@namzu/cli 34.1.1 → 36.0.0

package/dist/integrations/providers/harness-credentials.js

@@ -1,344 +0,0 @@
-/** Adapters for credentials owned by co-installed agent harnesses. */
-import { execFileSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { closeSync, fsyncSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
-import { DEFAULT_WSL_MOUNT_ROOT, readWslMountRoot, wslSystem32 } from '../../context/environment.js';
-const MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;
-export function claudeCredentialsPath(home = homedir(), env = process.env) {
-    const configured = env.CLAUDE_CONFIG_DIR;
-    return join(configured ? resolve(configured) : join(home, '.claude'), '.credentials.json');
-}
-/**
- * Convert an absolute Windows path into the drive mount WSL exposes, under
- * `mountRoot` (`/mnt/` unless `/etc/wsl.conf` moves it).
- */
-export function windowsPathToWsl(path, mountRoot = DEFAULT_WSL_MOUNT_ROOT) {
-    const normalized = path.trim().replaceAll('\\', '/');
-    const match = /^([A-Za-z]):\/(.+)$/u.exec(normalized);
-    if (!match?.[1] || !match[2] || match[2].split('/').includes('..'))
-        return null;
-    return `${mountRoot}${match[1].toLowerCase()}/${match[2]}`;
-}
-/**
- * Resolve the Windows account paired with this WSL process.
- *
- * The Windows executable is pinned instead of searched through PATH: this
- * lookup decides where a credential may be read, so a project-local `cmd.exe`
- * must not be able to redirect it. Failure is an ordinary "no second home"
- * result; native Linux never starts a process. Both the command and the home
- * it answers with are under the drive mount root `/etc/wsl.conf` sets
- * (`[automount] root`, `/mnt/` by default).
- */
-export function wslWindowsHome(env = process.env, run = execFileSync, command, mountRoot) {
-    if (!env.WSL_DISTRO_NAME && !env.WSL_INTEROP)
-        return null;
-    const root = mountRoot ?? readWslMountRoot();
-    const cmd = command ?? `${wslSystem32(root)}/cmd.exe`;
-    try {
-        if (!statSync(cmd).isFile())
-            return null;
-        const output = run(cmd, ['/d', '/s', '/c', 'echo', '%USERPROFILE%'], {
-            encoding: 'utf8',
-            timeout: 1_000,
-            // The interop shim that fronts a Windows process does not honour
-            // SIGTERM the way a Linux process does; a probe that overran its
-            // second was left alive, and the synchronous call waited on it for
-            // as long as Windows took to answer. SIGKILL is what actually ends
-            // it, and the answer is "no paired home", which is the correct one
-            // for a probe that could not be made in time.
-            killSignal: 'SIGKILL',
-            windowsHide: true,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        return windowsPathToWsl(String(output), root);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Usable Claude sessions visible from this process, freshest first.
- *
- * WSL is one device with two home directories in practice. Claude may be
- * installed and signed in on Windows while Namzu runs inside WSL; treating the
- * Linux home as the whole device turns that valid subscription into a missing
- * credential. An explicit `home` remains hermetic for embeds and tests.
- */
-export function readClaudeFileCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
-    return claudeCredentialSearchPaths(home, env, windowsHome).flatMap((path) => {
-        const credential = readClaudeCredentialFile(path);
-        return credential ? [{ path, credential }] : [];
-    });
-}
-/** The same Claude Code owner files discovery checks, including the paired WSL Windows home. */
-export function claudeCredentialSearchPaths(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
-    // The override selects one owner store. A missing or unusable custom
-    // credential must not revive another account from either default home.
-    const paths = env.CLAUDE_CONFIG_DIR
-        ? [claudeCredentialsPath(home, env)]
-        : [
-            claudeCredentialsPath(home, env),
-            ...(windowsHome ? [claudeCredentialsPath(windowsHome, {})] : []),
-        ];
-    return [...new Set(paths)];
-}
-export function codexCredentialsPath(home = homedir(), env = process.env) {
-    const configured = env.CODEX_HOME?.trim();
-    const root = configured
-        ? isAbsolute(configured)
-            ? configured
-            : resolve(configured)
-        : join(home, '.codex');
-    return join(root, 'auth.json');
-}
-export function opencodeCredentialsPath(home = homedir(), env = process.env) {
-    const configured = env.XDG_DATA_HOME?.trim();
-    const root = configured && isAbsolute(configured) ? configured : join(home, '.local', 'share');
-    return join(root, 'opencode', 'auth.json');
-}
-/** Read only OpenCode-owned API entries; OAuth and provider aliases are not credentials here. */
