@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/{muse-code-CNvqqAp6.mjs → muse-code-CYf8zj_B.mjs}

@@ -1,9 +1,9 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { r as __exportAll } from "./fs-promises-shim-B2YFWkcd.mjs";
-import { f as OAuthError, t as ConfigurationError } from "./error-O63pC8zg.mjs";
+import { i as __exportAll } from "./fs-promises-shim-CANAxFWh.mjs";
+import { h as OAuthError, t as ConfigurationError } from "./error-8LVo7tug.mjs";
 import { type } from "@oh-my-pi/omptype";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/muse-code.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/muse-code.ts
 var muse_code_exports = /* @__PURE__ */ __exportAll({
 	attachMuseCodeApiKey: () => attachMuseCodeApiKey,
 	parseMuseCodeCredential: () => parseMuseCodeCredential,
@@ -30,8 +30,8 @@ const museCodeKeyResponseSchema = type({
 	"user_email?": "string",
 	"user_id?": "string",
 	"is_subs_active?": "boolean",
-	"subs_tier_id?": "string",
-	"subs_tier_name?": "string",
+	"subs_tier_id?": "string | null",
+	"subs_tier_name?": "string | null",
 	"subs_usage?": subscriptionUsageSchema.or("null")
 });
 const museCodeCredentialSchema = type({

package/lib/{openai-codex-D5-CyTxa.mjs → openai-codex-Cj-TvSFh.mjs}

@@ -1,9 +1,10 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { f as OAuthError, m as LoginCancelledError } from "./error-O63pC8zg.mjs";
-import "./utils-cZX3f_Ls.mjs";
-import { n as isRecord } from "./type-guards-CttAANEx.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/openai-codex.ts
+import { _ as LoginCancelledError, h as OAuthError } from "./error-8LVo7tug.mjs";
+import "./utils-C_Ncya1r.mjs";
+import { h as isRecord } from "./cascade-BWjRTD1q.mjs";
+import "./id-EJwVLDHE.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/openai-codex.ts
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
 const JWT_CLAIM_PATH = "https://api.openai.com/auth";
@@ -64,7 +65,7 @@ function describeTokenEndpointValue(value) {
 const openAICodexProfileHook = async (credentials, context) => {
 	const idToken = isRecord(context.raw) && typeof context.raw.id_token === "string" ? context.raw.id_token : void 0;
 	const { accountId, email, planType } = getTokenProfile(credentials.access, idToken);
-	if (context.phase === "login" && !accountId) throw new OAuthError("Failed to extract accountId from token", {
+	if (context.phase === "login" && !accountId && !email) throw new OAuthError("Failed to extract account identity from token", {
 		kind: "validation",
 		provider: context.provider
 	});
@@ -119,15 +120,17 @@ async function exchangeCodeForToken(code, verifier, redirectUri, fetchImpl = fet
 	const tokenData = await tokenResponse.json();
 	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") throw new OAuthError("Token response missing required fields", { kind: "validation" });
 	const { accountId, email, planType } = getTokenProfile(tokenData.access_token, tokenData.id_token);
-	if (!accountId) throw new OAuthError("Failed to extract accountId from token", { kind: "validation" });
+	if (!accountId && !email) throw new OAuthError("Failed to extract account identity from token", { kind: "validation" });
 	return {
 		access: tokenData.access_token,
 		refresh: tokenData.refresh_token,
 		expires: Date.now() + tokenData.expires_in * 1e3,
-		accountId,
-		email,
-		orgId: accountId,
-		orgName: planType
+		...accountId ? {
+			accountId,
+			orgId: accountId
+		} : {},
+		...email ? { email } : {},
+		...planType ? { orgName: planType } : {}
 	};
 }
 /**

