@evalops/maestro 0.10.8 → 0.10.10

package/dist/oauth/evalops.js

@@ -1,5 +1,8 @@
 import { createServer, } from "node:http";
+import { PLATFORM_HTTP_ROUTES } from "../platform/core-services.js";
+import { fetchDownstream } from "../utils/downstream-http.js";
 import { createLogger } from "../utils/logger.js";
+import { buildDesktopDeviceProof, enrollDesktopDeviceIdentity, } from "./device-identity.js";
 import { loadOAuthCredentials, saveOAuthCredentials, } from "./storage.js";
 const logger = createLogger("oauth:evalops");
 const CALLBACK_PORT = 1460;
@@ -7,8 +10,19 @@ const CALLBACK_PATH = "/auth/callback/evalops";
 const CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;
 const CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;
 const DEFAULT_IDENTITY_URL = "http://127.0.0.1:8080";
+const IDENTITY_BASE_URL_ENV_VARS = [
+    "MAESTRO_IDENTITY_URL",
+    "EVALOPS_IDENTITY_URL",
+];
+const SHARED_PLATFORM_BASE_URL_ENV_VARS = [
+    "MAESTRO_PLATFORM_BASE_URL",
+    "MAESTRO_EVALOPS_BASE_URL",
+    "EVALOPS_BASE_URL",
+];
 const DEFAULT_PROVIDER_REF_PROVIDER = "openai";
 const DEFAULT_PROVIDER_REF_ENVIRONMENT = "prod";
+const DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;
+const DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;
 const REQUIRED_SCOPE = "llm_gateway:invoke";
 function getEnvValue(names) {
     for (const name of names) {
@@ -19,19 +33,51 @@ function getEnvValue(names) {
     }
     return undefined;
 }
+function parsePositiveInt(value, fallback) {
+    const parsed = Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizeIdentityBaseUrl(baseUrl, suffixes = []) {
+    let normalized = baseUrl.trim().replace(/\/+$/u, "");
+    for (const suffix of suffixes) {
+        if (normalized.endsWith(suffix)) {
+            normalized = normalized.slice(0, -suffix.length).replace(/\/+$/u, "");
+        }
+    }
+    return normalized;
+}
 function getIdentityBaseUrl() {
-    return (getEnvValue(["MAESTRO_IDENTITY_URL", "EVALOPS_IDENTITY_URL"]) ??
-        DEFAULT_IDENTITY_URL).replace(/\/+$/, "");
+    return normalizeIdentityBaseUrl(getEnvValue([
+        ...IDENTITY_BASE_URL_ENV_VARS,
+        ...SHARED_PLATFORM_BASE_URL_ENV_VARS,
+    ]) ?? DEFAULT_IDENTITY_URL, Object.values(PLATFORM_HTTP_ROUTES.identity));
+}
+function getIdentityTimeoutMs() {
+    return parsePositiveInt(getEnvValue([
+        "MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS",
+        "EVALOPS_IDENTITY_TIMEOUT_MS",
+    ]), DEFAULT_IDENTITY_TIMEOUT_MS);
+}
+function getIdentityMaxAttempts() {
+    return parsePositiveInt(getEnvValue([
+        "MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS",
+        "EVALOPS_IDENTITY_MAX_ATTEMPTS",
+    ]), DEFAULT_IDENTITY_MAX_ATTEMPTS);
+}
+function fetchIdentity(identityBaseUrl, path, init) {
+    return fetchDownstream(`${identityBaseUrl}${path}`, init, {
+        serviceName: "EvalOps identity service",
+        failureMode: "required",
+        timeoutMs: getIdentityTimeoutMs(),
+        maxAttempts: getIdentityMaxAttempts(),
+    });
 }
-function getOrganizationId() {
+function getConfiguredOrganizationId() {
     const organizationId = getEnvValue([
         "MAESTRO_EVALOPS_ORG_ID",
         "EVALOPS_ORGANIZATION_ID",
         "MAESTRO_ENTERPRISE_ORG_ID",
     ]);
-    if (!organizationId) {
-        throw new Error("EvalOps login requires MAESTRO_EVALOPS_ORG_ID or EVALOPS_ORGANIZATION_ID.");
-    }
     return organizationId;
 }
 function getProviderRef() {
@@ -135,7 +181,12 @@ function resolveStoredEvalOpsMetadata(metadata) {
     return stored?.metadata;
 }
 function resolveDelegationOrganizationId(metadata) {
-    return getMetadataString(metadata, "organizationId") ?? getOrganizationId();
+    const organizationId = getMetadataString(metadata, "organizationId") ??
