carrick 0.3.57 → 0.3.59

package/README.md

@@ -1,37 +1,92 @@
 # carrick
 
-Carrick indexes the TypeScript repos sitting beside each other on your disk and
-answers, about the file you are editing right now: which routes and calls are in
-it, who is on the other side of them in the other repos, and whether the
-contract between them still holds. It answers in your editor's Problems panel
-and in your coding agent's context, without either of them asking.
+Carrick indexes local TypeScript repositories and identifies the routes and
+calls in the file you are editing, their counterparts in indexed repositories,
+and whether their contracts agree. Configured editors show diagnostics, and
+coding agents can receive context through supported hooks or explicit checks.
 
 ```
 npm install -g carrick
-cd ~/code            # the folder that holds your repos
+carrick login
+cd ~/code            # a repo, or the folder that holds your repos
 carrick init
 ```
 
-`carrick init` needs a GitHub identity — `gh auth login`, or a `GITHUB_TOKEN` in
-the environment — and tells you so before it writes anything.
+`carrick login` opens the browser to authorise a Carrick workspace. `init`
+accepts that credential or a `CARRICK_TOKEN` environment override, and signs in
+through the browser itself when a terminal has neither. GitHub CLI credentials
+do not grant Carrick access.
+
+Existing users can initialise the local workspace against a named Carrick
+project:
+
+```
+carrick init --project payments
+```
+
+The command shows the current project assignment for every proposed GitHub
+repo. When the project is not in the workspace yet, it lists the workspace's
+projects and offers to create the named one from the terminal; where the API
+has no such action it prints the project link instead, as before. Repository
+assignment stays in the browser, so the command prints the GitHub App and
+repo-assignment links and, in an interactive terminal, opens the page. The CLI
+then reads `resolve-repos` until every proposed repo reports
+`project_slug: "payments"`. A repo connected to another project remains
+pending. In a noninteractive shell, an unmet target prints the same links and
+exits with status 1 without writing the local setup. Omit `--project` to keep
+the normal workspace init flow.
+
+Credentials live in `$XDG_CONFIG_HOME/carrick/credentials.json`, falling back
+to `~/.config/carrick/` on macOS and Linux or `%APPDATA%\carrick\` on Windows.
+The file is written with mode 0600. `carrick logout` removes it; unset
+`CARRICK_TOKEN` separately if you set that override. Revoke issued keys at
+[your account](https://app.carrick.tools/account).
+
+Rust derives the same services for CI, local indexing and `init`. An existing
+`carrick.json` is authoritative. When it is missing, `init` presents workspace
+packages and their compiler configuration, then creates the config once.
+Review service boundaries and shared source includes before committing it.
+Repeated init preserves existing config bytes, including hand edits.
+
+Workspace detection handles a repo root or immediate sibling repositories.
+An optional `carrick-workspace.json` adds paths through `repos` and removes
+directory names through `exclude`; init preserves this file and does not
+create one. `carrick derive --workspace . --json` previews the Rust proposal
+without writing files or scanning.
+
+Deno projects use their existing `deno.json` or `deno.jsonc` and require Deno
+2.9.4 or newer on PATH. Before local indexing, prepare their dependencies with
+`deno install --frozen --node-modules-dir=none` from the Deno workspace root;
+this prevents npm lifecycle scripts from running even when `allowScripts`
+authorizes them. Generate any application-owned declarations through the
+project's normal build before indexing.
+
+Deno services normally omit `tsconfig`. An explicit ordinary TypeScript config
+selects the TypeScript path; an explicit Deno config must be the nearest Deno
+manifest, with `deno.json` taking precedence over `deno.jsonc`. Import maps must
+be local files.
 
 ## What it installs
 
-One package. The scanner is a Rust binary that arrives as
+The scanner is a Rust binary that arrives as
 `@carrick-tools/cli-<platform>-<arch>`, an optional dependency npm resolves by
 `os` and `cpu`; the type sidecar, the language server and the hook scripts come
-with this package. There is no postinstall step and nothing is downloaded after
-the install, so `--ignore-scripts` works.
+with this package. Installing Carrick requires no postinstall script, so
+`--ignore-scripts` works. Dependency preparation and type checking during indexing
+can download registry packages; `index` and `refresh` can also download
+authenticated hosted indexes.
 
