alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/lib/Auth/Inspect.js

@@ -0,0 +1,67 @@
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Result from "effect/Result";
+import { reconfigureHint, } from "./AuthProvider.js";
+const broken = (name, method, severity, code, message) => ({
+    name,
+    method,
+    status: severity === "warning" ? "needs-reauth" : "invalid",
+    details: [],
+    diagnostic: { severity, code, message },
+});
+/**
+ * Resolve one stored provider's live connection status. Never fails: every
+ * way this can go wrong is reported as a `status` + `diagnostic` so a listing
+ * can show the whole profile.
+ */
+export const inspectProvider = Effect.fn("inspectProvider")(function* (profile, name, config, registered, updateConfig) {
+    const method = config.method ?? "unknown";
+    const provider = registered[name];
+    if (provider === undefined) {
+        return {
+            name,
+            method,
+            status: "unavailable",
+            details: [],
+            diagnostic: {
+                severity: "warning",
+                code: "provider.unregistered",
+                message: `Provider '${name}' is not registered.`,
+            },
+        };
+    }
+    // A deliberately empty migrated document records that the provider was
+    // connected in v0 while making no claim that its obsolete credentials are
+    // usable. Keep that distinct from malformed provider-owned values.
+    if (config.method === undefined) {
+        return {
+            name,
+            method,
+            status: "needs-reconfigure",
+            details: [],
+            diagnostic: {
+                severity: "warning",
+                code: "provider.needs-reconfigure",
+                message: `Provider '${name}' needs to be reconfigured. ${reconfigureHint(name, profile)}`,
+            },
+        };
+    }
+    const decoded = yield* Effect.result(provider.decodeConfig(profile, config));
+    if (Result.isFailure(decoded)) {
+        return broken(name, method, "error", "provider.invalid-config", decoded.failure.message);
+    }
+    const details = yield* Effect.result(provider.details(profile, decoded.success, updateConfig));
+    if (Result.isSuccess(details)) {
+        return {
+            name,
+            method,
+            status: "connected",
+            details: details.success.lines,
+        };
+    }
+    // A provider that can no longer prove who it is has expired credentials,
+    // which the user can fix by re-authenticating — not a broken config.
+    const needsReauth = Predicate.isTagged("NeedsReauth")(details.failure);
+    return broken(name, method, needsReauth ? "warning" : "error", needsReauth ? "provider.needs-reauth" : "provider.details-failed", details.failure.message);
+});
+//# sourceMappingURL=Inspect.js.map

package/lib/Auth/Inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Inspect.js","sourceRoot":"","sources":["../../src/Auth/Inspect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAEL,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AA4B3B,MAAM,MAAM,GAAG,CACb,IAAY,EACZ,MAAc,EACd,QAA6B,EAC7B,IAAY,EACZ,OAAe,EACK,EAAE,CAAC,CAAC;IACxB,IAAI;IACJ,MAAM;IACN,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;IAC3D,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;CACxC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EACnE,OAAe,EACf,IAAY,EACZ,MAAsB,EACtB,UAAoC,EACpC,YAAyE;IAEzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,aAAa,IAAI,sBAAsB;aACjD;SAC2B,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,aAAa,IAAI,+BAA+B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;aAC1F;SAC2B,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,EACN,OAAO,EACP,yBAAyB,EACzB,OAAO,CAAC,OAAO,CAAC,OAAO,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAClC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CACzD,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;SACF,CAAC;IACjC,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,EACN,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EACjC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,EACjE,OAAO,CAAC,OAAO,CAAC,OAAO,CACxB,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/lib/Auth/Lock.d.ts

@@ -48,4 +48,10 @@ export declare const withLock: <A, E, R>(key: string, effect: Effect.Effect<A, E
      */
     readonly stallInterval?: Duration.Input;
 }) => Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | Exclude<R, import("effect/Scope").Scope>>;
+/**
+ * Serialize an operation with every credential mutation for a profile. The
+ * lock key is shared by every credential operation for the profile,
+ * including profile-wide rename and delete operations.
