@oracle-agent/oracle 0.31.0 → 0.33.0

package/dist/bin/oracle.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{realpathSync as T}from"node:fs";import{fileURLToPath as oe}from"node:url";import h from"node:fs";import g from"node:path";import{pathToFileURL as z}from"node:url";import d from"node:fs";import P from"node:os";import i from"node:path";import{fileURLToPath as $}from"node:url";var M=i.dirname($(import.meta.url)),l=i.resolve(M,"../..");function u(){return process.env.ORACLE_FAKE_HOME||P.homedir()}function R(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function f(){return R()?process.env.ORACLE_CONFIG_DIR||i.join(u(),".config","oracle"):i.join(u(),".config","oracle")}function I(){return i.join(f(),"exec.env")}function k(){return i.join(f(),"desk.json")}function v(){return i.join(f(),"env")}function p({force:e=!1}={}){if(p._done&&!e)return p._result||null;p._done=!0;let o={},n=(c,t)=>{if(t==null)return;let r=String(t).trim();r&&(process.env[c]!=null&&String(process.env[c]).trim()!==""||(process.env[c]=r,o[c]=r))};try{let c=v();if(d.existsSync(c))for(let t of d.readFileSync(c,"utf8").split(/\r?\n/)){let r=t.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!r||r[2].startsWith("#"))continue;let a=r[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),n(r[1],a)}}catch{}try{let c=k();if(d.existsSync(c)){let t=JSON.parse(d.readFileSync(c,"utf8"));t&&typeof t=="object"&&(n("ORACLE_DESK_URL",t.deskUrl||t.dataUrl||t.url),n("ORACLE_DATA_URL",t.dataUrl||t.deskUrl||t.url),n("ORACLE_API_URL",t.apiUrl||t.dataUrl||t.deskUrl),n("ORACLE_PUBLIC_URL",t.publicUrl||t.deskUrl||t.dataUrl),n("ORACLE_EXEC_URL",t.execUrl),n("MAD_DESK_URL",t.deskUrl||t.dataUrl))}}catch{}let s=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return s&&(n("ORACLE_DESK_URL",s),n("ORACLE_DATA_URL",s),n("ORACLE_API_URL",s),n("ORACLE_PUBLIC_URL",s),n("MAD_DESK_URL",s)),p._result=Object.keys(o).length?o:null,p._result}try{p()}catch{}function H(){return process.env.HERMES_HOME?i.resolve(process.env.HERMES_HOME):i.join(u(),".hermes")}function N(){return i.join(u(),".claude.json")}function F(e=process.cwd()){return i.join(e,".mcp.json")}function q(){return process.platform==="darwin"?i.join(u(),"Library","Application Support","Claude","claude_desktop_config.json"):i.join(u(),".config","Claude","claude_desktop_config.json")}function K(){return i.join(u(),".codex","config.toml")}function C(){return i.join(f(),"connectors")}function B(){return i.join(C(),"chatgpt-openapi.json")}function G(){return i.join(f(),"active-chain.json")}function y(e){let o=[i.join(l,"bin",e),i.join(l,"dist","bin",e),i.join(l,"..","bin",e)];return o.find(n=>d.existsSync(n))||o[0]}function V(e){return d.mkdirSync(e,{recursive:!0}),e}var j={homeDir:u,isPublicDesktop:R,oracleConfigDir:f,oracleExecEnvPath:I,oracleDeskJsonPath:k,oracleEnvFilePath:v,loadDeskRouting:p,hermesRoot:H,activeChainPath:G,claudeCodeUserConfigPath:N,claudeCodeProjectMcpPath:F,claudeDesktopConfigPath:q,codexConfigPath:K,chatgptConnectorDir:C,chatgptOpenApiPath:B,packageBin:y,ensureDir:V,PACKAGE_ROOT:l};import{execFile as J}from"node:child_process";import{existsSync as me,mkdirSync as he,readFileSync as W,realpathSync as ge,writeFileSync as ye}from"node:fs";import w from"node:path";import{promisify as Y}from"node:util";var Ae=Y(J);var _e=1440*60*1e3;function L(e,o){let n=t=>String(t).replace(/^v/,"").split("-")[0].split(".").map(r=>Number.parseInt(r,10)||0),s=n(e),c=n(o);for(let t=0;t<Math.max(s.length,c.length);t+=1){let r=s[t]??0,a=c[t]??0;if(r>a)return 1;if(r<a)return-1}return 0}function X(e){let o=e?.stateDir||w.join(process.env.HOME||".",".oracle");return w.join(o,"update-check.json")}function O(e){try{return JSON.parse(W(X(e),"utf8"))}catch{return null}}var Q="\u25C7 ORACLE  // self-custody multichain agent control plane",Z=`START
