@mastra/code-sdk 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/auth/providers/anthropic.js

@@ -0,0 +1,126 @@
+import { parseAuthorizationInput } from "../authorization-input.js";
+import { generatePKCE } from "../pkce.js";
+//#region src/auth/providers/anthropic.ts
+/**
+* Anthropic OAuth flow (Claude Pro/Max)
+*
+* Inspired by pi-mono's OAuth implementation:
+* https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts
+*
+* The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted
+* callback page which displays `code#state` for the user to paste back. That
+* makes it deployable without any inbound connection to the server, so the
+* primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`
+* which can span separate HTTP requests (only the PKCE verifier needs to be
+* persisted in between).
+*/
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
+const REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+const SCOPES = "org:create_api_key user:profile user:inference";
+/**
+* Start an Anthropic login: generate PKCE state and build the authorization URL.
+*/
+async function startAnthropicLogin() {
+	const { verifier, challenge } = await generatePKCE();
+	const authParams = new URLSearchParams({
+		code: "true",
+		client_id: CLIENT_ID,
+		response_type: "code",
+		redirect_uri: REDIRECT_URI,
+		scope: SCOPES,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state: verifier
+	});
+	return {
+		url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+		verifier
+	};
+}
+/**
+* Complete an Anthropic login: parse the pasted authorization input
+* (full URL, `code#state`, or query string), validate its state, and exchange
+* it for tokens using the verifier from `startAnthropicLogin()`.
+*/
+async function completeAnthropicLogin(input, verifier) {
+	const { code, state } = parseAuthorizationInput(input);
+	if (!code) throw new Error("Missing authorization code");
+	if (!state || state !== verifier) throw new Error("Invalid authorization state");
+	const tokenResponse = await fetch(TOKEN_URL, {
+		method: "POST",
+		signal: AbortSignal.timeout(15e3),
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			state,
+			redirect_uri: REDIRECT_URI,
+			code_verifier: verifier
+		})
+	});
+	if (!tokenResponse.ok) {
+		const error = await tokenResponse.text();
+		throw new Error(`Token exchange failed: ${error}`);
+	}
+	const tokenData = await tokenResponse.json();
+	const expiresAt = Date.now() + tokenData.expires_in * 1e3 - 300 * 1e3;
+	return {
+		refresh: tokenData.refresh_token,
+		access: tokenData.access_token,
+		expires: expiresAt
+	};
+}
+/**
+* Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.
+*/
+async function loginAnthropic(onAuthUrl, onPromptCode) {
+	const { url, verifier } = await startAnthropicLogin();
+	onAuthUrl(url);
+	return completeAnthropicLogin(await onPromptCode(), verifier);
+}
+/**
+* Refresh Anthropic OAuth token
+*/
+async function refreshAnthropicToken(refreshToken) {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		signal: AbortSignal.timeout(15e3),
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "refresh_token",
+			client_id: CLIENT_ID,
+			refresh_token: refreshToken
+		})
+	});
+	if (!response.ok) {
+		const error = await response.text();
+		throw new Error(`Anthropic token refresh failed: ${error}`);
+	}
+	const data = await response.json();
+	return {
+		refresh: data.refresh_token,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1e3 - 300 * 1e3
+	};
+}
+const anthropicOAuthProvider = {
+	id: "anthropic",
+	name: "Anthropic (Claude Pro/Max)",
+	async login(callbacks) {
+		return loginAnthropic((url) => callbacks.onAuth({ url }), () => callbacks.onPrompt({ message: "Paste the authorization code:" }));
+	},
+	async refreshToken(credentials) {
+		return refreshAnthropicToken(credentials.refresh);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
+export { anthropicOAuthProvider, completeAnthropicLogin, loginAnthropic, refreshAnthropicToken, startAnthropicLogin };
+
+//# sourceMappingURL=anthropic.js.map

