@namzu/cli 35.0.0 → 36.0.0

package/dist/integrations/providers/codex-device-login.js

@@ -1,195 +0,0 @@
-/** Namzu-owned ChatGPT/Codex device authorization for machines without Codex installed. */
-import { writeStoredCodexCredential } from './credential-store.js';
-import { codexCredentialFromTokens } from './harness-credentials.js';
-export const CODEX_OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
-export const CODEX_AUTH_ORIGIN = 'https://auth.openai.com';
-function asRecord(value) {
-    return typeof value === 'object' && value !== null ? value : null;
-}
-async function withSignal(operation, signal) {
-    signal.throwIfAborted();
-    let rejectAbort = () => { };
-    const aborted = new Promise((_resolve, reject) => {
-        rejectAbort = reject;
-    });
-    const onAbort = () => rejectAbort(signal.reason);
-    signal.addEventListener('abort', onAbort, { once: true });
-    try {
-        return await Promise.race([operation, aborted]);
-    }
-    finally {
-        signal.removeEventListener('abort', onAbort);
-    }
-}
-async function parseJson(response, signal) {
-    const value = asRecord(await withSignal(response.json(), signal));
-    if (!value)
-        throw new Error('The sign-in service returned an invalid response.');
-    return value;
-}
-async function requestUserCode(fetchFn, origin, signal) {
-    const response = await withSignal(fetchFn(`${origin}/api/accounts/deviceauth/usercode`, {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/json',
-            accept: 'application/json',
-        },
-        body: JSON.stringify({ client_id: CODEX_OAUTH_CLIENT_ID }),
-        signal,
-    }), signal);
-    if (!response.ok) {
-        throw new Error(`The Codex device sign-in service refused the request (HTTP ${response.status}).`);
-    }
-    const body = await parseJson(response, signal);
-    const deviceAuthId = body.device_auth_id;
-    const userCode = body.user_code ?? body.usercode;
-    const seconds = Number(body.interval);
-    if (typeof deviceAuthId !== 'string' ||
-        deviceAuthId.length === 0 ||
-        typeof userCode !== 'string' ||
-        userCode.length === 0 ||
-        !Number.isFinite(seconds) ||
-        seconds < 0) {
-        throw new Error('The Codex device sign-in service returned an incomplete response.');
-    }
-    return { deviceAuthId, userCode, intervalMs: Math.max(10, seconds * 1_000) };
-}
-async function delay(ms, signal) {
-    let timer;
-    try {
-        await withSignal(new Promise((resolve) => {
-            timer = setTimeout(resolve, ms);
-        }), signal);
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
-}
-async function complete(code, options, signal) {
-    const fetchFn = options.fetch ?? globalThis.fetch;
-    const origin = (options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '');
-    const deadlineAt = Date.now() + (options.pollTimeoutMs ?? 15 * 60_000);
-    let authorization = null;
-    while (Date.now() < deadlineAt) {
-        signal.throwIfAborted();
-        const response = await withSignal(fetchFn(`${origin}/api/accounts/deviceauth/token`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json',
-            },
-            body: JSON.stringify({
-                device_auth_id: code.deviceAuthId,
-                user_code: code.userCode,
-            }),
-            signal,
-        }), signal);
-        if (response.ok) {
-            authorization = await parseJson(response, signal);
-            break;
-        }
-        if (response.status !== 403 && response.status !== 404) {
-            return {
-                ok: false,
-                reason: `The Codex device sign-in was refused (HTTP ${response.status}). Nothing was stored.`,
-            };
-        }
-        await delay(code.intervalMs, signal);
-    }
-    if (!authorization) {
-        return {
-            ok: false,
-            reason: 'The Codex device code expired. Nothing was stored.',
-        };
-    }
-    const authorizationCode = authorization.authorization_code;
-    const verifier = authorization.code_verifier;
-    if (typeof authorizationCode !== 'string' ||
-        authorizationCode.length === 0 ||
-        typeof verifier !== 'string' ||
-        verifier.length === 0) {
-        return {
-            ok: false,
-            reason: 'The Codex device sign-in returned no exchange code. Nothing was stored.',
-        };
-    }
-    const redirectUri = `${origin}/deviceauth/callback`;
-    const form = new URLSearchParams({
-        grant_type: 'authorization_code',
-        code: authorizationCode,
-        redirect_uri: redirectUri,
