@namzu/cli 14.2.0 → 14.3.0

package/dist/commands/upgrade.js

@@ -0,0 +1,182 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join, posix, resolve, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { EXIT_FAIL, EXIT_OK, EXIT_UNAVAILABLE, EXIT_USAGE } from '../exit-codes.js';
+import { compareVersions, latestNamzuVersion } from '../integrations/updates.js';
+const HELP = `namzu upgrade — update the active global Namzu installation
+
+Usage:
+  namzu upgrade
+  namzu upgrade --check
+
+Options:
+  --check   Check the registry without changing the installation
+  -h, --help  Show this help`;
+/**
+ * Derive the prefix owning an npm-global @namzu/cli package.
+ *
+ * The executing package root is authority. Ambient `npm prefix -g` may point
+ * at a different Node installation, especially under version managers, so it
+ * is deliberately not consulted.
+ */
+export function npmGlobalPrefixFor(packageRoot, platform) {
+    const paths = platform === 'win32' ? win32 : posix;
+    const root = paths.resolve(packageRoot);
+    const expectedTail = platform === 'win32'
+        ? paths.join('node_modules', '@namzu', 'cli')
+        : paths.join('lib', 'node_modules', '@namzu', 'cli');
+    const comparableRoot = platform === 'win32' ? root.toLowerCase() : root;
+    const comparableTail = platform === 'win32' ? expectedTail.toLowerCase() : expectedTail;
+    const suffix = `${paths.sep}${comparableTail}`;
+    if (!comparableRoot.endsWith(suffix))
+        return null;
+    const prefix = root.slice(0, root.length - suffix.length);
+    return prefix.length > 0 ? prefix : paths.parse(root).root;
+}
+function readInstalledVersion(packageRoot) {
+    const parsed = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+    if (parsed.name !== '@namzu/cli') {
+        throw new Error('the active package root is not @namzu/cli');
+    }
+    if (typeof parsed.version !== 'string') {
+        throw new Error('the active @namzu/cli package has no readable version');
+    }
+    return parsed.version;
+}
+function runNpm(request) {
+    return new Promise((resolveRun, reject) => {
+        const child = spawn(request.executable, [...request.args], {
+            cwd: request.prefix,
+            env: process.env,
+            stdio: 'inherit',
+            shell: false,
+        });
+        child.once('error', reject);
+        child.once('exit', (code) => resolveRun(code ?? 1));
+    });
+}
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const productionDeps = {
+    currentVersion: readInstalledVersion(PACKAGE_ROOT),
+    packageRoot: PACKAGE_ROOT,
+    platform: process.platform,
+    latestVersion: latestNamzuVersion,
+    runNpm,
+    installedVersion: readInstalledVersion,
+};
+function parseArgs(rawArgs) {
+    if (rawArgs.length === 0)
+        return { check: false };
+    if (rawArgs.length === 1 && rawArgs[0] === '--check')
+        return { check: true };
+    return null;
+}
+export function createUpgradeCommand(deps) {
+    return {
+        name: 'upgrade',
+        description: 'Update the active global Namzu installation',
+        passThrough: true,
+        help: HELP,
+        handler: async ({ ctx, rawArgs }) => {
+            const flags = parseArgs(rawArgs);
+            if (!flags) {
+                ctx.formatter.error({ message: 'Usage: namzu upgrade [--check]' });
+                return EXIT_USAGE;
+            }
+            let latest;
+            try {
+                latest = await deps.latestVersion();
+            }
+            catch (error) {
+                ctx.formatter.error({
+                    message: `Could not check the latest Namzu version: ${error instanceof Error ? error.message : String(error)}`,
+                });
+                return EXIT_UNAVAILABLE;
+            }
+            if (compareVersions(latest, deps.currentVersion) <= 0) {
+                ctx.formatter.print({
+                    current: deps.currentVersion,
+                    latest,
+                    upToDate: true,
+                    text: `Namzu ${deps.currentVersion} is up to date.`,
+                });
+                return EXIT_OK;
+            }
+            if (flags.check) {
+                ctx.formatter.print({
+                    current: deps.currentVersion,
+                    latest,
+                    upToDate: false,
+                    text: `Namzu ${latest} is available (current: ${deps.currentVersion}). Run \`namzu upgrade\` to install it.`,
+                });
+                return EXIT_OK;
+            }
+            const prefix = npmGlobalPrefixFor(deps.packageRoot, deps.platform);
+            if (!prefix) {
+                ctx.formatter.error({
+                    message: 'This Namzu process is not running from a recognized npm-global installation, so it will not update a different binary by guessing. Reinstall with the same package manager, or use the installer from https://github.com/cogitave/namzu#the-terminal-agent.',
+                });
+                return EXIT_UNAVAILABLE;
+            }
+            const executable = deps.platform === 'win32' ? 'npm.cmd' : 'npm';
+            const request = {
+                executable,
+                prefix,
+                args: [
+                    'install',
+                    '--global',
+                    '--prefix',
+                    prefix,
+                    '--no-fund',
+                    '--no-audit',
+                    '--registry',
+                    'https://registry.npmjs.org',
+                    `@namzu/cli@${latest}`,
+                ],
+            };
+            ctx.formatter.info(`Updating the active npm installation from ${deps.currentVersion} to ${latest}…`);
+            let code;
+            try {
+                code = await deps.runNpm(request);
+            }
+            catch (error) {
+                ctx.formatter.error({
+                    message: `Could not start npm: ${error instanceof Error ? error.message : String(error)}`,
+                });
+                return EXIT_FAIL;
+            }
+            if (code !== 0) {
+                ctx.formatter.error({
+                    message: `npm exited with status ${code}; Namzu was not verified.`,
+                });
+                return EXIT_FAIL;
+            }
+            let installed;
+            try {
+                installed = deps.installedVersion(deps.packageRoot);
+            }
+            catch (error) {
+                ctx.formatter.error({
+                    message: `npm exited successfully, but the active installation could not be read back: ${error instanceof Error ? error.message : String(error)}`,
+                });
+                return EXIT_FAIL;
+            }
+            if (installed !== latest) {
+                ctx.formatter.error({
+                    message: `npm exited successfully, but the active installation still reports ${installed} instead of ${latest}. No update is being claimed.`,
+                });
+                return EXIT_FAIL;
+            }
+            ctx.formatter.print({
+                previous: deps.currentVersion,
+                current: installed,
+                updated: true,
+                text: `Updated Namzu ${deps.currentVersion} → ${installed}.`,
+            });
+            return EXIT_OK;
+        },
+    };
+}
+export const upgradeCommand = createUpgradeCommand(productionDeps);
+//# sourceMappingURL=upgrade.js.map