package/dist/auth/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","names":[],"sources":["../../../src/auth/providers/anthropic.ts"],"sourcesContent":["/**\n * Anthropic OAuth flow (Claude Pro/Max)\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts\n *\n * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted\n * callback page which displays `code#state` for the user to paste back. That\n * makes it deployable without any inbound connection to the server, so the\n * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`\n * which can span separate HTTP requests (only the PKCE verifier needs to be\n * persisted in between).\n */\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');\nconst AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';\n// pi-mono uses `https://platform.claude.com/v1/oauth/token` with extra scopes\n// (user:sessions:claude_code, user:mcp_servers, user:file_upload); we keep the\n// console.anthropic.com endpoints that are known to work for our scope set.\nconst TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';\nconst REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';\nconst SCOPES = 'org:create_api_key user:profile user:inference';\n\nexport interface AnthropicLoginStart {\n  /** Authorization URL for the user to open. */\n  url: string;\n  /** PKCE code verifier — persist it to complete the login later. */\n  verifier: string;\n}\n\n/**\n * Start an Anthropic login: generate PKCE state and build the authorization URL.\n */\nexport async function startAnthropicLogin(): Promise<AnthropicLoginStart> {\n  const { verifier, challenge } = await generatePKCE();\n\n  const authParams = new URLSearchParams({\n    code: 'true',\n    client_id: CLIENT_ID,\n    response_type: 'code',\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPES,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state: verifier,\n  });\n\n  return { url: `${AUTHORIZE_URL}?${authParams.toString()}`, verifier };\n}\n\n/**\n * Complete an Anthropic login: parse the pasted authorization input\n * (full URL, `code#state`, or query string), validate its state, and exchange\n * it for tokens using the verifier from `startAnthropicLogin()`.\n */\nexport async function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials> {\n  const { code, state } = parseAuthorizationInput(input);\n  if (!code) {\n    throw new Error('Missing authorization code');\n  }\n  if (!state || state !== verifier) {\n    throw new Error('Invalid authorization state');\n  }\n\n  const tokenResponse = await fetch(TOKEN_URL, {\n    method: 'POST',\n    // Bound the OAuth exchange so an unresponsive upstream cannot pin the\n    // caller (and, in the shipyard server, the containing project lock)\n    // indefinitely. See 2025-07-23 shipyard latency incident.\n    signal: AbortSignal.timeout(15_000),\n    headers: {\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code,\n      state,\n      redirect_uri: REDIRECT_URI,\n      code_verifier: verifier,\n    }),\n  });\n\n  if (!tokenResponse.ok) {\n    const error = await tokenResponse.text();\n    throw new Error(`Token exchange failed: ${error}`);\n  }\n\n  const tokenData = (await tokenResponse.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  // Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n  const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n  return {\n    refresh: tokenData.refresh_token,\n    access: tokenData.access_token,\n    expires: expiresAt,\n  };\n}\n\n/**\n * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.\n */\nexport async function loginAnthropic(\n  onAuthUrl: (url: string) => void,\n  onPromptCode: () => Promise<string>,\n): Promise<OAuthCredentials> {\n  const { url, verifier } = await startAnthropicLogin();\n\n  // Notify caller with URL to open\n  onAuthUrl(url);\n\n  // Wait for user to paste authorization code (format: code#state)\n  const authCode = await onPromptCode();\n\n  return completeAnthropicLogin(authCode, verifier);\n}\n\n/**\n * Refresh Anthropic OAuth token\n */\nexport async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    signal: AbortSignal.timeout(15_000),\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  });\n\n  if (!response.ok) {\n    const error = await response.text();\n    throw new Error(`Anthropic token refresh failed: ${error}`);\n  }\n\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  return {\n    refresh: data.refresh_token,\n    access: data.access_token,\n    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n  };\n}\n\nexport const anthropicOAuthProvider: OAuthProviderInterface = {\n  id: 'anthropic',\n  name: 'Anthropic (Claude Pro/Max)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginAnthropic(\n      url => callbacks.onAuth({ url }),\n      () => callbacks.onPrompt({ message: 'Paste the authorization code:' }),\n    );\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshAnthropicToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,MAAM,UAAU,MAAc,KAAK,CAAC;AACpC,MAAM,YAAY,OAAO,kDAAkD;AAC3E,MAAM,gBAAgB;AAItB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,SAAS;;;;AAYf,eAAsB,sBAAoD;CACxE,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CAEnD,MAAM,aAAa,IAAI,gBAAgB;EACrC,MAAM;EACN,WAAW;EACX,eAAe;EACf,cAAc;EACd,OAAO;EACP,gBAAgB;EAChB,uBAAuB;EACvB,OAAO;CACT,CAAC;CAED,OAAO;EAAE,KAAK,GAAG,cAAc,GAAG,WAAW,SAAS;EAAK;CAAS;AACtE;;;;;;AAOA,eAAsB,uBAAuB,OAAe,UAA6C;CACvG,MAAM,EAAE,MAAM,UAAU,wBAAwB,KAAK;CACrD,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,CAAC,SAAS,UAAU,UACtB,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,gBAAgB,MAAM,MAAM,WAAW;EAC3C,QAAQ;EAIR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EACP,gBAAgB,mBAClB;EACA,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX;GACA;GACA,cAAc;GACd,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,cAAc,IAAI;EACrB,MAAM,QAAQ,MAAM,cAAc,KAAK;EACvC,MAAM,IAAI,MAAM,0BAA0B,OAAO;CACnD;CAEA,MAAM,YAAa,MAAM,cAAc,KAAK;CAO5C,MAAM,YAAY,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO,MAAS;CAEtE,OAAO;EACL,SAAS,UAAU;EACnB,QAAQ,UAAU;EAClB,SAAS;CACX;AACF;;;;AAKA,eAAsB,eACpB,WACA,cAC2B;CAC3B,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;CAGpD,UAAU,GAAG;CAKb,OAAO,uBAAuB,MAFP,aAAa,GAEI,QAAQ;AAClD;;;;AAKA,eAAsB,sBAAsB,cAAiD;CAC3F,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,MAAM,IAAI,MAAM,mCAAmC,OAAO;CAC5D;CAEA,MAAM,OAAQ,MAAM,SAAS,KAAK;CAMlC,OAAO;EACL,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,MAAS;CAC1D;AACF;AAEA,MAAa,yBAAiD;CAC5D,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,gBACL,QAAO,UAAU,OAAO,EAAE,IAAI,CAAC,SACzB,UAAU,SAAS,EAAE,SAAS,gCAAgC,CAAC,CACvE;CACF;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,sBAAsB,YAAY,OAAO;CAClD;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}

package/dist/auth/providers/github-copilot.d.ts

@@ -0,0 +1,154 @@
+/**
+ * GitHub Copilot OAuth flow
+ *
+ * Inspired by:
+ *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts
+ *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts
+ *
+ * Storage layout in AuthStorage:
+ *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).
+ *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).
+ *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).
+ *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from '../types.js';
+export type GitHubCopilotCredentials = OAuthCredentials & {
+    enterpriseUrl?: string;
+};
+export declare const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+/** Headers that Copilot endpoints expect from a VS Code-like client. */
+export declare const COPILOT_HEADERS: {
+    readonly 'User-Agent': "GitHubCopilotChat/0.35.0";
+    readonly 'Editor-Version': "vscode/1.107.0";
+    readonly 'Editor-Plugin-Version': "copilot-chat/0.35.0";
+    readonly 'Copilot-Integration-Id': "vscode-chat";
+};
+/**
+ * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).
+ * Returns null for an empty input or an unparseable URL.
+ */
+export declare function normalizeDomain(input: string): string | null;
+/**
+ * Resolve the Copilot API base URL.
+ * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.
+ */
+export declare function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string;
+/**
+ * Serializable pending state for a Copilot device-code login. Safe to persist
+ * (e.g. a `pending jsonb` column) so polling can span HTTP requests/replicas.
+ */
+export interface CopilotDeviceLoginPending {
+    /** GitHub host performing the flow (`github.com` or an Enterprise hostname). */
+    domain: string;
+    /** Enterprise hostname, or undefined for github.com. Recorded on the final credentials. */
+    enterpriseDomain?: string;
+    deviceCode: string;
+    userCode: string;
+    /** Verification URL for the user to open. */
+    url: string;
+    instructions: string;
+    /** Current base poll interval in ms (grows on slow_down). */
+    intervalMs: number;
+    /** Safety margin applied to intervalMs when computing the next wait. */
+    intervalMultiplier: number;
+    /** Number of slow_down responses seen (used for the clock-drift hint). */
+    slowDownCount: number;
+    /** ms epoch after which the device authorization expires. */
+    deadlineAt: number;
+}
+export type CopilotDevicePollResult = {
+    status: 'complete';
+    credentials: GitHubCopilotCredentials;
+} | {
+    status: 'pending';
+    pending: CopilotDeviceLoginPending;
+    nextPollMs: number;
+} | {
+    status: 'failed';
+    error: string;
+};
+/** Delay to wait before the next upstream poll for a pending Copilot device login. */
+export declare function copilotNextPollDelayMs(pending: CopilotDeviceLoginPending): number;
+/**
+ * Start a Copilot device-code login: request a user code and return the
+ * serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`
+ * before the first poll.
+ */
+export declare function startGitHubCopilotDeviceLogin(enterpriseDomain?: string, options?: {
+    signal?: AbortSignal;
+}): Promise<CopilotDeviceLoginPending>;
+/**
+ * Perform exactly one upstream poll for a pending Copilot device login.
