meerkat-auth-core 0.8.9

Shared auth primitives for Meerkat: TokenStore backends, RefreshCoordinator impls, OAuth2 helpers, generic cloud-IAM authorizers (AWS SigV4, Google ADC, Azure AD).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

//! meerkat-auth-core — shared auth primitives for Meerkat.
//!
//! Owns the concrete implementations of the auth traits declared in
//! `meerkat-core`: TokenStore backends (File/Keyring/Auto/Ephemeral),
//! RefreshCoordinator impls (InMemory/FileLock), OAuth2 helpers
//! (PKCE/callback/device-code/token-exchange), and generic cloud-IAM
//! authorizers (AWS SigV4, Google ADC, Azure AD).
//!
//! Non-wasm32 by construction: the filesystem, keyring, and OS lockfile
//! primitives this crate wraps are not available in the browser. Provider
//! crates (`meerkat-anthropic`, `meerkat-openai`, `meerkat-gemini`) depend
//! on this crate for their cloud-IAM backends via feature flags.
//!
//! Deferral §3 B2 split (2026-04-18): extracted from `meerkat-providers`.

#[cfg(not(target_arch = "wasm32"))]
pub mod auth_oauth;
#[cfg(not(target_arch = "wasm32"))]
pub mod auth_store;
#[cfg(not(target_arch = "wasm32"))]
pub mod authorizers;
#[cfg(not(target_arch = "wasm32"))]
mod browser_login;
#[cfg(not(target_arch = "wasm32"))]
#[cfg(feature = "oauth")]
pub mod mcp_oauth;
#[cfg(not(target_arch = "wasm32"))]
pub mod oauth_flow;
// `resolver` contains per-source-spec arms that are individually cfg-split
// for filesystem/command/managed-store sources. The InlineSecret, Env
// (host env_lookup), ExternalResolver, and authorizer-stub arms compile
// on wasm32 — that path is what browser WASM callers need when their
// bootstrap populates `config.realm` with
// `CredentialSourceSpec::InlineSecret` via
// `populate_realm_from_api_keys`. Exposing the module on wasm32 is what
// lets `meerkat-anthropic` / `meerkat-openai` / `meerkat-gemini`
// register their runtimes on wasm32 so `build_agent` can resolve
// provider credentials in the browser.
pub mod resolver;
pub mod self_hosted;

#[cfg(all(not(target_arch = "wasm32"), feature = "keyring"))]
pub use auth_store::KeyringTokenStore;
#[cfg(all(not(target_arch = "wasm32"), feature = "file-lock"))]
pub use auth_store::refresh::FileLockCoordinator;
#[cfg(not(target_arch = "wasm32"))]
pub use auth_store::refresh::InMemoryCoordinator;
#[cfg(not(target_arch = "wasm32"))]
pub use auth_store::{
    AutoTokenStore, CommandCredentialRunner, CommandCredentialSpec, EphemeralTokenStore,
    FileTokenStore,
};
#[cfg(not(target_arch = "wasm32"))]
pub use browser_login::{BrowserOAuthFlowCommit, save_oauth_tokens_and_consume_browser_flow};
#[cfg(not(target_arch = "wasm32"))]
#[cfg(feature = "oauth")]
pub use mcp_oauth::{
    BrowserOpener, MCP_INTERACTIVE_LOGIN_TIMEOUT, McpAuthMode, McpOAuthAuthority, McpOAuthError,
    McpServerIdentity,
};
#[cfg(not(target_arch = "wasm32"))]
pub use meerkat_core::auth::{
    RefreshCoordinator, RefreshError, RefreshFailureObservation, TokenStore,
};

pub use resolver::{resolve_external_authorizer, resolve_simple_secret};
pub use self_hosted::SelfHostedProviderRuntime;