meerkat_auth_core/
lib.rs

1//! meerkat-auth-core — shared auth primitives for Meerkat.
2//!
3//! Owns the concrete implementations of the auth traits declared in
4//! `meerkat-core`: TokenStore backends (File/Keyring/Auto/Ephemeral),
5//! RefreshCoordinator impls (InMemory/FileLock), OAuth2 helpers
6//! (PKCE/callback/device-code/token-exchange), and generic cloud-IAM
7//! authorizers (AWS SigV4, Google ADC, Azure AD).
8//!
9//! Non-wasm32 by construction: the filesystem, keyring, and OS lockfile
10//! primitives this crate wraps are not available in the browser. Provider
11//! crates (`meerkat-anthropic`, `meerkat-openai`, `meerkat-gemini`) depend
12//! on this crate for their cloud-IAM backends via feature flags.
13//!
14//! Deferral §3 B2 split (2026-04-18): extracted from `meerkat-providers`.
15
16#[cfg(not(target_arch = "wasm32"))]
17pub mod auth_oauth;
18#[cfg(not(target_arch = "wasm32"))]
19pub mod auth_store;
20#[cfg(not(target_arch = "wasm32"))]
21pub mod authorizers;
22#[cfg(not(target_arch = "wasm32"))]
23#[cfg(feature = "oauth")]
24pub mod mcp_oauth;
25#[cfg(not(target_arch = "wasm32"))]
26pub mod oauth_flow;
27// `resolver` contains per-source-spec arms that are individually cfg-split
28// for filesystem/command/managed-store sources. The InlineSecret, Env
29// (host env_lookup), ExternalResolver, and authorizer-stub arms compile
30// on wasm32 — that path is what browser WASM callers need when their
31// bootstrap populates `config.realm` with
32// `CredentialSourceSpec::InlineSecret` via
33// `populate_realm_from_api_keys`. Exposing the module on wasm32 is what
34// lets `meerkat-anthropic` / `meerkat-openai` / `meerkat-gemini`
35// register their runtimes on wasm32 so `build_agent` can resolve
36// provider credentials in the browser.
37pub mod resolver;
38pub mod self_hosted;
39
40#[cfg(all(not(target_arch = "wasm32"), feature = "keyring"))]
41pub use auth_store::KeyringTokenStore;
42#[cfg(all(not(target_arch = "wasm32"), feature = "file-lock"))]
43pub use auth_store::refresh::FileLockCoordinator;
44#[cfg(not(target_arch = "wasm32"))]
45pub use auth_store::refresh::InMemoryCoordinator;
46#[cfg(not(target_arch = "wasm32"))]
47pub use auth_store::{
48    AutoTokenStore, CommandCredentialRunner, CommandCredentialSpec, EphemeralTokenStore,
49    FileTokenStore,
50};
51#[cfg(not(target_arch = "wasm32"))]
52#[cfg(feature = "oauth")]
53pub use mcp_oauth::{
54    BrowserOpener, MCP_INTERACTIVE_LOGIN_TIMEOUT, McpAuthMode, McpOAuthAuthority, McpOAuthError,
55    McpServerIdentity,
56};
57#[cfg(not(target_arch = "wasm32"))]
58pub use meerkat_core::auth::{
59    RefreshCoordinator, RefreshError, RefreshFailureObservation, TokenStore,
60};
61
62pub use resolver::{resolve_external_authorizer, resolve_simple_secret};
63pub use self_hosted::SelfHostedProviderRuntime;
meerkat_auth_core/lib.rs

meerkat_auth_core/
lib.rs