+ * On success, exchanges the GitHub OAuth token for a Copilot bearer token and
+ * returns full credentials. Never throws for flow-level conditions; network
+ * errors from fetch still propagate.
+ */
+export declare function pollGitHubCopilotDeviceLogin(pending: CopilotDeviceLoginPending, options?: {
+    signal?: AbortSignal;
+    onProgress?: (message: string) => void;
+}): Promise<CopilotDevicePollResult>;
+/**
+ * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.
+ *
+ * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a
+ * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, signal?: AbortSignal): Promise<GitHubCopilotCredentials>;
+/**
+ * Login with GitHub Copilot OAuth (device-code flow).
+ *
+ * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,
+ * then exchanges the GitHub OAuth token for a Copilot bearer token.
+ */
+export declare function loginGitHubCopilot(options: {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+}): Promise<GitHubCopilotCredentials>;
+/**
+ * Filtered, normalized entry from the Copilot `/models` API.
+ *
+ * The full API payload includes a lot of capability metadata; we only keep the bits
+ * we need to expose models in `listAvailableModels()` and route requests sensibly.
+ */
+export type CopilotModelEntry = {
+    /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */
+    id: string;
+    /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */
+    name: string;
+    /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */
+    vendor: string;
+    /**
+     * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).
+     * Empty when the API didn't return `supported_endpoints` for this entry.
+     */
+    supportedEndpoints: string[];
+    /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */
+    isAnthropicShaped: boolean;
+    /** True when `capabilities.supports.vision` is true. */
+    supportsVision: boolean;
+    /** True when the model supports tool calling. */
+    supportsToolCalls: boolean;
+};
+/**
+ * Fetch the Copilot model list available to the current subscription.
+ *
+ * Hits `${baseURL}/models` with the Copilot bearer token, filters to
+ * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns
+ * a normalized list. Mirrors opencode's filtering rules.
+ *
+ * Inspired by:
+ *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts
+ */
+export declare function fetchCopilotModels(opts: {
+    baseUrl: string;
+    bearerToken: string;
+    signal?: AbortSignal;
+}): Promise<CopilotModelEntry[]>;
+export declare const githubCopilotOAuthProvider: OAuthProviderInterface;
+//# sourceMappingURL=github-copilot.d.ts.map

package/dist/auth/providers/github-copilot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-copilot.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/github-copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAyBX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AA0BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzF;AAmFD;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE,GAC7D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,yBAAyB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAEjF;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAgBpC;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACzE,OAAO,CAAC,uBAAuB,CAAC,CA4DlC;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAsCnC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,QAAQ,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwCpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA8D/B;AAED,eAAO,MAAM,0BAA0B,EAAE,sBAqBxC,CAAC"}

package/dist/auth/providers/github-copilot.js

@@ -0,0 +1,340 @@
+//#region src/auth/providers/github-copilot.ts
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+/** Headers that Copilot endpoints expect from a VS Code-like client. */
+const COPILOT_HEADERS = {
+	"User-Agent": COPILOT_USER_AGENT,
+	"Editor-Version": "vscode/1.107.0",
+	"Editor-Plugin-Version": "copilot-chat/0.35.0",
+	"Copilot-Integration-Id": "vscode-chat"
+};
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+/**
+* Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).
+* Returns null for an empty input or an unparseable URL.
+*/
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname || null;
+	} catch {
+		return null;
+	}
+}
+function getUrls(domain) {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+		copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`
+	};
+}
+/**
+* Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.
+* Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`
+*/
+function getBaseUrlFromToken(token) {
+	const match = token.match(/proxy-ep=([^;]+)/);
+	if (!match) return null;
+	return `https://${match[1].replace(/^proxy\./, "api.")}`;
+}
+/**
+* Resolve the Copilot API base URL.
+* Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.