+        getConfiguredOrganizationId();
+    if (!organizationId) {
+        throw new Error("EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.");
+    }
+    return organizationId;
 }
 async function getFreshEvalOpsAccessToken(metadata) {
     const credentials = loadOAuthCredentials("evalops");
@@ -175,11 +226,12 @@ export function buildEvalOpsDelegationEnvironment(result) {
 export async function issueEvalOpsDelegationToken(request) {
     const metadata = resolveStoredEvalOpsMetadata(request.metadata);
     const identityBaseUrl = getMetadataString(metadata, "identityBaseUrl") ?? getIdentityBaseUrl();
+    const deviceProof = await buildDesktopDeviceProof(identityBaseUrl, "delegation");
     const token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));
     if (!token) {
         throw new Error("EvalOps delegation requires a valid access token. Run /login evalops first.");
     }
-    const response = await fetch(`${identityBaseUrl}/v1/delegation-tokens`, {
+    const response = await fetchIdentity(identityBaseUrl, PLATFORM_HTTP_ROUTES.identity.delegationTokens, {
         method: "POST",
         headers: {
             Authorization: `Bearer ${token}`,
@@ -193,6 +245,7 @@ export async function issueEvalOpsDelegationToken(request) {
                 : {}),
             run_id: request.runId,
             ...(request.scopes?.length ? { scopes: request.scopes } : {}),
+            ...(deviceProof ? { device_proof: deviceProof } : {}),
             surface: request.surface,
             ...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),
         }),
@@ -297,13 +350,13 @@ function closeServer(server) {
 }
 async function startIdentityLogin(identityBaseUrl, organizationId, onStatus) {
     onStatus?.("Requesting EvalOps managed login URL...");
-    const response = await fetch(`${identityBaseUrl}/v1/auth/google/start`, {
+    const response = await fetchIdentity(identityBaseUrl, PLATFORM_HTTP_ROUTES.identity.authGoogleStart, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
             redirect_uri: CALLBACK_URI,
             response_mode: "query",
-            organization_id: organizationId,
+            ...(organizationId ? { organization_id: organizationId } : {}),
             prompt: "select_account",
             scopes: [REQUIRED_SCOPE],
         }),
@@ -325,7 +378,7 @@ async function startIdentityLogin(identityBaseUrl, organizationId, onStatus) {
 }
 export async function loginEvalOps(onAuthUrl, onStatus) {
     const identityBaseUrl = getIdentityBaseUrl();
-    const organizationId = getOrganizationId();
+    const organizationId = getConfiguredOrganizationId();
     const providerRef = getProviderRef();
     const { server, getResult } = await startCallbackServer();
     try {
@@ -338,6 +391,7 @@ export async function loginEvalOps(onAuthUrl, onStatus) {
                 setTimeout(() => reject(new Error("EvalOps login timed out after 5 minutes")), 5 * 60 * 1000);
             }),
         ]);
+        const deviceId = await enrollDesktopDeviceIdentity(identityBaseUrl, result.accessToken, process.env.npm_package_version);
         const credentials = {
             type: "oauth",
             access: result.accessToken,
@@ -347,6 +401,7 @@ export async function loginEvalOps(onAuthUrl, onStatus) {
                 identityBaseUrl,
                 organizationId: result.organizationId,
                 providerRef,
+                ...(deviceId ? { deviceId } : {}),
                 ...(result.refreshExpiresAt
                     ? { refreshExpiresAt: result.refreshExpiresAt }
                     : {}),
@@ -369,10 +424,14 @@ export async function refreshEvalOpsToken(refreshToken, metadata) {
         throw new Error("EvalOps refresh token missing. Run /login evalops again.");
     }
     const identityBaseUrl = getMetadataString(metadata, "identityBaseUrl") ?? getIdentityBaseUrl();
-    const response = await fetch(`${identityBaseUrl}/v1/tokens/refresh`, {
+    const deviceProof = await buildDesktopDeviceProof(identityBaseUrl, "refresh");
+    const response = await fetchIdentity(identityBaseUrl, PLATFORM_HTTP_ROUTES.identity.tokenRefresh, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refresh_token: refreshToken }),
+        body: JSON.stringify({
+            refresh_token: refreshToken,
+            ...(deviceProof ? { device_proof: deviceProof } : {}),
+        }),
     });
     let payload;
     try {
@@ -415,7 +474,7 @@ export async function revokeEvalOpsToken(refreshToken, metadata) {
         return;
     }
     const identityBaseUrl = getMetadataString(metadata, "identityBaseUrl") ?? getIdentityBaseUrl();
-    const response = await fetch(`${identityBaseUrl}/v1/tokens/revoke`, {
+    const response = await fetchIdentity(identityBaseUrl, PLATFORM_HTTP_ROUTES.identity.tokenRevoke, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refresh_token: refreshToken }),

package/dist/oauth/evalops.js.map

@@ -1 +1 @@
-{"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,CACN,WAAW,CAAC,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;QAC7D,oBAAoB,CACpB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB;IACzB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,2EAA2E,CAC3E,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,iBAAiB,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,uBAAuB,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,QAAQ,CAAC;QACzD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAsB,EACtB,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,uBAAuB,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,cAAc;YAC/B,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,UAAU,CACT,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;YACH,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,oBAAoB,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC,CAAC;IAEH,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEpD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,mBAAmB,EAAE;QACnE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CAAC,CAAC;IAEH,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"http://127.0.0.1:8080\";\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn (\n\t\tgetEnvValue([\"MAESTRO_IDENTITY_URL\", \"EVALOPS_IDENTITY_URL\"]) ??\n\t\tDEFAULT_IDENTITY_URL\n\t).replace(/\\/+$/, \"\");\n}\n\nfunction getOrganizationId(): string {\n\tconst organizationId = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps login requires MAESTRO_EVALOPS_ORG_ID or EVALOPS_ORGANIZATION_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\treturn getMetadataString(metadata, \"organizationId\") ?? getOrganizationId();\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst response = await fetch(`${identityBaseUrl}/v1/delegation-tokens`, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t},\n\t\tbody: JSON.stringify({\n\t\t\tagent_id: request.agentId,\n\t\t\tagent_type: request.agentType,\n\t\t\t...