-        client_id: CODEX_OAUTH_CLIENT_ID,
-        code_verifier: verifier,
-    });
-    const exchanged = await withSignal(fetchFn(`${origin}/oauth/token`, {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/x-www-form-urlencoded',
-            accept: 'application/json',
-        },
-        body: form.toString(),
-        signal,
-    }), signal);
-    if (!exchanged.ok) {
-        return {
-            ok: false,
-            reason: `The Codex token exchange was refused (HTTP ${exchanged.status}). Nothing was stored.`,
-        };
-    }
-    const tokens = await parseJson(exchanged, signal);
-    const accessToken = tokens.access_token;
-    const refreshToken = tokens.refresh_token;
-    const credential = typeof accessToken === 'string'
-        ? codexCredentialFromTokens({
-            accessToken,
-            ...(typeof refreshToken === 'string' ? { refreshToken } : {}),
-        })
-        : null;
-    if (!credential) {
-        return {
-            ok: false,
-            reason: 'The Codex token exchange did not identify an account. Nothing was stored.',
-        };
-    }
-    signal.throwIfAborted();
-    try {
-        const storedAt = writeStoredCodexCredential(credential, options.home);
-        return { ok: true, credential, storedAt };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            reason: `Signed in to Codex, but the credential could not be stored privately: ${error instanceof Error ? error.message : String(error)}`,
-        };
-    }
-}
-export async function beginCodexDeviceLogin(options = {}) {
-    options.signal?.throwIfAborted();
-    const owner = new AbortController();
-    const signal = options.signal ? AbortSignal.any([options.signal, owner.signal]) : owner.signal;
-    const origin = (options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '');
-    const userCode = await requestUserCode(options.fetch ?? globalThis.fetch, origin, signal);
-    let completion;
-    return {
-        url: `${origin}/codex/device`,
-        userCode: userCode.userCode,
-        waitForCompletion: () => {
-            completion ??= complete(userCode, options, signal).catch((error) => {
-                if (signal.aborted) {
-                    return {
-                        ok: false,
-                        reason: 'The Codex sign-in was cancelled. Nothing was stored.',
-                    };
-                }
-                return {
-                    ok: false,
-                    reason: `Could not complete Codex sign-in: ${error instanceof Error ? error.message : String(error)}`,
-                };
-            });
-            return completion;
-        },
-        cancel: () => owner.abort(new Error('The Codex sign-in attempt was cancelled.')),
-    };
-}
-//# sourceMappingURL=codex-device-login.js.map

package/dist/integrations/providers/codex-device-login.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-device-login.js","sourceRoot":"","sources":["../../../src/integrations/providers/codex-device-login.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAA6B,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAE/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AA+B1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,SAAyB,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CACvB,QAAkB,EAClB,MAAmB;IAEnB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAChF,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,MAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAChC,OAAO,CAAC,GAAG,MAAM,mCAAmC,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;QAC1D,MAAM;KACN,CAAC,EACF,MAAM,CACN,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,8DAA8D,QAAQ,CAAC,MAAM,IAAI,CACjF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAA;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAA;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrC,IACC,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,GAAG,CAAC,EACV,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAmB;IACnD,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,MAAM,UAAU,CACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7B,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAChC,CAAC,CAAC,EACF,MAAM,CACN,CAAA;IACF,CAAC;YAAS,CAAC;QACV,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,IAAsB,EACtB,OAAgC,EAChC,MAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,MAAM,CAAC,CAAA;IACtE,IAAI,aAAa,GAAmC,IAAI,CAAA;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAChC,OAAO,CAAC,GAAG,MAAM,gCAAgC,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,cAAc,EAAE,IAAI,CAAC,YAAY;gBACