@aliyunrds/ctxdb 1.0.8-beta.3 → 1.0.8

package/dist/opencode/index.js

@@ -1,10 +1,5 @@
 // <define:__CTXDB_DISTRIBUTION_MANIFEST__>
-var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false } };
-
-// src/config.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2, statSync as statSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false, deviceFlow: true } };
 
 // ../shared/src/graph-context.ts
 var GRAPH_CONTEXT_TAG = "graphrag";
@@ -435,8 +430,8 @@ function getMemoryImportance(memory) {
   };
   return defaults[cat] ?? 0.5;
 }
-function estimateTokens(text) {
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
+function estimateTokens(text2) {
+  return Math.ceil(text2.length / CHARS_PER_TOKEN);
 }
 function rankMemories(memories, categoryOrder) {
   const orderMap = new Map(categoryOrder.map((cat, i) => [cat, i]));
@@ -589,6 +584,7 @@ function selectAndFormatRecalledMemories(memories, userId, config = {}) {
 
 // ../shared/src/debug-policy.ts
 var OFFICIAL_PRODUCTION_BASE_URLS = [
+  "https://api.cn-hangzhou.agentcontext.aliyuncs.com",
   "https://context-database.aliyuncs.com"
 ];
 function normalizeBaseUrl(value) {
@@ -690,9 +686,9 @@ function sanitizeRecallFailureReason(reason, secrets = []) {
 }
 function sanitizeTraceString(value, secrets) {
   let sanitized = value.replace(/authorization\s*[:=]\s*[^\r\n]*/gi, "Authorization: [REDACTED]").replace(/(api[_-]?key|access[_-]?token)\s*[:=]\s*[^\s,;]+/gi, "$1=[REDACTED]");
-  for (const secret of secrets) {
-    if (!secret) continue;
-    sanitized = sanitized.split(secret).join("[REDACTED]");
+  for (const secret2 of secrets) {
+    if (!secret2) continue;
+    sanitized = sanitized.split(secret2).join("[REDACTED]");
   }
   return sanitized;
 }
@@ -827,10 +823,1049 @@ function isRecallTraceRecord(value) {
   const baseValid = record.schema_version === RECALL_TRACE_SCHEMA_VERSION && (record.type === "recall.start" || record.type === "recall.finish") && isIsoTimestamp(record.timestamp) && typeof record.recall_event_id === "string" && record.recall_event_id.length > 0 && (typeof record.session_id === "string" || record.session_id === null) && isRecallTraceAgent(record.agent) && (record.kind === "prompt" || record.kind === "warmup") && typeof record.query === "string" && isRecallTraceRequest(record.request);
   if (!baseValid) return false;
   if (record.type === "recall.start") return true;
+  if (record.type !== "recall.finish") return false;
   const selection = record.selection;
   return isNonNegativeFinite(record.duration_ms) && typeof record.outcome === "string" && TRACE_OUTCOMES.has(record.outcome) && (typeof record.failure_reason === "string" || record.failure_reason === null) && Array.isArray(record.returned_memories) && Array.isArray(record.returned_knowledge) && Boolean(selection) && Array.isArray(selection?.selected) && Array.isArray(selection?.excluded) && isNonNegativeFinite(selection?.token_estimate) && typeof record.recall_context === "string";
 }
 
+// ../shared/src/device-flow.ts
+import { setTimeout as delay } from "timers/promises";
+var DeviceFlowError = class extends Error {
+  code;
+  constructor(code) {
+    super(code === "service_unavailable" ? "ContextDB authentication service is unavailable. No automatic retry was performed; start a new login later if authorization could not be completed." : `ContextDB device authorization: ${code}. Start a new login if authorization could not be completed.`);
+    this.name = "DeviceFlowError";
+    this.code = code;
+  }
+};
+var invalid = () => new DeviceFlowError("invalid_response");
+var scopes = ["read_only", "read_write", "default"];
+var clientId = "ctxdb-cli";
+var grantType = "urn:ietf:params:oauth:grant-type:device_code";
+function normalizeCoreOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Invalid Core server origin");
+  }
+  const local = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || local && url.protocol === "http:")) throw new Error("Invalid Core server origin");
+  return url.origin;
+}
+var CoreDeviceClient = class {
+  baseUrl;
+  fetchImpl;
+  now;
+  requestTimeoutMs;
+  sleep;
+  constructor(baseUrl, options = {}) {
+    this.baseUrl = normalizeCoreOrigin(baseUrl);
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    this.now = options.now ?? Date.now;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+    this.sleep = options.sleep ?? ((ms, signal) => delay(ms, void 0, { signal }));
+  }
+  async login(options) {
+    const started = this.now();
+    const initial = await this.post("/v1/auth/device/authorize", {
+      client_id: clientId,
+      ...options.initialAgent === void 0 ? {} : { initial_agent: options.initialAgent }
+    }, options.signal);
+    if (!initial.ok) throw new DeviceFlowError("request_rejected");
+    const data = initial.data;
+    const requestId = text(data.request_id, 32), userCode = text(data.user_code, 9), code = text(data.device_code, 43);
+    if (!/^[0-9a-f]{32}$/.test(requestId) || !/^[0-9A-HJKMNP-TV-Z]{4}-[0-9A-HJKMNP-TV-Z]{4}$/.test(userCode) || !/^[A-Za-z0-9_-]{43}$/.test(code)) throw invalid();
+    const expiresIn = integer(data.expires_in, 1, 3600);
+    let interval = integer(data.interval, 1, 3600);
+    const deadline = started + expiresIn * 1e3;
+    options.onPrompt({ requestId, userCode, expiresIn, interval });
+    while (true) {
+      if (options.signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      try {
+        await this.sleep(Math.min(interval * 1e3, deadline - this.now()), options.signal);
+      } catch {
+        throw new DeviceFlowError("cancelled");
+      }
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      const issuedAt = this.now();
+      const result = await this.post("/v1/auth/device/token", { grant_type: grantType, client_id: clientId, device_code: code }, options.signal);
+      if (result.ok) return loginResult(result.data, this.baseUrl, issuedAt, this.now());
+      const error = result.data.error;
+      if (error === "authorization_pending") continue;
+      if (error === "slow_down") {
+        interval = Math.max(interval + 5, integer(result.data.interval, 1, 3605));
+        continue;
+      }
+      if (error === "access_denied" || error === "expired_token" || error === "invalid_grant") throw new DeviceFlowError(error);
+      throw new DeviceFlowError("request_rejected");
+    }
+  }
+  async refresh(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/refresh", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+    return credentialResult(result.data);
+  }
+  async revoke(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/revoke", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+  }
+  requireSameOrigin(baseUrl) {
+    if (normalizeCoreOrigin(baseUrl) !== this.baseUrl) throw new Error("OAuth credential Core origin cannot change");
+  }
+  async post(path, body, signal) {
+    if (signal?.aborted) throw new DeviceFlowError("cancelled");
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(abort, this.requestTimeoutMs);
+    timer.unref?.();
+    try {
+      const response = await this.fetchImpl(this.baseUrl + path, {
+        method: "POST",
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        redirect: "error",
+        credentials: "omit",
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const box = await boundedJson(response);
+      if (!Number.isInteger(box.errorCode)) throw invalid();
