@aliyunrds/ctxdb 1.0.8-beta.4 → 1.0.9-beta.0

package/dist/opencode/index.js

@@ -1,11 +1,6 @@
 // <define:__CTXDB_DISTRIBUTION_MANIFEST__>
 var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false, deviceFlow: true } };
 
-// src/config.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
-
 // ../shared/src/graph-context.ts
 var GRAPH_CONTEXT_TAG = "graphrag";
 var GRAPH_CONTEXT_SOURCE_LABEL = "Related content in Knowledge Graph";
@@ -589,6 +584,7 @@ function selectAndFormatRecalledMemories(memories, userId, config = {}) {
 
 // ../shared/src/debug-policy.ts
 var OFFICIAL_PRODUCTION_BASE_URLS = [
+  "https://api.cn-hangzhou.agentcontext.aliyuncs.com",
   "https://context-database.aliyuncs.com"
 ];
 function normalizeBaseUrl(value) {
@@ -861,16 +857,21 @@ var CoreDeviceClient = class {
   baseUrl;
   fetchImpl;
   now;
+  requestTimeoutMs;
   sleep;
   constructor(baseUrl, options = {}) {
     this.baseUrl = normalizeCoreOrigin(baseUrl);
     this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
     this.now = options.now ?? Date.now;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
     this.sleep = options.sleep ?? ((ms, signal) => delay(ms, void 0, { signal }));
   }
   async login(options) {
     const started = this.now();
-    const initial = await this.post("/v1/auth/device/authorize", { client_id: clientId }, options.signal);
+    const initial = await this.post("/v1/auth/device/authorize", {
+      client_id: clientId,
+      ...options.initialAgent === void 0 ? {} : { initial_agent: options.initialAgent }
+    }, options.signal);
     if (!initial.ok) throw new DeviceFlowError("request_rejected");
     const data = initial.data;
     const requestId = text(data.request_id, 32), userCode = text(data.user_code, 9), code = text(data.device_code, 43);
@@ -920,7 +921,7 @@ var CoreDeviceClient = class {
     const controller = new AbortController();
     const abort = () => controller.abort();
     signal?.addEventListener("abort", abort, { once: true });
-    const timer = setTimeout(abort, 3e4);
+    const timer = setTimeout(abort, this.requestTimeoutMs);
     timer.unref?.();
     try {
       const response = await this.fetchImpl(this.baseUrl + path, {
@@ -1022,74 +1023,334 @@ async function boundedJson(response) {
 }
 
 // ../shared/src/oauth-credentials.ts
-import {
-  constants,
-  closeSync as closeSync2,
-  existsSync as existsSync2,
-  fstatSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { join as join3 } from "path";
-import { setTimeout as delay2 } from "timers/promises";
+import { randomBytes as randomBytes3 } from "crypto";
 
-// ../shared/src/windows-private-storage.ts
-import { execFileSync } from "child_process";
+// ../shared/src/credentials/local-credential-provider.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-var SCRIPT = `
-$ErrorActionPreference = 'Stop'
-$path = $env:CTXDB_PRIVATE_STORAGE_PATH
-$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$item = Get-Item -LiteralPath $path -Force
-if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
-if ($env:CTXDB_PRIVATE_STORAGE_INITIALIZE -eq '1') {
-  if (-not $item.PSIsContainer) { throw 'not directory' }
-  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
-  $acl.SetOwner($sid)
-  $acl.SetAccessRuleProtection($true, $false)
-  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
-  $acl.AddAccessRule($rule)
-  Set-Acl -LiteralPath $path -AclObject $acl
-}
-$acl = Get-Acl -LiteralPath $path
-if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner' }
-$self = $false
-foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
-  if ($rule.AccessControlType -eq 'Allow') {
-    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'other principal' }
-    if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $self = $true }
-  }
-}
-if (-not $self) { throw 'missing owner access' }
-Write-Output 'private'
-`;
-function checkWindowsPrivateStorage(path, initialize, run = execFileSync) {
-  const systemRoot = process.env.SystemRoot;
-  if (!systemRoot) throw new Error("Private Windows credential storage could not be verified.");
+
+// ../shared/src/credentials/storage.ts
+import { constants, closeSync as closeSync2, existsSync as existsSync2, fstatSync, fsyncSync, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync } from "fs";
+import { randomBytes, createHash } from "crypto";
+import { dirname as dirname2 } from "path";
+import { setTimeout as delay2 } from "timers/promises";
+function assertStoragePath(path, directory = false) {
+  const s = lstatSync(path);
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw new Error("credentials: invalid storage path");
+}
+function prepareStorage(path) {
+  const dir = dirname2(path);
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+  }
+  assertStoragePath(dir, true);
+}
+function readCredentialFile(path) {
+  if (!existsSync2(path)) return void 0;
+  assertStoragePath(dirname2(path), true);
+  assertStoragePath(path);
+  const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > 16 * 1024 * 1024) throw new Error("credentials: invalid storage");
+    return readFileSync2(fd, "utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function atomicCredentialWrite(path, value) {
+  prepareStorage(path);
+  if (existsSync2(path)) assertStoragePath(path);
+  const temp = path + "." + randomBytes(12).toString("hex") + ".tmp";
+  let fd;
   try {
-    const result = run(
-      join2(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-      ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
-      {
-        env: { ...process.env, CTXDB_PRIVATE_STORAGE_PATH: path, CTXDB_PRIVATE_STORAGE_INITIALIZE: initialize ? "1" : "0" },
-        encoding: "utf8",
-        windowsHide: true,
-        timeout: 1e4,
-        maxBuffer: 4096,
-        stdio: ["ignore", "pipe", "pipe"]
+    fd = openSync2(temp, "wx", 384);
+    writeFileSync(fd, JSON.stringify(value, null, 2) + "\n");
+    fsyncSync(fd);
+    closeSync2(fd);
+    fd = void 0;
+    renameSync2(temp, path);
+    if (process.platform !== "win32") {
+      try {
+        const dir = openSync2(dirname2(path), "r");
+        try {
+          fsyncSync(dir);
+        } finally {
+          closeSync2(dir);
+        }
+      } catch {
       }
-    );
-    if (String(result).trim() !== "private") throw new Error();
+    }
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+    if (existsSync2(temp)) unlinkSync(temp);
+  }
+}
+function withCredentialWriteLock(path, operation) {
+  prepareStorage(path);
+  const lock = path + ".lock", deadline = Date.now() + 1e4;
+  let fd;
+  while (true) {
+    try {