-export function readOpenCodeApiCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
-    const parse = (value, source) => {
-        const root = record(value);
-        return ['opencode', 'opencode-go'].flatMap((id) => {
-            const entry = record(root?.[id]);
-            const apiKey = typeof entry?.key === 'string' ? entry.key.trim() : undefined;
-            return entry?.type === 'api' && apiKey && apiKey !== 'public'
-                ? [
-                    {
-                        provider: id === 'opencode' ? 'zen' : 'zen-go',
-                        apiKey,
-                        source,
-                    },
-                ]
-                : [];
-        });
-    };
-    // OpenCode treats this as the complete store. Even an invalid override must
-    // not silently revive an older account from disk.
-    if (env.OPENCODE_AUTH_CONTENT !== undefined) {
-        try {
-            if (Buffer.byteLength(env.OPENCODE_AUTH_CONTENT, 'utf8') > MAX_CREDENTIAL_FILE_BYTES)
-                return [];
-            return parse(JSON.parse(env.OPENCODE_AUTH_CONTENT), {
-                kind: 'env',
-                envName: 'OPENCODE_AUTH_CONTENT',
-            });
-        }
-        catch {
-            return [];
-        }
-    }
-    const paths = env.XDG_DATA_HOME?.trim() && isAbsolute(env.XDG_DATA_HOME.trim())
-        ? [opencodeCredentialsPath(home, env)]
-        : [
-            opencodeCredentialsPath(home, env),
-            ...(windowsHome ? [opencodeCredentialsPath(windowsHome, {})] : []),
-        ];
-    return [...new Set(paths)].flatMap((path) => parse(readCredentialJson(path), { kind: 'opencode-file', path }));
-}
-function readCredentialJson(path) {
-    try {
-        const stat = statSync(path);
-        if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_CREDENTIAL_FILE_BYTES)
-            return null;
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function record(value) {
-    return typeof value === 'object' && value !== null ? value : null;
-}
-function optionalString(value) {
-    return typeof value === 'string' && value.length > 0 ? value : undefined;
-}
-function optionalFiniteNumber(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-}
-function optionalStringArray(value) {
-    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string'))
-        return undefined;
-    return value;
-}
-export function readClaudeFileCredential(home = homedir(), env = process.env) {
-    return readClaudeCredentialFile(claudeCredentialsPath(home, env));
-}
-/** Read a Claude-owned credential from the exact path discovery admitted. */
-export function readClaudeCredentialFile(path) {
-    const root = record(readCredentialJson(path));
-    const oauth = record(root?.claudeAiOauth);
-    const accessToken = optionalString(oauth?.accessToken);
-    if (!accessToken)
-        return null;
-    return {
-        accessToken,
-        refreshToken: optionalString(oauth?.refreshToken),
-        expiresAt: optionalFiniteNumber(oauth?.expiresAt),
-        scopes: optionalStringArray(oauth?.scopes),
-    };
-}
-function sameClaudeCredential(left, right) {
-    return (left.accessToken === right.accessToken &&
-        left.refreshToken === right.refreshToken &&
-        left.expiresAt === right.expiresAt &&
-        JSON.stringify(left.scopes ?? []) === JSON.stringify(right.scopes ?? []));
-}
-/**
- * Publish a refreshed Claude session back to the exact owner file discovered.
- *
- * Claude refresh grants may rotate. Keeping the successor only in Namzu would
- * consume the owner's grant and leave its file unusable, so this preserves the
- * full envelope and atomically replaces only its OAuth fields. The final
- * re-read lets an owner rotation that completed during the network request win.
- * Claude does not participate in Namzu's lock, so this is intentionally not
- * described as a cross-process CAS; it is the strongest owner-compatible
- * publication available for this shared file format.
- */
-export function replaceClaudeCredentialFile(path, expected, replacement) {
-    const root = record(readCredentialJson(path));
-    const oauth = record(root?.claudeAiOauth);
-    const current = readClaudeCredentialFile(path);
-    if (!root || !oauth || !current)
-        return { replaced: false, current };
-    if (!sameClaudeCredential(current, expected))
-        return { replaced: false, current };
-    const updated = {
-        ...root,
-        claudeAiOauth: {
-            ...oauth,
-            accessToken: replacement.accessToken,
-            ...(replacement.refreshToken === undefined ? {} : { refreshToken: replacement.refreshToken }),
-            ...(replacement.expiresAt === undefined ? {} : { expiresAt: replacement.expiresAt }),
-            ...(replacement.scopes === undefined ? {} : { scopes: replacement.scopes }),
-        },
-    };
-    const tempPath = join(dirname(path), `.${basename(path)}.namzu-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
