@aliyunrds/ctxdb-shared 0.0.7 → 0.0.8

package/dist/index.js

@@ -483,8 +483,8 @@ function getMemoryImportance(memory) {
   };
   return defaults[cat] ?? 0.5;
 }
-function estimateTokens(text) {
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
+function estimateTokens(text2) {
+  return Math.ceil(text2.length / CHARS_PER_TOKEN);
 }
 function rankMemories(memories, categoryOrder) {
   const orderMap = new Map(categoryOrder.map((cat, i) => [cat, i]));
@@ -698,6 +698,7 @@ async function recall(provider, query, userId, config = {}, sessionId) {
 
 // src/debug-policy.ts
 var OFFICIAL_PRODUCTION_BASE_URLS = [
+  "https://api.cn-hangzhou.agentcontext.aliyuncs.com",
   "https://context-database.aliyuncs.com"
 ];
 function normalizeBaseUrl(value) {
@@ -809,9 +810,9 @@ function sanitizeRecallFailureReason(reason, secrets = []) {
 }
 function sanitizeTraceString(value, secrets) {
   let sanitized = value.replace(/authorization\s*[:=]\s*[^\r\n]*/gi, "Authorization: [REDACTED]").replace(/(api[_-]?key|access[_-]?token)\s*[:=]\s*[^\s,;]+/gi, "$1=[REDACTED]");
-  for (const secret of secrets) {
-    if (!secret) continue;
-    sanitized = sanitized.split(secret).join("[REDACTED]");
+  for (const secret2 of secrets) {
+    if (!secret2) continue;
+    sanitized = sanitized.split(secret2).join("[REDACTED]");
   }
   return sanitized;
 }
@@ -946,6 +947,7 @@ function isRecallTraceRecord(value) {
   const baseValid = record.schema_version === RECALL_TRACE_SCHEMA_VERSION && (record.type === "recall.start" || record.type === "recall.finish") && isIsoTimestamp(record.timestamp) && typeof record.recall_event_id === "string" && record.recall_event_id.length > 0 && (typeof record.session_id === "string" || record.session_id === null) && isRecallTraceAgent(record.agent) && (record.kind === "prompt" || record.kind === "warmup") && typeof record.query === "string" && isRecallTraceRequest(record.request);
   if (!baseValid) return false;
   if (record.type === "recall.start") return true;
+  if (record.type !== "recall.finish") return false;
   const selection = record.selection;
   return isNonNegativeFinite(record.duration_ms) && typeof record.outcome === "string" && TRACE_OUTCOMES.has(record.outcome) && (typeof record.failure_reason === "string" || record.failure_reason === null) && Array.isArray(record.returned_memories) && Array.isArray(record.returned_knowledge) && Boolean(selection) && Array.isArray(selection?.selected) && Array.isArray(selection?.excluded) && isNonNegativeFinite(selection?.token_estimate) && typeof record.recall_context === "string";
 }
@@ -993,8 +995,1617 @@ function readRecallTraces(options = {}) {
   });
   return { records: records.map(({ record }) => record), malformedLines };
 }
+
+// src/device-flow.ts
+import { setTimeout as delay } from "timers/promises";
+var DeviceFlowError = class extends Error {
+  code;
+  constructor(code) {
+    super(code === "service_unavailable" ? "ContextDB authentication service is unavailable. No automatic retry was performed; start a new login later if authorization could not be completed." : `ContextDB device authorization: ${code}. Start a new login if authorization could not be completed.`);
+    this.name = "DeviceFlowError";
+    this.code = code;
+  }
+};
+var invalid = () => new DeviceFlowError("invalid_response");
+var scopes = ["read_only", "read_write", "default"];
+var clientId = "ctxdb-cli";
+var grantType = "urn:ietf:params:oauth:grant-type:device_code";
+function normalizeCoreOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Invalid Core server origin");
+  }
+  const local = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || local && url.protocol === "http:")) throw new Error("Invalid Core server origin");
+  return url.origin;
+}
+var CoreDeviceClient = class {
+  baseUrl;
+  fetchImpl;
+  now;
+  requestTimeoutMs;
+  sleep;
+  constructor(baseUrl, options = {}) {
+    this.baseUrl = normalizeCoreOrigin(baseUrl);
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    this.now = options.now ?? Date.now;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+    this.sleep = options.sleep ?? ((ms, signal) => delay(ms, void 0, { signal }));
+  }
+  async login(options) {
+    const started = this.now();
+    const initial = await this.post("/v1/auth/device/authorize", {
+      client_id: clientId,
+      ...options.initialAgent === void 0 ? {} : { initial_agent: options.initialAgent }
+    }, options.signal);
+    if (!initial.ok) throw new DeviceFlowError("request_rejected");
+    const data = initial.data;
+    const requestId = text(data.request_id, 32), userCode = text(data.user_code, 9), code = text(data.device_code, 43);
+    if (!/^[0-9a-f]{32}$/.test(requestId) || !/^[0-9A-HJKMNP-TV-Z]{4}-[0-9A-HJKMNP-TV-Z]{4}$/.test(userCode) || !/^[A-Za-z0-9_-]{43}$/.test(code)) throw invalid();
+    const expiresIn = integer(data.expires_in, 1, 3600);
+    let interval = integer(data.interval, 1, 3600);
+    const deadline = started + expiresIn * 1e3;
+    options.onPrompt({ requestId, userCode, expiresIn, interval });
+    while (true) {
+      if (options.signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      try {
+        await this.sleep(Math.min(interval * 1e3, deadline - this.now()), options.signal);
+      } catch {
+        throw new DeviceFlowError("cancelled");
+      }
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      const issuedAt = this.now();
+      const result = await this.post("/v1/auth/device/token", { grant_type: grantType, client_id: clientId, device_code: code }, options.signal);
+      if (result.ok) return loginResult(result.data, this.baseUrl, issuedAt, this.now());
+      const error = result.data.error;
+      if (error === "authorization_pending") continue;
+      if (error === "slow_down") {
+        interval = Math.max(interval + 5, integer(result.data.interval, 1, 3605));
+        continue;
+      }
+      if (error === "access_denied" || error === "expired_token" || error === "invalid_grant") throw new DeviceFlowError(error);
+      throw new DeviceFlowError("request_rejected");
+    }
+  }
+  async refresh(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/refresh", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+    return credentialResult(result.data);
+  }
+  async revoke(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/revoke", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+  }
+  requireSameOrigin(baseUrl) {
+    if (normalizeCoreOrigin(baseUrl) !== this.baseUrl) throw new Error("OAuth credential Core origin cannot change");
+  }
+  async post(path, body, signal) {
+    if (signal?.aborted) throw new DeviceFlowError("cancelled");
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(abort, this.requestTimeoutMs);
+    timer.unref?.();
+    try {
+      const response = await this.fetchImpl(this.baseUrl + path, {
+        method: "POST",
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        redirect: "error",
+        credentials: "omit",
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const box = await boundedJson(response);
+      if (!Number.isInteger(box.errorCode)) throw invalid();
+      const ok = response.ok && box.errorCode === 0;
+      const data = (!ok || path === "/v1/auth/token/revoke") && box.data == null ? {} : object(box.data);
+      if (!ok && response.status >= 500) throw new DeviceFlowError("service_unavailable");
+      return { ok, data };
+    } catch (error) {
+      if (signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (error instanceof DeviceFlowError) throw error;
+      throw new DeviceFlowError("network_error");
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+function text(value, maximum) {
+  if (typeof value !== "string" || !value || value.length > maximum || /[\x00-\x1f\x7f]/.test(value)) throw invalid();
+  return value;
+}
+function integer(value, min, max) {
+  if (!Number.isSafeInteger(value) || value < min || value > max) throw invalid();
+  return value;
+}
+function secret(value) {
+  const token = text(value, 8192);
+  if (/\s/.test(token)) throw invalid();
+  return token;
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  return value;
+}
+function credentialResult(data) {
+  if (data.token_type !== "Bearer" || !scopes.includes(data.scope)) throw invalid();
+  return {
+    access_token: secret(data.access_token),
+    refresh_token: secret(data.refresh_token),
+    token_type: "Bearer",
+    expires_in: integer(data.expires_in, 1, 3600),
+    session_id: text(data.session_id, 64),
+    scope: data.scope
+  };
+}
+function loginResult(data, baseUrl, issuedAt, now) {
+  const tokens = credentialResult(data), scope = tokens.scope;
+  if (data.client_id !== clientId || scope !== "default") throw invalid();
+  const expiresAt = issuedAt + tokens.expires_in * 1e3;
+  if (expiresAt <= now) throw invalid();
+  return {
+    baseUrl,
+    workspaceId: text(data.workspace_id, 64),
+    memberId: text(data.member_id, 64),
+    scope,
+    clientId,
+    sessionId: tokens.session_id,
+    accountDisplay: text(data.account_display, 256),
+    issuedAt,
+    expiresAt,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token
+  };
+}
+async function boundedJson(response) {
+  if (!response.body || Number(response.headers.get("content-length")) > 65536) throw invalid();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 65536) {
+        await reader.cancel();
+        throw invalid();
+      }
+      chunks.push(value);
+    }
+    try {
+      return object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+    } catch {
+      throw invalid();
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// src/oauth-credentials.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// src/credentials/local-credential-provider.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// src/credentials/storage.ts
