@namzu/cli 14.1.0 → 14.2.1

package/dist/integrations/providers/harness-credentials.js

@@ -1,19 +1,66 @@
-/**
- * Read-only adapters for credentials owned by co-installed agent harnesses.
- *
- * These files are authorities, not migration inputs. Namzu reads the whole
- * record, validates only the fields its provider wire needs, and never writes
- * either file. In particular, refresh tokens remain owned by the harness that
- * obtained them; consuming a single-use refresh grant here would race that
- * owner and could log it out.
- */
-import { readFileSync, statSync } from 'node:fs';
+/** Adapters for credentials owned by co-installed agent harnesses. */
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { closeSync, fsyncSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 const MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;
 export function claudeCredentialsPath(home = homedir()) {
     return join(home, '.claude', '.credentials.json');
 }
+/** Convert an absolute Windows path into the drive mount WSL exposes. */
+export function windowsPathToWsl(path) {
+    const normalized = path.trim().replaceAll('\\', '/');
+    const match = /^([A-Za-z]):\/(.+)$/u.exec(normalized);
+    if (!match?.[1] || !match[2] || match[2].split('/').includes('..'))
+        return null;
+    return `/mnt/${match[1].toLowerCase()}/${match[2]}`;
+}
+/**
+ * Resolve the Windows account paired with this WSL process.
+ *
+ * The Windows executable is pinned instead of searched through PATH: this
+ * lookup decides where a credential may be read, so a project-local `cmd.exe`
+ * must not be able to redirect it. Failure is an ordinary "no second home"
+ * result; native Linux never starts a process.
+ */
+export function wslWindowsHome(env = process.env, run = execFileSync, command = '/mnt/c/Windows/System32/cmd.exe') {
+    if (!env.WSL_DISTRO_NAME && !env.WSL_INTEROP)
+        return null;
+    try {
+        if (!statSync(command).isFile())
+            return null;
+        const output = run(command, ['/d', '/s', '/c', 'echo', '%USERPROFILE%'], {
+            encoding: 'utf8',
+            timeout: 1_000,
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return windowsPathToWsl(String(output));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Usable Claude sessions visible from this process, freshest first.
+ *
+ * WSL is one device with two home directories in practice. Claude may be
+ * installed and signed in on Windows while Namzu runs inside WSL; treating the
+ * Linux home as the whole device turns that valid subscription into a missing
+ * credential. An explicit `home` remains hermetic for embeds and tests.
+ */
+export function readClaudeFileCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
+    const paths = [
+        claudeCredentialsPath(home),
+        ...(windowsHome ? [claudeCredentialsPath(windowsHome)] : []),
+    ];
+    const unique = [...new Set(paths)];
+    return unique.flatMap((path) => {
+        const credential = readClaudeCredentialFile(path);
+        return credential ? [{ path, credential }] : [];
+    });
+}
 export function codexCredentialsPath(home = homedir(), env = process.env) {
     const configured = env.CODEX_HOME?.trim();
     const root = configured
@@ -65,6 +112,73 @@ export function readClaudeCredentialFile(path) {
         scopes: optionalStringArray(oauth?.scopes),
     };
 }
+function sameClaudeCredential(left, right) {
+    return (left.accessToken === right.accessToken &&
+        left.refreshToken === right.refreshToken &&
+        left.expiresAt === right.expiresAt &&
+        JSON.stringify(left.scopes ?? []) === JSON.stringify(right.scopes ?? []));
+}
+/**
+ * Publish a refreshed Claude session back to the exact owner file discovered.
+ *
+ * Claude refresh grants may rotate. Keeping the successor only in Namzu would
+ * consume the owner's grant and leave its file unusable, so this preserves the
+ * full envelope and atomically replaces only its OAuth fields. The final
+ * re-read lets an owner rotation that completed during the network request win.
+ * Claude does not participate in Namzu's lock, so this is intentionally not
+ * described as a cross-process CAS; it is the strongest owner-compatible
+ * publication available for this shared file format.
+ */
+export function replaceClaudeCredentialFile(path, expected, replacement) {
+    const root = record(readCredentialJson(path));
+    const oauth = record(root?.claudeAiOauth);
+    const current = readClaudeCredentialFile(path);
+    if (!root || !oauth || !current)
+        return { replaced: false, current };
+    if (!sameClaudeCredential(current, expected))
+        return { replaced: false, current };
+    const updated = {
+        ...root,
+        claudeAiOauth: {
+            ...oauth,
+            accessToken: replacement.accessToken,
+            ...(replacement.refreshToken === undefined ? {} : { refreshToken: replacement.refreshToken }),
+            ...(replacement.expiresAt === undefined ? {} : { expiresAt: replacement.expiresAt }),
+            ...(replacement.scopes === undefined ? {} : { scopes: replacement.scopes }),
+        },
+    };
+    const tempPath = join(dirname(path), `.${basename(path)}.namzu-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(tempPath, 'wx', 0o600);
+        writeFileSync(descriptor, `${JSON.stringify(updated, null, 2)}\n`, 'utf8');
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        const beforeCommit = readClaudeCredentialFile(path);
+        if (!beforeCommit || !sameClaudeCredential(beforeCommit, expected)) {
+            return { replaced: false, current: beforeCommit };
+        }
+        renameSync(tempPath, path);
+        return { replaced: true, current: replacement };
+    }
+    finally {
+        if (descriptor !== undefined) {
+            try {
+                closeSync(descriptor);
+            }
+            catch {
+                // The primary publication error remains authoritative.
+            }
+        }
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // A successful rename has already consumed the temporary name.
+        }
+    }
+}
 export function codexCredentialFromTokens(tokens) {
     if (tokens.accessToken.length === 0)
         return null;
@@ -108,6 +222,21 @@ function jwtClaims(token) {
 export function readCodexFileCredential(home = homedir(), env = process.env) {
     return readCodexCredentialFile(codexCredentialsPath(home, env));
 }
+/** Usable Codex sessions visible from this process, including a paired WSL host. */
+export function readCodexFileCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
+    // CODEX_HOME is an explicit authority choice. Do not silently add another
+    // store beside it, because two owners could then refresh independently.
+    const paths = env.CODEX_HOME?.trim()
+        ? [codexCredentialsPath(home, env)]
+        : [
+            codexCredentialsPath(home, env),
+            ...(windowsHome ? [codexCredentialsPath(windowsHome, {})] : []),
+        ];
+    return [...new Set(paths)].flatMap((path) => {
+        const credential = readCodexCredentialFile(path);
+        return credential ? [{ path, credential }] : [];
+    });
+}
 /** Read a Codex-owned credential from the exact path discovery admitted. */
 export function readCodexCredentialFile(path) {
     const root = record(readCredentialJson(path));