+      const ok = response.ok && box.errorCode === 0;
+      const data = (!ok || path === "/v1/auth/token/revoke") && box.data == null ? {} : object(box.data);
+      if (!ok && response.status >= 500) throw new DeviceFlowError("service_unavailable");
+      return { ok, data };
+    } catch (error) {
+      if (signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (error instanceof DeviceFlowError) throw error;
+      throw new DeviceFlowError("network_error");
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+function text(value, maximum) {
+  if (typeof value !== "string" || !value || value.length > maximum || /[\x00-\x1f\x7f]/.test(value)) throw invalid();
+  return value;
+}
+function integer(value, min, max) {
+  if (!Number.isSafeInteger(value) || value < min || value > max) throw invalid();
+  return value;
+}
+function secret(value) {
+  const token = text(value, 8192);
+  if (/\s/.test(token)) throw invalid();
+  return token;
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  return value;
+}
+function credentialResult(data) {
+  if (data.token_type !== "Bearer" || !scopes.includes(data.scope)) throw invalid();
+  return {
+    access_token: secret(data.access_token),
+    refresh_token: secret(data.refresh_token),
+    token_type: "Bearer",
+    expires_in: integer(data.expires_in, 1, 3600),
+    session_id: text(data.session_id, 64),
+    scope: data.scope
+  };
+}
+function loginResult(data, baseUrl, issuedAt, now) {
+  const tokens = credentialResult(data), scope = tokens.scope;
+  if (data.client_id !== clientId || scope !== "default") throw invalid();
+  const expiresAt = issuedAt + tokens.expires_in * 1e3;
+  if (expiresAt <= now) throw invalid();
+  return {
+    baseUrl,
+    workspaceId: text(data.workspace_id, 64),
+    memberId: text(data.member_id, 64),
+    scope,
+    clientId,
+    sessionId: tokens.session_id,
+    accountDisplay: text(data.account_display, 256),
+    issuedAt,
+    expiresAt,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token
+  };
+}
+async function boundedJson(response) {
+  if (!response.body || Number(response.headers.get("content-length")) > 65536) throw invalid();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 65536) {
+        await reader.cancel();
+        throw invalid();
+      }
+      chunks.push(value);
+    }
+    try {
+      return object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+    } catch {
+      throw invalid();
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// ../shared/src/oauth-credentials.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// ../shared/src/credentials/local-credential-provider.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// ../shared/src/credentials/storage.ts
+import { constants, closeSync as closeSync2, existsSync as existsSync2, fstatSync, fsyncSync, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { randomBytes, createHash } from "crypto";
+import { dirname as dirname2 } from "path";
+import { setTimeout as delay2 } from "timers/promises";
+
+// ../shared/src/windows-private-storage.ts
+import { execFileSync } from "child_process";
+import { join as join2 } from "path";
+var SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$path = $env:CTXDB_PRIVATE_STORAGE_PATH
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$item = Get-Item -LiteralPath $path -Force
+if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
+if ($env:CTXDB_PRIVATE_STORAGE_INITIALIZE -eq '1') {
+  if (-not $item.PSIsContainer) { throw 'not directory' }
+  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+  $acl.SetOwner($sid)
+  $acl.SetAccessRuleProtection($true, $false)
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $path -AclObject $acl
+}
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner' }
+$self = $false
+foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow') {
+    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'other principal' }
+    if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $self = $true }
+  }
+}
+if (-not $self) { throw 'missing owner access' }
+Write-Output 'private'
+`;
+function checkWindowsPrivateStorage(path, initialize, run = execFileSync) {
+  const systemRoot = process.env.SystemRoot;
+  if (!systemRoot) throw new Error("Private Windows credential storage could not be verified.");
+  try {
+    const result = run(
+      join2(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
+      {
+        env: { ...process.env, CTXDB_PRIVATE_STORAGE_PATH: path, CTXDB_PRIVATE_STORAGE_INITIALIZE: initialize ? "1" : "0" },
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 1e4,
+        maxBuffer: 4096,
+        stdio: ["ignore", "pipe", "pipe"]
+      }
+    );
+    if (String(result).trim() !== "private") throw new Error();
+  } catch {
+    throw new Error("Private Windows credential storage could not be verified.");
+  }
+}
+
+// ../shared/src/credentials/storage.ts
+function privatePath(path, directory = false) {
+  const s = lstatSync(path);
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw new Error("credentials: storage is not private or is invalid");
+  if (process.platform === "win32") {
+    checkWindowsPrivateStorage(path, false);
+    return;
+  }
+  if (s.mode & 63 || process.getuid && s.uid !== process.getuid()) throw new Error("credentials: storage must be private and owner-only (run chmod 600 on credentials.json)");
+}
+function prepareStorage(path) {
+  const dir = dirname2(path);
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    if (process.platform === "win32") checkWindowsPrivateStorage(dir, true);
+  }
+  privatePath(dir, true);
+}
+function readPrivate(path) {
+  if (!existsSync2(path)) return void 0;
+  privatePath(dirname2(path), true);
+  privatePath(path);
+  const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > 16 * 1024 * 1024) throw new Error("credentials: invalid storage");
+    return readFileSync2(fd, "utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function atomicCredentialWrite(path, value) {
+  prepareStorage(path);
+  if (existsSync2(path)) privatePath(path);
+  const temp = path + "." + randomBytes(12).toString("hex") + ".tmp";
+  let fd;
+  try {
+    fd = openSync2(temp, "wx", 384);
+    writeFileSync(fd, JSON.stringify(value, null, 2) + "\n");
+    fsyncSync(fd);
+    closeSync2(fd);
+    fd = void 0;
+    renameSync2(temp, path);
+    if (process.platform !== "win32") {
+      try {
+        const dir = openSync2(dirname2(path), "r");
+        try {
+          fsyncSync(dir);
+        } finally {
+          closeSync2(dir);
+        }
+      } catch {
+      }
+    }
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+    if (existsSync2(temp)) unlinkSync(temp);
+  }
+}
+function withCredentialWriteLock(path, operation) {
+  prepareStorage(path);
+  const lock = path + ".lock", deadline = Date.now() + 1e4;
+  let fd;
+  while (true) {
+    try {
+      fd = openSync2(lock, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: writer lock is busy; check the previous CLI process");
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+    }
+  }
+  try {
+    return operation();
+  } finally {
+    closeSync2(fd);
+    unlinkSync(lock);
+  }
+}
+function operationLockPath(path, key) {
+  return path + "." + createHash("sha256").update(key).digest("hex") + ".lock";
+}
+async function withCredentialOperation(path, key, operation, options = {}) {
+  prepareStorage(path);