-Node 24 or newer, because the sidecar that resolves your request and response
-types runs on it.
+Node 24 or newer is required because the sidecar resolves request and response
+types in a Node process.
 
 ## The commands
 
 | Command | What it does |
 |---|---|
-| `carrick init` | The repo list, the first index, the agent hooks, and the lines it cannot run for you |
-| `carrick index` | Scan every repo in `carrick-workspace.json` and write `.carrick/` |
+| `carrick login` | Authorise a Carrick workspace in the browser, or verify `CARRICK_TOKEN` |
+| `carrick logout` | Remove the saved local credential |
+| `carrick init [--project SLUG]` | The repo list, optional project-assignment verification, the first index, the agent hooks, and the lines it cannot run for you |
+| `carrick index` | Derive the workspace, apply optional repo overrides and write `.carrick/` |
 | `carrick refresh [--service X]` | Re-scan one repo, or all of them, and re-join |
 | `carrick check <file>` | What the index knows about that file, verdicts included |
 | `carrick touch <file>` | The same, without the verdicts |
@@ -51,28 +106,64 @@ for the machine-readable shape, pinned in
 - **Claude Code**: the hooks `carrick init` writes deliver on the edit itself.
   `claude --plugin-dir <carrick checkout>/plugin` adds the language server too.
 - **VS Code, Cursor, Windsurf**: the `carrick-tools.carrick` extension is a
-  client on `carrick lsp --stdio`. Editor-hosted agents read the Problems panel
-  after their own edits.
+  client on `carrick lsp --stdio` and publishes diagnostics in the Problems
+  panel. Whether an editor-hosted agent reads those diagnostics depends on its
+  integration and configuration.
 - **Neovim, Helix, Zed, JetBrains**: any LSP client, on the same command.
 - **Anything else**: `carrick check <file>` on demand, and the pull request
   check in CI.
 
-## What a local index holds
+## In your editor
+
+Go to definition on a call to another service jumps to the handler that serves
+it, in the other repo. On a route it lists the call sites that reach it, and
+the editor shows the picker. Carrick answers only inside a row the index holds,
+and only when the file on the other side is on this disk, so every other jump
+falls through to TypeScript exactly as it did before.
 
-Deterministic rows: file-based and descriptor routes, class-controller routes,
-imported-member calls, GraphQL schema and document rows, socket and pub/sub
-operations, and the types on both sides of them. A route registered on a typed
-receiver, and a call whose URL is assembled at the call site, are classified in
-the hosted index and are absent here — every answer says how many of those it
-counted and did not classify, so a thin answer never reads as an empty one.
+## Settings
 
-The hosted index covers every repo in your organisation on its main branch,
-including the ones you do not have checked out, and answers over MCP:
+One switch per surface. In VS Code they are settings; any other LSP client
+sends the same keys, with the `carrick.` prefix stripped, as
+`initializationOptions`.
+
+| Setting | Default | What it turns off |
+|---|---|---|
+| `carrick.binary` | the `carrick` on PATH | — the path to the CLI, not a surface |
+| `carrick.diagnostics` | on | The verdicts in the Problems panel |
+| `carrick.definition` | on | Cross-repo go to definition. Off means Carrick answers nothing and your other definition providers are untouched |
+| `carrick.boundary` | on | The boundary: the status bar item, or the file-level row in a client without one |
+
+`CARRICK_CHANNEL=off` in the environment turns off delivery altogether.
+
+## What a local index holds
+
+A local index holds deterministic routes, calls, protocol operations and their
+types, together with eligible hosted model answers. `index` and `refresh` read
+authenticated hosted indexes and replay answers for unchanged files when the
+hosted commit is available locally and cache versions match. Changed files
+keep their local facts while their hosted model answers are withheld. Boundary
+rows report enrichment status and remaining unclassified candidates; no model
+runs on the local machine.
+
+Hosted queries cover connected, indexed repositories in the selected Carrick
+project, including repositories absent from this disk, using their most recent
+default-branch indexes. They are available over MCP, and `carrick init`
+connects the agent clients it finds on the machine: Claude Code through
+`claude mcp add`, and Cursor, Windsurf and VS Code by adding a `carrick` server
+to the client's own configuration file, leaving every other entry in it alone.
+A machine with none of them is given the line to run:
 
 ```
 claude mcp add --scope user --transport http carrick https://api.carrick.tools/mcp
 ```
 