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,MAAM;SACN,CAAC,EACF,MAAM,CACN,CAAA;QACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,aAAa,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACjD,MAAK;QACN,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,8CAA8C,QAAQ,CAAC,MAAM,wBAAwB;aAC7F,CAAA;QACF,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oDAAoD;SAC5D,CAAA;IACF,CAAC;IACD,MAAM,iBAAiB,GAAG,aAAa,CAAC,kBAAkB,CAAA;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAA;IAC5C,IACC,OAAO,iBAAiB,KAAK,QAAQ;QACrC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC,EACpB,CAAC;QACF,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yEAAyE;SACjF,CAAA;IACF,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,sBAAsB,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,QAAQ;KACvB,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CACjC,OAAO,CAAC,GAAG,MAAM,cAAc,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,MAAM;KACN,CAAC,EACF,MAAM,CACN,CAAA;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8CAA8C,SAAS,CAAC,MAAM,wBAAwB;SAC9F,CAAA;IACF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAA;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAA;IACzC,MAAM,UAAU,GACf,OAAO,WAAW,KAAK,QAAQ;QAC9B,CAAC,CAAC,yBAAyB,CAAC;YAC1B,WAAW;YACX,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACH,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2EAA2E;SACnF,CAAA;IACF,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yEAAyE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACzI,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,UAAmC,EAAE;IAErC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;IAC9F,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACzF,IAAI,UAAwD,CAAA;IAC5D,OAAO;QACN,GAAG,EAAE,GAAG,MAAM,eAAe;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,iBAAiB,EAAE,GAAG,EAAE;YACvB,UAAU,KAAK,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO;wBACN,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,sDAAsD;qBAC9D,CAAA;gBACF,CAAC;gBACD,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACrG,CAAA;YACF,CAAC,CAAC,CAAA;YACF,OAAO,UAAU,CAAA;QAClB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;KAChF,CAAA;AACF,CAAC"}

package/dist/integrations/providers/codex-oauth.js

@@ -1,95 +0,0 @@
-/** Refresh for a Codex credential owned by Namzu's credential store. */
-import { CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID } from './codex-device-login.js';
-import { readStoredCodexCredential, replaceStoredCodexCredential, } from './credential-store.js';
-import { codexCredentialFromTokens } from './harness-credentials.js';
-import { CredentialPublicationError, CredentialWithdrawnError } from './oauth.js';
-const REFRESH_WINDOW_MS = 5 * 60_000;
-function asRecord(value) {
-    return typeof value === 'object' && value !== null ? value : null;
-}
-async function withSignal(operation, signal) {
-    signal.throwIfAborted();
-    let rejectAbort = () => { };
-    const aborted = new Promise((_resolve, reject) => {
-        rejectAbort = reject;
-    });
-    const onAbort = () => rejectAbort(signal.reason);
-    signal.addEventListener('abort', onAbort, { once: true });
-    try {
-        return await Promise.race([operation, aborted]);
-    }
-    finally {
-        signal.removeEventListener('abort', onAbort);
-    }
-}
-export async function ensureFreshStoredCodexCredential(signal, options = {}) {
-    signal?.throwIfAborted();
-    const current = readStoredCodexCredential(options.home);
-    if (!current) {
-        throw new CredentialWithdrawnError('The Codex subscription Namzu stored was removed. Sign in again or choose another provider.');
-    }
-    if (current.expiresAt === undefined ||
-        current.expiresAt - (options.now ?? Date.now()) > REFRESH_WINDOW_MS) {
-        return current;
-    }
-    if (!current.refreshToken) {
-        throw new CredentialWithdrawnError('The Codex subscription expired without a refresh grant. Sign in again.');
-    }
-    const deadline = AbortSignal.timeout(30_000);
-    const requestSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
-    let response;
-    try {
-        response = await withSignal((options.fetch ?? globalThis.fetch)(`${(options.authOrigin ?? CODEX_AUTH_ORIGIN).replace(/\/$/, '')}/oauth/token`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json',
-            },
-            body: JSON.stringify({
-                client_id: CODEX_OAUTH_CLIENT_ID,
-                grant_type: 'refresh_token',
-                refresh_token: current.refreshToken,
-            }),
-            signal: requestSignal,
-        }), requestSignal);
