@duckcodeailabs/dql-cli 1.6.29 → 1.6.31

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duckcodeailabs/dql-cli",
-  "version": "1.6.29",
+  "version": "1.6.31",
   "description": "Public CLI for parsing, formatting, testing, and certifying DQL blocks",
   "license": "Apache-2.0",
   "type": "module",
@@ -25,15 +25,15 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.104.2",
-    "@duckcodeailabs/dql-agent": "^1.6.29",
-    "@duckcodeailabs/dql-compiler": "^1.6.29",
-    "@duckcodeailabs/dql-connectors": "^1.6.29",
-    "@duckcodeailabs/dql-core": "^1.6.29",
-    "@duckcodeailabs/dql-governance": "^1.6.29",
-    "@duckcodeailabs/dql-mcp": "^1.6.29",
-    "@duckcodeailabs/dql-notebook": "^1.6.29",
-    "@duckcodeailabs/dql-project": "^1.6.29",
-    "@duckcodeailabs/dql-slack": "^1.6.29",
+    "@duckcodeailabs/dql-agent": "^1.6.31",
+    "@duckcodeailabs/dql-compiler": "^1.6.31",
+    "@duckcodeailabs/dql-connectors": "^1.6.31",
+    "@duckcodeailabs/dql-core": "^1.6.31",
+    "@duckcodeailabs/dql-governance": "^1.6.31",
+    "@duckcodeailabs/dql-mcp": "^1.6.31",
+    "@duckcodeailabs/dql-notebook": "^1.6.31",
+    "@duckcodeailabs/dql-project": "^1.6.31",
+    "@duckcodeailabs/dql-slack": "^1.6.31",
     "isomorphic-git": "^1.27.0",
     "js-yaml": "^4.1.0",
     "node-cron": "^3.0.3",
@@ -41,6 +41,6 @@
     "openai": "^6.44.0"
   },
   "engines": {
-    "node": ">=20 <23"
+    "node": ">=20"
   }
 }

package/dist/providers/oauth/claude-oauth.d.ts

@@ -0,0 +1,80 @@
+import type { AgentProvider, AgentMessage, ProviderRunOptions } from '@duckcodeailabs/dql-agent';
+import { type ClaudeOAuthCredentials } from './oauth-store.js';
+/**
+ * Claude Pro/Max subscription login via OAuth 2.0 + PKCE, and a provider that
+ * drives `api.anthropic.com` with the resulting bearer token (no API key).
+ *
+ * Ported from the reference coding-extension flow. Tokens are stored in the
+ * `chmod 600` `.dql/oauth-credentials.json` file rather than VSCode secrets.
+ *
+ * NOTE (governance / ToS): this reuses the official Claude Code OAuth client id
+ * to authenticate a user's *subscription*. It is subject to Anthropic's terms —
+ * the client id can be revoked and accounts can be rate-limited/flagged. The
+ * provider falls back to the CLI-passthrough path when not connected.
+ */
+export declare const CLAUDE_OAUTH_CONFIG: {
+    readonly authorizationEndpoint: "https://claude.ai/oauth/authorize";
+    readonly tokenEndpoint: "https://console.anthropic.com/v1/oauth/token";
+    readonly clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+    readonly redirectUri: "http://localhost:54545/callback";
+    readonly scopes: "org:create_api_key user:profile user:inference";
+    readonly callbackPort: 54545;
+};
+/** Claude subscription models exposed after login (static list; default first). */
+export declare const CLAUDE_OAUTH_MODELS: readonly ["claude-sonnet-4-5", "claude-opus-4-5", "claude-haiku-4-5"];
+export declare const CLAUDE_OAUTH_DEFAULT_MODEL = "claude-sonnet-4-5";
+export declare function generateCodeVerifier(): string;
+export declare function generateCodeChallenge(verifier: string): string;
+export declare function generateState(): string;
+/** Claude Code identifies the caller with a synthetic `user_<hash>_account_<uuid>_session_<uuid>` id. */
+export declare function generateUserId(email?: string): string;
+export declare function buildAuthorizationUrl(codeChallenge: string, state: string): string;
+export declare function exchangeCodeForTokens(code: string, codeVerifier: string, state: string): Promise<ClaudeOAuthCredentials>;
+export declare function refreshAccessToken(credentials: ClaudeOAuthCredentials): Promise<ClaudeOAuthCredentials>;
+export declare function isTokenExpired(credentials: ClaudeOAuthCredentials): boolean;
+/**
+ * Project-scoped manager: owns the pending-auth state during a login and the
+ * lazy access-token refresh. File-backed, so the login flow (backend endpoints)
+ * and the provider (`generate`) see the same credentials.
