@namzu/cli 12.1.0 → 13.0.0

package/dist/integrations/providers/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC5B,IAAI,GAAG,sBAAsB,CAAA;CAC/C;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC/C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAA;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,GAAG,GAAG,GAA8B,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACjF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YAC/D,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAA0B,EAC1B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAC7B;QACC,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;KACD,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CAAA;IAEL,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,qEAAqE;QACrE,mEAAmE;QACnE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IAEb,IAAI,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iCAAiC,CAAC,OAAe,OAAO,EAAE;IACzE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,OAAM;IACP,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC7B,0CAA0C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,uCAAuC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kFAAkF,CAC1J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAU,EAAE;QAC5D,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAC7B,GAAG,GAAG,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAC/J,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC7B,uFAAuF,IAAI,yBAAyB,CACpH,CAAA;IACF,CAAC;IAED,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC7B,kDAAkD,IAAI,oCAAoC,CAC1F,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC7B,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,+FAA+F,CACtG,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,kDAAkD,OAAO,0CAA0C,CAC1G,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,qFAAqF,CAC5F,CAAA;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,EACb,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC5B,IAAI,GAAG,sBAAsB,CAAA;CAC/C;AAMD,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC/C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAA;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,GAAG,GAAG,GAA8B,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACjF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YAC/D,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAA0B,EAC1B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,yCAAyC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAClG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAClD,QAA8B,EAC9B,WAAiC,EACjC,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAC3E,yCAAyC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,yCAAyC,CACjD,IAA0B,EAC1B,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAC7B;QACC,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;KACD,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CAAA;IAEL,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,qEAAqE;QACrE,mEAAmE;QACnE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IAEb,IAAI,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iCAAiC,CAAC,OAAe,OAAO,EAAE;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAiC,EAAE,KAA2B;IACrF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IACC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EACjC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IACtC,OAAO,CACN,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAChE,CAAA;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAI,IAAY,EAAE,SAAkB;IACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/E,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC7B,mDAAmD,IAAI,8DAA8D,SAAS,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,0GAA0G,QAAQ,aAAa,CACxU,CAAA;IACF,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,SAAS,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACV,2EAA2E;QAC3E,IAAI,CAAC;YACJ,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;YACtE,yDAAyD;QAC1D,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC7B,QAAgB,EAChB,KAAa;IAEb,MAAM,aAAa,GAAG,GAAG,QAAQ,cAAc,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/F,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChC,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,EAAE,GAAG,SAAS,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,IAAI,oBAAoB,CAC7B,gDAAgD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAA;IACF,CAAC;IAED,IAAI,CAAC;QACJ,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAClC,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,uEAAuE;YACvE,4DAA4D;QAC7D,CAAC;IACF,CAAC;AACF,CAAC;AACD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,OAAM;IACP,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC7B,0CAA0C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,uCAAuC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kFAAkF,CAC1J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAU,EAAE;QAC5D,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAC7B,GAAG,GAAG,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAC/J,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC7B,uFAAuF,IAAI,yBAAyB,CACpH,CAAA;IACF,CAAC;IAED,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC7B,kDAAkD,IAAI,oCAAoC,CAC1F,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC7B,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,+FAA+F,CACtG,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,kDAAkD,OAAO,0CAA0C,CAC1G,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,qFAAqF,CAC5F,CAAA;IACF,CAAC;AACF,CAAC"}

package/dist/integrations/providers/index.d.ts

@@ -2,10 +2,10 @@ export { type DetectedProvider, type DetectionSource, type DiscoverOptions, disc
 export { type AgentOAuthCredential, isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
 export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
-export { type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, } from './oauth.js';
+export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, type LoginOutcome, parsePastedInput, type SubscriptionLogin, type SubscriptionLoginOptions, subscriptionDetectedProvider, } from './subscription-login.js';
 export { type CapabilityDisagreement, chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, type MemberCapabilities, unresolvedMembers, } from './chain-capabilities.js';
 export { chainPositionName, type Preferences, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, type ProviderChoice, type ReadResult, readPreferences, writePreferences, } from './preferences.js';
 export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, type ProviderId, type ProviderRegistryEntry, type SdkProviderType, unsupportedProviderMessage, } from './registry.js';
-export { ensureRegistered, isRegistered, resolveChainCapabilities } from './register.js';
+export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/integrations/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/index.js