package/dist/integrations/providers/harness-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIrD,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAA;AAM7C,MAAM,UAAU,qBAAqB,CAAC,OAAe,OAAO,EAAE;IAC7D,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;YAAE,OAAO,IAAI,CAAA;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,KAAiB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,OAAO,EAAE;IAChE,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACN,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACjD,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACjD,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,MAIzC;IACA,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO;YACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GACd,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,yBAAyB,CAAC;QAChC,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,SAAS;KACT,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACtC,IAAc,EACd,KAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,WAAW,GAAG,GAAG,GAAG,MAAM,CAAA;IAC7C,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7D,OAAO,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC"}
+{"version":3,"file":"harness-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACb,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIxE,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAA;AAgB7C,MAAM,UAAU,qBAAqB,CAAC,OAAe,OAAO,EAAE;IAC7D,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAClD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/E,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAyB,OAAO,CAAC,GAAG,EACpC,MAA2B,YAAY,EACvC,OAAO,GAAG,iCAAiC;IAE3C,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IACzD,IAAI,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE;YACxE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CACjD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,MAAM,KAAK,GAAG;QACb,qBAAqB,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;YAAE,OAAO,IAAI,CAAA;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,KAAiB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,OAAO,EAAE;IAChE,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACN,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACjD,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACjD,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAA0B,EAAE,KAA2B;IACpF,OAAO,CACN,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CACxE,CAAA;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAC1C,IAAY,EACZ,QAA8B,EAC9B,WAAiC;IAEjC,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACpE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAEjF,MAAM,OAAO,GAAG;QACf,GAAG,IAAI;QACP,aAAa,EAAE;YACd,GAAG,KAAK;YACR,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YACpF,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;SAC3E;KACD,CAAA;IACD,MAAM,QAAQ,GAAG,IAAI,CACpB,OAAO,CAAC,IAAI,CAAC,EACb,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/E,CAAA;IACD,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACJ,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5C,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1E,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,UAAU,GAAG,SAAS,CAAA;QAEtB,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QAClD,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACJ,SAAS,CAAC,UAAU,CAAC,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACR,uDAAuD;YACxD,CAAC;QACF,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACR,+DAA+D;QAChE,CAAC;IACF,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,MAIzC;IACA,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO;YACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAChD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC;YACA,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC;YAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GACd,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,yBAAyB,CAAC;QAChC,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,SAAS;KACT,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACtC,IAAc,EACd,KAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,WAAW,GAAG,GAAG,GAAG,MAAM,CAAA;IAC7C,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7D,OAAO,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC"}