+      fd = openSync2(lock, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: writer lock is busy; check the previous CLI process");
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+    }
+  }
+  try {
+    return operation();
+  } finally {
+    closeSync2(fd);
+    unlinkSync(lock);
+  }
+}
+function operationLockPath(path, key) {
+  return path + "." + createHash("sha256").update(key).digest("hex") + ".lock";
+}
+async function withCredentialOperation(path, key, operation, options = {}) {
+  prepareStorage(path);
+  const lock = operationLockPath(path, key), deadline = Date.now() + (options.lockWaitMs ?? 3e4);
+  while (true) {
+    options.signal?.throwIfAborted();
+    let fd;
+    try {
+      fd = openSync2(lock, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("credentials: credential_busy");
+      await delay2(25, void 0, { signal: options.signal });
+      continue;
+    }
+    try {
+      writeFileSync(fd, String(process.pid));
+    } finally {
+      closeSync2(fd);
+    }
+    try {
+      return await operation();
+    } finally {
+      unlinkSync(lock);
+    }
+  }
+}
+
+// ../shared/src/credentials/types.ts
+var ACTIVE_CONTEXTDB_CREDENTIAL = "contextdb/active";
+
+// ../shared/src/credentials/local-credential-provider.ts
+function defaultCredentialsPath() {
+  return join2(homedir2(), ".ctxdb", "credentials.json");
+}
+var object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var fail = (message) => {
+  throw new Error("credentials: " + message);
+};
+function origin(value) {
+  if (typeof value !== "string" || !value) return fail("invalid service URL");
+  let u;
+  try {
+    u = new URL(value);
   } catch {
-    throw new Error("Private Windows credential storage could not be verified.");
+    return fail("invalid service URL");
+  }
+  if (!["http:", "https:"].includes(u.protocol) || u.username || u.password || u.search || u.hash) return fail("invalid service URL");
+  return u.toString().replace(/\/$/, "");
+}
+function validateApi(raw, internal, v1 = false) {
+  if (!object2(raw.payload) || typeof raw.payload.api_key !== "string" || !raw.payload.api_key) fail("invalid api-key payload");
+  const metadata = v1 ? raw.payload : raw.metadata;
+  origin(metadata.base_url);
+  if (internal) {
+    origin(metadata.login_server);
+    if (!object2(raw.metadata) || !["browser-loopback", "device-code"].includes(raw.metadata.authorization_method) || typeof raw.metadata.issued_at !== "string" || !Number.isFinite(Date.parse(raw.metadata.issued_at))) fail("invalid api-key metadata");
+  }
+}
+function validate(key, raw) {
+  if (!object2(raw) || !["api-key", "oauth-session"].includes(raw.kind) || !object2(raw.payload) || !object2(raw.metadata) || !object2(raw.metadata.owner) || !["ready", "refreshing", "reauth_required", "logged_out"].includes(raw.metadata.state) || typeof raw.metadata.generation !== "string" || !/^[a-f0-9]{32}$/.test(raw.metadata.generation) || !Number.isSafeInteger(raw.metadata.revision) || raw.metadata.revision < 1) fail("invalid credential record");
+  if (key === ACTIVE_CONTEXTDB_CREDENTIAL) {
+    if (raw.kind !== "api-key" || raw.metadata.owner.distribution !== "internal" || raw.metadata.state !== "ready") fail("invalid contextdb/active record");
+  } else if (!/^[a-f0-9]{32}$/.test(key) || raw.metadata.owner.distribution !== "public" || typeof raw.metadata.owner.agent !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.agent) || raw.metadata.owner.loginId !== void 0 && (typeof raw.metadata.owner.loginId !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(raw.metadata.owner.loginId))) fail("invalid credential ownership");
+  const fields = raw.kind === "api-key" ? ["api_key"] : ["ready", "refreshing"].includes(raw.metadata.state) ? ["accessToken", "refreshToken"] : [];
+  if (Object.keys(raw.payload).length !== fields.length || fields.some((field) => typeof raw.payload[field] !== "string" || !raw.payload[field])) fail("invalid credential payload; only credential values are allowed");
+  if (raw.kind === "api-key") validateApi(raw, key === ACTIVE_CONTEXTDB_CREDENTIAL);
+}
+function readDocument(path) {
+  const bytes = readCredentialFile(path);
+  if (bytes === void 0) return { version: 2, records: {} };
+  let doc;
+  try {
+    doc = JSON.parse(bytes);
+  } catch {
+    return fail("credentials.json is not valid JSON");
+  }
+  if (!object2(doc) || ![1, 2].includes(doc.version) || !object2(doc.records)) return fail("unsupported credentials.json schema/version");
+  if (doc.version === 1) {
+    if (Object.keys(doc.records).some((k) => k !== ACTIVE_CONTEXTDB_CREDENTIAL)) fail("unsupported record key in v1 credentials");
+    const active = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+    if (active !== void 0) {
+      if (active.kind !== "api-key") fail("unsupported record kind");
+      validateApi(active, true, true);
+    }
+  } else for (const [key, record] of Object.entries(doc.records)) validate(key, record);
+  return doc;
+}
+function upgrade(doc) {
+  if (doc.version === 2) return doc;
+  const record = doc.records[ACTIVE_CONTEXTDB_CREDENTIAL];
+  return { ...doc, version: 2, records: record ? { [ACTIVE_CONTEXTDB_CREDENTIAL]: legacy(record) } : {} };
+}
+function legacy(record) {
+  const { api_key, ...details } = record.payload;
+  return { kind: record.kind, payload: { api_key }, metadata: {
+    ...details,
+    ...record.metadata,
+    base_url: record.payload.base_url,
+    login_server: record.payload.login_server,
+    owner: { distribution: "internal" },
+    state: "ready",
+    revision: 1,
+    generation: createHash2("sha256").update(JSON.stringify(record)).digest("hex").slice(0, 32)
+  } };
+}
+function snapshot(doc, key) {
+  const raw = Object.hasOwn(doc.records, key) ? doc.records[key] : void 0;
+  const record = raw && (doc.version === 1 ? legacy(raw) : raw);
+  return { key, record, fingerprint: createHash2("sha256").update(JSON.stringify(record) ?? "missing").digest("hex") };
+}
+function apiRecord(record) {
+  if (!record) return void 0;
+  if (record.kind !== "api-key" || record.metadata.owner.distribution !== "internal") return fail("invalid contextdb/active record");
+  return {
+    kind: "api-key",
+    payload: { apiKey: record.payload.api_key },
+    metadata: {
+      baseUrl: origin(record.metadata.base_url),
+      loginServer: origin(record.metadata.login_server),
+      authorizationMethod: record.metadata.authorization_method,
+      issuedAt: record.metadata.issued_at
+    }
+  };
+}
+function internalCandidate(record) {
+  return {
+    kind: "api-key",
+    payload: { api_key: record.payload.apiKey },
+    metadata: {
+      base_url: record.metadata.baseUrl,