+import{realpathSync as T}from"node:fs";import{fileURLToPath as oe}from"node:url";import h from"node:fs";import g from"node:path";import{pathToFileURL as z}from"node:url";import d from"node:fs";import P from"node:os";import i from"node:path";import{fileURLToPath as $}from"node:url";var M=i.dirname($(import.meta.url)),l=i.resolve(M,"../..");function u(){return process.env.ORACLE_FAKE_HOME||P.homedir()}function v(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function f(){return v()?process.env.ORACLE_CONFIG_DIR||i.join(u(),".config","oracle"):i.join(u(),".config","oracle")}function I(){return i.join(f(),"exec.env")}function R(){return i.join(f(),"desk.json")}function k(){return i.join(f(),"env")}function p({force:e=!1}={}){if(p._done&&!e)return p._result||null;p._done=!0;let o={},n=(c,t)=>{if(t==null)return;let r=String(t).trim();r&&(process.env[c]!=null&&String(process.env[c]).trim()!==""||(process.env[c]=r,o[c]=r))};try{let c=k();if(d.existsSync(c))for(let t of d.readFileSync(c,"utf8").split(/\r?\n/)){let r=t.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!r||r[2].startsWith("#"))continue;let a=r[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),n(r[1],a)}}catch{}try{let c=R();if(d.existsSync(c)){let t=JSON.parse(d.readFileSync(c,"utf8"));t&&typeof t=="object"&&(n("ORACLE_DESK_URL",t.deskUrl||t.dataUrl||t.url),n("ORACLE_DATA_URL",t.dataUrl||t.deskUrl||t.url),n("ORACLE_API_URL",t.apiUrl||t.dataUrl||t.deskUrl),n("ORACLE_PUBLIC_URL",t.publicUrl||t.deskUrl||t.dataUrl),n("ORACLE_EXEC_URL",t.execUrl),n("MAD_DESK_URL",t.deskUrl||t.dataUrl))}}catch{}let s=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return s&&(n("ORACLE_DESK_URL",s),n("ORACLE_DATA_URL",s),n("ORACLE_API_URL",s),n("ORACLE_PUBLIC_URL",s),n("MAD_DESK_URL",s)),p._result=Object.keys(o).length?o:null,p._result}try{p()}catch{}function H(){return process.env.HERMES_HOME?i.resolve(process.env.HERMES_HOME):i.join(u(),".hermes")}function N(){return i.join(u(),".claude.json")}function F(e=process.cwd()){return i.join(e,".mcp.json")}function q(){return process.platform==="darwin"?i.join(u(),"Library","Application Support","Claude","claude_desktop_config.json"):i.join(u(),".config","Claude","claude_desktop_config.json")}function K(){return i.join(u(),".codex","config.toml")}function C(){return i.join(f(),"connectors")}function B(){return i.join(C(),"chatgpt-openapi.json")}function G(){return i.join(f(),"active-chain.json")}function y(e){let o=[i.join(l,"bin",e),i.join(l,"dist","bin",e),i.join(l,"..","bin",e)];return o.find(n=>d.existsSync(n))||o[0]}function V(e){return d.mkdirSync(e,{recursive:!0}),e}var j={homeDir:u,isPublicDesktop:v,oracleConfigDir:f,oracleExecEnvPath:I,oracleDeskJsonPath:R,oracleEnvFilePath:k,loadDeskRouting:p,hermesRoot:H,activeChainPath:G,claudeCodeUserConfigPath:N,claudeCodeProjectMcpPath:F,claudeDesktopConfigPath:q,codexConfigPath:K,chatgptConnectorDir:C,chatgptOpenApiPath:B,packageBin:y,ensureDir:V,PACKAGE_ROOT:l};import{execFile as J}from"node:child_process";import{existsSync as me,mkdirSync as he,readFileSync as W,realpathSync as ge,writeFileSync as ye}from"node:fs";import w from"node:path";import{promisify as Y}from"node:util";var Ae=Y(J);var _e=1440*60*1e3;function L(e,o){let n=t=>String(t).replace(/^v/,"").split("-")[0].split(".").map(r=>Number.parseInt(r,10)||0),s=n(e),c=n(o);for(let t=0;t<Math.max(s.length,c.length);t+=1){let r=s[t]??0,a=c[t]??0;if(r>a)return 1;if(r<a)return-1}return 0}function X(e){let o=e?.stateDir||w.join(process.env.HOME||".",".oracle");return w.join(o,"update-check.json")}function O(e){try{return JSON.parse(W(X(e),"utf8"))}catch{return null}}var Q="\u25C7 ORACLE  // self-custody multichain agent control plane",Z=`START
   oracle                       open the native Oracle chat (TTY)
   oracle chat                  open chat explicitly
   oracle setup                 connect a model and optional messaging
@@ -36,6 +36,7 @@ SYSTEM
   oracle init                  optional Hermes lane install (dry-run by default)
   oracle bootstrap             optional Hermes installation
   oracle public serve          secret-free public HTTP surface
+  oracle telegram              native interactive Telegram cards (no Hermes)
   oracle fees                  status \xB7 check
   oracle eval                  desk \xB7 fidelity \xB7 hybrid \xB7 guards \xB7 contracts \xB7 all
   oracle upgrade               update installed agent lanes

package/dist/cli/commands/auth.mjs

@@ -1,16 +1,16 @@