(request.capabilities?.length\n\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t: {}),\n\t\t\trun_id: request.runId,\n\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\tsurface: request.surface,\n\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t}),\n\t});\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(metadata),\n\t\tproviderRef: resolveProviderRef(metadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetch(`${identityBaseUrl}/v1/auth/google/start`, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\tbody: JSON.stringify({\n\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\tresponse_mode: \"query\",\n\t\t\torganization_id: organizationId,\n\t\t\tprompt: \"select_account\",\n\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t}),\n\t});\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tsetTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t}),\n\t\t]);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetch(`${identityBaseUrl}/v1/tokens/refresh`, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t});\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetch(`${identityBaseUrl}/v1/tokens/revoke`, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t});\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}
+{"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,0BAA0B,GAAG;IAClC,sBAAsB;IACtB,sBAAsB;CACb,CAAC;AACX,MAAM,iCAAiC,GAAG;IACzC,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AACX,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAe,EACf,WAA8B,EAAE;IAEhC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,wBAAwB,CAC9B,WAAW,CAAC;QACX,GAAG,0BAA0B;QAC7B,GAAG,iCAAiC;KACpC,CAAC,IAAI,oBAAoB,EAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC5B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,qCAAqC;QACrC,6BAA6B;KAC7B,CAAC,EACF,2BAA2B,CAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC9B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,uCAAuC;QACvC,+BAA+B;KAC/B,CAAC,EACF,6BAA6B,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,eAAuB,EACvB,IAAY,EACZ,IAAiB;IAEjB,OAAO,eAAe,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;QACzD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,oBAAoB,EAAE;QACjC,WAAW,EAAE,sBAAsB,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IACnC,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,MAAM,cAAc,GACnB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC7C,2BAA2B,EAAE,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAChD,eAAe,EACf,YAAY,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,QAAQ,CAAC;QACzD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAkC,EAClC,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,eAAe,EAC7C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,2BAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,UAAU,CACT,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;YACH,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CACjD,eAAe,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC;QAEF,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAC1C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEpD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,WAAW,EACzC;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CACD,CAAC;IAEF,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tbuildDesktopDeviceProof,\n\tenrollDesktopDeviceIdentity,\n} from \"./device-identity.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"http://127.0.0.1:8080\";\nconst IDENTITY_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_IDENTITY_URL\",\n\t\"EVALOPS_IDENTITY_URL\",\n] as const;\nconst SHARED_PLATFORM_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;\nconst DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeIdentityBaseUrl(\n\tbaseUrl: string,\n\tsuffixes: readonly string[] = [],\n): string {\n\tlet normalized = baseUrl.trim().replace(/\\/+$/u, \"\");\n\tfor (const suffix of suffixes) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length).replace(/\\/+$/u, \"\");\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn normalizeIdentityBaseUrl(\n\t\tgetEnvValue([\n\t\t\t...IDENTITY_BASE_URL_ENV_VARS,\n\t\t\t...SHARED_PLATFORM_BASE_URL_ENV_VARS,\n\t\t]) ?? DEFAULT_IDENTITY_URL,\n\t\tObject.values(PLATFORM_HTTP_ROUTES.identity),\n\t);\n}\n\nfunction getIdentityTimeoutMs(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t\t\"EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_TIMEOUT_MS,\n\t);\n}\n\nfunction getIdentityMaxAttempts(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t\t\"EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_MAX_ATTEMPTS,\n\t);\n}\n\nfunction fetchIdentity(\n\tidentityBaseUrl: string,\n\tpath: string,\n\tinit: RequestInit,\n): Promise<Response> {\n\treturn fetchDownstream(`${identityBaseUrl}${path}`, init, {\n\t\tserviceName: \"EvalOps identity service\",\n\t\tfailureMode: \"required\",\n\t\ttimeoutMs: getIdentityTimeoutMs(),\n\t\tmaxAttempts: getIdentityMaxAttempts(),\n\t});\n}\n\nfunction getConfiguredOrganizationId(): string | undefined {\n\tconst organizationId = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\tconst organizationId =\n\t\tgetMetadataString(metadata, \"organizationId\") ??\n\t\tgetConfiguredOrganizationId();\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(\n\t\tidentityBaseUrl,\n\t\t\"delegation\",\n\t);\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.delegationTokens,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tagent_id: request.agentId,\n\t\t\t\tagent_type: request.agentType,\n\t\t\t\t...(request.capabilities?.length\n\t\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t\t: {}),\n\t\t\t\trun_id: request.runId,\n\t\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t\tsurface: request.surface,\n\t\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(metadata),\n\t\tproviderRef: resolveProviderRef(metadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string | undefined,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.authGoogleStart,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\t\tresponse_mode: \"query\",\n\t\t\t\t...(organizationId ? { organization_id: organizationId } : {}),\n\t\t\t\tprompt: \"select_account\",\n\t\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getConfiguredOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tsetTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t}),\n\t\t]);\n\n\t\tconst deviceId = await enrollDesktopDeviceIdentity(\n\t\t\tidentityBaseUrl,\n\t\t\tresult.accessToken,\n\t\t\tprocess.env.npm_package_version,\n\t\t);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(deviceId ? { deviceId } : {}),\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(identityBaseUrl, \"refresh\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRefresh,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRevoke,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t\t},\n\t);\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}

