gws-axi 0.1.0

package/dist/src/auth/loopback.js

@@ -0,0 +1,420 @@
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer, } from "node:http";
+import { dirname } from "node:path";
+import { URL } from "node:url";
+import { credentialsPath, listAccounts, normalizeEmail, profilePathForAccount, setDefaultAccount, tokensPathForAccount, } from "../config.js";
+import { markStepDone } from "./state.js";
+import { allScopes } from "./scopes.js";
+import { clearPendingAuth, isPendingAuthExpired, readPendingAuth, writePendingAuth, } from "./pending.js";
+import { setupHtmlPath, writeSetupHtml } from "./setup-html.js";
+function collapseHome(path) {
+    const home = process.env.HOME ?? "";
+    return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+}
+function readCredentials() {
+    if (!existsSync(credentialsPath()))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(credentialsPath(), "utf-8"));
+        return parsed.installed ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function base64url(input) {
+    return input
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function pkcePair() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function writeAccountFiles(email, tokens, profile) {
+    const tokensP = tokensPathForAccount(email);
+    const profileP = profilePathForAccount(email);
+    mkdirSync(dirname(tokensP), { recursive: true });
+    writeFileSync(tokensP, `${JSON.stringify(tokens, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(profileP, `${JSON.stringify(profile, null, 2)}\n`);
+}
+function buildAuthUrl(params) {
+    const u = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+    u.searchParams.set("client_id", params.clientId);
+    u.searchParams.set("redirect_uri", params.redirectUri);
+    u.searchParams.set("response_type", "code");
+    u.searchParams.set("scope", params.scopes.join(" "));
+    u.searchParams.set("code_challenge", params.challenge);
+    u.searchParams.set("code_challenge_method", "S256");
+    u.searchParams.set("state", params.state);
+    u.searchParams.set("access_type", "offline");
+    u.searchParams.set("prompt", "consent");
+    // Deliberately NOT setting include_granted_scopes=true. That flag
+    // returns access tokens covering every scope the user has ever
+    // granted this OAuth client, not just the scopes we asked for now,
+    // which makes scope counts balloon unpredictably when the user has
+    // historical grants from testing / revocations / different scope
+    // configs. Since we always request the full scope set and force
+    // prompt=consent (so users re-approve every time), incremental
+    // authorization isn't buying us anything — each auth should be a
+    // clean grant matching exactly what we asked for.
+    if (params.loginHint) {
+        u.searchParams.set("login_hint", params.loginHint);
+    }
+    return u.toString();
+}
+async function exchangeCode(params) {
+    const body = new URLSearchParams({
+        client_id: params.clientId,
+        client_secret: params.clientSecret,
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        grant_type: "authorization_code",
+        code_verifier: params.verifier,
+    });
+    const res = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    if (!res.ok) {
+        const txt = await res.text();
+        throw new Error(`Token exchange failed (${res.status}): ${txt}`);
+    }
+    return (await res.json());
+}
+async function fetchUserinfo(accessToken) {
+    const res = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
+        headers: { authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) {
+        throw new Error(`userinfo failed (${res.status})`);
+    }
+    return (await res.json());
+}
+async function waitForCallback(server, expectedState) {
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            reject(new Error("Timed out waiting for OAuth callback after 5 minutes"));
+        }, 5 * 60_000);
+        server.on("request", (req, res) => {
+            if (!req.url)
+                return;
+            const u = new URL(req.url, "http://127.0.0.1");
+            if (u.pathname !== "/callback") {
+                res.statusCode = 404;
+                res.end("Not found");
+                return;
+            }
+            const code = u.searchParams.get("code");