package/dist/commands/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAGhF,MAAM,IAAI,GAAG;;;;;;;;6BAQgB,CAAA;AAiB7B;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,QAAyB;IAChF,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACvC,MAAM,YAAY,GACjB,QAAQ,KAAK,OAAO;QACnB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,cAAc,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAA;IACvF,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,cAAc,EAAE,CAAA;IAC9C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACzD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGhF,CAAA;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAA;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,OAA0B;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1D,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAEjF,MAAM,cAAc,GAAuB;IAC1C,cAAc,EAAE,oBAAoB,CAAC,YAAY,CAAC;IAClD,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,aAAa,EAAE,kBAAkB;IACjC,MAAM;IACN,gBAAgB,EAAE,oBAAoB;CACtC,CAAA;AAED,SAAS,SAAS,CAAC,OAA0B;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC5E,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC5D,OAAO;QACN,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,6CAA6C;QAC1D,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAClE,OAAO,UAAU,CAAA;YAClB,CAAC;YAED,IAAI,MAAc,CAAA;YAClB,IAAI,CAAC;gBACJ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBAC9G,CAAC,CAAA;gBACF,OAAO,gBAAgB,CAAA;YACxB,CAAC;YAED,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,IAAI,CAAC,cAAc;oBAC5B,MAAM;oBACN,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,SAAS,IAAI,CAAC,cAAc,iBAAiB;iBACnD,CAAC,CAAA;gBACF,OAAO,OAAO,CAAA;YACf,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,IAAI,CAAC,cAAc;oBAC5B,MAAM;oBACN,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,SAAS,MAAM,2BAA2B,IAAI,CAAC,cAAc,yCAAyC;iBAC5G,CAAC,CAAA;gBACF,OAAO,OAAO,CAAA;YACf,CAAC;YAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAClE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EACN,6PAA6P;iBAC9P,CAAC,CAAA;gBACF,OAAO,gBAAgB,CAAA;YACxB,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAChE,MAAM,OAAO,GAAsB;gBAClC,UAAU;gBACV,MAAM;gBACN,IAAI,EAAE;oBACL,SAAS;oBACT,UAAU;oBACV,UAAU;oBACV,MAAM;oBACN,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,4BAA4B;oBAC5B,cAAc,MAAM,EAAE;iBACtB;aACD,CAAA;YACD,GAAG,CAAC,SAAS,CAAC,IAAI,CACjB,6CAA6C,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG,CAChF,CAAA;YAED,IAAI,IAAY,CAAA;YAChB,IAAI,CAAC;gBACJ,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACzF,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YACjB,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,0BAA0B,IAAI,2BAA2B;iBAClE,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YACjB,CAAC;YAED,IAAI,SAAiB,CAAA;YACrB,IAAI,CAAC;gBACJ,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,gFAAgF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACjJ,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YACjB,CAAC;YACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACnB,OAAO,EAAE,sEAAsE,SAAS,eAAe,MAAM,+BAA+B;iBAC5I,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YACjB,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;gBACnB,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,iBAAiB,IAAI,CAAC,cAAc,MAAM,SAAS,GAAG;aAC5D,CAAC,CAAA;YACF,OAAO,OAAO,CAAA;QACf,CAAC;KACD,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,oBAAoB,CAAC,cAAc,CAAC,CAAA"}