+ */
+export declare const withProfileCredentialsLock: <A, E, R>(profileName: string, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | Exclude<R, import("effect/Scope").Scope>>;
 //# sourceMappingURL=Lock.d.ts.map

package/lib/Auth/Lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Lock.d.ts","sourceRoot":"","sources":["../../src/Auth/Lock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAyBpC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,MACR,CAAC;AA6HvC;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OACzB,MAAM,UACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,YACpB;IACR,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CACzC,sGAyCF,CAAC"}
+{"version":3,"file":"Lock.d.ts","sourceRoot":"","sources":["../../src/Auth/Lock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAyBpC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,MACR,CAAC;AAqIvC;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OACzB,MAAM,UACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,YACpB;IACR,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CACzC,sGAsCF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,eACnC,MAAM,UACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,sGAC2B,CAAC"}

package/lib/Auth/Lock.js

@@ -8,7 +8,7 @@ import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Schedule from "effect/Schedule";
 import * as Semaphore from "effect/Semaphore";
-import { rootDir } from "./Profile.js";
+import { rootDir } from "./Paths.js";
 const semaphores = new Map();
 // Keep STALE well above REFRESH — a saturated machine can starve the
 // heartbeat fiber for seconds.
@@ -87,16 +87,24 @@ const acquireFileLock = Effect.fn(function* (lockPath, timeout) {
  * the terminal. The whole point of this notice is to reach the user who is
  * watching a frozen terminal, so it must not go through the logger.
  */
-const stallNotice = (lockPath, label, phase, interval) => Effect.suspend(() => {
-    let seconds = 0;
-    return Effect.suspend(() => {
-        seconds += Duration.toSeconds(interval);
-        return Console.error(phase.current === "waiting"
+const stallNotice = (lockPath, label, phase, interval) => Effect.gen(function* () {
+    const start = yield* Clock.currentTimeMillis;
+    const notice = Effect.gen(function* () {
+        // Report real elapsed time, not an accumulated interval count — the
+        // notice cadence and the reported wait must not drift apart.
+        const now = yield* Clock.currentTimeMillis;
+        const seconds = Math.round((now - start) / 1000);
+        yield* Console.error(phase.current === "waiting"
             ? `alchemy: ${seconds}s waiting for the auth lock '${lockPath}' (${label}). ` +
                 `Another alchemy process holds it; if none is running, delete that directory.`
             : `alchemy: ${label} has been running for ${seconds}s while holding the auth lock ` +
                 `'${lockPath}'. Re-run with --log-level debug for detail.`);
-    }).pipe(Effect.delay(interval), Effect.repeat(Schedule.spaced(interval)));
+    });
+    // `Effect.schedule` (unlike `Effect.repeat`) consults the schedule
+    // before the first run, and `Schedule.fixed`'s first recurrence comes
+    // after one full interval — so notices fire at interval, 2*interval, …
+    // on true wall-clock boundaries.
+    yield* Effect.schedule(notice, Schedule.fixed(interval));
 });
 /**
  * Serialise execution of `effect` for the same `key`, both within this
@@ -118,10 +126,7 @@ export const withLock = (key, effect, options) => {
     }
     return semaphore.withPermit(Effect.gen(function* () {
         const path = yield* Path.Path;
-        // Read `rootDir` here, not at module eval, so the
-        // `Profile -> AuthProvider -> Lock -> Profile` import cycle never
-        // sees it uninitialised.
-        const lockPath = path.join(rootDir, "lock", `${safeKey}.lock`);
+        const lockPath = path.join(rootDir(), "lock", `${safeKey}.lock`);
         const phase = { current: "waiting" };
         if (options?.watchdog !== false) {
             yield* Effect.forkScoped(stallNotice(lockPath, label, phase, options?.stallInterval ?? STALL_INTERVAL));
@@ -133,4 +138,10 @@ export const withLock = (key, effect, options) => {
         return yield* effect.pipe(Effect.onExit(() => Effect.logDebug(`auth lock: releasing '${lockPath}' for ${label}`)));
     }).pipe(Effect.scoped));
 };
+/**
+ * Serialize an operation with every credential mutation for a profile. The
+ * lock key is shared by every credential operation for the profile,
+ * including profile-wide rename and delete operations.