+import { constants, closeSync as closeSync2, existsSync as existsSync2, fstatSync, fsyncSync, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { randomBytes, createHash } from "crypto";
+import { dirname as dirname2 } from "path";
+import { setTimeout as delay2 } from "timers/promises";
+
+// src/windows-private-storage.ts
+import { execFileSync } from "child_process";
+import { join as join2 } from "path";
+var SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$path = $env:CTXDB_PRIVATE_STORAGE_PATH
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$item = Get-Item -LiteralPath $path -Force
+if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
+if ($env:CTXDB_PRIVATE_STORAGE_INITIALIZE -eq '1') {
+  if (-not $item.PSIsContainer) { throw 'not directory' }
+  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+  $acl.SetOwner($sid)
+  $acl.SetAccessRuleProtection($true, $false)
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $path -AclObject $acl
+}
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner' }
+$self = $false
+foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow') {
+    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'other principal' }
+    if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $self = $true }
+  }
+}
+if (-not $self) { throw 'missing owner access' }
+Write-Output 'private'
+`;
+function checkWindowsPrivateStorage(path, initialize, run = execFileSync) {
+  const systemRoot = process.env.SystemRoot;
+  if (!systemRoot) throw new Error("Private Windows credential storage could not be verified.");
+  try {
+    const result = run(
+      join2(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
+      {
+        env: { ...process.env, CTXDB_PRIVATE_STORAGE_PATH: path, CTXDB_PRIVATE_STORAGE_INITIALIZE: initialize ? "1" : "0" },
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 1e4,
+        maxBuffer: 4096,
+        stdio: ["ignore", "pipe", "pipe"]
+      }
+    );
+    if (String(result).trim() !== "private") throw new Error();
+  } catch {
+    throw new Error("Private Windows credential storage could not be verified.");
+  }
+}
+
+// src/credentials/storage.ts
+function privatePath(path, directory = false) {
+  const s = lstatSync(path);
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw new Error("credentials: storage is not private or is invalid");
+  if (process.platform === "win32") {
+    checkWindowsPrivateStorage(path, false);
+    return;
+  }
+  if (s.mode & 63 || process.getuid && s.uid !== process.getuid()) throw new Error("credentials: storage must be private and owner-only (run chmod 600 on credentials.json)");
+}
+function prepareStorage(path) {
+  const dir = dirname2(path);
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    if (process.platform === "win32") checkWindowsPrivateStorage(dir, true);
+  }
+  privatePath(dir, true);
+}
+function readPrivate(path) {
+  if (!existsSync2(path)) return void 0;
+  privatePath(dirname2(path), true);
+  privatePath(path);
+  const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > 16 * 1024 * 1024) throw new Error("credentials: invalid storage");
+    return readFileSync2(fd, "utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function atomicCredentialWrite(path, value) {
+  prepareStorage(path);
+  if (existsSync2(path)) privatePath(path);
+  const temp = path + "." + randomBytes(12).toString("hex") + ".tmp";
+  let fd;
+  try {
+    fd = openSync2(temp, "wx", 384);
+    writeFileSync(fd, JSON.stringify(value, null, 2) + "\n");
+    fsyncSync(fd);
+    closeSync2(fd);
+    fd = void 0;
+    renameSync2(temp, path);
+    if (process.platform !== "win32") {
+      try {
+        const dir = openSync2(dirname2(path), "r");
+        try {
+          fsyncSync(dir);
+        } finally {
+          closeSync2(dir);
+        }
+      } catch {
+      }
+    }
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+    if (existsSync2(temp)) unlinkSync(temp);
+  }
+}
+function withCredentialWriteLock(path, operation) {
+  prepareStorage(path);
+  const lock = path + ".lock", deadline = Date.now() + 1e4;
+  let fd;
+  while (true) {
+    try {
+      fd = openSync2(lock, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: writer lock is busy; check the previous CLI process");
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+    }
+  }
+  try {
+    return operation();
+  } finally {
+    closeSync2(fd);
+    unlinkSync(lock);
+  }
+}
+function operationLockPath(path, key) {
+  return path + "." + createHash("sha256").update(key).digest("hex") + ".lock";
+}
+async function withCredentialOperation(path, key, operation, options = {}) {
+  prepareStorage(path);
+  const lock = operationLockPath(path, key), deadline = Date.now() + (options.lockWaitMs ?? 3e4);
+  while (true) {
+    options.signal?.throwIfAborted();
+    let fd;
+    try {
+      fd = openSync2(lock, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: credential_busy");
+      await delay2(25, void 0, { signal: options.signal });
+      continue;
+    }
+    try {
+      writeFileSync(fd, String(process.pid));
+    } finally {
+      closeSync2(fd);
+    }
+    try {
+      return await operation();
+    } finally {
+      unlinkSync(lock);
+    }
+  }
+}
+
+// src/credentials/types.ts
+var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
+
+// src/credentials/local-credential-provider.ts
+function defaultCredentialsPath() {
+  return join3(homedir2(), ".ctxdb", "credentials.json");
+}
+var object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var fail = (message) => {
+  throw new Error("credentials: " + message);
+};
+function origin(value) {
+  if (typeof value !== "string" || !value) return fail("invalid service URL");
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    return fail("invalid service URL");
+  }
+  if (!["http:", "https:"].includes(u.protocol) || u.username || u.password || u.search || u.hash) return fail("invalid service URL");
+  return u.toString().replace(/\/$/, "");
+}
+function validateApi(raw, internal, v1 = false) {
+  if (!object2(raw.payload) || typeof raw.payload.api_key !== "string" || !raw.payload.api_key) fail("invalid api-key payload");
+  const metadata = v1 ? raw.payload : raw.metadata;
+  origin(metadata.base_url);
+  if (internal) {
+    origin(metadata.login_server);
+    if (!object2(raw.metadata) || !["browser-loopback", "device-code"].includes(raw.metadata.authorization_method) || typeof raw.metadata.issued_at !== "string" || !Number.isFinite(Date.parse(raw.metadata.issued_at))) fail("invalid api-key metadata");
+  }
+}
+function validate(key, raw) {
+  if (!object2(raw) || !["api-key", "oauth-session"].includes(raw.kind) || !object2(raw.payload) || !object2(raw.metadata) || !object2(raw.metadata.owner) || !["ready", "refreshing", "reauth_required", "logged_out"].includes(raw.metadata.state) || typeof raw.metadata.generation !== "string" || !/^[a-f0-9]{32}$/.test(raw.metadata.generation) || !Number.isSafeInteger(raw.metadata.revision) || raw.metadata.revision < 1) fail("invalid credential record");
+  if (key === ACTIVE_CONTEXTDB_CREDENTIAL) {
+    if (raw.kind !== "api-key" || raw.metadata.owner.distribution !== "internal" || raw.metadata.state !== "ready") fail("invalid contextdb/active record");
+  } else if (!/^[a-f0-9]{32}$/.test(key) || raw.metadata.owner.distribution !== "public" || typeof raw.metadata.owner.agent !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.agent) || raw.metadata.owner.loginId !== void 0 && (typeof raw.metadata.owner.loginId !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.loginId))) fail("invalid credential ownership");
+  const fields = raw.kind === "api-key" ? ["api_key"] : ["ready", "refreshing"].includes(raw.metadata.state) ? ["accessToken", "refreshToken"] : [];
+  if (Object.keys(raw.payload).length !== fields.length || fields.some((field) => typeof raw.payload[field] !== "string" || !raw.payload[field])) fail("invalid credential payload; only credential values are allowed");
+  if (raw.kind === "api-key") validateApi(raw, key === ACTIVE_CONTEXTDB_CREDENTIAL);
+}
+function readDocument(path) {
+  const bytes = readPrivate(path);
+  if (bytes === void 0) return { version: 2, records: {} };
+  let doc;
+  try {
+    doc = JSON.parse(bytes);
+  } catch {
+    return fail("credentials.json is not valid JSON");
+  }
+  if (!object2(doc) || ![1, 2].includes(doc.version) || !object2(doc.records)) return fail("unsupported credentials.json schema/version");
+  if (doc.version === 1) {
+    if (Object.keys(doc.records).some((k) => k !== ACTIVE_CONTEXTDB_CREDENTIAL)) fail("unsupported record key in v1 credentials");
+    const active = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+    if (active !== void 0) {
+      if (active.kind !== "api-key") fail("unsupported record kind");
+      validateApi(active, true, true);
+    }
+  } else for (const [key, record] of Object.entries(doc.records)) validate(key, record);
+  return doc;
+}
+function upgrade(doc) {
+  if (doc.version === 2) return doc;
+  const record = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+  return { ...doc, version: 2, records: record ? { [ACTIVE_CONTEXTDB_CREDENTIAL]: legacy(record) } : {} };
+}
+function legacy(record) {
+  const { api_key, ...details } = record.payload;
+  return { kind: record.kind, payload: { api_key }, metadata: {
+    ...details,
+    ...record.metadata,
+    base_url: record.payload.base_url,
+    login_server: record.payload.login_server,
+    owner: { distribution: "internal" },
+    state: "ready",
+    revision: 1,
+    generation: createHash2("sha256").update(JSON.stringify(record)).digest("hex").slice(0, 32)
+  } };
+}
+function snapshot(doc, key) {
+  const raw = Object.hasOwn(doc.records, key) ? doc.records[key] : void 0;
