@code-yeongyu/senpi-ai 2026.9.28 → 2026.9.29-2

package/dist/auth/oauth/github-copilot.js

@@ -1,9 +1,11 @@
 /**
  * GitHub Copilot OAuth flow
  */
-import { GITHUB_COPILOT_MODELS } from "../../providers/github-copilot.models.js";
+import { GITHUB_COPILOT_INDIVIDUAL_BASE_URL, githubCopilotTokenField, parseGitHubCopilotApiEndpoint, resolveGitHubCopilotBaseUrl, } from "../../api/github-copilot-endpoint.js";
+import { GITHUB_COPILOT_REJECTED_TOKEN_STATUSES } from "../../api/github-copilot-headers.js";
 import { sleep } from "../../utils/sleep.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+import { parseGitHubCopilotModelCatalog } from "./github-copilot-model-catalog.js";
 const decode = (s) => atob(s);
 const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
 const COPILOT_HEADERS = {
@@ -32,70 +34,8 @@ function getUrls(domain) {
         copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,
     };
 }
-/**
- * Parse the proxy-ep from a Copilot token and convert to API base URL.
- * Token format: tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...
- * Returns API URL like https://api.individual.githubcopilot.com
- */
-function getBaseUrlFromToken(token) {
-    const match = token.match(/proxy-ep=([^;]+)/);
-    if (!match)
-        return null;
-    const proxyHost = match[1];
-    // Convert proxy.xxx to api.xxx
-    const apiHost = proxyHost.replace(/^proxy\./, "api.");
-    return `https://${apiHost}`;
-}
-function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
-    // If we have a token, extract the base URL from proxy-ep
-    if (token) {
-        const urlFromToken = getBaseUrlFromToken(token);
-        if (urlFromToken)
-            return urlFromToken;
-    }
-    // Fallback for enterprise or if token parsing fails
-    if (enterpriseDomain)
-        return `https://copilot-api.${enterpriseDomain}`;
-    return "https://api.individual.githubcopilot.com";
-}
-function asRecord(value) {
-    return value && typeof value === "object" ? value : undefined;
-}
-function parseGitHubCopilotModelCatalog(raw, allowPolicyFallback) {
-    const data = asRecord(raw)?.data;
-    if (!Array.isArray(data)) {
-        throw new Error("Invalid Copilot models response");
-    }
-    const accountModels = data.flatMap((rawItem) => {
-        const item = asRecord(rawItem);
-        const id = item?.id;
-        if (!item || typeof id !== "string")
-            return [];
-        const capabilities = asRecord(item.capabilities);
-        const supports = asRecord(capabilities?.supports);
-        if (supports?.tool_calls === false)
-            return [];
-        return [
-            {
-                id,
-                pickerEnabled: item.model_picker_enabled === true,
-                policyState: asRecord(item.policy)?.state,
-            },
-        ];
-    });
-    const pickerModelIds = accountModels
-        .filter((model) => model.pickerEnabled && model.policyState !== "disabled")
-        .map((model) => model.id);
-    const usePolicyFallback = allowPolicyFallback && pickerModelIds.length === 0;
-    const availableModelIds = pickerModelIds.length > 0 || !allowPolicyFallback
-        ? pickerModelIds
-        : accountModels.filter((model) => model.policyState === "enabled").map((model) => model.id);
-    const policyModelIds = accountModels
-        .filter((model) => model.policyState === "unconfigured" &&
-        Object.hasOwn(GITHUB_COPILOT_MODELS, model.id) &&
-        (model.pickerEnabled || usePolicyFallback))
-        .map((model) => model.id);
-    return { availableModelIds, policyModelIds };
+function getGitHubCopilotBaseUrl(token, enterpriseDomain, apiEndpoint) {
+    return resolveGitHubCopilotBaseUrl({ token, enterpriseDomain, apiEndpoint });
 }
 async function fetchWithRateLimitRetry(url, init, signal, retryPolicy) {
     const retryBudgetSignal = retryPolicy.maxRetries > 0 && retryPolicy.maxElapsedMs > 0
@@ -125,11 +65,11 @@ async function fetchWithRateLimitRetry(url, init, signal, retryPolicy) {
         await sleep(delayMs, requestSignal);
     }
 }
-async function fetchGitHubCopilotModels(copilotToken, enterpriseDomain, signal, retryPolicy) {
-    const baseUrl = getGitHubCopilotBaseUrl(copilotToken, enterpriseDomain);
+async function fetchGitHubCopilotModels(copilotToken, enterpriseDomain, signal, retryPolicy, apiEndpoint) {
+    const baseUrl = getGitHubCopilotBaseUrl(copilotToken, enterpriseDomain, apiEndpoint);
     // Some Individual accounts return false for every picker flag despite explicit enabled policies.
     // Limit the fallback to that endpoint so other account types keep strict picker semantics.
-    const allowPolicyFallback = baseUrl === "https://api.individual.githubcopilot.com";
+    const allowPolicyFallback = baseUrl === GITHUB_COPILOT_INDIVIDUAL_BASE_URL;
     const response = await fetchWithRateLimitRetry(`${baseUrl}/models`, {
         headers: {
             Accept: "application/json",
@@ -260,12 +200,16 @@ async function refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, s
     if (typeof token !== "string" || typeof expiresAt !== "number") {
         throw new Error("Invalid Copilot token response fields");
     }
+    const endpoints = raw.endpoints;
+    const apiUrl = parseGitHubCopilotApiEndpoint(typeof endpoints === "object" && endpoints !== null ? Reflect.get(endpoints, "api") : undefined);
+    const tid = githubCopilotTokenField(token, "tid");
     return {
         type: "oauth",
         refresh: refreshToken,
         access: token,
         expires: expiresAt * 1000 - 5 * 60 * 1000,
         enterpriseUrl: enterpriseDomain,
+        ...(apiUrl !== undefined && tid !== undefined ? { copilotApiEndpoint: { tid, url: apiUrl } } : {}),
     };
 }
 /**
@@ -273,21 +217,22 @@ async function refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, s
  */
 async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal) {
     const credentials = await refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, signal);
-    const { availableModelIds } = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain, signal, {
+    const { availableModelIds, modelLimits } = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain, signal, {
         maxRetries: 0,
         maxElapsedMs: 0,
-    });
+    }, credentials.copilotApiEndpoint);
     return {
         ...credentials,
         availableModelIds,
+        copilotModelLimits: modelLimits,
     };
 }
 /**
  * Enable a model for the user's GitHub Copilot account.
  * This is required for some models (like Claude, Grok) before they can be used.
  */
-async function enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal) {
-    const baseUrl = getGitHubCopilotBaseUrl(token, enterpriseDomain);
+async function enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal, apiEndpoint) {
+    const baseUrl = getGitHubCopilotBaseUrl(token, enterpriseDomain, apiEndpoint);
     const url = `${baseUrl}/models/${modelId}/policy`;
     let response;
     try {
@@ -317,11 +262,11 @@ async function enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal
  * Enable the requested GitHub Copilot models and return the successful IDs.
  * Policy updates are best effort; exhausted rate limiting stops the batch.
  */
-async function enableGitHubCopilotModels(token, modelIds, enterpriseDomain, signal) {
+async function enableGitHubCopilotModels(token, modelIds, enterpriseDomain, signal, apiEndpoint) {
     const enabledModelIds = [];
     for (const modelId of modelIds) {
         try {
-            if (await enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal)) {
+            if (await enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal, apiEndpoint)) {
                 enabledModelIds.push(modelId);
             }
         }
@@ -359,15 +304,16 @@ async function loginGitHubCopilot(interaction) {
     const models = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain ?? undefined, interaction.signal, {
         maxRetries: 2,
         maxElapsedMs: 5000,
-    });
+    }, credentials.copilotApiEndpoint);
     let enabledModelIds = [];
     if (models.policyModelIds.length > 0) {
         interaction.notify({ type: "progress", message: "Enabling models..." });
-        enabledModelIds = await enableGitHubCopilotModels(credentials.access, models.policyModelIds, enterpriseDomain ?? undefined, interaction.signal);
+        enabledModelIds = await enableGitHubCopilotModels(credentials.access, models.policyModelIds, enterpriseDomain ?? undefined, interaction.signal, credentials.copilotApiEndpoint);
     }
     return {
         ...credentials,
         availableModelIds: [...new Set([...models.availableModelIds, ...enabledModelIds])],
+        copilotModelLimits: models.modelLimits,
     };
 }
 function copilotEnterpriseDomain(credential) {
@@ -379,13 +325,14 @@ function copilotEnterpriseDomain(credential) {
 export const githubCopilotOAuth = {
     name: "GitHub Copilot",
     isSubscription: true,
+    rejectedTokenStatuses: GITHUB_COPILOT_REJECTED_TOKEN_STATUSES,
     login: loginGitHubCopilot,
     refresh: (credential, signal) => refreshGitHubCopilotToken(credential.refresh, copilotEnterpriseDomain(credential), signal),
     /** Derive the credential-specific proxy endpoint for each request. */
     async toAuth(credential) {
         return {
             apiKey: credential.access,
-            baseUrl: getGitHubCopilotBaseUrl(credential.access, copilotEnterpriseDomain(credential)),
+            baseUrl: getGitHubCopilotBaseUrl(credential.access, copilotEnterpriseDomain(credential), credential.copilotApiEndpoint),
         };
     },
 };

package/dist/auth/oauth/github-copilot.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-copilot.js","sourceRoot":"","sources":["../../../src/auth/oauth/github-copilot.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,SAAS,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG;IACvB,YAAY,EAAE,0BAA0B;IACxC,gBAAgB,EAAE,gBAAgB;IAClC,uBAAuB,EAAE,qBAAqB;IAC9C,wBAAwB,EAAE,aAAa;CAC9B,CAAC;AACX,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAsBzC,SAAS,eAAe,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC,QAAQ,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAK9B,OAAO;QACN,aAAa,EAAE,WAAW,MAAM,oBAAoB;QACpD,cAAc,EAAE,WAAW,MAAM,2BAA2B;QAC5D,eAAe,EAAE,eAAe,MAAM,4BAA4B;KAClE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,+BAA+B;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,WAAW,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAE,gBAAyB;IACzE,yDAAyD;IACzD,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACvC,CAAC;IACD,oDAAoD;IACpD,IAAI,gBAAgB;QAAE,OAAO,uBAAuB,gBAAgB,EAAE,CAAC;IACvE,OAAO,0CAA0C,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAY,EAAE,mBAA4B;IACjF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAE/C,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,UAAU,KAAK,KAAK;YAAE,OAAO,EAAE,CAAC;QAE9C,OAAO;YACN;gBACC,EAAE;gBACF,aAAa,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI;gBACjD,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK;aACzC;SACD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,aAAa;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC;SAC1E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,iBAAiB,GAAG,mBAAmB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7E,MAAM,iBAAiB,GACtB,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB;QAChD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,aAAa;SAClC,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CACT,KAAK,CAAC,WAAW,KAAK,cAAc;QACpC,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,CAAC,KAAK,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAC3C;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAW,EACX,IAAiB,EACjB,MAAmB,EACnB,WAAyD;IAEzD,MAAM,iBAAiB,GACtB,WAAW,CAAC,UAAU,GAAG,CAAC,IAAI,WAAW,CAAC,YAAY,GAAG,CAAC;QACzD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,WAAW,CAAC,UAAU;YAAE,OAAO,QAAQ,CAAC;QAEjF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC1F,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,YAAoB,EACpB,gBAAoC,EACpC,MAAmB,EACnB,WAAyD;IAEzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACxE,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,mBAAmB,GAAG,OAAO,KAAK,0CAA0C,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC7C,GAAG,OAAO,SAAS,EACnB;QACC,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,GAAG,eAAe;YAClB,sBAAsB,EAAE,mBAAmB;SAC3C;KACD,EACD,MAAM,EACN,WAAW,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,8BAA8B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAiB;IACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAmB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;YACnD,YAAY,EAAE,0BAA0B;SACxC;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACzB,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,WAAW;SAClB,CAAC;QACF,MAAM;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAI,IAAgC,CAAC,WAAW,CAAC;IACjE,MAAM,QAAQ,GAAI,IAAgC,CAAC,SAAS,CAAC;IAC7D,MAAM,eAAe,GAAI,IAAgC,CAAC,gBAAgB,CAAC;IAC3E,MAAM,QAAQ,GAAI,IAAgC,CAAC,QAAQ,CAAC;IAC5D,MAAM,SAAS,GAAI,IAAgC,CAAC,UAAU,CAAC;IAE/D,IACC,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;QACxD,OAAO,SAAS,KAAK,QAAQ,EAC5B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IAED,kFAAkF;IAClF,6DAA6D;IAC7D,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACJ,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACN,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,SAAS,CAAC,IAAI;QAChC,QAAQ;QACR,UAAU,EAAE,SAAS;KACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,MAAc,EACd,MAA0B,EAC1B,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,uBAAuB,CAAS;QACtC,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,0BAA0B;iBACxC;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,8CAA8C;iBAC1D,CAAC;gBACF,MAAM;aACN,CAAC,CAAC;YAEH,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAkC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC5G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAG,GAAkC,CAAC,YAAY,EAAE,CAAC