-    let descriptor;
-    try {
-        descriptor = openSync(tempPath, 'wx', 0o600);
-        writeFileSync(descriptor, `${JSON.stringify(updated, null, 2)}\n`, 'utf8');
-        fsyncSync(descriptor);
-        closeSync(descriptor);
-        descriptor = undefined;
-        const beforeCommit = readClaudeCredentialFile(path);
-        if (!beforeCommit || !sameClaudeCredential(beforeCommit, expected)) {
-            return { replaced: false, current: beforeCommit };
-        }
-        renameSync(tempPath, path);
-        return { replaced: true, current: replacement };
-    }
-    finally {
-        if (descriptor !== undefined) {
-            try {
-                closeSync(descriptor);
-            }
-            catch {
-                // The primary publication error remains authoritative.
-            }
-        }
-        try {
-            unlinkSync(tempPath);
-        }
-        catch {
-            // A successful rename has already consumed the temporary name.
-        }
-    }
-}
-export function codexCredentialFromTokens(tokens) {
-    if (tokens.accessToken.length === 0)
-        return null;
-    const claims = jwtClaims(tokens.accessToken);
-    const accountId = tokens.accountId ?? claims.accountId;
-    if (!accountId)
-        return null;
-    return {
-        accessToken: tokens.accessToken,
-        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
-        accountId,
-        ...(claims.expiresAt === undefined ? {} : { expiresAt: claims.expiresAt }),
-    };
-}
-function jwtClaims(token) {
-    const parts = token.split('.');
-    if (parts.length !== 3 || !parts[1])
-        return {};
-    try {
-        const payload = record(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
-        const auth = record(payload?.['https://api.openai.com/auth']);
-        const exp = optionalFiniteNumber(payload?.exp);
-        return {
-            ...(exp === undefined ? {} : { expiresAt: exp * 1000 }),
-            ...(optionalString(auth?.chatgpt_account_id)
-                ? { accountId: optionalString(auth?.chatgpt_account_id) }
-                : {}),
-        };
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * Read the ChatGPT subscription record produced by Codex CLI.
- *
- * `OPENAI_API_KEY` is intentionally ignored: it belongs to the ordinary
- * OpenAI provider. This reader admits only the `tokens` envelope used by the
- * Codex Responses backend and requires the account id that backend routes on.
- */
-export function readCodexFileCredential(home = homedir(), env = process.env) {
-    return readCodexCredentialFile(codexCredentialsPath(home, env));
-}
-/** Usable Codex sessions visible from this process, including a paired WSL host. */
-export function readCodexFileCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
-    // CODEX_HOME is an explicit authority choice. Do not silently add another
-    // store beside it, because two owners could then refresh independently.
-    const paths = env.CODEX_HOME?.trim()
-        ? [codexCredentialsPath(home, env)]
-        : [
-            codexCredentialsPath(home, env),
-            ...(windowsHome ? [codexCredentialsPath(windowsHome, {})] : []),
-        ];
-    return [...new Set(paths)].flatMap((path) => {
-        const credential = readCodexCredentialFile(path);
-        return credential ? [{ path, credential }] : [];
-    });
-}
-/** Read a Codex-owned credential from the exact path discovery admitted. */
-export function readCodexCredentialFile(path) {
-    const root = record(readCredentialJson(path));
-    const tokens = record(root?.tokens);
-    const accessToken = optionalString(tokens?.access_token);
-    if (!accessToken)
-        return null;
-    const accessClaims = jwtClaims(accessToken);
-    const idToken = optionalString(tokens?.id_token);
-    const idClaims = idToken ? jwtClaims(idToken) : {};
-    const accountId = optionalString(tokens?.account_id) ?? accessClaims.accountId ?? idClaims.accountId;
-    if (!accountId)
-        return null;
-    return codexCredentialFromTokens({
-        accessToken,
-        ...(optionalString(tokens?.refresh_token)
-            ? { refreshToken: optionalString(tokens?.refresh_token) }
-            : {}),
-        accountId,
-    });
-}
-/** Prefer the credential whose access token remains valid for longer. */
-export function preferFresherCredential(left, right, now = Date.now()) {
-    if (!left)
-        return right;
-    if (!right)
-        return left;
-    const leftExpiry = left.expiresAt ?? Number.POSITIVE_INFINITY;
-    const rightExpiry = right.expiresAt ?? Number.POSITIVE_INFINITY;
-    const leftFresh = leftExpiry > now + 60_000;
-    const rightFresh = rightExpiry > now + 60_000;
-    if (leftFresh !== rightFresh)
-        return leftFresh ? left : right;
-    return leftExpiry >= rightExpiry ? left : right;
-}
-//# sourceMappingURL=harness-credentials.js.map