@@ -2,10 +2,10 @@ export { discoverProviders, findDetected, } from './discover.js';
 export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
 export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
-export { ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, } from './oauth.js';
+export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';
 export { chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, unresolvedMembers, } from './chain-capabilities.js';
 export { chainPositionName, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, readPreferences, writePreferences, } from './preferences.js';
 export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, unsupportedProviderMessage, } from './registry.js';
-export { ensureRegistered, isRegistered, resolveChainCapabilities } from './register.js';
+export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
 //# sourceMappingURL=index.js.map

package/dist/integrations/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAEN,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAIjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAIjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/keychain.d.ts

@@ -23,19 +23,6 @@ export interface AgentOAuthCredential {
     readonly scopes?: readonly string[];
 }
 export declare function readAgentKeychainCredential(): AgentOAuthCredential | null;
-/**
- * Persist a refreshed OAuth credential back into the same Keychain entry so
- * the new access token survives across launches and the other CLI stays in
- * sync. The full envelope is re-read and merged (only the OAuth sub-fields
- * change) so any extra keys it stores are preserved. Non-throwing:
- * returns `false` (not-darwin, no entry, missing account, write denied) and
- * the caller falls back to using the refreshed token only in memory.
- *
- * Note: `security` takes the secret as an argv (`-w`), so it is briefly
- * visible to `ps` — acceptable for a local dev CLI updating a credential that
- * already lives on this machine.
- */
-export declare function writeAgentKeychainCredential(cred: AgentOAuthCredential): boolean;
 /**
  * Detect whether a credential value is an OAuth-style token
  * (must be sent via `Authorization: Bearer`) vs a console API key (sent

package/dist/integrations/providers/keychain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,4BAA4B,CAAA;AAEzD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAmCzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAiDhF;AAiBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5D"}
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,4BAA4B,CAAA;AAEzD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAmCzE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5D"}

package/dist/integrations/providers/keychain.js

@@ -59,82 +59,6 @@ export function readAgentKeychainCredential() {
             : undefined,
     };
 }
-/**
- * Persist a refreshed OAuth credential back into the same Keychain entry so
- * the new access token survives across launches and the other CLI stays in
- * sync. The full envelope is re-read and merged (only the OAuth sub-fields
- * change) so any extra keys it stores are preserved. Non-throwing:
- * returns `false` (not-darwin, no entry, missing account, write denied) and
- * the caller falls back to using the refreshed token only in memory.
- *
- * Note: `security` takes the secret as an argv (`-w`), so it is briefly
- * visible to `ps` — acceptable for a local dev CLI updating a credential that
- * already lives on this machine.
- */
-export function writeAgentKeychainCredential(cred) {
-    if (platform() !== 'darwin')
-        return false;
-    // `add-generic-password -U` matches an existing item by service + account,
-    // so we must reuse the original account or we'd create a duplicate entry.
-    const account = readKeychainAccount();
-    if (!account)
-        return false;
-    let envelope = {};
-    try {
-        const raw = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === 'object' && parsed !== null)
-            envelope = parsed;
-    }
-    catch {
-        // Fall back to a fresh envelope below.
-    }
-    const prev = typeof envelope.claudeAiOauth === 'object' && envelope.claudeAiOauth !== null
-        ? envelope.claudeAiOauth
-        : {};
-    envelope.claudeAiOauth = {
-        ...prev,
-        accessToken: cred.accessToken,
-        ...(cred.refreshToken ? { refreshToken: cred.refreshToken } : {}),
-        ...(cred.expiresAt ? { expiresAt: cred.expiresAt } : {}),
-        ...(cred.scopes ? { scopes: cred.scopes } : {}),
-    };
-    try {
-        execFileSync('security', [
-            'add-generic-password',
-            '-U',
-            '-s',
-            KEYCHAIN_SERVICE,
-            '-a',
-            account,
-            '-w',
-            JSON.stringify(envelope),
-        ], { timeout: 5_000, stdio: ['ignore', 'ignore', 'ignore'] });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Read the account (`acct`) of the Keychain entry, for updates. */
-function readKeychainAccount() {
-    try {
-        const out = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE], {
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const m = out.match(/"acct"<blob>="((?:[^"\\]|\\.)*)"/);
-        return m?.[1] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Detect whether a credential value is an OAuth-style token
  * (must be sent via `Authorization: Bearer`) vs a console API key (sent

