IACxF,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/E,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,sCAAsC;IACtC,EAAE;IACF,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yBAAyB,EAAE,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAG,EAAE,CAAC,IAA4C,CAAC;IAE5D,kEAAkE;IAClE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE/F,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,GAAG,CAAC,sBAAsB,KAAK,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACxE,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,sEAAsE;IACtE,+EAA+E;IAC/E,+EAA+E;IAC/E,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,yGAAyG;IACzG,MAAM,cAAc,GAAI,GAAmD,CAAC,6BAA6B,CAAC;IAC1G,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAChH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACxE,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,gCAAgC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE;YACR,MAAM;YACN,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;YAClD,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,GAAG,CAAC,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,gCAAgC,EAAE,OAAO;SAC1C;KACF,CAAC;AACJ,CAAC"}

package/dist/oauth/mint.d.ts

@@ -31,13 +31,14 @@
  *   403 { error: "not_a_member" } · 400 · 429 · 500     refused; no retry helps
  * ```
  *
- * ⚠ Only the `token` field is read out of a 201. The rest is the server's
- * record of the row and this client has no use for it: the credential is opaque,
- * and its expiry is the server's to enforce.
+ * ⚠ The `token` field is the only one a mint cannot do without. `credential.id`,
+ * `credential.expires_at` and `account` are read when present and never required
+ * (`MintFacts`): the credential is opaque and its expiry is the server's to
+ * enforce, so these only feed the sidecar the client says "expired" from.
  *
  * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential request and response shapes, retyped
  */
-import { IngestCredential, type AccessToken } from "../credential.js";
+import { IngestCredential, type AccessToken, type MintTicket } from "../credential.js";
 /** Same origin as `/mcp` — one host, one issuer (D73). */
 export declare const MINT_PATH = "/oauth/ingest-credential";
 /** The table's `length(label) between 1 and 128`, mirrored so the server never has to 400. */
@@ -50,11 +51,23 @@ export declare function mintUrl(mcpEndpoint: string): string;
  * the hostname is what they would have typed into the web form anyway.
  */
 export declare function machineLabel(hostname: string): string;
+/**
+ * What the 201 says about the row it just created — all of it OPTIONAL, because a server older than
+ * the `account` field omits it and the credential is still good. The token is the only field this
+ * client cannot do without; these feed the credential-meta sidecar and the 5B block (`R8`, `R10`).
+ */
+export interface MintFacts {
+    readonly credentialId: string | null;
+    readonly expiresAt: string | null;
+    /** The approver's GitHub handle, or null. */
+    readonly account: string | null;
+}
 export type MintOutcome = 
 /** Minted. Not yet saved — the caller writes it through `saveCredential`. */
 {
     readonly kind: "ok";
     readonly credential: IngestCredential;
+    readonly facts: MintFacts;
 }
 /** 401. A FIRST-CLASS outcome so the caller refreshes once and retries once. */
  | {
@@ -94,4 +107,4 @@ export interface MintDeps {
  * refused before the server touches the table, so a retry cannot leave two live
  * credentials where the user expected one.
  */
-export declare function requestMint(endpoint: string, access: AccessToken, label: string, deps: MintDeps): Promise<MintOutcome>;
+export declare function requestMint(endpoint: string, access: AccessToken | MintTicket, label: string, deps: MintDeps): Promise<MintOutcome>;

package/dist/oauth/mint.js

@@ -31,9 +31,10 @@
  *   403 { error: "not_a_member" } · 400 · 429 · 500     refused; no retry helps
  * ```
  *
- * ⚠ Only the `token` field is read out of a 201. The rest is the server's
- * record of the row and this client has no use for it: the credential is opaque,
- * and its expiry is the server's to enforce.
+ * ⚠ The `token` field is the only one a mint cannot do without. `credential.id`,
+ * `credential.expires_at` and `account` are read when present and never required
+ * (`MintFacts`): the credential is opaque and its expiry is the server's to
+ * enforce, so these only feed the sidecar the client says "expired" from.
  *
  * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential request and response shapes, retyped
  */
@@ -71,7 +72,10 @@ export function machineLabel(hostname) {
  * refused before the server touches the table, so a retry cannot leave two live
  * credentials where the user expected one.
  */
-export async function requestMint(endpoint, access, label, deps) {
+export async function requestMint(endpoint, 
+// A session's access token (the loopback path) or a device approval's `vcmt_` ticket (`CR-234`): the
+// route takes either, and this function only ever spends it as the bearer.
+access, label, deps) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), deps.timeoutMs);
     let res;
@@ -115,6 +119,15 @@ export async function requestMint(endpoint, access, label, deps) {
     }
     if (typeof doc.token !== "string" || !MINTED_SHAPE.test(doc.token))
         return { kind: "malformed" };
-    return { kind: "ok", credential: new IngestCredential(doc.token, "file") };
+    const text = (v) => (typeof v === "string" && v !== "" ? v : null);
+    return {
+        kind: "ok",
+        credential: new IngestCredential(doc.token, "file"),
+        facts: {
+            credentialId: text(doc.credential?.id),
+            expiresAt: text(doc.credential?.expires_at),
+            account: text(doc.account),
+        },
+    };
 }
 //# sourceMappingURL=mint.js.map