+  const record = raw && (doc.version === 1 ? legacy(raw) : raw);
+  return { key, record, fingerprint: createHash2("sha256").update(JSON.stringify(record) ?? "missing").digest("hex") };
+}
+function apiRecord(record) {
+  if (!record) return void 0;
+  if (record.kind !== "api-key" || record.metadata.owner.distribution !== "internal") return fail("invalid contextdb/active record");
+  return {
+    kind: "api-key",
+    payload: { apiKey: record.payload.api_key },
+    metadata: {
+      baseUrl: origin(record.metadata.base_url),
+      loginServer: origin(record.metadata.login_server),
+      authorizationMethod: record.metadata.authorization_method,
+      issuedAt: record.metadata.issued_at
+    }
+  };
+}
+function internalCandidate(record) {
+  return {
+    kind: "api-key",
+    payload: { api_key: record.payload.apiKey },
+    metadata: {
+      base_url: record.metadata.baseUrl,
+      login_server: record.metadata.loginServer,
+      authorization_method: record.metadata.authorizationMethod,
+      issued_at: record.metadata.issuedAt,
+      owner: { distribution: "internal" },
+      state: "ready"
+    }
+  };
+}
+var LocalCredentialProvider = class {
+  listeners = /* @__PURE__ */ new Set();
+  path;
+  constructor(path = defaultCredentialsPath()) {
+    this.path = path;
+  }
+  snapshot(key) {
+    return snapshot(readDocument(this.path), key);
+  }
+  readStoredRecord(key) {
+    return this.snapshot(key).record;
+  }
+  async readRecord(key) {
+    return apiRecord(this.readStoredRecord(key));
+  }
+  async describeRecord(key) {
+    const r = this.readStoredRecord(key);
+    return { configured: !!r && r.metadata.state === "ready", kind: r?.kind, writable: true };
+  }
+  onRecordUpdated(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Synchronous short commit; callbacks may acquire a config lock, never the reverse. */
+  transaction(operation) {
+    return withCredentialWriteLock(this.path, () => {
+      let doc = readDocument(this.path);
+      const read = (key) => snapshot(doc, key);
+      const check = (expected) => {
+        if (read(expected.key).fingerprint !== expected.fingerprint) fail("authentication changed; the newer credential was preserved, retry the command");
+      };
+      const save = () => {
+        doc = upgrade(doc);
+        atomicCredentialWrite(this.path, doc);
+      };
+      return operation({
+        read,
+        put: (key, candidate, expected) => {
+          if (expected) {
+            if (expected.key !== key) fail("invalid commit target");
+            check(expected);
+          }
+          const before = read(key), previous = before.record;
+          const next = { kind: candidate.kind, payload: candidate.payload, metadata: {
+            ...candidate.metadata,
+            generation: previous?.metadata.generation ?? randomBytes2(16).toString("hex"),
+            revision: (previous?.metadata.revision ?? 0) + 1
+          } };
+          validate(key, next);
+          doc = upgrade(doc);
+          doc.records[key] = next;
+          save();
+          return { before, after: read(key) };
+        },
+        remove: (expected) => {
+          check(expected);
+          if (!read(expected.key).record) return;
+          doc = upgrade(doc);
+          delete doc.records[expected.key];
+          save();
+        }
+      });
+    });
+  }
+  commit(key, record, expected = this.snapshot(key)) {
+    return this.transaction((tx) => tx.put(key, record, expected));
+  }
+  rollback(receipt) {
+    return this.transaction((tx) => {
+      if (tx.read(receipt.after.key).fingerprint !== receipt.after.fingerprint) return false;
+      if (receipt.before.record) tx.put(receipt.after.key, receipt.before.record, receipt.after);
+      else tx.remove(receipt.after);
+      return true;
+    });
+  }
+  async modifyRecord(key, mutate, signal) {
+    const before = this.snapshot(key), next = await mutate(apiRecord(before.record));
+    signal?.throwIfAborted();
+    if (next === void 0) return apiRecord(before.record);
+    const receipt = this.commit(key, internalCandidate(next), before);
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
+    return apiRecord(receipt.after.record);
+  }
+  async deleteRecord(key, signal) {
+    signal?.throwIfAborted();
+    const before = this.snapshot(key);
+    this.transaction((tx) => tx.remove(before));
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
+  }
+};
+function readActiveCredentialSync(path = defaultCredentialsPath()) {
+  return apiRecord(new LocalCredentialProvider(path).readStoredRecord(ACTIVE_CONTEXTDB_CREDENTIAL));
+}
+async function withAuthorizationLock(path, operation, signal) {
+  return withCredentialOperation(path, ACTIVE_CONTEXTDB_CREDENTIAL, () => operation(signal), { signal });
+}
+
+// src/oauth-credentials.ts
+var OAuthCredentialError = class extends Error {
+  code;
+  constructor(code) {
+    const messages = {
+      login_required: "OAuth session needs login; run ctxdb login for this profile.",
+      credential_busy: "OAuth credential is busy. If its previous process crashed, run ctxdb login for a new credential.",
+      invalid_profile: "OAuth credential does not belong to this profile.",
+      unsafe_storage: "OAuth credential storage is not private or is invalid."
+    };
+    super(messages[code]);
+    this.name = "OAuthCredentialError";
+    this.code = code;
+  }
+};
+var loginRequired = () => new OAuthCredentialError("login_required");
+var unsafe = () => new OAuthCredentialError("unsafe_storage");
+var OAuthSessionStore = class {
+  provider;
+  now;
+  lockWaitMs;
+  path;
+  constructor(path, options = {}) {
+    this.path = path;
+    this.provider = new LocalCredentialProvider(path);
+    this.now = options.now ?? Date.now;
+    this.lockWaitMs = options.lockWaitMs ?? 3e4;
+  }
+  saveLogin(profile, session, loginId) {
+    requireProfile(profile);
+    validateSession(session);
+    if (loginId !== void 0) requireProfile(loginId);
+    const ref = randomBytes3(16).toString("hex");
+    this.write(ref, { profile, ...loginId ? { loginId } : {}, state: "ready", session });
+    return ref;
+  }
+  status(ref, owner) {
+    const record = this.read(ref, owner);
+    if (!record) return { state: "missing" };
+    const s = record.session;
+    return {
+      state: record.state,
+      profile: record.profile,
+      baseUrl: s.baseUrl,
+      workspaceId: s.workspaceId,
+      memberId: s.memberId,
+      clientId: s.clientId,
+      scope: s.scope,
+      sessionId: s.sessionId,
+      accountDisplay: s.accountDisplay,
+      accessExpiresAt: s.expiresAt
+    };
+  }
+  async resolve(ref, owner, transport) {
+    const first = this.read(ref, owner);
+    if (!first || ["reauth_required", "logged_out"].includes(first.state)) throw loginRequired();
+    if (first.state === "ready" && !this.needsRefresh(first.session)) return authorization(first.session);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (!this.needsRefresh(current.session)) return authorization(current.session);
+      const started = this.now();
+      this.write(ref, { ...current, state: "refreshing" });
+      try {
+        const response = await transport.refresh(current.session.refreshToken, current.session.baseUrl);
+        const next = rotated(current.session, response, started);
+        if (next.expiresAt <= this.now()) throw loginRequired();
+        this.write(ref, { ...current, state: "ready", session: next });
+        return authorization(next);
+      } catch (error) {
+        this.write(ref, { ...current, state: "reauth_required" });
+        if (error instanceof OAuthCredentialError) throw error;
+        throw loginRequired();
+      }
+    });
+  }
+  async share(ref, profile, loginId, commit) {
+    requireProfile(loginId);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, profile);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (current.loginId && current.loginId !== loginId) throw new OAuthCredentialError("invalid_profile");
+      const receipt = this.write(ref, { ...current, loginId });
+      try {
+        return commit();
+      } catch (error) {
+        this.provider.rollback(receipt);
+        throw error;
+      }
+    });
+  }
+  /** Setup changes the DATA endpoint without replacing the identity or racing a refresh. */
+  async changeBaseUrl(ref, owner, baseUrl, beforeWrite) {
+    await this.withLock(ref, async () => {
+      this.provider.transaction((tx) => {
+        beforeWrite();
+        const current = this.read(ref, owner);
+        if (!current || current.state !== "ready") throw loginRequired();
+        const session = { ...current.session, baseUrl };
+        validateSession(session);
+        const before = tx.read(ref), candidate = credentialForSession({ ...current, session });
+        tx.put(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
+      });
+    });
+  }
+  async logout(ref, owner, transport, beforeRevoke = () => {
+  }) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      this.provider.transaction((tx) => {
+        beforeRevoke();
+        const before = tx.read(ref);
+        if (current && before.record) tx.put(ref, { ...before.record, metadata: { ...before.record.metadata, state: "logged_out" }, payload: {} }, before);
+      });
+      let remoteRevoked = false;
+      try {
+        if (current?.session.refreshToken && current.state !== "logged_out") {
+          await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+          remoteRevoked = true;
+        }
+      } catch {
+      }
+      return { remoteRevoked };
+    });
+  }
+  /** Release config references under the write lock, then delete an unused session.
+   * Waiting on the operation lock first lets an in-flight refresh supply its latest RT.
+   * Returning false from release preserves a session that still has users.