package/dist/integrations/providers/harness-credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"harness-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACb,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAGpG,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAA;AAgB7C,MAAM,UAAU,qBAAqB,CACpC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAA;IACxC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAA;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,IAAY,EACZ,YAAoB,sBAAsB;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/E,OAAO,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAyB,OAAO,CAAC,GAAG,EACpC,MAA2B,YAAY,EACvC,OAAgB,EAChB,SAAkB;IAElB,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,IAAI,GAAG,SAAS,IAAI,gBAAgB,EAAE,CAAA;IAC5C,MAAM,GAAG,GAAG,OAAO,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAA;IACrD,IAAI,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,8CAA8C;YAC9C,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CACjD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,OAAO,2BAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3E,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,2BAA2B,CAC1C,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB;QAClC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC;YACA,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC;YAChC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/B,CAAC;AAUD,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9F,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;AAC3C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,mCAAmC,CAClD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,MAAM,KAAK,GAAG,CACb,KAAc,EACd,MAAgD,EACb,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAQ,CAAC,UAAU,EAAE,aAAa,CAAW,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,OAAO,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ;gBAC5D,CAAC,CAAC;oBACA;wBACC,QAAQ,EAAE,EAAE,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,CAAC,CAAE,QAAkB;wBACpE,MAAM;wBACN,MAAM;qBACN;iBACD;gBACF,CAAC,CAAC,EAAE,CAAA;QACN,CAAC,CAAC,CAAA;IACH,CAAC,CAAA;IACD,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,GAAG,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,CAAC;YACJ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,yBAAyB;gBACnF,OAAO,EAAE,CAAA;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE;gBACnD,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,uBAAuB;aAChC,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GACV,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC;YACA,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC;YAClC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAA;IACJ,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAChE,CAAA;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;YAAE,OAAO,IAAI,CAAA;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,KAAiB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACN,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACjD,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACjD,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAA0B,EAAE,KAA2B;IACpF,OAAO,CACN,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CACxE,CAAA;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAC1C,IAAY,EACZ,QAA8B,EAC9B,WAAiC;IAEjC,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACpE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAEjF,MAAM,OAAO,GAAG;QACf,GAAG,IAAI;QACP,aAAa,EAAE;YACd,GAAG,KAAK;YACR,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YACpF,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;SAC3E;KACD,CAAA;IACD,MAAM,QAAQ,GAAG,IAAI,CACpB,OAAO,CAAC,IAAI,CAAC,EACb,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/E,CAAA;IACD,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACJ,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5C,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1E,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,UAAU,GAAG,SAAS,CAAA;QAEtB,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QAClD,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACJ,SAAS,CAAC,UAAU,CAAC,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACR,uDAAuD;YACxD,CAAC;QACF,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACR,+DAA+D;QAChE,CAAC;IACF,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,MAIzC;IACA,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO;YACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAChD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC;YACA,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC;YAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GACd,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,yBAAyB,CAAC;QAChC,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,SAAS;KACT,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACtC,IAAc,EACd,KAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,WAAW,GAAG,GAAG,GAAG,MAAM,CAAA;IAC7C,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7D,OAAO,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC"}

