@mastra/code-sdk 1.0.3-alpha.0 → 1.1.0-alpha.2

package/dist/auth/providers/github-copilot.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/providers/github-copilot.ts"],"sourcesContent":["/**\n * GitHub Copilot OAuth flow\n *\n * Inspired by:\n *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts\n *\n * Storage layout in AuthStorage:\n *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).\n *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).\n *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).\n *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.\n */\n\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nexport type GitHubCopilotCredentials = OAuthCredentials & {\n  enterpriseUrl?: string;\n};\n\nconst decode = (s: string): string => atob(s);\n// Copilot's public client ID, encoded to mirror the upstream references.\nconst CLIENT_ID = decode('SXYxLmI1MDdhMDhjODdlY2ZlOTg=');\n\nexport const COPILOT_USER_AGENT = 'GitHubCopilotChat/0.35.0';\n\n/** Headers that Copilot endpoints expect from a VS Code-like client. */\nexport const COPILOT_HEADERS = {\n  'User-Agent': COPILOT_USER_AGENT,\n  'Editor-Version': 'vscode/1.107.0',\n  'Editor-Plugin-Version': 'copilot-chat/0.35.0',\n  'Copilot-Integration-Id': 'vscode-chat',\n} as const;\n\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\n\ntype DeviceCodeResponse = {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  interval: number;\n  expires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n  access_token: string;\n  token_type?: string;\n  scope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n  error: string;\n  error_description?: string;\n  interval?: number;\n};\n\n/**\n * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).\n * Returns null for an empty input or an unparseable URL.\n */\nexport function normalizeDomain(input: string): string | null {\n  const trimmed = input.trim();\n  if (!trimmed) return null;\n  try {\n    const url = trimmed.includes('://') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n    return url.hostname || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getUrls(domain: string): {\n  deviceCodeUrl: string;\n  accessTokenUrl: string;\n  copilotTokenUrl: string;\n} {\n  return {\n    deviceCodeUrl: `https://${domain}/login/device/code`,\n    accessTokenUrl: `https://${domain}/login/oauth/access_token`,\n    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n  };\n}\n\n/**\n * Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.\n * Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`\n */\nfunction getBaseUrlFromToken(token: string): string | null {\n  const match = token.match(/proxy-ep=([^;]+)/);\n  if (!match) return null;\n  const proxyHost = match[1]!;\n  const apiHost = proxyHost.replace(/^proxy\\./, 'api.');\n  return `https://${apiHost}`;\n}\n\n/**\n * Resolve the Copilot API base URL.\n * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.\n */\nexport function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string {\n  if (token) {\n    const fromToken = getBaseUrlFromToken(token);\n    if (fromToken) return fromToken;\n  }\n  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;\n  return 'https://api.individual.githubcopilot.com';\n}\n\nasync function fetchJson(url: string, init: RequestInit, signal?: AbortSignal): Promise<unknown> {\n  const response = await fetch(url, signal ? { ...init, signal } : init);\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`${response.status} ${response.statusText}: ${text}`);\n  }\n  return response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal?: AbortSignal): Promise<DeviceCodeResponse> {\n  const urls = getUrls(domain);\n  const data = await fetchJson(\n    urls.deviceCodeUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        scope: 'read:user',\n      }),\n    },\n    signal,\n  );\n\n  if (!data || typeof data !== 'object') {\n    throw new Error('Invalid device code response');\n  }\n\n  const obj = data as Record<string, unknown>;\n  const deviceCode = obj.device_code;\n  const userCode = obj.user_code;\n  const verificationUri = obj.verification_uri;\n  const interval = obj.interval;\n  const expiresIn = obj.expires_in;\n\n  if (\n    typeof deviceCode !== 'string' ||\n    typeof userCode !== 'string' ||\n    typeof verificationUri !== 'string' ||\n    typeof interval !== 'number' ||\n    typeof expiresIn !== 'number'\n  ) {\n    throw new Error('Invalid device code response fields');\n  }\n\n  return {\n    device_code: deviceCode,\n    user_code: userCode,\n    verification_uri: verificationUri,\n    interval,\n    expires_in: expiresIn,\n  };\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Serializable pending state for a Copilot device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests/replicas.\n */\nexport interface CopilotDeviceLoginPending {\n  /** GitHub host performing the flow (`github.com` or an Enterprise hostname). */\n  domain: string;\n  /** Enterprise hostname, or undefined for github.com. Recorded on the final credentials. */\n  enterpriseDomain?: string;\n  deviceCode: string;\n  userCode: string;\n  /** Verification URL for the user to open. */\n  url: string;\n  instructions: string;\n  /** Current base poll interval in ms (grows on slow_down). */\n  intervalMs: number;\n  /** Safety margin applied to intervalMs when computing the next wait. */\n  intervalMultiplier: number;\n  /** Number of slow_down responses seen (used for the clock-drift hint). */\n  slowDownCount: number;\n  /** ms epoch after which the device authorization expires. */\n  deadlineAt: number;\n}\n\nexport type CopilotDevicePollResult =\n  | { status: 'complete'; credentials: GitHubCopilotCredentials }\n  | { status: 'pending'; pending: CopilotDeviceLoginPending; nextPollMs: number }\n  | { status: 'failed'; error: string };\n\n/** Delay to wait before the next upstream poll for a pending Copilot device login. */\nexport function copilotNextPollDelayMs(pending: CopilotDeviceLoginPending): number {\n  return Math.ceil(pending.intervalMs * pending.intervalMultiplier);\n}\n\n/**\n * Start a Copilot device-code login: request a user code and return the\n * serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`\n * before the first poll.