+The first scan on a repository's default branch writes its hosted index. A
+Claude Code session opened in a workspace still waiting for one starts
+`carrick refresh` in the background, at most once an hour
+(`CARRICK_REFRESH_COOLDOWN_MS` states another gap), so the hosted rows arrive
+without a command to remember.
+
 ## Licence
 
 Elastic License 2.0. See

package/bin/carrick.mjs

@@ -99,8 +99,11 @@ function extraHelp() {
     "",
     "This package also carries the commands that put those answers where you work:",
     "",
-    "    carrick init                 set up this folder: the repos to index, the first",
-    "                                 index, and the editor and agent wiring",
+    "    carrick login                sign in to a Carrick workspace",
+    "    carrick logout               remove the saved local credential",
+    "    carrick init [--project X]   set up this folder: the repos to index, the first",
+    "                                 index, and the editor and agent wiring; with a",
+    "                                 project, verify every repo is assigned to it",
     "    carrick lsp --stdio          the language server, for an editor or an agent",
     "                                 that speaks LSP",
     "    carrick hook post-edit       Claude Code PostToolUse hook (reads the tool",
@@ -112,6 +115,14 @@ function extraHelp() {
 }
 
 switch (command) {
+  case "login": {
+    const { login } = await import("../dist/auth/run.js");
+    process.exit(await login(rest));
+  }
+  case "logout": {
+    const { logout } = await import("../dist/auth/run.js");
+    process.exit(logout(rest));
+  }
   case "lsp": {
     await pointAtNativeBinary();
     await import("../dist/server.js");

package/dist/auth/credentials.d.ts

@@ -0,0 +1,14 @@
+export declare const API_BASE = "https://api.carrick.tools";
+export declare const APP_BASE = "https://app.carrick.tools";
+/** Shared with the native read client. Tokens expire by server revocation. */
+export type Credential = {
+    api_base: string;
+    token: string;
+    workspace_slug: string | null;
+    obtained_at: string;
+};
+export declare function credentialPath(env?: NodeJS.ProcessEnv): string;
+export declare function readCredential(env?: NodeJS.ProcessEnv): Credential | null;
+export declare function saveCredential(token: string, workspace: string | null, env?: NodeJS.ProcessEnv): void;
+/** Removes the local credential only; dashboard revocation is a separate action. */
+export declare function removeCredential(env?: NodeJS.ProcessEnv): boolean;

package/dist/auth/credentials.js

@@ -0,0 +1,86 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+export const API_BASE = "https://api.carrick.tools";
+export const APP_BASE = "https://app.carrick.tools";
+export function credentialPath(env = process.env) {
+    const base = env["XDG_CONFIG_HOME"] ||
+        (process.platform === "win32" ? env["APPDATA"] : undefined) ||
+        path.join(env["HOME"] || os.homedir(), ".config");
+    if (!path.isAbsolute(base))
+        throw new Error("Carrick's configuration directory must be an absolute path.");
+    return path.join(base, "carrick", "credentials.json");
+}
+export function readCredential(env = process.env) {
+    if (env["CARRICK_TOKEN"] !== undefined) {
+        const token = env["CARRICK_TOKEN"];
+        if (!token || /\s/.test(token))
+            throw new Error("CARRICK_TOKEN is empty or malformed. Set it to a Carrick token or unset it and run carrick login.");
+        return { api_base: API_BASE, token, workspace_slug: null, obtained_at: "" };
+    }
+    const file = credentialPath(env);