+      login_server: record.metadata.loginServer,
+      authorization_method: record.metadata.authorizationMethod,
+      issued_at: record.metadata.issuedAt,
+      owner: { distribution: "internal" },
+      state: "ready"
+    }
+  };
+}
+var LocalCredentialProvider = class {
+  listeners = /* @__PURE__ */ new Set();
+  path;
+  constructor(path = defaultCredentialsPath()) {
+    this.path = path;
+  }
+  snapshot(key) {
+    return snapshot(readDocument(this.path), key);
+  }
+  readStoredRecord(key) {
+    return this.snapshot(key).record;
+  }
+  async readRecord(key) {
+    return apiRecord(this.readStoredRecord(key));
+  }
+  async describeRecord(key) {
+    const r = this.readStoredRecord(key);
+    return { configured: !!r && r.metadata.state === "ready", kind: r?.kind, writable: true };
+  }
+  onRecordUpdated(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Synchronous short commit; callbacks may acquire a config lock, never the reverse. */
+  transaction(operation) {
+    return withCredentialWriteLock(this.path, () => {
+      let doc = readDocument(this.path);
+      const read = (key) => snapshot(doc, key);
+      const check = (expected) => {
+        if (read(expected.key).fingerprint !== expected.fingerprint) fail("authentication changed; the newer credential was preserved, retry the command");
+      };
+      const save = () => {
+        doc = upgrade(doc);
+        atomicCredentialWrite(this.path, doc);
+      };
+      return operation({
+        read,
+        put: (key, candidate, expected) => {
+          if (expected) {
+            if (expected.key !== key) fail("invalid commit target");
+            check(expected);
+          }
+          const before = read(key), previous = before.record;
+          const next = { kind: candidate.kind, payload: candidate.payload, metadata: {
+            ...candidate.metadata,
+            generation: previous?.metadata.generation ?? randomBytes2(16).toString("hex"),
+            revision: (previous?.metadata.revision ?? 0) + 1
+          } };
+          validate(key, next);
+          doc = upgrade(doc);
+          doc.records[key] = next;
+          save();
+          return { before, after: read(key) };
+        },
+        remove: (expected) => {
+          check(expected);
+          if (!read(expected.key).record) return;
+          doc = upgrade(doc);
+          delete doc.records[expected.key];
+          save();
+        }
+      });
+    });
+  }
+  commit(key, record, expected = this.snapshot(key)) {
+    return this.transaction((tx) => tx.put(key, record, expected));
+  }
+  rollback(receipt) {
+    return this.transaction((tx) => {
+      if (tx.read(receipt.after.key).fingerprint !== receipt.after.fingerprint) return false;
+      if (receipt.before.record) tx.put(receipt.after.key, receipt.before.record, receipt.after);
+      else tx.remove(receipt.after);
+      return true;
+    });
+  }
+  async modifyRecord(key, mutate, signal) {
+    const before = this.snapshot(key), next = await mutate(apiRecord(before.record));
+    signal?.throwIfAborted();
+    if (next === void 0) return apiRecord(before.record);
+    const receipt = this.commit(key, internalCandidate(next), before);
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
+    return apiRecord(receipt.after.record);
+  }
+  async deleteRecord(key, signal) {
+    signal?.throwIfAborted();
+    const before = this.snapshot(key);
+    this.transaction((tx) => tx.remove(before));
+    for (const listener of this.listeners) {
+      try {
+        listener(key);
+      } catch {
+      }
+    }
   }
+};
+function readActiveCredentialSync(path = defaultCredentialsPath()) {
+  return apiRecord(new LocalCredentialProvider(path).readStoredRecord(ACTIVE_CONTEXTDB_CREDENTIAL));
 }
 
 // ../shared/src/oauth-credentials.ts
@@ -1100,7 +1361,7 @@ var OAuthCredentialError = class extends Error {
       login_required: "OAuth session needs login; run ctxdb login for this profile.",
       credential_busy: "OAuth credential is busy. If its previous process crashed, run ctxdb login for a new credential.",
       invalid_profile: "OAuth credential does not belong to this profile.",
-      unsafe_storage: "OAuth credential storage is not private or is invalid."
+      unsafe_storage: "OAuth credential storage is inaccessible or invalid."
     };
     super(messages[code]);
     this.name = "OAuthCredentialError";
@@ -1110,29 +1371,31 @@ var OAuthCredentialError = class extends Error {
 var loginRequired = () => new OAuthCredentialError("login_required");
 var unsafe = () => new OAuthCredentialError("unsafe_storage");
 var OAuthSessionStore = class {
-  directory;
+  provider;
   now;
   lockWaitMs;
-  constructor(directory, options = {}) {
-    this.directory = directory;
+  path;
+  constructor(path, options = {}) {
+    this.path = path;
+    this.provider = new LocalCredentialProvider(path);
     this.now = options.now ?? Date.now;
     this.lockWaitMs = options.lockWaitMs ?? 3e4;
   }
-  saveLogin(profile, session) {
+  saveLogin(profile, session, loginId) {
     requireProfile(profile);
     validateSession(session);
-    this.prepareDirectory();
-    const ref = randomBytes(16).toString("hex");
-    this.write(ref, { version: 1, profile, state: "ready", session });
+    if (loginId !== void 0) requireProfile(loginId);
+    const ref = randomBytes3(16).toString("hex");
+    this.write(ref, { profile, ...loginId ? { loginId } : {}, state: "ready", session });
     return ref;
   }
-  status(ref, profile) {
-    const record = this.read(ref, profile);
-    if (!record) return { state: this.isLoggedOut(ref) ? "logged_out" : "missing" };
+  status(ref, owner) {
+    const record = this.read(ref, owner);
+    if (!record) return { state: "missing" };
     const s = record.session;
     return {
       state: record.state,
-      profile,
+      profile: record.profile,
       baseUrl: s.baseUrl,
       workspaceId: s.workspaceId,
       memberId: s.memberId,
@@ -1143,12 +1406,12 @@ var OAuthSessionStore = class {
       accessExpiresAt: s.expiresAt
     };
   }
-  async resolve(ref, profile, transport) {
-    const first = this.read(ref, profile);
-    if (!first || first.state === "reauth_required") throw loginRequired();
+  async resolve(ref, owner, transport) {
+    const first = this.read(ref, owner);
+    if (!first || ["reauth_required", "logged_out"].includes(first.state)) throw loginRequired();
     if (first.state === "ready" && !this.needsRefresh(first.session)) return authorization(first.session);
     return this.withLock(ref, async () => {
-      const current = this.read(ref, profile);