package/dist/integrations/providers/identity.d.ts

@@ -36,33 +36,29 @@
  *
  * ## The addresses
  *
- * Verified 2026-08-09 rather than assumed. Two hosts serve this token
- * endpoint — the one below and `platform.claude.com` on the same path — and
- * both answer an `authorization_code` grant identically (`400 invalid_grant`
- * for a bogus code, from the same handler). namzu keeps the address its
- * existing refresh path has always used, because there was no behaviour to
- * gain by moving and a live refresh to lose by guessing.
- *
- * The redirect port is fixed and NOT free to change: it is part of what the
- * client identity above is registered with, so a different port is simply not
- * an accepted redirect. That is why a busy port degrades to the paste flow
- * rather than picking another one.
+ * Re-verified by capturing the exact URL emitted by the installed owner client
+ * (`claude auth login --claudeai`, 2.1.241) on 2026-08-23. Its live production
+ * contract uses the CAI authorize endpoint, the platform token endpoint and
+ * the platform callback below. That client does not offer a loopback redirect
+ * on this flow. A localhost callback may be valid OAuth in general, but it is
+ * not registered for this client identity; sending one makes the consent page
+ * refuse the request before sign-in.
  */
 export declare const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-export declare const OAUTH_TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
-export declare const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-/** Registered with the client identity above; not ours to choose. */
-export declare const SUBSCRIPTION_REDIRECT_PORT = 53692;
-export declare const REDIRECT_URI = "http://localhost:53692/callback";
+export declare const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export declare const AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
+/** Registered browser-to-terminal callback; not ours to replace with localhost. */
+export declare const MANUAL_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 /**
- * The smallest source-verified scope set used by the current Claude harness.
+ * The direct Claude Pro/Max scope set used by the current Claude harness.
  *
- * Do not copy every scope a historical client happened to request. Unknown
- * scopes make the authorization page reject the whole request before the
- * operator can sign in, and key creation is not inference authority. These
- * three are the live harness contract: identify the account, run inference,
- * and retain the ability to create an API key from that harness when the
- * account permits it.
+ * This looks broader than the inference capability Namzu consumes, but it is
+ * the exact set the current owner client sends for `--claudeai`, not its
+ * separately selected `--console` flow. The CAI endpoint validates the whole
+ * registered request shape; deleting `org:create_api_key` because its name
+ * sounds unrelated produces "Invalid request format" before the account can
+ * authorize anything. Keep this as one captured protocol value rather than a
+ * hand-curated list of what Namzu later uses.
  */
-export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference";
+export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
 //# sourceMappingURL=identity.d.ts.map

package/dist/integrations/providers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,iDAAiD,CAAA;AAC7E,eAAO,MAAM,aAAa,sCAAsC,CAAA;AAEhE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AAErF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,mDAAmD,CAAA"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,+CAA+C,CAAA;AAC3E,eAAO,MAAM,aAAa,2CAA2C,CAAA;AAErE,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,oDAAoD,CAAA;AAEpF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,+GACoF,CAAA"}