package/dist/integrations/providers/identity.js

@@ -1,64 +0,0 @@
-/**
- * The OAuth client namzu presents when it signs an operator in, and the
- * addresses that identity is valid against.
- *
- * ## Whose identity this is — the decision, written where the value is
- *
- * `OAUTH_CLIENT_ID` was **not registered by namzu**. It is the public client
- * identifier that the vendor's own command-line tool is registered under, and
- * it is the only one the subscription authorization server will issue
- * plan-scoped inference tokens to. This project has no client of its own
- * there because that vendor operates no open client registration for this
- * grant: there is no form to fill in, no application to make. The choice was
- * therefore between presenting this identity, and not offering the capability
- * at all.
- *
- * The owner decided the capability should exist, so this is the identity used,
- * and the consequences are stated rather than discovered later:
- *
- *  - **The authorization server cannot tell namzu apart from that tool.** A
- *    credential obtained here is, at the server, a credential obtained there.
- *  - **The operator's own plan governs it.** namzu mediates a sign-in the
- *    person completes themselves, on the vendor's own page, against the
- *    vendor's own account. No namzu service sees the credential, and nothing
- *    is proxied — the token goes from the vendor to this machine.
- *  - **This identity can be revoked by its owner at any time,** and if it is,
- *    every sign-in below stops working at once. That is a dependency namzu
- *    accepted knowingly; it is not a bug to be worked around when it happens.
- *  - **It is not a secret and is not treated as one.** A public OAuth client
- *    identifier is public by definition — that is why PKCE exists. Nearby
- *    implementations obscure this value behind a base64 decode at runtime,
- *    which hides nothing from anyone reading the request and hides the one
- *    fact a reviewer of THIS file most needs. It stays legible.
- *
- * Anyone uncomfortable with the above has the other door: set the credential
- * in the environment and namzu never runs this flow at all.
- *
- * ## The addresses
- *
- * Re-verified by capturing the exact URL emitted by the installed owner client
- * (`claude auth login --claudeai`, 2.1.241) on 2026-08-23. Its live production
- * contract uses the CAI authorize endpoint, the platform token endpoint and
- * the platform callback below. That client does not offer a loopback redirect
- * on this flow. A localhost callback may be valid OAuth in general, but it is
- * not registered for this client identity; sending one makes the consent page
- * refuse the request before sign-in.
- */
-export const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
-export const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
-export const AUTHORIZE_URL = 'https://claude.com/cai/oauth/authorize';
-/** Registered browser-to-terminal callback; not ours to replace with localhost. */
-export const MANUAL_REDIRECT_URI = 'https://platform.claude.com/oauth/code/callback';
-/**
- * The direct Claude Pro/Max scope set used by the current Claude harness.
- *
- * This looks broader than the inference capability Namzu consumes, but it is
- * the exact set the current owner client sends for `--claudeai`, not its
- * separately selected `--console` flow. The CAI endpoint validates the whole
- * registered request shape; deleting `org:create_api_key` because its name
- * sounds unrelated produces "Invalid request format" before the account can
- * authorize anything. Keep this as one captured protocol value rather than a
- * hand-curated list of what Namzu later uses.
- */
-export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
-//# sourceMappingURL=identity.js.map