+  const lock = operationLockPath(path, key), deadline = Date.now() + (options.lockWaitMs ?? 3e4);
+  while (true) {
+    options.signal?.throwIfAborted();
+    let fd;
+    try {
+      fd = openSync2(lock, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: credential_busy");
+      await delay2(25, void 0, { signal: options.signal });
+      continue;
+    }
+    try {
+      writeFileSync(fd, String(process.pid));
+    } finally {
+      closeSync2(fd);
+    }
+    try {
+      return await operation();
+    } finally {
+      unlinkSync(lock);
+    }
+  }
+}
+
+// ../shared/src/credentials/types.ts
+var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
+
+// ../shared/src/credentials/local-credential-provider.ts
+function defaultCredentialsPath() {
+  return join3(homedir2(), ".ctxdb", "credentials.json");
+}
+var object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var fail = (message) => {
+  throw new Error("credentials: " + message);
+};
+function origin(value) {
+  if (typeof value !== "string" || !value) return fail("invalid service URL");
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    return fail("invalid service URL");
+  }
+  if (!["http:", "https:"].includes(u.protocol) || u.username || u.password || u.search || u.hash) return fail("invalid service URL");
+  return u.toString().replace(/\/$/, "");
+}
+function validateApi(raw, internal, v1 = false) {
+  if (!object2(raw.payload) || typeof raw.payload.api_key !== "string" || !raw.payload.api_key) fail("invalid api-key payload");
+  const metadata = v1 ? raw.payload : raw.metadata;
+  origin(metadata.base_url);
+  if (internal) {
+    origin(metadata.login_server);
+    if (!object2(raw.metadata) || !["browser-loopback", "device-code"].includes(raw.metadata.authorization_method) || typeof raw.metadata.issued_at !== "string" || !Number.isFinite(Date.parse(raw.metadata.issued_at))) fail("invalid api-key metadata");
+  }
+}
+function validate(key, raw) {
+  if (!object2(raw) || !["api-key", "oauth-session"].includes(raw.kind) || !object2(raw.payload) || !object2(raw.metadata) || !object2(raw.metadata.owner) || !["ready", "refreshing", "reauth_required", "logged_out"].includes(raw.metadata.state) || typeof raw.metadata.generation !== "string" || !/^[a-f0-9]{32}$/.test(raw.metadata.generation) || !Number.isSafeInteger(raw.metadata.revision) || raw.metadata.revision < 1) fail("invalid credential record");
+  if (key === ACTIVE_CONTEXTDB_CREDENTIAL) {
+    if (raw.kind !== "api-key" || raw.metadata.owner.distribution !== "internal" || raw.metadata.state !== "ready") fail("invalid contextdb/active record");
+  } else if (!/^[a-f0-9]{32}$/.test(key) || raw.metadata.owner.distribution !== "public" || typeof raw.metadata.owner.agent !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.agent) || raw.metadata.owner.loginId !== void 0 && (typeof raw.metadata.owner.loginId !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.loginId))) fail("invalid credential ownership");
+  const fields = raw.kind === "api-key" ? ["api_key"] : ["ready", "refreshing"].includes(raw.metadata.state) ? ["accessToken", "refreshToken"] : [];
+  if (Object.keys(raw.payload).length !== fields.length || fields.some((field) => typeof raw.payload[field] !== "string" || !raw.payload[field])) fail("invalid credential payload; only credential values are allowed");
+  if (raw.kind === "api-key") validateApi(raw, key === ACTIVE_CONTEXTDB_CREDENTIAL);
+}
+function readDocument(path) {
+  const bytes = readPrivate(path);
+  if (bytes === void 0) return { version: 2, records: {} };
+  let doc;
+  try {
+    doc = JSON.parse(bytes);
+  } catch {
+    return fail("credentials.json is not valid JSON");
+  }
+  if (!object2(doc) || ![1, 2].includes(doc.version) || !object2(doc.records)) return fail("unsupported credentials.json schema/version");
+  if (doc.version === 1) {
+    if (Object.keys(doc.records).some((k) => k !== ACTIVE_CONTEXTDB_CREDENTIAL)) fail("unsupported record key in v1 credentials");
+    const active = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+    if (active !== void 0) {
+      if (active.kind !== "api-key") fail("unsupported record kind");
+      validateApi(active, true, true);
+    }
+  } else for (const [key, record] of Object.entries(doc.records)) validate(key, record);
+  return doc;
+}
+function upgrade(doc) {
+  if (doc.version === 2) return doc;
+  const record = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+  return { ...doc, version: 2, records: record ? { [ACTIVE_CONTEXTDB_CREDENTIAL]: legacy(record) } : {} };
+}
+function legacy(record) {
+  const { api_key, ...details } = record.payload;
+  return { kind: record.kind, payload: { api_key }, metadata: {
+    ...details,
+    ...record.metadata,
+    base_url: record.payload.base_url,
+    login_server: record.payload.login_server,
+    owner: { distribution: "internal" },
+    state: "ready",
+    revision: 1,
+    generation: createHash2("sha256").update(JSON.stringify(record)).digest("hex").slice(0, 32)
+  } };
+}
+function snapshot(doc, key) {
+  const raw = Object.hasOwn(doc.records, key) ? doc.records[key] : void 0;
+  const record = raw && (doc.version === 1 ? legacy(raw) : raw);
+  return { key, record, fingerprint: createHash2("sha256").update(JSON.stringify(record) ?? "missing").digest("hex") };
+}
+function apiRecord(record) {
+  if (!record) return void 0;
+  if (record.kind !== "api-key" || record.metadata.owner.distribution !== "internal") return fail("invalid contextdb/active record");
+  return {
+    kind: "api-key",
+    payload: { apiKey: record.payload.api_key },
+    metadata: {
+      baseUrl: origin(record.metadata.base_url),
+      loginServer: origin(record.metadata.login_server),
+      authorizationMethod: record.metadata.authorization_method,
+      issuedAt: record.metadata.issued_at
+    }
+  };
+}
+function internalCandidate(record) {
+  return {
+    kind: "api-key",
+    payload: { api_key: record.payload.apiKey },
+    metadata: {
+      base_url: record.metadata.baseUrl,
+      login_server: record.metadata.loginServer,
+      authorization_method: record.metadata.authorizationMethod,
+      issued_at: record.metadata.issuedAt,
+      owner: { distribution: "internal" },
+      state: "ready"
+    }
+  };
+}
+var LocalCredentialProvider = class {
+  listeners = /* @__PURE__ */ new Set();
+  path;
+  constructor(path = defaultCredentialsPath()) {
+    this.path = path;
+  }
+  snapshot(key) {
+    return snapshot(readDocument(this.path), key);
+  }
+  readStoredRecord(key) {
+    return this.snapshot(key).record;
+  }
+  async readRecord(key) {
+    return apiRecord(this.readStoredRecord(key));
+  }
+  async describeRecord(key) {
+    const r = this.readStoredRecord(key);
+    return { configured: !!r && r.metadata.state === "ready", kind: r?.kind, writable: true };
+  }
+  onRecordUpdated(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Synchronous short commit; callbacks may acquire a config lock, never the reverse. */
+  transaction(operation) {
+    return withCredentialWriteLock(this.path, () => {
+      let doc = readDocument(this.path);
+      const read = (key) => snapshot(doc, key);
+      const check = (expected) => {
+        if (read(expected.key).fingerprint !== expected.fingerprint) fail("authentication changed; the newer credential was preserved, retry the command");
+      };
+      const save = () => {