;YACxF,CAAC;YAED,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAgC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnG,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,GAA+B,CAAC;gBAC5F,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;oBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,CAAC;gBAED,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBACtG,CAAC;gBAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,KAAK,GAAG,iBAAiB,EAAE,EAAE,CAAC;YAC1F,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QACvE,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,IAAI,YAAY,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE;QACjD,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,GAAG,eAAe;SAClB;QACD,MAAM;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAI,GAA+B,CAAC,KAAK,CAAC;IACrD,MAAM,SAAS,GAAI,GAA+B,CAAC,UAAU,CAAC;IAE9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACN,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QACzC,aAAa,EAAE,gBAAgB;KAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,yBAAyB,CACvC,YAAoB,EACpB,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAClG,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,wBAAwB,CAAC,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE;QAC1G,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;KACf,CAAC,CAAC;IACH,OAAO;QACN,GAAG,WAAW;QACd,iBAAiB;KACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACtC,KAAa,EACb,OAAe,EACf,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,OAAO,WAAW,OAAO,SAAS,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,uBAAuB,CACvC,GAAG,EACH;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,eAAe;gBAClB,eAAe,EAAE,aAAa;gBAC9B,oBAAoB,EAAE,aAAa;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC1C,EACD,MAAM,EACN,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QAChC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACvC,KAAa,EACb,QAA2B,EAC3B,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9E,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC;YAChC,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,WAAoC;IACrE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,iBAAiB;KAC9B,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,gBAAgB,IAAI,YAAY,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjE,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,MAAM,+BAA+B,CACxD,iBAAiB,EACjB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,CAClB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC5C,WAAW,CAAC,MAAM,EAClB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,EAClB;QACC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,IAAI;KAClB,CACD,CAAC;IACF,IAAI,eAAe,GAAa,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxE,eAAe,GAAG,MAAM,yBAAyB,CAChD,WAAW,CAAC,MAAM,EAClB,MAAM,CAAC,cAAc,EACrB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,CAClB,CAAC;IACH,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,iBAAiB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;KAClF,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,UAA2B;IAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAC/C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,eAAe,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC5C,IAAI,EAAE,gBAAgB;IACtB,cAAc,EAAE,IAAI;IACpB,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAC/B,yBAAyB,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE3F,sEAAsE;IACtE,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,uBAAuB,CAAC,UAAU,CAAC,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;SACxF,CAAC;IACH,CAAC;CACD,CAAC","sourcesContent":["/**\n * GitHub Copilot OAuth flow\n */\n\nimport { GITHUB_COPILOT_MODELS } from \"../../providers/github-copilot.models.ts\";\nimport { sleep } from \"../../utils/sleep.ts\";\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode(\"SXYxLmI1MDdhMDhjODdlY2ZlOTg=\");\n\nconst COPILOT_HEADERS = {\n\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\"Editor-Version\": \"vscode/1.107.0\",\n\t\"Editor-Plugin-Version\": \"copilot-chat/0.35.0\",\n\t\"Copilot-Integration-Id\": \"vscode-chat\",\n} as const;\nconst COPILOT_API_VERSION = \"2026-06-01\";\n\ntype DeviceCodeResponse = {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\tinterval?: number;\n\texpires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n\taccess_token: string;\n\ttoken_type?: string;\n\tscope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n\terror: string;\n\terror_description?: string;\n\tinterval?: number;\n};\n\nfunction normalizeDomain(input: string): string | null {\n\tconst trimmed = input.trim();\n\tif (!trimmed) return null;\n\ttry {\n\t\tconst url = trimmed.includes(\"://\") ? new URL(trimmed) : new URL(`https://${trimmed}`);\n\t\treturn url.hostname;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction getUrls(domain: string): {\n\tdeviceCodeUrl: string;\n\taccessTokenUrl: string;\n\tcopilotTokenUrl: string;\n} {\n\treturn {\n\t\tdeviceCodeUrl: `https://${domain}/login/device/code`,\n\t\taccessTokenUrl: `https://${domain}/login/oauth/access_token`,\n\t\tcopilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n\t};\n}\n\n/**\n * Parse the proxy-ep from a Copilot token and convert to API base URL.\n * Token format: tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...\n * Returns API URL like https://api.individual.githubcopilot.com\n */\nfunction getBaseUrlFromToken(token: string): string | null {\n\tconst match = token.match(/proxy-ep=([^;]+)/);\n\tif (!match) return null;\n\tconst proxyHost = match[1];\n\t// Convert proxy.xxx to api.xxx\n\tconst apiHost = proxyHost.replace(/^proxy\\./, \"api.\");\n\treturn `https://${apiHost}`;\n}\n\nfunction getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string {\n\t// If we have a token, extract the base URL from proxy-ep\n\tif (token) {\n\t\tconst urlFromToken = getBaseUrlFromToken(token);\n\t\tif (urlFromToken) return urlFromToken;\n\t}\n\t// Fallback for enterprise or if token parsing fails\n\tif (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;\n\treturn \"https://api.individual.githubcopilot.com\";\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n\treturn value && typeof value === \"object\" ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction parseGitHubCopilotModelCatalog(raw: unknown, allowPolicyFallback: boolean) {\n\tconst data = asRecord(raw)?.data;\n\tif (!Array.isArray(data)) {\n\t\tthrow new Error(\"Invalid Copilot models response\");\n\t}\n\n\tconst accountModels = data.flatMap((rawItem) => {\n\t\tconst item = asRecord(rawItem);\n\t\tconst id = item?.id;\n\t\tif (!item || typeof id !== \"string\") return [];\n\n\t\tconst capabilities = asRecord(item.capabilities);\n\t\tconst supports = asRecord(capabilities?.supports);\n\t\tif (supports?.tool_calls === false) return [];\n\n\t\treturn [\n\t\t\t{\n\t\t\t\tid,\n\t\t\t\tpickerEnabled: item.model_picker_enabled === true,\n\t\t\t\tpolicyState: asRecord(item.policy)?.state,\n\t\t\t},\n\t\t];\n\t});\n\tconst pickerModelIds = accountModels\n\t\t.filter((model) => model.pickerEnabled && model.policyState !== \"disabled\")\n\t\t.map((model) => model.id);\n\tconst usePolicyFallback = allowPolicyFallback && pickerModelIds.length === 0;\n\tconst availableModelIds =\n\t\tpickerModelIds.length > 0 || !allowPolicyFallback\n\t\t\t? pickerModelIds\n\t\t\t: accountModels.filter((model) => model.policyState === \"enabled\").map((model) => model.id);\n\tconst policyModelIds = accountModels\n\t\t.filter(\n\t\t\t(model) =>\n\t\t\t\tmodel.policyState === \"unconfigured\" &&\n\t\t\t\tObject.hasOwn(GITHUB_COPILOT_MODELS, model.id) &&\n\t\t\t\t(model.pickerEnabled || usePolicyFallback),\n\t\t)\n\t\t.map((model) => model.id);\n\treturn { availableModelIds, policyModelIds };\n}\n\nasync function fetchWithRateLimitRetry(\n\turl: string,\n\tinit: RequestInit,\n\tsignal: AbortSignal,\n\tretryPolicy: { maxRetries: number; maxElapsedMs: number },\n): Promise<Response> {\n\tconst retryBudgetSignal =\n\t\tretryPolicy.maxRetries > 0 && retryPolicy.maxElapsedMs > 0\n\t\t\t? AbortSignal.timeout(retryPolicy.maxElapsedMs)\n\t\t\t: undefined;\n\tconst requestSignal = retryBudgetSignal ? AbortSignal.any([signal, retryBudgetSignal]) : signal;\n\tconst retryDeadline = retryBudgetSignal ? Date.now() + retryPolicy.maxElapsedMs : undefined;\n\tfor (let retry = 0; ; retry++) {\n\t\tconst response = await fetch(url, {\n\t\t\t...init,\n\t\t\tsignal: AbortSignal.any([requestSignal, AbortSignal.timeout(5000)]),\n\t\t});\n\t\tif (response.status !== 429 || retry === retryPolicy.maxRetries) return response;\n\n\t\tconst retryAfter = response.headers.get(\"retry-after\");\n\t\tlet delayMs = 500 * 2 ** retry;\n\t\tif (retryAfter) {\n\t\t\tconst seconds = Number.parseFloat(retryAfter);\n\t\t\tdelayMs = Number.isNaN(seconds) ? Date.parse(retryAfter) - Date.now() : seconds * 1000;\n\t\t\tif (!Number.isFinite(delayMs)) return response;\n\t\t}\n\t\tdelayMs = Math.max(0, delayMs);\n\t\tif (retryDeadline !== undefined && delayMs >= retryDeadline - Date.now()) return response;\n\t\tawait response.body?.cancel();\n\t\tawait sleep(delayMs, requestSignal);\n\t}\n}\n\nasync function fetchGitHubCopilotModels(\n\tcopilotToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n\tretryPolicy: { maxRetries: number; maxElapsedMs: number },\n) {\n\tconst baseUrl = getGitHubCopilotBaseUrl(copilotToken, enterpriseDomain);\n\t// Some Individual accounts return false for every picker flag despite explicit enabled policies.\n\t// Limit the fallback to that endpoint so other account types keep strict picker semantics.\n\tconst allowPolicyFallback = baseUrl === \"https://api.individual.githubcopilot.com\";\n\tconst response = await fetchWithRateLimitRetry(\n\t\t`${baseUrl}/models`,\n\t\t{\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\tAuthorization: `Bearer ${copilotToken}`,\n\t\t\t\t...COPILOT_HEADERS,\n\t\t\t\t\"X-GitHub-Api-Version\": COPILOT_API_VERSION,\n\t\t\t},\n\t\t},\n\t\tsignal,\n\t\tretryPolicy,\n\t);\n\tif (!response.ok) {\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${await response.text()}`);\n\t}\n\treturn parseGitHubCopilotModelCatalog(await response.json(), allowPolicyFallback);\n}\n\nasync function fetchJson(url: string, init: RequestInit): Promise<unknown> {\n\tconst response = await fetch(url, init);\n\tif (!response.ok) {\n\t\tconst text = await response.text();\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${text}`);\n\t}\n\treturn response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal: AbortSignal): Promise<DeviceCodeResponse> {\n\tconst urls = getUrls(domain);\n\tconst data = await fetchJson(urls.deviceCodeUrl, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\t},\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: CLIENT_ID,\n\t\t\tscope: \"read:user\",\n\t\t}),\n\t\tsignal,\n\t});\n\n\tif (!data || typeof data !== \"object\") {\n\t\tthrow new Error(\"Invalid device code response\");\n\t}\n\n\tconst deviceCode = (data as Record<string, unknown>).device_code;\n\tconst userCode = (data as Record<string, unknown>).user_code;\n\tconst verificationUri = (data as Record<string, unknown>).verification_uri;\n\tconst interval = (data as Record<string, unknown>).interval;\n\tconst expiresIn = (data as Record<string, unknown>).expires_in;\n\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\t(interval !== undefined && typeof interval !== \"number\") ||\n\t\ttypeof expiresIn !== \"number\"\n\t) {\n\t\tthrow new Error(\"Invalid device code response fields\");\n\t}\n\n\t// The verification URI is opened in the user's browser and to prevent `open` from\n\t// opening an executable or similar, we force it to be a URL.\n\tlet parsedUri: URL;\n\ttry {\n\t\tparsedUri = new URL(verificationUri);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\tif (parsedUri.protocol !== \"https:\" && parsedUri.protocol !== \"http:\") {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\n\treturn {\n\t\tdevice_code: deviceCode,\n\t\tuser_code: userCode,\n\t\tverification_uri: parsedUri.href,\n\t\tinterval,\n\t\texpires_in: expiresIn,\n\t};\n}\n\nasync function pollForGitHubAccessToken(\n\tdomain: string,\n\tdevice: DeviceCodeResponse,\n\tsignal: AbortSignal,\n): Promise<string> {\n\tconst urls = getUrls(domain);\n\treturn pollOAuthDeviceCodeFlow<string>({\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst raw = await fetchJson(urls.accessTokenUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tdevice_code: device.device_code,\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t}),\n\t\t\t\tsignal,\n\t\t\t});\n\n\t\t\tif (raw && typeof raw === \"object\" && typeof (raw as DeviceTokenSuccessResponse).access_token === \"string\") {\n\t\t\t\treturn { status: \"complete\", value: (raw as DeviceTokenSuccessResponse).access_token };\n\t\t\t}\n\n\t\t\tif (raw && typeof raw === \"object\" && typeof (raw as DeviceTokenErrorResponse).error === \"string\") {\n\t\t\t\tconst { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n\t\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\t\treturn { status: \"pending\" };\n\t\t\t\t}\n\n\t\t\t\tif (error === \"slow_down\") {\n\t\t\t\t\treturn { status: \"slow_down\", intervalSeconds: typeof interval === \"number\" ? interval : undefined };\n\t\t\t\t}\n\n\t\t\t\tconst descriptionSuffix = description ? `: ${description}` : \"\";\n\t\t\t\treturn { status: \"failed\", message: `Device flow failed: ${error}${descriptionSuffix}` };\n\t\t\t}\n\n\t\t\treturn { status: \"failed\", message: \"Invalid device token response\" };\n\t\t},\n\t});\n}\n\nasync function refreshGitHubCopilotAccessToken(\n\trefreshToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tconst domain = enterpriseDomain || \"github.com\";\n\tconst urls = getUrls(domain);\n\n\tconst raw = await fetchJson(urls.copilotTokenUrl, {\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t\tAuthorization: `Bearer ${refreshToken}`,\n\t\t\t...COPILOT_HEADERS,\n\t\t},\n\t\tsignal,\n\t});\n\n\tif (!raw || typeof raw !