+*/
+function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
+	if (token) {
+		const fromToken = getBaseUrlFromToken(token);
+		if (fromToken) return fromToken;
+	}
+	if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;
+	return "https://api.individual.githubcopilot.com";
+}
+async function fetchJson(url, init, signal) {
+	const response = await fetch(url, signal ? {
+		...init,
+		signal
+	} : init);
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`${response.status} ${response.statusText}: ${text}`);
+	}
+	return response.json();
+}
+async function startDeviceFlow(domain, signal) {
+	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded",
+			"User-Agent": COPILOT_USER_AGENT
+		},
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			scope: "read:user"
+		})
+	}, signal);
+	if (!data || typeof data !== "object") throw new Error("Invalid device code response");
+	const obj = data;
+	const deviceCode = obj.device_code;
+	const userCode = obj.user_code;
+	const verificationUri = obj.verification_uri;
+	const interval = obj.interval;
+	const expiresIn = obj.expires_in;
+	if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") throw new Error("Invalid device code response fields");
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn
+	};
+}
+/** Sleep that can be interrupted by an AbortSignal. */
+function abortableSleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+			return;
+		}
+		let timeout;
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+		};
+		timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Delay to wait before the next upstream poll for a pending Copilot device login. */
+function copilotNextPollDelayMs(pending) {
+	return Math.ceil(pending.intervalMs * pending.intervalMultiplier);
+}
+/**
+* Start a Copilot device-code login: request a user code and return the
+* serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`
+* before the first poll.
+*/
+async function startGitHubCopilotDeviceLogin(enterpriseDomain, options) {
+	const domain = enterpriseDomain || "github.com";
+	const device = await startDeviceFlow(domain, options?.signal);
+	return {
+		domain,
+		...enterpriseDomain ? { enterpriseDomain } : {},
+		deviceCode: device.device_code,
+		userCode: device.user_code,
+		url: device.verification_uri,
+		instructions: `Enter code: ${device.user_code}`,
+		intervalMs: Math.max(1e3, Math.floor(device.interval * 1e3)),
+		intervalMultiplier: INITIAL_POLL_INTERVAL_MULTIPLIER,
+		slowDownCount: 0,
+		deadlineAt: Date.now() + device.expires_in * 1e3
+	};
+}
+/**
+* Perform exactly one upstream poll for a pending Copilot device login.
+* On success, exchanges the GitHub OAuth token for a Copilot bearer token and
+* returns full credentials. Never throws for flow-level conditions; network
+* errors from fetch still propagate.
+*/
+async function pollGitHubCopilotDeviceLogin(pending, options) {
+	if (Date.now() >= pending.deadlineAt) {
+		if (pending.slowDownCount > 0) return {
+			status: "failed",
+			error: "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again."
+		};
+		return {
+			status: "failed",
+			error: "Device flow timed out"
+		};
+	}
+	const raw = await fetchJson(getUrls(pending.domain).accessTokenUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded",
+			"User-Agent": COPILOT_USER_AGENT
+		},
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			device_code: pending.deviceCode,
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+		})
+	}, options?.signal);
+	if (raw && typeof raw === "object" && typeof raw.access_token === "string") {
+		const githubAccessToken = raw.access_token;
+		options?.onProgress?.("Fetching Copilot token...");
+		return {
+			status: "complete",
+			credentials: await refreshGitHubCopilotToken(githubAccessToken, pending.enterpriseDomain, options?.signal)
+		};
+	}
+	if (raw && typeof raw === "object" && typeof raw.error === "string") {
+		const { error, error_description: description, interval } = raw;
+		if (error === "slow_down") {
+			const next = {
+				...pending,
+				slowDownCount: pending.slowDownCount + 1,
+				intervalMs: typeof interval === "number" && interval > 0 ? interval * 1e3 : Math.max(1e3, pending.intervalMs + 5e3),
+				intervalMultiplier: SLOW_DOWN_POLL_INTERVAL_MULTIPLIER
+			};
+			return {
+				status: "pending",
+				pending: next,
+				nextPollMs: copilotNextPollDelayMs(next)
+			};
+		}
+		if (error !== "authorization_pending") return {
+			status: "failed",
+			error: `Device flow failed: ${error}${description ? `: ${description}` : ""}`
+		};
+	}
+	return {
+		status: "pending",
+		pending,
+		nextPollMs: copilotNextPollDelayMs(pending)
+	};
+}
+/**
+* Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.
+*
+* `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a
+* fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).
+*/
+async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal) {
+	const raw = await fetchJson(getUrls(enterpriseDomain || "github.com").copilotTokenUrl, { headers: {
+		Accept: "application/json",
+		Authorization: `Bearer ${refreshToken}`,
+		...COPILOT_HEADERS
+	} }, signal);
+	if (!raw || typeof raw !== "object") throw new Error("Invalid Copilot token response");
+	const obj = raw;
+	const token = obj.token;
+	const expiresAt = obj.expires_at;
+	if (typeof token !== "string" || typeof expiresAt !== "number") throw new Error("Invalid Copilot token response fields");
+	const credentials = {
+		refresh: refreshToken,
+		access: token,
+		expires: expiresAt * 1e3 - 300 * 1e3
+	};
+	if (enterpriseDomain) credentials.enterpriseUrl = enterpriseDomain;
+	return credentials;
+}
+/**
+* Login with GitHub Copilot OAuth (device-code flow).