package/dist/integrations/providers/identity.js

@@ -36,33 +36,29 @@
  *
  * ## The addresses
  *
- * Verified 2026-08-09 rather than assumed. Two hosts serve this token
- * endpoint — the one below and `platform.claude.com` on the same path — and
- * both answer an `authorization_code` grant identically (`400 invalid_grant`
- * for a bogus code, from the same handler). namzu keeps the address its
- * existing refresh path has always used, because there was no behaviour to
- * gain by moving and a live refresh to lose by guessing.
- *
- * The redirect port is fixed and NOT free to change: it is part of what the
- * client identity above is registered with, so a different port is simply not
- * an accepted redirect. That is why a busy port degrades to the paste flow
- * rather than picking another one.
+ * Re-verified by capturing the exact URL emitted by the installed owner client
+ * (`claude auth login --claudeai`, 2.1.241) on 2026-08-23. Its live production
+ * contract uses the CAI authorize endpoint, the platform token endpoint and
+ * the platform callback below. That client does not offer a loopback redirect
+ * on this flow. A localhost callback may be valid OAuth in general, but it is
+ * not registered for this client identity; sending one makes the consent page
+ * refuse the request before sign-in.
  */
 export const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
-export const OAUTH_TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';
-export const AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
-/** Registered with the client identity above; not ours to choose. */
-export const SUBSCRIPTION_REDIRECT_PORT = 53692;
-export const REDIRECT_URI = `http://localhost:${SUBSCRIPTION_REDIRECT_PORT}/callback`;
+export const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+export const AUTHORIZE_URL = 'https://claude.com/cai/oauth/authorize';
+/** Registered browser-to-terminal callback; not ours to replace with localhost. */
+export const MANUAL_REDIRECT_URI = 'https://platform.claude.com/oauth/code/callback';
 /**
- * The smallest source-verified scope set used by the current Claude harness.
+ * The direct Claude Pro/Max scope set used by the current Claude harness.
  *
- * Do not copy every scope a historical client happened to request. Unknown
- * scopes make the authorization page reject the whole request before the
- * operator can sign in, and key creation is not inference authority. These
- * three are the live harness contract: identify the account, run inference,
- * and retain the ability to create an API key from that harness when the
- * account permits it.
+ * This looks broader than the inference capability Namzu consumes, but it is
+ * the exact set the current owner client sends for `--claudeai`, not its
+ * separately selected `--console` flow. The CAI endpoint validates the whole
+ * registered request shape; deleting `org:create_api_key` because its name
+ * sounds unrelated produces "Invalid request format" before the account can
+ * authorize anything. Keep this as one captured protocol value rather than a
+ * hand-curated list of what Namzu later uses.
  */
-export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference';
+export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
 //# sourceMappingURL=identity.js.map

package/dist/integrations/providers/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAA;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAA;AAEhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AAErF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gDAAgD,CAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,4CAA4C,CAAA;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,wCAAwC,CAAA;AAErE,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iDAAiD,CAAA;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,4GAA4G,CAAA"}

package/dist/integrations/providers/index.d.ts

@@ -4,7 +4,7 @@ export { type AgentOAuthCredential, isAnthropicOAuthToken, readAgentKeychainCred
 export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, type CodexDeviceLogin, type CodexDeviceLoginOptions, type CodexDeviceLoginOutcome, } from './codex-device-login.js';
 export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, type StoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
 export { ensureFreshStoredCodexCredential, type StoredCodexRefreshOptions, } from './codex-oauth.js';
-export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
+export { MANUAL_REDIRECT_URI, OAUTH_SCOPES } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, type LoginOutcome, parsePastedInput, type SubscriptionLogin, type SubscriptionLoginOptions, subscriptionDetectedProvider, } from './subscription-login.js';
 export { type CapabilityDisagreement, chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, type MemberCapabilities, unresolvedMembers, } from './chain-capabilities.js';

package/dist/integrations/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/index.js