== \"object\") {\n\t\tthrow new Error(\"Invalid Copilot token response\");\n\t}\n\n\tconst token = (raw as Record<string, unknown>).token;\n\tconst expiresAt = (raw as Record<string, unknown>).expires_at;\n\n\tif (typeof token !== \"string\" || typeof expiresAt !== \"number\") {\n\t\tthrow new Error(\"Invalid Copilot token response fields\");\n\t}\n\n\treturn {\n\t\ttype: \"oauth\",\n\t\trefresh: refreshToken,\n\t\taccess: token,\n\t\texpires: expiresAt * 1000 - 5 * 60 * 1000,\n\t\tenterpriseUrl: enterpriseDomain,\n\t};\n}\n\n/**\n * Refresh GitHub Copilot token\n */\nasync function refreshGitHubCopilotToken(\n\trefreshToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tconst credentials = await refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, signal);\n\tconst { availableModelIds } = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain, signal, {\n\t\tmaxRetries: 0,\n\t\tmaxElapsedMs: 0,\n\t});\n\treturn {\n\t\t...credentials,\n\t\tavailableModelIds,\n\t};\n}\n\n/**\n * Enable a model for the user's GitHub Copilot account.\n * This is required for some models (like Claude, Grok) before they can be used.\n */\nasync function enableGitHubCopilotModel(\n\ttoken: string,\n\tmodelId: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<boolean> {\n\tconst baseUrl = getGitHubCopilotBaseUrl(token, enterpriseDomain);\n\tconst url = `${baseUrl}/models/${modelId}/policy`;\n\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetchWithRateLimitRetry(\n\t\t\turl,\n\t\t\t{\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\t...COPILOT_HEADERS,\n\t\t\t\t\t\"openai-intent\": \"chat-policy\",\n\t\t\t\t\t\"x-interaction-type\": \"chat-policy\",\n\t\t\t\t},\n\t\t\t\tbody: JSON.stringify({ state: \"enabled\" }),\n\t\t\t},\n\t\t\tsignal,\n\t\t\t{ maxRetries: 2, maxElapsedMs: 5000 },\n\t\t);\n\t} catch (error) {\n\t\tif (signal.aborted) throw error;\n\t\treturn false;\n\t}\n\tif (response.status === 429) {\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${await response.text()}`);\n\t}\n\treturn response.ok;\n}\n\n/**\n * Enable the requested GitHub Copilot models and return the successful IDs.\n * Policy updates are best effort; exhausted rate limiting stops the batch.\n */\nasync function enableGitHubCopilotModels(\n\ttoken: string,\n\tmodelIds: readonly string[],\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<string[]> {\n\tconst enabledModelIds: string[] = [];\n\tfor (const modelId of modelIds) {\n\t\ttry {\n\t\t\tif (await enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal)) {\n\t\t\t\tenabledModelIds.push(modelId);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (signal.aborted) throw error;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn enabledModelIds;\n}\n\nasync function loginGitHubCopilot(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst input = await interaction.prompt({\n\t\ttype: \"text\",\n\t\tmessage: \"GitHub Enterprise URL/domain (blank for github.com)\",\n\t\tplaceholder: \"company.ghe.com\",\n\t});\n\tif (interaction.signal.aborted) throw new Error(\"Login cancelled\");\n\n\tconst trimmed = input.trim();\n\tconst enterpriseDomain = normalizeDomain(input);\n\tif (trimmed && !enterpriseDomain) throw new Error(\"Invalid GitHub Enterprise URL/domain\");\n\tconst domain = enterpriseDomain || \"github.com\";\n\n\tconst device = await startDeviceFlow(domain, interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.user_code,\n\t\tverificationUri: device.verification_uri,\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t});\n\n\tconst githubAccessToken = await pollForGitHubAccessToken(domain, device, interaction.signal);\n\tconst credentials = await refreshGitHubCopilotAccessToken(\n\t\tgithubAccessToken,\n\t\tenterpriseDomain ?? undefined,\n\t\tinteraction.signal,\n\t);\n\tconst models = await fetchGitHubCopilotModels(\n\t\tcredentials.access,\n\t\tenterpriseDomain ?? undefined,\n\t\tinteraction.signal,\n\t\t{\n\t\t\tmaxRetries: 2,\n\t\t\tmaxElapsedMs: 5000,\n\t\t},\n\t);\n\tlet enabledModelIds: string[] = [];\n\tif (models.policyModelIds.length > 0) {\n\t\tinteraction.notify({ type: \"progress\", message: \"Enabling models...\" });\n\t\tenabledModelIds = await enableGitHubCopilotModels(\n\t\t\tcredentials.access,\n\t\t\tmodels.policyModelIds,\n\t\t\tenterpriseDomain ?? undefined,\n\t\t\tinteraction.signal,\n\t\t);\n\t}\n\treturn {\n\t\t...credentials,\n\t\tavailableModelIds: [...new Set([...models.availableModelIds, ...enabledModelIds])],\n\t};\n}\n\nfunction copilotEnterpriseDomain(credential: OAuthCredential): string | undefined {\n\tconst enterpriseUrl = credential.enterpriseUrl;\n\tif (typeof enterpriseUrl !== \"string\" || !enterpriseUrl) return undefined;\n\treturn normalizeDomain(enterpriseUrl) ?? undefined;\n}\n\nexport const githubCopilotOAuth: OAuthAuth = {\n\tname: \"GitHub Copilot\",\n\tisSubscription: true,\n\tlogin: loginGitHubCopilot,\n\trefresh: (credential, signal) =>\n\t\trefreshGitHubCopilotToken(credential.refresh, copilotEnterpriseDomain(credential), signal),\n\n\t/** Derive the credential-specific proxy endpoint for each request. */\n\tasync toAuth(credential) {\n\t\treturn {\n\t\t\tapiKey: credential.access,\n\t\t\tbaseUrl: getGitHubCopilotBaseUrl(credential.access, copilotEnterpriseDomain(credential)),\n\t\t};\n\t},\n};\n"]}
+{"version":3,"file":"github-copilot.js","sourceRoot":"","sources":["../../../src/auth/oauth/github-copilot.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACN,kCAAkC,EAClC,uBAAuB,EACvB,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,SAAS,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG;IACvB,YAAY,EAAE,0BAA0B;IACxC,gBAAgB,EAAE,gBAAgB;IAClC,uBAAuB,EAAE,qBAAqB;IAC9C,wBAAwB,EAAE,aAAa;CAC9B,CAAC;AACX,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAsBzC,SAAS,eAAe,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC,QAAQ,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAK9B,OAAO;QACN,aAAa,EAAE,WAAW,MAAM,oBAAoB;QACpD,cAAc,EAAE,WAAW,MAAM,2BAA2B;QAC5D,eAAe,EAAE,eAAe,MAAM,4BAA4B;KAClE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAE,gBAAyB,EAAE,WAAqB;IAChG,OAAO,2BAA2B,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAW,EACX,IAAiB,EACjB,MAAmB,EACnB,WAAyD;IAEzD,MAAM,iBAAiB,GACtB,WAAW,CAAC,UAAU,GAAG,CAAC,IAAI,WAAW,CAAC,YAAY,GAAG,CAAC;QACzD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,WAAW,CAAC,UAAU;YAAE,OAAO,QAAQ,CAAC;QAEjF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC1F,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,YAAoB,EACpB,gBAAoC,EACpC,MAAmB,EACnB,WAAyD,EACzD,WAAqB;IAErB,MAAM,OAAO,GAAG,uBAAuB,CAAC,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACrF,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,mBAAmB,GAAG,OAAO,KAAK,kCAAkC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC7C,GAAG,OAAO,SAAS,EACnB;QACC,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,GAAG,eAAe;YAClB,sBAAsB,EAAE,mBAAmB;SAC3C;KACD,EACD,MAAM,EACN,WAAW,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,8BAA8B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAiB;IACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAmB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;YACnD,YAAY,EAAE,0BAA0B;SACxC;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACzB,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,WAAW;SAClB,CAAC;QACF,MAAM;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAI,IAAgC,CAAC,WAAW,CAAC;IACjE,MAAM,QAAQ,GAAI,IAAgC,CAAC,SAAS,CAAC;IAC7D,MAAM,eAAe,GAAI,IAAgC,CAAC,gBAAgB,CAAC;IAC3E,MAAM,QAAQ,GAAI,IAAgC,CAAC,QAAQ,CAAC;IAC5D,MAAM,SAAS,GAAI,IAAgC,CAAC,UAAU,CAAC;IAE/D,IACC,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;QACxD,OAAO,SAAS,KAAK,QAAQ,EAC5B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IAED,kFAAkF;IAClF,6DAA6D;IAC7D,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACJ,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACN,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,SAAS,CAAC,IAAI;QAChC,QAAQ;QACR,UAAU,EAAE,SAAS;KACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,MAAc,EACd,MAA0B,EAC1B,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,uBAAuB,CAAS;QACtC,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,0BAA0B;iBACxC;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,8CAA8C;iBAC1D,CAAC;gBACF,MAAM;aACN,CAAC,CAAC;YAEH,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAkC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC5G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAG,GAAkC,CAAC,YAAY,EAAE,CAAC;YACxF,CAAC;YAED,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAgC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnG,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,GAA+B,CAAC;gBAC5F,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;oBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,CAAC;gBAED,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBACtG,CAAC;gBAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,KAAK,GAAG,iBAAiB,EAAE,EAAE,CAAC;YAC1F,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QACvE,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,IAAI,YAAY,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE;QACjD,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,GAAG,eAAe;SAClB;QACD,MAAM;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAI,GAA+B,CAAC,KAAK,CAAC;IACrD,MAAM,SAAS,GAAI,GAA+B,CAAC,UAAU,CAAC;IAE9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAI,GAA+B,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,6BAA6B,CAC3C,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/F,CAAC;IACF,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QACzC,aAAa,EAAE,gBAAgB;QAC/B,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,yBAAyB,CACvC,YAAoB,EACpB,gBAAoC,EACpC,MAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAClG,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CACxE,WAAW,CAAC,MAAM,EAClB,gBAAgB,EAChB,MAAM,EACN;QACC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;KACf,EACD,WAAW,CAAC,kBAAkB,CAC9B,CAAC;IACF,OAAO;QACN,GAAG,WAAW;QACd,iBAAiB;QACjB,kBAAkB,EAAE,WAAW;KAC/B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACtC,KAAa,EACb,OAAe,EACf,gBAAoC,EACpC,MAAmB,EACnB,WAAqB;IAErB,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,GAAG,OAAO,WAAW,OAAO,SAAS,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,uBAAuB,CACvC,GAAG,EACH;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,eAAe;gBAClB,eAAe,EAAE,aAAa;gBAC9B,oBAAoB,EAAE,aAAa;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC1C,EACD,MAAM,EACN,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QAChC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACvC,KAAa,EACb,QAA2B,EAC3B,gBAAoC,EACpC,MAAmB,EACnB,WAAqB;IAErB,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC3F,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC;YAChC,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,WAAoC;IACrE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,iBAAiB;KAC9B,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,gBAAgB,IAAI,YAAY,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjE,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,MAAM,+BAA+B,CACxD,iBAAiB,EACjB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,CAClB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC5C,WAAW,CAAC,MAAM,EAClB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,EAClB;QACC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,IAAI;KAClB,EACD,WAAW,CAAC,kBAAkB,CAC9B,CAAC;IACF,IAAI,eAAe,GAAa,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxE,eAAe,GAAG,MAAM,yBAAyB,CAChD,WAAW,CAAC,MAAM,EAClB,MAAM,CAAC,cAAc,EACrB,gBAAgB,IAAI,SAAS,EAC7B,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,kBAAkB,CAC9B,CAAC;IACH,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,iBAAiB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;QAClF,kBAAkB,EAAE,MAAM,CAAC,WAAW;KACtC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,UAA2B;IAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAC/C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,eAAe,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC5C,IAAI,EAAE,gBAAgB;IACtB,cAAc,EAAE,IAAI;IACpB,qBAAqB,EAAE,sCAAsC;IAC7D,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAC/B,yBAAyB,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE3F,sEAAsE;IACtE,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,uBAAuB,CAC/B,UAAU,CAAC,MAAM,EACjB,uBAAuB,CAAC,UAAU,CAAC,EACnC,UAAU,CAAC,kBAAkB,CAC7B;SACD,CAAC;IACH,CAAC;CACD,CAAC","sourcesContent":["/**\n * GitHub Copilot OAuth flow\n */\n\nimport {\n\tGITHUB_COPILOT_INDIVIDUAL_BASE_URL,\n\tgithubCopilotTokenField,\n\tparseGitHubCopilotApiEndpoint,\n\tresolveGitHubCopilotBaseUrl,\n} from \"../../api/github-copilot-endpoint.ts\";\nimport { GITHUB_COPILOT_REJECTED_TOKEN_STATUSES } from \"../../api/github-copilot-headers.ts\";\nimport { sleep } from \"../../utils/sleep.ts\";\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\nimport { parseGitHubCopilotModelCatalog } from \"./github-copilot-model-catalog.ts\";\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode(\"SXYxLmI1MDdhMDhjODdlY2ZlOTg=\");\n\nconst COPILOT_HEADERS = {\n\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\"Editor-Version\": \"vscode/1.107.0\",\n\t\"Editor-Plugin-Version\": \"copilot-chat/0.35.0\",\n\t\"Copilot-Integration-Id\": \"vscode-chat\",\n} as const;\nconst COPILOT_API_VERSION = \"2026-06-01\";\n\ntype DeviceCodeResponse = {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\tinterval?: number;\n\texpires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n\taccess_token: string;\n\ttoken_type?: string;\n\tscope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n\terror: string;\n\terror_description?: string;\n\tinterval?: number;\n};\n\nfunction normalizeDomain(input: string): string | null {\n\tconst trimmed = input.trim();\n\tif (!trimmed) return null;\n\ttry {\n\t\tconst url = trimmed.includes(\"://\") ? new URL(trimmed) : new URL(`https://${trimmed}`);\n\t\treturn url.hostname;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction getUrls(domain: string): {\n\tdeviceCodeUrl: string;\n\taccessTokenUrl: string;\n\tcopilotTokenUrl: string;\n} {\n\treturn {\n\t\tdeviceCodeUrl: `https://${domain}/login/device/code`,\n\t\taccessTokenUrl: `https://${domain}/login/oauth/access_token`,\n\t\tcopilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n\t};\n}\n\nfunction getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string, apiEndpoint?: unknown): string {\n\treturn resolveGitHubCopilotBaseUrl({ token, enterpriseDomain, apiEndpoint });\n}\n\nasync function fetchWithRateLimitRetry(\n\turl: string,\n\tinit: RequestInit,\n\tsignal: AbortSignal,\n\tretryPolicy: { maxRetries: number; maxElapsedMs: number },\n): Promise<Response> {\n\tconst retryBudgetSignal =\n\t\tretryPolicy.maxRetries > 0 && retryPolicy.maxElapsedMs > 0\n\t\t\t? AbortSignal.timeout(retryPolicy.maxElapsedMs)\n\t\t\t: undefined;\n\tconst requestSignal = retryBudgetSignal ? AbortSignal.any([signal, retryBudgetSignal]) : signal;\n\tconst retryDeadline = retryBudgetSignal ? Date.now() + retryPolicy.maxElapsedMs : undefined;\n\tfor (let retry = 0; ; retry++) {\n\t\tconst response = await fetch(url, {\n\t\t\t...init,\n\t\t\tsignal: AbortSignal.any([requestSignal, AbortSignal.timeout(5000)]),\n\t\t});\n\t\tif (response.status !