+ */
+export const withProfileCredentialsLock = (profileName, effect) => withLock(`profile-credentials-${profileName}`, effect);
 //# sourceMappingURL=Lock.js.map

package/lib/Auth/Lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"Lock.js","sourceRoot":"","sources":["../../src/Auth/Lock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE1D,qEAAqE;AACrE,+BAA+B;AAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5C,4EAA4E;AAC5E,6DAA6D;AAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE5C,MAAM,QAAS,SAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;CAAG;AAEtD,MAAM,WAAY,SAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAItD;CAAG;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CACrD,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAEvC;;;GAGG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACzC,QAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5D,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,iEAAiE;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,IAAI,CAAC,KAAK,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,OAAO,CACZ,EAAE;SACC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC;SACjC,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,EAAE;SACC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAClD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvB,CACF,CACJ,EACD,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,EAAE,CACxD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC5D,EACD,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;QAC3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CACrC;KACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,GAAG,CACR,IAAI,WAAW,CAAC;QACd,QAAQ;QACR,OAAO;QACP,OAAO,EACL,gDAAgD,QAAQ,sBAAsB;YAC9E,gCAAgC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB;YAC5E,kEAAkE;KACrE,CAAC,CACH,CACF,CACF,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,EACnD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACrE,MAAM,CAAC,MAAM,CACd,CACF,CAAC;IAEF,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,EACnD,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CACjE;IACD,gEAAgE;IAChE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EACtD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EACvC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,UAAU,CACf,wCAAwC,QAAQ,sCAAsC,CACvF,CACF;IACD,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAClB,CAAC;AACJ,CAAC,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,CAClB,QAAgB,EAChB,KAAa,EACb,KAAY,EACZ,QAAwB,EACxB,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QACzB,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,KAAK,CAClB,KAAK,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,YAAY,OAAO,gCAAgC,QAAQ,MAAM,KAAK,KAAK;gBACzE,8EAA8E;YAClF,CAAC,CAAC,YAAY,KAAK,yBAAyB,OAAO,gCAAgC;gBAC/E,IAAI,QAAQ,8CAA8C,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,GAAW,EACX,MAA8B,EAC9B,OAuBC,EACD,EAAE;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,GAAG,CAAC;IACpC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,kDAAkD;QAClD,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC5C,IAAI,OAAO,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,WAAW,CACT,QAAQ,EACR,KAAK,EACL,KAAK,EACL,OAAO,EAAE,aAAa,IAAI,cAAc,CACzC,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,QAAQ,SAAS,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,CAAC,eAAe,CACpB,QAAQ,EACR,OAAO,EAAE,OAAO,IAAI,eAAe,CACpC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QACvB,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,QAAQ,SAAS,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,QAAQ,CAAC,yBAAyB,QAAQ,SAAS,KAAK,EAAE,CAAC,CACnE,CACF,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"Lock.js","sourceRoot":"","sources":["../../src/Auth/Lock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE1D,qEAAqE;AACrE,+BAA+B;AAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5C,4EAA4E;AAC5E,6DAA6D;AAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE5C,MAAM,QAAS,SAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;CAAG;AAEtD,MAAM,WAAY,SAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAItD;CAAG;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CACrD,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAEvC;;;GAGG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACzC,QAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5D,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,iEAAiE;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,IAAI,CAAC,KAAK,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,kEAAkE;IAClE,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,OAAO,CACZ,EAAE;SACC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC;SACjC,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