+      const current = this.read(ref, owner);
       if (!current || current.state !== "ready") throw loginRequired();
       if (!this.needsRefresh(current.session)) return authorization(current.session);
       const started = this.now();
@@ -1159,170 +1422,160 @@ var OAuthSessionStore = class {
         if (next.expiresAt <= this.now()) throw loginRequired();
         this.write(ref, { ...current, state: "ready", session: next });
         return authorization(next);
-      } catch {
-        if (!this.isLoggedOut(ref)) this.write(ref, { ...current, state: "reauth_required" });
+      } catch (error) {
+        this.write(ref, { ...current, state: "reauth_required" });
+        if (error instanceof OAuthCredentialError) throw error;
         throw loginRequired();
       }
     });
   }
-  async logout(ref, profile, transport) {
-    const current = this.read(ref, profile);
-    let remoteRevoked = false;
-    try {
-      if (current) {
-        await transport.revoke(current.session.refreshToken, current.session.baseUrl);
-        remoteRevoked = true;
+  async share(ref, profile, loginId, commit) {
+    requireProfile(loginId);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, profile);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (current.loginId && current.loginId !== loginId) throw new OAuthCredentialError("invalid_profile");
+      const receipt = this.write(ref, { ...current, loginId });
+      try {
+        return commit();
+      } catch (error) {
+        this.provider.rollback(receipt);
+        throw error;
       }
-    } catch {
-    } finally {
-      this.prepareDirectory();
-      this.atomicWrite(this.path(ref, ".logged-out"), "");
-      remove(this.path(ref));
-    }
-    return { remoteRevoked };
-  }
-  needsRefresh(session) {
-    const advance = Math.min(3e4, (session.expiresAt - session.issuedAt) / 2);
-    return this.now() >= session.expiresAt - advance;
+    });
   }
-  path(ref, suffix = ".json") {
-    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
-    return join3(this.directory, ref + suffix);
+  /** Setup changes the DATA endpoint without replacing the identity or racing a refresh. */
+  async changeBaseUrl(ref, owner, baseUrl, beforeWrite) {
+    await this.withLock(ref, async () => {
+      this.provider.transaction((tx) => {
+        beforeWrite();
+        const current = this.read(ref, owner);
+        if (!current || current.state !== "ready") throw loginRequired();
+        const session = { ...current.session, baseUrl };
+        validateSession(session);
+        const before = tx.read(ref), candidate = credentialForSession({ ...current, session });
+        tx.put(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
+      });
+    });
   }
-  isLoggedOut(ref) {
-    return existsSync2(this.path(ref, ".logged-out"));
+  async logout(ref, owner, transport, beforeRevoke = () => {
+  }) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      this.provider.transaction((tx) => {
+        beforeRevoke();
+        const before = tx.read(ref);
+        if (current && before.record) tx.put(ref, { ...before.record, metadata: { ...before.record.metadata, state: "logged_out" }, payload: {} }, before);
+      });
+      let remoteRevoked = false;
+      try {
+        if (current?.session.refreshToken && current.state !== "logged_out") {
+          await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+          remoteRevoked = true;
+        }
+      } catch {
+      }
+      return { remoteRevoked };
+    });
   }
-  prepareDirectory() {
-    if (!existsSync2(this.directory)) {
-      mkdirSync2(join3(this.directory, ".."), { recursive: true, mode: 448 });
+  /** Release config references under the write lock, then delete an unused session.
+   * Waiting on the operation lock first lets an in-flight refresh supply its latest RT.
+   * Returning false from release preserves a session that still has users.
+   */
+  async retire(ref, owner, transport, release) {
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, owner);
+      const removed = this.provider.transaction((tx) => {
+        if (!release()) return false;
+        tx.remove(tx.read(ref));
+        return true;
+      });
+      if (!removed) return { removed: false, remoteRevoked: false, remoteUnconfirmed: false };
+      if (!current || current.state === "logged_out") return { removed: true, remoteRevoked: false, remoteUnconfirmed: false };
       try {
-        mkdirSync2(this.directory, { mode: 448 });
-        if (process.platform === "win32") checkWindowsPrivateStorage(this.directory, true);
-      } catch (error) {
-        if (error.code !== "EEXIST") throw unsafe();
+        if (!current.session.refreshToken) throw loginRequired();
+        await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+        return { removed: true, remoteRevoked: true, remoteUnconfirmed: false };
+      } catch {
+        return { removed: true, remoteRevoked: false, remoteUnconfirmed: true };
       }
-    }
-    requirePrivate(this.directory, true);
+    });
   }
-  read(ref, profile) {
-    requireProfile(profile);
-    if (this.isLoggedOut(ref)) return void 0;
-    const path = this.path(ref);
-    if (!existsSync2(path)) return void 0;
-    requirePrivate(this.directory, true);
-    requirePrivate(path, false);
-    const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    let text2;
-    try {
-      const stat = fstatSync(fd);
-      if (stat.size > 65536 || !stat.isFile()) throw unsafe();
-      text2 = readFileSync2(fd, "utf8");
-    } finally {
-      closeSync2(fd);
-    }
-    let doc;
+  needsRefresh(session) {
+    return this.now() >= session.expiresAt - Math.min(3e4, (session.expiresAt - session.issuedAt) / 2);
+  }
+  read(ref, owner) {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    requireProfile(typeof owner === "string" ? owner : owner.loginId);
+    let stored;
     try {
-      doc = JSON.parse(text2);
+      stored = this.provider.readStoredRecord(ref);
     } catch {
       throw unsafe();
     }
-    if (!doc || doc.version !== 1 || !["ready", "refreshing", "reauth_required"].includes(doc.state)) throw unsafe();
-    if (doc.profile !== profile) throw new OAuthCredentialError("invalid_profile");
-    validateSession(doc.session);
-    return this.isLoggedOut(ref) ? void 0 : doc;
+    if (!stored) return void 0;
+    if (stored.kind !== "oauth-session" || stored.metadata.owner.distribution !== "public") throw new OAuthCredentialError("invalid_profile");
+    const who = stored.metadata.owner;
+    if (typeof owner === "string" ? who.agent !== owner : who.loginId !== owner.loginId) throw new OAuthCredentialError("invalid_profile");
