auth

type AccountEntry struct {
	Email   string    `json:"email"`
	AddedAt time.Time `json:"added_at"`
}

type AccountStore struct {
	Active   string                  `json:"active"`
	Accounts map[string]AccountEntry `json:"accounts"`
}

type BrowserOpener interface {
	Open(url string) error
}

type BuildAuthURLParams struct {
	// CodeChallenge is the BASE64URL(SHA256(verifier)) string.
	CodeChallenge string
	// State is the OAuth state nonce echoed back at the callback.
	State string
	// Port is the local listener port for the automatic flow. Ignored when
	// IsManual is true.
	Port int
	// IsManual selects the `MANUAL_REDIRECT_URL` redirect_uri (the user pastes
	// the code) instead of `http://localhost:<port>/callback`.
	IsManual bool
	// LoginWithClaudeAI selects `ClaudeAIAuthorizeURL` over
	// `ConsoleAuthorizeURL`. Use true for Max/Pro/Team/Enterprise; false for
	// the Console (API key) flow.
	LoginWithClaudeAI bool
	// InferenceOnly requests the long-lived inference-only scope set
	// (`user:inference` only). Used by SDK callers like Cowork.
	InferenceOnly bool
	// OrgUUID, LoginHint, LoginMethod are optional pre-fill / routing hints.
	OrgUUID     string
	LoginHint   string
	LoginMethod string
}

type CallbackListener struct {
	// contains filtered or unexported fields
}

type Config struct {
	BaseAPIURL           string
	ConsoleAuthorizeURL  string
	ClaudeAIAuthorizeURL string
	ClaudeAIOrigin       string
	TokenURL             string
	APIKeyURL            string
	RolesURL             string
	ConsoleSuccessURL    string
	ClaudeAISuccessURL   string
	ManualRedirectURL    string
	ClientID             string
	MCPProxyURL          string
	MCPProxyPath         string
}

type ExchangeParams struct {
	Code         string
	State        string
	CodeVerifier string
	Port         int
	UseManual    bool
	// ExpiresIn is optional. When > 0 it's sent as `expires_in` in the
	// request body (decoded/1220.js:74). Used by inference-only flows.
	ExpiresIn int
}

type LoginDisplay interface {
	Show(automaticURL, manualURL string)
	// BrowserOpenFailed is called with a non-nil error when the system
	// browser launcher returned an error. Implementations should display
	// a hint that the user must open the URL manually instead.
	BrowserOpenFailed(err error)
}

type LoginFlow struct {
	Cfg     Config
	Tokens  *TokenClient
	Browser BrowserOpener // optional; stdout-only when nil
	// Display is called with both the manual auth URL and (when not nil) the
	// automatic URL. It is responsible for showing them to the user. When
	// the manual flow is desired, Display can also block on user paste.
	Display LoginDisplay
}

type LoginOptions struct {
	// LoginWithClaudeAI selects the Claude.ai (Max/Pro/Team) authorize URL
	// rather than the Console URL. Set true for subscription users.
	LoginWithClaudeAI bool
	// InferenceOnly requests the long-lived `user:inference`-only scope set.
	InferenceOnly bool
	// OrgUUID, LoginHint, LoginMethod are optional pre-fill / routing hints.
	OrgUUID     string
	LoginHint   string
	LoginMethod string
	// SkipBrowserOpen suppresses BrowserOpener.Open and only shows URLs via
	// Display. Used by the SDK control protocol where the SDK client owns
	// the user's display.
	SkipBrowserOpen bool
	// Timeout bounds how long Login will wait for the user to authorize.
	// Zero defaults to 5 minutes.
	Timeout time.Duration
}

type PersistedTokens struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	ExpiresAt    time.Time `json:"expires_at"`
	TokenType    string    `json:"token_type"`
	Scopes       []string  `json:"scopes"`
	APIKey       string    `json:"api_key,omitempty"`
}

type RefreshOptions struct {
	// Scopes overrides the default ScopesClaudeAI. Pass nil for default.
	Scopes []string
	// ExpiresIn, when > 0, requests a specific token lifetime.
	ExpiresIn int
	// ClientID overrides the configured client_id. Used for some SDK paths
	// (decoded/1220.js:91: `K ?? Aq().CLIENT_ID`).
	ClientID string
}

type SystemBrowser struct{}

type TokenClient struct {
	// contains filtered or unexported fields
}

type Tokens struct {
	AccessToken  string
	RefreshToken string
	ExpiresIn    int
	TokenType    string
	Scopes       []string
	// Email is populated from account.email_address in the token response,
	// when the server includes it. Used for multi-account keychain key scoping.
	Email string
}