,EAAE;SACC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAClD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvB,CACF,CACJ,EACD,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,EAAE,CACxD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC5D,EACD,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;QAC3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CACrC;KACF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,GAAG,CACR,IAAI,WAAW,CAAC;QACd,QAAQ;QACR,OAAO;QACP,OAAO,EACL,gDAAgD,QAAQ,sBAAsB;YAC9E,gCAAgC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB;YAC5E,kEAAkE;KACrE,CAAC,CACH,CACF,CACF,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,EACnD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACrE,MAAM,CAAC,MAAM,CACd,CACF,CAAC;IAEF,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,EACnD,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CACjE;IACD,gEAAgE;IAChE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EACtD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EACvC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,UAAU,CACf,wCAAwC,QAAQ,sCAAsC,CACvF,CACF;IACD,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAClB,CAAC;AACJ,CAAC,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,CAClB,QAAgB,EAChB,KAAa,EACb,KAAY,EACZ,QAAwB,EACxB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,oEAAoE;QACpE,6DAA6D;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAClB,KAAK,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,YAAY,OAAO,gCAAgC,QAAQ,MAAM,KAAK,KAAK;gBACzE,8EAA8E;YAClF,CAAC,CAAC,YAAY,KAAK,yBAAyB,OAAO,gCAAgC;gBAC/E,IAAI,QAAQ,8CAA8C,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,iCAAiC;IACjC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,GAAW,EACX,MAA8B,EAC9B,OAuBC,EACD,EAAE;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,GAAG,CAAC;IACpC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;QACjE,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC5C,IAAI,OAAO,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,WAAW,CACT,QAAQ,EACR,KAAK,EACL,KAAK,EACL,OAAO,EAAE,aAAa,IAAI,cAAc,CACzC,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,QAAQ,SAAS,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,CAAC,eAAe,CACpB,QAAQ,EACR,OAAO,EAAE,OAAO,IAAI,eAAe,CACpC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QACvB,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,QAAQ,SAAS,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,QAAQ,CAAC,yBAAyB,QAAQ,SAAS,KAAK,EAAE,CAAC,CACnE,CACF,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,WAAmB,EACnB,MAA8B,EAC9B,EAAE,CAAC,QAAQ,CAAC,uBAAuB,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC"}

package/lib/Auth/OAuthFlow.d.ts

@@ -0,0 +1,119 @@
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+declare const OAuthError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthError";
+} & Readonly<A>;
+export declare class OAuthError extends OAuthError_base<{
+    error: string;
+    errorDescription: string;
+}> {
+}
+declare const CallbackServerStartError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CallbackServerStartError";
+} & Readonly<A>;
+/**
+ * The local loopback callback server could not start (typically the port is
+ * already taken). Distinct from {@link OAuthError} so callers can fall back to
+ * manual code entry instead of failing the whole flow.
+ */
+export declare class CallbackServerStartError extends CallbackServerStartError_base<{
+    message: string;
+}> {
+}
+/**
+ * On-disk shape of OAuth credentials persisted under
+ * `~/.alchemy/credentials/{profile}/<provider>-oauth.json`.
+ *
+ * `clientId` is optional because files written before the client id was
+ * recorded must still parse — {@link OAuthClient.usesCurrentClient} treats a
+ * missing id as "issued to a previous client", which triggers a clean
+ * re-login.
+ */
+export declare const OAuthCredentials: Schema.Struct<{
+    readonly type: Schema.Literal<"oauth">;
+    readonly clientId: Schema.optional<Schema.String>;
+    readonly access: Schema.RedactedFromValue<Schema.String>;
+    readonly refresh: Schema.RedactedFromValue<Schema.String>;
+    readonly expires: Schema.Number;
+    readonly scopes: Schema.mutable<Schema.$Array<Schema.String>>;
+}>;
+export type OAuthCredentials = typeof OAuthCredentials.Type;
+export interface Authorization {
+    url: string;
+    state: string;
+    /** PKCE verifier; present only for `auth: { kind: "pkce" }` clients. */
+    verifier?: string;
+}
+/**
+ * The provider-specific facts a browser OAuth flow needs. Everything else —
+ * state/PKCE generation, the loopback callback server, hosted-relay code
+ * extraction, token exchange, refresh, revoke — is shared.