== 429 || retry === retryPolicy.maxRetries) return response;\n\n\t\tconst retryAfter = response.headers.get(\"retry-after\");\n\t\tlet delayMs = 500 * 2 ** retry;\n\t\tif (retryAfter) {\n\t\t\tconst seconds = Number.parseFloat(retryAfter);\n\t\t\tdelayMs = Number.isNaN(seconds) ? Date.parse(retryAfter) - Date.now() : seconds * 1000;\n\t\t\tif (!Number.isFinite(delayMs)) return response;\n\t\t}\n\t\tdelayMs = Math.max(0, delayMs);\n\t\tif (retryDeadline !== undefined && delayMs >= retryDeadline - Date.now()) return response;\n\t\tawait response.body?.cancel();\n\t\tawait sleep(delayMs, requestSignal);\n\t}\n}\n\nasync function fetchGitHubCopilotModels(\n\tcopilotToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n\tretryPolicy: { maxRetries: number; maxElapsedMs: number },\n\tapiEndpoint?: unknown,\n) {\n\tconst baseUrl = getGitHubCopilotBaseUrl(copilotToken, enterpriseDomain, apiEndpoint);\n\t// Some Individual accounts return false for every picker flag despite explicit enabled policies.\n\t// Limit the fallback to that endpoint so other account types keep strict picker semantics.\n\tconst allowPolicyFallback = baseUrl === GITHUB_COPILOT_INDIVIDUAL_BASE_URL;\n\tconst response = await fetchWithRateLimitRetry(\n\t\t`${baseUrl}/models`,\n\t\t{\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\tAuthorization: `Bearer ${copilotToken}`,\n\t\t\t\t...COPILOT_HEADERS,\n\t\t\t\t\"X-GitHub-Api-Version\": COPILOT_API_VERSION,\n\t\t\t},\n\t\t},\n\t\tsignal,\n\t\tretryPolicy,\n\t);\n\tif (!response.ok) {\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${await response.text()}`);\n\t}\n\treturn parseGitHubCopilotModelCatalog(await response.json(), allowPolicyFallback);\n}\n\nasync function fetchJson(url: string, init: RequestInit): Promise<unknown> {\n\tconst response = await fetch(url, init);\n\tif (!response.ok) {\n\t\tconst text = await response.text();\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${text}`);\n\t}\n\treturn response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal: AbortSignal): Promise<DeviceCodeResponse> {\n\tconst urls = getUrls(domain);\n\tconst data = await fetchJson(urls.deviceCodeUrl, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\t},\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: CLIENT_ID,\n\t\t\tscope: \"read:user\",\n\t\t}),\n\t\tsignal,\n\t});\n\n\tif (!data || typeof data !== \"object\") {\n\t\tthrow new Error(\"Invalid device code response\");\n\t}\n\n\tconst deviceCode = (data as Record<string, unknown>).device_code;\n\tconst userCode = (data as Record<string, unknown>).user_code;\n\tconst verificationUri = (data as Record<string, unknown>).verification_uri;\n\tconst interval = (data as Record<string, unknown>).interval;\n\tconst expiresIn = (data as Record<string, unknown>).expires_in;\n\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\t(interval !== undefined && typeof interval !== \"number\") ||\n\t\ttypeof expiresIn !== \"number\"\n\t) {\n\t\tthrow new Error(\"Invalid device code response fields\");\n\t}\n\n\t// The verification URI is opened in the user's browser and to prevent `open` from\n\t// opening an executable or similar, we force it to be a URL.\n\tlet parsedUri: URL;\n\ttry {\n\t\tparsedUri = new URL(verificationUri);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\tif (parsedUri.protocol !== \"https:\" && parsedUri.protocol !== \"http:\") {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\n\treturn {\n\t\tdevice_code: deviceCode,\n\t\tuser_code: userCode,\n\t\tverification_uri: parsedUri.href,\n\t\tinterval,\n\t\texpires_in: expiresIn,\n\t};\n}\n\nasync function pollForGitHubAccessToken(\n\tdomain: string,\n\tdevice: DeviceCodeResponse,\n\tsignal: AbortSignal,\n): Promise<string> {\n\tconst urls = getUrls(domain);\n\treturn pollOAuthDeviceCodeFlow<string>({\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst raw = await fetchJson(urls.accessTokenUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\t\"User-Agent\": \"GitHubCopilotChat/0.35.0\",\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tdevice_code: device.device_code,\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t}),\n\t\t\t\tsignal,\n\t\t\t});\n\n\t\t\tif (raw && typeof raw === \"object\" && typeof (raw as DeviceTokenSuccessResponse).access_token === \"string\") {\n\t\t\t\treturn { status: \"complete\", value: (raw as DeviceTokenSuccessResponse).access_token };\n\t\t\t}\n\n\t\t\tif (raw && typeof raw === \"object\" && typeof (raw as DeviceTokenErrorResponse).error === \"string\") {\n\t\t\t\tconst { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n\t\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\t\treturn { status: \"pending\" };\n\t\t\t\t}\n\n\t\t\t\tif (error === \"slow_down\") {\n\t\t\t\t\treturn { status: \"slow_down\", intervalSeconds: typeof interval === \"number\" ? interval : undefined };\n\t\t\t\t}\n\n\t\t\t\tconst descriptionSuffix = description ? `: ${description}` : \"\";\n\t\t\t\treturn { status: \"failed\", message: `Device flow failed: ${error}${descriptionSuffix}` };\n\t\t\t}\n\n\t\t\treturn { status: \"failed\", message: \"Invalid device token response\" };\n\t\t},\n\t});\n}\n\nasync function refreshGitHubCopilotAccessToken(\n\trefreshToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tconst domain = enterpriseDomain || \"github.com\";\n\tconst urls = getUrls(domain);\n\n\tconst raw = await fetchJson(urls.copilotTokenUrl, {\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t\tAuthorization: `Bearer ${refreshToken}`,\n\t\t\t...COPILOT_HEADERS,\n\t\t},\n\t\tsignal,\n\t});\n\n\tif (!raw || typeof raw !== \"object\") {\n\t\tthrow new Error(\"Invalid Copilot token response\");\n\t}\n\n\tconst token = (raw as Record<string, unknown>).token;\n\tconst expiresAt = (raw as Record<string, unknown>).expires_at;\n\n\tif (typeof token !== \"string\" || typeof expiresAt !== \"number\") {\n\t\tthrow new Error(\"Invalid Copilot token response fields\");\n\t}\n\n\tconst endpoints = (raw as Record<string, unknown>).endpoints;\n\tconst apiUrl = parseGitHubCopilotApiEndpoint(\n\t\ttypeof endpoints === \"object\" && endpoints !== null ? Reflect.get(endpoints, \"api\") : undefined,\n\t);\n\tconst tid = githubCopilotTokenField(token, \"tid\");\n\treturn {\n\t\ttype: \"oauth\",\n\t\trefresh: refreshToken,\n\t\taccess: token,\n\t\texpires: expiresAt * 1000 - 5 * 60 * 1000,\n\t\tenterpriseUrl: enterpriseDomain,\n\t\t...(apiUrl !== undefined && tid !== undefined ? { copilotApiEndpoint: { tid, url: apiUrl } } : {}),\n\t};\n}\n\n/**\n * Refresh GitHub Copilot token\n */\nasync function refreshGitHubCopilotToken(\n\trefreshToken: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tconst credentials = await refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, signal);\n\tconst { availableModelIds, modelLimits } = await fetchGitHubCopilotModels(\n\t\tcredentials.access,\n\t\tenterpriseDomain,\n\t\tsignal,\n\t\t{\n\t\t\tmaxRetries: 0,\n\t\t\tmaxElapsedMs: 0,\n\t\t},\n\t\tcredentials.copilotApiEndpoint,\n\t);\n\treturn {\n\t\t...credentials,\n\t\tavailableModelIds,\n\t\tcopilotModelLimits: modelLimits,\n\t};\n}\n\n/**\n * Enable a model for the user's GitHub Copilot account.\n * This is required for some models (like Claude, Grok) before they can be used.\n */\nasync function enableGitHubCopilotModel(\n\ttoken: string,\n\tmodelId: string,\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n\tapiEndpoint?: unknown,\n): Promise<boolean> {\n\tconst baseUrl = getGitHubCopilotBaseUrl(token, enterpriseDomain, apiEndpoint);\n\tconst url = `${baseUrl}/models/${modelId}/policy`;\n\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetchWithRateLimitRetry(\n\t\t\turl,\n\t\t\t{\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\t...COPILOT_HEADERS,\n\t\t\t\t\t\"openai-intent\": \"chat-policy\",\n\t\t\t\t\t\"x-interaction-type\": \"chat-policy\",\n\t\t\t\t},\n\t\t\t\tbody: JSON.stringify({ state: \"enabled\" }),\n\t\t\t},\n\t\t\tsignal,\n\t\t\t{ maxRetries: 2, maxElapsedMs: 5000 },\n\t\t);\n\t} catch (error) {\n\t\tif (signal.aborted) throw error;\n\t\treturn false;\n\t}\n\tif (response.status === 429) {\n\t\tthrow new Error(`${response.status} ${response.statusText}: ${await response.text()}`);\n\t}\n\treturn response.ok;\n}\n\n/**\n * Enable the requested GitHub Copilot models and return the successful IDs.\n * Policy updates are best effort; exhausted rate limiting stops the batch.\n */\nasync function enableGitHubCopilotModels(\n\ttoken: string,\n\tmodelIds: readonly string[],\n\tenterpriseDomain: string | undefined,\n\tsignal: AbortSignal,\n\tapiEndpoint?: unknown,\n): Promise<string[]> {\n\tconst enabledModelIds: string[] = [];\n\tfor (const modelId of modelIds) {\n\t\ttry {\n\t\t\tif (await enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal, apiEndpoint)) {\n\t\t\t\tenabledModelIds.push(modelId);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (signal.aborted) throw error;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn enabledModelIds;\n}\n\nasync function loginGitHubCopilot(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst input = await interaction.prompt({\n\t\ttype: \"text\",\n\t\tmessage: \"GitHub Enterprise URL/domain (blank for github.com)\",\n\t\tplaceholder: \"company.ghe.com\",\n\t});\n\tif (interaction.signal.aborted) throw new Error(\"Login cancelled\");\n\n\tconst trimmed = input.trim();\n\tconst enterpriseDomain = normalizeDomain(input);\n\tif (trimmed && !enterpriseDomain) throw new Error(\"Invalid GitHub Enterprise URL/domain\");\n\tconst domain = enterpriseDomain || \"github.com\";\n\n\tconst device = await startDeviceFlow(domain, interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.user_code,\n\t\tverificationUri: device.verification_uri,\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t});\n\n\tconst githubAccessToken = await pollForGitHubAccessToken(domain, device, interaction.signal);\n\tconst credentials = await refreshGitHubCopilotAccessToken(\n\t\tgithubAccessToken,\n\t\tenterpriseDomain ?? undefined,\n\t\tinteraction.signal,\n\t);\n\tconst models = await fetchGitHubCopilotModels(\n\t\tcredentials.access,\n\t\tenterpriseDomain ?? undefined,\n\t\tinteraction.signal,\n\t\t{\n\t\t\tmaxRetries: 2,\n\t\t\tmaxElapsedMs: 5000,\n\t\t},\n\t\tcredentials.copilotApiEndpoint,\n\t);\n\tlet enabledModelIds: string[] = [];\n\tif (models.policyModelIds.length > 0) {\n\t\tinteraction.notify({ type: \"progress\", message: \"Enabling models...\" });\n\t\tenabledModelIds = await enableGitHubCopilotModels(\n\t\t\tcredentials.access,\n\t\t\tmodels.policyModelIds,\n\t\t\tenterpriseDomain ?? undefined,\n\t\t\tinteraction.signal,\n\t\t\tcredentials.copilotApiEndpoint,\n\t\t);\n\t}\n\treturn {\n\t\t...credentials,\n\t\tavailableModelIds: [...new Set([...models.availableModelIds, ...enabledModelIds])],\n\t\tcopilotModelLimits: models.modelLimits,\n\t};\n}\n\nfunction copilotEnterpriseDomain(credential: OAuthCredential): string | undefined {\n\tconst enterpriseUrl = credential.enterpriseUrl;\n\tif (typeof enterpriseUrl !== \"string\" || !enterpriseUrl) return undefined;\n\treturn normalizeDomain(enterpriseUrl) ?? undefined;\n}\n\nexport const githubCopilotOAuth: OAuthAuth = {\n\tname: \"GitHub Copilot\",\n\tisSubscription: true,\n\trejectedTokenStatuses: GITHUB_COPILOT_REJECTED_TOKEN_STATUSES,\n\tlogin: loginGitHubCopilot,\n\trefresh: (credential, signal) =>\n\t\trefreshGitHubCopilotToken(credential.refresh, copilotEnterpriseDomain(credential), signal),\n\n\t/** Derive the credential-specific proxy endpoint for each request. */\n\tasync toAuth(credential) {\n\t\treturn {\n\t\t\tapiKey: credential.access,\n\t\t\tbaseUrl: getGitHubCopilotBaseUrl(\n\t\t\t\tcredential.access,\n\t\t\t\tcopilotEnterpriseDomain(credential),\n\t\t\t\tcredential.copilotApiEndpoint,\n\t\t\t),\n\t\t};\n\t},\n};\n"]}

package/dist/auth/pool/slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAqBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAW1G;AAgDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AASD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}
+{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAqBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAW1G;AAkED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AASD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}

package/dist/auth/pool/slots.js

@@ -263,13 +263,31 @@ function providedSlots(credential) {
  * `current` wins for every name it already holds: the provider built its
  * object from a snapshot taken BEFORE the interactive browser round trip, so a
  * sibling account that rotated its refresh token or earned a rate-limit block
- * during that window must not be rewound to the snapshot. Only names that do
- * not exist yet are appended.