+            const state = u.searchParams.get("state");
+            const errorParam = u.searchParams.get("error");
+            res.statusCode = 200;
+            res.setHeader("content-type", "text/html; charset=utf-8");
+            if (errorParam) {
+                res.end(errorPage(errorParam));
+                clearTimeout(timeout);
+                reject(new Error(`OAuth error: ${errorParam}`));
+                return;
+            }
+            if (!code || state !== expectedState) {
+                res.end(errorPage("invalid_state_or_missing_code"));
+                clearTimeout(timeout);
+                reject(new Error("OAuth callback missing code or state mismatch"));
+                return;
+            }
+            res.end(successPage());
+            clearTimeout(timeout);
+            resolve({ code, scope: u.searchParams.get("scope") ?? undefined });
+        });
+    });
+}
+function successPage() {
+    return `<!doctype html>
+<html><head><meta charset="utf-8"><title>gws-axi — authenticated</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;max-width:480px;margin:60px auto;padding:24px;color:#222}h1{color:#1a7f37}</style>
+</head><body><h1>Authenticated</h1><p>You can close this tab and return to your terminal.</p></body></html>`;
+}
+function errorPage(message) {
+    const escaped = message.replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c] ?? c);
+    return `<!doctype html>
+<html><head><meta charset="utf-8"><title>gws-axi — error</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;max-width:480px;margin:60px auto;padding:24px;color:#222}h1{color:#c62828}pre{background:#f4f4f4;padding:12px;border-radius:4px}</style>
+</head><body><h1>Authentication failed</h1><pre>${escaped}</pre><p>Close this tab and check the terminal.</p></body></html>`;
+}
+/**
+ * Reserve a port by binding and immediately closing. The returned port is
+ * likely still free when the caller uses it, but not guaranteed — there's
+ * a microscopic race window. In practice it's not an issue.
+ */
+async function reservePort() {
+    const server = createServer();
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    await new Promise((resolve) => server.close(() => resolve()));
+    return port;
+}
+/**
+ * Phase 1: generate the auth URL, reserve a port, persist pending state,
+ * write setup.html with the authenticate button. Returns immediately so the
+ * agent can relay instructions to the user BEFORE any process blocks on a
+ * callback. Call `awaitPendingAuth` after instructing the user.
+ */
+export async function preparePendingAuth(options = {}) {
+    const creds = readCredentials();
+    if (!creds) {
+        return {
+            error: "credentials.json missing — complete setup steps 1-4 first",
+            code: "PRECONDITION_FAILED",
+        };
+    }
+    // Clear any stale pending state from a previous abandoned run so the HTML
+    // helper doesn't show two conflicting banners and so a future --wait
+    // doesn't pick up the wrong pending.
+    clearPendingAuth();
+    const port = await reservePort();
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const { verifier, challenge } = pkcePair();
+    const state = base64url(randomBytes(16));
+    const scopes = allScopes();
+    const authUrl = buildAuthUrl({
+        clientId: creds.client_id,
+        redirectUri,
+        scopes,
+        challenge,
+        state,
+        loginHint: options.expectedAccount,
+    });
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + 10 * 60_000); // 10 min — plenty for user + agent coordination
+    const pending = {
+        version: 1,
+        url: authUrl,
+        port,
+        verifier,
+        state,
+        expected_account: options.expectedAccount,
+        started_at: now.toISOString(),
+        expires_at: expiresAt.toISOString(),
+    };
+    writePendingAuth(pending);
+    writeSetupHtml({
+        pendingAuth: { url: authUrl, account: options.expectedAccount },
+    });
+    return {
+        pending,
+        htmlPath: setupHtmlPath(),
+        credentialsPresent: true,
+    };
+}
+/**
+ * Phase 2: read pending state, start the callback server, block until the
+ * user authenticates (or timeout). Runs the token exchange, fetches the
+ * userinfo to identify the account, writes tokens + profile, updates