+ */
+export interface OAuthClientSpec {
+    readonly clientId: string;
+    readonly endpoints: {
+        readonly authorize: string;
+        readonly token: string;
+        /** Providers without a revocation endpoint omit it; `revoke` then no-ops. */
+        readonly revoke?: string;
+    };
+    /** Hosted relay redirect URI registered with the OAuth application. */
+    readonly redirectUri: string;
+    /** Loopback URI the local callback server listens on. */
+    readonly localCallbackUri: string;
+    /**
+     * Client authentication. `pkce` for public clients; `clientSecret` for
+     * providers whose token endpoint requires client authentication for every
+     * grant (the secret ships in the CLI — same exposure posture as a public
+     * client id, rotated by cutting a release).
+     */
+    readonly auth: {
+        readonly kind: "pkce";
+    } | {
+        readonly kind: "clientSecret";
+        readonly clientSecret: Redacted.Redacted<string>;
+    };
+    /**
+     * How token-request parameters travel: URL-encoded POST body (the OAuth 2
+     * standard, default) or the query string (PlanetScale's documented form).
+     */
+    readonly tokenTransport?: "body" | "query";
+}
+export interface OAuthClient {
+    readonly clientId: string;
+    /** Whether persisted credentials were issued to this client. */
+    readonly usesCurrentClient: (credentials: {
+        readonly clientId?: unknown;
+    }) => boolean;
+    /**
+     * Generate an authorization URL. Pass `scopes` only for providers that
+     * take them per-authorization; omit for providers whose scopes are
+     * configured on the application.
+     */
+    readonly authorize: (scopes?: ReadonlyArray<string>) => Effect.Effect<Authorization, OAuthError, Crypto.Crypto>;
+    /**
+     * Exchange an authorization code directly. `authorization` supplies the
+     * PKCE verifier; omit for non-PKCE clients (tests, relay-less flows).
+     */
+    readonly exchange: (code: string, authorization?: Authorization) => Effect.Effect<OAuthCredentials, OAuthError, never>;
+    /**
+     * Exchange a code copied from the hosted relay page, or extract the code
+     * from either the hosted or loopback callback URL.
+     */
+    readonly exchangeCallbackInput: (input: string, authorization: Authorization) => Effect.Effect<OAuthCredentials, OAuthError, never>;
+    /**
+     * Start a local HTTP server to listen for the OAuth callback, exchange
+     * the authorization code, and return the credentials. Times out after 5
+     * minutes.
+     */
+    readonly callback: (authorization: Authorization) => Effect.Effect<OAuthCredentials, OAuthError | CallbackServerStartError, never>;
+    /** Refresh expired OAuth credentials with the stored refresh token. */
+    readonly refresh: (credentials: OAuthCredentials) => Effect.Effect<OAuthCredentials, OAuthError, never>;
+    /** Revoke the refresh token; no-op when the spec has no revoke endpoint. */
+    readonly revoke: (credentials: OAuthCredentials) => Effect.Effect<void, OAuthError>;
+}
+export declare const makeOAuthClient: (spec: OAuthClientSpec) => OAuthClient;
+export {};
+//# sourceMappingURL=OAuthFlow.d.ts.map

package/lib/Auth/OAuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthFlow.d.ts","sourceRoot":"","sources":["../../src/Auth/OAuthFlow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;;;AAQxC,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;;;;AAEL;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,8BAE5C;IACA,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;;;;EAO3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,6EAA6E;QAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EACT;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzB;QACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAClD,CAAC;IACN;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE;QACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;KAC7B,KAAK,OAAO,CAAC;IACd;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,CAClB,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,aAAa,KAC1B,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,aAAa,KACzB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,aAAa,EAAE,aAAa,KACzB,MAAM,CAAC,MAAM,CAChB,gBAAgB,EAChB,UAAU,GAAG,wBAAwB,EACrC,KAAK,CACN,CAAC;IACF,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAChB,WAAW,EAAE,gBAAgB,KAC1B,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACxD,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,CACf,WAAW,EAAE,gBAAgB,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;CACtC;AA6CD,eAAO,MAAM,eAAe,SAAU,eAAe,KAAG,WA2WvD,CAAC"}

package/lib/Auth/OAuthFlow.js

@@ -0,0 +1,314 @@
+import * as Data from "effect/Data";
+import * as Clock from "effect/Clock";
+import * as Crypto from "effect/Crypto";
+import * as Encoding from "effect/Encoding";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import http from "node:http";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { AUTH_ERROR_URL, AUTH_SUCCESS_URL } from "./AuthProvider.js";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+export class OAuthError extends Data.TaggedError("OAuthError") {
+}
+/**
+ * The local loopback callback server could not start (typically the port is
+ * already taken). Distinct from {@link OAuthError} so callers can fall back to
+ * manual code entry instead of failing the whole flow.