+ * during that window must not be rewound to the snapshot. Names that do not
+ * exist yet are appended.
+ *
+ * The one exception is a same-name slot whose `expires` is strictly newer than
+ * the stored slot's: that is this login refreshing an existing account in place
+ * (re-login recovery of an auth-blocked slot), so it replaces the stored copy
+ * together with any block fields it carried. A snapshot sibling is never newer
+ * than what concurrent writers stored, so it still loses.
  */
 function mergeProvidedPool(current, existing, provided) {
+    const providedByName = new Map(provided.map((slot) => [slot.name, slot]));
+    let refreshed = false;
+    const merged = existing.map((slot) => {
+        const candidate = providedByName.get(slot.name);
+        if (!candidate || !hasNewerMaterial(candidate, slot))
+            return slot;
+        refreshed = true;
+        return candidate;
+    });
     const known = new Set(existing.map((slot) => slot.name));
     const added = provided.filter((slot) => !known.has(slot.name));
-    return added.length === 0 ? current : { ...current, accounts: [...existing, ...added] };
+    return added.length === 0 && !refreshed ? current : { ...current, accounts: [...merged, ...added] };
+}
+function hasNewerMaterial(candidate, stored) {
+    return candidate.expires !== undefined && (stored.expires === undefined || candidate.expires > stored.expires);
 }
 /**
  * Appends an unnamed flat credential to a pool as a generated `login-N` slot.

package/dist/auth/pool/slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"slots.js","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAMnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAuB3C,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,yBAAyB,IAAI,qEAAqE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,wDAAwD,CAAC;AACzF,qFAAqF;AACrF,MAAM,2BAA2B,GAAG,sDAAsD,CAAC;AAC3F,MAAM,sBAAsB,GAC3B,4OAA4O,CAAC;AAE9O;;;GAGG;AACH,MAAM,mBAAmB,GAA2B;IACnD,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;CACb,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;AAExF,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrD,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SACrE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;SAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACnC,4EAA4E;IAC5E,iFAAiF;IACjF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,kBAAkB,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA+C;IAC3E,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC;AACtF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACpC,UAA4B,EAC5B,IAAY,EACZ,KAAoB;IAEpB,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACd,0BAA0B,wBAAwB,6EAA6E,CAC/H,CAAC;IACH,CAAC;IACD,IACC,WAAW,KAAK,SAAS;QACzB,QAAQ,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACR,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,cAAc,CAAC,WAAW,CAAC,CAC3F,EACA,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACN,GAAG,UAAU;QACb,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;YACzD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QAC9E,CAAC,CAAC;KACF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAA4B;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAsB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA4B;IAC3D,OAAO,2BAA2B,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAwC;IACjE,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAwC,EAAE,IAAY;IAC9E,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAAwC,EAAE,IAAoB;IACxF,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GACT,UAAU;QACV,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YACvG,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,QAAQ,GACb,KAAK,IAAI,CAAC;QACT,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,UAA4B,EAAE,IAAoB;IAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC;IACjH,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC;AACpC,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,UAA4B,EAAE,IAAoB;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAC7G,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,UAAwC,EAAE,IAAY;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,WAAW,GAChB,OAAO,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAqB,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,UAA4B,EAAE,IAAY;IACjE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAwC,EAAE,IAAY;IACjF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5G,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAsB,EAAE,IAAY;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACN,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,GAAG,iBAAiB,CAAC,UAAU,CAAC;SAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA4B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,SAAS,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,UAAsB;IAC5C,MAAM,QAAQ,GAAI,UAA+B,CAAC,QAAQ,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACzB,OAAyB,EACzB,QAAmC,EACnC,QAAmC;IAEnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC9B,OAAqC,EACrC,IAAgB,EAChB,WAAsE;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACd,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7G,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9F,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ;YAAE,WAAW,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,QAAQ,EAAE,CAAC;QACd,2EAA2E;QAC3E,kEAAkE;QAClE,OAAO,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACzD,OAAO,GAAG,UAAU,UAAU,CAAC;AAChC,CAAC;AAED,MAAM,yBAAyB,GAAgC,IAAI,GAAG,CACrE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;IACpE,WAAW;IACX,uBAAuB,CAAC,QAAQ,CAAC;CACjC,CAAC,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IAC1D,MAAM,SAAS,GAAG,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,IAAoB;IAC7E,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB,EAAE,UAAsB;IACpF,MAAM,MAAM,GAAG,UAA8B,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAqB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACjH,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,IAAY,EAAE,SAAqB;IAChG,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IAC3F,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,SAAqB;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG;QACf,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM;QACtB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpB,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { LEGACY_PROVIDER_IDS } from \"../../legacy-provider-ids.ts\";\nimport type { ProviderEnv } from \"../../types.ts\";\nimport type { Credential } from \"../types.ts\";\n\nexport type { Credential };\n\nexport const DEFAULT_SLOT_NAME = \"default\";\n\nexport type CredentialSlotSource = \"login\" | \"import\" | \"env\";\n\nexport type CredentialSlot = {\n\t/** Immutable operational identity. */\n\tname: string;\n\t/** Optional presentation metadata; never used for credential selection. */\n\tdisplayName?: string;\n\tsource?: CredentialSlotSource;\n\tkey?: string;\n\taccess?: string;\n\trefresh?: string;\n\texpires?: number;\n\t/** Provider-scoped values this account carries (a Kimi region, a Cloudflare account id). */\n\tenv?: ProviderEnv;\n};\n\nexport type PooledCredential = Credential & {\n\taccounts?: CredentialSlot[];\n\tpinned?: string;\n};\n\nconst SLOT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;\n\nexport function assertValidSlotName(name: string): void {\n\tif (!SLOT_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(\n\t\t\t`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`,\n\t\t);\n\t}\n}\n\nconst UNSAFE_DISPLAY_CHARACTERS = /[\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}]/u;\n\n/**\n * Labels are bounded in terminal columns, not UTF-16 code units: 80 code units\n * of CJK render ~170 columns, which no footer segment can hold, while 41 emoji\n * render 82 columns yet count 82 code units. The bound is what the footer's\n * parenthesised provider segment can carry alongside a provider id.\n */\nexport const DISPLAY_NAME_MAX_COLUMNS = 32;\n\n/** Code points that advance a cell without painting anything a user can see. */\nconst BLANK_DISPLAY_CHARACTER = /^[\\s\\p{M}\\u115f\\u1160\\u17b4\\u17b5\\u2800\\u3164\\uffa0]$/u;\n/** Invisible code points that are not whitespace, so trimming never removes them. */\nconst INVISIBLE_DISPLAY_CHARACTER = /^[\\p{M}\\u115f\\u1160\\u17b4\\u17b5\\u2800\\u3164\\uffa0]$/u;\nconst WIDE_DISPLAY_CHARACTER =\n\t/^(?:[\\u1100-\\u115f\\u2329\\u232a\\u2e80-\\u303e\\u3041-\\u33ff\\u3400-\\u4dbf\\u4e00-\\u9fff\\ua000-\\ua4cf\\ua960-\\ua97f\\uac00-\\ud7a3\\uf900-\\ufaff\\ufe10-\\ufe19\\ufe30-\\ufe6f\\uff00-\\uff60\\uffe0-\\uffe6]|[\\u{1f300}-\\u{1faff}]|[\\u{20000}-\\u{3fffd}])$/u;\n\n/**\n * Latin lookalikes for the Cyrillic letters a homoglyph label would use. Folded\n * only for the uniqueness comparison; the stored label keeps the user's script.\n */\nconst CYRILLIC_LOOKALIKES: Record<string, string> = {\n\t\"\\u0430\": \"a\",\n\t\"\\u0432\": \"b\",\n\t\"\\u0435\": \"e\",\n\t\"\\u043a\": \"k\",\n\t\"\\u043c\": \"m\",\n\t\"\\u043d\": \"h\",\n\t\"\\u043e\": \"o\",\n\t\"\\u0440\": \"p\",\n\t\"\\u0441\": \"c\",\n\t\"\\u0442\": \"t\",\n\t\"\\u0443\": \"y\",\n\t\"\\u0445\": \"x\",\n\t\"\\u0455\": \"s\",\n\t\"\\u0456\": \"i\",\n\t\"\\u0458\": \"j\",\n};\n\nconst displayNameGraphemes = new Intl.Segmenter(undefined, { granularity: \"grapheme\" });\n\n/** Terminal columns a label occupies, measured per grapheme cluster. */\nexport function displayNameColumns(value: string): number {\n\tlet columns = 0;\n\tfor (const { segment } of displayNameGraphemes.segment(value)) {\n\t\tconst codePoint = segment.codePointAt(0);\n\t\tif (codePoint === undefined) continue;\n\t\tconst base = String.fromCodePoint(codePoint);\n\t\tif (INVISIBLE_DISPLAY_CHARACTER.test(base)) continue;\n\t\tcolumns += WIDE_DISPLAY_CHARACTER.test(base) || segment.includes(\"\\ufe0f\") ? 2 : 1;\n\t}\n\treturn columns;\n}\n\n/** The stored form: NFC, trimmed, internal whitespace runs collapsed to one space. */\nfunction normalizeDisplayName(value: string): string {\n\treturn value.normalize(\"NFC\").trim().replace(/\\s+/gu, \" \");\n}\n\n/**\n * Comparison key for \"unique per provider\": compatibility-folded (fullwidth and\n * other compatibility forms), case-folded, invisible code points dropped, and\n * Cyrillic lookalikes mapped to Latin, so two labels that render identically\n * cannot both be stored.\n */\nfunction displayNameKey(value: string): string {\n\treturn [...normalizeDisplayName(value).normalize(\"NFKC\").toLowerCase()]\n\t\t.filter((character) => !INVISIBLE_DISPLAY_CHARACTER.test(character))\n\t\t.map((character) => CYRILLIC_LOOKALIKES[character] ?? character)\n\t\t.join(\"\");\n}\n\n/** Treat persisted metadata as untrusted presentation input. */\nexport function accountDisplayName(value: unknown): string | undefined {\n\tif (typeof value !== \"string\" || UNSAFE_DISPLAY_CHARACTERS.test(value)) return undefined;\n\tconst normalized = normalizeDisplayName(value);\n\tconst characters = [...normalized];\n\t// A leading combining mark glues the label onto whatever precedes it, and a\n\t// label made only of blank-rendering code points is indistinguishable from none.\n\tif (characters.length === 0 || /^\\p{M}$/u.test(characters[0])) return undefined;\n\tif (characters.every((character) => BLANK_DISPLAY_CHARACTER.test(character))) return undefined;\n\treturn displayNameColumns(normalized) <= DISPLAY_NAME_MAX_COLUMNS ? normalized : undefined;\n}\n\nexport function accountLabel(account: { name: string; displayName?: string }): string {\n\tconst displayName = accountDisplayName(account.displayName);\n\treturn displayName === undefined ? account.name : `${displayName} (${account.name})`;\n}\n\n/** Pure metadata update; callers serialize this against the latest stored credential. */\nexport function renameSlotDisplayName(\n\tcredential: PooledCredential,\n\tname: string,\n\tvalue: string | null,\n): PooledCredential {\n\tassertValidSlotName(name);\n\tconst accounts = Array.isArray(credential.accounts) ? credential.accounts : listSlots(credential);\n\tconst target = accounts.find((slot) => slot.name === name);\n\tif (!target) throw new Error(`Stored provider account not found: ${name}`);\n\tif (target.source === \"env\") throw new Error(`Environment provider account cannot be renamed: ${name}`);\n\tconst displayName = value === null ? undefined : accountDisplayName(value);\n\tif (value !== null && displayName === undefined) {\n\t\tthrow new Error(\n\t\t\t`Display name must be 1-${DISPLAY_NAME_MAX_COLUMNS} terminal columns of visible text without control or formatting characters.`,\n\t\t);\n\t}\n\tif (\n\t\tdisplayName !== undefined &&\n\t\taccounts.some(\n\t\t\t(slot) =>\n\t\t\t\tslot.name !== name &&\n\t\t\t\tdisplayNameKey(accountDisplayName(slot.displayName) ?? \"\") === displayNameKey(displayName),\n\t\t)\n\t) {\n\t\tthrow new Error(\"Display name is already used by another account for this provider.\");\n\t}\n\treturn {\n\t\t...credential,\n\t\taccounts: accounts.map((slot) => {\n\t\t\tif (slot.name !== name) return slot;\n\t\t\tconst { displayName: _displayName, ...unchanged } = slot;\n\t\t\treturn displayName === undefined ? unchanged : { ...unchanged, displayName };\n\t\t}),\n\t};\n}\n\nfunction storedSlots(credential: PooledCredential): CredentialSlot[] {\n\treturn Array.isArray(credential.accounts) ? credential.accounts : [];\n}\n\nfunction credentialSlotEnv(credential: Credential): { env: ProviderEnv } | Record<string, never> {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return {};\n\tconst env: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry !== \"string\") return {};\n\t\tenv[name] = entry;\n\t}\n\treturn { env };\n}\n\nfunction slotFromFlatCredential(credential: PooledCredential): CredentialSlot {\n\treturn slotFromFlatCredentialNamed(credential, DEFAULT_SLOT_NAME);\n}\n\n/**\n * A flat credential written by a build predating pools is read as a one-slot pool\n * without writing anything back; the caller decides whether a write ever happens.