+ */
+export declare class ClaudeOAuthManager {
+    private readonly projectRoot;
+    private pendingAuth;
+    private refreshPromise;
+    constructor(projectRoot: string);
+    cancelAuthorizationFlow(): void;
+    /** True while a login is in flight (callback server listening). */
+    isPending(): boolean;
+    startAuthorizationFlow(): string;
+    /** Starts the loopback callback server on the fixed OAuth port and resolves when the browser returns. */
+    waitForCallback(): Promise<ClaudeOAuthCredentials>;
+    /** Returns a valid access token, refreshing (and persisting) if within the expiry buffer. */
+    getAccessToken(): Promise<string | null>;
+    getEmail(): string | null;
+    isAuthenticated(): Promise<boolean>;
+    signOut(): void;
+}
+/** True if a Claude subscription is connected (a credential exists on disk). */
+export declare function claudeOAuthConnected(projectRoot: string): boolean;
+/**
+ * AgentProvider that drives Claude via the subscription OAuth token. Requires a
+ * prior `Sign in with Claude`. The "You are Claude Code…" system preamble and the
+ * `oauth-2025-04-20` beta header are required for the subscription API to accept
+ * the request.
+ */
+export declare class ClaudeOAuthProvider implements AgentProvider {
+    readonly name: "claude";
+    private readonly manager;
+    private readonly projectRoot;
+    private readonly defaultModel;
+    private readonly maxTokens;
+    private readonly cliModel?;
+    private cliFallback?;
+    constructor(opts: {
+        projectRoot: string;
+        model?: string;
+    });
+    available(): Promise<boolean>;
+    generate(messages: AgentMessage[], options?: ProviderRunOptions): Promise<string>;
+}
+//# sourceMappingURL=claude-oauth.d.ts.map

package/dist/providers/oauth/claude-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-oauth.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/claude-oauth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;;CAOtB,CAAC;AAEX,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,uEAAwE,CAAC;AACzG,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAE9D,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWlF;AAiBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0B9H;AAED,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAkB7G;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAG3E;AAED;;;;GAIG;AACH,qBAAa,kBAAkB;IAIjB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAHxC,OAAO,CAAC,WAAW,CAA6G;IAChI,OAAO,CAAC,cAAc,CAAgD;gBAEzC,WAAW,EAAE,MAAM;IAEhD,uBAAuB,IAAI,IAAI;IAY/B,mEAAmE;IACnE,SAAS,IAAI,OAAO;IAIpB,sBAAsB,IAAI,MAAM;IAShC,yGAAyG;IACnG,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAyDxD,6FAA6F;IACvF,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiB9C,QAAQ,IAAI,MAAM,GAAG,IAAI;IAInB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAIzC,OAAO,IAAI,IAAI;CAIhB;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE;AAoBD;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,WAAW,CAAC,CAAwB;gBAEhC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAQnD,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;CAgD5F"}

package/dist/providers/oauth/claude-oauth.js

@@ -0,0 +1,352 @@
+import * as crypto from 'node:crypto';
+import * as http from 'node:http';
+import { URL } from 'node:url';
+import { getClaudeCredentials, setClaudeCredentials, clearOAuthProvider, } from './oauth-store.js';
+import { ClaudeCodeCliProvider } from '../subscription-cli.js';
+/**
+ * Claude Pro/Max subscription login via OAuth 2.0 + PKCE, and a provider that
+ * drives `api.anthropic.com` with the resulting bearer token (no API key).
+ *
+ * Ported from the reference coding-extension flow. Tokens are stored in the
+ * `chmod 600` `.dql/oauth-credentials.json` file rather than VSCode secrets.
+ *
+ * NOTE (governance / ToS): this reuses the official Claude Code OAuth client id
+ * to authenticate a user's *subscription*. It is subject to Anthropic's terms —
+ * the client id can be revoked and accounts can be rate-limited/flagged. The
+ * provider falls back to the CLI-passthrough path when not connected.