+ * default account if first, regenerates setup.html without the banner.
+ */
+export async function awaitPendingAuth() {
+    const step = "tokens_obtained";
+    const pending = readPendingAuth();
+    if (!pending) {
+        return {
+            step,
+            advanced: false,
+            title: "No pending authentication",
+            error: "No pending auth flow — run `gws-axi auth login --account <email>` first to prepare",
+            code: "NO_PENDING_AUTH",
+            instructions: [
+                "Run `gws-axi auth login --account <email>` to prepare",
+                "Then run `gws-axi auth login --wait` to block on the user's browser click",
+            ],
+        };
+    }
+    if (isPendingAuthExpired(pending)) {
+        clearPendingAuth();
+        return {
+            step,
+            advanced: false,
+            title: "Pending authentication expired",
+            error: "The prepared OAuth flow expired — prepare a new one",
+            code: "PENDING_EXPIRED",
+            instructions: [
+                "Re-run `gws-axi auth login --account <email>` to prepare a fresh flow",
+            ],
+        };
+    }
+    const creds = readCredentials();
+    if (!creds) {
+        return {
+            step,
+            advanced: false,
+            title: "Credentials disappeared",
+            error: "credentials.json is missing — was it deleted between prepare and wait?",
+            code: "PRECONDITION_FAILED",
+            instructions: ["Re-run `gws-axi auth setup --credentials-json <path>`"],
+        };
+    }
+    const server = createServer();
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(pending.port, "127.0.0.1", () => resolve());
+        });
+    }
+    catch (err) {
+        return {
+            step,
+            advanced: false,
+            title: "Could not bind callback server",
+            error: `Port ${pending.port} is not available: ${err instanceof Error ? err.message : String(err)}`,
+            code: "PORT_UNAVAILABLE",
+            instructions: [
+                "Another process is bound to that port. Retry with a fresh flow:",
+                "Run `gws-axi auth login --account <email>` again",
+            ],
+        };
+    }
+    const redirectUri = `http://127.0.0.1:${pending.port}/callback`;
+    // Snapshot account list BEFORE writing new tokens so we can detect
+    // whether this is the first-ever account (should be promoted to
+    // default) vs. an additional one (default stays put).
+    const accountsBefore = listAccounts();
+    try {
+        const { code, scope } = await waitForCallback(server, pending.state);
+        const tokens = await exchangeCode({
+            clientId: creds.client_id,
+            clientSecret: creds.client_secret,
+            code,
+            redirectUri,
+            verifier: pending.verifier,
+        });
+        const userinfo = await fetchUserinfo(tokens.access_token);
+        const authenticatedEmail = normalizeEmail(userinfo.email);
+        if (pending.expected_account &&
+            normalizeEmail(pending.expected_account) !== authenticatedEmail) {
+            return {
+                step,
+                advanced: false,
+                title: "Authenticated account does not match expected",
+                error: `Expected ${pending.expected_account}, got ${authenticatedEmail}`,
+                code: "ACCOUNT_MISMATCH",
+                instructions: [
+                    `Re-run with: \`gws-axi auth login --account ${pending.expected_account}\``,
+                    "Make sure you sign in as the correct account in the browser",
+                ],
+            };
+        }
+        const grantedScopes = (scope ?? tokens.scope).split(" ").filter(Boolean);
+        const stored = {
+            client_id: creds.client_id,
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            expiry_date: Date.now() + tokens.expires_in * 1000,
+            scope: grantedScopes.join(" "),
+            token_type: tokens.token_type,
+            obtained_at: new Date().toISOString(),
+        };
+        const profile = {
+            email: authenticatedEmail,
+            verified_email: userinfo.email_verified,
+            name: userinfo.name,
+            picture: userinfo.picture,
+            sub: userinfo.sub,
+            updated_at: new Date().toISOString(),