package/dist/context/runtime-message.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeContextMessageKind } from '@namzu/sdk';
+/** Human label for provider-user-role context authored by the runtime. */
+export declare function runtimeContextLabel(kind: RuntimeContextMessageKind): string;
+//# sourceMappingURL=runtime-message.d.ts.map

package/dist/context/runtime-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-message.d.ts","sourceRoot":"","sources":["../../src/context/runtime-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAE3D,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAiB3E"}

package/dist/context/runtime-message.js

@@ -0,0 +1,20 @@
+/** Human label for provider-user-role context authored by the runtime. */
+export function runtimeContextLabel(kind) {
+    switch (kind) {
+        case 'advisory':
+            return 'Advisor context';
+        case 'answer-review':
+            return 'Answer review feedback';
+        case 'auto-continuation':
+            return 'Automatic continuation';
+        case 'limit-finalization':
+            return 'Limit finalization request';
+        case 'steering':
+            return 'Runtime steering';
+        case 'structured-output':
+            return 'Structured-output retry';
+        case 'task-completion':
+            return 'Task completion context';
+    }
+}
+//# sourceMappingURL=runtime-message.js.map

package/dist/context/runtime-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-message.js","sourceRoot":"","sources":["../../src/context/runtime-message.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAA+B;IAClE,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,UAAU;YACd,OAAO,iBAAiB,CAAA;QACzB,KAAK,eAAe;YACnB,OAAO,wBAAwB,CAAA;QAChC,KAAK,mBAAmB;YACvB,OAAO,wBAAwB,CAAA;QAChC,KAAK,oBAAoB;YACxB,OAAO,4BAA4B,CAAA;QACpC,KAAK,UAAU;YACd,OAAO,kBAAkB,CAAA;QAC1B,KAAK,mBAAmB;YACvB,OAAO,yBAAyB,CAAA;QACjC,KAAK,iBAAiB;YACrB,OAAO,yBAAyB,CAAA;IAClC,CAAC;AACF,CAAC"}