\n */\nexport async function startGitHubCopilotDeviceLogin(\n  enterpriseDomain?: string,\n  options?: { signal?: AbortSignal },\n): Promise<CopilotDeviceLoginPending> {\n  const domain = enterpriseDomain || 'github.com';\n  const device = await startDeviceFlow(domain, options?.signal);\n\n  return {\n    domain,\n    ...(enterpriseDomain ? { enterpriseDomain } : {}),\n    deviceCode: device.device_code,\n    userCode: device.user_code,\n    url: device.verification_uri,\n    instructions: `Enter code: ${device.user_code}`,\n    intervalMs: Math.max(1000, Math.floor(device.interval * 1000)),\n    intervalMultiplier: INITIAL_POLL_INTERVAL_MULTIPLIER,\n    slowDownCount: 0,\n    deadlineAt: Date.now() + device.expires_in * 1000,\n  };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Copilot device login.\n * On success, exchanges the GitHub OAuth token for a Copilot bearer token and\n * returns full credentials. Never throws for flow-level conditions; network\n * errors from fetch still propagate.\n */\nexport async function pollGitHubCopilotDeviceLogin(\n  pending: CopilotDeviceLoginPending,\n  options?: { signal?: AbortSignal; onProgress?: (message: string) => void },\n): Promise<CopilotDevicePollResult> {\n  if (Date.now() >= pending.deadlineAt) {\n    if (pending.slowDownCount > 0) {\n      return {\n        status: 'failed',\n        error:\n          'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.',\n      };\n    }\n    return { status: 'failed', error: 'Device flow timed out' };\n  }\n\n  const urls = getUrls(pending.domain);\n  const raw = await fetchJson(\n    urls.accessTokenUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        device_code: pending.deviceCode,\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n      }),\n    },\n    options?.signal,\n  );\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenSuccessResponse).access_token === 'string') {\n    const githubAccessToken = (raw as DeviceTokenSuccessResponse).access_token;\n    options?.onProgress?.('Fetching Copilot token...');\n    const credentials = await refreshGitHubCopilotToken(githubAccessToken, pending.enterpriseDomain, options?.signal);\n    return { status: 'complete', credentials };\n  }\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenErrorResponse).error === 'string') {\n    const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n\n    if (error === 'slow_down') {\n      const next: CopilotDeviceLoginPending = {\n        ...pending,\n        slowDownCount: pending.slowDownCount + 1,\n        intervalMs:\n          typeof interval === 'number' && interval > 0 ? interval * 1000 : Math.max(1000, pending.intervalMs + 5000),\n        intervalMultiplier: SLOW_DOWN_POLL_INTERVAL_MULTIPLIER,\n      };\n      return { status: 'pending', pending: next, nextPollMs: copilotNextPollDelayMs(next) };\n    }\n\n    if (error !== 'authorization_pending') {\n      const descriptionSuffix = description ? `: ${description}` : '';\n      return { status: 'failed', error: `Device flow failed: ${error}${descriptionSuffix}` };\n    }\n  }\n\n  // authorization_pending or an unrecognized-but-OK response: keep polling.\n  return { status: 'pending', pending, nextPollMs: copilotNextPollDelayMs(pending) };\n}\n\n/**\n * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.\n *\n * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a\n * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).\n */\nexport async function refreshGitHubCopilotToken(\n  refreshToken: string,\n  enterpriseDomain?: string,\n  signal?: AbortSignal,\n): Promise<GitHubCopilotCredentials> {\n  const domain = enterpriseDomain || 'github.com';\n  const urls = getUrls(domain);\n\n  const raw = await fetchJson(\n    urls.copilotTokenUrl,\n    {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${refreshToken}`,\n        ...COPILOT_HEADERS,\n      },\n    },\n    signal,\n  );\n\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('Invalid Copilot token response');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const token = obj.token;\n  const expiresAt = obj.expires_at;\n\n  if (typeof token !== 'string' || typeof expiresAt !== 'number') {\n    throw new Error('Invalid Copilot token response fields');\n  }\n\n  const credentials: GitHubCopilotCredentials = {\n    refresh: refreshToken,\n    access: token,\n    // expires_at is seconds; subtract 5 minutes so we refresh before actual expiry.\n    expires: expiresAt * 1000 - 5 * 60 * 1000,\n  };\n  if (enterpriseDomain) {\n    credentials.enterpriseUrl = enterpriseDomain;\n  }\n  return credentials;\n}\n\n/**\n * Login with GitHub Copilot OAuth (device-code flow).\n *\n * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,\n * then exchanges the GitHub OAuth token for a Copilot bearer token.\n */\nexport async function loginGitHubCopilot(options: {\n  onAuth: (url: string, instructions?: string) => void;\n  onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;\n  onProgress?: (message: string) => void;\n  signal?: AbortSignal;\n}): Promise<GitHubCopilotCredentials> {\n  const input = await options.onPrompt({\n    message: 'GitHub Enterprise URL/domain (blank for github.com)',\n    placeholder: 'company.ghe.com',\n    allowEmpty: true,\n  });\n\n  if (options.signal?.aborted) {\n    throw new Error('Login cancelled');\n  }\n\n  const trimmed = input.trim();\n  const enterpriseDomain = normalizeDomain(input);\n  if (trimmed && !enterpriseDomain) {\n    throw new Error('Invalid GitHub Enterprise URL/domain');\n  }\n  let pending = await startGitHubCopilotDeviceLogin(enterpriseDomain ?? undefined, { signal: options.signal });\n  options.onAuth(pending.url, pending.instructions);\n\n  while (true) {\n    if (options.signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n\n    // Wait before polling (safety margin over the server interval), clamped to the deadline.