+ */
+export const CLAUDE_OAUTH_CONFIG = {
+    authorizationEndpoint: 'https://claude.ai/oauth/authorize',
+    tokenEndpoint: 'https://console.anthropic.com/v1/oauth/token',
+    clientId: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+    redirectUri: 'http://localhost:54545/callback',
+    scopes: 'org:create_api_key user:profile user:inference',
+    callbackPort: 54545,
+};
+/** Claude subscription models exposed after login (static list; default first). */
+export const CLAUDE_OAUTH_MODELS = ['claude-sonnet-4-5', 'claude-opus-4-5', 'claude-haiku-4-5'];
+export const CLAUDE_OAUTH_DEFAULT_MODEL = 'claude-sonnet-4-5';
+export function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+export function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest().toString('base64url');
+}
+export function generateState() {
+    return crypto.randomBytes(16).toString('hex');
+}
+/** Claude Code identifies the caller with a synthetic `user_<hash>_account_<uuid>_session_<uuid>` id. */
+export function generateUserId(email) {
+    const userHash = email
+        ? crypto.createHash('sha256').update(email).digest('hex').slice(0, 16)
+        : crypto.randomBytes(8).toString('hex');
+    const accountUuid = crypto.randomUUID().replace(/-/g, '');
+    const sessionUuid = crypto.randomUUID().replace(/-/g, '');
+    return `user_${userHash}_account_${accountUuid}_session_${sessionUuid}`;
+}
+export function buildAuthorizationUrl(codeChallenge, state) {
+    const params = new URLSearchParams({
+        client_id: CLAUDE_OAUTH_CONFIG.clientId,
+        redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+        scope: CLAUDE_OAUTH_CONFIG.scopes,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        response_type: 'code',
+        state,
+    });
+    return `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+}
+function parseTokenResponse(data) {
+    const d = data;
+    if (!d || typeof d.access_token !== 'string' || typeof d.expires_in !== 'number') {
+        throw new Error('Claude OAuth: malformed token response');
+    }
+    return { access_token: d.access_token, refresh_token: d.refresh_token, expires_in: d.expires_in, email: d.email };
+}
+export async function exchangeCodeForTokens(code, codeVerifier, state) {
+    const response = await fetch(CLAUDE_OAUTH_CONFIG.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            code,
+            state,
+            grant_type: 'authorization_code',
+            client_id: CLAUDE_OAUTH_CONFIG.clientId,
+            redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+            code_verifier: codeVerifier,
+        }),
+        signal: AbortSignal.timeout(30000),
+    });
+    if (!response.ok) {
+        throw new Error(`Claude OAuth token exchange failed: ${response.status} ${await response.text().catch(() => response.statusText)}`);
+    }
+    const token = parseTokenResponse(await response.json());
+    if (!token.refresh_token)
+        throw new Error('Claude OAuth: token exchange did not return a refresh_token');
+    return {
+        type: 'claude',
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        expired: new Date(Date.now() + token.expires_in * 1000).toISOString(),
+        email: token.email,
+    };
+}
+export async function refreshAccessToken(credentials) {
+    const response = await fetch(CLAUDE_OAUTH_CONFIG.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ grant_type: 'refresh_token', client_id: CLAUDE_OAUTH_CONFIG.clientId, refresh_token: credentials.refresh_token }),
+        signal: AbortSignal.timeout(30000),
+    });
+    if (!response.ok) {
+        throw new Error(`Claude OAuth token refresh failed: ${response.status} ${await response.text().catch(() => response.statusText)}`);
+    }
+    const token = parseTokenResponse(await response.json());
+    return {
+        type: 'claude',
+        access_token: token.access_token,
+        refresh_token: token.refresh_token ?? credentials.refresh_token,
+        expired: new Date(Date.now() + token.expires_in * 1000).toISOString(),
+        email: token.email ?? credentials.email,
+    };
+}
+export function isTokenExpired(credentials) {
+    const bufferMs = 5 * 60 * 1000;
+    return Date.now() >= new Date(credentials.expired).getTime() - bufferMs;
+}
+/**
+ * Project-scoped manager: owns the pending-auth state during a login and the
+ * lazy access-token refresh. File-backed, so the login flow (backend endpoints)
+ * and the provider (`generate`) see the same credentials.