-import T from"node:fs";import F from"node:path";import j from"node:fs";import pe from"node:os";import O from"node:path";import{fileURLToPath as le}from"node:url";var fe=O.dirname(le(import.meta.url)),Ve=O.resolve(fe,"../..");function X(){return process.env.ORACLE_FAKE_HOME||pe.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function b(){return he()?process.env.ORACLE_CONFIG_DIR||O.join(X(),".config","oracle"):O.join(X(),".config","oracle")}function me(){return O.join(b(),"desk.json")}function we(){return O.join(b(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let t={},r=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=we();if(j.existsSync(n))for(let i of j.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let p=s[2];(p.startsWith('"')&&p.endsWith('"')||p.startsWith("'")&&p.endsWith("'"))&&(p=p.slice(1,-1)),r(s[1],p)}}catch{}try{let n=me();if(j.existsSync(n)){let i=JSON.parse(j.readFileSync(n,"utf8"));i&&typeof i=="object"&&(r("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),r("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),r("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),r("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),r("ORACLE_EXEC_URL",i.execUrl),r("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),E._result=Object.keys(t).length?t:null,E._result}try{E()}catch{}function $(e){return j.mkdirSync(e,{recursive:!0}),e}var ge=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function ye(e,{required:t=!1}={}){let r=I(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!ge.has(r))throw new Error(`unsupported provider: ${r}`);return r}function ve(e,{required:t=!1}={}){let r=I(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function ke(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=ye(e),i=ve(t,{required:o});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:ke(r)};if(I(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var xe=new Set(["auto","standalone","hermes","remote","arch"]);function _e(){return F.join(b(),"model.json")}function P(e){return String(e||"").trim()||void 0}function Ae(e={}){let t=P(e.backend)?.toLowerCase()||"auto",r=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=P(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=P(e.reasoningEffort),s=P(e.computeHost||e.remoteHost),p=P(e.computeUser||e.remoteUser),u=P(e.computePath||e.remotePath);if(!xe.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...p?{computeUser:p}:{},...u?{computePath:u}:{}}}function Z(e){let t=Ae(e),r=_e();$(F.dirname(r)),process.platform!=="win32"&&T.chmodSync(F.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return T.writeFileSync(o,`${JSON.stringify(t,null,2)}
+import T from"node:fs";import F from"node:path";import j from"node:fs";import le from"node:os";import O from"node:path";import{fileURLToPath as pe}from"node:url";var fe=O.dirname(pe(import.meta.url)),Ve=O.resolve(fe,"../..");function X(){return process.env.ORACLE_FAKE_HOME||le.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function b(){return he()?process.env.ORACLE_CONFIG_DIR||O.join(X(),".config","oracle"):O.join(X(),".config","oracle")}function me(){return O.join(b(),"desk.json")}function we(){return O.join(b(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let t={},r=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=we();if(j.existsSync(n))for(let i of j.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let l=s[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),r(s[1],l)}}catch{}try{let n=me();if(j.existsSync(n)){let i=JSON.parse(j.readFileSync(n,"utf8"));i&&typeof i=="object"&&(r("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),r("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),r("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),r("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),r("ORACLE_EXEC_URL",i.execUrl),r("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),E._result=Object.keys(t).length?t:null,E._result}try{E()}catch{}function $(e){return j.mkdirSync(e,{recursive:!0}),e}var ge=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function ye(e,{required:t=!1}={}){let r=I(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!ge.has(r))throw new Error(`unsupported provider: ${r}`);return r}function ve(e,{required:t=!1}={}){let r=I(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function ke(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=ye(e),i=ve(t,{required:o});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:ke(r)};if(I(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var xe=new Set(["auto","standalone","hermes","remote","arch"]);function _e(){return F.join(b(),"model.json")}function P(e){return String(e||"").trim()||void 0}function Ae(e={}){let t=P(e.backend)?.toLowerCase()||"auto",r=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=P(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=P(e.reasoningEffort),s=P(e.computeHost||e.remoteHost),l=P(e.computeUser||e.remoteUser),u=P(e.computePath||e.remotePath);if(!xe.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...l?{computeUser:l}:{},...u?{computePath:u}:{}}}function Z(e){let t=Ae(e),r=_e();$(F.dirname(r)),process.platform!=="win32"&&T.chmodSync(F.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return T.writeFileSync(o,`${JSON.stringify(t,null,2)}
