Module auth 

Login support tooling for Muse Code (feature async-client).

Muse’s auth surface is automation-friendly — no TUI to drive:

• auth_set wraps muse auth set --api-key-stdin (the key travels over stdin; Muse refuses to take secrets as arguments).
• DeviceLoginFlow wraps muse login, a plain-stdout OAuth device-code flow: the CLI prints a verification URL and a short code, then polls until the user approves in a browser.
• logout wraps muse logout (removes the saved credential; META_API_KEY in the environment is never touched).
• credentials_present reports whether a run could authenticate right now (env key or saved credential file).

Credential resolution order (per the CLI): META_API_KEY env always wins, then the saved credential at ~/.config/muse/auth.json.

Structs

AuthFile

Shape of ~/.config/muse/auth.json (observed schema_version 1).

DeviceCode

The verification details a DeviceLoginFlow presents to the user. Serde-serializable for relay to remote UIs.

DeviceLoginFlow

An in-flight muse login OAuth device-code flow.

ProviderCredential

One saved provider credential.

Constants

META_API_KEY_VAR

Environment variable that overrides any saved credential.

Functions

auth_set

Save a provider API key: muse auth set --provider <p> --api-key-stdin.

auth_set_with_binary

auth_set against a specific CLI binary.

credentials_path

Path of the saved credential file (~/.config/muse/auth.json), honoring XDG_CONFIG_HOME. None when no home directory resolves.

credentials_present

True when a headless run could authenticate right now: META_API_KEY is set (non-empty) or the saved credential file carries at least one provider. (muse logout empties the providers map but keeps the file, so bare existence is not enough.)

logout

Remove the saved credential: muse logout.

logout_with_binary

logout against a specific CLI binary.