+   */
+  async retire(ref, owner, transport, release) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      const removed = this.provider.transaction((tx) => {
+        if (!release()) return false;
+        tx.remove(tx.read(ref));
+        return true;
+      });
+      if (!removed) return { removed: false, remoteRevoked: false, remoteUnconfirmed: false };
+      if (!current || current.state === "logged_out") return { removed: true, remoteRevoked: false, remoteUnconfirmed: false };
+      try {
+        if (!current.session.refreshToken) throw loginRequired();
+        await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+        return { removed: true, remoteRevoked: true, remoteUnconfirmed: false };
+      } catch {
+        return { removed: true, remoteRevoked: false, remoteUnconfirmed: true };
+      }
+    });
+  }
+  needsRefresh(session) {
+    return this.now() >= session.expiresAt - Math.min(3e4, (session.expiresAt - session.issuedAt) / 2);
+  }
+  read(ref, owner) {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    requireProfile(typeof owner === "string" ? owner : owner.loginId);
+    let stored;
+    try {
+      stored = this.provider.readStoredRecord(ref);
+    } catch {
+      throw unsafe();
+    }
+    if (!stored) return void 0;
+    if (stored.kind !== "oauth-session" || stored.metadata.owner.distribution !== "public") throw new OAuthCredentialError("invalid_profile");
+    const who = stored.metadata.owner;
+    if (typeof owner === "string" ? who.agent !== owner : who.loginId !== owner.loginId) throw new OAuthCredentialError("invalid_profile");
+    return { profile: who.agent, loginId: who.loginId, state: stored.metadata.state, session: oauthSessionFromCredential(stored) };
+  }
+  write(ref, doc) {
+    const before = this.provider.snapshot(ref);
+    if (before.record && ["logged_out", "reauth_required"].includes(before.record.metadata.state)) throw loginRequired();
+    const candidate = credentialForSession(doc);
+    return this.provider.commit(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
+  }
+  async withLock(ref, task) {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    try {
+      return await withCredentialOperation(this.path, ref, task, { lockWaitMs: this.lockWaitMs });
+    } catch (error) {
+      if (error instanceof Error && error.message === "credentials: credential_busy") throw new OAuthCredentialError("credential_busy");
+      throw error;
+    }
+  }
+};
+function oauthSessionCandidate(profile, session, loginId) {
+  requireProfile(profile);
+  validateSession(session);
+  if (loginId !== void 0) requireProfile(loginId);
+  return credentialForSession({ profile, loginId, state: "ready", session });
+}
+function credentialForSession(doc) {
+  const { accessToken, refreshToken, ...metadata } = doc.session;
+  return {
+    kind: "oauth-session",
+    payload: ["ready", "refreshing"].includes(doc.state) ? { accessToken, refreshToken } : {},
+    metadata: {
+      ...metadata,
+      owner: { distribution: "public", agent: doc.profile, ...doc.loginId ? { loginId: doc.loginId } : {} },
+      state: doc.state,
+      authorization_method: "device-code"
+    }
+  };
+}
+function oauthSessionFromCredential(record) {
+  if (record.kind !== "oauth-session") throw unsafe();
+  const m = record.metadata, p = record.payload;
+  const session = {
+    baseUrl: m.baseUrl,
+    workspaceId: m.workspaceId,
+    memberId: m.memberId,
+    clientId: m.clientId,
+    scope: m.scope,
+    sessionId: m.sessionId,
+    accountDisplay: m.accountDisplay,
+    issuedAt: m.issuedAt,
+    expiresAt: m.expiresAt,
+    accessToken: p.accessToken,
+    refreshToken: p.refreshToken
+  };
+  validateSession(session, ["ready", "refreshing"].includes(m.state));
+  return session;
+}
+function requireProfile(profile) {
+  if (typeof profile !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("invalid_profile");
+}
+function validateSession(s, requireTokens = true) {
+  if (!s || typeof s !== "object" || s.clientId !== "ctxdb-cli" || !["read_only", "read_write", "default"].includes(s.scope) || !Number.isSafeInteger(s.issuedAt) || !Number.isSafeInteger(s.expiresAt) || s.expiresAt - s.issuedAt < 1e3 || s.expiresAt - s.issuedAt > 36e5) throw unsafe();
+  for (const value of [s.workspaceId, s.memberId, s.sessionId, s.accountDisplay]) {
+    if (typeof value !== "string" || !value || value.length > 256 || /[\r\n\x00-\x1f]/.test(value)) throw unsafe();
+  }
+  for (const value of requireTokens ? [s.accessToken, s.refreshToken] : []) {
+    if (typeof value !== "string" || !value || value.length > 8192 || /\s/.test(value)) throw unsafe();
+  }
+  let url;
+  try {
+    url = new URL(s.baseUrl);
+  } catch {
+    throw unsafe();
+  }
+  const loopback = ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || loopback && url.protocol === "http:")) throw unsafe();
+}
+function rotated(current, response, issuedAt) {
+  if (!response || response.token_type !== "Bearer" || response.session_id !== current.sessionId || response.scope !== current.scope || !Number.isSafeInteger(response.expires_in) || response.expires_in < 1 || response.expires_in > 3600 || response.refresh_token === current.refreshToken) throw loginRequired();
+  const next = {
+    ...current,
+    accessToken: response.access_token,
+    refreshToken: response.refresh_token,
+    issuedAt,
+    expiresAt: issuedAt + response.expires_in * 1e3
+  };
+  validateSession(next);
+  return next;
+}
+function authorization(session) {
+  return { scheme: "Bearer", value: session.accessToken, baseUrl: session.baseUrl, expiresAt: session.expiresAt };
+}
+
+// src/oauth-profile.ts
+import { dirname as dirname4, join as join4, resolve } from "path";
+
+// src/auth-config.ts
+import { closeSync as closeSync3, existsSync as existsSync3, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
+import { dirname as dirname3 } from "path";
+var AuthConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthConfigError";
+  }
+};
+function readAuthConfig(path) {
+  if (!existsSync3(path)) return { version: 2, agents: {} };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    throw new AuthConfigError("Invalid ctxdb.json; repair the JSON before changing authentication.");
+  }
+  if (raw?.version !== 2 || !object3(raw.agents) || raw.logins !== void 0 && !object3(raw.logins)) {
+    throw new AuthConfigError("Unsupported ctxdb configuration; authentication was not changed.");
+  }
+  return raw;
+}
+function object3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function ownAuthProfile(raw, agent) {
+  const value = Object.hasOwn(raw.agents, agent) ? raw.agents[agent] : void 0;
+  if (value !== void 0 && !object3(value)) throw new AuthConfigError("Invalid agent configuration; repair its section in ctxdb.json.");
+  return value ?? {};
+}
+function requireLoginId(id) {
+  if (typeof id !== "string" || id === "default" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id)) throw new AuthConfigError("Invalid login ID; use an ID from ctxdb auth status --all.");
+}
+function newLoginId(agent, logins) {
+  requireLoginId(`${agent}-00000000`);
+  for (let attempt = 0; attempt < 16; attempt++) {
+    const id = `${agent}-${randomBytes4(4).toString("hex")}`;
+    if (!Object.hasOwn(logins ?? {}, id)) return id;
+  }
+  throw new AuthConfigError("Cannot allocate a unique login ID; retry login.");
+}
+function loginUsers(raw, id) {
+  return Object.keys(raw.agents).filter((agent) => ownAuthProfile(raw, agent).access_credential === id).sort();
+}
+function validateLoginChoice(section) {
+  if (Object.hasOwn(section, "credential_ref")) {
+    if (typeof section.credential_ref !== "string" || !/^[a-f0-9]{32}$/.test(section.credential_ref)) throw new AuthConfigError("Invalid credential_ref; explicitly select --api-key or --login again.");
+    if (Object.hasOwn(section, "access_credential") || section.api_key || section.oauth_credential_ref) throw new AuthConfigError("Conflicting credential_ref and access_credential/api_key/oauth_credential_ref. Keep one authentication choice.");
+  }
+  if (!Object.hasOwn(section, "access_credential")) return;
+  if (section.access_credential === null) return;
+  requireLoginId(section.access_credential);
+  if (section.api_key || section.oauth_credential_ref) {
+    throw new AuthConfigError("Conflicting access_credential and api_key/oauth_credential_ref in this Agent. Keep one authentication choice, or use setup --api-key/--login to replace it.");
+  }
+}
+function authSnapshot(raw, agent) {
+  const s = ownAuthProfile(raw, agent), d = ownAuthProfile(raw, "default");
+  const fields = (s2) => ["credential_ref", "access_credential", "oauth_credential_ref", "api_key", "base_url"].map((k) => [k, Object.hasOwn(s2, k), s2[k]]);
+  return createHash3("sha256").update(JSON.stringify([
+    fields(s),
+    s.access_credential ? raw.logins?.[s.access_credential] : void 0,
