pyric-tools 0.1.0-alpha.7

package/dist/credentials/core/authorize.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Authorization URL + PKCE + state. Pure / isomorphic: uses Web Crypto
+ * (`crypto.getRandomValues` / `crypto.subtle`) and `btoa`, both present in modern
+ * Node and browsers. No `node:*`.
+ */
+import type { OAuthClient } from './types.js';
+/** A random `state` nonce — the CSRF guard the authorizer validates on redirect. */
+export declare function randomState(): string;
+/** PKCE pair: a random verifier and its SHA-256 challenge. */
+export declare function pkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+/** Build the Google consent URL. Pure. */
+export declare function buildAuthUrl(params: {
+    client: OAuthClient;
+    scopes: readonly string[];
+    redirectUri: string;
+    challenge: string;
+    state: string;
+}): string;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/credentials/core/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/authorize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAe9C,oFAAoF;AACpF,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,8DAA8D;AAC9D,wBAAsB,IAAI,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAI7E;AAED,0CAA0C;AAC1C,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAcT"}

package/dist/credentials/core/authorize.js

@@ -0,0 +1,39 @@
+/** base64url-encode bytes (btoa is isomorphic across Node 16+ and browsers). */
+function base64Url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function randomBytes(n) {
+    const b = new Uint8Array(n);
+    crypto.getRandomValues(b);
+    return b;
+}
+/** A random `state` nonce — the CSRF guard the authorizer validates on redirect. */
+export function randomState() {
+    return base64Url(randomBytes(16));
+}
+/** PKCE pair: a random verifier and its SHA-256 challenge. */
+export async function pkce() {
+    const verifier = base64Url(randomBytes(32));
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64Url(new Uint8Array(digest)) };
+}
+/** Build the Google consent URL. Pure. */
+export function buildAuthUrl(params) {
+    const q = new URLSearchParams({
+        client_id: params.client.clientId,
+        redirect_uri: params.redirectUri,
+        response_type: 'code',
+        scope: params.scopes.join(' '),
+        code_challenge: params.challenge,
+        code_challenge_method: 'S256',
+        state: params.state,
+        access_type: 'offline', // required to receive a refresh token
+        prompt: 'consent', // ensure a refresh token even on re-auth
+        include_granted_scopes: 'true', // incremental: a later consent keeps prior grants
+    });
+    return `${params.client.authUri}?${q.toString()}`;
+}
+//# sourceMappingURL=authorize.js.map

package/dist/credentials/core/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/credentials/core/authorize.ts"],"names":[],"mappings":"AAOA,gFAAgF;AAChF,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW;IACzB,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,YAAY,CAAC,MAM5B;IACC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC,SAAS;QAChC,qBAAqB,EAAE,MAAM;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,SAAS,EAAE,sCAAsC;QAC9D,MAAM,EAAE,SAAS,EAAE,yCAAyC;QAC5D,sBAAsB,EAAE,MAAM,EAAE,kDAAkD;KACnF,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpD,CAAC"}

package/dist/credentials/core/client.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OAuth client config. `clientId`/`clientSecret` are INJECTED (the CLI reads them
+ * from env / the baked default, the browser from its config) so the core stays
+ * browser-safe — no `process.env` here.
+ */
+import type { OAuthClient } from './types.js';
+export declare const GOOGLE_AUTH_URI = "https://accounts.google.com/o/oauth2/v2/auth";
+export declare const GOOGLE_TOKEN_URI = "https://oauth2.googleapis.com/token";
+export declare function oauthClient(opts: {
+    clientId: string;
+    clientSecret?: string;
+    scopes?: readonly string[];
+}): OAuthClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/credentials/core/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,eAAO,MAAM,eAAe,iDAAiD,CAAC;AAC9E,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AAEtE,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GAAG,WAAW,CAQd"}