package/dist/integrations/providers/identity.d.ts

@@ -36,34 +36,29 @@
  *
  * ## The addresses
  *
- * Re-verified against the installed owner client on 2026-08-23. Its live
- * production contract uses the platform token endpoint, the direct Claude
- * subscription authorize endpoint, a local callback when reachable and the
- * platform callback for manual paste. Keeping these together matters: mixing
- * the older console authorize flow with subscription scopes makes the browser
- * classify the attempt as API billing or reject the scope entirely.
- *
- * The redirect port is fixed and NOT free to change: it is part of what the
- * client identity above is registered with, so a different port is simply not
- * an accepted redirect. That is why a busy port degrades to the paste flow
- * rather than picking another one.
+ * Re-verified by capturing the exact URL emitted by the installed owner client
+ * (`claude auth login --claudeai`, 2.1.241) on 2026-08-23. Its live production
+ * contract uses the CAI authorize endpoint, the platform token endpoint and
+ * the platform callback below. That client does not offer a loopback redirect
+ * on this flow. A localhost callback may be valid OAuth in general, but it is
+ * not registered for this client identity; sending one makes the consent page
+ * refuse the request before sign-in.
  */
 export declare const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 export declare const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
-/** Registered with the client identity above; not ours to choose. */
-export declare const SUBSCRIPTION_REDIRECT_PORT = 53692;
-export declare const REDIRECT_URI = "http://localhost:53692/callback";
-/** Browser-to-terminal callback used when no local listener is reachable. */
+/** Registered browser-to-terminal callback; not ours to replace with localhost. */
 export declare const MANUAL_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 /**
  * The direct Claude Pro/Max scope set used by the current Claude harness.
  *
- * Do not copy every scope a historical client happened to request. Unknown
- * scopes make the authorization page reject the whole request before the
- * operator can sign in. `org:create_api_key` belongs to the platform/API
- * billing login and is intentionally absent: Namzu is borrowing the person's
- * Claude subscription session, not asking to create a separately billed key.
+ * This looks broader than the inference capability Namzu consumes, but it is
+ * the exact set the current owner client sends for `--claudeai`, not its
+ * separately selected `--console` flow. The CAI endpoint validates the whole
+ * registered request shape; deleting `org:create_api_key` because its name
+ * sounds unrelated produces "Invalid request format" before the account can
+ * authorize anything. Keep this as one captured protocol value rather than a
+ * hand-curated list of what Namzu later uses.
  */
-export declare const OAUTH_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
 //# sourceMappingURL=identity.d.ts.map

package/dist/integrations/providers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,+CAA+C,CAAA;AAC3E,eAAO,MAAM,aAAa,2CAA2C,CAAA;AAErE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AACrF,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,oDAAoD,CAAA;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,4FACiE,CAAA"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,+CAA+C,CAAA;AAC3E,eAAO,MAAM,aAAa,2CAA2C,CAAA;AAErE,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,oDAAoD,CAAA;AAEpF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,+GACoF,CAAA"}