+    agent !== "default" && !Object.hasOwn(s, "credential_ref") && !Object.hasOwn(s, "access_credential") && !s.oauth_credential_ref && !Object.hasOwn(s, "api_key") ? fields(d) : void 0
+  ])).digest("hex");
+}
+function assertAuthSnapshot(raw, agent, expected) {
+  if (authSnapshot(raw, agent) !== expected) throw new AuthConfigError("Authentication changed while this operation was running. The newer choice was preserved; retry the command.");
+}
+function preserveDefaultApiKey(raw, store) {
+  const d = ownAuthProfile(raw, "default");
+  if (typeof d.api_key !== "string" || !d.api_key) return;
+  for (const agent of Object.keys(raw.agents)) {
+    if (agent === "default") continue;
+    const s = ownAuthProfile(raw, agent);
+    if (Object.hasOwn(s, "credential_ref") || Object.hasOwn(s, "api_key") || Object.hasOwn(s, "access_credential") || s.oauth_credential_ref) continue;
+    if (!Object.hasOwn(s, "base_url")) s.base_url = d.base_url ?? "https://api.cn-hangzhou.agentcontext.aliyuncs.com";
+    if (store) s.credential_ref = store(agent, d.api_key, s.base_url);
+    else s.api_key = d.api_key;
+  }
+}
+function rejectAuthEnvironment(env) {
+  if (env.CTXDB_ACCESS_TOKEN?.trim() || env.CTXDB_API_KEY || env.CTXDB_BASE_URL) {
+    throw new AuthConfigError("Unset CTXDB_ACCESS_TOKEN, CTXDB_API_KEY and CTXDB_BASE_URL before switching authentication; use --server or --base-url explicitly.");
+  }
+}
+function withAuthConfigLock(path, task) {
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  const lock = path + ".oauth-config.lock", deadline = Date.now() + 1e4;
+  let fd;
+  while (true) {
+    try {
+      fd = openSync3(lock, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw new AuthConfigError("Cannot lock ctxdb configuration.");
+      if (Date.now() >= deadline) throw new AuthConfigError("Configuration is locked. Check the previous CLI process before removing a stale .oauth-config.lock file.");
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+  try {
+    return task();
+  } finally {
+    closeSync3(fd);
+    unlinkSync2(lock);
+  }
+}
+function updateAuthConfig(path, task) {
+  return withAuthConfigLock(path, () => {
+    const raw = readAuthConfig(path), result = task(raw);
+    writeAuthConfig(path, raw);
+    return result;
+  });
+}
+function writeAuthConfig(path, raw) {
+  const temporary = path + "." + randomBytes4(12).toString("hex") + ".tmp";
+  let fd;
+  try {
+    fd = openSync3(temporary, "wx", 384);
+    writeFileSync2(fd, JSON.stringify(raw, null, 2) + "\n");
+    fsyncSync2(fd);
+    closeSync3(fd);
+    fd = void 0;
+    renameSync3(temporary, path);
+    if (process.platform !== "win32") {
+      try {
+        const dir = openSync3(dirname3(path), "r");
+        try {
+          fsyncSync2(dir);
+        } finally {
+          closeSync3(dir);
+        }
+      } catch {
+      }
+    }
+  } finally {
+    if (fd !== void 0) closeSync3(fd);
+    if (existsSync3(temporary)) unlinkSync2(temporary);
+  }
+}
+
+// src/oauth-profile.ts
+function oauthProfile(reference, configPath, profile, baseUrl) {
+  if (reference === void 0) return void 0;
+  if (typeof reference !== "string" || !/^[a-f0-9]{32}$/.test(reference) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("unsafe_storage");
+  const path = resolve(configPath);
+  return {
+    reference,
+    profile,
+    configPath: path,
+    credentialsPath: join4(dirname4(path), "credentials.json"),
+    baseUrl: normalizeCoreOrigin(baseUrl)
+  };
+}
+function oauthProfileFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (section.access_credential === null) return void 0;
+  if (Object.hasOwn(section, "access_credential")) {
+    const id = section.access_credential;
+    requireLoginId(id);
+    const record = raw.logins && Object.hasOwn(raw.logins, id) ? raw.logins[id] : void 0;
+    if (!record?.credential_ref) throw new AuthConfigError("access_credential points to a missing login. Use ctxdb auth status --all and explicitly bind a valid login or log in again.");
+    return storedProfile(record.credential_ref, path, agent, id, baseUrlOverride);
+  }
+  return storedProfile(section.oauth_credential_ref, path, agent, void 0, baseUrlOverride);
+}
+function storedProfile(reference, path, agent, loginId, baseUrlOverride) {
+  const descriptor = oauthProfile(reference, path, agent, "https://api.cn-hangzhou.agentcontext.aliyuncs.com");
+  if (!descriptor) return void 0;
+  const profile = { ...descriptor, ...loginId ? { loginId } : {} };
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (!("baseUrl" in status) || typeof status.baseUrl !== "string") throw new OAuthCredentialError("login_required");
+  profile.baseUrl = normalizeCoreOrigin(status.baseUrl);
+  if (baseUrlOverride && normalizeCoreOrigin(baseUrlOverride) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return profile;
+}
+function oauthOwner(profile) {
+  return profile.loginId ? { loginId: profile.loginId } : profile.profile;
+}
+function oauthProfileStatus(profile) {
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (typeof status.baseUrl === "string" && normalizeCoreOrigin(status.baseUrl) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return status;
+}
+var OAuthProfileProvider = class {
+  selected;
+  constructor(selected) {
+    this.selected = selected;
+  }
+  async resolve(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 3e4, deadline = Date.now() + timeoutMs;
+    const selected = this.selected;
+    const readCurrent = () => {
+      const raw = readAuthConfig(selected.configPath);
+      return oauthProfileFromConfig(raw, selected.configPath, selected.profile);
+    };
+    const current = readCurrent();
+    if (!current || current.baseUrl !== selected.baseUrl) throw new OAuthCredentialError("login_required");
+    const store = new OAuthSessionStore(current.credentialsPath, { lockWaitMs: timeoutMs });
+    const status = oauthProfileStatus(current);
+    if (!("baseUrl" in status) || typeof status.baseUrl !== "string" || normalizeCoreOrigin(status.baseUrl) !== current.baseUrl) throw new OAuthCredentialError("login_required");
+    const authorization2 = await store.resolve(current.reference, oauthOwner(current), {
+      refresh: (rt, url) => new CoreDeviceClient(url, { requestTimeoutMs: Math.max(1, deadline - Date.now()) }).refresh(rt, url)
+    });
+    const after = readCurrent();
+    if (!after || after.reference !== current.reference || after.loginId !== current.loginId || after.baseUrl !== current.baseUrl || oauthProfileStatus(after).state !== "ready") throw new OAuthCredentialError("login_required");
+    return authorization2;
+  }
+};
+
+// src/login-bindings.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { dirname as dirname6, join as join6 } from "path";
+
+// src/data-auth.ts
+import { dirname as dirname5, join as join5 } from "path";
+function selectDataApiCredential(cfg, env = process.env) {
+  const accessToken = env.CTXDB_ACCESS_TOKEN?.trim();
+  if (accessToken) return { type: "access-token", value: accessToken };
+  if (env.CTXDB_API_KEY) return { type: "api-key", value: env.CTXDB_API_KEY };
+  const context = cfg.authContext ? { context: cfg.authContext } : {};
+  if (cfg.oauthCredential) return { type: "oauth-session", profile: cfg.oauthCredential, ...context };
+  return cfg.apiKey ? { type: "api-key", value: cfg.apiKey, ...context } : null;
+}
+var DataApiAuthorizationProvider = class {
+  context;
+  constructor(context) {
+    this.context = context;
+  }
+  async resolve(options = {}) {
+    const c = this.context, raw = readAuthConfig(c.configPath), section = ownAuthProfile(raw, c.agent);
+    const fallback = c.inheritDefaultKey && c.agent !== "default" ? ownAuthProfile(raw, "default") : {};
+    if (c.managedCredentials) {
+      const active = readActiveCredentialSync(c.credentialsPath ?? join5(dirname5(c.configPath), "credentials.json"));
+      if (active) {
+        const baseUrl2 = c.baseUrlOverride ?? active.metadata.baseUrl;
+        if (baseUrl2 !== c.baseUrl) throw new OAuthCredentialError("login_required");
+        return { scheme: "Token", value: active.payload.apiKey, baseUrl: baseUrl2, expiresAt: null };
+      }
+      throw new OAuthCredentialError("login_required");
+    }
+    const stored = publicAuthenticationFromConfig(raw, c.configPath, c.agent, c.baseUrlOverride);
+    const baseUrl = stored?.baseUrl ?? String(c.baseUrlOverride || section.base_url || fallback.base_url || "https://api.cn-hangzhou.agentcontext.aliyuncs.com").replace(/\/+$/, "");
+    if (baseUrl !== c.baseUrl) throw new OAuthCredentialError("login_required");
+    if (stored?.apiKey) return { scheme: "Token", value: stored.apiKey, baseUrl, expiresAt: null };
+    if (stored?.oauthCredential) return new OAuthProfileProvider(stored.oauthCredential).resolve(options);
+    if (Object.hasOwn(section, "access_credential")) throw new OAuthCredentialError("login_required");