+ */
+export class CallbackServerStartError extends Data.TaggedError("CallbackServerStartError") {
+}
+/**
+ * On-disk shape of OAuth credentials persisted under
+ * `~/.alchemy/credentials/{profile}/<provider>-oauth.json`.
+ *
+ * `clientId` is optional because files written before the client id was
+ * recorded must still parse — {@link OAuthClient.usesCurrentClient} treats a
+ * missing id as "issued to a previous client", which triggers a clean
+ * re-login.
+ */
+export const OAuthCredentials = Schema.Struct({
+    type: Schema.Literal("oauth"),
+    clientId: Schema.optional(Schema.String),
+    access: Schema.RedactedFromValue(Schema.String),
+    refresh: Schema.RedactedFromValue(Schema.String),
+    expires: Schema.Number,
+    scopes: Schema.mutable(Schema.Array(Schema.String)),
+});
+const randomText = Effect.fn(function* (length) {
+    const crypto = yield* Crypto.Crypto;
+    const bytes = yield* crypto.randomBytes(length).pipe(Effect.mapError((cause) => new OAuthError({
+        error: "crypto_error",
+        errorDescription: `Secure random generation failed: ${cause}`,
+    })));
+    return Encoding.encodeBase64Url(bytes);
+});
+const generatePKCE = Effect.fn(function* (length = 96) {
+    const crypto = yield* Crypto.Crypto;
+    const verifier = yield* randomText(length);
+    const challenge = yield* crypto
+        .digest("SHA-256", new TextEncoder().encode(verifier))
+        .pipe(Effect.mapError((cause) => new OAuthError({
+        error: "crypto_error",
+        errorDescription: `PKCE digest failed: ${cause}`,
+    })));
+    return { verifier, challenge: Encoding.encodeBase64Url(challenge) };
+});
+const TokenResponse = Schema.Struct({
+    access_token: Schema.String,
+    refresh_token: Schema.optional(Schema.String),
+    expires_in: Schema.Number,
+    scope: Schema.optional(Schema.String),
+});
+const TokenErrorResponse = Schema.Struct({
+    error: Schema.String,
+    error_description: Schema.optional(Schema.String),
+});
+export const makeOAuthClient = (spec) => {
+    const provideHttp = (effect) => effect.pipe(Effect.provide(FetchHttpClient.layer));
+    const clientAuthParams = () => spec.auth.kind === "clientSecret"
+        ? { client_secret: Redacted.value(spec.auth.clientSecret) }
+        : {};
+    const extractCredentials = (json, previous) => {
+        const refresh = json.refresh_token === undefined
+            ? previous?.refresh
+            : Redacted.make(json.refresh_token);
+        if (!refresh) {
+            return Effect.fail(new OAuthError({
+                error: "invalid_token_response",
+                errorDescription: "The provider did not return a refresh token for this authorization.",
+            }));
+        }
+        return Effect.gen(function* () {
+            const now = yield* Clock.currentTimeMillis;
+            return {
+                type: "oauth",
+                clientId: spec.clientId,
+                access: Redacted.make(json.access_token),
+                refresh,
+                expires: now + json.expires_in * 1000,
+                scopes: json.scope?.split(" ") ?? previous?.scopes ?? [],
+            };
+        });
+    };
+    const tokenRequest = Effect.fn(function* (params, previous) {
+        const client = yield* HttpClient.HttpClient;
+        const transport = spec.tokenTransport ?? "body";
+        const request = HttpClientRequest.post(spec.endpoints.token).pipe(HttpClientRequest.setHeader("Accept", "application/json"), transport === "query"
+            ? HttpClientRequest.setUrlParams(params)
+            : HttpClientRequest.bodyUrlParams(params));
+        const response = yield* client.execute(request).pipe(Effect.mapError((cause) => new OAuthError({
+            error: "network_error",
+            errorDescription: `Token request failed: ${cause}`,
+        })));
+        if (response.status < 200 || response.status >= 300) {
+            const json = yield* HttpClientResponse.schemaBodyJson(TokenErrorResponse)(response).pipe(Effect.mapError(() => new OAuthError({
+                error: "parse_error",
+                errorDescription: `Token endpoint returned ${response.status}`,
+            })));
+            return yield* new OAuthError({
+                error: json.error,
+                errorDescription: json.error_description ??