package/dist/integrations/providers/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AASzD,MAAM,UAAU,2BAA2B;IAC1C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAExC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAsC,CAAC,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrF,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YACjE,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACtE,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACzC,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAA;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YAC7F,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,QAAQ,GAAG,MAAiC,CAAA;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,uCAAuC;IACxC,CAAC;IACD,MAAM,IAAI,GACT,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC5E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAA;IACN,QAAQ,CAAC,aAAa,GAAG;QACxB,GAAG,IAAI;QACP,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAA;IACD,IAAI,CAAC;QACJ,YAAY,CACX,UAAU,EACV;YACC,sBAAsB;YACtB,IAAI;YACJ,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SACxB,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACzD,CAAA;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB;IAC3B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,kBAAkB;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,MAAM;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;IACvF,OAAO,KAAK,CAAA;AACb,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AASzD,MAAM,UAAU,2BAA2B;IAC1C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAExC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAsC,CAAC,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrF,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YACjE,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,kBAAkB;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,MAAM;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;IACvF,OAAO,KAAK,CAAA;AACb,CAAC"}

package/dist/integrations/providers/oauth.d.ts

@@ -7,27 +7,29 @@
  * stale token before the session starts instead of surfacing it as an
  * authentication error.
  *
- * Non-throwing: any failure (no refresh token, network down, endpoint error)
- * returns the existing token unchanged — at worst the caller hits the same
- * 401 it would have hit anyway, never a crash.
+ * Best-effort for transient refresh failures: no refresh token, a network
+ * failure, an ordinary endpoint refusal or the private deadline all return the
+ * existing token. `invalid_grant` is different: the authorization grant is no
+ * longer usable, so sending the expired access token or retrying the same
+ * refresh on every turn cannot recover. It is a typed refusal. Caller
+ * cancellation also escapes with its exact cause.
  *
  * ## Where a refreshed token is written back
  *
  * There are two places a subscription credential can live and they are not
  * interchangeable, so `origin` says which one this credential came from and
- * the refreshed value goes back to the same place:
+ * therefore which publication rule applies:
  *
  *  - `'stored'` — namzu's own store, written by the login flow, present on
- *    every platform.
+ *    every platform. A refresh replaces only the exact credential it used.
  *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
- *    does not own.
+ *    does not own. A refresh is session-local and never writes that entry.
  *
  * `origin` is optional and defaults to `'keychain'` because that is the only
- * source that existed when this file was written, and a caller compiled
- * against the old shape must keep behaving as it did. Every namzu-owned
- * caller passes it explicitly; a credential that came from the login flow and
- * was written back to the Keychain would be a no-op off macOS, leaving the
- * real store holding a token that is refreshed again on every launch.
+ * source that existed when this file was written. Every namzu-owned caller
+ * passes it explicitly; a credential from the login flow misclassified as
+ * Keychain-origin would remain stale on disk and refresh again on every
+ * launch.
  */
 import { type AgentOAuthCredential } from './keychain.js';
 /**
@@ -49,20 +51,47 @@ import { type AgentOAuthCredential } from './keychain.js';
  * at detection; everything after that is told, not asked.
  */
 export declare function readSubscriptionCredential(origin: CredentialOrigin): AgentOAuthCredential | null;
-/** Which store a subscription credential came from, and goes back to. */
+/** Which store a subscription credential came from and therefore who owns publication. */
 export type CredentialOrigin = 'stored' | 'keychain';
 export interface OAuthMetadata {
     readonly refreshToken?: string;
     readonly expiresAt?: number;
+    readonly scopes?: readonly string[];
     /** Defaults to `'keychain'` — see the note at the top of this file. */
     readonly origin?: CredentialOrigin;
 }
+/** The credential that authorized a refresh was removed before publication. */
+export declare class CredentialWithdrawnError extends Error {
+    readonly name = "CredentialWithdrawnError";
+    constructor();
+}
+/** The store could not prove whether the refresh still owned publication. */
+export declare class CredentialPublicationError extends Error {
+    readonly name = "CredentialPublicationError";
+    constructor(options?: ErrorOptions);
+}
+/** The authorization server says this exact refresh grant cannot be used again. */
+export declare class CredentialRefreshRejectedError extends Error {
+    readonly name = "CredentialRefreshRejectedError";
+    readonly code: "invalid_grant";
+    constructor();
+}
 /**
  * Return a non-expired access token, refreshing first if the current one is
  * lapsed/about-to-lapse and a refresh token is available. On a successful
- * refresh the new credential is persisted back to its own store (best-effort).
+ * refresh a Namzu-owned credential is conditionally persisted. A borrowed
+ * Keychain credential is used only in memory because its owner cannot
+ * participate in our conditional-write boundary.
+ */
+export declare function ensureFreshAnthropicToken(accessToken: string, oauth: OAuthMetadata, signal?: AbortSignal): Promise<string>;
+/** Exact credential identity used by refresh publication and the live-session refusal cache. */
+export declare function sameOAuthCredential(left: AgentOAuthCredential, right: AgentOAuthCredential): boolean;
+/**
+ * Exchange a refresh token for a new credential.
+ *
+ * Transient/unclassified failures return `null`. A standards-defined
+ * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
+ * the same grant is not recovery.
  */
-export declare function ensureFreshAnthropicToken(accessToken: string, oauth: OAuthMetadata): Promise<string>;
-/** Exchange a refresh token for a new credential, or `null` on any failure. */
-export declare function refreshAgentOAuthToken(refreshToken: string): Promise<AgentOAuthCredential | null>;
+export declare function refreshAgentOAuthToken(refreshToken: string, signal?: AbortSignal): Promise<AgentOAuthCredential | null>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/integrations/providers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAWH,OAAO,EACN,KAAK,oBAAoB,EAGzB,MAAM,eAAe,CAAA;AAKtB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAEhG;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CASjB;AAgDD,+EAA+E;AAC/E,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA2BtC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAEhG;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;;CAKnD;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AA6DD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6DtC"}