+    let fd;
+    try {
+        fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Could not read Carrick credentials. Run carrick login.");
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || (process.platform !== "win32" && (stat.mode & 0o077) !== 0))
+            throw new Error();
+        const value = JSON.parse(fs.readFileSync(fd, "utf8"));
+        if (typeof value !== "object" || value === null)
+            throw new Error();
+        const credential = value;
+        if (credential.api_base !== API_BASE || typeof credential.token !== "string" ||
+            !credential.token || /\s/.test(credential.token) ||
+            !(credential.workspace_slug === null || typeof credential.workspace_slug === "string") ||
+            typeof credential.obtained_at !== "string")
+            throw new Error();
+        return credential;
+    }
+    catch {
+        throw new Error("Carrick credentials are invalid or not private. Run carrick login.");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function saveCredential(token, workspace, env = process.env) {
+    if (!token || /\s/.test(token))
+        throw new Error("The authorization server returned an invalid token.");
+    const file = credentialPath(env);
+    const directory = path.dirname(file);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (!fs.lstatSync(directory).isDirectory())
+        throw new Error("Carrick's credential directory must not be a symbolic link.");
+    if (process.platform !== "win32")
+        fs.chmodSync(directory, 0o700);
+    const temporary = fs.mkdtempSync(path.join(directory, ".login-"));
+    try {
+        const pending = path.join(temporary, "credentials.json");
+        const credential = { api_base: API_BASE, token, workspace_slug: workspace, obtained_at: new Date().toISOString() };
+        fs.writeFileSync(pending, `${JSON.stringify(credential, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        fs.renameSync(pending, file);
+    }
+    finally {
+        fs.rmSync(temporary, { recursive: true, force: true });
+    }
+}
+/** Removes the local credential only; dashboard revocation is a separate action. */
+export function removeCredential(env = process.env) {
+    try {
+        fs.unlinkSync(credentialPath(env));
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw new Error("Could not remove Carrick's credential file.");
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAUpD,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACjC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACrJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACrG,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAmB,CAAC;QACvC,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACxE,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC;YACtF,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;YAC1F,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAAwB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC1G,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/H,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACvE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,11 @@
+/** Launch a URL as an argument, never through a shell. */
+export declare function openBrowser(url: string): Promise<boolean>;
+export type OAuthOptions = {
+    fetch?: typeof fetch;
+    open?: (url: string) => Promise<boolean>;
+    say?: (message: string) => void;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+};
+/** RFC 8252 loopback + S256 PKCE against Carrick's existing public OAuth client flow. */
+export declare function authorize(options?: OAuthOptions): Promise<string>;