package/dist/oauth/mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../src/oauth/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAoB,MAAM,kBAAkB,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAE7B,mGAAmG;AACnG,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,mBAAmB,iBAAiB,CAAC,CAAC;AAE1E,6FAA6F;AAC7F,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAyBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,MAAmB,EACnB,KAAa,EACb,IAAc;IAEd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,uEAAuE;gBACvE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE;gBAC1C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,mEAAmE;YACnE,gEAAgE;YAChE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAExD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;IAEjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,sBAAsB;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../src/oauth/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAqC,MAAM,kBAAkB,CAAC;AAE5G,0DAA0D;AAC1D,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAE7B,mGAAmG;AACnG,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,mBAAmB,iBAAiB,CAAC,CAAC;AAE1E,6FAA6F;AAC7F,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAqCD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB;AAChB,qGAAqG;AACrG,2EAA2E;AAC3E,MAAgC,EAChC,KAAa,EACb,IAAc;IAEd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,uEAAuE;gBACvE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE;gBAC1C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,mEAAmE;YACnE,gEAAgE;YAChE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAExD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAKtB,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,sBAAsB;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;QACnD,KAAK,EAAE;YACL,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;SAC3B;KACF,CAAC;AACJ,CAAC"}

package/dist/oauth/retire.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `POST /oauth/ingest-credential/retire` — retire the credential this one replaces (G4).
+ *
+ * ```
+ *   POST <mcp origin>/oauth/ingest-credential/retire
+ *   Authorization: Bearer <the NEW vcik_>         { "old_token": "vcik_…" }
+ *
+ *   200 { "retired": true }     the old credential was revoked with reason 'rotated'
+ *   200 { "retired": false }    the ONE uniform answer for not-found / other user / other org /
+ *                               already revoked / same token — the server never says which
+ *   401 opaque · 400 { "error": "invalid_request" } · 429 retry-after · 404 an older server
+ * ```
+ *
+ * ## Self-revoke (brief A3)
+ *
+ * The same route, body exactly `{ "self": true }`, Bearer = the credential to revoke: the bearer's own
+ * row is revoked (`user_revoke`) and the answer is 200 `{ "retired": true }`. It exists for the one
+ * case the two-token form cannot serve: a re-auth the user DECLINES after the browser landed in a
+ * different workspace. The credential just minted there is the one to remove, and the only credential
+ * this machine holds in that workspace is that one. A 404 (a server without it) or any failure leaves
+ * the credential live and unused, and the caller says where to revoke it.
+ *
+ * Proof of possession: the caller holds BOTH tokens, over the same TLS every ingest already uses.
+ * The old token travels in the body, never in argv or a URL. A 404 means "this server cannot
+ * retire", which the caller prints as "unknown" rather than as a failure — nothing is lost either
+ * way, the old row simply lives until it expires and shows in Settings.
+ *
+ * ⛔ `old_token` IS A SECRET, so nothing in this module renders a response body or an error.
+ *
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential/retire, retyped
+ */
+import type { IngestCredential } from "../credential.js";
+export declare const RETIRE_PATH = "/oauth/ingest-credential/retire";
+export type Retire = 
+/** The server revoked the old credential. */
+{
+    readonly kind: "retired";
+}
+/** 200 `retired: false` — nothing was revoked, and the server will not say why. */
+ | {
+    readonly kind: "not-retired";
+}
+/** 404 — a server that predates the route. */
+ | {
+    readonly kind: "unknown";
+}
+/** Anything else: 401, 400, 429, 5xx, a timeout, a body off-contract. */
+ | {
+    readonly kind: "failed";
+};
+export interface RetireDeps {
+    readonly fetch: typeof fetch;
+    readonly timeoutMs?: number;
+}
+export declare function retireUrl(mcpEndpoint: string): string;
+export declare function retireCredential(mcpEndpoint: string, replacement: IngestCredential, old: IngestCredential, deps: RetireDeps): Promise<Retire>;
+/**
+ * Revoke `credential` with itself as the bearer — see "Self-revoke" above.
+ *
+ * `retired` only on a clean 200 `{ retired: true }`; a 404 is `unknown` (an older server); everything
+ * else — 401, 400, 429, 5xx, a timeout, a body off-contract — is `failed`. Never throws, and the
+ * result carries nothing of the credential.
+ */
+export declare function selfRevokeCredential(mcpEndpoint: string, credential: IngestCredential, deps: RetireDeps): Promise<Retire>;