package/dist/credentials/core/client.js

@@ -0,0 +1,13 @@
+import { BASE_SCOPES } from './scopes.js';
+export const GOOGLE_AUTH_URI = 'https://accounts.google.com/o/oauth2/v2/auth';
+export const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+export function oauthClient(opts) {
+    return {
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        authUri: GOOGLE_AUTH_URI,
+        tokenUri: GOOGLE_TOKEN_URI,
+        baseScopes: [...(opts.scopes ?? BASE_SCOPES)],
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/credentials/core/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/credentials/core/client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAEtE,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/credentials/core/exchange.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Token exchange against Google's token endpoint — `fetch` only (the same seam
+ * `from-service-account` uses; tested via a global-`fetch` mock). Shared by login
+ * (auth-code grant) and the user source (refresh grant).
+ */
+import type { OAuthClient, TokenResponse } from './types.js';
+/**
+ * Thrown when a refresh token is rejected (revoked, or expired — e.g. the
+ * Testing-mode 7-day expiry). The CLI maps this to "run `pyric login`" rather
+ * than surfacing a raw token-endpoint error mid-deploy.
+ */
+export declare class AuthExpired extends Error {
+    constructor(message?: string);
+}
+/** Auth-code grant (login). */
+export declare function exchangeAuthCode(params: {
+    client: OAuthClient;
+    code: string;
+    verifier: string;
+    redirectUri: string;
+}): Promise<TokenResponse>;
+/** Refresh grant (the user source's `resolveToken`). */
+export declare function exchangeRefreshToken(client: OAuthClient, refreshToken: string): Promise<TokenResponse>;
+//# sourceMappingURL=exchange.d.ts.map

package/dist/credentials/core/exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/exchange.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,SAAoE;CAIxF;AAgBD,+BAA+B;AAC/B,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,aAAa,CAAC,CASzB;AAED,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOtG"}

package/dist/credentials/core/exchange.js

@@ -0,0 +1,46 @@
+/**
+ * Thrown when a refresh token is rejected (revoked, or expired — e.g. the
+ * Testing-mode 7-day expiry). The CLI maps this to "run `pyric login`" rather
+ * than surfacing a raw token-endpoint error mid-deploy.
+ */
+export class AuthExpired extends Error {
+    constructor(message = 'Your pyric login has expired or was revoked. Run `pyric login`.') {
+        super(message);
+        this.name = 'AuthExpired';
+    }
+}
+async function tokenRequest(client, body) {
+    const res = await fetch(client.tokenUri, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(body).toString(),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        if (res.status === 400 && text.includes('invalid_grant'))
+            throw new AuthExpired();
+        throw new Error(`pyric login: token exchange failed (${res.status}): ${text}`);
+    }
+    return (await res.json());
+}
+/** Auth-code grant (login). */
+export function exchangeAuthCode(params) {
+    return tokenRequest(params.client, {
+        client_id: params.client.clientId,
+        ...(params.client.clientSecret ? { client_secret: params.client.clientSecret } : {}),
+        code: params.code,
+        code_verifier: params.verifier,
+        redirect_uri: params.redirectUri,
+        grant_type: 'authorization_code',
+    });
+}
+/** Refresh grant (the user source's `resolveToken`). */
+export function exchangeRefreshToken(client, refreshToken) {
+    return tokenRequest(client, {
+        client_id: client.clientId,
+        ...(client.clientSecret ? { client_secret: client.clientSecret } : {}),
+        refresh_token: refreshToken,
+        grant_type: 'refresh_token',
+    });
+}
+//# sourceMappingURL=exchange.js.map

package/dist/credentials/core/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../../src/credentials/core/exchange.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,GAAG,iEAAiE;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,MAAmB,EAAE,IAA4B;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,WAAW,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC7C,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,gBAAgB,CAAC,MAKhC;IACC,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,YAAoB;IAC5E,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/credentials/core/flow.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `runLogin` — the env-agnostic login orchestrator. PKCE + state, hand the
+ * authorizer a URL-builder (it owns its redirect), get the code, exchange it,
+ * persist the GRANTED scopes. The authorizer + store are the only env-specific
+ * bits; everything here is isomorphic. `now` is injectable for tests.
+ */
+import type { Authorizer, CredentialStore, OAuthClient, StoredCredential } from './types.js';
+export declare function runLogin(opts: {
+    authorizer: Authorizer;
+    store: CredentialStore;
+    client: OAuthClient;
+    scopes: readonly string[];
+    now?: () => number;
+}): Promise<StoredCredential>;
+//# sourceMappingURL=flow.d.ts.map

package/dist/credentials/core/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/flow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAI7F,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B"}