+        doc = upgrade(doc);
+        atomicCredentialWrite(this.path, doc);
+      };
+      return operation({
+        read,
+        put: (key, candidate, expected) => {
+          if (expected) {
+            if (expected.key !== key) fail("invalid commit target");
+            check(expected);
+          }
+          const before = read(key), previous = before.record;
+          const next = { kind: candidate.kind, payload: candidate.payload, metadata: {
+            ...candidate.metadata,
+            generation: previous?.metadata.generation ?? randomBytes2(16).toString("hex"),
+            revision: (previous?.metadata.revision ?? 0) + 1
+          } };
+          validate(key, next);
+          doc = upgrade(doc);
+          doc.records[key] = next;
+          save();
+          return { before, after: read(key) };
+        },
+        remove: (expected) => {
+          check(expected);
+          if (!read(expected.key).record) return;
+          doc = upgrade(doc);
+          delete doc.records[expected.key];
+          save();
+        }
+      });
+    });
+  }
+  commit(key, record, expected = this.snapshot(key)) {
+    return this.transaction((tx) => tx.put(key, record, expected));
+  }
+  rollback(receipt) {
+    return this.transaction((tx) => {
+      if (tx.read(receipt.after.key).fingerprint !== receipt.after.fingerprint) return false;
+      if (receipt.before.record) tx.put(receipt.after.key, receipt.before.record, receipt.after);
+      else tx.remove(receipt.after);
+      return true;
+    });
+  }
+  async modifyRecord(key, mutate, signal) {
+    const before = this.snapshot(key), next = await mutate(apiRecord(before.record));
+    signal?.throwIfAborted();
+    if (next === void 0) return apiRecord(before.record);
+    const receipt = this.commit(key, internalCandidate(next), before);
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
+    return apiRecord(receipt.after.record);
+  }
+  async deleteRecord(key, signal) {
+    signal?.throwIfAborted();
+    const before = this.snapshot(key);
+    this.transaction((tx) => tx.remove(before));
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
+  }
+};
+function readActiveCredentialSync(path = defaultCredentialsPath()) {
+  return apiRecord(new LocalCredentialProvider(path).readStoredRecord(ACTIVE_CONTEXTDB_CREDENTIAL));
+}
+
+// ../shared/src/oauth-credentials.ts
+var OAuthCredentialError = class extends Error {
+  code;
+  constructor(code) {
+    const messages = {
+      login_required: "OAuth session needs login; run ctxdb login for this profile.",
+      credential_busy: "OAuth credential is busy. If its previous process crashed, run ctxdb login for a new credential.",
+      invalid_profile: "OAuth credential does not belong to this profile.",
+      unsafe_storage: "OAuth credential storage is not private or is invalid."
+    };
+    super(messages[code]);
+    this.name = "OAuthCredentialError";
+    this.code = code;
+  }
+};
+var loginRequired = () => new OAuthCredentialError("login_required");
+var unsafe = () => new OAuthCredentialError("unsafe_storage");
+var OAuthSessionStore = class {
+  provider;
+  now;
+  lockWaitMs;
+  path;
+  constructor(path, options = {}) {
+    this.path = path;
+    this.provider = new LocalCredentialProvider(path);
+    this.now = options.now ?? Date.now;
+    this.lockWaitMs = options.lockWaitMs ?? 3e4;
+  }
+  saveLogin(profile, session, loginId) {
+    requireProfile(profile);
+    validateSession(session);
+    if (loginId !== void 0) requireProfile(loginId);
+    const ref = randomBytes3(16).toString("hex");
+    this.write(ref, { profile, ...loginId ? { loginId } : {}, state: "ready", session });
+    return ref;
+  }
+  status(ref, owner) {
+    const record = this.read(ref, owner);
+    if (!record) return { state: "missing" };
+    const s = record.session;
+    return {
+      state: record.state,
+      profile: record.profile,
+      baseUrl: s.baseUrl,
+      workspaceId: s.workspaceId,
+      memberId: s.memberId,
+      clientId: s.clientId,
+      scope: s.scope,
+      sessionId: s.sessionId,
+      accountDisplay: s.accountDisplay,
+      accessExpiresAt: s.expiresAt
+    };
+  }
+  async resolve(ref, owner, transport) {
+    const first = this.read(ref, owner);
+    if (!first || ["reauth_required", "logged_out"].includes(first.state)) throw loginRequired();
+    if (first.state === "ready" && !this.needsRefresh(first.session)) return authorization(first.session);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (!this.needsRefresh(current.session)) return authorization(current.session);
+      const started = this.now();
+      this.write(ref, { ...current, state: "refreshing" });
+      try {
+        const response = await transport.refresh(current.session.refreshToken, current.session.baseUrl);
+        const next = rotated(current.session, response, started);
+        if (next.expiresAt <= this.now()) throw loginRequired();
+        this.write(ref, { ...current, state: "ready", session: next });
+        return authorization(next);
+      } catch (error) {
+        this.write(ref, { ...current, state: "reauth_required" });
+        if (error instanceof OAuthCredentialError) throw error;
+        throw loginRequired();
+      }
+    });
+  }
+  async share(ref, profile, loginId, commit) {
+    requireProfile(loginId);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, profile);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (current.loginId && current.loginId !== loginId) throw new OAuthCredentialError("invalid_profile");
+      const receipt = this.write(ref, { ...current, loginId });
+      try {
+        return commit();
+      } catch (error) {
+        this.provider.rollback(receipt);
+        throw error;
+      }
+    });
+  }
+  /** Setup changes the DATA endpoint without replacing the identity or racing a refresh. */
+  async changeBaseUrl(ref, owner, baseUrl, beforeWrite) {
+    await this.withLock(ref, async () => {
+      this.provider.transaction((tx) => {
+        beforeWrite();
+        const current = this.read(ref, owner);
+        if (!current || current.state !== "ready") throw loginRequired();
+        const session = { ...current.session, baseUrl };
+        validateSession(session);
+        const before = tx.read(ref), candidate = credentialForSession({ ...current, session });
+        tx.put(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
+      });
+    });
+  }
+  async logout(ref, owner, transport, beforeRevoke = () => {
+  }) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      this.provider.transaction((tx) => {
+        beforeRevoke();
+        const before = tx.read(ref);
+        if (current && before.record) tx.put(ref, { ...before.record, metadata: { ...before.record.metadata, state: "logged_out" }, payload: {} }, before);
+      });
+      let remoteRevoked = false;
+      try {
+        if (current?.session.refreshToken && current.state !== "logged_out") {
+          await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+          remoteRevoked = true;
+        }
+      } catch {
+      }
+      return { remoteRevoked };
+    });
+  }
+  /** Release config references under the write lock, then delete an unused session.
+   * Waiting on the operation lock first lets an in-flight refresh supply its latest RT.
+   * Returning false from release preserves a session that still has users.