package/dist/integrations/providers/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,4CAA4C,CAAA;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,wCAAwC,CAAA;AAErE,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iDAAiD,CAAA;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,4GAA4G,CAAA"}

package/dist/integrations/providers/index.js

@@ -1,14 +0,0 @@
-export { discoverProviders, findDetected, signedInSubscriptionProviders, } from './discover.js';
-export { claudeCredentialsPath, codexCredentialsPath, readClaudeCredentialFile, readClaudeFileCredential, readCodexCredentialFile, readCodexFileCredential, } from './harness-credentials.js';
-export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
-export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, } from './codex-device-login.js';
-export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, clearStoredGeminiApiKey, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, googleApiKeyPath, readStoredSubscriptionCredential, readStoredCodexCredential, readStoredGeminiApiKey, replaceStoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, writeStoredGeminiApiKey, } from './credential-store.js';
-export { ensureFreshStoredCodexCredential, } from './codex-oauth.js';
-export { MANUAL_REDIRECT_URI, OAUTH_SCOPES } from './identity.js';
-export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
-export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';
-export { chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, unresolvedMembers, } from './chain-capabilities.js';
-export { chainPositionName, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, readPreferences, writePreferences, } from './preferences.js';
-export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, providerEntriesOfVendor, unsupportedProviderMessage, VENDOR_NAMES, } from './registry.js';
-export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
-//# sourceMappingURL=index.js.map

package/dist/integrations/providers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,EACZ,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,gCAAgC,EAChC,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,EAC1B,uBAAuB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EAKvB,0BAA0B,EAC1B,YAAY,GAEZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/keychain.js

@@ -1,78 +0,0 @@
-/**
- * macOS Keychain reader for a co-installed agent CLI's OAuth credentials.
- *
- * That CLI keeps its credentials in the macOS login Keychain rather than a
- * flat file, under the generic-password service in {@link KEYCHAIN_SERVICE}
- * below — the exact name is there, in one place, because it is the address
- * of the data and an auditor has to be able to read it. The password value
- * is a JSON envelope:
- *
- *   { "claudeAiOauth": { "accessToken": "...", "refreshToken": "...",
- *                         "expiresAt": ..., "scopes": [...] } }
- *
- *  * Non-throwing — every failure (not-darwin, security not installed,
- * entry missing, payload malformed) returns `null` so discovery treats
- * the source as "not available" rather than crashing.
- */
-import { execFileSync } from 'node:child_process';
-import { platform } from 'node:os';
-/** The generic-password service this reads. The address, verbatim. */
-export const KEYCHAIN_SERVICE = 'Claude Code-credentials';
-export function readAgentKeychainCredential() {
-    if (platform() !== 'darwin')
-        return null;
-    let raw;
-    try {
-        raw = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-    }
-    catch {
-        return null;
-    }
-    if (raw.length === 0)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (typeof parsed !== 'object' || parsed === null)
-        return null;
-    const env = parsed.claudeAiOauth;
-    if (typeof env !== 'object' || env === null)
-        return null;
-    const oauth = env;
-    const accessToken = oauth.accessToken;
-    if (typeof accessToken !== 'string' || accessToken.length === 0)
-        return null;
-    return {
-        accessToken,
-        refreshToken: typeof oauth.refreshToken === 'string' ? oauth.refreshToken : undefined,
-        expiresAt: typeof oauth.expiresAt === 'number' ? oauth.expiresAt : undefined,
-        scopes: Array.isArray(oauth.scopes)
-            ? oauth.scopes.filter((s) => typeof s === 'string')
-            : undefined,
-    };
-}
-/**
- * Detect whether a credential value is an OAuth-style token
- * (must be sent via `Authorization: Bearer`) vs a console API key (sent
- * via `x-api-key`). Positively identifies by prefix; defaults to API-key when unsure.
- */
-export function isAnthropicOAuthToken(value) {
-    if (value.startsWith('sk-ant-api'))
-        return false; // console API key
-    if (value.startsWith('sk-ant-oat'))
-        return true; // OAuth setup token
-    if (value.startsWith('eyJ'))
-        return true; // JWT
-    if (value.startsWith('cc-'))
-        return true; // OAuth access token from the Keychain source
-    return false;
-}
-//# sourceMappingURL=keychain.js.map