+ */
+export class ClaudeOAuthManager {
+    projectRoot;
+    pendingAuth = null;
+    refreshPromise = null;
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    cancelAuthorizationFlow() {
+        const prior = this.pendingAuth;
+        this.pendingAuth = null;
+        if (!prior)
+            return;
+        // Settle the in-flight callback promise so its port + closure are released
+        // deterministically (server.close() alone would leave the promise dangling).
+        if (prior.reject)
+            prior.reject(new Error('Authorization flow superseded'));
+        if (prior.server) {
+            try {
+                prior.server.close();
+            }
+            catch { /* noop */ }
+        }
+    }
+    /** True while a login is in flight (callback server listening). */
+    isPending() {
+        return this.pendingAuth !== null;
+    }
+    startAuthorizationFlow() {
+        this.cancelAuthorizationFlow();
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        const state = generateState();
+        this.pendingAuth = { codeVerifier, state };
+        return buildAuthorizationUrl(codeChallenge, state);
+    }
+    /** Starts the loopback callback server on the fixed OAuth port and resolves when the browser returns. */
+    async waitForCallback() {
+        if (!this.pendingAuth)
+            throw new Error('No pending authorization flow');
+        const pending = this.pendingAuth;
+        const { codeVerifier, state } = pending;
+        return new Promise((resolve, reject) => {
+            pending.reject = reject;
+            const server = http.createServer(async (req, res) => {
+                try {
+                    const url = new URL(req.url || '', `http://localhost:${CLAUDE_OAUTH_CONFIG.callbackPort}`);
+                    if (url.pathname !== '/callback') {
+                        res.writeHead(404);
+                        res.end('Not Found');
+                        return;
+                    }
+                    const code = url.searchParams.get('code');
+                    const receivedState = url.searchParams.get('state');
+                    if (!code || !receivedState) {
+                        res.writeHead(400);
+                        res.end('Missing code or state');
+                        return;
+                    }
+                    if (receivedState !== state) {
+                        res.writeHead(400);
+                        res.end('Invalid state');
+                        return;
+                    }
+                    const credentials = await exchangeCodeForTokens(code, codeVerifier, receivedState);
+                    setClaudeCredentials(this.projectRoot, credentials);
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end('<html><body style="font-family:system-ui;padding:40px">Signed in to Claude. You can close this tab and return to DQL.</body></html>');
+                    server.close();
+                    this.pendingAuth = null;
+                    resolve(credentials);
+                }
+                catch (error) {
+                    try {
+                        res.writeHead(500);
+                        res.end('Authentication failed');
+                    }
+                    catch { /* noop */ }
+                    try {
+                        server.close();
+                    }
+                    catch { /* noop */ }
+                    this.pendingAuth = null;
+                    reject(error);
+                }
+            });
+            pending.server = server;
+            const timeout = setTimeout(() => {
+                try {
+                    server.close();
+                }
+                catch { /* noop */ }
+                if (this.pendingAuth === pending)
+                    this.pendingAuth = null;
+                reject(new Error('Claude OAuth callback timed out'));
+            }, 5 * 60 * 1000);
+            server.on('close', () => clearTimeout(timeout));
+            server.on('error', (err) => {
+                clearTimeout(timeout);
+                if (this.pendingAuth === pending)
+                    this.pendingAuth = null;
+                reject(err);
+            });
+            server.listen(CLAUDE_OAUTH_CONFIG.callbackPort);
+        });
+    }
+    /** Returns a valid access token, refreshing (and persisting) if within the expiry buffer. */
+    async getAccessToken() {
+        let creds = getClaudeCredentials(this.projectRoot);
+        if (!creds)
+            return null;
+        if (isTokenExpired(creds)) {
+            try {
+                if (!this.refreshPromise)
+                    this.refreshPromise = refreshAccessToken(creds);
+                creds = await this.refreshPromise;
+                this.refreshPromise = null;
+                setClaudeCredentials(this.projectRoot, creds);
+            }
+            catch {
+                this.refreshPromise = null;
+                return null;
+            }
+        }
+        return creds.access_token;
+    }
+    getEmail() {
+        return getClaudeCredentials(this.projectRoot)?.email ?? null;
+    }
+    async isAuthenticated() {
+        return (await this.getAccessToken()) !== null;
+    }
+    signOut() {
+        this.cancelAuthorizationFlow();
+        clearOAuthProvider(this.projectRoot, 'claude');
+    }
+}
+/** True if a Claude subscription is connected (a credential exists on disk). */
+export function claudeOAuthConnected(projectRoot) {
+    return getClaudeCredentials(projectRoot) !== null;
+}
+const ANTHROPIC_OAUTH_BETAS = [
+    'prompt-caching-2024-07-31',
+    'claude-code-20250219',
+    'oauth-2025-04-20',
+    'interleaved-thinking-2025-05-14',
+    'fine-grained-tool-streaming-2025-05-14',
+].join(',');
+/** effort → extended-thinking token budget (matches the reference flow). */
+function thinkingFor(effort, maxTokens) {
+    const budget = effort === 'high' ? 20000 : effort === 'medium' ? 8192 : effort === 'low' ? 2048 : 0;
+    if (budget <= 0)
+        return { type: 'disabled' };
+    const clamped = Math.min(budget, Math.floor(maxTokens * 0.8));
+    // Anthropic requires budget_tokens >= 1024; if the output cap leaves no room, skip thinking.