package/dist/auth/oauth.js

@@ -0,0 +1,119 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import http from "node:http";
+import { spawn } from "node:child_process";
+import { APP_BASE, API_BASE } from "./credentials.js";
+/** Launch a URL as an argument, never through a shell. */
+export async function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    return await new Promise((resolve) => {
+        const child = spawn(command, args, { stdio: "ignore" });
+        child.on("error", () => resolve(false));
+        child.on("exit", (code) => resolve(code === 0));
+    });
+}
+/** RFC 8252 loopback + S256 PKCE against Carrick's existing public OAuth client flow. */
+export async function authorize(options = {}) {
+    const request = options.fetch ?? fetch;
+    const say = options.say ?? ((message) => process.stdout.write(`${message}\n`));
+    const signal = AbortSignal.any([AbortSignal.timeout(options.timeoutMs ?? 5 * 60_000), ...(options.signal ? [options.signal] : [])]);
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    let settle;
+    const received = new Promise((resolve) => { settle = resolve; });
+    let consumed = false;
+    const server = http.createServer((req, res) => {
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("Content-Type", "text/plain; charset=utf-8");
+        let url;
+        try {
+            url = new URL(req.url ?? "/", "http://127.0.0.1");
+        }
+        catch {
+            res.writeHead(400).end("Invalid authorization callback.");
+            return;
+        }
+        const supplied = url.searchParams.get("state") ?? "";
+        if (consumed || req.method !== "GET" || url.pathname !== "/callback" ||
+            url.searchParams.getAll("state").length !== 1 ||
+            Buffer.byteLength(supplied) !== Buffer.byteLength(state) ||
+            !timingSafeEqual(Buffer.from(supplied), Buffer.from(state))) {
+            res.writeHead(400).end("Invalid authorization callback.");
+            return;
+        }
+        if (url.searchParams.has("error")) {
+            consumed = true;
+            res.writeHead(400).end("Carrick authorization was declined. Return to your terminal.");
+            settle(new Error("Carrick authorization was declined. Run carrick login to try again."));
+            return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code || url.searchParams.getAll("code").length !== 1) {
+            res.writeHead(400).end("Missing authorization code.");
+            return;
+        }
+        consumed = true;
+        res.end("Authorization received. Return to your terminal to finish Carrick login.");
+        settle(code);
+    });
+    server.requestTimeout = 10_000;
+    const cancel = () => { settle(new Error("Carrick login was cancelled or timed out. Run carrick login to try again.")); };
+    signal.addEventListener("abort", cancel, { once: true });
+    try {
+        signal.throwIfAborted();
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Could not open the Carrick login callback.");
+        const redirect = `http://127.0.0.1:${address.port}/callback`;
+        const registration = await request(`${APP_BASE}/oauth/register`, {
+            method: "POST", redirect: "error", signal,
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_name: "Carrick CLI", redirect_uris: [redirect], token_endpoint_auth_method: "none", grant_types: ["authorization_code"], response_types: ["code"], scope: "mcp" }),
+        });
+        if (!registration.ok)
+            throw new Error(`Carrick client registration failed (HTTP ${registration.status}).`);
+        const registered = await registration.json();
+        if (typeof registered.client_id !== "string" || !registered.client_id)
+            throw new Error("Carrick registration returned no client ID.");
+        const url = new URL(`${APP_BASE}/oauth/authorize`);
+        url.search = new URLSearchParams({ response_type: "code", client_id: registered.client_id, redirect_uri: redirect, scope: "mcp", resource: `${API_BASE}/mcp`, state, code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256" }).toString();
+        say(`Sign in to Carrick in your browser:\n${url}`);
+        // Opening a browser is best effort. A manual browser can finish the same callback.
+        void (options.open ?? openBrowser)(url.toString()).catch(() => false);
+        const code = await received;
+        if (code instanceof Error)
+            throw code;
+        const result = await request(`${APP_BASE}/oauth/token`, {
+            method: "POST", redirect: "error", signal,
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "authorization_code", client_id: registered.client_id, redirect_uri: redirect, code, code_verifier: verifier, resource: `${API_BASE}/mcp` }),
+        });
+        if (!result.ok)
+            throw new Error(`Carrick token exchange failed (HTTP ${result.status}). Run carrick login again.`);
+        const body = await result.json();
+        if (typeof body.access_token !== "string" || !body.access_token || /\s/.test(body.access_token) ||
+            typeof body.token_type !== "string" || body.token_type.toLowerCase() !== "bearer" || body.scope !== "mcp") {
+            throw new Error("Carrick returned an invalid OAuth token response.");
+        }
+        return body.access_token;
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw new Error("Carrick login was cancelled or timed out. Run carrick login to try again.");
+        // Never include a remote body, token, verifier or callback URL in an error.
+        if (error instanceof Error && error.message.startsWith("Carrick"))
+            throw error;
+        throw new Error("Carrick login could not complete. Check the connection and loopback listener, then run carrick login.");
+    }
+    finally {
+        signal.removeEventListener("abort", cancel);
+        server.closeAllConnections();
+        if (server.listening)
+            await new Promise((resolve) => server.close(() => resolve()));
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAwB,EAAE;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,MAAuC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAChE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACxD,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YACvF,MAAM,CAAC,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YAC/D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SACjM,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3G,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,EAA6B,CAAC;QACxE,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACtI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,kBAAkB,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5R,GAAG,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACnD,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;QAC5B,IAAI,IAAI,YAAY,KAAK;YAAE,MAAM,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,cAAc,EAAE;YACtD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC;SACrL,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAuE,CAAC;QACtG,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3F,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QACjH,4EAA4E;QAC5E,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;IAC3H,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/auth/read.d.ts