package/dist/oauth/index.d.ts

@@ -4,7 +4,7 @@ import { listOAuthProviders as listOAuthProvidersFromStorage } from "./storage.j
 export { listOAuthProvidersFromStorage as listOAuthProviders };
 export type { OAuthCredentials } from "./storage.js";
 export { buildEvalOpsDelegationEnvironment, issueEvalOpsDelegationToken };
-export type SupportedOAuthProvider = "anthropic" | "evalops" | "openai" | "github-copilot" | "google-gemini-cli" | "google-antigravity";
+export type SupportedOAuthProvider = "anthropic" | "evalops" | "openai" | "openai-codex" | "github-copilot" | "google-gemini-cli" | "google-antigravity";
 export interface OAuthProviderInfo {
     id: SupportedOAuthProvider;
     name: string;

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAWzE,OAAO,EACN,iCAAiC,EACjC,2BAA2B,EAI3B,MAAM,cAAc,CAAC;AAmBtB,OAAO,EAEN,kBAAkB,IAAI,6BAA6B,EAInD,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,6BAA6B,IAAI,kBAAkB,EAAE,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAC/B,WAAW,GACX,SAAS,GACT,QAAQ,GACR,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,CAAC;AAExB,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,sBAAsB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,EAAE,CAuCvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAE7E;AAED;;GAEG;AACH,wBAAsB,KAAK,CAC1B,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE;IACR,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/D,GACC,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E;AAED;;GAEG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAClC,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBxB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkB7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAgBzE,OAAO,EACN,iCAAiC,EACjC,2BAA2B,EAI3B,MAAM,cAAc,CAAC;AAoBtB,OAAO,EAEN,kBAAkB,IAAI,6BAA6B,EAInD,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,6BAA6B,IAAI,kBAAkB,EAAE,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAC/B,WAAW,GACX,SAAS,GACT,QAAQ,GACR,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,CAAC;AAExB,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,sBAAsB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,EAAE,CA6CvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAE7E;AAED;;GAEG;AACH,wBAAsB,KAAK,CAC1B,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE;IACR,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/D,GACC,OAAO,CAAC,IAAI,CAAC,CAuDf;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5E;AAED;;GAEG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAClC,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBxB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkB7D"}

package/dist/oauth/index.js

@@ -1,10 +1,12 @@
 import { assertEvalOpsManagedGatewayEnabled, isEvalOpsManagedGatewayEnabled, } from "../providers/evalops-managed.js";
 import { createLogger } from "../utils/logger.js";
 import { loginAnthropic, migrateAnthropicCredentials, refreshAnthropicToken, } from "./anthropic.js";
+import { revokeOAuthProviderConnection, syncOAuthProviderConnection, syncStoredOAuthProviderConnection, } from "./connectors.js";
 import { buildEvalOpsDelegationEnvironment, issueEvalOpsDelegationToken, loginEvalOps, refreshEvalOpsToken, revokeEvalOpsToken, } from "./evalops.js";
 import { loginGitHubCopilot, migrateGitHubCopilotCredentials, refreshGitHubCopilotToken, } from "./github-copilot.js";
 import { loginGoogleAntigravity, refreshGoogleAntigravityToken, } from "./google-antigravity.js";
 import { loginGoogleGeminiCli, refreshGoogleGeminiCliToken, } from "./google-gemini-cli.js";
+import { loginOpenAICodex, refreshOpenAICodexToken } from "./openai-codex.js";
 import { loginOpenAI, migrateOpenAICredentials, refreshOpenAIToken, } from "./openai.js";
 import { listOAuthProviders as listOAuthProvidersFromStorage, loadOAuthCredentials, removeOAuthCredentials, saveOAuthCredentials, } from "./storage.js";
 const logger = createLogger("oauth");
@@ -31,7 +33,13 @@ export function getOAuthProviders() {
         {
             id: "openai",
             name: "OpenAI",
-            description: "ChatGPT Plus subscription",
+            description: "OpenAI Platform API via ChatGPT login",
+            available: true,
+        },
+        {
+            id: "openai-codex",
+            name: "OpenAI Codex",
+            description: "Codex with ChatGPT Plus/Pro login",
             available: true,
         },
         {
@@ -64,15 +72,22 @@ export function hasOAuthCredentials(provider) {
  * Login with OAuth provider
  */
 export async function login(provider, options) {
+    let shouldSyncConnectorConnection = false;
     switch (provider) {
         case "anthropic":
             if (!options.onPromptCode) {
                 throw new Error("Anthropic login requires onPromptCode callback for auth code input");
             }
             await loginAnthropic(options.mode ?? "pro", options.onAuthUrl, options.onPromptCode);
+            shouldSyncConnectorConnection = true;
             break;
         case "openai":
             await loginOpenAI(options.onAuthUrl, options.onStatus);
+            shouldSyncConnectorConnection = true;
+            break;
+        case "openai-codex":
+            await loginOpenAICodex(options.onAuthUrl, options.onPromptCode, options.onStatus);
+            shouldSyncConnectorConnection = true;
             break;
         case "evalops":
             assertEvalOpsManagedGatewayEnabled();
@@ -80,19 +95,25 @@ export async function login(provider, options) {
             break;
         case "google-gemini-cli":
             await loginGoogleGeminiCli(options.onAuthUrl, options.onStatus);
+            shouldSyncConnectorConnection = true;
             break;
         case "google-antigravity":
             await loginGoogleAntigravity(options.onAuthUrl, options.onStatus);
+            shouldSyncConnectorConnection = true;
             break;
         case "github-copilot":
             if (!options.onDeviceCode) {
                 throw new Error("GitHub Copilot requires onDeviceCode callback for device flow");
             }
             await loginGitHubCopilot(options.onDeviceCode, options.onStatus);
+            shouldSyncConnectorConnection = true;
             break;
         default:
             throw new Error(`Unknown OAuth provider: ${provider}`);
     }
+    if (shouldSyncConnectorConnection) {
+        await syncStoredOAuthProviderConnection(provider);
+    }
 }
 /**
  * Logout from OAuth provider
@@ -110,6 +131,9 @@ export async function logout(provider) {
             });
         }
     }
+    if (provider !== "evalops") {
+        await revokeOAuthProviderConnection(provider, credentials);
+    }
     removeOAuthCredentials(provider);
 }
 /**
@@ -128,6 +152,9 @@ export async function refreshToken(provider) {
         case "openai":
             newCredentials = await refreshOpenAIToken(credentials.refresh, credentials.metadata);