+   */
+  async retire(ref, owner, transport, release) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      const removed = this.provider.transaction((tx) => {
+        if (!release()) return false;
+        tx.remove(tx.read(ref));
+        return true;
+      });
+      if (!removed) return { removed: false, remoteRevoked: false, remoteUnconfirmed: false };
+      if (!current || current.state === "logged_out") return { removed: true, remoteRevoked: false, remoteUnconfirmed: false };
+      try {
+        if (!current.session.refreshToken) throw loginRequired();
+        await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+        return { removed: true, remoteRevoked: true, remoteUnconfirmed: false };
+      } catch {
+        return { removed: true, remoteRevoked: false, remoteUnconfirmed: true };
+      }
+    });
+  }
+  needsRefresh(session) {
+    return this.now() >= session.expiresAt - Math.min(3e4, (session.expiresAt - session.issuedAt) / 2);
+  }
+  read(ref, owner) {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    requireProfile(typeof owner === "string" ? owner : owner.loginId);
+    let stored;
+    try {
+      stored = this.provider.readStoredRecord(ref);
+    } catch {
+      throw unsafe();
+    }
+    if (!stored) return void 0;
+    if (stored.kind !== "oauth-session" || stored.metadata.owner.distribution !== "public") throw new OAuthCredentialError("invalid_profile");
+    const who = stored.metadata.owner;
+    if (typeof owner === "string" ? who.agent !== owner : who.loginId !== owner.loginId) throw new OAuthCredentialError("invalid_profile");
+    return { profile: who.agent, loginId: who.loginId, state: stored.metadata.state, session: oauthSessionFromCredential(stored) };
+  }
+  write(ref, doc) {
+    const before = this.provider.snapshot(ref);
+    if (before.record && ["logged_out", "reauth_required"].includes(before.record.metadata.state)) throw loginRequired();
+    const candidate = credentialForSession(doc);
+    return this.provider.commit(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
+  }
+  async withLock(ref, task) {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    try {
+      return await withCredentialOperation(this.path, ref, task, { lockWaitMs: this.lockWaitMs });
+    } catch (error) {
+      if (error instanceof Error && error.message === "credentials: credential_busy") throw new OAuthCredentialError("credential_busy");
+      throw error;
+    }
+  }
+};
+function credentialForSession(doc) {
+  const { accessToken, refreshToken, ...metadata } = doc.session;
+  return {
+    kind: "oauth-session",
+    payload: ["ready", "refreshing"].includes(doc.state) ? { accessToken, refreshToken } : {},
+    metadata: {
+      ...metadata,
+      owner: { distribution: "public", agent: doc.profile, ...doc.loginId ? { loginId: doc.loginId } : {} },
+      state: doc.state,
+      authorization_method: "device-code"
+    }
+  };
+}
+function oauthSessionFromCredential(record) {
+  if (record.kind !== "oauth-session") throw unsafe();
+  const m = record.metadata, p = record.payload;
+  const session = {
+    baseUrl: m.baseUrl,
+    workspaceId: m.workspaceId,
+    memberId: m.memberId,
+    clientId: m.clientId,
+    scope: m.scope,
+    sessionId: m.sessionId,
+    accountDisplay: m.accountDisplay,
+    issuedAt: m.issuedAt,
+    expiresAt: m.expiresAt,
+    accessToken: p.accessToken,
+    refreshToken: p.refreshToken
+  };
+  validateSession(session, ["ready", "refreshing"].includes(m.state));
+  return session;
+}
+function requireProfile(profile) {
+  if (typeof profile !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("invalid_profile");
+}
+function validateSession(s, requireTokens = true) {
+  if (!s || typeof s !== "object" || s.clientId !== "ctxdb-cli" || !["read_only", "read_write", "default"].includes(s.scope) || !Number.isSafeInteger(s.issuedAt) || !Number.isSafeInteger(s.expiresAt) || s.expiresAt - s.issuedAt < 1e3 || s.expiresAt - s.issuedAt > 36e5) throw unsafe();
+  for (const value of [s.workspaceId, s.memberId, s.sessionId, s.accountDisplay]) {
+    if (typeof value !== "string" || !value || value.length > 256 || /[\r\n\x00-\x1f]/.test(value)) throw unsafe();
+  }
+  for (const value of requireTokens ? [s.accessToken, s.refreshToken] : []) {
+    if (typeof value !== "string" || !value || value.length > 8192 || /\s/.test(value)) throw unsafe();
+  }
+  let url;
+  try {
+    url = new URL(s.baseUrl);
+  } catch {
+    throw unsafe();
+  }
+  const loopback = ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || loopback && url.protocol === "http:")) throw unsafe();
+}
+function rotated(current, response, issuedAt) {
+  if (!response || response.token_type !== "Bearer" || response.session_id !== current.sessionId || response.scope !== current.scope || !Number.isSafeInteger(response.expires_in) || response.expires_in < 1 || response.expires_in > 3600 || response.refresh_token === current.refreshToken) throw loginRequired();
+  const next = {
+    ...current,
+    accessToken: response.access_token,
+    refreshToken: response.refresh_token,
+    issuedAt,
+    expiresAt: issuedAt + response.expires_in * 1e3
+  };
+  validateSession(next);
+  return next;
+}
+function authorization(session) {
+  return { scheme: "Bearer", value: session.accessToken, baseUrl: session.baseUrl, expiresAt: session.expiresAt };
+}
+
+// ../shared/src/oauth-profile.ts
+import { dirname as dirname4, join as join4, resolve } from "path";
+
+// ../shared/src/auth-config.ts
+import { closeSync as closeSync3, existsSync as existsSync3, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
+import { dirname as dirname3 } from "path";
+var AuthConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthConfigError";
+  }
+};
+function readAuthConfig(path) {
+  if (!existsSync3(path)) return { version: 2, agents: {} };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    throw new AuthConfigError("Invalid ctxdb.json; repair the JSON before changing authentication.");
+  }
+  if (raw?.version !== 2 || !object3(raw.agents) || raw.logins !== void 0 && !object3(raw.logins)) {
+    throw new AuthConfigError("Unsupported ctxdb configuration; authentication was not changed.");
+  }
+  return raw;
+}
+function object3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function ownAuthProfile(raw, agent) {
+  const value = Object.hasOwn(raw.agents, agent) ? raw.agents[agent] : void 0;
+  if (value !== void 0 && !object3(value)) throw new AuthConfigError("Invalid agent configuration; repair its section in ctxdb.json.");
+  return value ?? {};
+}
+function requireLoginId(id) {
+  if (typeof id !== "string" || id === "default" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id)) throw new AuthConfigError("Invalid login ID; use an ID from ctxdb auth status --all.");
+}
+function validateLoginChoice(section) {