package/dist/integrations/providers/oauth.js

@@ -7,35 +7,69 @@
  * stale token before the session starts instead of surfacing it as an
  * authentication error.
  *
- * Non-throwing: any failure (no refresh token, network down, endpoint error)
- * returns the existing token unchanged — at worst the caller hits the same
- * 401 it would have hit anyway, never a crash.
+ * Best-effort for transient refresh failures: no refresh token, a network
+ * failure, an ordinary endpoint refusal or the private deadline all return the
+ * existing token. `invalid_grant` is different: the authorization grant is no
+ * longer usable, so sending the expired access token or retrying the same
+ * refresh on every turn cannot recover. It is a typed refusal. Caller
+ * cancellation also escapes with its exact cause.
  *
  * ## Where a refreshed token is written back
  *
  * There are two places a subscription credential can live and they are not
  * interchangeable, so `origin` says which one this credential came from and
- * the refreshed value goes back to the same place:
+ * therefore which publication rule applies:
  *
  *  - `'stored'` — namzu's own store, written by the login flow, present on
- *    every platform.
+ *    every platform. A refresh replaces only the exact credential it used.
  *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
- *    does not own.
+ *    does not own. A refresh is session-local and never writes that entry.
  *
  * `origin` is optional and defaults to `'keychain'` because that is the only
- * source that existed when this file was written, and a caller compiled
- * against the old shape must keep behaving as it did. Every namzu-owned
- * caller passes it explicitly; a credential that came from the login flow and
- * was written back to the Keychain would be a no-op off macOS, leaving the
- * real store holding a token that is refreshed again on every launch.
+ * source that existed when this file was written. Every namzu-owned caller
+ * passes it explicitly; a credential from the login flow misclassified as
+ * Keychain-origin would remain stale on disk and refresh again on every
+ * launch.
  */
 import { buildProbeContext, probe } from '@namzu/sdk';
 import { SUBSCRIPTION_CREDENTIAL_REF } from './credential-provider.js';
-import { credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
+import { credentialsPath, readStoredSubscriptionCredential, replaceStoredSubscriptionCredential, } from './credential-store.js';
 import { OAUTH_CLIENT_ID, OAUTH_TOKEN_URL } from './identity.js';
-import { readAgentKeychainCredential, writeAgentKeychainCredential, } from './keychain.js';
+import { readAgentKeychainCredential } from './keychain.js';
 /** Refresh a few seconds early so an about-to-expire token isn't used. */
 const EXPIRY_SKEW_MS = 60_000;
+/** One refresh request, including its response body, may hold a caller this long. */
+const REFRESH_DEADLINE_MS = 30_000;
+class RefreshDeadlineError extends Error {
+    constructor() {
+        super(`The token endpoint did not answer within ${REFRESH_DEADLINE_MS}ms.`);
+        this.name = 'RefreshDeadlineError';
+    }
+}
+/**
+ * Settle independently of a foreign promise that may ignore its signal.
+ *
+ * Passing `signal` to fetch is cooperative. This race is the host-owned
+ * boundary that makes cancellation and the refresh deadline true even for a
+ * custom transport or response body that never settles.
+ */
+async function awaitWithSignal(operation, signal) {
+    signal.throwIfAborted();
+    let rejectAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        rejectAbort = reject;
+    });
+    const onAbort = () => rejectAbort(signal.reason);
+    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    try {
+        return await Promise.race([operation, aborted]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /**
  * Re-read the current credential from the store it lives in.
  *
@@ -57,30 +91,56 @@ const EXPIRY_SKEW_MS = 60_000;
 export function readSubscriptionCredential(origin) {
     return origin === 'stored' ? readStoredSubscriptionCredential() : readAgentKeychainCredential();
 }
+/** The credential that authorized a refresh was removed before publication. */
+export class CredentialWithdrawnError extends Error {
+    name = 'CredentialWithdrawnError';
+    constructor() {