             break;
+        case "openai-codex":
+            newCredentials = await refreshOpenAICodexToken(credentials.refresh, credentials.metadata);
+            break;
         case "evalops":
             newCredentials = await refreshEvalOpsToken(credentials.refresh, credentials.metadata);
             break;
@@ -143,6 +170,9 @@ export async function refreshToken(provider) {
         default:
             throw new Error(`Unknown OAuth provider: ${provider}`);
     }
+    if (provider !== "evalops") {
+        newCredentials = await syncOAuthProviderConnection(provider, newCredentials);
+    }
     // Save new credentials
     saveOAuthCredentials(provider, newCredentials);
     return newCredentials.access;

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EACN,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,iCAAiC,EACjC,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,+BAA+B,EAC/B,yBAAyB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,oBAAoB,EACpB,2BAA2B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,WAAW,EACX,wBAAwB,EACxB,kBAAkB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEN,kBAAkB,IAAI,6BAA6B,EACnD,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EAAE,6BAA6B,IAAI,kBAAkB,EAAE,CAAC;AAE/D,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;AAiB1E;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO;QACN;YACC,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,6BAA6B;YAC1C,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,wCAAwC;YACrD,SAAS,EAAE,8BAA8B,EAAE;SAC3C;QACD;YACC,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,2BAA2B;YACxC,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,oBAAoB;YACxB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,2BAA2B;YACxC,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,6BAA6B;YAC1C,SAAS,EAAE,IAAI;SACf;KACD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgC;IACnE,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,QAAgC,EAChC,OAMC;IAED,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,WAAW;YACf,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACd,oEAAoE,CACpE,CAAC;YACH,CAAC;YACD,MAAM,cAAc,CACnB,OAAO,CAAC,IAAI,IAAI,KAAK,EACrB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,CACpB,CAAC;YACF,MAAM;QACP,KAAK,QAAQ;YACZ,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM;QACP,KAAK,SAAS;YACb,kCAAkC,EAAE,CAAC;YACrC,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM;QACP,KAAK,mBAAmB;YACvB,MAAM,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM;QACP,KAAK,oBAAoB;YACxB,MAAM,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM;QACP,KAAK,gBAAgB;YACpB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM;QACP;YACC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgC;IAC5D,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC;YACJ,MAAM,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,QAAQ;aACR,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,QAAgC;IAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,cAAgC,CAAC;IAErC,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,WAAW;YACf,cAAc,GAAG,MAAM,qBAAqB,CAC3C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,QAAQ;YACZ,cAAc,GAAG,MAAM,kBAAkB,CACxC,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,SAAS;YACb,cAAc,GAAG,MAAM,mBAAmB,CACzC,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,mBAAmB;YACvB,cAAc,GAAG,MAAM,2BAA2B,CACjD,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,oBAAoB;YACxB,cAAc,GAAG,MAAM,6BAA6B,CACnD,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,gBAAgB;YACpB,cAAc,GAAG,MAAM,yBAAyB,CAC/C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP;YACC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,uBAAuB;IACvB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE/C,OAAO,cAAc,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,QAAgC;IAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAChD,8CAA8C;QAC9C,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CACX,+BAA+B,EAC/B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,EAAE,QAAQ,EAAE,CACZ,CAAC;YACF,6BAA6B;YAC7B,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC5C,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC9D,IAAI,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;IAED,6BAA6B;IAC7B,MAAM,cAAc,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACxD,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,+BAA+B,EAAE,CAAC;IAChE,IAAI,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;AACF,CAAC","sourcesContent":["import type { AnthropicLoginMode } from \"../providers/anthropic-auth.js\";\nimport {\n\tassertEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedGatewayEnabled,\n} from \"../providers/evalops-managed.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tloginAnthropic,\n\tmigrateAnthropicCredentials,\n\trefreshAnthropicToken,\n} from \"./anthropic.js\";\nimport {\n\tbuildEvalOpsDelegationEnvironment,\n\tissueEvalOpsDelegationToken,\n\tloginEvalOps,\n\trefreshEvalOpsToken,\n\trevokeEvalOpsToken,\n} from \"./evalops.js\";\nimport {\n\tloginGitHubCopilot,\n\tmigrateGitHubCopilotCredentials,\n\trefreshGitHubCopilotToken,\n} from \"./github-copilot.js\";\nimport {\n\tloginGoogleAntigravity,\n\trefreshGoogleAntigravityToken,\n} from \"./google-antigravity.js\";\nimport {\n\tloginGoogleGeminiCli,\n\trefreshGoogleGeminiCliToken,\n} from \"./google-gemini-cli.js\";\nimport {\n\tloginOpenAI,\n\tmigrateOpenAICredentials,\n\trefreshOpenAIToken,\n} from \"./openai.js\";\nimport {\n\ttype OAuthCredentials,\n\tlistOAuthProviders as listOAuthProvidersFromStorage,\n\tloadOAuthCredentials,\n\tremoveOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth\");\n\n// Re-export for convenience\nexport { listOAuthProvidersFromStorage as listOAuthProviders };\nexport type { OAuthCredentials } from \"./storage.js\";\nexport { buildEvalOpsDelegationEnvironment, issueEvalOpsDelegationToken };\n\nexport type SupportedOAuthProvider =\n\t| \"anthropic\"\n\t| \"evalops\"\n\t| \"openai\"\n\t| \"github-copilot\"\n\t| \"google-gemini-cli\"\n\t| \"google-antigravity\";\n\nexport interface OAuthProviderInfo {\n\tid: SupportedOAuthProvider;\n\tname: string;\n\tdescription: string;\n\tavailable: boolean;\n}\n\n/**\n * Get list of OAuth providers\n */\nexport function getOAuthProviders(): OAuthProviderInfo[] {\n\treturn [\n\t\t{\n\t\t\tid: \"anthropic\",\n\t\t\tname: \"Anthropic\",\n\t\t\tdescription: \"Claude Pro/Max subscription\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"evalops\",\n\t\t\tname: \"EvalOps Managed\",\n\t\t\tdescription: \"Identity-backed managed gateway access\",\n\t\t\tavailable: isEvalOpsManagedGatewayEnabled(),\n\t\t},\n\t\t{\n\t\t\tid: \"openai\",\n\t\t\tname: \"OpenAI\",\n\t\t\tdescription: \"ChatGPT Plus subscription\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"google-gemini-cli\",\n\t\t\tname: \"Google Gemini CLI\",\n\t\t\tdescription: \"Cloud Code Assist OAuth\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"google-antigravity\",\n\t\t\tname: \"Google Antigravity\",\n\t\t\tdescription: \"Antigravity sandbox OAuth\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"github-copilot\",\n\t\t\tname: \"GitHub Copilot\",\n\t\t\tdescription: \"GitHub Copilot subscription\",\n\t\t\tavailable: true,\n\t\t},\n\t];\n}\n\n/**\n * Check if a provider has OAuth credentials stored\n */\nexport function hasOAuthCredentials(provider: SupportedOAuthProvider): boolean {\n\treturn loadOAuthCredentials(provider) !