+  if (Object.hasOwn(section, "credential_ref")) {
+    if (typeof section.credential_ref !== "string" || !/^[a-f0-9]{32}$/.test(section.credential_ref)) throw new AuthConfigError("Invalid credential_ref; explicitly select --api-key or --login again.");
+    if (Object.hasOwn(section, "access_credential") || section.api_key || section.oauth_credential_ref) throw new AuthConfigError("Conflicting credential_ref and access_credential/api_key/oauth_credential_ref. Keep one authentication choice.");
+  }
+  if (!Object.hasOwn(section, "access_credential")) return;
+  if (section.access_credential === null) return;
+  requireLoginId(section.access_credential);
+  if (section.api_key || section.oauth_credential_ref) {
+    throw new AuthConfigError("Conflicting access_credential and api_key/oauth_credential_ref in this Agent. Keep one authentication choice, or use setup --api-key/--login to replace it.");
+  }
+}
+
+// ../shared/src/oauth-profile.ts
+function oauthProfile(reference, configPath, profile, baseUrl) {
+  if (reference === void 0) return void 0;
+  if (typeof reference !== "string" || !/^[a-f0-9]{32}$/.test(reference) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("unsafe_storage");
+  const path = resolve(configPath);
+  return {
+    reference,
+    profile,
+    configPath: path,
+    credentialsPath: join4(dirname4(path), "credentials.json"),
+    baseUrl: normalizeCoreOrigin(baseUrl)
+  };
+}
+function oauthProfileFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (section.access_credential === null) return void 0;
+  if (Object.hasOwn(section, "access_credential")) {
+    const id = section.access_credential;
+    requireLoginId(id);
+    const record = raw.logins && Object.hasOwn(raw.logins, id) ? raw.logins[id] : void 0;
+    if (!record?.credential_ref) throw new AuthConfigError("access_credential points to a missing login. Use ctxdb auth status --all and explicitly bind a valid login or log in again.");
+    return storedProfile(record.credential_ref, path, agent, id, baseUrlOverride);
+  }
+  return storedProfile(section.oauth_credential_ref, path, agent, void 0, baseUrlOverride);
+}
+function storedProfile(reference, path, agent, loginId, baseUrlOverride) {
+  const descriptor = oauthProfile(reference, path, agent, "https://api.cn-hangzhou.agentcontext.aliyuncs.com");
+  if (!descriptor) return void 0;
+  const profile = { ...descriptor, ...loginId ? { loginId } : {} };
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (!("baseUrl" in status) || typeof status.baseUrl !== "string") throw new OAuthCredentialError("login_required");
+  profile.baseUrl = normalizeCoreOrigin(status.baseUrl);
+  if (baseUrlOverride && normalizeCoreOrigin(baseUrlOverride) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return profile;
+}
+function oauthOwner(profile) {
+  return profile.loginId ? { loginId: profile.loginId } : profile.profile;
+}
+function oauthProfileStatus(profile) {
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (typeof status.baseUrl === "string" && normalizeCoreOrigin(status.baseUrl) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return status;
+}
+var OAuthProfileProvider = class {
+  selected;
+  constructor(selected) {
+    this.selected = selected;
+  }
+  async resolve(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 3e4, deadline = Date.now() + timeoutMs;
+    const selected = this.selected;
+    const readCurrent = () => {
+      const raw = readAuthConfig(selected.configPath);
+      return oauthProfileFromConfig(raw, selected.configPath, selected.profile);
+    };
+    const current = readCurrent();
+    if (!current || current.baseUrl !== selected.baseUrl) throw new OAuthCredentialError("login_required");
+    const store = new OAuthSessionStore(current.credentialsPath, { lockWaitMs: timeoutMs });
+    const status = oauthProfileStatus(current);
+    if (!("baseUrl" in status) || typeof status.baseUrl !== "string" || normalizeCoreOrigin(status.baseUrl) !== current.baseUrl) throw new OAuthCredentialError("login_required");
+    const authorization2 = await store.resolve(current.reference, oauthOwner(current), {
+      refresh: (rt, url) => new CoreDeviceClient(url, { requestTimeoutMs: Math.max(1, deadline - Date.now()) }).refresh(rt, url)
+    });
+    const after = readCurrent();
+    if (!after || after.reference !== current.reference || after.loginId !== current.loginId || after.baseUrl !== current.baseUrl || oauthProfileStatus(after).state !== "ready") throw new OAuthCredentialError("login_required");
+    return authorization2;
+  }
+};
+
+// ../shared/src/login-bindings.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { dirname as dirname6, join as join6 } from "path";
+
+// ../shared/src/data-auth.ts
+import { dirname as dirname5, join as join5 } from "path";
+function selectDataApiCredential(cfg, env = process.env) {
+  const accessToken = env.CTXDB_ACCESS_TOKEN?.trim();
+  if (accessToken) return { type: "access-token", value: accessToken };
+  if (env.CTXDB_API_KEY) return { type: "api-key", value: env.CTXDB_API_KEY };
+  const context = cfg.authContext ? { context: cfg.authContext } : {};
+  if (cfg.oauthCredential) return { type: "oauth-session", profile: cfg.oauthCredential, ...context };
+  return cfg.apiKey ? { type: "api-key", value: cfg.apiKey, ...context } : null;
+}
+var DataApiAuthorizationProvider = class {
+  context;
+  constructor(context) {
+    this.context = context;
+  }
+  async resolve(options = {}) {
+    const c = this.context, raw = readAuthConfig(c.configPath), section = ownAuthProfile(raw, c.agent);
+    const fallback = c.inheritDefaultKey && c.agent !== "default" ? ownAuthProfile(raw, "default") : {};
+    if (c.managedCredentials) {
+      const active = readActiveCredentialSync(c.credentialsPath ?? join5(dirname5(c.configPath), "credentials.json"));
+      if (active) {
+        const baseUrl2 = c.baseUrlOverride ?? active.metadata.baseUrl;
+        if (baseUrl2 !== c.baseUrl) throw new OAuthCredentialError("login_required");
+        return { scheme: "Token", value: active.payload.apiKey, baseUrl: baseUrl2, expiresAt: null };
+      }
+      throw new OAuthCredentialError("login_required");
+    }
+    const stored = publicAuthenticationFromConfig(raw, c.configPath, c.agent, c.baseUrlOverride);
+    const baseUrl = stored?.baseUrl ?? String(c.baseUrlOverride || section.base_url || fallback.base_url || "https://api.cn-hangzhou.agentcontext.aliyuncs.com").replace(/\/+$/, "");
+    if (baseUrl !== c.baseUrl) throw new OAuthCredentialError("login_required");
+    if (stored?.apiKey) return { scheme: "Token", value: stored.apiKey, baseUrl, expiresAt: null };
+    if (stored?.oauthCredential) return new OAuthProfileProvider(stored.oauthCredential).resolve(options);
+    if (Object.hasOwn(section, "access_credential")) throw new OAuthCredentialError("login_required");