package/dist/credentials/core/flow.js

@@ -0,0 +1,40 @@
+import { buildAuthUrl, pkce, randomState } from './authorize.js';
+import { exchangeAuthCode } from './exchange.js';
+export async function runLogin(opts) {
+    const { verifier, challenge } = await pkce();
+    const state = randomState();
+    const { code, redirectUri } = await opts.authorizer.authorize({
+        buildUrl: (redirect) => buildAuthUrl({ client: opts.client, scopes: opts.scopes, redirectUri: redirect, challenge, state }),
+        state,
+    });
+    const tokens = await exchangeAuthCode({ client: opts.client, code, verifier, redirectUri });
+    if (!tokens.refresh_token) {
+        throw new Error('pyric login: Google returned no refresh token. Run `pyric logout` and try again.');
+    }
+    const cred = {
+        version: 1,
+        refreshToken: tokens.refresh_token,
+        // GRANTED scopes (from the response), not what we requested.
+        scopes: (tokens.scope ?? opts.scopes.join(' ')).split(' ').filter(Boolean),
+        clientId: opts.client.clientId,
+        email: emailFromIdToken(tokens.id_token),
+        obtainedAt: (opts.now ?? Date.now)(),
+    };
+    await opts.store.write(cred);
+    return cred;
+}
+/** Best-effort email from the id_token payload (for `whoami`). Display-only — no
+ *  signature verification needed; `atob` is isomorphic (Node 16+ and browsers). */
+function emailFromIdToken(idToken) {
+    const payload = idToken?.split('.')[1];
+    if (!payload)
+        return undefined;
+    try {
+        const claims = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
+        return claims.email;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=flow.js.map

package/dist/credentials/core/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/credentials/core/flow.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAM9B;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5D,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACrG,KAAK;KACN,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAqB;QAC7B,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,6DAA6D;QAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1E,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC9B,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;KACrC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mFACmF;AACnF,SAAS,gBAAgB,CAAC,OAAgB;IACxC,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAuB,CAAC;QACrG,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/credentials/core/from-user-credential.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectScope, StoredCredential, OAuthClient } from './types.js';
+export declare function fromUserCredential(cred: StoredCredential, client: OAuthClient, projectId: string): ProjectScope;
+//# sourceMappingURL=from-user-credential.d.ts.map

package/dist/credentials/core/from-user-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-user-credential.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/from-user-credential.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAChB,YAAY,CAMd"}

package/dist/credentials/core/from-user-credential.js

@@ -0,0 +1,19 @@
+/**
+ * A logged-in user credential -> `ProjectScope` — the third credential source,
+ * a sibling of `from-service-account`. `resolveToken` refreshes the access token
+ * on demand (memoized by TTL); a revoked/expired refresh token surfaces as
+ * `AuthExpired` (thrown from the exchange). Browser-safe.
+ *
+ * `projectId` is passed in (a user has many projects; the project comes from
+ * `--project` / `.firebaserc` via `resolveScope`, not from the credential).
+ */
+import { memoizeTtl } from '../../deploy/memoize-ttl.js';
+import { exchangeRefreshToken } from './exchange.js';
+export function fromUserCredential(cred, client, projectId) {
+    const resolveToken = memoizeTtl(async () => {
+        const { access_token, expires_in } = await exchangeRefreshToken(client, cred.refreshToken);
+        return { token: access_token, expiresIn: expires_in };
+    });
+    return Object.freeze({ projectId, resolveToken });
+}
+//# sourceMappingURL=from-user-credential.js.map

