@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/google-oauth-shared-CwNWYdmR.mjs

@@ -0,0 +1,147 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError, h as LoginCancelledError } from "./error-B3bevhrs.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-BEFNf-jf.mjs";
+import { n as formatGoogleValidationRequiredMessage, t as extractGoogleValidationUrl } from "./google-validation-Cgbn3tWJ.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-oauth-shared.ts
+/**
+* Shared OAuth flow for Google-style providers (Gemini CLI, Antigravity).
+*
+* Both providers use the same authorization-code flow shape; only the client
+* credentials, scopes, endpoint constants, and project-discovery logic differ.
+*/
+/**
+* Per-request timeout for the post-callback provisioning phase (token exchange,
+* user-info, project discovery/onboarding, LRO polling). These Cloud Code
+* Assist calls normally settle in well under this window; a longer stall means
+* a hung endpoint that must surface a login error instead of hanging forever.
+* The callback server's own 300s deadline covers only the browser-callback wait
+* ({@link OAuthCallbackFlow}) and does not gate this phase.
+*/
+const OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+/**
+* Throw {@link AIError.LoginCancelledError} when the controller signal has
+* already aborted. Gates each provisioning round-trip, which the callback-wait
+* cancellation checks in {@link OAuthCallbackFlow} do not reach.
+*/
+function throwIfLoginCancelled(signal) {
+	if (signal?.aborted) throw new LoginCancelledError(`OAuth login cancelled: ${String(signal.reason)}`);
+}
+/**
+* `fetch` for the provisioning phase: composes the controller signal with a
+* per-request timeout so a stalled endpoint aborts instead of hanging login,
+* and user cancellation aborts the in-flight request. Cancellation surfaces as
+* {@link AIError.LoginCancelledError}; a timeout surfaces as an
+* {@link AIError.OAuthError} with `kind: "timeout"`.
+*/
+async function oauthFetch(url, init, { provider, signal, timeoutMs = OAUTH_REQUEST_TIMEOUT_MS }) {
+	const timeoutSignal = AbortSignal.timeout(timeoutMs);
+	const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+	try {
+		return await fetch(url, {
+			...init,
+			signal: requestSignal
+		});
+	} catch (err) {
+		if (signal?.aborted) throw new LoginCancelledError(`OAuth login cancelled: ${String(signal.reason)}`);
+		if (timeoutSignal.aborted) throw new OAuthError(`Timed out after ${timeoutMs}ms waiting for ${url}`, {
+			kind: "timeout",
+			provider
+		});
+		throw err;
+	}
+}
+async function getUserEmail(accessToken, provider, signal) {
+	try {
+		const response = await oauthFetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${accessToken}` } }, {
+			provider,
+			signal
+		});
+		if (response.ok) return (await response.json()).email;
+	} catch {}
+}
+var GoogleOAuthFlow = class extends OAuthCallbackFlow {
+	config;
+	constructor(ctrl, config) {
+		super(ctrl, {
+			preferredPort: config.callbackPort,
+			callbackPath: config.callbackPath,
+			callbackHostname: "127.0.0.1"
+		});
+		this.config = config;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			client_id: this.config.clientId,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: this.config.scopes.join(" "),
+			state,
+			access_type: "offline",
+			prompt: "consent"
+		});
+		return {
+			url: `${this.config.authUrl}?${authParams.toString()}`,
+			instructions: "Complete the sign-in in your browser."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		const { provider } = this.config;
+		const signal = this.ctrl.signal;
+		throwIfLoginCancelled(signal);
+		this.ctrl.onProgress?.("Exchanging authorization code for tokens...");
+		const tokenResponse = await oauthFetch(this.config.tokenUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.config.clientId,
+				client_secret: this.config.clientSecret,
+				code,
+				grant_type: "authorization_code",
+				redirect_uri: redirectUri
+			})
+		}, {
+			provider,
+			signal
+		});
+		if (!tokenResponse.ok) {
+			const error = await tokenResponse.text();
+			throw new OAuthError(`Token exchange failed: ${error}`, {
+				kind: "token-exchange",
+				provider
+			});
+		}
+		const tokenData = await tokenResponse.json();
+		if (!tokenData.refresh_token) throw new OAuthError("No refresh token received. Please try again.", {
+			kind: "validation",
+			provider
+		});
+		throwIfLoginCancelled(signal);
+		this.ctrl.onProgress?.("Getting user info...");
+		const email = await getUserEmail(tokenData.access_token, provider, signal);
+		throwIfLoginCancelled(signal);
+		let projectId;
+		try {
+			projectId = await this.config.discoverProject(tokenData.access_token, this.ctrl.onProgress, signal);
+		} catch (err) {
+			const validationUrl = extractGoogleValidationUrl(err instanceof Error ? err.message : String(err));
+			if (!validationUrl) throw err;
+			throw new OAuthError(formatGoogleValidationRequiredMessage(validationUrl, "sign in again", email), {
+				kind: "validation",
+				provider
+			});
+		}
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1e3 - 3e5,
+			projectId,
+			email
+		};
+	}
+};
+async function runGoogleOAuthLogin(ctrl, config) {
+	return new GoogleOAuthFlow(ctrl, config).login();
+}
+//#endregion
+export { runGoogleOAuthLogin as n, throwIfLoginCancelled as r, oauthFetch as t };