== null;\n}\n\n/**\n * Login with OAuth provider\n */\nexport async function login(\n\tprovider: SupportedOAuthProvider,\n\toptions: {\n\t\tmode?: AnthropicLoginMode;\n\t\tonAuthUrl: (url: string) => void;\n\t\tonPromptCode?: () => Promise<string>;\n\t\tonStatus?: (status: string) => void;\n\t\tonDeviceCode?: (code: string, verificationUri: string) => void;\n\t},\n): Promise<void> {\n\tswitch (provider) {\n\t\tcase \"anthropic\":\n\t\t\tif (!options.onPromptCode) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"Anthropic login requires onPromptCode callback for auth code input\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait loginAnthropic(\n\t\t\t\toptions.mode ?? \"pro\",\n\t\t\t\toptions.onAuthUrl,\n\t\t\t\toptions.onPromptCode,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"openai\":\n\t\t\tawait loginOpenAI(options.onAuthUrl, options.onStatus);\n\t\t\tbreak;\n\t\tcase \"evalops\":\n\t\t\tassertEvalOpsManagedGatewayEnabled();\n\t\t\tawait loginEvalOps(options.onAuthUrl, options.onStatus);\n\t\t\tbreak;\n\t\tcase \"google-gemini-cli\":\n\t\t\tawait loginGoogleGeminiCli(options.onAuthUrl, options.onStatus);\n\t\t\tbreak;\n\t\tcase \"google-antigravity\":\n\t\t\tawait loginGoogleAntigravity(options.onAuthUrl, options.onStatus);\n\t\t\tbreak;\n\t\tcase \"github-copilot\":\n\t\t\tif (!options.onDeviceCode) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"GitHub Copilot requires onDeviceCode callback for device flow\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait loginGitHubCopilot(options.onDeviceCode, options.onStatus);\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown OAuth provider: ${provider}`);\n\t}\n}\n\n/**\n * Logout from OAuth provider\n */\nexport async function logout(provider: SupportedOAuthProvider): Promise<void> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (provider === \"evalops\" && credentials?.refresh) {\n\t\ttry {\n\t\t\tawait revokeEvalOpsToken(credentials.refresh, credentials.metadata);\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to revoke EvalOps refresh token during logout\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\tprovider,\n\t\t\t});\n\t\t}\n\t}\n\tremoveOAuthCredentials(provider);\n}\n\n/**\n * Refresh OAuth token for provider\n */\nexport async function refreshToken(\n\tprovider: SupportedOAuthProvider,\n): Promise<string> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\n\tlet newCredentials: OAuthCredentials;\n\n\tswitch (provider) {\n\t\tcase \"anthropic\":\n\t\t\tnewCredentials = await refreshAnthropicToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"openai\":\n\t\t\tnewCredentials = await refreshOpenAIToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"evalops\":\n\t\t\tnewCredentials = await refreshEvalOpsToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"google-gemini-cli\":\n\t\t\tnewCredentials = await refreshGoogleGeminiCliToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"google-antigravity\":\n\t\t\tnewCredentials = await refreshGoogleAntigravityToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"github-copilot\":\n\t\t\tnewCredentials = await refreshGitHubCopilotToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown OAuth provider: ${provider}`);\n\t}\n\n\t// Save new credentials\n\tsaveOAuthCredentials(provider, newCredentials);\n\n\treturn newCredentials.access;\n}\n\n/**\n * Get OAuth token for provider (auto-refreshes if expired)\n */\nexport async function getOAuthToken(\n\tprovider: SupportedOAuthProvider,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\n\t// Check if token is expired (with 1 min buffer)\n\tif (Date.now() >= credentials.expires - 60_000) {\n\t\t// Token expired or expiring soon - refresh it\n\t\ttry {\n\t\t\treturn await refreshToken(provider);\n\t\t} catch (error) {\n\t\t\tlogger.error(\n\t\t\t\t\"Failed to refresh OAuth token\",\n\t\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t\t\t{ provider },\n\t\t\t);\n\t\t\t// Remove invalid credentials\n\t\t\tremoveOAuthCredentials(provider);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\treturn credentials.access;\n}\n\n/**\n * Migrate old provider-specific OAuth credentials to new generic format\n */\nexport async function migrateOAuthCredentials(): Promise<void> {\n\t// Migrate Anthropic credentials\n\tconst anthropicMigrated = await migrateAnthropicCredentials();\n\tif (anthropicMigrated) {\n\t\tlogger.info(\"Migrated Anthropic OAuth credentials to new format\");\n\t}\n\n\t// Migrate OpenAI credentials\n\tconst openaiMigrated = await migrateOpenAICredentials();\n\tif (openaiMigrated) {\n\t\tlogger.info(\"Migrated OpenAI OAuth credentials to new format\");\n\t}\n\n\t// Migrate GitHub Copilot credentials from environment\n\tconst copilotMigrated = await migrateGitHubCopilotCredentials();\n\tif (copilotMigrated) {\n\t\tlogger.info(\"Migrated GitHub Copilot credentials from environment\");\n\t}\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EACN,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,6BAA6B,EAC7B,2BAA2B,EAC3B,iCAAiC,GACjC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,iCAAiC,EACjC,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,+BAA+B,EAC/B,yBAAyB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,oBAAoB,EACpB,2BAA2B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACN,WAAW,EACX,wBAAwB,EACxB,kBAAkB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEN,kBAAkB,IAAI,6BAA6B,EACnD,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EAAE,6BAA6B,IAAI,kBAAkB,EAAE,CAAC;AAE/D,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;AAkB1E;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO;QACN;YACC,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,6BAA6B;YAC1C,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,wCAAwC;YACrD,SAAS,EAAE,8BAA8B,EAAE;SAC3C;QACD;YACC,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,uCAAuC;YACpD,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,mCAAmC;YAChD,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,oBAAoB;YACxB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,2BAA2B;YACxC,SAAS,EAAE,IAAI;SACf;QACD;YACC,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,6BAA6B;YAC1C,SAAS,EAAE,IAAI;SACf;KACD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgC;IACnE,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,QAAgC,EAChC,OAMC;IAED,IAAI,6BAA6B,GAAG,KAAK,CAAC;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