package/dist/integrations/providers/identity.js

@@ -36,34 +36,29 @@
  *
  * ## The addresses
  *
- * Re-verified against the installed owner client on 2026-08-23. Its live
- * production contract uses the platform token endpoint, the direct Claude
- * subscription authorize endpoint, a local callback when reachable and the
- * platform callback for manual paste. Keeping these together matters: mixing
- * the older console authorize flow with subscription scopes makes the browser
- * classify the attempt as API billing or reject the scope entirely.
- *
- * The redirect port is fixed and NOT free to change: it is part of what the
- * client identity above is registered with, so a different port is simply not
- * an accepted redirect. That is why a busy port degrades to the paste flow
- * rather than picking another one.
+ * Re-verified by capturing the exact URL emitted by the installed owner client
+ * (`claude auth login --claudeai`, 2.1.241) on 2026-08-23. Its live production
+ * contract uses the CAI authorize endpoint, the platform token endpoint and
+ * the platform callback below. That client does not offer a loopback redirect
+ * on this flow. A localhost callback may be valid OAuth in general, but it is
+ * not registered for this client identity; sending one makes the consent page
+ * refuse the request before sign-in.
  */
 export const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 export const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 export const AUTHORIZE_URL = 'https://claude.com/cai/oauth/authorize';
-/** Registered with the client identity above; not ours to choose. */
-export const SUBSCRIPTION_REDIRECT_PORT = 53692;
-export const REDIRECT_URI = `http://localhost:${SUBSCRIPTION_REDIRECT_PORT}/callback`;
-/** Browser-to-terminal callback used when no local listener is reachable. */
+/** Registered browser-to-terminal callback; not ours to replace with localhost. */
 export const MANUAL_REDIRECT_URI = 'https://platform.claude.com/oauth/code/callback';
 /**
  * The direct Claude Pro/Max scope set used by the current Claude harness.
  *
- * Do not copy every scope a historical client happened to request. Unknown
- * scopes make the authorization page reject the whole request before the
- * operator can sign in. `org:create_api_key` belongs to the platform/API
- * billing login and is intentionally absent: Namzu is borrowing the person's
- * Claude subscription session, not asking to create a separately billed key.
+ * This looks broader than the inference capability Namzu consumes, but it is
+ * the exact set the current owner client sends for `--claudeai`, not its
+ * separately selected `--console` flow. The CAI endpoint validates the whole
+ * registered request shape; deleting `org:create_api_key` because its name
+ * sounds unrelated produces "Invalid request format" before the account can
+ * authorize anything. Keep this as one captured protocol value rather than a
+ * hand-curated list of what Namzu later uses.
  */
-export const OAUTH_SCOPES = 'user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
+export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
 //# sourceMappingURL=identity.js.map

package/dist/integrations/providers/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,4CAA4C,CAAA;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,wCAAwC,CAAA;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AACrF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,iDAAiD,CAAA;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,yFAAyF,CAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,4CAA4C,CAAA;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,wCAAwC,CAAA;AAErE,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iDAAiD,CAAA;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,4GAA4G,CAAA"}

package/dist/integrations/providers/index.d.ts

@@ -4,7 +4,7 @@ export { type AgentOAuthCredential, isAnthropicOAuthToken, readAgentKeychainCred
 export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, type CodexDeviceLogin, type CodexDeviceLoginOptions, type CodexDeviceLoginOutcome, } from './codex-device-login.js';
 export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, type StoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
 export { ensureFreshStoredCodexCredential, type StoredCodexRefreshOptions, } from './codex-oauth.js';
-export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
+export { MANUAL_REDIRECT_URI, OAUTH_SCOPES } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, type LoginOutcome, parsePastedInput, type SubscriptionLogin, type SubscriptionLoginOptions, subscriptionDetectedProvider, } from './subscription-login.js';
 export { type CapabilityDisagreement, chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, type MemberCapabilities, unresolvedMembers, } from './chain-capabilities.js';

package/dist/integrations/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/index.js

@@ -4,7 +4,7 @@ export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.
 export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, } from './codex-device-login.js';
 export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
 export { ensureFreshStoredCodexCredential, } from './codex-oauth.js';
-export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
+export { MANUAL_REDIRECT_URI, OAUTH_SCOPES } from './identity.js';
 export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';
 export { chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, unresolvedMembers, } from './chain-capabilities.js';

package/dist/integrations/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/subscription-login.d.ts