-    }
-    catch (error) {
-        if (signal?.aborted)
-            throw signal.reason;
-        throw new CredentialPublicationError({ cause: error });
-    }
-    if (!response.ok) {
-        throw new CredentialWithdrawnError(`The Codex subscription could not be refreshed (HTTP ${response.status}). Sign in again.`);
-    }
-    const body = asRecord(await withSignal(response.json(), requestSignal));
-    if (!body) {
-        throw new CredentialWithdrawnError('The Codex refresh service returned an invalid credential. Sign in again.');
-    }
-    const accessToken = body.access_token;
-    const refreshToken = body.refresh_token;
-    const refreshed = typeof accessToken === 'string'
-        ? codexCredentialFromTokens({
-            accessToken,
-            refreshToken: typeof refreshToken === 'string' ? refreshToken : current.refreshToken,
-            accountId: current.accountId,
-        })
-        : null;
-    if (!refreshed || refreshed.accountId !== current.accountId) {
-        throw new CredentialWithdrawnError('The refreshed Codex credential did not belong to the signed-in account. Sign in again.');
-    }
-    signal?.throwIfAborted();
-    let result;
-    try {
-        result = replaceStoredCodexCredential(current, refreshed, options.home);
-    }
-    catch (error) {
-        throw new CredentialPublicationError({ cause: error });
-    }
-    if (!result.replaced) {
-        if (!result.current)
-            throw new CredentialWithdrawnError();
-        return result.current;
-    }
-    return refreshed;
-}
-//# sourceMappingURL=codex-oauth.js.map

package/dist/integrations/providers/codex-oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-oauth.js","sourceRoot":"","sources":["../../../src/integrations/providers/codex-oauth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAEN,yBAAyB,EACzB,4BAA4B,GAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEjF,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAA;AASpC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,SAAyB,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,MAAoB,EACpB,UAAqC,EAAE;IAEvC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CACjC,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,IACC,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,OAAO,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,iBAAiB,EAClE,CAAC;QACF,OAAO,OAAO,CAAA;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CACjC,wEAAwE,CACxE,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC7E,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,UAAU,CAC1B,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAClC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,EAC7E;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,qBAAqB;gBAChC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;YACF,MAAM,EAAE,aAAa;SACrB,CACD,EACD,aAAa,CACb,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAA;QACxC,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,wBAAwB,CACjC,uDAAuD,QAAQ,CAAC,MAAM,mBAAmB,CACzF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CACjC,0EAA0E,CAC1E,CAAA;IACF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAA;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAA;IACvC,MAAM,SAAS,GACd,OAAO,WAAW,KAAK,QAAQ;QAC9B,CAAC,CAAC,yBAAyB,CAAC;YAC1B,WAAW;YACX,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC;QACH,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,wBAAwB,CACjC,wFAAwF,CACxF,CAAA;IACF,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,MAAuD,CAAA;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QACzD,OAAO,MAAM,CAAC,OAAO,CAAA;IACtB,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/integrations/providers/credential-provider.js

@@ -1,74 +0,0 @@
-import { NamzuError } from '@namzu/sdk';
-import { clearStoredSubscriptionCredential, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
-/**
- * The CLI's hardened credential file, as a writable `CredentialProvider`.
- *
- * The seam had no writable implementation, so `describe()` reported
- * `writable: false` everywhere and nothing could rotate a credential
- * through it — the OAuth refresh wrote straight into this store, invisibly
- * to the kernel.
- *
- * **This adapter adds no file logic of its own.** The store already owns
- * the `wx` open, the `0600`, the read-back that proves the mode landed and
- * the refusal that leaves no file when it did not. Reimplementing any of
- * that here would be a second, weaker copy of a guarantee this repo has a
- * ratified rule about, and the copy is the one that would drift.
- */
-/**
- * The one credential this store holds.