+        super('The subscription credential was removed while it was being refreshed.');
+    }
+}
+/** The store could not prove whether the refresh still owned publication. */
+export class CredentialPublicationError extends Error {
+    name = 'CredentialPublicationError';
+    constructor(options) {
+        super('The refreshed subscription credential could not be published safely.', options);
+    }
+}
+/** The authorization server says this exact refresh grant cannot be used again. */
+export class CredentialRefreshRejectedError extends Error {
+    name = 'CredentialRefreshRejectedError';
+    code = 'invalid_grant';
+    constructor() {
+        super('The subscription refresh token is no longer usable. Sign in again with /login.');
+    }
+}
 /**
  * Return a non-expired access token, refreshing first if the current one is
  * lapsed/about-to-lapse and a refresh token is available. On a successful
- * refresh the new credential is persisted back to its own store (best-effort).
+ * refresh a Namzu-owned credential is conditionally persisted. A borrowed
+ * Keychain credential is used only in memory because its owner cannot
+ * participate in our conditional-write boundary.
  */
-export async function ensureFreshAnthropicToken(accessToken, oauth) {
+export async function ensureFreshAnthropicToken(accessToken, oauth, signal) {
+    signal?.throwIfAborted();
     const fresh = oauth.expiresAt === undefined || oauth.expiresAt - Date.now() > EXPIRY_SKEW_MS;
     if (fresh)
         return accessToken;
     if (!oauth.refreshToken)
         return accessToken;
-    const refreshed = await refreshAgentOAuthToken(oauth.refreshToken);
+    const refreshed = await refreshAgentOAuthToken(oauth.refreshToken, signal);
     if (!refreshed)
         return accessToken;
-    persistRefreshed(refreshed, oauth.origin ?? 'keychain');
-    return refreshed.accessToken;
+    // The response body was the final foreign await. Re-check immediately at
+    // the durable boundary so a stopped run cannot rotate a credential later.
+    signal?.throwIfAborted();
+    const expected = {
+        accessToken,
+        refreshToken: oauth.refreshToken,
+        expiresAt: oauth.expiresAt,
+        scopes: oauth.scopes,
+    };
+    return publishRefreshed(expected, refreshed, oauth.origin ?? 'keychain').accessToken;
 }
-/**
- * Write a refreshed credential back to the store it came from.
- *
- * Best-effort in both arms, and for the same reason the refresh itself is:
- * the token is already in hand and usable for this session, so a store that
- * will not take it costs a re-refresh next launch, not the session.
- */
 /**
  * Say that a credential turned over, without saying what it turned into.
  *
@@ -98,28 +158,73 @@ function announceRotation(replaced) {
         ref: SUBSCRIPTION_CREDENTIAL_REF,
     }, buildProbeContext());
 }
-function persistRefreshed(cred, origin) {
+function publishRefreshed(expected, refreshed, origin) {
     if (origin === 'keychain') {
-        writeAgentKeychainCredential(cred);
-        return;
+        // This entry belongs to another product, whose writer cannot participate
+        // in a Namzu lock or conditional update. Never overwrite it. A rotation
+        // that landed while the request was pending wins for this session; when it
+        // is unchanged, the refreshed token remains session-local.
+        const current = readAgentKeychainCredential();
+        if (!current)
+            throw new CredentialWithdrawnError();
+        return !sameOAuthCredential(current, expected) ? current : refreshed;
+    }
+    let result;
+    try {
+        result = replaceStoredSubscriptionCredential(expected, refreshed);
+    }
+    catch (error) {
+        // A busy lock may be an external rotation in progress. Falling back to
+        // A' here would turn a failed CAS into permission to ignore its winner.
+        throw new CredentialPublicationError({ cause: error });
+    }
+    if (!result.replaced) {
+        if (!result.current)
+            throw new CredentialWithdrawnError();
+        return result.current;
     }
+    // Announced only after the store proved the file private. A rotation event
+    // for a write that refused would have a reader chasing a turn-over that
+    // never happened. Probe failure is observability failure, not permission to