\n */\nexport function listSlots(credential: PooledCredential | undefined): CredentialSlot[] {\n\tif (!credential) return [];\n\tconst slots = storedSlots(credential);\n\treturn slots.length > 0 ? [...slots] : [slotFromFlatCredential(credential)];\n}\n\nexport function findSlot(credential: PooledCredential | undefined, name: string): CredentialSlot | undefined {\n\treturn listSlots(credential).find((slot) => slot.name === name);\n}\n\n/**\n * Replaces or appends one slot while every sibling, the pin, and the flat\n * top-level credential survive untouched. The flat fields stay as written so a\n * build that ignores `accounts` still authenticates from them.\n */\nexport function upsertSlot(credential: PooledCredential | undefined, slot: CredentialSlot): PooledCredential {\n\tassertValidSlotName(slot.name);\n\tconst base: PooledCredential =\n\t\tcredential ??\n\t\t(slot.access !== undefined || slot.refresh !== undefined\n\t\t\t? { type: \"oauth\", access: slot.access ?? \"\", refresh: slot.refresh ?? \"\", expires: slot.expires ?? 0 }\n\t\t\t: { type: \"api_key\", key: slot.key });\n\tconst existing = listSlots(base);\n\tconst index = existing.findIndex((candidate) => candidate.name === slot.name);\n\tconst accounts =\n\t\tindex >= 0\n\t\t\t? existing.map((candidate) => (candidate.name === slot.name ? { ...candidate, ...slot } : candidate))\n\t\t\t: [...existing, slot];\n\treturn { ...base, accounts };\n}\n\n/** Whether the flat top-level fields are this slot's material rather than a sibling's. */\nfunction slotMirrorsFlat(credential: PooledCredential, slot: CredentialSlot): boolean {\n\tif (credential.type === \"oauth\") return slot.access === credential.access || slot.refresh === credential.refresh;\n\treturn slot.key === credential.key;\n}\n\n/** Rewrites the flat top-level projection to carry the given slot's material. */\nfunction projectFlatFields(credential: PooledCredential, slot: CredentialSlot): PooledCredential {\n\tconst env = slot.env === undefined ? {} : { env: slot.env };\n\tif (credential.type === \"oauth\") {\n\t\tif (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined) return credential;\n\t\treturn { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };\n\t}\n\treturn { ...credential, key: slot.key, ...env };\n}\n\n/**\n * Removes one slot. The credential is dropped entirely once its last slot is gone,\n * and a pin naming the removed slot is cleared so selection never points at a slot\n * that no longer exists.\n *\n * When the removed slot was the one the flat top-level fields projected, those\n * fields are re-projected from the first survivor. Without that the pool keeps\n * authenticating with the deleted account's material: a credential with a single\n * remaining slot does not enter the rotation path, so ordinary requests resolve\n * the flat projection and would keep using exactly the account the user removed.\n * `accounts` is preserved either way, so the entry stays a pool.\n */\nexport function removeSlot(credential: PooledCredential | undefined, name: string): PooledCredential | undefined {\n\tif (!credential) return undefined;\n\tconst existing = listSlots(credential);\n\tconst removed = existing.find((slot) => slot.name === name);\n\tconst accounts = existing.filter((slot) => slot.name !== name);\n\tif (accounts.length === 0) return undefined;\n\tconst reprojected =\n\t\tremoved && slotMirrorsFlat(credential, removed) ? projectFlatFields(credential, accounts[0]) : credential;\n\tconst next: PooledCredential = { ...reprojected, accounts };\n\tif (next.pinned === name) delete next.pinned;\n\treturn next;\n}\n\nexport function pinSlot(credential: PooledCredential, name: string): PooledCredential {\n\tassertValidSlotName(name);\n\treturn { ...credential, pinned: name };\n}\n\n/**\n * Projects one named slot onto the flat credential shape for request-scoped\n * resolution; pool bookkeeping fields are stripped so provider handlers see a\n * plain credential and never write pool state back through the projection.\n */\nexport function projectSlot(credential: PooledCredential | undefined, name: string): Credential | undefined {\n\tif (!credential) return undefined;\n\tconst slot = findSlot(credential, name);\n\tif (!slot) return undefined;\n\tconst { accounts: _accounts, pinned: _pinned, ...flat } = credential;\n\tconst env = slot.env === undefined ? {} : { env: slot.env };\n\tif (flat.type === \"oauth\") {\n\t\tif (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined) return undefined;\n\t\treturn { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };\n\t}\n\treturn { ...flat, key: slot.key, ...env };\n}\n\nfunction slotFromFlatCredentialNamed(credential: Credential, name: string): CredentialSlot {\n\tif (credential.type === \"oauth\") {\n\t\treturn {\n\t\t\tname,\n\t\t\tsource: \"login\",\n\t\t\taccess: credential.access,\n\t\t\trefresh: credential.refresh,\n\t\t\texpires: credential.expires,\n\t\t\t...credentialSlotEnv(credential),\n\t\t};\n\t}\n\treturn { name, source: \"login\", key: credential.key, ...credentialSlotEnv(credential) };\n}\n\nfunction nextLoginSlotName(credential: PooledCredential): string {\n\tconst taken = new Set(listSlots(credential).map((slot) => slot.name));\n\tfor (let index = 2; index < 1000; index++) {\n\t\tconst candidate = `login-${index}`;\n\t\tif (!taken.has(candidate)) return candidate;\n\t}\n\tthrow new Error(\"Credential pool is full\");\n}\n\nfunction providedSlots(credential: Credential): CredentialSlot[] | undefined {\n\tconst accounts = (credential as PooledCredential).accounts;\n\treturn Array.isArray(accounts) && accounts.length > 0 ? accounts : undefined;\n}\n\n/**\n * Unions a provider-owned pool onto the value read under the credential lock.\n * `current` wins for every name it already holds: the provider built its\n * object from a snapshot taken BEFORE the interactive browser round trip, so a\n * sibling account that rotated its refresh token or earned a rate-limit block\n * during that window must not be rewound to the snapshot. Only names that do\n * not exist yet are appended.\n */\nfunction mergeProvidedPool(\n\tcurrent: PooledCredential,\n\texisting: readonly CredentialSlot[],\n\tprovided: readonly CredentialSlot[],\n): PooledCredential {\n\tconst known = new Set(existing.map((slot) => slot.name));\n\tconst added = provided.filter((slot) => !known.has(slot.name));\n\treturn added.length === 0 ? current : { ...current, accounts: [...existing, ...added] };\n}\n\n/**\n * Appends an unnamed flat credential to a pool as a generated `login-N` slot.\n * An absent current entry keeps today's whole-write shape; a flat current entry\n * is promoted to a pool so the legacy credential stays reachable as `default`\n * instead of being overwritten by the second login.\n *\n * A login result that already carries its own populated `accounts` array is a\n * provider-owned pool, and a provider that already holds a POOL names the\n * account this login created itself. That pool is MERGED onto `current` rather\n * than written through: a pre-browser-flow snapshot must never overwrite what\n * concurrent writers stored meanwhile. A flat `current` keeps the whole-write\n * shape - the provider echoes the flat fields it read, so there is nothing to\n * preserve and the login must not be dropped on a name collision.\n *\n * `onAllocated` reports the account this login committed, so a caller can name\n * it in a receipt without re-reading storage.\n */\nexport function appendLoginSlot(\n\tcurrent: PooledCredential | undefined,\n\tflat: Credential,\n\tonAllocated?: (name: string, origin: \"generated\" | \"provider\") => void,\n): Credential {\n\tconst provided = providedSlots(flat);\n\tif (provided) {\n\t\t// Provider-owned envelopes identify an addition by immutable ID, never by\n\t\t// token equality or array position. Ambiguous envelopes have no receipt.\n\t\tconst previous = new Set(\n\t\t\t(current && Array.isArray(current.accounts) ? current.accounts : listSlots(current)).map((slot) => slot.name),\n\t\t);\n\t\tconst added = provided.filter((slot) => !previous.has(slot.name));\n\t\tif (added.length === 1 && SLOT_NAME_PATTERN.test(added[0].name) && added[0].source !== \"env\") {\n\t\t\tonAllocated?.(added[0].name, \"provider\");\n\t\t}\n\t}\n\tif (!current) {\n\t\tif (!provided) onAllocated?.(DEFAULT_SLOT_NAME, \"generated\");\n\t\treturn flat;\n\t}\n\tconst storedAccounts = Array.isArray(current.accounts) ? current.accounts : undefined;\n\tif (provided) {\n\t\t// A pool merges onto the stored pool; a flat current keeps the whole-write\n\t\t// shape because the provider's accounts already carry this login.\n\t\treturn storedAccounts ? mergeProvidedPool(current, storedAccounts, provided) : flat;\n\t}\n\tconst name = nextLoginSlotName(current);\n\tconst next = upsertSlot(current, slotFromFlatCredentialNamed(flat, name));\n\tonAllocated?.(name, \"generated\");\n\treturn next;\n}\n\n/**\n * Material a provider writes into the flat credential when the real token lives\n * outside auth.json (an SDK subprocess or a vendor CLI owns it): the literal\n * `<providerId>-managed` in both OAuth fields. It is a marker, never a token.\n */\nexport function managedSentinelMaterial(providerId: string): string {\n\treturn `${providerId}-managed`;\n}\n\nconst LEGACY_SENTINEL_MATERIALS: ReadonlyMap<string, string> = new Map(\n\tObject.entries(LEGACY_PROVIDER_IDS).map(([legacyId, canonicalId]) => [\n\t\tcanonicalId,\n\t\tmanagedSentinelMaterial(legacyId),\n\t]),\n);\n\n/**\n * Every sentinel material a stored credential may legitimately carry for this\n * provider: the canonical `<providerId>-managed` plus the legacy material of\n * any renamed ancestor id, because credentials written before a rename keep\n * the old literal verbatim.\n */\nexport function managedSentinelMaterials(providerId: string): string[] {\n\tconst materials = [managedSentinelMaterial(providerId)];\n\tconst legacy = LEGACY_SENTINEL_MATERIALS.get(providerId);\n\tif (legacy !== undefined && !materials.includes(legacy)) materials.push(legacy);\n\treturn materials;\n}\n\n/**\n * A POOL SLOT carrying that marker can never authenticate: `projectSlot` hands\n * it to the provider's `check`, which rejects it, and the request dies with\n * \"Provider is not configured\". Slots like that exist only because a shipped\n * build appended a provider-owned pool's flat sentinel as a generated `login-N`\n * slot.\n */\nexport function isManagedSentinelSlot(providerId: string, slot: CredentialSlot): boolean {\n\tconst materials = managedSentinelMaterials(providerId);\n\treturn materials.includes(slot.access ?? \"\") && slot.refresh === slot.access;\n}\n\n/**\n * Drops those poisoned slots from a stored credential, clearing a pin that\n * named one. Returns `undefined` when the credential holds none, so a caller\n * can tell a repair from a no-op and only rewrite storage when the bytes\n * actually change.\n */\nexport function repairManagedSentinelSlots(providerId: string, credential: Credential): PooledCredential | undefined {\n\tconst pooled = credential as PooledCredential;\n\tif (!Array.isArray(pooled.accounts)) return undefined;\n\tconst kept = pooled.accounts.filter((slot) => !isManagedSentinelSlot(providerId, slot));\n\tif (kept.length === pooled.accounts.length) return undefined;\n\tconst repaired: PooledCredential = { ...pooled, accounts: kept };\n\tif (repaired.pinned !== undefined && !kept.some((slot) => slot.name === repaired.pinned)) delete repaired.pinned;\n\treturn repaired;\n}\n\n/**\n * Merges a rotated OAuth credential back into the pool: the slot whose material\n * matches the pre-refresh flat fields is updated in place together with those\n * flat fields, while every sibling and the pin survive byte-identical. A flat\n * current entry keeps today's whole-write shape.\n */\n/**\n * Merges a rotated OAuth credential into the NAMED slot. The flat top-level\n * projection rotates only when it mirrored that slot's previous material, so\n * refreshing a secondary slot never disturbs what an older binary reads.\n */\nexport function mergeRefreshedSlot(current: PooledCredential, name: string, refreshed: Credential): Credential {\n\tif (refreshed.type !== \"oauth\" || current.type !== \"oauth\") return current;\n\tif (!Array.isArray(current.accounts) || current.accounts.length === 0) return mergeRefreshed(current, refreshed);\n\tconst target = current.accounts.find((slot) => slot.name === name);\n\tif (!target) return current;\n\tconst rotated = { access: refreshed.access, refresh: refreshed.refresh, expires: refreshed.expires };\n\tconst accounts = current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot));\n\tconst mirrorsFlat = target.access === current.access || target.refresh === current.refresh;\n\treturn mirrorsFlat ? { ...current, ...rotated, accounts } : { ...current, accounts };\n}\n\nexport function mergeRefreshed(current: PooledCredential, refreshed: Credential): Credential {\n\tif (!Array.isArray(current.accounts) || current.accounts.length === 0) {\n\t\treturn refreshed;\n\t}\n\tif (refreshed.type !== \"oauth\" || current.type !== \"oauth\") return refreshed;\n\tconst target = current.accounts.find((slot) => slot.access === current.access || slot.refresh === current.refresh);\n\tconst rotated = {\n\t\taccess: refreshed.access,\n\t\trefresh: refreshed.refresh,\n\t\texpires: refreshed.expires,\n\t};\n\tconst accounts = target\n\t\t? current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot))\n\t\t: current.accounts;\n\treturn { ...current, ...rotated, accounts };\n}\n"]}