@@ -10,21 +10,11 @@
  *
  * ## The flow
  *
- * Authorization code with PKCE (RFC 7636, S256), redirected to a loopback
- * address (RFC 8252 §7.3). Two ways to finish, and BOTH are always offered:
- *
- *  1. **Loopback.** A one-request server on `127.0.0.1` at the port the
- *     redirect is registered under. The browser lands on it and the code
- *     never touches a screen.
- *  2. **Paste.** The operator copies the code — or the whole redirect URL —
- *     out of a browser and hands it back.
- *
- * The second is not a consolation prize. A container, a remote shell over
- * SSH, a machine with no graphical session: none of them can be redirected
- * to, and on all of them the loopback server is either unreachable from
- * wherever the browser actually is or cannot bind at all. `start()` says
- * which of the two it managed to arrange (`loopback`), and the paste path
- * works whether or not it did.
+ * Authorization code with PKCE (RFC 7636, S256), redirected to the platform
+ * callback registered for the owner client's public identity. The operator
+ * copies the code — or the whole finished address — back to the initiating
+ * surface. This flow deliberately does not invent a localhost redirect: the
+ * authorization server rejects an unregistered callback before sign-in.
  *
  * ## What never happens here
  *
@@ -51,26 +41,9 @@ export interface SubscriptionLogin {
     /** The page to open. Safe to print — it carries a challenge, never a secret. */
     readonly url: string;
     readonly redirectUri: string;
-    /**
-     * Whether the loopback listener came up.
-     *
-     * `false` is not a failure: the port was busy, or the environment forbids
-     * listening. The paste path is unaffected, and a surface should say so
-     * rather than imply the login is broken.
-     */
-    readonly loopback: boolean;
-    /**
-     * Resolve when the browser reaches the loopback listener, or never.
-     *
-     * `null` when `loopback` is false, so a caller cannot await a promise that
-     * has no way to settle. Racing this against `completeWithPastedCode` is the
-     * intended use; whichever finishes first wins and `cancel()` releases the
-     * other.
-     */
-    waitForCallback(): Promise<LoginOutcome> | null;
     /** Finish from a pasted redirect URL, `code#state`, or a bare code. */
     completeWithPastedCode(input: string): Promise<LoginOutcome>;
-    /** Release the listener. Safe to call twice, and safe to call after success. */
+    /** Withdraw the attempt. Safe to call twice, and safe to call after success. */
     cancel(): void;
 }
 export interface SubscriptionLoginOptions {
@@ -78,18 +51,11 @@ export interface SubscriptionLoginOptions {
     readonly home?: string;
     /** Override the token-exchange transport (tests inject a stub). */
     readonly fetch?: typeof fetch;
-    /**
-     * Try to listen on the loopback redirect. Default true.
-     *
-     * A caller that knows there is no browser here — `--no-browser`, a
-     * container — passes false and skips a bind that would only ever time out.
-     */
-    readonly loopback?: boolean;
     /** Authority of the surface that started this attempt. */
     readonly signal?: AbortSignal;
 }
 /**
- * Begin a login. Returns the page to open plus the two ways to finish it.
+ * Begin a login. Returns the page to open plus the paste-completion handle.
  *
  * Deliberately does NOT open a browser. Which of `open`, `xdg-open` or a
  * Windows protocol handler to spawn — and whether spawning anything is even

package/dist/integrations/providers/subscription-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-login.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/subscription-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAUrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAGzD,6EAA6E;AAC7E,MAAM,MAAM,YAAY,GACrB;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,MAAM,WAAW,iBAAiB;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC/C,uEAAuE;IACvE,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5D,gFAAgF;IAChF,MAAM,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,GAAE,wBAA6B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAwE5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC3C,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,MAAM,GACd,gBAAgB,CAYlB;AAsQD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA+BjF"}
+{"version":3,"file":"subscription-login.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/subscription-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAQrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAGzD,6EAA6E;AAC7E,MAAM,MAAM,YAAY,GACrB;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,MAAM,WAAW,iBAAiB;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,uEAAuE;IACvE,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5D,gFAAgF;IAChF,MAAM,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,GAAE,wBAA6B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAuD5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC3C,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,MAAM,GACd,gBAAgB,CAYlB;AA+JD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACd,CA+BA"}