+        };
+        writeAccountFiles(authenticatedEmail, stored, profile);
+        // Only promote to default if there were no accounts BEFORE this one.
+        // getDefaultAccount()'s implicit single-account fallback can return
+        // undefined for a newly-added second account (no explicit default
+        // in config.json because the first account was implicitly inferred
+        // via listAccounts().length === 1), which would wrongly overwrite
+        // the existing default. Always persist an explicit default_account
+        // on first auth so subsequent auths don't disturb it.
+        if (accountsBefore.length === 0) {
+            setDefaultAccount(authenticatedEmail);
+        }
+        markStepDone(step, {
+            accounts: listAccounts(),
+            latest_account: authenticatedEmail,
+        });
+        return {
+            step,
+            advanced: true,
+            title: "Tokens obtained",
+            detail: {
+                account: authenticatedEmail,
+                scopes_granted: grantedScopes.length,
+                scopes_requested: allScopes().length,
+                tokens_path: tokensPathForAccount(authenticatedEmail),
+            },
+        };
+    }
+    catch (err) {
+        return {
+            step,
+            advanced: false,
+            title: "OAuth flow failed",
+            error: err instanceof Error ? err.message : String(err),
+            code: "OAUTH_FAILED",
+            instructions: [
+                "Check that the consent screen (step 5) and test user (step 6) are configured",
+                "Re-run: `gws-axi auth login --account <email>` to start a fresh flow",
+            ],
+        };
+    }
+    finally {
+        // The browser holds a keep-alive connection to the callback server
+        // after the success/error page renders. server.close() alone only
+        // stops *new* connections — the lingering keep-alive keeps Node's
+        // event loop alive indefinitely. closeAllConnections() forcibly
+        // terminates them so the process exits immediately.
+        server.closeAllConnections();
+        server.close();
+        clearPendingAuth();
+        try {
+            writeSetupHtml();
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+/**
+ * Helper for callers (like `auth setup`) that want to expose the prepared
+ * instructions to the user/agent as a StepOutcome. Does NOT block — just
+ * wraps preparePendingAuth into the StepOutcome shape.
+ */
+export async function advanceTokensObtained(options = {}) {
+    const step = "tokens_obtained";
+    const prepared = await preparePendingAuth(options);
+    if ("error" in prepared) {
+        return {
+            step,
+            advanced: false,
+            title: prepared.code === "PRECONDITION_FAILED"
+                ? "OAuth credentials not yet saved"
+                : "OAuth prepare failed",
+            error: prepared.error,
+            code: prepared.code,
+            instructions: ["Re-run: `gws-axi auth setup --credentials-json <path>`"],
+        };
+    }
+    const expected = prepared.pending.expected_account;
+    return {
+        step,
+        advanced: false,
+        title: "Step 7 of 7: Authenticate in your browser",
+        instructions: [
+            `The gws-axi setup page (${collapseHome(prepared.htmlPath)}) must be open in the browser PROFILE/SESSION where the user is signed into ${expected ? `\`${expected}\`` : "the target Google account"}. If initial setup ran in a different browser profile, tell the user to open ${collapseHome(prepared.htmlPath)} in the correct profile first.`,
+            `In that setup page, the user waits for the yellow "Authenticate with Google" button (up to 10s auto-refresh), clicks it${expected ? `, signs in as \`${expected}\`` : ""}, approves scopes, and sees a success page.`,
+            "After RELAYING these instructions to the user, IMMEDIATELY run `gws-axi auth login --wait` in a new bash turn — do NOT wait for the user to confirm they're ready. The callback server must be listening BEFORE the user clicks. If you delay, the click hits an unreachable localhost URL. The wait is harmless: it just listens for up to 5 min while the user takes their time.",
+        ],
+    };
+}
+//# sourceMappingURL=loopback.js.map