\n    const remainingMs = Math.max(pending.deadlineAt - Date.now(), 0);\n    await abortableSleep(Math.min(copilotNextPollDelayMs(pending), remainingMs), options.signal);\n\n    const result = await pollGitHubCopilotDeviceLogin(pending, {\n      signal: options.signal,\n      onProgress: options.onProgress,\n    });\n    if (result.status === 'complete') {\n      return result.credentials;\n    }\n    if (result.status === 'failed') {\n      throw new Error(result.error);\n    }\n    pending = result.pending;\n  }\n}\n\n/**\n * Filtered, normalized entry from the Copilot `/models` API.\n *\n * The full API payload includes a lot of capability metadata; we only keep the bits\n * we need to expose models in `listAvailableModels()` and route requests sensibly.\n */\nexport type CopilotModelEntry = {\n  /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */\n  id: string;\n  /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */\n  name: string;\n  /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */\n  vendor: string;\n  /**\n   * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).\n   * Empty when the API didn't return `supported_endpoints` for this entry.\n   */\n  supportedEndpoints: string[];\n  /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */\n  isAnthropicShaped: boolean;\n  /** True when `capabilities.supports.vision` is true. */\n  supportsVision: boolean;\n  /** True when the model supports tool calling. */\n  supportsToolCalls: boolean;\n};\n\n/**\n * Fetch the Copilot model list available to the current subscription.\n *\n * Hits `${baseURL}/models` with the Copilot bearer token, filters to\n * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns\n * a normalized list. Mirrors opencode's filtering rules.\n *\n * Inspired by:\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts\n */\nexport async function fetchCopilotModels(opts: {\n  baseUrl: string;\n  bearerToken: string;\n  signal?: AbortSignal;\n}): Promise<CopilotModelEntry[]> {\n  const url = `${opts.baseUrl.replace(/\\/$/, '')}/models`;\n  const response = await fetch(url, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `Bearer ${opts.bearerToken}`,\n      ...COPILOT_HEADERS,\n    },\n    signal: opts.signal,\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);\n  }\n\n  const json = await response.json().catch(() => null);\n  if (!json || typeof json !== 'object' || !Array.isArray((json as { data?: unknown }).data)) {\n    throw new Error('Invalid Copilot models response: missing `data` array');\n  }\n\n  const data = (json as { data: unknown[] }).data;\n  const result: CopilotModelEntry[] = [];\n\n  for (const item of data) {\n    if (!item || typeof item !== 'object') continue;\n    const obj = item as Record<string, unknown>;\n\n    if (obj.model_picker_enabled !== true) continue;\n\n    const policy = obj.policy as Record<string, unknown> | undefined;\n    if (policy && policy.state === 'disabled') continue;\n\n    const id = obj.id;\n    if (typeof id !== 'string' || !id) continue;\n\n    const name = typeof obj.name === 'string' ? obj.name : id;\n    const vendor = typeof obj.vendor === 'string' ? obj.vendor : '';\n\n    const capabilities = obj.capabilities as Record<string, unknown> | undefined;\n    const supports = capabilities?.supports as Record<string, unknown> | undefined;\n    const supportsVision = supports?.vision === true;\n    const supportsToolCalls = supports?.tool_calls === true;\n\n    const rawEndpoints = obj.supported_endpoints;\n    const supportedEndpoints = Array.isArray(rawEndpoints)\n      ? rawEndpoints.filter((e): e is string => typeof e === 'string')\n      : [];\n    const isAnthropicShaped = supportedEndpoints.includes('/v1/messages');\n\n    result.push({\n      id,\n      name,\n      vendor,\n      supportedEndpoints,\n      isAnthropicShaped,\n      supportsVision,\n      supportsToolCalls,\n    });\n  }\n\n  return result;\n}\n\nexport const githubCopilotOAuthProvider: OAuthProviderInterface = {\n  id: 'github-copilot',\n  name: 'GitHub Copilot',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginGitHubCopilot({\n      onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),\n      onPrompt: callbacks.onPrompt,\n      onProgress: callbacks.onProgress,\n      signal: callbacks.signal,\n    });\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    const creds = credentials as GitHubCopilotCredentials;\n    return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":"AAoBA,MAAM,SAAS,CAAC,MAAsB,KAAK,CAAC;AAE5C,MAAM,YAAY,OAAO,8BAA8B;AAEhD,MAAM,qBAAqB;AAG3B,MAAM,kBAAkB;AAAA,EAC7B,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,yBAAyB;AAAA,EACzB,0BAA0B;AAC5B;AAEA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AA0BpC,SAAS,gBAAgB,OAA8B;AAC5D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,OAAO,EAAE;AACrF,WAAO,IAAI,YAAY;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,QAIf;AACA,SAAO;AAAA,IACL,eAAe,WAAW,MAAM;AAAA,IAChC,gBAAgB,WAAW,MAAM;AAAA,IACjC,iBAAiB,eAAe,MAAM;AAAA,EACxC;AACF;AAMA,SAAS,oBAAoB,OAA8B;AACzD,QAAM,QAAQ,MAAM,MAAM,kBAAkB;AAC5C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,CAAC;AACzB,QAAM,UAAU,UAAU,QAAQ,YAAY,MAAM;AACpD,SAAO,WAAW,OAAO;AAC3B;AAMO,SAAS,wBAAwB,OAAgB,kBAAmC;AACzF,MAAI,OAAO;AACT,UAAM,YAAY,oBAAoB,KAAK;AAC3C,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