package/dist/integrations/providers/keychain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AASzD,MAAM,UAAU,2BAA2B;IAC1C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAExC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAsC,CAAC,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrF,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YACjE,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,kBAAkB;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,MAAM;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;IACvF,OAAO,KAAK,CAAA;AACb,CAAC"}

package/dist/integrations/providers/model-reasoning.js

@@ -1,51 +0,0 @@
-const levels = new Set([
-    'none',
-    'minimal',
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-    'max',
-    'ultra',
-]);
-/** A capability-only view: catalogue metadata is scoped to this exact provider/model. */
-export function modelReasoningView(provider, model, catalogue) {
-    const rows = catalogue.filter((item) => item.id === model);
-    const entry = rows.length === 1 ? rows[0] : undefined;
-    const published = entry?.reasoningEffortLevels;
-    const valid = Array.isArray(published) &&
-        published.every((level) => levels.has(level)) &&
-        new Set(published).size === published.length;
-    const menu = valid
-        ? Object.freeze([...published])
-        : published !== undefined || rows.length > 1
-            ? undefined
-            : provider.reasoningEffortLevelsFor
-                ? provider.reasoningEffortLevelsFor(model)
-                : provider.effortLevelsFor?.(model);
-    let candidateDefault = entry?.reasoningEffortDefault;
-    if (candidateDefault === undefined) {
-        try {
-            candidateDefault = provider.reasoningEffortDefaultFor?.(model);
-        }
-        catch {
-            // An unavailable default must not erase an established menu.
-        }
-    }
-    // Preserve the declaration so the host can diagnose a default outside its menu.
-    const defaultEffort = candidateDefault !== undefined && levels.has(candidateDefault) ? candidateDefault : undefined;
-    return {
-        id: provider.id,
-        name: provider.name,
-        capabilities: provider.capabilities,
-        ...(provider.supportsHostedWebSearchFor
-            ? {
-                supportsHostedWebSearchFor: provider.supportsHostedWebSearchFor.bind(provider),
-            }
-            : {}),
-        chatStream: (params) => provider.chatStream(params),
-        reasoningEffortLevelsFor: (requested) => (requested === model ? menu : undefined),
-        reasoningEffortDefaultFor: (requested) => (requested === model ? defaultEffort : undefined),
-    };
-}
-//# sourceMappingURL=model-reasoning.js.map

package/dist/integrations/providers/model-reasoning.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-reasoning.js","sourceRoot":"","sources":["../../../src/integrations/providers/model-reasoning.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkB;IACvC,MAAM;IACN,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;CACP,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CACjC,QAAqB,EACrB,KAAa,EACb,SAA+B;IAE/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,MAAM,SAAS,GAAG,KAAK,EAAE,qBAAqB,CAAA;IAC9C,MAAM,KAAK,GACV,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,CAAA;IAC7C,MAAM,IAAI,GAAG,KAAK;QACjB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QAC/B,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ,CAAC,wBAAwB;gBAClC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC;gBAC1C,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,gBAAgB,GAAG,KAAK,EAAE,sBAAsB,CAAA;IACpD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,gBAAgB,GAAG,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;IACF,CAAC;IACD,gFAAgF;IAChF,MAAM,aAAa,GAClB,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,OAAO;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,GAAG,CAAC,QAAQ,CAAC,0BAA0B;YACtC,CAAC,CAAC;gBACA,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC9E;YACF,CAAC,CAAC,EAAE,CAAC;QACN,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QACnD,wBAAwB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,yBAAyB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;KAC3F,CAAA;AACF,CAAC"}