+    // undo a credential that is already durably committed.
     try {
-        writeStoredSubscriptionCredential(cred);
-        // Announced only after the store proved the file private. A rotation
-        // event for a write that refused would have a reader chasing a
-        // credential turn-over that never happened.
-        announceRotation(cred.accessToken !== undefined);
+        announceRotation(refreshed.accessToken !== undefined);
     }
     catch {
-        // The store refused to prove the file private and therefore wrote
-        // nothing. Deliberately silent: the message would be about a file, on
-        // a path the operator did not ask about, in the middle of a turn.
+        // The credential is already committed. Telemetry cannot roll it back.
     }
+    return refreshed;
 }
-/** Exchange a refresh token for a new credential, or `null` on any failure. */
-export async function refreshAgentOAuthToken(refreshToken) {
+/** Exact credential identity used by refresh publication and the live-session refusal cache. */
+export function sameOAuthCredential(left, right) {
+    if (left.accessToken !== right.accessToken ||
+        left.refreshToken !== right.refreshToken ||
+        left.expiresAt !== right.expiresAt) {
+        return false;
+    }
+    const leftScopes = left.scopes ?? [];
+    const rightScopes = right.scopes ?? [];
+    return (leftScopes.length === rightScopes.length &&
+        leftScopes.every((scope, index) => scope === rightScopes[index]));
+}
+/**
+ * Exchange a refresh token for a new credential.
+ *
+ * Transient/unclassified failures return `null`. A standards-defined
+ * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
+ * the same grant is not recovery.
+ */
+export async function refreshAgentOAuthToken(refreshToken, signal) {
+    signal?.throwIfAborted();
+    const requestController = new AbortController();
+    const timeoutCause = new RefreshDeadlineError();
+    const onCallerAbort = () => requestController.abort(signal?.reason);
+    signal?.addEventListener('abort', onCallerAbort, { once: true });
+    if (signal?.aborted)
+        onCallerAbort();
+    const timer = setTimeout(() => requestController.abort(timeoutCause), REFRESH_DEADLINE_MS);
     try {
-        const res = await fetch(OAUTH_TOKEN_URL, {
+        const res = await awaitWithSignal(fetch(OAUTH_TOKEN_URL, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({
@@ -127,10 +232,19 @@ export async function refreshAgentOAuthToken(refreshToken) {
                 refresh_token: refreshToken,
                 client_id: OAUTH_CLIENT_ID,
             }),
-        });
-        if (!res.ok)
+            signal: requestController.signal,
+        }), requestController.signal);
+        signal?.throwIfAborted();
+        if (!res.ok) {
+            if (res.status === 400) {
+                const failure = (await awaitWithSignal(res.json(), requestController.signal));
+                if (typeof failure?.error === 'string' && failure.error.toLowerCase() === 'invalid_grant') {
+                    throw new CredentialRefreshRejectedError();
+                }
+            }
             return null;
-        const data = (await res.json());
+        }
+        const data = (await awaitWithSignal(res.json(), requestController.signal));
         if (typeof data.access_token !== 'string' || data.access_token.length === 0)
             return null;
         return {
@@ -139,8 +253,21 @@ export async function refreshAgentOAuthToken(refreshToken) {
             expiresAt: typeof data.expires_in === 'number' ? Date.now() + data.expires_in * 1_000 : undefined,
         };
     }
-    catch {
+    catch (error) {
+        if (error instanceof CredentialRefreshRejectedError)
+            throw error;
+        // A cooperative transport may replace the request cause with a generic
+        // AbortError. The fused controller is the first-cause latch: only a caller
+        // reason that actually won is allowed to escape as cancellation. A later
+        // caller abort cannot relabel the private deadline.
+        if (signal?.aborted && requestController.signal.reason === signal.reason) {
+            throw signal.reason;
+        }
         return null;
     }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', onCallerAbort);
+    }
 }
 //# sourceMappingURL=oauth.js.map