+    if (clamped < 1024)
+        return { type: 'disabled' };
+    return { type: 'enabled', budget_tokens: clamped };
+}
+/**
+ * AgentProvider that drives Claude via the subscription OAuth token. Requires a
+ * prior `Sign in with Claude`. The "You are Claude Code…" system preamble and the
+ * `oauth-2025-04-20` beta header are required for the subscription API to accept
+ * the request.
+ */
+export class ClaudeOAuthProvider {
+    name = 'claude';
+    manager;
+    projectRoot;
+    defaultModel;
+    maxTokens;
+    cliModel;
+    cliFallback;
+    constructor(opts) {
+        this.manager = new ClaudeOAuthManager(opts.projectRoot);
+        this.projectRoot = opts.projectRoot;
+        this.defaultModel = opts.model || CLAUDE_OAUTH_DEFAULT_MODEL;
+        this.cliModel = opts.model;
+        this.maxTokens = 32768;
+    }
+    async available() {
+        return this.manager.isAuthenticated();
+    }
+    async generate(messages, options = {}) {
+        const accessToken = await this.manager.getAccessToken();
+        if (!accessToken) {
+            // A credential exists but is unusable (expired + refresh failed, or revoked):
+            // honor the OAuth-first, CLI-fallback contract. With no credential at all,
+            // prompt to sign in.
+            if (claudeOAuthConnected(this.projectRoot)) {
+                if (!this.cliFallback)
+                    this.cliFallback = new ClaudeCodeCliProvider({ model: this.cliModel });
+                if (await this.cliFallback.available()) {
+                    return this.cliFallback.generate(messages, options);
+                }
+            }
+            throw new Error('Your Claude subscription session expired. Open Settings → Claude subscription and click "Sign in with Claude" again.');
+        }
+        const systemText = messages.filter((m) => m.role === 'system').map((m) => m.content).join('\n\n');
+        const turns = messages.filter((m) => m.role !== 'system').map((m) => ({ role: m.role, content: m.content }));
+        const userId = generateUserId(this.manager.getEmail() || undefined);
+        const maxTokens = options.maxTokens ?? this.maxTokens;
+        const body = {
+            model: options.model || this.defaultModel,
+            max_tokens: maxTokens,
+            system: [
+                { type: 'text', text: "You are Claude Code, Anthropic's official CLI for Claude." },
+                ...(systemText ? [{ type: 'text', text: systemText }] : []),
+            ],
+            messages: turns,
+            thinking: thinkingFor(options.reasoningEffort, maxTokens),
+            metadata: { user_id: userId },
+        };
+        const res = await fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+                'Anthropic-Version': '2023-06-01',
+                'Anthropic-Beta': ANTHROPIC_OAUTH_BETAS,
+            },
+            body: JSON.stringify(body),
+            signal: options.signal,
+        });
+        if (!res.ok) {
+            throw new Error(`claude (subscription): ${res.status} ${await res.text().catch(() => res.statusText)}`);
+        }
+        const json = (await res.json());
+        return (json.content ?? []).filter((b) => b.type === 'text').map((b) => b.text ?? '').join('');
+    }
+}
+//# sourceMappingURL=claude-oauth.js.map

package/dist/providers/oauth/claude-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-oauth.js","sourceRoot":"","sources":["../../../src/providers/oauth/claude-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB,EAAE,mCAAmC;IAC1D,aAAa,EAAE,8CAA8C;IAC7D,QAAQ,EAAE,sCAAsC;IAChD,WAAW,EAAE,iCAAiC;IAC9C,MAAM,EAAE,gDAAgD;IACxD,YAAY,EAAE,KAAK;CACX,CAAC;AAEX,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,CAAU,CAAC;AACzG,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,QAAQ,GAAG,KAAK;QACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,QAAQ,QAAQ,YAAY,WAAW,YAAY,WAAW,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,KAAa;IACxE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,mBAAmB,CAAC,QAAQ;QACvC,YAAY,EAAE,mBAAmB,CAAC,WAAW;QAC7C,KAAK,EAAE,mBAAmB,CAAC,MAAM;QACjC,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,aAAa,EAAE,MAAM;QACrB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,GAAG,mBAAmB,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7E,CAAC;AASD,SAAS,kBAAkB,CAAC,IAAa;IACvC,MAAM,CAAC,GAAG,IAA0C,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,YAAoB,EAAE,KAAa;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,KAAK;YACL,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