Crate meerkat_auth_core 

meerkat-auth-core — shared auth primitives for Meerkat.

Owns the concrete implementations of the auth traits declared in meerkat-core: TokenStore backends (File/Keyring/Auto/Ephemeral), RefreshCoordinator impls (InMemory/FileLock), OAuth2 helpers (PKCE/callback/device-code/token-exchange), and generic cloud-IAM authorizers (AWS SigV4, Google ADC, Azure AD).

Non-wasm32 by construction: the filesystem, keyring, and OS lockfile primitives this crate wraps are not available in the browser. Provider crates (meerkat-anthropic, meerkat-openai, meerkat-gemini) depend on this crate for their cloud-IAM backends via feature flags.

Deferral §3 B2 split (2026-04-18): extracted from meerkat-providers.

Re-exports

pub use auth_store::KeyringTokenStore;

pub use auth_store::refresh::FileLockCoordinator;

pub use auth_store::refresh::InMemoryCoordinator;

pub use auth_store::AutoTokenStore;

pub use auth_store::CommandCredentialRunner;

pub use auth_store::CommandCredentialSpec;

pub use auth_store::EphemeralTokenStore;

pub use auth_store::FileTokenStore;

pub use mcp_oauth::BrowserOpener;

pub use mcp_oauth::MCP_INTERACTIVE_LOGIN_TIMEOUT;

pub use mcp_oauth::McpAuthMode;

pub use mcp_oauth::McpOAuthAuthority;

pub use mcp_oauth::McpOAuthError;

pub use mcp_oauth::McpServerIdentity;

pub use resolver::resolve_external_authorizer;

pub use resolver::resolve_simple_secret;

pub use self_hosted::SelfHostedProviderRuntime;

Modules

auth_oauth

OAuth 2.0 helpers.

auth_store

Token storage backends — concrete implementations of meerkat_core::auth::TokenStore and RefreshCoordinator.

authorizers

Dynamic HttpAuthorizer implementations for cloud backends: AWS (SigV4 for Bedrock), Google (ADC + metadata), Azure AD (client-credentials OAuth2).

mcp_oauth

Runtime-discovered OAuth for HTTP MCP servers.

oauth_flow

Short-lived OAuth login flow authority.

resolver

Shared resolver helpers used by provider runtimes.

self_hosted

Self-hosted provider credential runtime.

Structs

RefreshFailureObservation

Typed boundary evidence reported to AuthMachine after a refresh failure.

Enums

RefreshError

Errors raised by the refresh coordinator.

Traits

RefreshCoordinator

Coordinator for token-refresh calls. Implementations coalesce concurrent calls for the same TokenKey.

TokenStore

Cross-process-safe persistence for tokens.