+    return { profile: who.agent, loginId: who.loginId, state: stored.metadata.state, session: oauthSessionFromCredential(stored) };
   }
   write(ref, doc) {
-    if (this.isLoggedOut(ref)) throw loginRequired();
-    this.atomicWrite(this.path(ref), JSON.stringify(doc));
-    if (this.isLoggedOut(ref)) {
-      remove(this.path(ref));
-      throw loginRequired();
-    }
-  }
-  atomicWrite(path, text2) {
-    this.prepareDirectory();
-    const temporary = path + "." + randomBytes(12).toString("hex") + ".tmp";
-    let fd;
-    try {
-      fd = openSync2(temporary, "wx", 384);
-      writeFileSync(fd, text2);
-      fsyncSync(fd);
-      closeSync2(fd);
-      fd = void 0;
-      renameSync2(temporary, path);
-      if (process.platform !== "win32") {
-        const dir = openSync2(this.directory, "r");
-        try {
-          fsyncSync(dir);
-        } finally {
-          closeSync2(dir);
-        }
-      }
-    } finally {
-      if (fd !== void 0) closeSync2(fd);
-      remove(temporary);
-    }
+    const before = this.provider.snapshot(ref);
+    if (before.record && ["logged_out", "reauth_required"].includes(before.record.metadata.state)) throw loginRequired();
+    const candidate = credentialForSession(doc);
+    return this.provider.commit(ref, { ...candidate, metadata: { ...before.record?.metadata, ...candidate.metadata } }, before);
   }
   async withLock(ref, task) {
-    const path = this.path(ref, ".lock");
-    const deadline = Date.now() + this.lockWaitMs;
-    this.prepareDirectory();
-    while (true) {
-      let fd;
-      try {
-        fd = openSync2(path, "wx", 384);
-      } catch (error) {
-        if (error.code !== "EEXIST") throw unsafe();
-        if (Date.now() >= deadline) throw new OAuthCredentialError("credential_busy");
-        await delay2(25);
-        continue;
-      }
-      try {
-        writeFileSync(fd, String(process.pid));
-        fsyncSync(fd);
-      } catch {
-        closeSync2(fd);
-        remove(path);
-        throw unsafe();
-      }
-      closeSync2(fd);
-      try {
-        return await task();
-      } finally {
-        remove(path);
-      }
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    try {
+      return await withCredentialOperation(this.path, ref, task, { lockWaitMs: this.lockWaitMs });
+    } catch (error) {
+      if (error instanceof Error && error.message === "credentials: credential_busy") throw new OAuthCredentialError("credential_busy");
+      throw error;
     }
   }
 };
-function requireProfile(profile) {
-  if (typeof profile !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("invalid_profile");
-}
-function requirePrivate(path, directory) {
-  const s = lstatSync(path);
-  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw unsafe();
-  if (process.platform === "win32") {
-    try {
-      checkWindowsPrivateStorage(path, false);
-    } catch {
-      throw unsafe();
+function credentialForSession(doc) {
+  const { accessToken, refreshToken, ...metadata } = doc.session;
+  return {
+    kind: "oauth-session",
+    payload: ["ready", "refreshing"].includes(doc.state) ? { accessToken, refreshToken } : {},
+    metadata: {
+      ...metadata,
+      owner: { distribution: "public", agent: doc.profile, ...doc.loginId ? { loginId: doc.loginId } : {} },
+      state: doc.state,
+      authorization_method: "device-code"
     }
-    return;
-  }
-  if ((s.mode & 63) !== 0 || process.getuid && s.uid !== process.getuid()) throw unsafe();
+  };
 }
-function remove(path) {
-  try {
-    unlinkSync(path);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw unsafe();
-  }
+function oauthSessionFromCredential(record) {
+  if (record.kind !== "oauth-session") throw unsafe();
+  const m = record.metadata, p = record.payload;
+  const session = {
+    baseUrl: m.baseUrl,
+    workspaceId: m.workspaceId,
+    memberId: m.memberId,
+    clientId: m.clientId,
+    scope: m.scope,
+    sessionId: m.sessionId,
+    accountDisplay: m.accountDisplay,
+    issuedAt: m.issuedAt,
+    expiresAt: m.expiresAt,
+    accessToken: p.accessToken,
+    refreshToken: p.refreshToken
+  };
+  validateSession(session, ["ready", "refreshing"].includes(m.state));
+  return session;
+}
+function requireProfile(profile) {
+  if (typeof profile !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("invalid_profile");
 }
-function validateSession(s) {
+function validateSession(s, requireTokens = true) {
   if (!s || typeof s !== "object" || s.clientId !== "ctxdb-cli" || !["read_only", "read_write", "default"].includes(s.scope) || !Number.isSafeInteger(s.issuedAt) || !Number.isSafeInteger(s.expiresAt) || s.expiresAt - s.issuedAt < 1e3 || s.expiresAt - s.issuedAt > 36e5) throw unsafe();
   for (const value of [s.workspaceId, s.memberId, s.sessionId, s.accountDisplay]) {
     if (typeof value !== "string" || !value || value.length > 256 || /[\r\n\x00-\x1f]/.test(value)) throw unsafe();
   }
-  for (const value of [s.accessToken, s.refreshToken]) {
+  for (const value of requireTokens ? [s.accessToken, s.refreshToken] : []) {
     if (typeof value !== "string" || !value || value.length > 8192 || /\s/.test(value)) throw unsafe();
   }
   let url;
@@ -1351,8 +1604,56 @@ function authorization(session) {
 }
 
 // ../shared/src/oauth-profile.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join4, resolve } from "path";
+import { dirname as dirname4, join as join3, resolve } from "path";
+
+// ../shared/src/auth-config.ts
+import { closeSync as closeSync3, existsSync as existsSync3, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync3, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
+import { dirname as dirname3 } from "path";
+var AuthConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthConfigError";
+  }
+};
+function readAuthConfig(path) {
+  if (!existsSync3(path)) return { version: 2, agents: {} };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    throw new AuthConfigError("Invalid ctxdb.json; repair the JSON before changing authentication.");
+  }
+  if (raw?.version !== 2 || !object3(raw.agents) || raw.logins !== void 0 && !object3(raw.logins)) {
+    throw new AuthConfigError("Unsupported ctxdb configuration; authentication was not changed.");
+  }
+  return raw;
+}
+function object3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function ownAuthProfile(raw, agent) {
+  const value = Object.hasOwn(raw.agents, agent) ? raw.agents[agent] : void 0;
+  if (value !== void 0 && !object3(value)) throw new AuthConfigError("Invalid agent configuration; repair its section in ctxdb.json.");
+  return value ?? {};
+}