,WAAW;YACf,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACd,oEAAoE,CACpE,CAAC;YACH,CAAC;YACD,MAAM,cAAc,CACnB,OAAO,CAAC,IAAI,IAAI,KAAK,EACrB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,CACpB,CAAC;YACF,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP,KAAK,QAAQ;YACZ,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvD,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP,KAAK,cAAc;YAClB,MAAM,gBAAgB,CACrB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,QAAQ,CAChB,CAAC;YACF,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP,KAAK,SAAS;YACb,kCAAkC,EAAE,CAAC;YACrC,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM;QACP,KAAK,mBAAmB;YACvB,MAAM,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP,KAAK,oBAAoB;YACxB,MAAM,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClE,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP,KAAK,gBAAgB;YACpB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjE,6BAA6B,GAAG,IAAI,CAAC;YACrC,MAAM;QACP;YACC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,6BAA6B,EAAE,CAAC;QACnC,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgC;IAC5D,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC;YACJ,MAAM,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,QAAQ;aACR,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IACD,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,QAAgC;IAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,cAAgC,CAAC;IAErC,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,WAAW;YACf,cAAc,GAAG,MAAM,qBAAqB,CAC3C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,QAAQ;YACZ,cAAc,GAAG,MAAM,kBAAkB,CACxC,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,cAAc;YAClB,cAAc,GAAG,MAAM,uBAAuB,CAC7C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,SAAS;YACb,cAAc,GAAG,MAAM,mBAAmB,CACzC,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,mBAAmB;YACvB,cAAc,GAAG,MAAM,2BAA2B,CACjD,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,oBAAoB;YACxB,cAAc,GAAG,MAAM,6BAA6B,CACnD,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP,KAAK,gBAAgB;YACpB,cAAc,GAAG,MAAM,yBAAyB,CAC/C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM;QACP;YACC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,cAAc,GAAG,MAAM,2BAA2B,CACjD,QAAQ,EACR,cAAc,CACd,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE/C,OAAO,cAAc,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,QAAgC;IAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAChD,8CAA8C;QAC9C,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CACX,+BAA+B,EAC/B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,EAAE,QAAQ,EAAE,CACZ,CAAC;YACF,6BAA6B;YAC7B,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC5C,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC9D,IAAI,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;IAED,6BAA6B;IAC7B,MAAM,cAAc,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACxD,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,+BAA+B,EAAE,CAAC;IAChE,IAAI,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;AACF,CAAC","sourcesContent":["import type { AnthropicLoginMode } from \"../providers/anthropic-auth.js\";\nimport {\n\tassertEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedGatewayEnabled,\n} from \"../providers/evalops-managed.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tloginAnthropic,\n\tmigrateAnthropicCredentials,\n\trefreshAnthropicToken,\n} from \"./anthropic.js\";\nimport {\n\trevokeOAuthProviderConnection,\n\tsyncOAuthProviderConnection,\n\tsyncStoredOAuthProviderConnection,\n} from \"./connectors.js\";\nimport {\n\tbuildEvalOpsDelegationEnvironment,\n\tissueEvalOpsDelegationToken,\n\tloginEvalOps,\n\trefreshEvalOpsToken,\n\trevokeEvalOpsToken,\n} from \"./evalops.js\";\nimport {\n\tloginGitHubCopilot,\n\tmigrateGitHubCopilotCredentials,\n\trefreshGitHubCopilotToken,\n} from \"./github-copilot.js\";\nimport {\n\tloginGoogleAntigravity,\n\trefreshGoogleAntigravityToken,\n} from \"./google-antigravity.js\";\nimport {\n\tloginGoogleGeminiCli,\n\trefreshGoogleGeminiCliToken,\n} from \"./google-gemini-cli.js\";\nimport { loginOpenAICodex, refreshOpenAICodexToken } from \"./openai-codex.js\";\nimport {\n\tloginOpenAI,\n\tmigrateOpenAICredentials,\n\trefreshOpenAIToken,\n} from \"./openai.js\";\nimport {\n\ttype OAuthCredentials,\n\tlistOAuthProviders as listOAuthProvidersFromStorage,\n\tloadOAuthCredentials,\n\tremoveOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth\");\n\n// Re-export for convenience\nexport { listOAuthProvidersFromStorage as listOAuthProviders };\nexport type { OAuthCredentials } from \"./storage.js\";\nexport { buildEvalOpsDelegationEnvironment, issueEvalOpsDelegationToken };\n\nexport type SupportedOAuthProvider =\n\t| \"anthropic\"\n\t| \"evalops\"\n\t| \"openai\"\n\t| \"openai-codex\"\n\t| \"github-copilot\"\n\t| \"google-gemini-cli\"\n\t| \"google-antigravity\";\n\nexport interface OAuthProviderInfo {\n\tid: SupportedOAuthProvider;\n\tname: string;\n\tdescription: string;\n\tavailable: boolean;\n}\n\n/**\n * Get list of OAuth providers\n */\nexport function getOAuthProviders(): OAuthProviderInfo[] {\n\treturn [\n\t\t{\n\t\t\tid: \"anthropic\",\n\t\t\tname: \"Anthropic\",\n\t\t\tdescription: \"Claude Pro/Max subscription\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"evalops\",\n\t\t\tname: \"EvalOps Managed\",\n\t\t\tdescription: \"Identity-backed managed gateway access\",\n\t\t\tavailable: isEvalOpsManagedGatewayEnabled(),\n\t\t},\n\t\t{\n\t\t\tid: \"openai\",\n\t\t\tname: \"OpenAI\",\n\t\t\tdescription: \"OpenAI Platform API via ChatGPT login\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"openai-codex\",\n\t\t\tname: \"OpenAI Codex\",\n\t\t\tdescription: \"Codex with ChatGPT Plus/Pro login\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"google-gemini-cli\",\n\t\t\tname: \"Google Gemini CLI\",\n\t\t\tdescription: \"Cloud Code Assist OAuth\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"google-antigravity\",\n\t\t\tname: \"Google Antigravity\",\n\t\t\tdescription: \"Antigravity sandbox OAuth\",\n\t\t\tavailable: true,\n\t\t},\n\t\t{\n\t\t\tid: \"github-copilot\",\n\t\t\tname: \"GitHub Copilot\",\n\t\t\tdescription: \"GitHub Copilot subscription\",\n\t\t\tavailable: true,\n\t\t},\n\t];\n}\n\n/**\n * Check if a provider has OAuth credentials stored\n */\nexport function hasOAuthCredentials(provider: SupportedOAuthProvider): boolean {\n\treturn loadOAuthCredentials(provider) !