- *
- * A single ref rather than a namespace, because the file has exactly one
- * subscription credential in it. A provider that accepted any name would
- * report `configured: false` for every other one — indistinguishable from
- * "this name is not set here" — while quietly answering only for this one.
- */
-export const SUBSCRIPTION_CREDENTIAL_REF = 'namzu.subscription.accessToken';
-export class FileCredentialProvider {
-    options;
-    constructor(options = {}) {
-        this.options = options;
-    }
-    get source() {
-        return credentialsPath(...(this.options.home === undefined ? [] : [this.options.home]));
-    }
-    refused(ref) {
-        return new NamzuError({
-            code: 'invalid_config',
-            message: `This store holds only "${SUBSCRIPTION_CREDENTIAL_REF}"; it has no place for "${ref}".`,
-            details: { ref },
-            retryable: false,
-        });
-    }
-    async resolve(ref) {
-        if (ref !== SUBSCRIPTION_CREDENTIAL_REF)
-            return undefined;
-        const stored = readStoredSubscriptionCredential(...(this.options.home === undefined ? [] : [this.options.home]));
-        return stored?.accessToken ? { value: stored.accessToken, source: this.source } : undefined;
-    }
-    async describe(ref) {
-        const found = await this.resolve(ref);
-        return {
-            configured: found !== undefined,
-            ...(found ? { source: found.source } : {}),
-            // True for this ref and only this ref. Reporting writable for a
-            // name `set` would refuse is a description that disagrees with the
-            // thing it describes.
-            writable: ref === SUBSCRIPTION_CREDENTIAL_REF,
-        };
-    }
-    async set(ref, value) {
-        if (ref !== SUBSCRIPTION_CREDENTIAL_REF)
-            throw this.refused(ref);
-        // Refresh metadata is preserved: a rotation replaces the access token
-        // and must not silently discard the refresh token that will rotate it
-        // again, or the next rotation has nothing to work from.
-        const existing = readStoredSubscriptionCredential(...(this.options.home === undefined ? [] : [this.options.home]));
-        writeStoredSubscriptionCredential({ ...(existing ?? {}), accessToken: value }, ...(this.options.home === undefined ? [] : [this.options.home]));
-    }
-    async unset(ref) {
-        if (ref !== SUBSCRIPTION_CREDENTIAL_REF)
-            throw this.refused(ref);
-        clearStoredSubscriptionCredential(...(this.options.home === undefined ? [] : [this.options.home]));
-    }
-}
-//# sourceMappingURL=credential-provider.js.map

package/dist/integrations/providers/credential-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EACN,iCAAiC,EACjC,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAE9B;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAA;AAO3E,MAAM,OAAO,sBAAsB;IACL;IAA7B,YAA6B,UAAyC,EAAE;QAA3C,YAAO,GAAP,OAAO,CAAoC;IAAG,CAAC;IAE5E,IAAY,MAAM;QACjB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IAEO,OAAO,CAAC,GAAW;QAC1B,OAAO,IAAI,UAAU,CAAC;YACrB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,0BAA0B,2BAA2B,2BAA2B,GAAG,IAAI;YAChG,OAAO,EAAE,EAAE,GAAG,EAAE;YAChB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACxB,IAAI,GAAG,KAAK,2BAA2B;YAAE,OAAO,SAAS,CAAA;QACzD,MAAM,MAAM,GAAG,gCAAgC,CAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAA;QACD,OAAO,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACrC,OAAO;YACN,UAAU,EAAE,KAAK,KAAK,SAAS;YAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,gEAAgE;YAChE,mEAAmE;YACnE,sBAAsB;YACtB,QAAQ,EAAE,GAAG,KAAK,2BAA2B;SAC7C,CAAA;IACF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QACnC,IAAI,GAAG,KAAK,2BAA2B;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,gCAAgC,CAChD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAA;QACD,iCAAiC,CAChC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAA;IACF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACtB,IAAI,GAAG,KAAK,2BAA2B;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChE,iCAAiC,CAChC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAA;IACF,CAAC;CACD"}