 `,{mode:384}),T.renameSync(o,r),process.platform!=="win32"&&T.chmodSync(r,384),t}import{createHash as Se,randomBytes as N,timingSafeEqual as Ee}from"node:crypto";import g from"node:fs";import k from"node:path";import Oe from"node:readline/promises";import{spawn as be,spawnSync as Pe}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),Ce=12e4;function Re(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(R))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function Y(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let r=JSON.parse(g.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${k.basename(e)}`)}}function Q(e){$(e),process.platform!=="win32"&&g.chmodSync(e,448)}function x(e,t){Q(k.dirname(e));let r=`${e}.${process.pid}.${N(4).toString("hex")}.tmp`;g.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),g.renameSync(r,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ue(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function D(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function C(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function je(e={}){let t=e.file||k.join(b(),"oauth.json"),r=e.metadataFile||k.join(k.dirname(t),"oauth-meta.json"),o=e.linksFile||k.join(k.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Pe,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ue(i),p=s?"linux-secret-service":"private-file",u=`${t}.lock`;async function v(f){Q(k.dirname(u));let l;for(let c=0;c<400;c+=1)try{l=g.openSync(u,"wx",384);break}catch(a){if(a?.code!=="EEXIST")throw a;try{Date.now()-g.statSync(u).mtimeMs>3e5&&g.unlinkSync(u)}catch{}await new Promise(d=>setTimeout(d,25))}if(l===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(l)}catch{}try{g.unlinkSync(u)}catch{}}}function w(f,l="oauth"){return["application","oracle","kind",l,"provider",f]}function U(f){if(!g.existsSync(o))return null;let c=m(o,{providers:{}}).providers?.[f];if(!Array.isArray(c))return null;let a=[];for(let d of c)if(k.isAbsolute(String(d||"")))try{let h=m(d,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let S=C(h.claudeAiOauth);a.push({...S,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let S=y[f]||y[f.replace(/-oauth$/,"")]||[],ue=Array.isArray(S)?S:S?[S]:[];for(let z of ue)if(!(!z||typeof z!="object"))try{let de=C(z);a.push({...de,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return a.length?a.find(d=>!d.expiresAt||d.expiresAt>n()+Ce)||a[0]:null}function W(f){let l=_(f);if(s){let d=i("secret-tool",["lookup",...w(l)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!d.error&&d.status===0&&String(d.stdout||"").trim())try{return C(JSON.parse(String(d.stdout).trim()))}catch{}return U(l)}let a=m(t,{providers:{}}).providers?.[l];if(a)try{return C(a)}catch{}return U(l)}function ne(f,l){let c=_(f),a=C(l);if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} OAuth`,...w(c)],{input:JSON.stringify(a),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(r,{providers:{}});return y.providers||={},y.providers[c]={expiresAt:a.expiresAt,source:a.source},x(r,y),a}let d=m(t,{providers:{}});return d.providers||={},d.providers[c]=a,x(t,d),a}function ie(f){let l=_(f);if(s){let d=i("secret-tool",["clear",...w(l)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{}});return h.providers&&delete h.providers[l],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{}}),a=!!c.providers?.[l];return c.providers&&delete c.providers[l],x(t,c),a}function V(f){let l=D(f);if(s){let c=i("secret-tool",["lookup",...w(l,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return c.error||c.status!==0?"":String(c.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[l]||"").trim()}function se(f,l){let c=D(f),a=String(l||"").trim();if(!a)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} API key`,...w(c,"api-key")],{input:a,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(r,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[c]={configured:!0},x(r,y),!0}let d=m(t,{providers:{},apiKeys:{}});return d.apiKeys||={},d.apiKeys[c]=a,x(t,d),!0}function ce(f){let l=D(f);if(s){let d=i("secret-tool",["clear",...w(l,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[l],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{},apiKeys:{}}),a=!!c.apiKeys?.