+                    `Token endpoint returned ${response.status}`,
+            });
+        }
+        const json = yield* HttpClientResponse.schemaBodyJson(TokenResponse)(response).pipe(Effect.mapError(() => new OAuthError({
+            error: "parse_error",
+            errorDescription: "Failed to parse token response",
+        })));
+        return yield* extractCredentials(json, previous);
+    });
+    const authorize = Effect.fn(function* (scopes) {
+        const state = yield* randomText(32);
+        const url = new URL(spec.endpoints.authorize);
+        url.searchParams.set("client_id", spec.clientId);
+        url.searchParams.set("redirect_uri", spec.redirectUri);
+        url.searchParams.set("response_type", "code");
+        if (scopes !== undefined) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("state", state);
+        if (spec.auth.kind === "pkce") {
+            const pkce = yield* generatePKCE();
+            url.searchParams.set("code_challenge", pkce.challenge);
+            url.searchParams.set("code_challenge_method", "S256");
+            return { url: url.toString(), state, verifier: pkce.verifier };
+        }
+        return { url: url.toString(), state };
+    });
+    const exchange = Effect.fn(function (code, authorization) {
+        return tokenRequest({
+            grant_type: "authorization_code",
+            code,
+            client_id: spec.clientId,
+            redirect_uri: spec.redirectUri,
+            ...clientAuthParams(),
+            ...(authorization?.verifier === undefined
+                ? {}
+                : { code_verifier: authorization.verifier }),
+        });
+    });
+    const refresh = Effect.fn(function (credentials) {
+        return tokenRequest({
+            grant_type: "refresh_token",
+            refresh_token: Redacted.value(credentials.refresh),
+            client_id: spec.clientId,
+            ...clientAuthParams(),
+        }, credentials);
+    });
+    const revoke = Effect.fn(function* (credentials) {
+        const endpoint = spec.endpoints.revoke;
+        if (endpoint === undefined)
+            return;
+        const client = yield* HttpClient.HttpClient;
+        const request = HttpClientRequest.post(endpoint).pipe(HttpClientRequest.setHeader("Accept", "application/json"), HttpClientRequest.bodyUrlParams({
+            token: Redacted.value(credentials.refresh),
+            token_type_hint: "refresh_token",
+            client_id: spec.clientId,
+            ...clientAuthParams(),
+        }));
+        yield* client.execute(request).pipe(Effect.mapError((cause) => new OAuthError({
+            error: "network_error",
+            errorDescription: `Revoke request failed: ${cause}`,
+        })), Effect.asVoid);
+    });
+    const exchangeCallbackInput = Effect.fn(function* (input, authorization) {
+        const value = input.trim();
+        let code = value;
+        let state = null;
+        try {
+            const url = new URL(value);
+            code = url.searchParams.get("code") ?? "";
+            state = url.searchParams.get("state");
+        }
+        catch {
+            const separator = value.lastIndexOf("#");
+            if (separator >= 0) {
+                code = value.slice(0, separator);
+                state = value.slice(separator + 1);
+            }
+        }
+        if (!code) {
+            return yield* new OAuthError({
+                error: "invalid_request",
+                errorDescription: "The authorization code is missing.",
+            });
+        }
+        if (state !== null && state !== authorization.state) {
+            return yield* new OAuthError({
+                error: "invalid_request",
+                errorDescription: "The authorization state does not match.",
+            });
+        }
+        return yield* exchange(code, authorization);
+    });
+    const callback = Effect.fn(function* (authorization) {
+        const { pathname, port, protocol } = new URL(spec.localCallbackUri);
+        const listenPort = port === "" ? (protocol === "https:" ? 443 : 80) : Number(port);
+        const listen = Effect.callback((resume) => {
+            // The handler can run more than once (browser retries, extra tabs);
+            // resume exactly once and ignore everything after.