package/dist/credentials/core/from-user-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-user-credential.js","sourceRoot":"","sources":["../../../src/credentials/core/from-user-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,UAAU,kBAAkB,CAChC,IAAsB,EACtB,MAAmB,EACnB,SAAiB;IAEjB,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/credentials/core/scopes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * OAuth scope policy. The free path (rules / hosting / indexes) lives on the
+ * narrow `firebase` + `datastore` scopes; only the PAID, rarely-used targets
+ * (functions / storage) need `cloud-platform`, so they lazy-upgrade.
+ *
+ * (Confirm the narrow strings against each API's discovery doc; `cloudfunctions`
+ * and `serviceusage.enable` are the ones with no narrower scope than
+ * cloud-platform, which is exactly why they're the lazy tier.)
+ */
+export declare const SCOPES: {
+    readonly openid: "openid";
+    readonly email: "email";
+    readonly firebase: "https://www.googleapis.com/auth/firebase";
+    readonly firebaseDatabase: "https://www.googleapis.com/auth/firebase.database";
+    readonly datastore: "https://www.googleapis.com/auth/datastore";
+    readonly cloudPlatform: "https://www.googleapis.com/auth/cloud-platform";
+};
+/** The scopes a base `pyric login` requests — the whole free deploy path. */
+export declare const BASE_SCOPES: readonly string[];
+/**
+ * Is `required` covered by what was `granted`? Returns the missing scope (so the
+ * caller can name it in an upgrade prompt) or `null` when already covered.
+ * `cloud-platform` is a superset — granting it covers the narrower scopes too.
+ */
+export declare function missingScope(granted: readonly string[], required: string): string | null;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/credentials/core/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;;;;;;;CAOT,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAqE,CAAC;AAE/G;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxF"}

package/dist/credentials/core/scopes.js

@@ -0,0 +1,32 @@
+/**
+ * OAuth scope policy. The free path (rules / hosting / indexes) lives on the
+ * narrow `firebase` + `datastore` scopes; only the PAID, rarely-used targets
+ * (functions / storage) need `cloud-platform`, so they lazy-upgrade.
+ *
+ * (Confirm the narrow strings against each API's discovery doc; `cloudfunctions`
+ * and `serviceusage.enable` are the ones with no narrower scope than
+ * cloud-platform, which is exactly why they're the lazy tier.)
+ */
+export const SCOPES = {
+    openid: 'openid',
+    email: 'email',
+    firebase: 'https://www.googleapis.com/auth/firebase',
+    firebaseDatabase: 'https://www.googleapis.com/auth/firebase.database',
+    datastore: 'https://www.googleapis.com/auth/datastore',
+    cloudPlatform: 'https://www.googleapis.com/auth/cloud-platform',
+};
+/** The scopes a base `pyric login` requests — the whole free deploy path. */
+export const BASE_SCOPES = [SCOPES.openid, SCOPES.email, SCOPES.firebase, SCOPES.datastore];
+/**
+ * Is `required` covered by what was `granted`? Returns the missing scope (so the
+ * caller can name it in an upgrade prompt) or `null` when already covered.
+ * `cloud-platform` is a superset — granting it covers the narrower scopes too.
+ */
+export function missingScope(granted, required) {
+    if (granted.includes(required))
+        return null;
+    if (granted.includes(SCOPES.cloudPlatform))
+        return null; // cloud-platform subsumes the narrow ones
+    return required;
+}
+//# sourceMappingURL=scopes.js.map