@@ -4,7 +4,7 @@ export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.
 export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, } from './codex-device-login.js';
 export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
 export { ensureFreshStoredCodexCredential, } from './codex-oauth.js';
-export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
+export { MANUAL_REDIRECT_URI, OAUTH_SCOPES } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';
 export { chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, unresolvedMembers, } from './chain-capabilities.js';

package/dist/integrations/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/oauth.d.ts

@@ -16,7 +16,7 @@
  *
  * ## Where a refreshed token is written back
  *
- * There are two places a subscription credential can live and they are not
+ * There are three places a subscription credential can live and they are not
  * interchangeable, so `origin` says which one this credential came from and
  * therefore which publication rule applies:
  *
@@ -24,6 +24,9 @@
  *    every platform. A refresh replaces only the exact credential it used.
  *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
  *    does not own. A refresh is session-local and never writes that entry.
+ *  - `'claude-file'` — Claude's device-session file. A rotating refresh grant
+ *    must publish its successor back to the exact admitted file or it would
+ *    log the owner out, so publication preserves Claude's full envelope.
  *
  * `origin` is optional and defaults to `'keychain'` because that is the only
  * source that existed when this file was written. Every namzu-owned caller
@@ -50,7 +53,7 @@ import { type AgentOAuthCredential } from './keychain.js';
  * One credential, one store, for its whole life. `discover.ts` decides which
  * at detection; everything after that is told, not asked.
  */
-export declare function readSubscriptionCredential(origin: CredentialOrigin): AgentOAuthCredential | null;
+export declare function readSubscriptionCredential(origin: CredentialOrigin, sourcePath?: string): AgentOAuthCredential | null;
 /** Which store a subscription credential came from and therefore who owns publication. */
 export type CredentialOrigin = 'stored' | 'keychain' | 'claude-file';
 export interface OAuthMetadata {
@@ -59,6 +62,8 @@ export interface OAuthMetadata {
     readonly scopes?: readonly string[];
     /** Defaults to `'keychain'` — see the note at the top of this file. */
     readonly origin?: CredentialOrigin;
+    /** Exact owner file admitted by discovery; required for `'claude-file'`. */
+    readonly sourcePath?: string;
 }
 /** The credential that authorized a refresh was removed before publication. */
 export declare class CredentialWithdrawnError extends Error {
@@ -93,5 +98,5 @@ export declare function sameOAuthCredential(left: AgentOAuthCredential, right: A
  * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
  * the same grant is not recovery.
  */
-export declare function refreshAgentOAuthToken(refreshToken: string, signal?: AbortSignal): Promise<AgentOAuthCredential | null>;
+export declare function refreshAgentOAuthToken(refreshToken: string, signal?: AbortSignal, scopes?: readonly string[]): Promise<AgentOAuthCredential | null>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/integrations/providers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAYH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAGhG;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;gBAEvC,OAAO,SAA0E;CAG7F;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AA8DD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6DtC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAYH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,gBAAgB,EACxB,UAAU,CAAC,EAAE,MAAM,GACjB,oBAAoB,GAAG,IAAI,CAM7B;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;gBAEvC,OAAO,SAA0E;CAG7F;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAmBjB;AA4ED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,SAAS,MAAM,EAA4B,GACjD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAgEtC"}