+*
+* Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,
+* then exchanges the GitHub OAuth token for a Copilot bearer token.
+*/
+async function loginGitHubCopilot(options) {
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true
+	});
+	if (options.signal?.aborted) throw new Error("Login cancelled");
+	const trimmed = input.trim();
+	const enterpriseDomain = normalizeDomain(input);
+	if (trimmed && !enterpriseDomain) throw new Error("Invalid GitHub Enterprise URL/domain");
+	let pending = await startGitHubCopilotDeviceLogin(enterpriseDomain ?? void 0, { signal: options.signal });
+	options.onAuth(pending.url, pending.instructions);
+	while (true) {
+		if (options.signal?.aborted) throw new Error("Login cancelled");
+		const remainingMs = Math.max(pending.deadlineAt - Date.now(), 0);
+		await abortableSleep(Math.min(copilotNextPollDelayMs(pending), remainingMs), options.signal);
+		const result = await pollGitHubCopilotDeviceLogin(pending, {
+			signal: options.signal,
+			onProgress: options.onProgress
+		});
+		if (result.status === "complete") return result.credentials;
+		if (result.status === "failed") throw new Error(result.error);
+		pending = result.pending;
+	}
+}
+/**
+* Fetch the Copilot model list available to the current subscription.
+*
+* Hits `${baseURL}/models` with the Copilot bearer token, filters to
+* `model_picker_enabled === true && policy.state !== 'disabled'`, and returns
+* a normalized list. Mirrors opencode's filtering rules.
+*
+* Inspired by:
+*   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts
+*/
+async function fetchCopilotModels(opts) {
+	const url = `${opts.baseUrl.replace(/\/$/, "")}/models`;
+	const response = await fetch(url, {
+		headers: {
+			Accept: "application/json",
+			Authorization: `Bearer ${opts.bearerToken}`,
+			...COPILOT_HEADERS
+		},
+		signal: opts.signal
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);
+	}
+	const json = await response.json().catch(() => null);
+	if (!json || typeof json !== "object" || !Array.isArray(json.data)) throw new Error("Invalid Copilot models response: missing `data` array");
+	const data = json.data;
+	const result = [];
+	for (const item of data) {
+		if (!item || typeof item !== "object") continue;
+		const obj = item;
+		if (obj.model_picker_enabled !== true) continue;
+		const policy = obj.policy;
+		if (policy && policy.state === "disabled") continue;
+		const id = obj.id;
+		if (typeof id !== "string" || !id) continue;
+		const name = typeof obj.name === "string" ? obj.name : id;
+		const vendor = typeof obj.vendor === "string" ? obj.vendor : "";
+		const supports = obj.capabilities?.supports;
+		const supportsVision = supports?.vision === true;
+		const supportsToolCalls = supports?.tool_calls === true;
+		const rawEndpoints = obj.supported_endpoints;
+		const supportedEndpoints = Array.isArray(rawEndpoints) ? rawEndpoints.filter((e) => typeof e === "string") : [];
+		const isAnthropicShaped = supportedEndpoints.includes("/v1/messages");
+		result.push({
+			id,
+			name,
+			vendor,
+			supportedEndpoints,
+			isAnthropicShaped,
+			supportsVision,
+			supportsToolCalls
+		});
+	}
+	return result;
+}
+const githubCopilotOAuthProvider = {
+	id: "github-copilot",
+	name: "GitHub Copilot",
+	async login(callbacks) {
+		return loginGitHubCopilot({
+			onAuth: (url, instructions) => callbacks.onAuth({
+				url,
+				instructions
+			}),
+			onPrompt: callbacks.onPrompt,
+			onProgress: callbacks.onProgress,
+			signal: callbacks.signal
+		});
+	},
+	async refreshToken(credentials) {
+		const creds = credentials;
+		return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
+export { COPILOT_HEADERS, COPILOT_USER_AGENT, copilotNextPollDelayMs, fetchCopilotModels, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, pollGitHubCopilotDeviceLogin, refreshGitHubCopilotToken, startGitHubCopilotDeviceLogin };
+
+//# sourceMappingURL=github-copilot.js.map