package/dist/credentials/core/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../../src/credentials/core/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,0CAA0C;IACpD,gBAAgB,EAAE,mDAAmD;IACrE,SAAS,EAAE,2CAA2C;IACtD,aAAa,EAAE,gDAAgD;CACvD,CAAC;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AAE/G;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,QAAgB;IACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IACnG,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/credentials/core/types.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The isomorphic login core — contract types. Browser-safe: NO top-level
+ * `node:*`. The two strategy seams (`Authorizer`, `CredentialStore`) are the same
+ * seams the tests fake and the env adapters implement (node/ loopback + file,
+ * browser/ popup + IndexedDB).
+ */
+import type { ProjectScope } from '../../deploy/scope.js';
+export type { ProjectScope };
+/** A Google OAuth client (a "Desktop" installed-app client). The secret is
+ *  bundled, not confidential — PKCE is the real protection. */
+export interface OAuthClient {
+    clientId: string;
+    clientSecret?: string;
+    authUri: string;
+    tokenUri: string;
+    baseScopes: string[];
+}
+/** The persisted credential. Versioned so multi-account is addable without a
+ *  migration. `scopes` are the scopes Google actually GRANTED (from the token
+ *  response), never what we requested. */
+export interface StoredCredential {
+    version: 1;
+    refreshToken: string;
+    /** Granted scopes (from the token response's `scope` field). */
+    scopes: string[];
+    clientId: string;
+    projectId?: string;
+    email?: string;
+    obtainedAt: number;
+}
+/**
+ * Persistence seam. The file impl (node/) writes atomically (temp + rename),
+ * `0600`, and `read()` returns `null` on a missing OR corrupt file — it never
+ * throws (a corrupt store reads as logged-out).
+ */
+export interface CredentialStore {
+    read(): Promise<StoredCredential | null>;
+    write(cred: StoredCredential): Promise<void>;
+    clear(): Promise<void>;
+}
+/** What `runLogin` hands the authorizer. The authorizer owns its own redirect
+ *  (a loopback port in Node, the app origin in the browser), so it builds the
+ *  final URL from `buildUrl(redirectUri)` and validates `state` on the redirect. */
+export interface AuthorizeRequest {
+    buildUrl(redirectUri: string): string;
+    state: string;
+}
+export interface AuthorizeResult {
+    code: string;
+    /** The redirect the authorizer used — the token exchange must reuse it. */
+    redirectUri: string;
+}
+/**
+ * The interactive-acquisition seam (HOW a user authorizes). Impls: loopback
+ * (Node desktop), device-code (Node headless), popup/redirect (browser), fake
+ * (test). Non-interactive credentials (service account, ADC, injected refresh
+ * token) are `resolveScope` sources and need no authorizer.
+ */
+export interface Authorizer {
+    authorize(req: AuthorizeRequest): Promise<AuthorizeResult>;
+}
+/** Google's token-endpoint response (code or refresh grant). */
+export interface TokenResponse {
+    access_token: string;
+    expires_in: number;
+    refresh_token?: string;
+    /** Space-delimited GRANTED scopes. */
+    scope?: string;
+    /** OpenID id_token (a JWT); its payload carries the user's email. */
+    id_token?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/credentials/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,YAAY,EAAE,YAAY,EAAE,CAAC;AAE7B;+DAC+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;0CAE0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;oFAEoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/credentials/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/credentials/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":""}

package/dist/credentials/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Public credential surface (`pyric-tools/credentials`) for consumers that build
+ * their own auth flow on the isomorphic core — notably the playground's BFF
+ * server endpoints. The core (auth-url + PKCE, token exchange, scope policy) plus
+ * the framework-agnostic BFF helpers. Browser-safe core; the BFF helpers are
+ * server-intended but use only `fetch`.
+ */
+export { buildAuthUrl, pkce, randomState } from './core/authorize.js';
+export { exchangeAuthCode, exchangeRefreshToken, AuthExpired } from './core/exchange.js';
+export { oauthClient, GOOGLE_AUTH_URI, GOOGLE_TOKEN_URI } from './core/client.js';
+export { SCOPES, BASE_SCOPES, missingScope } from './core/scopes.js';
+export { startAuth, completeAuth, refreshAccess } from './server/bff.js';
+export type { OAuthClient, StoredCredential, TokenResponse } from './core/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/credentials/index.js

@@ -0,0 +1,13 @@
+/**
+ * Public credential surface (`pyric-tools/credentials`) for consumers that build
+ * their own auth flow on the isomorphic core — notably the playground's BFF
+ * server endpoints. The core (auth-url + PKCE, token exchange, scope policy) plus
+ * the framework-agnostic BFF helpers. Browser-safe core; the BFF helpers are
+ * server-intended but use only `fetch`.
+ */
+export { buildAuthUrl, pkce, randomState } from './core/authorize.js';
+export { exchangeAuthCode, exchangeRefreshToken, AuthExpired } from './core/exchange.js';
+export { oauthClient, GOOGLE_AUTH_URI, GOOGLE_TOKEN_URI } from './core/client.js';
+export { SCOPES, BASE_SCOPES, missingScope } from './core/scopes.js';
+export { startAuth, completeAuth, refreshAccess } from './server/bff.js';
+//# sourceMappingURL=index.js.map

package/dist/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/credentials/node/ensure-scope.d.ts