package/dist/integrations/providers/oauth.js

@@ -16,7 +16,7 @@
  *
  * ## Where a refreshed token is written back
  *
- * There are two places a subscription credential can live and they are not
+ * There are three places a subscription credential can live and they are not
  * interchangeable, so `origin` says which one this credential came from and
  * therefore which publication rule applies:
  *
@@ -24,6 +24,9 @@
  *    every platform. A refresh replaces only the exact credential it used.
  *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
  *    does not own. A refresh is session-local and never writes that entry.
+ *  - `'claude-file'` — Claude's device-session file. A rotating refresh grant
+ *    must publish its successor back to the exact admitted file or it would
+ *    log the owner out, so publication preserves Claude's full envelope.
  *
  * `origin` is optional and defaults to `'keychain'` because that is the only
  * source that existed when this file was written. Every namzu-owned caller
@@ -34,8 +37,8 @@
 import { buildProbeContext, probe } from '@namzu/sdk';
 import { SUBSCRIPTION_CREDENTIAL_REF } from './credential-provider.js';
 import { credentialsPath, readStoredSubscriptionCredential, replaceStoredSubscriptionCredential, } from './credential-store.js';
-import { readClaudeFileCredential } from './harness-credentials.js';
-import { OAUTH_CLIENT_ID, OAUTH_TOKEN_URL } from './identity.js';
+import { readClaudeCredentialFile, replaceClaudeCredentialFile } from './harness-credentials.js';
+import { OAUTH_CLIENT_ID, OAUTH_SCOPES, OAUTH_TOKEN_URL } from './identity.js';
 import { readAgentKeychainCredential } from './keychain.js';
 /** Refresh a few seconds early so an about-to-expire token isn't used. */
 const EXPIRY_SKEW_MS = 60_000;
@@ -89,10 +92,13 @@ async function awaitWithSignal(operation, signal) {
  * One credential, one store, for its whole life. `discover.ts` decides which
  * at detection; everything after that is told, not asked.
  */
-export function readSubscriptionCredential(origin) {
+export function readSubscriptionCredential(origin, sourcePath) {
     if (origin === 'stored')
         return readStoredSubscriptionCredential();
-    return origin === 'claude-file' ? readClaudeFileCredential() : readAgentKeychainCredential();
+    if (origin === 'claude-file') {
+        return sourcePath ? readClaudeCredentialFile(sourcePath) : null;
+    }
+    return readAgentKeychainCredential();
 }
 /** The credential that authorized a refresh was removed before publication. */
 export class CredentialWithdrawnError extends Error {
@@ -130,7 +136,7 @@ export async function ensureFreshAnthropicToken(accessToken, oauth, signal) {
         return accessToken;
     if (!oauth.refreshToken)
         return accessToken;
-    const refreshed = await refreshAgentOAuthToken(oauth.refreshToken, signal);
+    const refreshed = await refreshAgentOAuthToken(oauth.refreshToken, signal, oauth.scopes);
     if (!refreshed)
         return accessToken;
     // The response body was the final foreign await. Re-check immediately at
@@ -142,7 +148,8 @@ export async function ensureFreshAnthropicToken(accessToken, oauth, signal) {
         expiresAt: oauth.expiresAt,
         scopes: oauth.scopes,
     };
-    return publishRefreshed(expected, refreshed, oauth.origin ?? 'keychain').accessToken;
+    return publishRefreshed(expected, refreshed, oauth.origin ?? 'keychain', oauth.sourcePath)
+        .accessToken;
 }
 /**
  * Say that a credential turned over, without saying what it turned into.
@@ -161,17 +168,34 @@ function announceRotation(replaced) {
         ref: SUBSCRIPTION_CREDENTIAL_REF,
     }, buildProbeContext());
 }
-function publishRefreshed(expected, refreshed, origin) {
-    if (origin !== 'stored') {
+function publishRefreshed(expected, refreshed, origin, sourcePath) {
+    if (origin === 'keychain') {
         // This entry belongs to another product, whose writer cannot participate
         // in a Namzu lock or conditional update. Never overwrite it. A rotation
         // that landed while the request was pending wins for this session; when it
         // is unchanged, the refreshed token remains session-local.
-        const current = origin === 'claude-file' ? readClaudeFileCredential() : readAgentKeychainCredential();
+        const current = readAgentKeychainCredential();
         if (!current)
             throw new CredentialWithdrawnError();
         return !sameOAuthCredential(current, expected) ? current : refreshed;
     }
+    if (origin === 'claude-file') {
+        if (!sourcePath)
+            throw new CredentialPublicationError();
+        let result;
+        try {
+            result = replaceClaudeCredentialFile(sourcePath, expected, refreshed);
+        }
+        catch (error) {
+            throw new CredentialPublicationError({ cause: error });
+        }
+        if (!result.replaced) {
+            if (!result.current)
+                throw new CredentialWithdrawnError();
+            return result.current;
+        }
+        return refreshed;
+    }
     let result;
     try {
         result = replaceStoredSubscriptionCredential(expected, refreshed);
@@ -217,7 +241,7 @@ export function sameOAuthCredential(left, right) {
  * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
  * the same grant is not recovery.
  */
-export async function refreshAgentOAuthToken(refreshToken, signal) {
+export async function refreshAgentOAuthToken(refreshToken, signal, scopes = OAUTH_SCOPES.split(' ')) {
     signal?.throwIfAborted();
     const requestController = new AbortController();
     const timeoutCause = new RefreshDeadlineError();
@@ -234,6 +258,7 @@ export async function refreshAgentOAuthToken(refreshToken, signal) {
                 grant_type: 'refresh_token',
                 refresh_token: refreshToken,
                 client_id: OAUTH_CLIENT_ID,
+                scope: scopes.join(' '),
             }),
             signal: requestController.signal,
         }), requestController.signal);
@@ -254,6 +279,7 @@ export async function refreshAgentOAuthToken(refreshToken, signal) {
             accessToken: data.access_token,
             refreshToken: typeof data.refresh_token === 'string' ? data.refresh_token : refreshToken,
             expiresAt: typeof data.expires_in === 'number' ? Date.now() + data.expires_in * 1_000 : undefined,
+            scopes: typeof data.scope === 'string' ? data.scope.split(' ').filter(Boolean) : [...scopes],
         };
     }
     catch (error) {