+    const key = Object.hasOwn(section, "api_key") ? section.api_key : fallback.api_key;
+    if (typeof key !== "string" || !key) throw new OAuthCredentialError("login_required");
+    return { scheme: "Token", value: key, baseUrl, expiresAt: null };
+  }
+};
+function publicAuthenticationFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (!Object.hasOwn(section, "credential_ref")) {
+    const oauthCredential = oauthProfileFromConfig(raw, path, agent, baseUrlOverride);
+    return oauthCredential ? { baseUrl: oauthCredential.baseUrl, oauthCredential } : void 0;
+  }
+  const r = new LocalCredentialProvider(join5(dirname5(path), "credentials.json")).readStoredRecord(section.credential_ref);
+  if (!r || r.kind !== "api-key" || r.metadata.state !== "ready" || r.metadata.owner.distribution !== "public" || r.metadata.owner.agent !== agent || r.metadata.owner.loginId) {
+    throw new AuthConfigError("credential_ref is missing, invalid or belongs to another Agent. Use setup --api-key/--login to choose a valid credential.");
+  }
+  const baseUrl = String(r.metadata.base_url).replace(/\/+$/, "");
+  if (baseUrlOverride && baseUrl !== baseUrlOverride.replace(/\/+$/, "")) throw new AuthConfigError("Requested base URL does not match the credential origin; no credential was sent.");
+  return { baseUrl, apiKey: r.payload.api_key };
+}
+function createRequestAuthorizationProvider(credential, baseUrl) {
+  if (credential?.context) return new DataApiAuthorizationProvider(credential.context);
+  if (credential?.type === "oauth-session") return new OAuthProfileProvider(credential.profile);
+  return { async resolve(_options) {
+    if (!credential) throw new OAuthCredentialError("login_required");
+    return {
+      scheme: credential.type === "access-token" ? "Bearer" : "Token",
+      value: credential.value,
+      baseUrl,
+      expiresAt: null
+    };
+  } };
+}
+
+// ../shared/src/authorization/public-target.ts
+import { dirname as dirname7, join as join7 } from "path";
+
+// src/config.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname8, join as join8 } from "path";
+
 // src/distribution-capabilities.ts
 var PUBLIC_DISTRIBUTION = {
   id: "public",
@@ -838,13 +1873,14 @@ var PUBLIC_DISTRIBUTION = {
   packageRegistry: null,
   capabilities: {
     interactiveLogin: false,
-    managedCredentials: false
+    managedCredentials: false,
+    deviceFlow: true
   }
 };
 var DISTRIBUTION_MANIFEST = typeof define_CTXDB_DISTRIBUTION_MANIFEST_default === "undefined" ? PUBLIC_DISTRIBUTION : define_CTXDB_DISTRIBUTION_MANIFEST_default;
 
 // src/config.ts
-var DEFAULT_BASE_URL = "https://context-database.aliyuncs.com";
+var DEFAULT_BASE_URL = "https://api.cn-hangzhou.agentcontext.aliyuncs.com";
 var DEFAULT_USER_ID = "default";
 var DEFAULT_TOP_K = 5;
 var DEFAULT_THRESHOLD = 0.4;
@@ -852,7 +1888,7 @@ var DEFAULT_KNOWLEDGE_TOP_K = 6;
 var DEFAULT_KB_CATALOG_INJECTION = "session_start";
 function defaultPath(env) {
   if (env.CTXDB_CONFIG_PATH) return env.CTXDB_CONFIG_PATH;
-  return join2(homedir2(), ".ctxdb", "ctxdb.json");
+  return join8(homedir3(), ".ctxdb", "ctxdb.json");
 }
 function coerceInt(v, fallback) {
   if (v === null || v === void 0 || v === "") return fallback;
@@ -874,9 +1910,9 @@ function coerceKbCatalogInjection(v) {
   return DEFAULT_KB_CATALOG_INJECTION;
 }
 function readRaw(path) {
-  if (!existsSync2(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -911,40 +1947,6 @@ function applyDebugPolicy(cfg) {
   cfg.debugReason = policy.debugReason;
   return cfg;
 }
-function managedCredential(path) {
-  if (!existsSync2(path)) return null;
-  if (process.platform !== "win32" && (statSync2(path).mode & 63) !== 0) {
-    throw new Error(`credentials: ${path} must be owner-only (run chmod 600)`);
-  }
-  const raw = JSON.parse(readFileSync2(path, "utf8"));
-  if (raw.version !== 1 || !raw.records || typeof raw.records !== "object") {
-    throw new Error("credentials: unsupported credentials.json schema");
-  }
-  const unknownKeys = Object.keys(raw.records).filter(
-    (key) => key !== "contextdb/active"
-  );
-  if (unknownKeys.length > 0) {
-    throw new Error(`credentials: unsupported record key ${unknownKeys[0]}`);
-  }
-  const record = raw.records["contextdb/active"];
-  if (!record) return null;
-  if (record.kind !== "api-key" || typeof record.payload?.api_key !== "string" || !record.payload.api_key || typeof record.payload?.base_url !== "string" || !record.payload.base_url) {
-    throw new Error("credentials: invalid contextdb/active record");
-  }
-  let baseUrl;
-  try {
-    baseUrl = new URL(record.payload.base_url);
-  } catch {
-    throw new Error("credentials: invalid contextdb/active base_url");
-  }
-  if (!["https:", "http:"].includes(baseUrl.protocol) || baseUrl.username || baseUrl.password || baseUrl.search || baseUrl.hash) {
-    throw new Error("credentials: invalid contextdb/active base_url");
-  }
-  return {
-    apiKey: record.payload.api_key,
-    baseUrl: baseUrl.toString().replace(/\/$/, "")
-  };
-}
 function loadOpencodeConfig(options = {}) {
   const env = options.env ?? process.env;
   const path = options.path ?? defaultPath(env);
@@ -970,17 +1972,47 @@ function loadOpencodeConfig(options = {}) {
     debugReason: null,
     kbCatalogInjection: coerceKbCatalogInjection(section.kb_catalog_injection)
   };
-  const managed = DISTRIBUTION_MANIFEST.capabilities.managedCredentials && options.managedCredentials !== false ? managedCredential(
-    options.credentialsPath ?? join2(dirname2(path), "credentials.json")
+  const managed = DISTRIBUTION_MANIFEST.capabilities.managedCredentials && options.managedCredentials !== false ? readActiveCredentialSync(
+    options.credentialsPath ?? join8(dirname8(path), "credentials.json")
   ) : null;
   if (managed) {
-    cfg.apiKey = managed.apiKey;
-    cfg.baseUrl = managed.baseUrl;
+    cfg.apiKey = managed.payload.apiKey;
+    cfg.baseUrl = managed.metadata.baseUrl;
+  }
+  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
+    validateLoginChoice(section);
+    const stored = env.CTXDB_API_KEY || env.CTXDB_ACCESS_TOKEN?.trim() ? void 0 : publicAuthenticationFromConfig({ ...raw, version: 2, agents: raw.agents ?? {} }, path, "opencode", env.CTXDB_BASE_URL);
+    if (stored) {
+      cfg.baseUrl = stored.baseUrl;
+      cfg.apiKey = stored.apiKey ?? null;
+      cfg.oauthCredential = stored.oauthCredential;
+    } else if (section.credential_ref) cfg.apiKey = null;
+  }
+  applyEnv(cfg, env);
+  if (managed) cfg.authContext = {
+    configPath: path,
+    agent: "opencode",
+    baseUrl: cfg.baseUrl,
+    inheritDefaultKey: false,
+    managedCredentials: true,
+    credentialsPath: options.credentialsPath,
+    ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
+  };
+  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
+    cfg.authContext = {
+      configPath: path,