,MAAI,iBAAkB,QAAO,uBAAuB,gBAAgB;AACpE,SAAO;AACT;AAEA,eAAe,UAAU,KAAa,MAAmB,QAAwC;AAC/F,QAAM,WAAW,MAAM,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI;AACrE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,KAAK,IAAI,EAAE;AAAA,EACtE;AACA,SAAO,SAAS,KAAK;AACvB;AAEA,eAAe,gBAAgB,QAAgB,QAAmD;AAChG,QAAM,OAAO,QAAQ,MAAM;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB,KAAK;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,gBAAgB;AAAA,QAChB,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,WAAW;AAAA,QACX,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,QAAM,MAAM;AACZ,QAAM,aAAa,IAAI;AACvB,QAAM,WAAW,IAAI;AACrB,QAAM,kBAAkB,IAAI;AAC5B,QAAM,WAAW,IAAI;AACrB,QAAM,YAAY,IAAI;AAEtB,MACE,OAAO,eAAe,YACtB,OAAO,aAAa,YACpB,OAAO,oBAAoB,YAC3B,OAAO,aAAa,YACpB,OAAO,cAAc,UACrB;AACA,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,SAAO;AAAA,IACL,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAGA,SAAS,eAAe,IAAY,QAAqC;AACvE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AACnC;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,UAAU,MAAM;AACpB,mBAAa,OAAO;AACpB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AAAA,IACrC;AAEA,cAAU,WAAW,MAAM;AACzB,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ;AAAA,IACV,GAAG,EAAE;AAEL,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AACH;AAgCO,SAAS,uBAAuB,SAA4C;AACjF,SAAO,KAAK,KAAK,QAAQ,aAAa,QAAQ,kBAAkB;AAClE;AAOA,eAAsB,8BACpB,kBACA,SACoC;AACpC,QAAM,SAAS,oBAAoB;AACnC,QAAM,SAAS,MAAM,gBAAgB,QAAQ,SAAS,MAAM;AAE5D,SAAO;AAAA,IACL;AAAA,IACA,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,IAC/C,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,KAAK,OAAO;AAAA,IACZ,cAAc,eAAe,OAAO,SAAS;AAAA,IAC7C,YAAY,KAAK,IAAI,KAAM,KAAK,MAAM,OAAO,WAAW,GAAI,CAAC;AAAA,IAC7D,oBAAoB;AAAA,IACpB,eAAe;AAAA,IACf,YAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AAAA,EAC/C;AACF;AAQA,eAAsB,6BACpB,SACA,SACkC;AAClC,MAAI,KAAK,IAAI,KAAK,QAAQ,YAAY;AACpC,QAAI,QAAQ,gBAAgB,GAAG;AAC7B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OACE;AAAA,MACJ;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,UAAU,OAAO,wBAAwB;AAAA,EAC5D;AAEA,QAAM,OAAO,QAAQ,QAAQ,MAAM;AACnC,QAAM,MAAM,MAAM;AAAA,IAChB,KAAK;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,gBAAgB;AAAA,QAChB,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,WAAW;AAAA,QACX,aAAa,QAAQ;AAAA,QACrB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,SAAS;AAAA,EACX;AAEA,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAmC,iBAAiB,UAAU;AAC1G,UAAM,oBAAqB,IAAmC;AAC9D,aAAS,aAAa,2BAA2B;AACjD,UAAM,cAAc,MAAM,0BAA0B,mBAAmB,QAAQ,kBAAkB,SAAS,MAAM;AAChH,WAAO,EAAE,QAAQ,YAAY,YAAY;AAAA,EAC3C;AAEA,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAiC,UAAU,UAAU;AACjG,UAAM,EAAE,OAAO,mBAAmB,aAAa,SAAS,IAAI;AAE5D,QAAI,UAAU,aAAa;AACzB,YAAM,OAAkC;AAAA,QACtC,GAAG;AAAA,QACH,eAAe,QAAQ,gBAAgB;AAAA,QACvC,YACE,OAAO,aAAa,YAAY,WAAW,IAAI,WAAW,MAAO,KAAK,IAAI,KAAM,QAAQ,aAAa,GAAI;AAAA,QAC3G,oBAAoB;AAAA,MACtB;AACA,aAAO,EAAE,QAAQ,WAAW,SAAS,MAAM,YAAY,uBAAuB,IAAI,EAAE;AAAA,IACtF;AAEA,QAAI,UAAU,yBAAyB;AACrC,YAAM,oBAAoB,cAAc,KAAK,WAAW,KAAK;AAC7D,aAAO,EAAE,QAAQ,UAAU,OAAO,uBAAuB,KAAK,GAAG,iBAAiB,GAAG;AAAA,IACvF;AAAA,EACF;AAGA,SAAO,EAAE,QAAQ,WAAW,SAAS,YAAY,uBAAuB,OAAO,EAAE;AACnF;AAQA,eAAsB,0BACpB,cACA,kBACA,QACmC;AACnC,QAAM,SAAS,oBAAoB;AACnC,QAAM,OAAO,QAAQ,MAAM;AAE3B,QAAM,MAAM,MAAM;AAAA,IAChB,KAAK;AAAA,IACL;AAAA,MACE,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,eAAe,UAAU,YAAY;AAAA,QACrC,GAAG;AAAA,MACL;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAEA,QAAM,MAAM;AACZ,QAAM,QAAQ,IAAI;AAClB,QAAM,YAAY,IAAI;AAEtB,MAAI,OAAO,UAAU,YAAY,OAAO,cAAc,UAAU;AAC9D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,cAAwC;AAAA,IAC5C,SAAS;AAAA,IACT,QAAQ;AAAA;AAAA,IAER,SAAS,YAAY,MAAO,IAAI,KAAK;AAAA,EACvC;AACA,MAAI,kBAAkB;AACpB,gBAAY,gBAAgB;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,mBAAmB,SAKH;AACpC,QAAM,QAAQ,MAAM,QAAQ,SAAS;AAAA,IACnC,SAAS;AAAA,IACT,aAAa;AAAA,IACb,YAAY;AAAA,EACd,CAAC;AAED,MAAI,QAAQ,QAAQ,SAAS;AAC3B,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AAEA,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,mBAAmB,gBAAgB,KAAK;AAC9C,MAAI,WAAW,CAAC,kBAAkB;AAChC,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,MAAI,UAAU,MAAM,8BAA8B,oBAAoB,QAAW,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC3G,UAAQ,OAAO,QAAQ,KAAK,QAAQ,YAAY;AAEhD,SAAO,MAAM;AACX,QAAI,QAAQ,QAAQ,SAAS;AAC3B,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACnC;AAGA,UAAM,cAAc,KAAK,IAAI,QAAQ,aAAa,KAAK,IAAI,GAAG,CAAC;AAC/D,UAAM,eAAe,KAAK,IAAI,uBAAuB,OAAO,GAAG,WAAW,GAAG,QAAQ,MAAM;AAE3F,UAAM,SAAS,MAAM,6BAA6B,SAAS;AAAA,MACzD,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,IACtB,CAAC;AACD,QAAI,OAAO,WAAW,YAAY;AAChC,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,MAAM,OAAO,KAAK;AAAA,IAC9B;AACA,cAAU,OAAO;AAAA,EACnB;AACF;AAsCA,eAAsB,mBAAmB,MAIR;AAC/B,QAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC9C,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe,UAAU,KAAK,WAAW;AAAA,MACzC,GAAG;AAAA,IACL;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,mCAAmC,SAAS,MAAM,IAAI,SAAS,UAAU,KAAK,IAAI,EAAE;AAAA,EACtG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAS,KAA4B,IAAI,GAAG;AAC1F,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,OAAQ,KAA6B;AAC3C,QAAM,SAA8B,CAAC;AAErC,aAAW,QAAQ,MAAM;AACvB,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,MAAM;AAEZ,QAAI,IAAI,yBAAyB,KAAM;AAEvC,UAAM,SAAS,IAAI;AACnB,QAAI,UAAU,OAAO,UAAU,WAAY;AAE3C,UAAM,KAAK,IAAI;AACf,QAAI,OAAO,OAAO,YAAY,CAAC,GAAI;AAEnC,UAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAE7D,UAAM,eAAe,IAAI;AACzB,UAAM,WAAW,cAAc;AAC/B,UAAM,iBAAiB,UAAU,WAAW;AAC5C,UAAM,oBAAoB,UAAU,eAAe;AAEnD,UAAM,eAAe,IAAI;AACzB,UAAM,qBAAqB,MAAM,QAAQ,YAAY,IACjD,aAAa,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;AACL,UAAM,oBAAoB,mBAAmB,SAAS,cAAc;AAEpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEO,MAAM,6BAAqD;AAAA,EAChE,IAAI;AAAA,EACJ,MAAM;AAAA,EAEN,MAAM,MAAM,WAA2D;AACrE,WAAO,mBAAmB;AAAA,MACxB,QAAQ,CAAC,KAAK,iBAAiB,UAAU,OAAO,EAAE,KAAK,aAAa,CAAC;AAAA,MACrE,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,UAAM,QAAQ;AACd,WAAO,0BAA0B,MAAM,SAAS,MAAM,aAAa;AAAA,EACrE;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}