package/lib/google-oauth-shared-yqlyqPPC.mjs

@@ -0,0 +1,147 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-DDSrZ6l_.mjs";
+import { n as formatGoogleValidationRequiredMessage, t as extractGoogleValidationUrl } from "./google-validation-Cgbn3tWJ.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-oauth-shared.ts
+/**
+* Shared OAuth flow for Google-style providers (Gemini CLI, Antigravity).
+*
+* Both providers use the same authorization-code flow shape; only the client
+* credentials, scopes, endpoint constants, and project-discovery logic differ.
+*/
+/**
+* Per-request timeout for the post-callback provisioning phase (token exchange,
+* user-info, project discovery/onboarding, LRO polling). These Cloud Code
+* Assist calls normally settle in well under this window; a longer stall means
+* a hung endpoint that must surface a login error instead of hanging forever.
+* The callback server's own 300s deadline covers only the browser-callback wait
+* ({@link OAuthCallbackFlow}) and does not gate this phase.
+*/
+const OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+/**
+* Throw {@link AIError.LoginCancelledError} when the controller signal has
+* already aborted. Gates each provisioning round-trip, which the callback-wait
+* cancellation checks in {@link OAuthCallbackFlow} do not reach.
+*/
+function throwIfLoginCancelled(signal) {
+	if (signal?.aborted) throw new LoginCancelledError(`OAuth login cancelled: ${String(signal.reason)}`);
+}
+/**
+* `fetch` for the provisioning phase: composes the controller signal with a
+* per-request timeout so a stalled endpoint aborts instead of hanging login,
+* and user cancellation aborts the in-flight request. Cancellation surfaces as
+* {@link AIError.LoginCancelledError}; a timeout surfaces as an
+* {@link AIError.OAuthError} with `kind: "timeout"`.
+*/
+async function oauthFetch(url, init, { provider, signal, timeoutMs = OAUTH_REQUEST_TIMEOUT_MS }) {
+	const timeoutSignal = AbortSignal.timeout(timeoutMs);
+	const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+	try {
+		return await fetch(url, {
+			...init,
+			signal: requestSignal
+		});
+	} catch (err) {
+		if (signal?.aborted) throw new LoginCancelledError(`OAuth login cancelled: ${String(signal.reason)}`);
+		if (timeoutSignal.aborted) throw new OAuthError(`Timed out after ${timeoutMs}ms waiting for ${url}`, {
+			kind: "timeout",
+			provider
+		});
+		throw err;
+	}
+}
+async function getUserEmail(accessToken, provider, signal) {
+	try {
+		const response = await oauthFetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${accessToken}` } }, {
+			provider,
+			signal
+		});
+		if (response.ok) return (await response.json()).email;
+	} catch {}
+}
+var GoogleOAuthFlow = class extends OAuthCallbackFlow {
+	config;
+	constructor(ctrl, config) {
+		super(ctrl, {
+			preferredPort: config.callbackPort,
+			callbackPath: config.callbackPath,
+			callbackHostname: "127.0.0.1"
+		});
+		this.config = config;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			client_id: this.config.clientId,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: this.config.scopes.join(" "),
+			state,
+			access_type: "offline",
+			prompt: "consent"
+		});
+		return {
+			url: `${this.config.authUrl}?${authParams.toString()}`,
+			instructions: "Complete the sign-in in your browser."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		const { provider } = this.config;
+		const signal = this.ctrl.signal;
+		throwIfLoginCancelled(signal);
+		this.ctrl.onProgress?.("Exchanging authorization code for tokens...");
+		const tokenResponse = await oauthFetch(this.config.tokenUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.config.clientId,
+				client_secret: this.config.clientSecret,
+				code,
+				grant_type: "authorization_code",
+				redirect_uri: redirectUri
+			})
+		}, {
+			provider,
+			signal
+		});
+		if (!tokenResponse.ok) {
+			const error = await tokenResponse.text();
+			throw new OAuthError(`Token exchange failed: ${error}`, {
+				kind: "token-exchange",
+				provider
+			});
+		}
+		const tokenData = await tokenResponse.json();
+		if (!tokenData.refresh_token) throw new OAuthError("No refresh token received. Please try again.", {
+			kind: "validation",
+			provider
+		});
+		throwIfLoginCancelled(signal);
+		this.ctrl.onProgress?.("Getting user info...");
+		const email = await getUserEmail(tokenData.access_token, provider, signal);
+		throwIfLoginCancelled(signal);
+		let projectId;
+		try {
+			projectId = await this.config.discoverProject(tokenData.access_token, this.ctrl.onProgress, signal);
+		} catch (err) {
+			const validationUrl = extractGoogleValidationUrl(err instanceof Error ? err.message : String(err));
+			if (!validationUrl) throw err;
+			throw new OAuthError(formatGoogleValidationRequiredMessage(validationUrl, "sign in again", email), {
+				kind: "validation",
+				provider
+			});
+		}
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1e3 - 3e5,
+			projectId,
+			email
+		};
+	}
+};
+async function runGoogleOAuthLogin(ctrl, config) {
+	return new GoogleOAuthFlow(ctrl, config).login();
+}
+//#endregion
+export { runGoogleOAuthLogin as n, throwIfLoginCancelled as r, oauthFetch as t };