package/lib/{perplexity-A2PEoGaC.mjs → perplexity-Dh_Qgsmx.mjs}

@@ -1,21 +1,12 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { E as CookieMap, N as $env, T as Cookie, w as $ } from "./src-AELUUb5U.mjs";
-import { V as ProviderHttpError, f as OAuthError, g as OnPromptRequiredError, m as LoginCancelledError } from "./error-O63pC8zg.mjs";
+import { F as CookieMap, H as $env, N as $, P as Cookie } from "./src-BhinCSpi.mjs";
+import { X as ProviderHttpError, _ as LoginCancelledError, h as OAuthError, y as OnPromptRequiredError } from "./error-8LVo7tug.mjs";
 import * as os from "node:os";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/perplexity.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/perplexity.ts
 /**
-* Perplexity login and token refresh.
-*
-* Login paths (in priority order):
-* 1. macOS native app: reads JWT from NSUserDefaults (`defaults read ai.perplexity.mac authToken`)
-* 2. HTTP email OTP: `GET /api/auth/csrf` → `POST /api/auth/signin-email` → `POST /api/auth/signin-otp`
-*
-* No browser or manual cookie paste required.
-* Refresh: Socket.IO `refreshJWT` RPC over authenticated WebSocket connection.
-*
-* Protocol: Engine.IO v4 + Socket.IO v4 over WebSocket (bypasses Cloudflare managed challenge).
-* Architecture reverse-engineered from Perplexity macOS app (ai.perplexity.mac).
+* Perplexity login via legacy macOS session borrowing, host-managed browser SSO,
+* or HTTP email OTP (including authenticator challenges).
 */
 const API_VERSION = "2.18";
 const NATIVE_APP_BUNDLE = "ai.perplexity.mac";
@@ -58,10 +49,7 @@ function jwtToCredentials(jwt, email) {
 		email
 	};
 }
-/**
-* Read the Perplexity JWT from the native macOS Catalyst app's UserDefaults.
-* Tokens are stored in NSUserDefaults (not Keychain), readable by any same-UID process.
-*/
+/** Read the legacy ai.perplexity.mac app's session; newer Mac apps use a restricted Keychain. */
 async function extractFromNativeApp() {
 	if (os.platform() !== "darwin") return null;
 	try {
@@ -214,23 +202,78 @@ async function httpEmailLogin(ctrl) {
 	}
 	return jwtToCredentials(token, trimmedEmail);
 }
-/**
-* Login to Perplexity.
-*
-* Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
-*
-* No browser/manual token paste fallback is used.
-*/
+const SESSION_COOKIE_NAME = "__Secure-next-auth.session-token";
+const PERPLEXITY_BASE_URL = "https://www.perplexity.ai";
+async function browserSsoLogin(ctrl) {
+	if (!ctrl.onBrowserSession) throw new OAuthError("Browser SSO is unavailable in this client", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	ctrl.onProgress?.("Complete Perplexity sign-in in the browser window. Choose SSO for your organization.");
+	const token = (await ctrl.onBrowserSession({
+		url: `${PERPLEXITY_BASE_URL}/auth/signin`,
+		cookieNames: [SESSION_COOKIE_NAME, "next-auth.session-token"]
+	}, ctrl.signal)).trim();
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	if (!token || /[\s;]/.test(token)) throw new OAuthError("Perplexity SSO captured an invalid session cookie", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	ctrl.onProgress?.("Validating Perplexity session...");
+	const response = await (ctrl.fetch ?? fetch)(`${PERPLEXITY_BASE_URL}/api/auth/session`, {
+		headers: {
+			Cookie: `${SESSION_COOKIE_NAME}=${token}`,
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION
+		},
+		redirect: "error",
+		signal: ctrl.signal
+	});
+	if (!response.ok) throw new ProviderHttpError(`Perplexity session validation failed (${response.status})`, response.status);
+	let email;
+	try {
+		email = (await response.json())?.user?.email;
+	} catch (error) {
+		if (ctrl.signal?.aborted) throw new LoginCancelledError();
+		if (!(error instanceof SyntaxError)) throw error;
+		throw new OAuthError("Perplexity returned an invalid session response", {
+			kind: "validation",
+			provider: "perplexity"
+		});
+	}
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	if (typeof email !== "string" || !email.trim()) throw new OAuthError("Perplexity session is invalid or expired. Sign in again.", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	return jwtToCredentials(token, email.trim());
+}
+/** Prefer legacy app borrowing, then offer browser SSO when the host supports it. */
 async function loginPerplexity(ctrl) {
 	if (!ctrl.onPrompt) throw new OnPromptRequiredError("Perplexity");
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
 	if (!$env.PI_AUTH_NO_BORROW) {
 		ctrl.onProgress?.("Checking for Perplexity desktop app...");
 		const nativeJwt = await extractFromNativeApp();
+		if (ctrl.signal?.aborted) throw new LoginCancelledError();
 		if (nativeJwt) {
 			ctrl.onProgress?.("Found Perplexity JWT from native app");
 			return jwtToCredentials(nativeJwt);
 		}
 	}
+	if (ctrl.onBrowserSession) {
+		const method = (await ctrl.onPrompt({
+			message: "Login method: sso (browser) or email; blank for sso",
+			placeholder: "sso / email",
+			allowEmpty: true
+		})).trim().toLowerCase();
+		if (ctrl.signal?.aborted) throw new LoginCancelledError();
+		if (!method || method === "sso") return browserSsoLogin(ctrl);
+		if (method !== "email") throw new OAuthError("Choose sso or email for Perplexity login", {
+			kind: "validation",
+			provider: "perplexity"
+		});
+	}
 	return httpEmailLogin(ctrl);
 }
 //#endregion

package/lib/{pkce-BYjmugmw.mjs → pkce-DO-jBJLV.mjs}

@@ -1,6 +1,6 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/pkce.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/pkce.ts
 /**
 * Generate PKCE code verifier and challenge.
 * Uses Web Crypto API for cross-platform compatibility.