+{"version":3,"file":"github-copilot.js","names":[],"sources":["../../../src/auth/providers/github-copilot.ts"],"sourcesContent":["/**\n * GitHub Copilot OAuth flow\n *\n * Inspired by:\n *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts\n *\n * Storage layout in AuthStorage:\n *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).\n *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).\n *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).\n *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.\n */\n\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nexport type GitHubCopilotCredentials = OAuthCredentials & {\n  enterpriseUrl?: string;\n};\n\nconst decode = (s: string): string => atob(s);\n// Copilot's public client ID, encoded to mirror the upstream references.\nconst CLIENT_ID = decode('SXYxLmI1MDdhMDhjODdlY2ZlOTg=');\n\nexport const COPILOT_USER_AGENT = 'GitHubCopilotChat/0.35.0';\n\n/** Headers that Copilot endpoints expect from a VS Code-like client. */\nexport const COPILOT_HEADERS = {\n  'User-Agent': COPILOT_USER_AGENT,\n  'Editor-Version': 'vscode/1.107.0',\n  'Editor-Plugin-Version': 'copilot-chat/0.35.0',\n  'Copilot-Integration-Id': 'vscode-chat',\n} as const;\n\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\n\ntype DeviceCodeResponse = {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  interval: number;\n  expires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n  access_token: string;\n  token_type?: string;\n  scope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n  error: string;\n  error_description?: string;\n  interval?: number;\n};\n\n/**\n * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).\n * Returns null for an empty input or an unparseable URL.\n */\nexport function normalizeDomain(input: string): string | null {\n  const trimmed = input.trim();\n  if (!trimmed) return null;\n  try {\n    const url = trimmed.includes('://') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n    return url.hostname || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getUrls(domain: string): {\n  deviceCodeUrl: string;\n  accessTokenUrl: string;\n  copilotTokenUrl: string;\n} {\n  return {\n    deviceCodeUrl: `https://${domain}/login/device/code`,\n    accessTokenUrl: `https://${domain}/login/oauth/access_token`,\n    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n  };\n}\n\n/**\n * Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.\n * Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`\n */\nfunction getBaseUrlFromToken(token: string): string | null {\n  const match = token.match(/proxy-ep=([^;]+)/);\n  if (!match) return null;\n  const proxyHost = match[1]!;\n  const apiHost = proxyHost.replace(/^proxy\\./, 'api.');\n  return `https://${apiHost}`;\n}\n\n/**\n * Resolve the Copilot API base URL.\n * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.\n */\nexport function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string {\n  if (token) {\n    const fromToken = getBaseUrlFromToken(token);\n    if (fromToken) return fromToken;\n  }\n  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;\n  return 'https://api.individual.githubcopilot.com';\n}\n\nasync function fetchJson(url: string, init: RequestInit, signal?: AbortSignal): Promise<unknown> {\n  const response = await fetch(url, signal ? { ...init, signal } : init);\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`${response.status} ${response.statusText}: ${text}`);\n  }\n  return response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal?: AbortSignal): Promise<DeviceCodeResponse> {\n  const urls = getUrls(domain);\n  const data = await fetchJson(\n    urls.deviceCodeUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        scope: 'read:user',\n      }),\n    },\n    signal,\n  );\n\n  if (!data || typeof data !== 'object') {\n    throw new Error('Invalid device code response');\n  }\n\n  const obj = data as Record<string, unknown>;\n  const deviceCode = obj.device_code;\n  const userCode = obj.user_code;\n  const verificationUri = obj.verification_uri;\n  const interval = obj.interval;\n  const expiresIn = obj.expires_in;\n\n  if (\n    typeof deviceCode !== 'string' ||\n    typeof userCode !== 'string' ||\n    typeof verificationUri !== 'string' ||\n    typeof interval !== 'number' ||\n    typeof expiresIn !== 'number'\n  ) {\n    throw new Error('Invalid device code response fields');\n  }\n\n  return {\n    device_code: deviceCode,\n    user_code: userCode,\n    verification_uri: verificationUri,\n    interval,\n    expires_in: expiresIn,\n  };\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Serializable pending state for a Copilot device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests/replicas.\n */\nexport interface CopilotDeviceLoginPending {\n  /** GitHub host performing the flow (`github.com` or an Enterprise hostname). */\n  domain: string;\n  /** Enterprise hostname, or undefined for github.com. Recorded on the final credentials. */\n  enterpriseDomain?: string;\n  deviceCode: string;\n  userCode: string;\n  /** Verification URL for the user to open. */\n  url: string;\n  instructions: string;\n  /** Current base poll interval in ms (grows on slow_down). */\n  intervalMs: number;\n  /** Safety margin applied to intervalMs when computing the next wait. */\n  intervalMultiplier: number;\n  /** Number of slow_down responses seen (used for the clock-drift hint). */\n  slowDownCount: number;\n  /** ms epoch after which the device authorization expires. */\n  deadlineAt: number;\n}\n\nexport type CopilotDevicePollResult =\n  | { status: 'complete'; credentials: GitHubCopilotCredentials }\n  | { status: 'pending'; pending: CopilotDeviceLoginPending; nextPollMs: number }\n  | { status: 'failed'; error: string };\n\n/** Delay to wait before the next upstream poll for a pending Copilot device login. */\nexport function copilotNextPollDelayMs(pending: CopilotDeviceLoginPending): number {\n  return Math.ceil(pending.intervalMs * pending.intervalMultiplier);\n}\n\n/**\n * Start a Copilot device-code login: request a user code and return the\n * serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`\n * before the first poll.