package/dist/src/auth/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../../src/auth/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EACL,YAAY,GAIb,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GAEjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGhE,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAuCD,SAAS,eAAe;IACtB,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAoB,CAAC;QACvF,OAAO,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,MAAoB,EACpB,OAAsB;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,MAOrB;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,kEAAkE;IAClE,+DAA+D;IAC/D,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,iEAAiE;IACjE,kDAAkD;IAClD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAM3B;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB;QAChC,aAAa,EAAE,MAAM,CAAC,QAAQ;KAC/B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC7C,CAAC;AAUD,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;QAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;QAC5E,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QAEf,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACjE,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,OAAO;YACrB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE/C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAE1D,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/B,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBACpD,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACvB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;;;4GAGmG,CAAC;AAC7G,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;IACF,OAAO;;;kDAGyC,OAAO,mEAAmE,CAAC;AAC7H,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,qBAAqB;SAC5B,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,qCAAqC;IACrC,gBAAgB,EAAE,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAExD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,WAAW;QACX,MAAM;QACN,SAAS;QACT,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,eAAe;KACnC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,gDAAgD;IACzG,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,OAAO;QACZ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,gBAAgB,EAAE,OAAO,CAAC,eAAe;QACzC,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,cAAc,CAAC;QACb,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;KAChE,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,aAAa,EAAE;QACzB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,iBAA0B,CAAC;IAExC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,2BAA2B;YAClC,KAAK,EAAE,oFAAoF;YAC3F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE;gBACZ,uDAAuD;gBACvD,2EAA2E;aAC5E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,gBAAgB,EAAE,CAAC;QACnB,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gCAAgC;YACvC,KAAK,EAAE,qDAAqD;YAC5D,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE;gBACZ,uEAAuE;aACxE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,wEAAwE;YAC/E,IAAI,EAAE,qBAAqB;YAC3B,YAAY,EAAE,CAAC,uDAAuD,CAAC;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gCAAgC;YACvC,KAAK,EAAE,QAAQ,OAAO,CAAC,IAAI,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACnG,IAAI,EAAE,kBAAkB;YACxB,YAAY,EAAE;gBACZ,iEAAiE;gBACjE,kDAAkD;aACnD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;IAEhE,mEAAmE;IACnE,gEAAgE;IAChE,sDAAsD;IACtD,MAAM,cAAc,GAAG,YAAY,EAAE,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,IAAI;YACJ,WAAW;YACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE1D,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,IACE,OAAO,CAAC,gBAAgB;YACxB,cAAc,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,kBAAkB,EAC/D,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,+CAA+C;gBACtD,KAAK,EAAE,YAAY,OAAO,CAAC,gBAAgB,SAAS,kBAAkB,EAAE;gBACxE,IAAI,EAAE,kBAAkB;gBACxB,YAAY,EAAE;oBACZ,+CAA+C,OAAO,CAAC,gBAAgB,IAAI;oBAC3E,6DAA6D;iBAC9D;aACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,MAAM,GAAiB;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;YAClD,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,kBAAkB;YACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,iBAAiB,CAAC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEvD,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,sDAAsD;QACtD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QAED,YAAY,CAAC,IAAI,EAAE;YACjB,QAAQ,EAAE,YAAY,EAAE;YACxB,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE;gBACN,OAAO,EAAE,kBAAkB;gBAC3B,cAAc,EAAE,aAAa,CAAC,MAAM;gBACpC,gBAAgB,EAAE,SAAS,EAAE,CAAC,MAAM;gBACpC,WAAW,EAAE,oBAAoB,CAAC,kBAAkB,CAAC;aACtD;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE;gBACZ,8EAA8E;gBAC9E,sEAAsE;aACvE;SACF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,oDAAoD;QACpD,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,gBAAgB,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,cAAc,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,iBAA0B,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,qBAAqB;gBAC5C,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,sBAAsB;YAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,CAAC,wDAAwD,CAAC;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACnD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,2CAA2C;QAClD,YAAY,EAAE;YACZ,2BAA2B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,+EAA+E,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,2BAA2B,gFAAgF,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,gCAAgC;YAClV,0HAA0H,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,6CAA6C;YACtN,oXAAoX;SACrX;KACF,CAAC;AACJ,CAAC"}