[l];return c.apiKeys&&delete c.apiKeys[l],x(t,c),a}function ae(){let f={},l={};if(s){let c=m(r,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!W(a),expiresAt:Number(d.expiresAt||0),source:String(d.source||"oracle"),storage:p};for(let a of Object.keys(c.apiKeys||{}))l[a]={configured:!!V(a),storage:p}}else{let c=m(t,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!d?.accessToken,expiresAt:Number(d?.expiresAt||0),source:String(d?.source||"oracle"),storage:p};for(let[a,d]of Object.entries(c.apiKeys||{}))l[a]={configured:!!d,storage:p}}for(let c of Object.keys(R)){if(f[c])continue;let a=U(c);a&&(f[c]={loggedIn:!0,expiresAt:a.expiresAt,source:a.source,storage:"external-access-source"})}return{storage:p,providers:f,apiKeys:l}}return Object.freeze({file:t,storage:p,get:W,set:ne,remove:ie,getApiKey:V,setApiKey:se,removeApiKey:ce,status:ae,withLock:v})}var G;function ee(){return G||=je(),G}function M(e){return Buffer.from(e).toString("base64url")}function $e(){let e=M(N(32));return{verifier:e,challenge:M(Se("sha256").update(e).digest()),state:M(N(24))}}function Ie(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&Ee(r,o)}function Le(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return be(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function B(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function Te(e){if(e)return String(await e()).trim();let t=Oe.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return C({accessToken:r,refreshToken:o,expiresAt:Re(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ke(e){let t=R["anthropic-oauth"],r=e.pkce||$e(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let i=await Te(e.inputFn),[s,p]=i.split("#",2);if(!s||!Ie(p,r.state))throw new Error("Claude OAuth state mismatch");let u=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:p,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return H(await A(u,"Claude OAuth token exchange"),e)}async function ze(e){let t=R["openai-codex"],r=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),i;for(let p=0;p<Math.ceil(900/n);p+=1){await e.sleepFn(n*1e3);let u=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(u.ok){i=await A(u,"Codex device authorization");break}if(![403,404].includes(u.status))throw new Error(`Codex device authorization failed (HTTP ${u.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:B({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function K(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Fe(e){let t=R["xai-oauth"],r=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");K(r.authorization_endpoint);let o=K(r.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=K(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),p=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let u=0;u<p;u+=1){let v=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let U=await A(v,"xAI OAuth token exchange");return H(U,{...e,discovery:{authorization_endpoint:K(r.authorization_endpoint),token_endpoint:o}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function te(e,t={}){let r=_(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Le,output:t.output||(n=>process.stdout.write(`${n}
+`,{mode:384}),g.renameSync(r,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ue(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function D(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function C(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function je(e={}){let t=e.file||k.join(b(),"oauth.json"),r=e.metadataFile||k.join(k.dirname(t),"oauth-meta.json"),o=e.linksFile||k.join(k.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Pe,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ue(i),l=s?"linux-secret-service":"private-file",u=`${t}.lock`;async function v(f){Q(k.dirname(u));let p;for(let c=0;c<400;c+=1)try{p=g.openSync(u,"wx",384);break}catch(a){if(a?.code!=="EEXIST")throw a;try{Date.now()-g.statSync(u).mtimeMs>3e5&&g.unlinkSync(u)}catch{}await new Promise(d=>setTimeout(d,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(u)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function U(f){if(!g.existsSync(o))return null;let c=m(o,{providers:{}}).providers?.