\n */\nexport async function startGitHubCopilotDeviceLogin(\n  enterpriseDomain?: string,\n  options?: { signal?: AbortSignal },\n): Promise<CopilotDeviceLoginPending> {\n  const domain = enterpriseDomain || 'github.com';\n  const device = await startDeviceFlow(domain, options?.signal);\n\n  return {\n    domain,\n    ...(enterpriseDomain ? { enterpriseDomain } : {}),\n    deviceCode: device.device_code,\n    userCode: device.user_code,\n    url: device.verification_uri,\n    instructions: `Enter code: ${device.user_code}`,\n    intervalMs: Math.max(1000, Math.floor(device.interval * 1000)),\n    intervalMultiplier: INITIAL_POLL_INTERVAL_MULTIPLIER,\n    slowDownCount: 0,\n    deadlineAt: Date.now() + device.expires_in * 1000,\n  };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Copilot device login.\n * On success, exchanges the GitHub OAuth token for a Copilot bearer token and\n * returns full credentials. Never throws for flow-level conditions; network\n * errors from fetch still propagate.\n */\nexport async function pollGitHubCopilotDeviceLogin(\n  pending: CopilotDeviceLoginPending,\n  options?: { signal?: AbortSignal; onProgress?: (message: string) => void },\n): Promise<CopilotDevicePollResult> {\n  if (Date.now() >= pending.deadlineAt) {\n    if (pending.slowDownCount > 0) {\n      return {\n        status: 'failed',\n        error:\n          'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.',\n      };\n    }\n    return { status: 'failed', error: 'Device flow timed out' };\n  }\n\n  const urls = getUrls(pending.domain);\n  const raw = await fetchJson(\n    urls.accessTokenUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        device_code: pending.deviceCode,\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n      }),\n    },\n    options?.signal,\n  );\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenSuccessResponse).access_token === 'string') {\n    const githubAccessToken = (raw as DeviceTokenSuccessResponse).access_token;\n    options?.onProgress?.('Fetching Copilot token...');\n    const credentials = await refreshGitHubCopilotToken(githubAccessToken, pending.enterpriseDomain, options?.signal);\n    return { status: 'complete', credentials };\n  }\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenErrorResponse).error === 'string') {\n    const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n\n    if (error === 'slow_down') {\n      const next: CopilotDeviceLoginPending = {\n        ...pending,\n        slowDownCount: pending.slowDownCount + 1,\n        intervalMs:\n          typeof interval === 'number' && interval > 0 ? interval * 1000 : Math.max(1000, pending.intervalMs + 5000),\n        intervalMultiplier: SLOW_DOWN_POLL_INTERVAL_MULTIPLIER,\n      };\n      return { status: 'pending', pending: next, nextPollMs: copilotNextPollDelayMs(next) };\n    }\n\n    if (error !== 'authorization_pending') {\n      const descriptionSuffix = description ? `: ${description}` : '';\n      return { status: 'failed', error: `Device flow failed: ${error}${descriptionSuffix}` };\n    }\n  }\n\n  // authorization_pending or an unrecognized-but-OK response: keep polling.\n  return { status: 'pending', pending, nextPollMs: copilotNextPollDelayMs(pending) };\n}\n\n/**\n * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.\n *\n * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a\n * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).\n */\nexport async function refreshGitHubCopilotToken(\n  refreshToken: string,\n  enterpriseDomain?: string,\n  signal?: AbortSignal,\n): Promise<GitHubCopilotCredentials> {\n  const domain = enterpriseDomain || 'github.com';\n  const urls = getUrls(domain);\n\n  const raw = await fetchJson(\n    urls.copilotTokenUrl,\n    {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${refreshToken}`,\n        ...COPILOT_HEADERS,\n      },\n    },\n    signal,\n  );\n\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('Invalid Copilot token response');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const token = obj.token;\n  const expiresAt = obj.expires_at;\n\n  if (typeof token !== 'string' || typeof expiresAt !== 'number') {\n    throw new Error('Invalid Copilot token response fields');\n  }\n\n  const credentials: GitHubCopilotCredentials = {\n    refresh: refreshToken,\n    access: token,\n    // expires_at is seconds; subtract 5 minutes so we refresh before actual expiry.\n    expires: expiresAt * 1000 - 5 * 60 * 1000,\n  };\n  if (enterpriseDomain) {\n    credentials.enterpriseUrl = enterpriseDomain;\n  }\n  return credentials;\n}\n\n/**\n * Login with GitHub Copilot OAuth (device-code flow).\n *\n * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,\n * then exchanges the GitHub OAuth token for a Copilot bearer token.