package/dist/integrations/providers/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EACN,eAAe,EACf,gCAAgC,EAChC,mCAAmC,GACnC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAChE,OAAO,EAA6B,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAEtF,0EAA0E;AAC1E,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC,MAAM,oBAAqB,SAAQ,KAAK;IACvC;QACC,KAAK,CAAC,4CAA4C,mBAAmB,KAAK,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACnC,CAAC;CACD;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAI,SAAyB,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAwB;IAClE,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,gCAAgC,EAAE,CAAA;IAClE,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;AAC7F,CAAC;AAaD,+EAA+E;AAC/E,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAChC,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAO,GAAG,uEAAuE;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAA;IACf,CAAC;CACD;AAED,6EAA6E;AAC7E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAClC,IAAI,GAAG,4BAA4B,CAAA;IAErD,YAAY,OAAsB;QACjC,KAAK,CAAC,sEAAsE,EAAE,OAAO,CAAC,CAAA;IACvF,CAAC;CACD;AAED,mFAAmF;AACnF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACtC,IAAI,GAAG,gCAAgC,CAAA;IAChD,IAAI,GAAG,eAAwB,CAAA;IAExC;QACC,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACxF,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,WAAmB,EACnB,KAAoB,EACpB,MAAoB;IAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;IAC5F,IAAI,KAAK;QAAE,OAAO,WAAW,CAAA;IAC7B,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,WAAW,CAAA;IAE3C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAC1E,IAAI,CAAC,SAAS;QAAE,OAAO,WAAW,CAAA;IAClC,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAyB;QACtC,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAA;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,WAAW,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAAiB;IAC1C,KAAK,CAAC,QAAQ,CACb;QACC,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QAClC,MAAM,EAAE,eAAe,EAAE;QACzB,kEAAkE;QAClE,sCAAsC;QACtC,GAAG,EAAE,2BAA2B;KAChC,EACD,iBAAiB,EAAE,CACnB,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA8B,EAC9B,SAA+B,EAC/B,MAAwB;IAExB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,OAAO,GACZ,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;QACtF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QAClD,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;IACD,IAAI,MAA8D,CAAA;IAClE,IAAI,CAAC;QACJ,MAAM,GAAG,mCAAmC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QACzD,OAAO,MAAM,CAAC,OAAO,CAAA;IACtB,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAAC;QACJ,gBAAgB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAClC,IAA0B,EAC1B,KAA2B;IAE3B,IACC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EACjC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IACtC,OAAO,CACN,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAChE,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,YAAoB,EACpB,MAAoB;IAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAA;IAC/C,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC/C,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,MAAM,EAAE,OAAO;QAAE,aAAa,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAE1F,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,eAAe,CAChC,KAAK,CAAC,eAAe,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,eAAe;aAC1B,CAAC;YACF,MAAM,EAAE,iBAAiB,CAAC,MAAM;SAChC,CAAC,EACF,iBAAiB,CAAC,MAAM,CACxB,CAAA;QACD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAE3E,CAAA;gBACD,IAAI,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;oBAC3F,MAAM,IAAI,8BAA8B,EAAE,CAAA;gBAC3C,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAIxE,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACxF,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;YACxF,SAAS,EACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;SACvF,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,MAAM,EAAE,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,MAAM,MAAM,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACpD,CAAC;AACF,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EACN,eAAe,EACf,gCAAgC,EAChC,mCAAmC,GACnC