[f];if(!Array.isArray(c))return null;let a=[];for(let d of c)if(k.isAbsolute(String(d||"")))try{let h=m(d,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let S=C(h.claudeAiOauth);a.push({...S,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let S=y[f]||y[f.replace(/-oauth$/,"")]||[],ue=Array.isArray(S)?S:S?[S]:[];for(let z of ue)if(!(!z||typeof z!="object"))try{let de=C(z);a.push({...de,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return a.length?a.find(d=>!d.expiresAt||d.expiresAt>n()+Ce)||a[0]:null}function W(f){let p=_(f);if(s){let d=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!d.error&&d.status===0&&String(d.stdout||"").trim())try{return C(JSON.parse(String(d.stdout).trim()))}catch{}return U(p)}let a=m(t,{providers:{}}).providers?.[p];if(a)try{return C(a)}catch{}return U(p)}function ne(f,p){let c=_(f),a=C(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} OAuth`,...w(c)],{input:JSON.stringify(a),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(r,{providers:{}});return y.providers||={},y.providers[c]={expiresAt:a.expiresAt,source:a.source},x(r,y),a}let d=m(t,{providers:{}});return d.providers||={},d.providers[c]=a,x(t,d),a}function ie(f){let p=_(f);if(s){let d=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{}});return h.providers&&delete h.providers[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{}}),a=!!c.providers?.[p];return c.providers&&delete c.providers[p],x(t,c),a}function V(f){let p=D(f);if(s){let c=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return c.error||c.status!==0?"":String(c.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function se(f,p){let c=D(f),a=String(p||"").trim();if(!a)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} API key`,...w(c,"api-key")],{input:a,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(r,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[c]={configured:!0},x(r,y),!0}let d=m(t,{providers:{},apiKeys:{}});return d.apiKeys||={},d.apiKeys[c]=a,x(t,d),!0}function ce(f){let p=D(f);if(s){let d=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{},apiKeys:{}}),a=!!c.apiKeys?.[p];return c.apiKeys&&delete c.apiKeys[p],x(t,c),a}function ae(){let f={},p={};if(s){let c=m(r,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!W(a),expiresAt:Number(d.expiresAt||0),source:String(d.source||"oracle"),storage:l};for(let a of Object.keys(c.apiKeys||{}))p[a]={configured:!!V(a),storage:l}}else{let c=m(t,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!d?.accessToken,expiresAt:Number(d?.expiresAt||0),source:String(d?.source||"oracle"),storage:l};for(let[a,d]of Object.entries(c.apiKeys||{}))p[a]={configured:!!d,storage:l}}for(let c of Object.keys(R)){if(f[c])continue;let a=U(c);a&&(f[c]={loggedIn:!0,expiresAt:a.expiresAt,source:a.source,storage:"external-access-source"})}return{storage:l,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:l,get:W,set:ne,remove:ie,getApiKey:V,setApiKey:se,removeApiKey:ce,status:ae,withLock:v})}var G;function ee(){return G||=je(),G}function M(e){return Buffer.from(e).toString("base64url")}function $e(){let e=M(N(32));return{verifier:e,challenge:M(Se("sha256").update(e).digest()),state:M(N(24))}}function Ie(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&Ee(r,o)}function Le(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return be(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function B(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function Te(e){if(e)return String(await e()).trim();let t=Oe.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return C({accessToken:r,refreshToken:o,expiresAt:Re(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ke(e){let t=R["anthropic-oauth"],r=e.pkce||$e(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let i=await Te(e.inputFn),[s,l]=i.split("#",2);if(!s||!Ie(l,r.state))throw new Error("Claude OAuth state mismatch");let u=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:l,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return H(await A(u,"Claude OAuth token exchange"),e)}async function ze(e){let t=R["openai-codex"],r=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),i;for(let l=0;l<Math.ceil(900/n);l+=1){await e.sleepFn(n*1e3);let u=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(u.ok){i=await A(u,"Codex device authorization");break}if(![403,404].includes(u.status))throw new Error(`Codex device authorization failed (HTTP ${u.