\n */\nexport async function loginGitHubCopilot(options: {\n  onAuth: (url: string, instructions?: string) => void;\n  onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;\n  onProgress?: (message: string) => void;\n  signal?: AbortSignal;\n}): Promise<GitHubCopilotCredentials> {\n  const input = await options.onPrompt({\n    message: 'GitHub Enterprise URL/domain (blank for github.com)',\n    placeholder: 'company.ghe.com',\n    allowEmpty: true,\n  });\n\n  if (options.signal?.aborted) {\n    throw new Error('Login cancelled');\n  }\n\n  const trimmed = input.trim();\n  const enterpriseDomain = normalizeDomain(input);\n  if (trimmed && !enterpriseDomain) {\n    throw new Error('Invalid GitHub Enterprise URL/domain');\n  }\n  let pending = await startGitHubCopilotDeviceLogin(enterpriseDomain ?? undefined, { signal: options.signal });\n  options.onAuth(pending.url, pending.instructions);\n\n  while (true) {\n    if (options.signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n\n    // Wait before polling (safety margin over the server interval), clamped to the deadline.\n    const remainingMs = Math.max(pending.deadlineAt - Date.now(), 0);\n    await abortableSleep(Math.min(copilotNextPollDelayMs(pending), remainingMs), options.signal);\n\n    const result = await pollGitHubCopilotDeviceLogin(pending, {\n      signal: options.signal,\n      onProgress: options.onProgress,\n    });\n    if (result.status === 'complete') {\n      return result.credentials;\n    }\n    if (result.status === 'failed') {\n      throw new Error(result.error);\n    }\n    pending = result.pending;\n  }\n}\n\n/**\n * Filtered, normalized entry from the Copilot `/models` API.\n *\n * The full API payload includes a lot of capability metadata; we only keep the bits\n * we need to expose models in `listAvailableModels()` and route requests sensibly.\n */\nexport type CopilotModelEntry = {\n  /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */\n  id: string;\n  /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */\n  name: string;\n  /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */\n  vendor: string;\n  /**\n   * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).\n   * Empty when the API didn't return `supported_endpoints` for this entry.\n   */\n  supportedEndpoints: string[];\n  /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */\n  isAnthropicShaped: boolean;\n  /** True when `capabilities.supports.vision` is true. */\n  supportsVision: boolean;\n  /** True when the model supports tool calling. */\n  supportsToolCalls: boolean;\n};\n\n/**\n * Fetch the Copilot model list available to the current subscription.\n *\n * Hits `${baseURL}/models` with the Copilot bearer token, filters to\n * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns\n * a normalized list. Mirrors opencode's filtering rules.\n *\n * Inspired by:\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts\n */\nexport async function fetchCopilotModels(opts: {\n  baseUrl: string;\n  bearerToken: string;\n  signal?: AbortSignal;\n}): Promise<CopilotModelEntry[]> {\n  const url = `${opts.baseUrl.replace(/\\/$/, '')}/models`;\n  const response = await fetch(url, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `Bearer ${opts.bearerToken}`,\n      ...COPILOT_HEADERS,\n    },\n    signal: opts.signal,\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);\n  }\n\n  const json = await response.json().catch(() => null);\n  if (!json || typeof json !== 'object' || !Array.isArray((json as { data?: unknown }).data)) {\n    throw new Error('Invalid Copilot models response: missing `data` array');\n  }\n\n  const data = (json as { data: unknown[] }).data;\n  const result: CopilotModelEntry[] = [];\n\n  for (const item of data) {\n    if (!item || typeof item !== 'object') continue;\n    const obj = item as Record<string, unknown>;\n\n    if (obj.model_picker_enabled !== true) continue;\n\n    const policy = obj.policy as Record<string, unknown> | undefined;\n    if (policy && policy.state === 'disabled') continue;\n\n    const id = obj.id;\n    if (typeof id !== 'string' || !id) continue;\n\n    const name = typeof obj.name === 'string' ? obj.name : id;\n    const vendor = typeof obj.vendor === 'string' ? obj.vendor : '';\n\n    const capabilities = obj.capabilities as Record<string, unknown> | undefined;\n    const supports = capabilities?.supports as Record<string, unknown> | undefined;\n    const supportsVision = supports?.vision === true;\n    const supportsToolCalls = supports?.tool_calls === true;\n\n    const rawEndpoints = obj.supported_endpoints;\n    const supportedEndpoints = Array.isArray(rawEndpoints)\n      ? rawEndpoints.filter((e): e is string => typeof e === 'string')\n      : [];\n    const isAnthropicShaped = supportedEndpoints.includes('/v1/messages');\n\n    result.push({\n      id,\n      name,\n      vendor,\n      supportedEndpoints,\n      isAnthropicShaped,\n      supportsVision,\n      supportsToolCalls,\n    });\n  }\n\n  return result;\n}\n\nexport const githubCopilotOAuthProvider: OAuthProviderInterface = {\n  id: 'github-copilot',\n  name: 'GitHub Copilot',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginGitHubCopilot({\n      onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),\n      onPrompt: callbacks.onPrompt,\n      onProgress: callbacks.onProgress,\n      signal: callbacks.signal,\n    });\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    const creds = credentials as GitHubCopilotCredentials;\n    