+function requireLoginId(id) {
+  if (typeof id !== "string" || id === "default" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id)) throw new AuthConfigError("Invalid login ID; use an ID from ctxdb auth status --all.");
+}
+function validateLoginChoice(section) {
+  if (Object.hasOwn(section, "credential_ref")) {
+    if (typeof section.credential_ref !== "string" || !/^[a-f0-9]{32}$/.test(section.credential_ref)) throw new AuthConfigError("Invalid credential_ref; explicitly select --api-key or --login again.");
+    if (Object.hasOwn(section, "access_credential") || section.api_key || section.oauth_credential_ref) throw new AuthConfigError("Conflicting credential_ref and access_credential/api_key/oauth_credential_ref. Keep one authentication choice.");
+  }
+  if (!Object.hasOwn(section, "access_credential")) return;
+  if (section.access_credential === null) return;
+  requireLoginId(section.access_credential);
+  if (section.api_key || section.oauth_credential_ref) {
+    throw new AuthConfigError("Conflicting access_credential and api_key/oauth_credential_ref in this Agent. Keep one authentication choice, or use setup --api-key/--login to replace it.");
+  }
+}
+
+// ../shared/src/oauth-profile.ts
 function oauthProfile(reference, configPath, profile, baseUrl) {
   if (reference === void 0) return void 0;
   if (typeof reference !== "string" || !/^[a-f0-9]{32}$/.test(reference) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("unsafe_storage");
@@ -1361,34 +1662,150 @@ function oauthProfile(reference, configPath, profile, baseUrl) {
     reference,
     profile,
     configPath: path,
-    directory: join4(dirname2(path), "oauth-credentials"),
+    credentialsPath: join3(dirname4(path), "credentials.json"),
     baseUrl: normalizeCoreOrigin(baseUrl)
   };
 }
+function oauthProfileFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (section.access_credential === null) return void 0;
+  if (Object.hasOwn(section, "access_credential")) {
+    const id = section.access_credential;
+    requireLoginId(id);
+    const record = raw.logins && Object.hasOwn(raw.logins, id) ? raw.logins[id] : void 0;
+    if (!record?.credential_ref) throw new AuthConfigError("access_credential points to a missing login. Use ctxdb auth status --all and explicitly bind a valid login or log in again.");
+    return storedProfile(record.credential_ref, path, agent, id, baseUrlOverride);
+  }
+  return storedProfile(section.oauth_credential_ref, path, agent, void 0, baseUrlOverride);
+}
+function storedProfile(reference, path, agent, loginId, baseUrlOverride) {
+  const descriptor = oauthProfile(reference, path, agent, "https://api.cn-hangzhou.agentcontext.aliyuncs.com");
+  if (!descriptor) return void 0;
+  const profile = { ...descriptor, ...loginId ? { loginId } : {} };
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (!("baseUrl" in status) || typeof status.baseUrl !== "string") throw new OAuthCredentialError("login_required");
+  profile.baseUrl = normalizeCoreOrigin(status.baseUrl);
+  if (baseUrlOverride && normalizeCoreOrigin(baseUrlOverride) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return profile;
+}
+function oauthOwner(profile) {
+  return profile.loginId ? { loginId: profile.loginId } : profile.profile;
+}
+function oauthProfileStatus(profile) {
+  const status = new OAuthSessionStore(profile.credentialsPath).status(profile.reference, oauthOwner(profile));
+  if (typeof status.baseUrl === "string" && normalizeCoreOrigin(status.baseUrl) !== profile.baseUrl) {
+    throw new AuthConfigError("Requested base URL does not match the login Core origin; no token was sent.");
+  }
+  return status;
+}
 var OAuthProfileProvider = class {
   selected;
   constructor(selected) {
     this.selected = selected;
   }
-  async resolve() {
+  async resolve(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 3e4, deadline = Date.now() + timeoutMs;
     const selected = this.selected;
-    let raw;
-    try {
-      raw = JSON.parse(readFileSync3(selected.configPath, "utf8"));
-    } catch {
-      throw new OAuthCredentialError("login_required");
-    }
-    const profile = raw?.version === 2 ? raw.agents?.[selected.profile] : void 0;
-    if (!profile || !Object.hasOwn(profile, "oauth_credential_ref")) throw new OAuthCredentialError("login_required");
-    const current = oauthProfile(profile.oauth_credential_ref, selected.configPath, selected.profile, profile.base_url);
+    const readCurrent = () => {
+      const raw = readAuthConfig(selected.configPath);
+      return oauthProfileFromConfig(raw, selected.configPath, selected.profile);
+    };
+    const current = readCurrent();
     if (!current || current.baseUrl !== selected.baseUrl) throw new OAuthCredentialError("login_required");
-    const store = new OAuthSessionStore(current.directory);
-    const status = store.status(current.reference, current.profile);
+    const store = new OAuthSessionStore(current.credentialsPath, { lockWaitMs: timeoutMs });
+    const status = oauthProfileStatus(current);
     if (!("baseUrl" in status) || typeof status.baseUrl !== "string" || normalizeCoreOrigin(status.baseUrl) !== current.baseUrl) throw new OAuthCredentialError("login_required");
-    return store.resolve(current.reference, current.profile, new CoreDeviceClient(current.baseUrl));
+    const authorization2 = await store.resolve(current.reference, oauthOwner(current), {
+      refresh: (rt, url) => new CoreDeviceClient(url, { requestTimeoutMs: Math.max(1, deadline - Date.now()) }).refresh(rt, url)
+    });
+    const after = readCurrent();
+    if (!after || after.reference !== current.reference || after.loginId !== current.loginId || after.baseUrl !== current.baseUrl || oauthProfileStatus(after).state !== "ready") throw new OAuthCredentialError("login_required");
+    return authorization2;
   }
 };
 
+// ../shared/src/login-bindings.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { dirname as dirname6, join as join5 } from "path";
+
+// ../shared/src/data-auth.ts
+import { dirname as dirname5, join as join4 } from "path";
+function selectDataApiCredential(cfg, env = process.env) {
+  const accessToken = env.CTXDB_ACCESS_TOKEN?.trim();
+  if (accessToken) return { type: "access-token", value: accessToken };
+  if (env.CTXDB_API_KEY) return { type: "api-key", value: env.CTXDB_API_KEY };
+  const context = cfg.authContext ? { context: cfg.authContext } : {};
+  if (cfg.oauthCredential) return { type: "oauth-session", profile: cfg.oauthCredential, ...context };
+  return cfg.apiKey ? { type: "api-key", value: cfg.apiKey, ...context } : null;
+}
+var DataApiAuthorizationProvider = class {