+{"version":3,"file":"slots.js","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAMnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAuB3C,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,yBAAyB,IAAI,qEAAqE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,wDAAwD,CAAC;AACzF,qFAAqF;AACrF,MAAM,2BAA2B,GAAG,sDAAsD,CAAC;AAC3F,MAAM,sBAAsB,GAC3B,4OAA4O,CAAC;AAE9O;;;GAGG;AACH,MAAM,mBAAmB,GAA2B;IACnD,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;CACb,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;AAExF,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrD,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SACrE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;SAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACnC,4EAA4E;IAC5E,iFAAiF;IACjF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,kBAAkB,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA+C;IAC3E,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC;AACtF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACpC,UAA4B,EAC5B,IAAY,EACZ,KAAoB;IAEpB,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACd,0BAA0B,wBAAwB,6EAA6E,CAC/H,CAAC;IACH,CAAC;IACD,IACC,WAAW,KAAK,SAAS;QACzB,QAAQ,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACR,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,cAAc,CAAC,WAAW,CAAC,CAC3F,EACA,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACN,GAAG,UAAU;QACb,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;YACzD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QAC9E,CAAC,CAAC;KACF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAA4B;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAsB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA4B;IAC3D,OAAO,2BAA2B,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAwC;IACjE,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAwC,EAAE,IAAY;IAC9E,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAAwC,EAAE,IAAoB;IACxF,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GACT,UAAU;QACV,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YACvG,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,QAAQ,GACb,KAAK,IAAI,CAAC;QACT,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,UAA4B,EAAE,IAAoB;IAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC;IACjH,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC;AACpC,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,UAA4B,EAAE,IAAoB;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAC7G,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,UAAwC,EAAE,IAAY;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,WAAW,GAChB,OAAO,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAqB,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,UAA4B,EAAE,IAAY;IACjE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAwC,EAAE,IAAY;IACjF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5G,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAsB,EAAE,IAAY;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACN,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,GAAG,iBAAiB,CAAC,UAAU,CAAC;SAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA4B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,SAAS,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,UAAsB;IAC5C,MAAM,QAAQ,GAAI,UAA+B,CAAC,QAAQ,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CACzB,OAAyB,EACzB,QAAmC,EACnC,QAAmC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAyB,EAAE,MAAsB;IAC1E,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC9B,OAAqC,EACrC,IAAgB,EAChB,WAAsE;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACd,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7G,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9F,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ;YAAE,WAAW,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,QAAQ,EAAE,CAAC;QACd,2EAA2E;QAC3E,kEAAkE;QAClE,OAAO,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACzD,OAAO,GAAG,UAAU,UAAU,CAAC;AAChC,CAAC;AAED,MAAM,yBAAyB,GAAgC,IAAI,GAAG,CACrE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;IACpE,WAAW;IACX,uBAAuB,CAAC,QAAQ,CAAC;CACjC,CAAC,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IAC1D,MAAM,SAAS,GAAG,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,IAAoB;IAC7E,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB,EAAE,UAAsB;IACpF,MAAM,MAAM,GAAG,UAA8B,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAqB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACjH,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,IAAY,EAAE,SAAqB;IAChG,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IAC3F,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,SAAqB;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG;QACf,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM;QACtB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpB,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { LEGACY_PROVIDER_IDS } from \"../../legacy-provider-ids.ts\";\nimport type { ProviderEnv } from \"../../types.ts\";\nimport type { Credential } from \"../types.ts\";\n\nexport type { Credential };\n\nexport const DEFAULT_SLOT_NAME = \"default\";\n\nexport type CredentialSlotSource = \"login\" | \"import\" | \"env\";\n\nexport type CredentialSlot = {\n\t/** Immutable operational identity. */\n\tname: string;\n\t/** Optional presentation metadata; never used for credential selection. */\n\tdisplayName?: string;\n\tsource?: CredentialSlotSource;\n\tkey?: string;\n\taccess?: string;\n\trefresh?: string;\n\texpires?: number;\n\t/** Provider-scoped values this account carries (a Kimi region, a Cloudflare account id). */\n\tenv?: ProviderEnv;\n};\n\nexport type PooledCredential = Credential & {\n\taccounts?: CredentialSlot[];\n\tpinned?: string;\n};\n\nconst SLOT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;\n\nexport function assertValidSlotName(name: string): void {\n\tif (!SLOT_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(\n\t\t\t`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`,\n\t\t);\n\t}\n}\n\nconst UNSAFE_DISPLAY_CHARACTERS = /[\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}]/u;\n\n/**\n * Labels are bounded in terminal columns, not UTF-16 code units: 80 code units\n * of CJK render ~170 columns, which no footer segment can hold, while 41 emoji\n * render 82 columns yet count 82 code units. The bound is what the footer's\n * parenthesised provider segment can carry alongside a provider id.\n */\nexport const DISPLAY_NAME_MAX_COLUMNS = 32;\n\n/** Code points that advance a cell without painting anything a user can see. */\nconst BLANK_DISPLAY_CHARACTER = /^[\\s\\p{M}\\u115f\\u1160\\u17b4\\u17b5\\u2800\\u3164\\uffa0]$/u;\n/** Invisible code points that are not whitespace, so trimming never removes them. */\nconst INVISIBLE_DISPLAY_CHARACTER = /^[\\p{M}\\u115f\\u1160\\u17b4\\u17b5\\u2800\\u3164\\uffa0]$/u;\nconst WIDE_DISPLAY_CHARACTER =\n\t/^(?:[\\u1100-\\u115f\\u2329\\u232a\\u2e80-\\u303e\\u3041-\\u33ff\\u3400-\\u4dbf\\u4e00-\\u9fff\\ua000-\\ua4cf\\ua960-\\ua97f\\uac00-\\ud7a3\\uf900-\\ufaff\\ufe10-\\ufe19\\ufe30-\\ufe6f\\uff00-\\uff60\\uffe0-\\uffe6]|[\\u{1f300}-\\u{1faff}]|[\\u{20000}-\\u{3fffd}])$/u;\n\n/**\n * Latin lookalikes for the Cyrillic letters a homoglyph label would use. Folded\n * only for the uniqueness comparison; the stored label keeps the user's script.\n */\nconst CYRILLIC_LOOKALIKES: Record<string, string> = {\n\t\"\\u0430\": \"a\",\n\t\"\\u0432\": \"b\",\n\t\"\\u0435\": \"e\",\n\t\"\\u043a\": \"k\",\n\t\"\\u043c\": \"m\",\n\t\"\\u043d\": \"h\",\n\t\"\\u043e\": \"o\",\n\t\"\\u0440\": \"p\",\n\t\"\\u0441\": \"c\",\n\t\"\\u0442\": \"t\",\n\t\"\\u0443\": \"y\",\n\t\"\\u0445\": \"x\",\n\t\"\\u0455\": \"s\",\n\t\"\\u0456\": \"i\",\n\t\"\\u0458\": \"j\",\n};\n\nconst displayNameGraphemes = new Intl.Segmenter(undefined, { granularity: \"grapheme\" });\n\n/** Terminal columns a label occupies, measured per grapheme cluster. */\nexport function displayNameColumns(value: string): number {\n\tlet columns = 0;\n\tfor (const { segment } of displayNameGraphemes.segment(value)) {\n\t\tconst codePoint = segment.codePointAt(0);\n\t\tif (codePoint === undefined) continue;\n\t\tconst base = String.fromCodePoint(codePoint);\n\t\tif (INVISIBLE_DISPLAY_CHARACTER.test(base)) continue;\n\t\tcolumns += WIDE_DISPLAY_CHARACTER.test(base) || segment.includes(\"\\ufe0f\") ? 2 : 1;\n\t}\n\treturn columns;\n}\n\n/** The stored form: NFC, trimmed, internal whitespace runs collapsed to one space. */\nfunction normalizeDisplayName(value: string): string {\n\treturn value.normalize(\"NFC\").trim().replace(/\\s+/gu, \" \");\n}\n\n/**\n * Comparison key for \"unique per provider\": compatibility-folded (fullwidth and\n * other compatibility forms), case-folded, invisible code points dropped, and\n * Cyrillic lookalikes mapped to Latin, so two labels that render identically\n * cannot both be stored.\n */\nfunction displayNameKey(value: string): string {\n\treturn [...normalizeDisplayName(value).normalize(\"NFKC\").toLowerCase()]\n\t\t.filter((character) => !INVISIBLE_DISPLAY_CHARACTER.test(character))\n\t\t.map((character) => CYRILLIC_LOOKALIKES[character] ?? character)\n\t\t.join(\"\");\n}\n\n/** Treat persisted metadata as untrusted presentation input. */\nexport function accountDisplayName(value: unknown): string | undefined {\n\tif (typeof value !== \"string\" || UNSAFE_DISPLAY_CHARACTERS.test(value)) return undefined;\n\tconst normalized = normalizeDisplayName(value);\n\tconst characters = [...normalized];\n\t// A leading combining mark glues the label onto whatever precedes it, and a\n\t// label made only of blank-rendering code points is indistinguishable from none.\n\tif (characters.length === 0 || /^\\p{M}$/u.test(characters[0])) return undefined;\n\tif (characters.every((character) => BLANK_DISPLAY_CHARACTER.test(character))) return undefined;\n\treturn displayNameColumns(normalized) <= DISPLAY_NAME_MAX_COLUMNS ? normalized : undefined;\n}\n\nexport function accountLabel(account: { name: string; displayName?: string }): string {\n\tconst displayName = accountDisplayName(account.displayName);\n\treturn displayName === undefined ? account.name : `${displayName} (${account.name})`;\n}\n\n/** Pure metadata update; callers serialize this against the latest stored credential. */\nexport function renameSlotDisplayName(\n\tcredential: PooledCredential,\n\tname: string,\n\tvalue: string | null,\n): PooledCredential {\n\tassertValidSlotName(name);\n\tconst accounts = Array.isArray(credential.accounts) ? credential.accounts : listSlots(credential);\n\tconst target = accounts.find((slot) => slot.name === name);\n\tif (!target) throw new Error(`Stored provider account not found: ${name}`);\n\tif (target.source === \"env\") throw new Error(`Environment provider account cannot be renamed: ${name}`);\n\tconst displayName = value === null ? undefined : accountDisplayName(value);\n\tif (value !== null && displayName === undefined) {\n\t\tthrow new Error(\n\t\t\t`Display name must be 1-${DISPLAY_NAME_MAX_COLUMNS} terminal columns of visible text without control or formatting characters.`,\n\t\t);\n\t}\n\tif (\n\t\tdisplayName !== undefined &&\n\t\taccounts.some(\n\t\t\t(slot) =>\n\t\t\t\tslot.name !== name &&\n\t\t\t\tdisplayNameKey(accountDisplayName(slot.displayName) ?? \"\") === displayNameKey(displayName),\n\t\t)\n\t) {\n\t\tthrow new Error(\"Display name is already used by another account for this provider.\");\n\t}\n\treturn {\n\t\t...credential,\n\t\taccounts: accounts.map((slot) => {\n\t\t\tif (slot.name !== name) return slot;\n\t\t\tconst { displayName: _displayName, ...unchanged } = slot;\n\t\t\treturn displayName === undefined ? unchanged : { ...unchanged, displayName };\n\t\t}),\n\t};\n}\n\nfunction storedSlots(credential: PooledCredential): CredentialSlot[] {\n\treturn Array.isArray(credential.accounts) ? credential.accounts : [];\n}\n\nfunction credentialSlotEnv(credential: Credential): { env: ProviderEnv } | Record<string, never> {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return {};\n\tconst env: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry !== \"string\") return {};\n\t\tenv[name] = entry;\n\t}\n\treturn { env };\n}\n\nfunction slotFromFlatCredential(credential: PooledCredential): CredentialSlot {\n\treturn slotFromFlatCredentialNamed(credential, DEFAULT_SLOT_NAME);\n}\n\n/**\n * A flat credential written by a build predating pools is read as a one-slot pool\n * without writing anything back; the caller decides whether a write ever happens.\n */\nexport function listSlots(credential: PooledCredential | undefined): CredentialSlot[] {\n\tif (!credential) return [];\n\tconst slots = storedSlots(credential);\n\treturn slots.length > 0 ? [...slots] : [slotFromFlatCredential(credential)];\n}\n\nexport function findSlot(credential: PooledCredential | undefined, name: string): CredentialSlot | undefined {\n\treturn listSlots(credential).find((slot) => slot.name === name);\n}\n\n/**\n * Replaces or appends one slot while every sibling, the pin, and the flat\n * top-level credential survive untouched. The flat fields stay as written so a\n * build that ignores `accounts` still authenticates from them.\n */\nexport function upsertSlot(credential: PooledCredential | undefined, slot: CredentialSlot): PooledCredential {\n\tassertValidSlotName(slot.name);\n\tconst base: PooledCredential =\n\t\tcredential ??\n\t\t(slot.access !== undefined || slot.refresh !== undefined\n\t\t\t? { type: \"oauth\", access: slot.access ?? \"\", refresh: slot.refresh ?? \"\", expires: slot.expires ?? 0 }\n\t\t\t: { type: \"api_key\", key: slot.key });\n\tconst existing = listSlots(base);\n\tconst index = existing.findIndex((candidate) => candidate.name === slot.name);\n\tconst accounts =\n\t\tindex >= 0\n\t\t\t? existing.map((candidate) => (candidate.name === slot.name ? { ...candidate, ...slot } : candidate))\n\t\t\t: [...existing, slot];\n\treturn { ...base, accounts };\n}\n\n/** Whether the flat top-level fields are this slot's material rather than a sibling's. */\nfunction slotMirrorsFlat(credential: PooledCredential, slot: CredentialSlot): boolean {\n\tif (credential.type === \"oauth\") return slot.access === credential.access || slot.refresh === credential.refresh;\n\treturn slot.key === credential.key;\n}\n\n/** Rewrites the flat top-level projection to carry the given slot's material. */\nfunction projectFlatFields(credential: PooledCredential, slot: CredentialSlot): PooledCredential {\n\tconst env = slot.env === undefined ? {} : { env: slot.env };\n\tif (credential.type === \"oauth\") {\n\t\tif (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined) return credential;\n\t\treturn { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };\n\t}\n\treturn { ...credential, key: slot.key, ...env };\n}\n\n/**\n * Removes one slot. The credential is dropped entirely once its last slot is gone,\n * and a pin naming the removed slot is cleared so selection never points at a slot\n * that no longer exists.