,mBAAmB,CAAC,QAAQ;YACvC,YAAY,EAAE,mBAAmB,CAAC,WAAW;YAC7C,aAAa,EAAE,YAAY;SAC5B,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACzG,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACrE,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmC;IAC1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;QACxI,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,WAAW,CAAC,aAAa;QAC/D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACrE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAmC;IAChE,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAIA;IAHrB,WAAW,GAAwG,IAAI,CAAC;IACxH,cAAc,GAA2C,IAAI,CAAC;IAEtE,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IAEpD,uBAAuB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,sBAAsB;QACpB,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC3C,OAAO,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAExC,OAAO,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,oBAAoB,mBAAmB,CAAC,YAAY,EAAE,CAAC,CAAC;oBAC3F,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;wBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACrB,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpD,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;wBACjC,OAAO;oBACT,CAAC;oBACD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;wBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;oBACnF,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;oBACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,qIAAqI,CAAC,CAAC;oBAC/I,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;oBACxB,OAAO,CAAC,WAAW,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;oBAClF,IAAI,CAAC;wBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;oBAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;oBACxB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC5C,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;oBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC1D,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;YACvD,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAClB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;oBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC1D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,cAAc;QAClB,IAAI,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,cAAc;oBAAE,IAAI,CAAC,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1E,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,QAAQ;QACN,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,IAAI,CAAC;IAChD,CAAC;IAED,OAAO;QACL,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,oBAAoB,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClB,iCAAiC;IACjC,wCAAwC;CACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,4EAA4E;AAC5E,SAAS,WAAW,CAAC,MAA6C,EAAE,SAAiB;IACnF,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC;IAC9D,6FAA6F;IAC7F,IAAI,OAAO,GAAG,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,QAAiB,CAAC;IACjB,OAAO,CAAqB;IAC5B,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAC3B,WAAW,CAAyB;IAE5C,YAAY,IAA6C;QACvD,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,0BAA0B,CAAC;QAC7D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAwB,EAAE,UAA8B,EAAE;QACvE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,8EAA8E;YAC9E,2EAA2E;YAC3E,qBAAqB;YACrB,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9F,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;oBACvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;QAC1I,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrI,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,SAAS,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEtD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY;YACzC,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2DAA2D,EAAE;gBACnF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;YACD,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC;YACzD,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;SAC9B,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,mBAAmB,EAAE,YAAY;gBACjC,gBAAgB,EAAE,qBAAqB;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyD,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;CACF"}

package/dist/providers/oauth/codex-oauth.d.ts

@@ -0,0 +1,71 @@
+import type { AgentProvider, AgentMessage, ProviderRunOptions } from '@duckcodeailabs/dql-agent';
+import { type CodexOAuthCredentials } from './oauth-store.js';
+/**
+ * ChatGPT Plus/Pro subscription login via OpenAI OAuth 2.0 + PKCE, and a provider
+ * that drives the ChatGPT Codex backend with the resulting bearer token.