+  context;
+  constructor(context) {
+    this.context = context;
+  }
+  async resolve(options = {}) {
+    const c = this.context, raw = readAuthConfig(c.configPath), section = ownAuthProfile(raw, c.agent);
+    const fallback = c.inheritDefaultKey && c.agent !== "default" ? ownAuthProfile(raw, "default") : {};
+    if (c.managedCredentials) {
+      const active = readActiveCredentialSync(c.credentialsPath ?? join4(dirname5(c.configPath), "credentials.json"));
+      if (active) {
+        const baseUrl2 = c.baseUrlOverride ?? active.metadata.baseUrl;
+        if (baseUrl2 !== c.baseUrl) throw new OAuthCredentialError("login_required");
+        return { scheme: "Token", value: active.payload.apiKey, baseUrl: baseUrl2, expiresAt: null };
+      }
+      throw new OAuthCredentialError("login_required");
+    }
+    const stored = publicAuthenticationFromConfig(raw, c.configPath, c.agent, c.baseUrlOverride);
+    const baseUrl = stored?.baseUrl ?? String(c.baseUrlOverride || section.base_url || fallback.base_url || "https://api.cn-hangzhou.agentcontext.aliyuncs.com").replace(/\/+$/, "");
+    if (baseUrl !== c.baseUrl) throw new OAuthCredentialError("login_required");
+    if (stored?.apiKey) return { scheme: "Token", value: stored.apiKey, baseUrl, expiresAt: null };
+    if (stored?.oauthCredential) return new OAuthProfileProvider(stored.oauthCredential).resolve(options);
+    if (Object.hasOwn(section, "access_credential")) throw new OAuthCredentialError("login_required");
+    const key = Object.hasOwn(section, "api_key") ? section.api_key : fallback.api_key;
+    if (typeof key !== "string" || !key) throw new OAuthCredentialError("login_required");
+    return { scheme: "Token", value: key, baseUrl, expiresAt: null };
+  }
+};
+function publicAuthenticationFromConfig(raw, path, agent, baseUrlOverride) {
+  const section = ownAuthProfile(raw, agent);
+  validateLoginChoice(section);
+  if (!Object.hasOwn(section, "credential_ref")) {
+    const oauthCredential = oauthProfileFromConfig(raw, path, agent, baseUrlOverride);
+    return oauthCredential ? { baseUrl: oauthCredential.baseUrl, oauthCredential } : void 0;
+  }
+  const r = new LocalCredentialProvider(join4(dirname5(path), "credentials.json")).readStoredRecord(section.credential_ref);
+  if (!r || r.kind !== "api-key" || r.metadata.state !== "ready" || r.metadata.owner.distribution !== "public" || r.metadata.owner.agent !== agent || r.metadata.owner.loginId) {
+    throw new AuthConfigError("credential_ref is missing, invalid or belongs to another Agent. Use setup --api-key/--login to choose a valid credential.");
+  }
+  const baseUrl = String(r.metadata.base_url).replace(/\/+$/, "");
+  if (baseUrlOverride && baseUrl !== baseUrlOverride.replace(/\/+$/, "")) throw new AuthConfigError("Requested base URL does not match the credential origin; no credential was sent.");
+  return { baseUrl, apiKey: r.payload.api_key };
+}
+function createRequestAuthorizationProvider(credential, baseUrl) {
+  if (credential?.context) return new DataApiAuthorizationProvider(credential.context);
+  if (credential?.type === "oauth-session") return new OAuthProfileProvider(credential.profile);
+  return { async resolve(_options) {
+    if (!credential) throw new OAuthCredentialError("login_required");
+    return {
+      scheme: credential.type === "access-token" ? "Bearer" : "Token",
+      value: credential.value,
+      baseUrl,
+      expiresAt: null
+    };
+  } };
+}
+
+// ../shared/src/authorization/public-target.ts
+import { dirname as dirname7, join as join6 } from "path";
+
+// src/config.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname8, join as join7 } from "path";
+
 // src/distribution-capabilities.ts
 var PUBLIC_DISTRIBUTION = {
   id: "public",
@@ -1403,7 +1820,7 @@ var PUBLIC_DISTRIBUTION = {
 var DISTRIBUTION_MANIFEST = typeof define_CTXDB_DISTRIBUTION_MANIFEST_default === "undefined" ? PUBLIC_DISTRIBUTION : define_CTXDB_DISTRIBUTION_MANIFEST_default;
 
 // src/config.ts
-var DEFAULT_BASE_URL = "https://context-database.aliyuncs.com";
+var DEFAULT_BASE_URL = "https://api.cn-hangzhou.agentcontext.aliyuncs.com";
 var DEFAULT_USER_ID = "default";
 var DEFAULT_TOP_K = 5;
 var DEFAULT_THRESHOLD = 0.4;
@@ -1411,7 +1828,7 @@ var DEFAULT_KNOWLEDGE_TOP_K = 6;
 var DEFAULT_KB_CATALOG_INJECTION = "session_start";
 function defaultPath(env) {
   if (env.CTXDB_CONFIG_PATH) return env.CTXDB_CONFIG_PATH;
-  return join5(homedir2(), ".ctxdb", "ctxdb.json");
+  return join7(homedir3(), ".ctxdb", "ctxdb.json");
 }
 function coerceInt(v, fallback) {
   if (v === null || v === void 0 || v === "") return fallback;
@@ -1433,7 +1850,7 @@ function coerceKbCatalogInjection(v) {
   return DEFAULT_KB_CATALOG_INJECTION;
 }
 function readRaw(path) {
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
     const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
@@ -1470,40 +1887,6 @@ function applyDebugPolicy(cfg) {
   cfg.debugReason = policy.debugReason;
   return cfg;
 }
-function managedCredential(path) {
-  if (!existsSync3(path)) return null;
-  if (process.platform !== "win32" && (statSync2(path).mode & 63) !== 0) {
-    throw new Error(`credentials: ${path} must be owner-only (run chmod 600)`);
-  }
-  const raw = JSON.parse(readFileSync4(path, "utf8"));
-  if (raw.version !== 1 || !raw.records || typeof raw.records !== "object") {
-    throw new Error("credentials: unsupported credentials.json schema");
-  }
-  const unknownKeys = Object.keys(raw.records).filter(
-    (key) => key !== "contextdb/active"
-  );
-  if (unknownKeys.length > 0) {
-    throw new Error(`credentials: unsupported record key ${unknownKeys[0]}`);
-  }
-  const record = raw.records["contextdb/active"];
-  if (!record) return null;
-  if (record.kind !== "api-key" || typeof record.payload?.api_key !== "string" || !record.payload.api_key || typeof record.payload?.base_url !== "string" || !record.payload.base_url) {
-    throw new Error("credentials: invalid contextdb/active record");
-  }
-  let baseUrl;
-  try {
-    baseUrl = new URL(record.payload.base_url);
-  } catch {
-    throw new Error("credentials: invalid contextdb/active base_url");
-  }
-  if (!["https:", "http:"].includes(baseUrl.protocol) || baseUrl.username || baseUrl.password || baseUrl.search || baseUrl.hash) {
-    throw new Error("credentials: invalid contextdb/active base_url");
-  }
-  return {
-    apiKey: record.payload.api_key,
-    baseUrl: baseUrl.toString().replace(/\/$/, "")
-  };
-}
 function loadOpencodeConfig(options = {}) {
   const env = options.env ?? process.env;
   const path = options.path ?? defaultPath(env);