+    const key = Object.hasOwn(section, "api_key") ? section.api_key : fallback.api_key;
+    if (typeof key !== "string" || !key) throw new OAuthCredentialError("login_required");
+    return { scheme: "Token", value: key, baseUrl, expiresAt: null };
+  }
+};
+function publicAuthenticationFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (!Object.hasOwn(section, "credential_ref")) {
+    const oauthCredential = oauthProfileFromConfig(raw, path, agent, baseUrlOverride);
+    return oauthCredential ? { baseUrl: oauthCredential.baseUrl, oauthCredential } : void 0;
+  }
+  const r = new LocalCredentialProvider(join5(dirname5(path), "credentials.json")).readStoredRecord(section.credential_ref);
+  if (!r || r.kind !== "api-key" || r.metadata.state !== "ready" || r.metadata.owner.distribution !== "public" || r.metadata.owner.agent !== agent || r.metadata.owner.loginId) {
+    throw new AuthConfigError("credential_ref is missing, invalid or belongs to another Agent. Use setup --api-key/--login to choose a valid credential.");
+  }
+  const baseUrl = String(r.metadata.base_url).replace(/\/+$/, "");
+  if (baseUrlOverride && baseUrl !== baseUrlOverride.replace(/\/+$/, "")) throw new AuthConfigError("Requested base URL does not match the credential origin; no credential was sent.");
+  return { baseUrl, apiKey: r.payload.api_key };
+}
+function publicApiKeyFromConfig(raw, path, agent, baseUrl) {
+  return publicAuthenticationFromConfig(raw, path, agent, baseUrl)?.apiKey;
+}
+function createRequestAuthorizationProvider(credential, baseUrl) {
+  if (credential?.context) return new DataApiAuthorizationProvider(credential.context);
+  if (credential?.type === "oauth-session") return new OAuthProfileProvider(credential.profile);
+  return { async resolve(_options) {
+    if (!credential) throw new OAuthCredentialError("login_required");
+    return {
+      scheme: credential.type === "access-token" ? "Bearer" : "Token",
+      value: credential.value,
+      baseUrl,
+      expiresAt: null
+    };
+  } };
+}
+
+// src/data-endpoint.ts
+var DEFAULT_DATA_BASE_URL = "https://api.cn-hangzhou.agentcontext.aliyuncs.com";
+function validateDataBaseUrl(value, coreOrigin = false) {
+  try {
+    if (typeof value !== "string" || !value || /[\s\x00-\x1f\x7f]/.test(value) || !/^https?:\/\//i.test(value)) throw new Error();
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash) throw new Error();
+    if (coreOrigin) normalizeCoreOrigin(value);
+  } catch {
+    throw new Error(`Invalid --base-url: provide a valid service URL. Recommended: --base-url ${DEFAULT_DATA_BASE_URL}`);
+  }
+}
+
+// src/login-bindings.ts
+function selectedLogin(path, agent) {
+  return oauthProfileFromConfig(readAuthConfig(path), path, agent);
+}
+function namedLogin(raw, path, name) {
+  if (name === "default") {
+    const selected = oauthProfileFromConfig(raw, path, "default");
+    if (!selected) throw new AuthConfigError("default has no login. Run ctxdb login first, or specify an existing login ID.");
+    return selected;
+  }
+  requireLoginId(name);
+  const ref = raw.logins && Object.hasOwn(raw.logins, name) ? raw.logins[name]?.credential_ref : void 0;
+  if (!ref) throw new AuthConfigError("Login ID was not found. Run ctxdb auth status --all.");
+  const temporary = { ...oauthProfile(ref, path, name, DEFAULT_DATA_BASE_URL), loginId: name };
+  const status = new OAuthSessionStore(temporary.credentialsPath).status(ref, { loginId: name });
+  if (!("baseUrl" in status) || typeof status.baseUrl !== "string") throw new AuthConfigError("Login credential is missing; log in again.");
+  return { ...temporary, baseUrl: normalizeCoreOrigin(status.baseUrl) };
+}
+function setChoice(raw, agent, choice) {
+  const s = { ...ownAuthProfile(raw, agent) };
+  delete s.api_key;
+  delete s.oauth_credential_ref;
+  delete s.access_credential;
+  delete s.credential_ref;
+  if (choice.credentialRef !== void 0) s.credential_ref = choice.credentialRef;
+  else s.access_credential = choice.loginId ?? null;
+  delete s.base_url;
+  raw.agents[agent] = s;
+}
+function groupSnapshot(raw, profile) {
+  if (!profile?.loginId) return "";
+  return JSON.stringify([raw.logins?.[profile.loginId], loginUsers(raw, profile.loginId).map((a) => [a, authSnapshot(raw, a)])]);
+}
+function beginLogin(path, agent, name) {
+  const raw = readAuthConfig(path);
+  const previous = name !== void 0 ? namedLogin(raw, path, name) : selectedLogin(path, agent);
+  const update = name !== void 0 || agent === "default";
+  const loginId = update && previous?.loginId ? previous.loginId : newLoginId(name !== void 0 && previous ? previous.profile : agent, raw.logins);
+  return {
+    path,
+    agent,
+    name,
+    previous,
+    loginId,
+    update,
+    snapshot: authSnapshot(raw, agent),
+    previousState: previous ? oauthProfileStatus(previous).state : void 0,
+    group: update ? groupSnapshot(raw, previous) : "",
+    users: update && previous?.loginId ? loginUsers(raw, previous.loginId) : [agent]
+  };
+}
+function commitLogin(pending, reference, baseUrl) {
+  const { path, agent, previous, loginId, update } = pending;
+  const next = { ...oauthProfile(reference, path, agent, baseUrl), loginId };
+  if (oauthProfileStatus(next).state !== "ready") throw new AuthConfigError("New credential is not ready; the old login was preserved.");
+  updateAuthentication(path, (raw) => {
+    assertAuthSnapshot(raw, agent, pending.snapshot);
+    if (previous && pending.previousState !== "logged_out" && oauthProfileStatus(previous).state === "logged_out") {
+      throw new AuthConfigError("Login was revoked during authorization; retry login. The late result was not saved.");
+    }
+    if (update && groupSnapshot(raw, previous) !== pending.group) throw new AuthConfigError("The shared login or its users changed during authorization. Retry and confirm the current users.");
+    raw.logins ??= {};
+    if (!(update && previous?.loginId) && Object.hasOwn(raw.logins, loginId)) throw new AuthConfigError("Login ID already exists; retry login.");
+    raw.logins[loginId] = { ...raw.logins[loginId], credential_ref: reference };
+    if (update && previous?.loginId) {
+      for (const user of loginUsers(raw, loginId)) {
+        oauthProfileFromConfig(raw, path, user);
+        delete ownAuthProfile(raw, user).base_url;
+      }
+    }
+    if (pending.name === void 0) setChoice(raw, agent, { loginId });
+    else if (!previous?.loginId) setChoice(raw, "default", { loginId });
+  });
+}
+function unbindLogin(path, agent) {
+  updateAuthentication(path, (raw) => {
+    const s = ownAuthProfile(raw, agent);
+    if (!Object.hasOwn(s, "access_credential") && !s.oauth_credential_ref) {
+      if (s.api_key || s.credential_ref) throw new AuthConfigError("This Agent uses an API key, not a local login binding.");
+    }
+    setChoice(raw, agent, { loginId: null });
+  });
+}
+async function bindLogin(path, agent, name) {
+  const raw = readAuthConfig(path), expected = authSnapshot(raw, agent), source = namedLogin(raw, path, name);
+  const status = oauthProfileStatus(source);
+  if (status.state !== "ready") throw new AuthConfigError("Selected login is not ready. Run ctxdb login to authorize it again before binding.");
+  const loginId = source.loginId ?? newLoginId(source.profile, raw.logins);
+  const sourceSnapshot = source.loginId ? JSON.stringify(raw.logins?.[source.loginId]) : authSnapshot(raw, "default");
+  const commit = () => updateAuthentication(path, (current) => {
+    assertAuthSnapshot(current, agent, expected);
+    if (source.loginId ? JSON.stringify(current.logins?.[source.loginId]) !== sourceSnapshot : authSnapshot(current, "default") !== sourceSnapshot) throw new AuthConfigError("Source login changed; retry setup --login.");
+    if (oauthProfileStatus({ ...source, loginId }).state !== "ready") throw new AuthConfigError("Source login is no longer ready; log in again.");
+    if (!source.loginId) {
+      current.logins ??= {};
+      if (Object.hasOwn(current.logins, loginId)) throw new AuthConfigError("Login ID already exists; retry setup --login.");
+      current.logins[loginId] = { credential_ref: source.reference };
+      setChoice(current, "default", { loginId });
+    }
+    setChoice(current, agent, { loginId });
+  });
+  if (source.loginId) commit();
+  else await new OAuthSessionStore(source.credentialsPath).share(source.reference, source.profile, loginId, commit);
+}
+async function setupAuthentication(path, agent, options, env = process.env) {
+  if (options.baseUrl !== void 0) validateDataBaseUrl(options.baseUrl);
+  await selectSetupAuthentication(path, agent, options, env);
+  if (options.baseUrl === void 0 && !options.preserveBaseUrl) await resetSetupBaseUrl(path, agent, env);
+}
+async function selectSetupAuthentication(path, agent, options, env = process.env) {