package/dist/src/auth/pending.d.ts

@@ -0,0 +1,15 @@
+export interface PendingAuth {
+    version: 1;
+    url: string;
+    port: number;
+    verifier: string;
+    state: string;
+    expected_account?: string;
+    started_at: string;
+    expires_at: string;
+}
+export declare function pendingAuthPath(): string;
+export declare function readPendingAuth(): PendingAuth | null;
+export declare function writePendingAuth(pending: PendingAuth): void;
+export declare function clearPendingAuth(): void;
+export declare function isPendingAuthExpired(pending: PendingAuth): boolean;

package/dist/src/auth/pending.js

@@ -0,0 +1,35 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { configDir } from "../config.js";
+export function pendingAuthPath() {
+    return join(configDir(), "pending-auth.json");
+}
+export function readPendingAuth() {
+    const path = pendingAuthPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (parsed.version !== 1)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function writePendingAuth(pending) {
+    const path = pendingAuthPath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(pending, null, 2)}\n`, { mode: 0o600 });
+}
+export function clearPendingAuth() {
+    const path = pendingAuthPath();
+    if (existsSync(path)) {
+        rmSync(path, { force: true });
+    }
+}
+export function isPendingAuthExpired(pending) {
+    return Date.parse(pending.expires_at) < Date.now();
+}
+//# sourceMappingURL=pending.js.map

package/dist/src/auth/pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.js","sourceRoot":"","sources":["../../../src/auth/pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAazC,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAgB,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC"}

package/dist/src/auth/scopes.d.ts

@@ -0,0 +1,13 @@
+export declare const BASE_SCOPES: readonly ["openid", "email", "profile"];
+export declare const SERVICE_SCOPES: {
+    readonly gmail: "https://www.googleapis.com/auth/gmail.modify";
+    readonly calendar: "https://www.googleapis.com/auth/calendar";
+    readonly docs: "https://www.googleapis.com/auth/documents";
+    readonly drive: "https://www.googleapis.com/auth/drive";
+    readonly slides: "https://www.googleapis.com/auth/presentations";
+};
+export type ServiceName = keyof typeof SERVICE_SCOPES;
+export declare const SERVICES: ServiceName[];
+export declare const REQUIRED_APIS: Record<ServiceName, string>;
+export declare function allScopes(): string[];
+export declare function allApis(): string[];

package/dist/src/auth/scopes.js

@@ -0,0 +1,29 @@
+export const BASE_SCOPES = ["openid", "email", "profile"];
+export const SERVICE_SCOPES = {
+    gmail: "https://www.googleapis.com/auth/gmail.modify",
+    calendar: "https://www.googleapis.com/auth/calendar",
+    docs: "https://www.googleapis.com/auth/documents",
+    drive: "https://www.googleapis.com/auth/drive",
+    slides: "https://www.googleapis.com/auth/presentations",
+};
+export const SERVICES = [
+    "gmail",
+    "calendar",
+    "docs",
+    "drive",
+    "slides",
+];
+export const REQUIRED_APIS = {
+    gmail: "gmail.googleapis.com",
+    calendar: "calendar-json.googleapis.com",
+    docs: "docs.googleapis.com",
+    drive: "drive.googleapis.com",
+    slides: "slides.googleapis.com",
+};
+export function allScopes() {
+    return [...BASE_SCOPES, ...Object.values(SERVICE_SCOPES)];
+}
+export function allApis() {
+    return Object.values(REQUIRED_APIS);
+}
+//# sourceMappingURL=scopes.js.map

package/dist/src/auth/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,8CAA8C;IACrD,QAAQ,EAAE,0CAA0C;IACpD,IAAI,EAAE,2CAA2C;IACjD,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,+CAA+C;CAC/C,CAAC;AAIX,MAAM,CAAC,MAAM,QAAQ,GAAkB;IACrC,OAAO;IACP,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,KAAK,EAAE,sBAAsB;IAC7B,QAAQ,EAAE,8BAA8B;IACxC,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,uBAAuB;CAChC,CAAC;AAEF,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/auth/setup-html.d.ts

@@ -0,0 +1,13 @@
+export declare function setupHtmlPath(): string;
+export interface SetupHtmlOptions {
+    /**
+     * When set, render a prominent "Authenticate now" button at the top of
+     * setup.html pointing at this URL. Used by the OAuth loopback flow to
+     * avoid printing the jumbo URL to the terminal (where it gets mangled).
+     */
+    pendingAuth?: {
+        url: string;
+        account?: string;
+    };
+}
+export declare function writeSetupHtml(options?: SetupHtmlOptions): string;