== null;\n}\n\n/**\n * Login with OAuth provider\n */\nexport async function login(\n\tprovider: SupportedOAuthProvider,\n\toptions: {\n\t\tmode?: AnthropicLoginMode;\n\t\tonAuthUrl: (url: string) => void;\n\t\tonPromptCode?: () => Promise<string>;\n\t\tonStatus?: (status: string) => void;\n\t\tonDeviceCode?: (code: string, verificationUri: string) => void;\n\t},\n): Promise<void> {\n\tlet shouldSyncConnectorConnection = false;\n\tswitch (provider) {\n\t\tcase \"anthropic\":\n\t\t\tif (!options.onPromptCode) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"Anthropic login requires onPromptCode callback for auth code input\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait loginAnthropic(\n\t\t\t\toptions.mode ?? \"pro\",\n\t\t\t\toptions.onAuthUrl,\n\t\t\t\toptions.onPromptCode,\n\t\t\t);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tcase \"openai\":\n\t\t\tawait loginOpenAI(options.onAuthUrl, options.onStatus);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tcase \"openai-codex\":\n\t\t\tawait loginOpenAICodex(\n\t\t\t\toptions.onAuthUrl,\n\t\t\t\toptions.onPromptCode,\n\t\t\t\toptions.onStatus,\n\t\t\t);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tcase \"evalops\":\n\t\t\tassertEvalOpsManagedGatewayEnabled();\n\t\t\tawait loginEvalOps(options.onAuthUrl, options.onStatus);\n\t\t\tbreak;\n\t\tcase \"google-gemini-cli\":\n\t\t\tawait loginGoogleGeminiCli(options.onAuthUrl, options.onStatus);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tcase \"google-antigravity\":\n\t\t\tawait loginGoogleAntigravity(options.onAuthUrl, options.onStatus);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tcase \"github-copilot\":\n\t\t\tif (!options.onDeviceCode) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"GitHub Copilot requires onDeviceCode callback for device flow\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait loginGitHubCopilot(options.onDeviceCode, options.onStatus);\n\t\t\tshouldSyncConnectorConnection = true;\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown OAuth provider: ${provider}`);\n\t}\n\tif (shouldSyncConnectorConnection) {\n\t\tawait syncStoredOAuthProviderConnection(provider);\n\t}\n}\n\n/**\n * Logout from OAuth provider\n */\nexport async function logout(provider: SupportedOAuthProvider): Promise<void> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (provider === \"evalops\" && credentials?.refresh) {\n\t\ttry {\n\t\t\tawait revokeEvalOpsToken(credentials.refresh, credentials.metadata);\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to revoke EvalOps refresh token during logout\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\tprovider,\n\t\t\t});\n\t\t}\n\t}\n\tif (provider !== \"evalops\") {\n\t\tawait revokeOAuthProviderConnection(provider, credentials);\n\t}\n\tremoveOAuthCredentials(provider);\n}\n\n/**\n * Refresh OAuth token for provider\n */\nexport async function refreshToken(\n\tprovider: SupportedOAuthProvider,\n): Promise<string> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\n\tlet newCredentials: OAuthCredentials;\n\n\tswitch (provider) {\n\t\tcase \"anthropic\":\n\t\t\tnewCredentials = await refreshAnthropicToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"openai\":\n\t\t\tnewCredentials = await refreshOpenAIToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"openai-codex\":\n\t\t\tnewCredentials = await refreshOpenAICodexToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"evalops\":\n\t\t\tnewCredentials = await refreshEvalOpsToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"google-gemini-cli\":\n\t\t\tnewCredentials = await refreshGoogleGeminiCliToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"google-antigravity\":\n\t\t\tnewCredentials = await refreshGoogleAntigravityToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tcase \"github-copilot\":\n\t\t\tnewCredentials = await refreshGitHubCopilotToken(\n\t\t\t\tcredentials.refresh,\n\t\t\t\tcredentials.metadata,\n\t\t\t);\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown OAuth provider: ${provider}`);\n\t}\n\n\tif (provider !== \"evalops\") {\n\t\tnewCredentials = await syncOAuthProviderConnection(\n\t\t\tprovider,\n\t\t\tnewCredentials,\n\t\t);\n\t}\n\n\t// Save new credentials\n\tsaveOAuthCredentials(provider, newCredentials);\n\n\treturn newCredentials.access;\n}\n\n/**\n * Get OAuth token for provider (auto-refreshes if expired)\n */\nexport async function getOAuthToken(\n\tprovider: SupportedOAuthProvider,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\n\t// Check if token is expired (with 1 min buffer)\n\tif (Date.now() >= credentials.expires - 60_000) {\n\t\t// Token expired or expiring soon - refresh it\n\t\ttry {\n\t\t\treturn await refreshToken(provider);\n\t\t} catch (error) {\n\t\t\tlogger.error(\n\t\t\t\t\"Failed to refresh OAuth token\",\n\t\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t\t\t{ provider },\n\t\t\t);\n\t\t\t// Remove invalid credentials\n\t\t\tremoveOAuthCredentials(provider);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\treturn credentials.access;\n}\n\n/**\n * Migrate old provider-specific OAuth credentials to new generic format\n */\nexport async function migrateOAuthCredentials(): Promise<void> {\n\t// Migrate Anthropic credentials\n\tconst anthropicMigrated = await migrateAnthropicCredentials();\n\tif (anthropicMigrated) {\n\t\tlogger.info(\"Migrated Anthropic OAuth credentials to new format\");\n\t}\n\n\t// Migrate OpenAI credentials\n\tconst openaiMigrated = await migrateOpenAICredentials();\n\tif (openaiMigrated) {\n\t\tlogger.info(\"Migrated OpenAI OAuth credentials to new format\");\n\t}\n\n\t// Migrate GitHub Copilot credentials from environment\n\tconst copilotMigrated = await migrateGitHubCopilotCredentials();\n\tif (copilotMigrated) {\n\t\tlogger.info(\"Migrated GitHub Copilot credentials from environment\");\n\t}\n}\n"]}

package/dist/oauth/openai-codex.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OpenAI Codex OAuth integration.
+ *
+ * This is intentionally separate from the OpenAI Platform OAuth flow. Codex
+ * uses the ChatGPT access token directly against the ChatGPT Codex backend,
+ * while the regular OpenAI provider exchanges the login for a Platform API key.
+ */
+import { type OAuthCredentials } from "./storage.js";
+export declare function parseOpenAICodexAuthorizationInput(input: string): {
+    code?: string;
+    state?: string;
+};
+export declare function extractOpenAICodexAccountId(accessToken: string): string | null;
+export declare function loginOpenAICodex(onAuthUrl: (url: string) => void, onPromptCode?: () => Promise<string>, onStatus?: (status: string) => void): Promise<void>;
+export declare function refreshOpenAICodexToken(refreshToken: string, metadata?: Record<string, unknown>): Promise<OAuthCredentials>;
+//# sourceMappingURL=openai-codex.d.ts.map

package/dist/oauth/openai-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-codex.d.ts","sourceRoot":"","sources":["../../src/oauth/openai-codex.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,cAAc,CAAC;AA2E3E,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CA4BA;AAYD,wBAAgB,2BAA2B,CAC1C,WAAW,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAoLD,wBAAsB,gBAAgB,CACrC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACpC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAuDf;AAED,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAU3B"}