+            let settled = false;
+            const resolveOnce = (effect) => {
+                if (settled)
+                    return;
+                settled = true;
+                resume(effect);
+            };
+            const server = http.createServer((req, res) => {
+                const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+                if (url.pathname === "/auth/ping") {
+                    res.writeHead(req.method === "OPTIONS" ? 204 : 200, {
+                        "Access-Control-Allow-Origin": new URL(spec.redirectUri).origin,
+                        "Access-Control-Allow-Methods": "GET, OPTIONS",
+                        "Access-Control-Allow-Private-Network": "true",
+                        "Cache-Control": "no-store",
+                    });
+                    res.end();
+                    return;
+                }
+                if (url.pathname !== pathname) {
+                    res.statusCode = 404;
+                    res.end("Not Found");
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                const errorDescription = url.searchParams.get("error_description");
+                if (error) {
+                    res.writeHead(302, { Location: AUTH_ERROR_URL });
+                    res.end();
+                    resolveOnce(Effect.fail(new OAuthError({
+                        error,
+                        errorDescription: errorDescription ?? "An unknown error occurred.",
+                    })));
+                    return;
+                }
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                if (!code || !state) {
+                    res.writeHead(302, { Location: AUTH_ERROR_URL });
+                    res.end();
+                    resolveOnce(Effect.fail(new OAuthError({
+                        error: "invalid_request",
+                        errorDescription: "Missing code or state",
+                    })));
+                    return;
+                }
+                if (state !== authorization.state) {
+                    res.writeHead(302, { Location: AUTH_ERROR_URL });
+                    res.end();
+                    resolveOnce(Effect.fail(new OAuthError({
+                        error: "invalid_request",
+                        errorDescription: "Invalid state",
+                    })));
+                    return;
+                }
+                resolveOnce(exchange(code, authorization).pipe(Effect.tap(() => Effect.sync(() => {
+                    res.writeHead(302, { Location: AUTH_SUCCESS_URL });
+                    res.end();
+                })), Effect.tapError(() => Effect.sync(() => {
+                    res.writeHead(302, { Location: AUTH_ERROR_URL });
+                    res.end();
+                }))));
+            });
+            server.on("error", (err) => {
+                resolveOnce(Effect.fail(server.listening
+                    ? new OAuthError({
+                        error: "server_error",
+                        errorDescription: `Callback server failed: ${err.message}`,
+                    })
+                    : new CallbackServerStartError({
+                        message: `Failed to start callback server: ${err.message}`,
+                    })));
+            });
+            server.listen(listenPort, "127.0.0.1");
+            return Effect.sync(() => {
+                server.close();
+                // `close` only stops new connections — a keep-alive browser
+                // connection would otherwise hold the process open until its
+                // socket timeout after login completes.
+                server.closeAllConnections();
+            });
+        });
+        return yield* listen.pipe(Effect.timeoutOrElse({
+            duration: "5 minutes",
+            orElse: () => Effect.fail(new OAuthError({
+                error: "timeout",
+                errorDescription: "The authorization process timed out.",
+            })),
+        }));
+    });
+    return {
+        clientId: spec.clientId,
+        usesCurrentClient: (credentials) => credentials.clientId === spec.clientId,
+        authorize,
+        exchange: (...args) => provideHttp(exchange(...args)),
+        exchangeCallbackInput: (...args) => provideHttp(exchangeCallbackInput(...args)),
+        callback: (authorization) => provideHttp(callback(authorization)),
+        refresh: (credentials) => provideHttp(refresh(credentials)),
+        revoke: (credentials) => provideHttp(revoke(credentials)),
+    };
+};
+//# sourceMappingURL=OAuthFlow.js.map