+  if (options.apiKey !== void 0 && options.login !== void 0) throw new AuthConfigError("--api-key and --login are mutually exclusive.");
+  if (options.apiKey !== void 0) {
+    rejectAuthEnvironment(env);
+    if (!options.apiKey.trim()) throw new AuthConfigError("--api-key requires a nonempty value.");
+    const raw2 = readAuthConfig(path);
+    const baseUrl = options.baseUrl ?? (options.preserveBaseUrl ? replacementBaseUrl(raw2, path, agent) : DEFAULT_DATA_BASE_URL);
+    saveSetupKey(path, agent, raw2, options.apiKey, baseUrl);
+    return;
+  }
+  if (options.login !== void 0) {
+    rejectAuthEnvironment(env);
+    const source = namedLogin(readAuthConfig(path), path, options.login);
+    if (options.baseUrl && normalizeCoreOrigin(options.baseUrl) !== source.baseUrl) throw new AuthConfigError("--base-url must match the selected login Core origin.");
+    await bindLogin(path, agent, options.login);
+    return;
+  }
+  const raw = readAuthConfig(path), s = ownAuthProfile(raw, agent);
+  if (Object.hasOwn(s, "credential_ref") || Object.hasOwn(s, "access_credential") || Object.hasOwn(s, "oauth_credential_ref") || s.api_key) {
+    if (options.baseUrl) publicAuthenticationFromConfig(raw, path, agent, options.baseUrl);
+    return;
+  }
+  if (env.CTXDB_ACCESS_TOKEN?.trim() || env.CTXDB_API_KEY) return;
+  const d = ownAuthProfile(raw, "default");
+  if (!Object.hasOwn(s, "api_key") && d.api_key) return;
+  if (agent !== "default" && (d.access_credential || d.oauth_credential_ref)) {
+    rejectAuthEnvironment(env);
+    const source = namedLogin(raw, path, "default");
+    if (options.baseUrl && normalizeCoreOrigin(options.baseUrl) !== source.baseUrl) throw new AuthConfigError("--base-url must match the default login Core origin.");
+    await bindLogin(path, agent, "default");
+  }
+}
+function saveSetupKey(path, agent, raw, apiKey, baseUrl) {
+  const provider = new LocalCredentialProvider(join6(dirname6(path), "credentials.json"));
+  const previousRef = ownAuthProfile(raw, agent).credential_ref;
+  const previous = typeof previousRef === "string" && /^[a-f0-9]{32}$/.test(previousRef) ? provider.snapshot(previousRef) : void 0;
+  const expected = authSnapshot(raw, agent), ref = randomBytes5(16).toString("hex");
+  const receipt = provider.commit(ref, keyCandidate(agent, apiKey, baseUrl));
+  try {
+    updateAuthentication(path, (current) => {
+      assertAuthSnapshot(current, agent, expected);
+      setChoice(current, agent, { credentialRef: ref });
+    });
+  } catch (error) {
+    try {
+      provider.rollback(receipt);
+    } catch {
+    }
+    throw error;
+  }
+  const old = previous?.record;
+  if (old?.kind !== "api-key" || old.metadata.owner.distribution !== "public" || old.metadata.owner.agent !== agent || old.metadata.owner.loginId) return;
+  try {
+    provider.transaction((tx) => withAuthConfigLock(path, () => {
+      const current = readAuthConfig(path);
+      if (Object.values(current.agents).some((s) => s.credential_ref === previousRef || s.oauth_credential_ref === previousRef) || Object.values(current.logins ?? {}).some((s) => s.credential_ref === previousRef)) return;
+      if (tx.read(previousRef).fingerprint === previous.fingerprint) tx.remove(previous);
+    }));
+  } catch {
+    throw new AuthConfigError("New API key was saved, but cleanup of the previous local key could not be confirmed. Inspect credentials.json before retrying.");
+  }
+}
+async function resetSetupBaseUrl(path, agent, env) {
+  const raw = readAuthConfig(path), s = ownAuthProfile(raw, agent);
+  const stored = publicAuthenticationFromConfig(raw, path, agent);
+  if (stored?.baseUrl === DEFAULT_DATA_BASE_URL) return;
+  const profile = stored?.oauthCredential;
+  if (profile) {
+    rejectAuthEnvironment(env);
+    const expected = authSnapshot(raw, agent), group = groupSnapshot(raw, profile);
+    await new OAuthSessionStore(profile.credentialsPath).changeBaseUrl(profile.reference, oauthOwner(profile), DEFAULT_DATA_BASE_URL, () => {
+      const current = readAuthConfig(path);
+      assertAuthSnapshot(current, agent, expected);
+      if (groupSnapshot(current, profile) !== group) throw new AuthConfigError("The shared login or its users changed during setup; retry setup.");
+    });
+    return;
+  }
+  if (Object.hasOwn(s, "access_credential")) return;
+  const d = ownAuthProfile(raw, "default");
+  const key = stored?.apiKey ?? (Object.hasOwn(s, "api_key") ? s.api_key : d.api_key);
+  if (typeof key !== "string" || !key) return;
+  const baseUrl = stored?.baseUrl ?? s.base_url ?? d.base_url ?? DEFAULT_DATA_BASE_URL;
+  if (baseUrl === DEFAULT_DATA_BASE_URL) return;
+  rejectAuthEnvironment(env);
+  if (stored?.apiKey) {
+    const expected = authSnapshot(raw, agent), provider = new LocalCredentialProvider(join6(dirname6(path), "credentials.json"));
+    provider.transaction((tx) => withAuthConfigLock(path, () => {
+      const current = readAuthConfig(path);
+      assertAuthSnapshot(current, agent, expected);
+      publicAuthenticationFromConfig(current, path, agent);
+      const before = tx.read(s.credential_ref);
+      if (!before.record) throw new AuthConfigError("API key credential changed during setup; retry setup.");
+      tx.put(s.credential_ref, { ...before.record, metadata: { ...before.record.metadata, base_url: DEFAULT_DATA_BASE_URL } }, before);
+    }));
+    return;
+  }
+  saveSetupKey(path, agent, raw, key, DEFAULT_DATA_BASE_URL);
+}
+function replacementBaseUrl(raw, path, agent) {
+  for (const candidate of agent === "default" ? [agent] : [agent, "default"]) {
+    try {
+      const stored = publicAuthenticationFromConfig(raw, path, candidate);
+      if (stored) return stored.baseUrl;
+    } catch {
+    }
+    const baseUrl = ownAuthProfile(raw, candidate).base_url;
+    if (typeof baseUrl === "string" && baseUrl) return baseUrl;
+  }
+  return DEFAULT_DATA_BASE_URL;
+}
+function keyCandidate(agent, apiKey, baseUrl) {
+  return { kind: "api-key", payload: { api_key: apiKey }, metadata: { base_url: baseUrl, owner: { distribution: "public", agent }, state: "ready", authorization_method: "api-key" } };
+}
+function updateAuthentication(path, task) {
+  return new LocalCredentialProvider(join6(dirname6(path), "credentials.json")).transaction((tx) => {
+    const created = [];
+    try {
+      return updateAuthConfig(path, (raw) => {
+        const before = structuredClone(raw), snapshot2 = authSnapshot(raw, "default");
+        const result = task(raw), d = ownAuthProfile(before, "default");
+        if (snapshot2 !== authSnapshot(raw, "default") && typeof d.api_key === "string" && d.api_key) {
+          const selected = (s) => ["credential_ref", "access_credential", "api_key"].some((k) => Object.hasOwn(s, k)) || !!s.oauth_credential_ref;
+          for (const agent of Object.keys(before.agents)) {
+            if (agent === "default") continue;
+            const prior = ownAuthProfile(before, agent), current = ownAuthProfile(raw, agent);
+            if (selected(prior) || selected(current)) continue;
+            const baseUrl = prior.base_url ?? d.base_url ?? DEFAULT_DATA_BASE_URL, ref = randomBytes5(16).toString("hex");
+            created.push(tx.put(ref, keyCandidate(agent, d.api_key, baseUrl)));
+            current.credential_ref = ref;
+            delete current.base_url;
+          }
+        }
+        return result;
+      });
+    } catch (error) {
+      for (const receipt of created) {
+        try {
+          tx.remove(receipt.after);
+        } catch {
+          try {
+            process.stderr.write("Credential cleanup could not be confirmed; inspect auth status before retrying.\n");
+          } catch {
+          }
+        }
+      }
+      throw error;
+    }
+  });
+}
+
+// src/login-cleanup.ts
+function referenced(raw, reference) {
+  return Object.values(raw.agents).some((s) => s.oauth_credential_ref === reference || s.credential_ref === reference) || Object.entries(raw.logins ?? {}).some(([id, entry]) => entry.credential_ref === reference && loginUsers(raw, id).length > 0);
+}
+async function releaseLogin(profile, transport, detach = () => {
+}) {
+  return new OAuthSessionStore(profile.credentialsPath).retire(profile.reference, oauthOwner(profile), transport, () => updateAuthConfig(profile.configPath, (raw) => {
+    detach(raw);
+    if (referenced(raw, profile.reference)) return false;
+    for (const [id, entry] of Object.entries(raw.logins ?? {})) {
+      if (entry.credential_ref === profile.reference) delete raw.logins[id];
+    }
+    return true;
+  }));
+}
+async function collectUnusedLogins(path, transport, previous) {
+  const raw = readAuthConfig(path), candidates = /* @__PURE__ */ new Map();
+  if (previous) candidates.set(previous.reference, previous);
+  for (const [id, entry] of Object.entries(raw.logins ?? {})) {
+    if (loginUsers(raw, id).length) continue;