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:B({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function K(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Fe(e){let t=R["xai-oauth"],r=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");K(r.authorization_endpoint);let o=K(r.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=K(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),l=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let u=0;u<l;u+=1){let v=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let U=await A(v,"xAI OAuth token exchange");return H(U,{...e,discovery:{authorization_endpoint:K(r.authorization_endpoint),token_endpoint:o}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function te(e,t={}){let r=_(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Le,output:t.output||(n=>process.stdout.write(`${n}
 `)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?Ke(o):r==="openai-codex"?ze(o):Fe(o)}var re=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function q(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function De(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function Me(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
-`)},i=s=>{let p=String(s);for(let u of p){if(u==="\r"||u===`
+`)},i=s=>{let l=String(s);for(let u of l){if(u==="\r"||u===`
 `){n(),t(o.trim());return}if(u===""){n(),r(new Error("cancelled"));return}u==="\x7F"||u==="\b"?o=o.slice(0,-1):o+=u}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function J(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function oe(e,t,r={}){return Z(J(e,t,r))}function Ne(e){process.stdout.write(`storage: ${e.storage}
 `);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
 `);return}for(let[o,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
 `)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
 `)}function Be(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var lt={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Be(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=ee();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):Ne(n),0}if(r==="login"){let n=t.find(u=>!u.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=Y(n),s=q(t,"--model")||i.model;J(i.id,s);let p=await te(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let u=o.get(i.id);o.set(i.id,p);try{oe(i.id,s)}catch(v){throw u?o.set(i.id,u):o.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${o.storage}
-`),0}if(r==="api-key"){let n=String(t.find(u=>!u.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(re,n))throw new Error(`unsupported API-key provider: ${n}`);let i=q(t,"--model")||re[n].model,s=q(t,"--base-url");J(n,i,{baseUrl:s});let p=t.includes("--stdin")?await De():await Me();return await o.withLock(async()=>{let u=o.getApiKey(n);o.setApiKey(n,p);try{oe(n,i,{baseUrl:s})}catch(v){throw u?o.setApiKey(n,u):o.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${o.storage}
-`),0}if(r==="logout"){let n=String(t.find(p=>!p.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=o.remove(_(n))}catch{}let s=o.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`)}var pt={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Be(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=ee();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):Ne(n),0}if(r==="login"){let n=t.find(u=>!u.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=Y(n),s=q(t,"--model")||i.model;J(i.id,s);let l=await te(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let u=o.get(i.id);o.set(i.id,l);try{oe(i.id,s)}catch(v){throw u?o.set(i.id,u):o.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${o.storage}
+`),0}if(r==="api-key"){let n=String(t.find(u=>!u.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(re,n))throw new Error(`unsupported API-key provider: ${n}`);let i=q(t,"--model")||re[n].model,s=q(t,"--base-url");J(n,i,{baseUrl:s});let l=t.includes("--stdin")?await De():await Me();return await o.withLock(async()=>{let u=o.getApiKey(n);o.setApiKey(n,l);try{oe(n,i,{baseUrl:s})}catch(v){throw u?o.setApiKey(n,u):o.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${o.storage}
+`),0}if(r==="logout"){let n=String(t.find(l=>!l.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=o.remove(_(n))}catch{}let s=o.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
 `),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};export{lt as default};
+`),1}}};export{pt as default};