@@ -0,0 +1,139 @@
+import { z } from "zod";
+declare const response: z.ZodObject<{
+    schema: z.ZodLiteral<"carrick.resolve-repos/0">;
+    workspace: z.ZodObject<{
+        slug: z.ZodString;
+        billing_tier: z.ZodEnum<["free", "cross_repo", "paid"]>;
+        installed: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        slug: string;
+        billing_tier: "free" | "cross_repo" | "paid";
+        installed: boolean;
+    }, {
+        slug: string;
+        billing_tier: "free" | "cross_repo" | "paid";
+        installed: boolean;
+    }>;
+    allowance_sentence: z.ZodNullable<z.ZodString>;
+    repos: z.ZodArray<z.ZodDiscriminatedUnion<"connected", [z.ZodObject<{
+        full_name: z.ZodString;
+        connected: z.ZodLiteral<false>;
+    }, "strip", z.ZodTypeAny, {
+        connected: false;
+        full_name: string;
+    }, {
+        connected: false;
+        full_name: string;
+    }>, z.ZodObject<{
+        full_name: z.ZodString;
+        connected: z.ZodLiteral<true>;
+        project_id: z.ZodString;
+        project_slug: z.ZodString;
+        services: z.ZodArray<z.ZodObject<{
+            service: z.ZodString;
+            hash: z.ZodNullable<z.ZodString>;
+            updated_at: z.ZodNullable<z.ZodString>;
+            scanner_version: z.ZodNullable<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }, {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        services: {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }[];
+        connected: true;
+        full_name: string;
+        project_id: string;
+        project_slug: string;
+    }, {
+        services: {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }[];
+        connected: true;
+        full_name: string;
+        project_id: string;
+        project_slug: string;
+    }>]>, "many">;
+    project_repos: z.ZodArray<z.ZodObject<{
+        project_slug: z.ZodString;
+        repos: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        project_slug: string;
+        repos: string[];
+    }, {
+        project_slug: string;
+        repos: string[];
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    schema: "carrick.resolve-repos/0";
+    workspace: {
+        slug: string;
+        billing_tier: "free" | "cross_repo" | "paid";
+        installed: boolean;
+    };
+    allowance_sentence: string | null;
+    repos: ({
+        connected: false;
+        full_name: string;
+    } | {
+        services: {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }[];
+        connected: true;
+        full_name: string;
+        project_id: string;
+        project_slug: string;
+    })[];
+    project_repos: {
+        project_slug: string;
+        repos: string[];
+    }[];
+}, {
+    schema: "carrick.resolve-repos/0";
+    workspace: {
+        slug: string;
+        billing_tier: "free" | "cross_repo" | "paid";
+        installed: boolean;
+    };
+    allowance_sentence: string | null;
+    repos: ({
+        connected: false;
+        full_name: string;
+    } | {
+        services: {
+            service: string;
+            scanner_version: string | null;
+            hash: string | null;
+            updated_at: string | null;
+        }[];
+        connected: true;
+        full_name: string;
+        project_id: string;
+        project_slug: string;
+    })[];
+    project_repos: {
+        project_slug: string;
+        repos: string[];
+    }[];
+}>;
+export type ResolvedRepos = z.infer<typeof response>;
+/** Metadata only. This client never uploads source or requests model work. */
+export declare function resolveRepos(token: string, repos: string[], request?: typeof fetch, signal?: AbortSignal): Promise<ResolvedRepos>;
+export {};

package/dist/auth/read.js

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import { API_BASE } from "./credentials.js";
+const service = z.object({ service: z.string(), hash: z.string().nullable(), updated_at: z.string().nullable(), scanner_version: z.string().nullable() });
+const repository = z.discriminatedUnion("connected", [
+    z.object({ full_name: z.string(), connected: z.literal(false) }),
+    z.object({ full_name: z.string(), connected: z.literal(true), project_id: z.string(), project_slug: z.string(), services: z.array(service) }),
+]);
+const response = z.object({
+    schema: z.literal("carrick.resolve-repos/0"),
+    workspace: z.object({ slug: z.string().regex(/^[a-zA-Z0-9_-]+$/), billing_tier: z.enum(["free", "cross_repo", "paid"]), installed: z.boolean() }),
+    allowance_sentence: z.string().nullable(),
+    repos: z.array(repository),
+    project_repos: z.array(z.object({ project_slug: z.string(), repos: z.array(z.string()) })),
+});
+/** Metadata only. This client never uploads source or requests model work. */
+export async function resolveRepos(token, repos, request = fetch, signal) {
+    let result;
+    try {
+        result = await request(`${API_BASE}/types/check-or-upload`, {
+            method: "POST", redirect: "error", signal: AbortSignal.any([AbortSignal.timeout(30_000), ...(signal ? [signal] : [])]),
+            headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ action: "resolve-repos", repos }),
+        });
+    }
+    catch {
+        throw new Error("Could not reach Carrick to verify the workspace. Check the connection and retry.");
+    }
+    if (result.status === 401)
+        throw new Error("Carrick rejected this credential. Run carrick login (unset CARRICK_TOKEN first if it overrides your login).");
+    if (!result.ok)
+        throw new Error(`Carrick workspace lookup failed (HTTP ${result.status}).`);
+    let payload;
+    try {
+        payload = await result.json();
+    }
+    catch {
+        throw new Error("Carrick workspace lookup returned invalid JSON.");
+    }
+    const parsed = response.safeParse(payload);
+    if (!parsed.success)
+        throw new Error("Carrick workspace lookup returned an unsupported or incomplete schema. The server must support carrick.resolve-repos/0.");
+    return parsed.data;
+}
+//# sourceMappingURL=read.js.map