@@ -0,0 +1,29 @@
+import type { Authorizer, CredentialStore, OAuthClient, ProjectScope } from '../core/types.js';
+type Sink = {
+    write(s: string): void;
+};
+export interface EnsureScopeOptions {
+    requiredScope: string;
+    target: string;
+    scope: ProjectScope;
+    grantedScopes: string[] | 'all';
+    interactive: boolean;
+    env: NodeJS.ProcessEnv;
+    out: Sink;
+    err: Sink;
+    /** Injectable for tests; production builds the loopback + file store + client. */
+    authorizer?: Authorizer;
+    store?: CredentialStore;
+    client?: OAuthClient;
+}
+export type EnsureScopeResult = {
+    ok: true;
+    scope: ProjectScope;
+    grantedScopes: string[] | 'all';
+} | {
+    ok: false;
+    exit: number;
+};
+export declare function ensureScope(opts: EnsureScopeOptions): Promise<EnsureScopeResult>;
+export {};
+//# sourceMappingURL=ensure-scope.d.ts.map

package/dist/credentials/node/ensure-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-scope.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/ensure-scope.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE/F,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,IAAI,CAAC;IACV,kFAAkF;IAClF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhC,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgCtF"}

package/dist/credentials/node/ensure-scope.js

@@ -0,0 +1,42 @@
+/**
+ * The deploy scope-upgrade preflight. A logged-in user lacking a target's
+ * `requiredScope` is re-authorized (an incremental login requesting the union of
+ * granted + needed scopes) BEFORE dispatch — so the login UI never overlaps the
+ * deploy board. A service account (`'all'`) skips this; a non-interactive session
+ * (`--json` / no TTY) fails fast rather than silently opening a browser.
+ */
+import { runLogin } from '../core/flow.js';
+import { missingScope } from '../core/scopes.js';
+import { fromUserCredential } from '../core/from-user-credential.js';
+import { oauthClient } from '../core/client.js';
+import { loopbackAuthorizer } from './loopback-authorizer.js';
+import { fileCredentialStore } from './file-store.js';
+import { openBrowser } from '../../serve/open-browser.js';
+export async function ensureScope(opts) {
+    // A service account carries every scope — nothing to upgrade.
+    if (opts.grantedScopes === 'all')
+        return { ok: true, scope: opts.scope, grantedScopes: 'all' };
+    const need = missingScope(opts.grantedScopes, opts.requiredScope);
+    if (!need)
+        return { ok: true, scope: opts.scope, grantedScopes: opts.grantedScopes };
+    if (!opts.interactive) {
+        opts.err.write(`pyric deploy ${opts.target}: needs the '${need}' scope, which your sign-in doesn't have. ` +
+            'Run `pyric login` interactively to grant it (or use a service account in CI).\n');
+        return { ok: false, exit: 1 };
+    }
+    opts.out.write(`pyric deploy ${opts.target}: needs broader Google access ('${need}'). Re-authorizing in your browser...\n`);
+    const client = opts.client ??
+        oauthClient({ clientId: opts.env.PYRIC_OAUTH_CLIENT_ID ?? '', clientSecret: opts.env.PYRIC_OAUTH_CLIENT_SECRET });
+    const store = opts.store ?? fileCredentialStore();
+    const authorizer = opts.authorizer ?? loopbackAuthorizer({ openUrl: openBrowser, print: (l) => opts.out.write(`${l}\n`) });
+    try {
+        const cred = await runLogin({ authorizer, store, client, scopes: [...opts.grantedScopes, need] });
+        // Build the upgraded scope directly from the new credential — no re-resolve.
+        return { ok: true, scope: fromUserCredential(cred, client, opts.scope.projectId), grantedScopes: cred.scopes };
+    }
+    catch (e) {
+        opts.err.write(`pyric deploy ${opts.target}: re-authorization failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return { ok: false, exit: 2 };
+    }
+}
+//# sourceMappingURL=ensure-scope.js.map

package/dist/credentials/node/ensure-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-scope.js","sourceRoot":"","sources":["../../../src/credentials/node/ensure-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAwB1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,8DAA8D;IAC9D,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAE/F,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IAErF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,KAAK,CACZ,gBAAgB,IAAI,CAAC,MAAM,gBAAgB,IAAI,4CAA4C;YACzF,iFAAiF,CACpF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,CACZ,gBAAgB,IAAI,CAAC,MAAM,mCAAmC,IAAI,yCAAyC,CAC5G,CAAC;IACF,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClG,6EAA6E;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,MAAM,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/credentials/node/file-store.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialStore } from '../core/types.js';
+export declare function defaultCredentialPath(): string;
+export declare function fileCredentialStore(path?: string): CredentialStore;
+//# sourceMappingURL=file-store.d.ts.map

package/dist/credentials/node/file-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/file-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAE1E,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAgC,GAAG,eAAe,CAqC3F"}