@@ -1529,16 +1912,41 @@ function loadOpencodeConfig(options = {}) {
     debugReason: null,
     kbCatalogInjection: coerceKbCatalogInjection(section.kb_catalog_injection)
   };
-  const managed = DISTRIBUTION_MANIFEST.capabilities.managedCredentials && options.managedCredentials !== false ? managedCredential(
-    options.credentialsPath ?? join5(dirname3(path), "credentials.json")
+  const managed = DISTRIBUTION_MANIFEST.capabilities.managedCredentials && options.managedCredentials !== false ? readActiveCredentialSync(
+    options.credentialsPath ?? join7(dirname8(path), "credentials.json")
   ) : null;
   if (managed) {
-    cfg.apiKey = managed.apiKey;
-    cfg.baseUrl = managed.baseUrl;
+    cfg.apiKey = managed.payload.apiKey;
+    cfg.baseUrl = managed.metadata.baseUrl;
+  }
+  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
+    validateLoginChoice(section);
+    const stored = env.CTXDB_API_KEY || env.CTXDB_ACCESS_TOKEN?.trim() ? void 0 : publicAuthenticationFromConfig({ ...raw, version: 2, agents: raw.agents ?? {} }, path, "opencode", env.CTXDB_BASE_URL);
+    if (stored) {
+      cfg.baseUrl = stored.baseUrl;
+      cfg.apiKey = stored.apiKey ?? null;
+      cfg.oauthCredential = stored.oauthCredential;
+    } else if (section.credential_ref) cfg.apiKey = null;
   }
   applyEnv(cfg, env);
+  if (managed) cfg.authContext = {
+    configPath: path,
+    agent: "opencode",
+    baseUrl: cfg.baseUrl,
+    inheritDefaultKey: false,
+    managedCredentials: true,
+    credentialsPath: options.credentialsPath,
+    ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
+  };
   if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
-    cfg.oauthCredential = oauthProfile(section.oauth_credential_ref, path, "opencode", cfg.baseUrl);
+    cfg.authContext = {
+      configPath: path,
+      agent: "opencode",
+      baseUrl: cfg.baseUrl,
+      inheritDefaultKey: false,
+      ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
+    };
+    if (Object.hasOwn(section, "access_credential") && !env.CTXDB_API_KEY) cfg.apiKey = null;
   }
   if (env.CTXDB_API_KEY || accessTokenFromEnv(env)) cfg.oauthCredential = void 0;
   return cfg;
@@ -1566,25 +1974,28 @@ var HttpClient = class {
   userAgent;
   fetchImpl;
   oauthProvider;
+  credential;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.apiKey = opts.apiKey;
     this.accessToken = opts.accessToken ?? null;
-    this.oauthProvider = opts.oauthCredential ? new OAuthProfileProvider(opts.oauthCredential) : void 0;
+    this.credential = selectDataApiCredential(opts, { CTXDB_ACCESS_TOKEN: opts.accessToken ?? void 0, CTXDB_API_KEY: opts.environmentApiKey });
+    this.oauthProvider = createRequestAuthorizationProvider(this.credential, this.baseUrl);
     this.userAgent = opts.userAgent ?? "ctxdb-opencode-plugin/0.0.0";
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
-  async headers(contentType) {
+  async headers(contentType, timeoutMs) {
     const h = {
       "User-Agent": this.userAgent,
       Connection: "close"
     };
-    if (this.accessToken) h.Authorization = `Bearer ${this.accessToken}`;
-    else if (this.oauthProvider) {
-      const authorization2 = await this.oauthProvider.resolve();
+    if (this.oauthProvider) {
+      const authorization2 = await this.oauthProvider.resolve({ timeoutMs });
       if (authorization2.baseUrl !== this.baseUrl) throw new Error("OAuth environment changed; reload this runtime.");
-      h.Authorization = `Bearer ${authorization2.value}`;
-    } else if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
+      h.Authorization = `${authorization2.scheme} ${authorization2.value}`;
+    } else if (this.credential && this.credential.type !== "oauth-session") {
+      h.Authorization = `${this.credential.type === "access-token" ? "Bearer" : "Token"} ${this.credential.value}`;
+    }
     if (contentType) h["Content-Type"] = contentType;
     return h;
   }
@@ -1605,12 +2016,12 @@ var HttpClient = class {
     return this.request("POST", url, path, JSON.stringify(body), "application/json", options.timeoutMs);
   }
   async request(method, url, path, body, contentType, timeoutMs) {
-    const headers = await this.headers(contentType);
-    const bearer = headers.Authorization?.startsWith("Bearer ") ? headers.Authorization.slice(7) : void 0;
+    const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS, started = Date.now();
+    const headers = await this.headers(contentType, effectiveTimeout);
+    const bearer = headers.Authorization?.replace(/^(Bearer|Token) /, "");
     const safeText = (value) => bearer ? String(value).split(bearer).join("[REDACTED]") : String(value);
-    const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), effectiveTimeout);
+    const timer = setTimeout(() => controller.abort(), Math.max(1, effectiveTimeout - (Date.now() - started)));
     try {
       let resp;
       try {
@@ -1630,7 +2041,8 @@ var HttpClient = class {
       if (resp.status === 204) return {};
       let text2;
       try {
-        text2 = safeText(await resp.text());
+        const bodyText = await resp.text();
+        text2 = headers.Authorization?.startsWith("Bearer ") || !resp.ok ? safeText(bodyText) : bodyText;
       } catch (err) {
         throw new CtxdbHttpError(path, resp.status, `body read failed: ${safeText(err?.message ?? err)}`);
       }
@@ -1904,7 +2316,7 @@ function buildWarmupQuery(cwd, git) {
 }
 
 // src/capture.ts
-import { createHash } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var EMPTY2 = {
   captured: false,
   reason: "",
@@ -1971,7 +2383,7 @@ function toParsedMessage(m, index) {
   return null;
 }
 function fingerprintMessages(messages) {
-  const h = createHash("sha256");
+  const h = createHash4("sha256");
   for (const m of messages) {
     h.update(m.role);
     h.update("\0");
@@ -2045,6 +2457,8 @@ function buildRuntime(config, cwd, env = process.env) {
       baseUrl: config.baseUrl,
       apiKey: config.apiKey,
       oauthCredential: config.oauthCredential,
+      authContext: config.authContext,
+      environmentApiKey: env.CTXDB_API_KEY,
       accessToken: accessTokenFromEnv(env)
     }),
     sessionState: /* @__PURE__ */ new Map(),
@@ -2084,7 +2498,13 @@ function extractTextPrompt(parts) {
 }
 async function buildHooks(input) {
   if (shouldSkipHooks()) return {};
-  const config = loadOpencodeConfig();
+  let config;
+  try {
+    config = loadOpencodeConfig();
+  } catch {
+    process.stderr.write("[ctxdb] Invalid authentication configuration; OpenCode integration skipped. Run ctxdb auth status --all.\n");
+    return {};
+  }
   if (!isConfigured(config)) {
     logDebug(
       config,