+    const profile = { ...oauthProfile(entry.credential_ref, path, id, "https://api.cn-hangzhou.agentcontext.aliyuncs.com"), loginId: id };
+    if (profile.reference) candidates.set(profile.reference, profile);
+  }
+  let removed = 0, unconfirmed = 0;
+  for (const profile of candidates.values()) {
+    try {
+      const result = await releaseLogin(profile, transport);
+      if (result.removed) removed++;
+      if (result.remoteUnconfirmed) unconfirmed++;
+    } catch {
+      unconfirmed++;
+    }
+  }
+  return { removed, unconfirmed };
+}
+
+// src/authorization/authorization-service.ts
+var AuthorizationError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "AuthorizationError";
+  }
+};
+var AuthorizationDeclinedError = class extends Error {
+  constructor(message = "authorization declined") {
+    super(message);
+    this.name = "AuthorizationDeclinedError";
+  }
+};
+var AuthorizationService = class {
+  flows = /* @__PURE__ */ new Map();
+  running = /* @__PURE__ */ new Map();
+  credentials;
+  constructor(credentials) {
+    this.credentials = credentials;
+  }
+  registerFlow(flow) {
+    if (this.flows.has(flow.key)) throw new AuthorizationError("authorization flow already registered", "DUPLICATE_FLOW");
+    this.flows.set(flow.key, flow);
+    return () => {
+      this.flows.delete(flow.key);
+      this.running.get(flow.key)?.abort();
+    };
+  }
+  list() {
+    return [...this.flows.values()].map((flow) => ({ key: flow.key, label: flow.label, methods: flow.methods, inFlight: this.running.has(flow.key) }));
+  }
+  cancel(key) {
+    this.running.get(key)?.abort();
+  }
+  async begin(request) {
+    const flow = this.flows.get(request.key);
+    if (!flow) throw new AuthorizationError("no authorization flow", "NO_FLOW");
+    const method = request.method ?? flow.methods[0].id;
+    if (!flow.methods.some((m) => m.id === method)) throw new AuthorizationError("authorization method is not supported", "UNKNOWN_METHOD");
+    if (this.running.has(request.key)) throw new AuthorizationError("authorization already running", "ALREADY_IN_FLIGHT");
+    if (request.signal?.aborted) return { status: "cancelled" };
+    const provider = this.credentials, key = request.credentialKey ?? request.key;
+    const before = !request.target && provider ? provider.snapshot(key) : void 0;
+    const controller = new AbortController(), withdraw = () => controller.abort(request.signal?.reason);
+    request.signal?.addEventListener("abort", withdraw, { once: true });
+    this.running.set(request.key, controller);
+    const warn = (message) => {
+      try {
+        request.warn?.(message);
+      } catch {
+      }
+    };
+    const target = request.target ?? {
+      commit: (candidate2) => {
+        if (!provider || !before) throw new AuthorizationError("authorization target required", "NO_TARGET");
+        return provider.commit(key, candidate2, before);
+      },
+      rollback: (receipt2) => provider.rollback(receipt2),
+      retirePrevious: async () => {
+        if (before?.record) await flow.revoke(before.record);
+      }
+    };
+    let candidate, receipt, committed = false;
+    try {
+      candidate = await flow.run({
+        method,
+        signal: controller.signal,
+        notify: (notice) => {
+          try {
+            request.interaction.notify(notice);
+          } catch {
+          }
+        },
+        prompt: (prompt) => request.interaction.prompt(prompt)
+      });
+      controller.signal.throwIfAborted();
+      if (!candidate) throw new AuthorizationError("authorization completed without a candidate credential", "NOT_COMMITTED");
+      await flow.validate?.(candidate, controller.signal);
+      controller.signal.throwIfAborted();
+      receipt = target.commit(candidate);
+      committed = true;
+      try {
+        if (request.finalize) {
+          controller.signal.throwIfAborted();
+          await request.finalize();
+          controller.signal.throwIfAborted();
+        }
+      } catch (error) {
+        try {
+          committed = !target.rollback(receipt);
+        } catch {
+          warn("The previous local credential could not be restored; inspect auth status before retrying.");
+        }
+        throw error;
+      }
+      try {
+        await target.retirePrevious?.();
+      } catch {
+        warn(request.previousCleanupWarning ?? "New login saved; previous credential cleanup could not be confirmed.");
+      }
+      return { status: "authorized" };
+    } catch (error) {
+      if (candidate && !committed) {
+        try {
+          target.discard?.();
+        } catch {
+          warn("New login was not saved; local credential cleanup needs attention.");
+        }
+        try {
+          await flow.revoke(candidate);
+        } catch {
+          warn("New login was not saved; session cleanup could not be confirmed.");
+        }
+      }
+      if (controller.signal.aborted || error instanceof AuthorizationDeclinedError) return { status: "cancelled" };
+      throw error;
+    } finally {
+      request.signal?.removeEventListener("abort", withdraw);
+      this.running.delete(request.key);
+    }
+  }
+};
+
+// src/authorization/public-target.ts
+import { dirname as dirname7, join as join7 } from "path";
+function publicAuthorizationTarget(pending, revoke) {
+  const path = join7(dirname7(pending.path), "credentials.json"), store = new OAuthSessionStore(path), provider = new LocalCredentialProvider(path);
+  let reference, published = false;
+  return {
+    commit(candidate) {
+      const session = oauthSessionFromCredential(candidate);
+      reference = store.saveLogin(pending.agent, session, pending.loginId);
+      commitLogin(pending, reference, session.baseUrl);
+      published = true;
+      return reference;
+    },
+    // Public login has no integration finalize step after publishing. A successful commit is final.
+    rollback() {
+      return false;
+    },
+    discard() {
+      if (!reference || published) return;
+      const snapshot2 = provider.snapshot(reference);
+      if (snapshot2.record) {
+        provider.transaction((tx) => tx.remove(snapshot2));
+      }
+    },
+    async retirePrevious() {
+      const result = await collectUnusedLogins(pending.path, revoke, pending.previous);
+      if (result.unconfirmed) throw new Error("Previous session cleanup unconfirmed");
+    }
+  };
+}
 export {
+  ACTIVE_CONTEXTDB_CREDENTIAL,
+  AuthConfigError,
+  AuthorizationDeclinedError,
+  AuthorizationError,
+  AuthorizationService,
+  CoreDeviceClient,
+  DEFAULT_DATA_BASE_URL,
   DOCUMENT_EVIDENCE_SECTION_TITLE,
+  DataApiAuthorizationProvider,
+  DeviceFlowError,
   EXTERNAL_KNOWLEDGE_PREAMBLE_HEAD,
   GRAPH_CONTEXT_MAX_CHARS,
   GRAPH_CONTEXT_SECTION_TITLE,
@@ -1002,6 +2613,10 @@ export {
   GRAPH_CONTEXT_TAG,
   GRAPH_CONTEXT_TRUNCATION_MARKER,
   GRAPH_CONTEXT_USAGE_NOTICE,
+  LocalCredentialProvider,
+  OAuthCredentialError,
+  OAuthProfileProvider,
+  OAuthSessionStore,
   OFFICIAL_PRODUCTION_BASE_URLS,
   RECALLED_MEMORIES_SAFETY_NOTICE,
   RECALL_TRACE_AGENTS,
@@ -1010,11 +2625,19 @@ export {
   RECALL_TRACE_OUTCOMES,
   RECALL_TRACE_ROTATED_GENERATIONS,
   RECALL_TRACE_SCHEMA_VERSION,
+  assertAuthSnapshot,
+  authSnapshot,
+  beginLogin,
+  bindLogin,
   buildExternalKnowledgeBlock,
   buildExternalKnowledgePreamble,
   buildNormalizedGraphContext,
+  collectUnusedLogins,
+  commitLogin,
   createRecallFinishRecord,
   createRecallStartRecord,
+  createRequestAuthorizationProvider,
+  defaultCredentialsPath,
   extractKnowledgeBaseIds,
   extractKnowledgeChunkContent,
   extractKnowledgeChunkSourceLabel,
@@ -1022,24 +2645,53 @@ export {
   filterMessagesForExtraction,
   formatExternalKnowledgeChunks,
   formatRecalledMemoriesBlock,
+  internalCandidate,
   isGenericAssistantMessage,
   isGraphContextChunk,
   isKnowledgeBaseUploadTurn,
   isNoiseMessage,
   isOfficialProductionUrl,
   isSessionSpecificContent,
+  loginUsers,
+  namedLogin,
   normalizeBaseUrl,
+  normalizeCoreOrigin,
+  oauthOwner,
+  oauthProfile,
+  oauthProfileFromConfig,
+  oauthProfileStatus,
+  oauthSessionCandidate,
+  oauthSessionFromCredential,
+  ownAuthProfile,
   partitionKnowledgeChunks,
+  preserveDefaultApiKey,
+  publicApiKeyFromConfig,
+  publicAuthenticationFromConfig,
+  publicAuthorizationTarget,
+  readActiveCredentialSync,
+  readAuthConfig,
   readRecallTraces,
   recall,
   recallTracePath,
+  rejectAuthEnvironment,
+  releaseLogin,
+  requireLoginId,
   resolveDebugPolicy,
   sanitizeChunkContent,
   sanitizeQuery,
   sanitizeRecallFailureReason,
   selectAndFormatRecalledMemories,
+  selectDataApiCredential,
   selectTurnMessages,
+  selectedLogin,
+  setupAuthentication,
   stripNoiseFromContent,
   truncateGraphContext,
+  unbindLogin,
+  updateAuthConfig,
+  validateDataBaseUrl,
+  validateLoginChoice,
+  withAuthConfigLock,
+  withAuthorizationLock,
   writeRecallTrace
 };