\n *\n * When the removed slot was the one the flat top-level fields projected, those\n * fields are re-projected from the first survivor. Without that the pool keeps\n * authenticating with the deleted account's material: a credential with a single\n * remaining slot does not enter the rotation path, so ordinary requests resolve\n * the flat projection and would keep using exactly the account the user removed.\n * `accounts` is preserved either way, so the entry stays a pool.\n */\nexport function removeSlot(credential: PooledCredential | undefined, name: string): PooledCredential | undefined {\n\tif (!credential) return undefined;\n\tconst existing = listSlots(credential);\n\tconst removed = existing.find((slot) => slot.name === name);\n\tconst accounts = existing.filter((slot) => slot.name !== name);\n\tif (accounts.length === 0) return undefined;\n\tconst reprojected =\n\t\tremoved && slotMirrorsFlat(credential, removed) ? projectFlatFields(credential, accounts[0]) : credential;\n\tconst next: PooledCredential = { ...reprojected, accounts };\n\tif (next.pinned === name) delete next.pinned;\n\treturn next;\n}\n\nexport function pinSlot(credential: PooledCredential, name: string): PooledCredential {\n\tassertValidSlotName(name);\n\treturn { ...credential, pinned: name };\n}\n\n/**\n * Projects one named slot onto the flat credential shape for request-scoped\n * resolution; pool bookkeeping fields are stripped so provider handlers see a\n * plain credential and never write pool state back through the projection.\n */\nexport function projectSlot(credential: PooledCredential | undefined, name: string): Credential | undefined {\n\tif (!credential) return undefined;\n\tconst slot = findSlot(credential, name);\n\tif (!slot) return undefined;\n\tconst { accounts: _accounts, pinned: _pinned, ...flat } = credential;\n\tconst env = slot.env === undefined ? {} : { env: slot.env };\n\tif (flat.type === \"oauth\") {\n\t\tif (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined) return undefined;\n\t\treturn { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };\n\t}\n\treturn { ...flat, key: slot.key, ...env };\n}\n\nfunction slotFromFlatCredentialNamed(credential: Credential, name: string): CredentialSlot {\n\tif (credential.type === \"oauth\") {\n\t\treturn {\n\t\t\tname,\n\t\t\tsource: \"login\",\n\t\t\taccess: credential.access,\n\t\t\trefresh: credential.refresh,\n\t\t\texpires: credential.expires,\n\t\t\t...credentialSlotEnv(credential),\n\t\t};\n\t}\n\treturn { name, source: \"login\", key: credential.key, ...credentialSlotEnv(credential) };\n}\n\nfunction nextLoginSlotName(credential: PooledCredential): string {\n\tconst taken = new Set(listSlots(credential).map((slot) => slot.name));\n\tfor (let index = 2; index < 1000; index++) {\n\t\tconst candidate = `login-${index}`;\n\t\tif (!taken.has(candidate)) return candidate;\n\t}\n\tthrow new Error(\"Credential pool is full\");\n}\n\nfunction providedSlots(credential: Credential): CredentialSlot[] | undefined {\n\tconst accounts = (credential as PooledCredential).accounts;\n\treturn Array.isArray(accounts) && accounts.length > 0 ? accounts : undefined;\n}\n\n/**\n * Unions a provider-owned pool onto the value read under the credential lock.\n * `current` wins for every name it already holds: the provider built its\n * object from a snapshot taken BEFORE the interactive browser round trip, so a\n * sibling account that rotated its refresh token or earned a rate-limit block\n * during that window must not be rewound to the snapshot. Names that do not\n * exist yet are appended.\n *\n * The one exception is a same-name slot whose `expires` is strictly newer than\n * the stored slot's: that is this login refreshing an existing account in place\n * (re-login recovery of an auth-blocked slot), so it replaces the stored copy\n * together with any block fields it carried. A snapshot sibling is never newer\n * than what concurrent writers stored, so it still loses.\n */\nfunction mergeProvidedPool(\n\tcurrent: PooledCredential,\n\texisting: readonly CredentialSlot[],\n\tprovided: readonly CredentialSlot[],\n): PooledCredential {\n\tconst providedByName = new Map(provided.map((slot) => [slot.name, slot]));\n\tlet refreshed = false;\n\tconst merged = existing.map((slot) => {\n\t\tconst candidate = providedByName.get(slot.name);\n\t\tif (!candidate || !hasNewerMaterial(candidate, slot)) return slot;\n\t\trefreshed = true;\n\t\treturn candidate;\n\t});\n\tconst known = new Set(existing.map((slot) => slot.name));\n\tconst added = provided.filter((slot) => !known.has(slot.name));\n\treturn added.length === 0 && !refreshed ? current : { ...current, accounts: [...merged, ...added] };\n}\n\nfunction hasNewerMaterial(candidate: CredentialSlot, stored: CredentialSlot): boolean {\n\treturn candidate.expires !== undefined && (stored.expires === undefined || candidate.expires > stored.expires);\n}\n\n/**\n * Appends an unnamed flat credential to a pool as a generated `login-N` slot.\n * An absent current entry keeps today's whole-write shape; a flat current entry\n * is promoted to a pool so the legacy credential stays reachable as `default`\n * instead of being overwritten by the second login.\n *\n * A login result that already carries its own populated `accounts` array is a\n * provider-owned pool, and a provider that already holds a POOL names the\n * account this login created itself. That pool is MERGED onto `current` rather\n * than written through: a pre-browser-flow snapshot must never overwrite what\n * concurrent writers stored meanwhile. A flat `current` keeps the whole-write\n * shape - the provider echoes the flat fields it read, so there is nothing to\n * preserve and the login must not be dropped on a name collision.\n *\n * `onAllocated` reports the account this login committed, so a caller can name\n * it in a receipt without re-reading storage.\n */\nexport function appendLoginSlot(\n\tcurrent: PooledCredential | undefined,\n\tflat: Credential,\n\tonAllocated?: (name: string, origin: \"generated\" | \"provider\") => void,\n): Credential {\n\tconst provided = providedSlots(flat);\n\tif (provided) {\n\t\t// Provider-owned envelopes identify an addition by immutable ID, never by\n\t\t// token equality or array position. Ambiguous envelopes have no receipt.\n\t\tconst previous = new Set(\n\t\t\t(current && Array.isArray(current.accounts) ? current.accounts : listSlots(current)).map((slot) => slot.name),\n\t\t);\n\t\tconst added = provided.filter((slot) => !previous.has(slot.name));\n\t\tif (added.length === 1 && SLOT_NAME_PATTERN.test(added[0].name) && added[0].source !== \"env\") {\n\t\t\tonAllocated?.(added[0].name, \"provider\");\n\t\t}\n\t}\n\tif (!current) {\n\t\tif (!provided) onAllocated?.(DEFAULT_SLOT_NAME, \"generated\");\n\t\treturn flat;\n\t}\n\tconst storedAccounts = Array.isArray(current.accounts) ? current.accounts : undefined;\n\tif (provided) {\n\t\t// A pool merges onto the stored pool; a flat current keeps the whole-write\n\t\t// shape because the provider's accounts already carry this login.\n\t\treturn storedAccounts ? mergeProvidedPool(current, storedAccounts, provided) : flat;\n\t}\n\tconst name = nextLoginSlotName(current);\n\tconst next = upsertSlot(current, slotFromFlatCredentialNamed(flat, name));\n\tonAllocated?.(name, \"generated\");\n\treturn next;\n}\n\n/**\n * Material a provider writes into the flat credential when the real token lives\n * outside auth.json (an SDK subprocess or a vendor CLI owns it): the literal\n * `<providerId>-managed` in both OAuth fields. It is a marker, never a token.\n */\nexport function managedSentinelMaterial(providerId: string): string {\n\treturn `${providerId}-managed`;\n}\n\nconst LEGACY_SENTINEL_MATERIALS: ReadonlyMap<string, string> = new Map(\n\tObject.entries(LEGACY_PROVIDER_IDS).map(([legacyId, canonicalId]) => [\n\t\tcanonicalId,\n\t\tmanagedSentinelMaterial(legacyId),\n\t]),\n);\n\n/**\n * Every sentinel material a stored credential may legitimately carry for this\n * provider: the canonical `<providerId>-managed` plus the legacy material of\n * any renamed ancestor id, because credentials written before a rename keep\n * the old literal verbatim.\n */\nexport function managedSentinelMaterials(providerId: string): string[] {\n\tconst materials = [managedSentinelMaterial(providerId)];\n\tconst legacy = LEGACY_SENTINEL_MATERIALS.get(providerId);\n\tif (legacy !== undefined && !materials.includes(legacy)) materials.push(legacy);\n\treturn materials;\n}\n\n/**\n * A POOL SLOT carrying that marker can never authenticate: `projectSlot` hands\n * it to the provider's `check`, which rejects it, and the request dies with\n * \"Provider is not configured\". Slots like that exist only because a shipped\n * build appended a provider-owned pool's flat sentinel as a generated `login-N`\n * slot.\n */\nexport function isManagedSentinelSlot(providerId: string, slot: CredentialSlot): boolean {\n\tconst materials = managedSentinelMaterials(providerId);\n\treturn materials.includes(slot.access ?? \"\") && slot.refresh === slot.access;\n}\n\n/**\n * Drops those poisoned slots from a stored credential, clearing a pin that\n * named one. Returns `undefined` when the credential holds none, so a caller\n * can tell a repair from a no-op and only rewrite storage when the bytes\n * actually change.\n */\nexport function repairManagedSentinelSlots(providerId: string, credential: Credential): PooledCredential | undefined {\n\tconst pooled = credential as PooledCredential;\n\tif (!Array.isArray(pooled.accounts)) return undefined;\n\tconst kept = pooled.accounts.filter((slot) => !isManagedSentinelSlot(providerId, slot));\n\tif (kept.length === pooled.accounts.length) return undefined;\n\tconst repaired: PooledCredential = { ...pooled, accounts: kept };\n\tif (repaired.pinned !== undefined && !kept.some((slot) => slot.name === repaired.pinned)) delete repaired.pinned;\n\treturn repaired;\n}\n\n/**\n * Merges a rotated OAuth credential back into the pool: the slot whose material\n * matches the pre-refresh flat fields is updated in place together with those\n * flat fields, while every sibling and the pin survive byte-identical. A flat\n * current entry keeps today's whole-write shape.\n */\n/**\n * Merges a rotated OAuth credential into the NAMED slot. The flat top-level\n * projection rotates only when it mirrored that slot's previous material, so\n * refreshing a secondary slot never disturbs what an older binary reads.\n */\nexport function mergeRefreshedSlot(current: PooledCredential, name: string, refreshed: Credential): Credential {\n\tif (refreshed.type !== \"oauth\" || current.type !== \"oauth\") return current;\n\tif (!Array.isArray(current.accounts) || current.accounts.length === 0) return mergeRefreshed(current, refreshed);\n\tconst target = current.accounts.find((slot) => slot.name === name);\n\tif (!target) return current;\n\tconst rotated = { access: refreshed.access, refresh: refreshed.refresh, expires: refreshed.expires };\n\tconst accounts = current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot));\n\tconst mirrorsFlat = target.access === current.access || target.refresh === current.refresh;\n\treturn mirrorsFlat ? { ...current, ...rotated, accounts } : { ...current, accounts };\n}\n\nexport function mergeRefreshed(current: PooledCredential, refreshed: Credential): Credential {\n\tif (!Array.isArray(current.accounts) || current.accounts.length === 0) {\n\t\treturn refreshed;\n\t}\n\tif (refreshed.type !== \"oauth\" || current.type !== \"oauth\") return refreshed;\n\tconst target = current.accounts.find((slot) => slot.access === current.access || slot.refresh === current.refresh);\n\tconst rotated = {\n\t\taccess: refreshed.access,\n\t\trefresh: refreshed.refresh,\n\t\texpires: refreshed.expires,\n\t};\n\tconst accounts = target\n\t\t? current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot))\n\t\t: current.accounts;\n\treturn { ...current, ...rotated, accounts };\n}\n"]}

package/dist/auth/resolve.d.ts

@@ -12,6 +12,12 @@ export interface AuthResolutionOverrides {
      * ambient env, so a slot-scoped request can never silently switch identities.
      */
     slotName?: string;
+    /**
+     * An access token the provider just refused with one of its
+     * `OAuthAuth.rejectedTokenStatuses`. A stored OAuth credential still carrying it
+     * is re-exchanged regardless of its expiry; one already rotated is used as is.
+     */
+    rejectedAccess?: string;
     signal?: AbortSignal;
 }
 /**

package/dist/auth/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU/C,OAAO,KAAK,EAGX,WAAW,EACX,UAAU,EAEV,eAAe,EAGf,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7G,MAAM,WAAW,uBAAuB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iCAAiC,CAAC;AAE7E,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,YAAY,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAIhF;CACD;AAUD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,WAAW,EAAE,eAAe,EAC5B,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAMjC;AAoGD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAOvF"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU/C,OAAO,KAAK,EAGX,WAAW,EACX,UAAU,EAEV,eAAe,EAGf,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7G,MAAM,WAAW,uBAAuB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,iCAAiC,CAAC;AAE7E,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,YAAY,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAIhF;CACD;AAUD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,WAAW,EAAE,eAAe,EAC5B,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAMjC;AAuGD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAOvF"}