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAA6B,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAEtF,0EAA0E;AAC1E,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC,MAAM,oBAAqB,SAAQ,KAAK;IACvC;QACC,KAAK,CAAC,4CAA4C,mBAAmB,KAAK,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACnC,CAAC;CACD;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAI,SAAyB,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,gCAAgC,EAAE,CAAA;IAClE,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,CAAC;IACD,OAAO,2BAA2B,EAAE,CAAA;AACrC,CAAC;AAeD,+EAA+E;AAC/E,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAChC,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAO,GAAG,uEAAuE;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAA;IACf,CAAC;CACD;AAED,6EAA6E;AAC7E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAClC,IAAI,GAAG,4BAA4B,CAAA;IAErD,YAAY,OAAsB;QACjC,KAAK,CAAC,sEAAsE,EAAE,OAAO,CAAC,CAAA;IACvF,CAAC;CACD;AAED,mFAAmF;AACnF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACtC,IAAI,GAAG,gCAAgC,CAAA;IAChD,IAAI,GAAG,eAAwB,CAAA;IAExC;QACC,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACxF,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,WAAmB,EACnB,KAAoB,EACpB,MAAoB;IAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;IAC5F,IAAI,KAAK;QAAE,OAAO,WAAW,CAAA;IAC7B,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,WAAW,CAAA;IAE3C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACxF,IAAI,CAAC,SAAS;QAAE,OAAO,WAAW,CAAA;IAClC,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAyB;QACtC,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAA;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;SACxF,WAAW,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAAiB;IAC1C,KAAK,CAAC,QAAQ,CACb;QACC,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QAClC,MAAM,EAAE,eAAe,EAAE;QACzB,kEAAkE;QAClE,sCAAsC;QACtC,GAAG,EAAE,2BAA2B;KAChC,EACD,iBAAiB,EAAE,CACnB,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA8B,EAC9B,SAA+B,EAC/B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAA;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QAClD,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAA0B,EAAE,CAAA;QACvD,IAAI,MAAsD,CAAA;QAC1D,IAAI,CAAC;YACJ,MAAM,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACzD,OAAO,MAAM,CAAC,OAAO,CAAA;QACtB,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IACD,IAAI,MAA8D,CAAA;IAClE,IAAI,CAAC;QACJ,MAAM,GAAG,mCAAmC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QACzD,OAAO,MAAM,CAAC,OAAO,CAAA;IACtB,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAAC;QACJ,gBAAgB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAClC,IAA0B,EAC1B,KAA2B;IAE3B,IACC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EACjC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IACtC,OAAO,CACN,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAChE,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,YAAoB,EACpB,MAAoB,EACpB,SAA4B,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;IAEnD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAA;IAC/C,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC/C,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,MAAM,EAAE,OAAO;QAAE,aAAa,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAE1F,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,eAAe,CAChC,KAAK,CAAC,eAAe,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACvB,CAAC;YACF,MAAM,EAAE,iBAAiB,CAAC,MAAM;SAChC,CAAC,EACF,iBAAiB,CAAC,MAAM,CACxB,CAAA;QACD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAE3E,CAAA;gBACD,IAAI,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;oBAC3F,MAAM,IAAI,8BAA8B,EAAE,CAAA;gBAC3C,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAKxE,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACxF,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;YACxF,SAAS,EACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;YACvF,MAAM,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;SAC5F,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,MAAM,EAAE,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,MAAM,MAAM,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACpD,CAAC;AACF,CAAC"}