+ *
+ * Ported from the reference coding-extension flow. Tokens live in the `chmod 600`
+ * `.dql/oauth-credentials.json` file. Same ToS caveat as the Claude flow: this
+ * reuses the official Codex OAuth client id against a subscription; the provider
+ * falls back to the CLI-passthrough path when not connected.
+ */
+export declare const CODEX_OAUTH_CONFIG: {
+    readonly authorizationEndpoint: "https://auth.openai.com/oauth/authorize";
+    readonly tokenEndpoint: "https://auth.openai.com/oauth/token";
+    readonly clientId: "app_EMoamEEZ73f0CkXaXp7hrann";
+    readonly redirectUri: "http://localhost:1455/auth/callback";
+    readonly scopes: "openid profile email offline_access";
+    readonly callbackPort: 1455;
+};
+/** ChatGPT subscription models exposed after login (static list; default first). */
+export declare const CODEX_OAUTH_MODELS: readonly ["gpt-5.2-codex", "gpt-5.1-codex", "gpt-5-codex", "gpt-5-codex-mini"];
+export declare const CODEX_OAUTH_DEFAULT_MODEL = "gpt-5.2-codex";
+export declare function generateCodeVerifier(): string;
+export declare function generateCodeChallenge(verifier: string): string;
+export declare function generateState(): string;
+export declare function buildAuthorizationUrl(codeChallenge: string, state: string): string;
+export declare function extractAccountId(tokens: {
+    id_token?: string;
+    access_token: string;
+}): string | undefined;
+export declare function exchangeCodeForTokens(code: string, codeVerifier: string): Promise<CodexOAuthCredentials>;
+export declare function refreshAccessToken(credentials: CodexOAuthCredentials): Promise<CodexOAuthCredentials>;
+export declare function isTokenExpired(credentials: CodexOAuthCredentials): boolean;
+export declare class CodexOAuthManager {
+    private readonly projectRoot;
+    private pendingAuth;
+    private refreshPromise;
+    constructor(projectRoot: string);
+    cancelAuthorizationFlow(): void;
+    /** True while a login is in flight (callback server listening). */
+    isPending(): boolean;
+    startAuthorizationFlow(): string;
+    waitForCallback(): Promise<CodexOAuthCredentials>;
+    getAccessToken(): Promise<string | null>;
+    getAccountId(): string | null;
+    getEmail(): string | null;
+    isAuthenticated(): Promise<boolean>;
+    signOut(): void;
+}
+export declare function codexOAuthConnected(projectRoot: string): boolean;
+/**
+ * AgentProvider that drives ChatGPT Codex via the subscription OAuth token.
+ * Streams the Responses SSE and accumulates visible text (reasoning deltas are
+ * dropped from the returned string). Requires a prior `Sign in with ChatGPT`.
+ */
+export declare class CodexOAuthProvider implements AgentProvider {
+    readonly name: "openai";
+    private readonly manager;
+    private readonly projectRoot;
+    private readonly defaultModel;
+    private readonly cliModel?;
+    private readonly sessionId;
+    private cliFallback?;
+    constructor(opts: {
+        projectRoot: string;
+        model?: string;
+    });
+    available(): Promise<boolean>;
+    generate(messages: AgentMessage[], options?: ProviderRunOptions): Promise<string>;
+}
+//# sourceMappingURL=codex-oauth.d.ts.map

package/dist/providers/oauth/codex-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oauth.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/codex-oauth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;CAOrB,CAAC;AAIX,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,gFAAiF,CAAC;AACjH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAalF;AA2BD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAQxG;AAkBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2B9G;AAED,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwB3G;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAG1E;AAED,qBAAa,iBAAiB;IAIhB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAHxC,OAAO,CAAC,WAAW,CAA6G;IAChI,OAAO,CAAC,cAAc,CAA+C;gBAExC,WAAW,EAAE,MAAM;IAEhD,uBAAuB,IAAI,IAAI;IAW/B,mEAAmE;IACnE,SAAS,IAAI,OAAO;IAIpB,sBAAsB,IAAI,MAAM;IAS1B,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAyDjD,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiB9C,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,QAAQ,IAAI,MAAM,GAAG,IAAI;IAInB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAIzC,OAAO,IAAI,IAAI;CAIhB;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEhE;AA+BD;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,WAAW,CAAC,CAAmB;gBAE3B,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAQnD,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;CAsE5F"}