return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";AAoBA,MAAM,UAAU,MAAsB,KAAK,CAAC;AAE5C,MAAM,YAAY,OAAO,8BAA8B;AAEvD,MAAa,qBAAqB;;AAGlC,MAAa,kBAAkB;CAC7B,cAAc;CACd,kBAAkB;CAClB,yBAAyB;CACzB,0BAA0B;AAC5B;AAEA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;;;;;AA0B3C,SAAgB,gBAAgB,OAA8B;CAC5D,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI;EAEF,QADY,QAAQ,SAAS,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,SAAS,EAAA,CAC1E,YAAY;CACzB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,QAAQ,QAIf;CACA,OAAO;EACL,eAAe,WAAW,OAAO;EACjC,gBAAgB,WAAW,OAAO;EAClC,iBAAiB,eAAe,OAAO;CACzC;AACF;;;;;AAMA,SAAS,oBAAoB,OAA8B;CACzD,MAAM,QAAQ,MAAM,MAAM,kBAAkB;CAC5C,IAAI,CAAC,OAAO,OAAO;CAGnB,OAAO,WAFW,MAAM,EACC,CAAC,QAAQ,YAAY,MACtB;AAC1B;;;;;AAMA,SAAgB,wBAAwB,OAAgB,kBAAmC;CACzF,IAAI,OAAO;EACT,MAAM,YAAY,oBAAoB,KAAK;EAC3C,IAAI,WAAW,OAAO;CACxB;CACA,IAAI,kBAAkB,OAAO,uBAAuB;CACpD,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,MAAmB,QAAwC;CAC/F,MAAM,WAAW,MAAM,MAAM,KAAK,SAAS;EAAE,GAAG;EAAM;CAAO,IAAI,IAAI;CACrE,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,GAAG,SAAS,OAAO,GAAG,SAAS,WAAW,IAAI,MAAM;CACtE;CACA,OAAO,SAAS,KAAK;AACvB;AAEA,eAAe,gBAAgB,QAAgB,QAAmD;CAEhG,MAAM,OAAO,MAAM,UADN,QAAQ,MAEhB,CAAC,CAAC,eACL;EACE,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,WAAW;GACX,OAAO;EACT,CAAC;CACH,GACA,MACF;CAEA,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,MAAM,8BAA8B;CAGhD,MAAM,MAAM;CACZ,MAAM,aAAa,IAAI;CACvB,MAAM,WAAW,IAAI;CACrB,MAAM,kBAAkB,IAAI;CAC5B,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI;CAEtB,IACE,OAAO,eAAe,YACtB,OAAO,aAAa,YACpB,OAAO,oBAAoB,YAC3B,OAAO,aAAa,YACpB,OAAO,cAAc,UAErB,MAAM,IAAI,MAAM,qCAAqC;CAGvD,OAAO;EACL,aAAa;EACb,WAAW;EACX,kBAAkB;EAClB;EACA,YAAY;CACd;AACF;;AAGA,SAAS,eAAe,IAAY,QAAqC;CACvE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS;GACnB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;GACnC;EACF;EAEA,IAAI;EACJ,MAAM,gBAAgB;GACpB,aAAa,OAAO;GACpB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;EACrC;EAEA,UAAU,iBAAiB;GACzB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EAEL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;AAgCA,SAAgB,uBAAuB,SAA4C;CACjF,OAAO,KAAK,KAAK,QAAQ,aAAa,QAAQ,kBAAkB;AAClE;;;;;;AAOA,eAAsB,8BACpB,kBACA,SACoC;CACpC,MAAM,SAAS,oBAAoB;CACnC,MAAM,SAAS,MAAM,gBAAgB,QAAQ,SAAS,MAAM;CAE5D,OAAO;EACL;EACA,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;EAC/C,YAAY,OAAO;EACnB,UAAU,OAAO;EACjB,KAAK,OAAO;EACZ,cAAc,eAAe,OAAO;EACpC,YAAY,KAAK,IAAI,KAAM,KAAK,MAAM,OAAO,WAAW,GAAI,CAAC;EAC7D,oBAAoB;EACpB,eAAe;EACf,YAAY,KAAK,IAAI,IAAI,OAAO,aAAa;CAC/C;AACF;;;;;;;AAQA,eAAsB,6BACpB,SACA,SACkC;CAClC,IAAI,KAAK,IAAI,KAAK,QAAQ,YAAY;EACpC,IAAI,QAAQ,gBAAgB,GAC1B,OAAO;GACL,QAAQ;GACR,OACE;EACJ;EAEF,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAwB;CAC5D;CAGA,MAAM,MAAM,MAAM,UADL,QAAQ,QAAQ,MAExB,CAAC,CAAC,gBACL;EACE,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,WAAW;GACX,aAAa,QAAQ;GACrB,YAAY;EACd,CAAC;CACH,GACA,SAAS,MACX;CAEA,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAmC,iBAAiB,UAAU;EAC1G,MAAM,oBAAqB,IAAmC;EAC9D,SAAS,aAAa,2BAA2B;EAEjD,OAAO;GAAE,QAAQ;GAAY,aAAA,MADH,0BAA0B,mBAAmB,QAAQ,kBAAkB,SAAS,MAAM;EACvE;CAC3C;CAEA,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAiC,UAAU,UAAU;EACjG,MAAM,EAAE,OAAO,mBAAmB,aAAa,aAAa;EAE5D,IAAI,UAAU,aAAa;GACzB,MAAM,OAAkC;IACtC,GAAG;IACH,eAAe,QAAQ,gBAAgB;IACvC,YACE,OAAO,aAAa,YAAY,WAAW,IAAI,WAAW,MAAO,KAAK,IAAI,KAAM,QAAQ,aAAa,GAAI;IAC3G,oBAAoB;GACtB;GACA,OAAO;IAAE,QAAQ;IAAW,SAAS;IAAM,YAAY,uBAAuB,IAAI;GAAE;EACtF;EAEA,IAAI,UAAU,yBAEZ,OAAO;GAAE,QAAQ;GAAU,OAAO,uBAAuB,QAD/B,cAAc,KAAK,gBAAgB;EACwB;CAEzF;CAGA,OAAO;EAAE,QAAQ;EAAW;EAAS,YAAY,uBAAuB,OAAO;CAAE;AACnF;;;;;;;AAQA,eAAsB,0BACpB,cACA,kBACA,QACmC;CAInC,MAAM,MAAM,MAAM,UAFL,QADE,oBAAoB,YAI9B,CAAC,CAAC,iBACL,EACE,SAAS;EACP,QAAQ;EACR,eAAe,UAAU;EACzB,GAAG;CACL,EACF,GACA,MACF;CAEA,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,MAAM,gCAAgC;CAGlD,MAAM,MAAM;CACZ,MAAM,QAAQ,IAAI;CAClB,MAAM,YAAY,IAAI;CAEtB,IAAI,OAAO,UAAU,YAAY,OAAO,cAAc,UACpD,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,cAAwC;EAC5C,SAAS;EACT,QAAQ;EAER,SAAS,YAAY,MAAO,MAAS;CACvC;CACA,IAAI,kBACF,YAAY,gBAAgB;CAE9B,OAAO;AACT;;;;;;;AAQA,eAAsB,mBAAmB,SAKH;CACpC,MAAM,QAAQ,MAAM,QAAQ,SAAS;EACnC,SAAS;EACT,aAAa;EACb,YAAY;CACd,CAAC;CAED,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;CAGnC,MAAM,UAAU,MAAM,KAAK;CAC3B,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,IAAI,WAAW,CAAC,kBACd,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,UAAU,MAAM,8BAA8B,oBAAoB,KAAA,GAAW,EAAE,QAAQ,QAAQ,OAAO,CAAC;CAC3G,QAAQ,OAAO,QAAQ,KAAK,QAAQ,YAAY;CAEhD,OAAO,MAAM;EACX,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;EAInC,MAAM,cAAc,KAAK,IAAI,QAAQ,aAAa,KAAK,IAAI,GAAG,CAAC;EAC/D,MAAM,eAAe,KAAK,IAAI,uBAAuB,OAAO,GAAG,WAAW,GAAG,QAAQ,MAAM;EAE3F,MAAM,SAAS,MAAM,6BAA6B,SAAS;GACzD,QAAQ,QAAQ;GAChB,YAAY,QAAQ;EACtB,CAAC;EACD,IAAI,OAAO,WAAW,YACpB,OAAO,OAAO;EAEhB,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,MAAM,OAAO,KAAK;EAE9B,UAAU,OAAO;CACnB;AACF;;;;;;;;;;;AAsCA,eAAsB,mBAAmB,MAIR;CAC/B,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,EAAE;CAC/C,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,KAAK;GAC9B,GAAG;EACL;EACA,QAAQ,KAAK;CACf,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,mCAAmC,SAAS,OAAO,GAAG,SAAS,WAAW,IAAI,MAAM;CACtG;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;CACnD,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAS,KAA4B,IAAI,GACvF,MAAM,IAAI,MAAM,uDAAuD;CAGzE,MAAM,OAAQ,KAA6B;CAC3C,MAAM,SAA8B,CAAC;CAErC,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,MAAM,MAAM;EAEZ,IAAI,IAAI,yBAAyB,MAAM;EAEvC,MAAM,SAAS,IAAI;EACnB,IAAI,UAAU,OAAO,UAAU,YAAY;EAE3C,MAAM,KAAK,IAAI;EACf,IAAI,OAAO,OAAO,YAAY,CAAC,IAAI;EAEnC,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;EACvD,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;EAG7D,MAAM,WADe,IAAI,cACM;EAC/B,MAAM,iBAAiB,UAAU,WAAW;EAC5C,MAAM,oBAAoB,UAAU,eAAe;EAEnD,MAAM,eAAe,IAAI;EACzB,MAAM,qBAAqB,MAAM,QAAQ,YAAY,IACjD,aAAa,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;EACL,MAAM,oBAAoB,mBAAmB,SAAS,cAAc;EAEpE,OAAO,KAAK;GACV;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH;CAEA,OAAO;AACT;AAEA,MAAa,6BAAqD;CAChE,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,mBAAmB;GACxB,SAAS,KAAK,iBAAiB,UAAU,OAAO;IAAE;IAAK;GAAa,CAAC;GACrE,UAAU,UAAU;GACpB,YAAY,UAAU;GACtB,QAAQ,UAAU;EACpB,CAAC;CACH;CAEA,MAAM,aAAa,aAA0D;EAC3E,MAAM,QAAQ;EACd,OAAO,0BAA0B,MAAM,SAAS,MAAM,aAAa;CACrE;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}