+      agent: "opencode",
+      baseUrl: cfg.baseUrl,
+      inheritDefaultKey: false,
+      ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
+    };
+    if (Object.hasOwn(section, "access_credential") && !env.CTXDB_API_KEY) cfg.apiKey = null;
   }
-  return applyEnv(cfg, env);
+  if (env.CTXDB_API_KEY || accessTokenFromEnv(env)) cfg.oauthCredential = void 0;
+  return cfg;
 }
 function isConfigured(cfg, env = process.env) {
-  return Boolean((accessTokenFromEnv(env) || cfg.apiKey) && cfg.baseUrl);
+  return Boolean((accessTokenFromEnv(env) || cfg.oauthCredential || cfg.apiKey) && cfg.baseUrl);
 }
 
 // src/http-client.ts
@@ -1001,20 +2033,29 @@ var HttpClient = class {
   accessToken;
   userAgent;
   fetchImpl;
+  oauthProvider;
+  credential;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.apiKey = opts.apiKey;
     this.accessToken = opts.accessToken ?? null;
+    this.credential = selectDataApiCredential(opts, { CTXDB_ACCESS_TOKEN: opts.accessToken ?? void 0, CTXDB_API_KEY: opts.environmentApiKey });
+    this.oauthProvider = createRequestAuthorizationProvider(this.credential, this.baseUrl);
     this.userAgent = opts.userAgent ?? "ctxdb-opencode-plugin/0.0.0";
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
-  headers(contentType) {
+  async headers(contentType, timeoutMs) {
     const h = {
       "User-Agent": this.userAgent,
       Connection: "close"
     };
-    if (this.accessToken) h.Authorization = `Bearer ${this.accessToken}`;
-    else if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
+    if (this.oauthProvider) {
+      const authorization2 = await this.oauthProvider.resolve({ timeoutMs });
+      if (authorization2.baseUrl !== this.baseUrl) throw new Error("OAuth environment changed; reload this runtime.");
+      h.Authorization = `${authorization2.scheme} ${authorization2.value}`;
+    } else if (this.credential && this.credential.type !== "oauth-session") {
+      h.Authorization = `${this.credential.type === "access-token" ? "Bearer" : "Token"} ${this.credential.value}`;
+    }
     if (contentType) h["Content-Type"] = contentType;
     return h;
   }
@@ -1035,49 +2076,54 @@ var HttpClient = class {
     return this.request("POST", url, path, JSON.stringify(body), "application/json", options.timeoutMs);
   }
   async request(method, url, path, body, contentType, timeoutMs) {
-    const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS, started = Date.now();
+    const headers = await this.headers(contentType, effectiveTimeout);
+    const bearer = headers.Authorization?.replace(/^(Bearer|Token) /, "");
+    const safeText = (value) => bearer ? String(value).split(bearer).join("[REDACTED]") : String(value);
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), effectiveTimeout);
+    const timer = setTimeout(() => controller.abort(), Math.max(1, effectiveTimeout - (Date.now() - started)));
     try {
       let resp;
       try {
         resp = await this.fetchImpl(url, {
           method,
-          headers: this.headers(contentType),
+          headers,
           body,
-          signal: controller.signal
+          signal: controller.signal,
+          ...headers.Authorization?.startsWith("Bearer ") ? { redirect: "error" } : {}
         });
       } catch (err) {
         if (err?.name === "AbortError") {
           throw new CtxdbHttpError(path, null, `timeout after ${effectiveTimeout}ms`);
         }
-        throw new CtxdbHttpError(path, null, `network error: ${err?.message ?? err}`);
+        throw new CtxdbHttpError(path, null, `network error: ${safeText(err?.message ?? err)}`);
       }
       if (resp.status === 204) return {};
-      let text;
+      let text2;
       try {
-        text = await resp.text();
+        const bodyText = await resp.text();
+        text2 = headers.Authorization?.startsWith("Bearer ") || !resp.ok ? safeText(bodyText) : bodyText;
       } catch (err) {
-        throw new CtxdbHttpError(path, resp.status, `body read failed: ${err?.message ?? err}`);
+        throw new CtxdbHttpError(path, resp.status, `body read failed: ${safeText(err?.message ?? err)}`);
       }
       if (!resp.ok) {
-        throw new CtxdbHttpError(path, resp.status, extractDetail(text) || `HTTP ${resp.status}`);
+        throw new CtxdbHttpError(path, resp.status, extractDetail(text2) || `HTTP ${resp.status}`);
       }
-      if (!text) return {};
+      if (!text2) return {};
       try {
-        return JSON.parse(text);
+        return JSON.parse(text2);
       } catch {
-        return text;
+        return text2;
       }
     } finally {
       clearTimeout(timer);
     }
   }
 };
-function extractDetail(text) {
-  if (!text) return "";
+function extractDetail(text2) {
+  if (!text2) return "";
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       for (const k of ["detail", "message", "error"]) {
         const v = parsed[k];
@@ -1087,7 +2133,7 @@ function extractDetail(text) {
     }
     return String(parsed);
   } catch {
-    return text;
+    return text2;
   }
 }
 
@@ -1330,7 +2376,7 @@ function buildWarmupQuery(cwd, git) {
 }
 
 // src/capture.ts
-import { createHash } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var EMPTY2 = {
   captured: false,
   reason: "",
@@ -1397,7 +2443,7 @@ function toParsedMessage(m, index) {
   return null;
 }
 function fingerprintMessages(messages) {
-  const h = createHash("sha256");
+  const h = createHash4("sha256");
   for (const m of messages) {
     h.update(m.role);
     h.update("\0");
@@ -1470,6 +2516,9 @@ function buildRuntime(config, cwd, env = process.env) {
     http: new HttpClient({
       baseUrl: config.baseUrl,
       apiKey: config.apiKey,
+      oauthCredential: config.oauthCredential,
+      authContext: config.authContext,
+      environmentApiKey: env.CTXDB_API_KEY,
       accessToken: accessTokenFromEnv(env)
     }),
     sessionState: /* @__PURE__ */ new Map(),
@@ -1509,7 +2558,13 @@ function extractTextPrompt(parts) {
 }
 async function buildHooks(input) {
   if (shouldSkipHooks()) return {};
-  const config = loadOpencodeConfig();
+  let config;
+  try {
+    config = loadOpencodeConfig();
+  } catch {
+    process.stderr.write("[ctxdb] Invalid authentication configuration; OpenCode integration skipped. Run ctxdb auth status --all.\n");
+    return {};
+  }
   if (!isConfigured(config)) {
     logDebug(
       config,
@@ -1523,10 +2578,10 @@ async function buildHooks(input) {
   const hooks = {
     "chat.message": async (input2, output) => {
       try {
-        const text = extractTextPrompt(output.parts);
-        if (!text) return;
+        const text2 = extractTextPrompt(output.parts);
+        if (!text2) return;
         const s = touchSession(rt, input2.sessionID);
-        s.lastPrompt = text;
+        s.lastPrompt = text2;
       } catch (err) {
         logError(rt.config, "chat.message", err);
       }