@oracle-agent/oracle 0.35.31 → 0.35.34

package/dist/cli/commands/auth.mjs

@@ -1,16 +1,17 @@
-import T from"node:fs";import F from"node:path";import j from"node:fs";import le from"node:os";import O from"node:path";import{fileURLToPath as pe}from"node:url";var fe=O.dirname(pe(import.meta.url)),Ve=O.resolve(fe,"../..");function X(){return process.env.ORACLE_FAKE_HOME||le.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function b(){return he()?process.env.ORACLE_CONFIG_DIR||O.join(X(),".config","oracle"):O.join(X(),".config","oracle")}function me(){return O.join(b(),"desk.json")}function we(){return O.join(b(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let t={},r=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=we();if(j.existsSync(n))for(let i of j.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let l=s[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),r(s[1],l)}}catch{}try{let n=me();if(j.existsSync(n)){let i=JSON.parse(j.readFileSync(n,"utf8"));i&&typeof i=="object"&&(r("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),r("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),r("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),r("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),r("ORACLE_EXEC_URL",i.execUrl),r("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),E._result=Object.keys(t).length?t:null,E._result}try{E()}catch{}function $(e){return j.mkdirSync(e,{recursive:!0}),e}var ge=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function ye(e,{required:t=!1}={}){let r=I(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!ge.has(r))throw new Error(`unsupported provider: ${r}`);return r}function ve(e,{required:t=!1}={}){let r=I(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function ke(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=ye(e),i=ve(t,{required:o});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:ke(r)};if(I(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var xe=new Set(["auto","standalone","hermes","remote","arch"]);function _e(){return F.join(b(),"model.json")}function P(e){return String(e||"").trim()||void 0}function Ae(e={}){let t=P(e.backend)?.toLowerCase()||"auto",r=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=P(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=P(e.reasoningEffort),s=P(e.computeHost||e.remoteHost),l=P(e.computeUser||e.remoteUser),u=P(e.computePath||e.remotePath);if(!xe.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...l?{computeUser:l}:{},...u?{computePath:u}:{}}}function Z(e){let t=Ae(e),r=_e();$(F.dirname(r)),process.platform!=="win32"&&T.chmodSync(F.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return T.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),T.renameSync(o,r),process.platform!=="win32"&&T.chmodSync(r,384),t}import{createHash as Se,randomBytes as N,timingSafeEqual as Ee}from"node:crypto";import g from"node:fs";import k from"node:path";import Oe from"node:readline/promises";import{spawn as be,spawnSync as Pe}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),Ce=12e4;function Re(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(R))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function Y(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let r=JSON.parse(g.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${k.basename(e)}`)}}function Q(e){$(e),process.platform!=="win32"&&g.chmodSync(e,448)}function x(e,t){Q(k.dirname(e));let r=`${e}.${process.pid}.${N(4).toString("hex")}.tmp`;g.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),g.renameSync(r,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ue(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function D(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function C(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function je(e={}){let t=e.file||k.join(b(),"oauth.json"),r=e.metadataFile||k.join(k.dirname(t),"oauth-meta.json"),o=e.linksFile||k.join(k.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Pe,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ue(i),l=s?"linux-secret-service":"private-file",u=`${t}.lock`;async function v(f){Q(k.dirname(u));let p;for(let c=0;c<400;c+=1)try{p=g.openSync(u,"wx",384);break}catch(a){if(a?.code!=="EEXIST")throw a;try{Date.now()-g.statSync(u).mtimeMs>3e5&&g.unlinkSync(u)}catch{}await new Promise(d=>setTimeout(d,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(u)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function U(f){if(!g.existsSync(o))return null;let c=m(o,{providers:{}}).providers?.[f];if(!Array.isArray(c))return null;let a=[];for(let d of c)if(k.isAbsolute(String(d||"")))try{let h=m(d,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let S=C(h.claudeAiOauth);a.push({...S,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let S=y[f]||y[f.replace(/-oauth$/,"")]||[],ue=Array.isArray(S)?S:S?[S]:[];for(let z of ue)if(!(!z||typeof z!="object"))try{let de=C(z);a.push({...de,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return a.length?a.find(d=>!d.expiresAt||d.expiresAt>n()+Ce)||a[0]:null}function W(f){let p=_(f);if(s){let d=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!d.error&&d.status===0&&String(d.stdout||"").trim())try{return C(JSON.parse(String(d.stdout).trim()))}catch{}return U(p)}let a=m(t,{providers:{}}).providers?.[p];if(a)try{return C(a)}catch{}return U(p)}function ne(f,p){let c=_(f),a=C(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} OAuth`,...w(c)],{input:JSON.stringify(a),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(r,{providers:{}});return y.providers||={},y.providers[c]={expiresAt:a.expiresAt,source:a.source},x(r,y),a}let d=m(t,{providers:{}});return d.providers||={},d.providers[c]=a,x(t,d),a}function ie(f){let p=_(f);if(s){let d=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{}});return h.providers&&delete h.providers[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{}}),a=!!c.providers?.[p];return c.providers&&delete c.providers[p],x(t,c),a}function V(f){let p=D(f);if(s){let c=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return c.error||c.status!==0?"":String(c.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function se(f,p){let c=D(f),a=String(p||"").trim();if(!a)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} API key`,...w(c,"api-key")],{input:a,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(r,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[c]={configured:!0},x(r,y),!0}let d=m(t,{providers:{},apiKeys:{}});return d.apiKeys||={},d.apiKeys[c]=a,x(t,d),!0}function ce(f){let p=D(f);if(s){let d=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{},apiKeys:{}}),a=!!c.apiKeys?.[p];return c.apiKeys&&delete c.apiKeys[p],x(t,c),a}function ae(){let f={},p={};if(s){let c=m(r,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!W(a),expiresAt:Number(d.expiresAt||0),source:String(d.source||"oracle"),storage:l};for(let a of Object.keys(c.apiKeys||{}))p[a]={configured:!!V(a),storage:l}}else{let c=m(t,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!d?.accessToken,expiresAt:Number(d?.expiresAt||0),source:String(d?.source||"oracle"),storage:l};for(let[a,d]of Object.entries(c.apiKeys||{}))p[a]={configured:!!d,storage:l}}for(let c of Object.keys(R)){if(f[c])continue;let a=U(c);a&&(f[c]={loggedIn:!0,expiresAt:a.expiresAt,source:a.source,storage:"external-access-source"})}return{storage:l,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:l,get:W,set:ne,remove:ie,getApiKey:V,setApiKey:se,removeApiKey:ce,status:ae,withLock:v})}var G;function ee(){return G||=je(),G}function M(e){return Buffer.from(e).toString("base64url")}function $e(){let e=M(N(32));return{verifier:e,challenge:M(Se("sha256").update(e).digest()),state:M(N(24))}}function Ie(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&Ee(r,o)}function Le(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return be(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function B(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function Te(e){if(e)return String(await e()).trim();let t=Oe.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return C({accessToken:r,refreshToken:o,expiresAt:Re(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ke(e){let t=R["anthropic-oauth"],r=e.pkce||$e(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let i=await Te(e.inputFn),[s,l]=i.split("#",2);if(!s||!Ie(l,r.state))throw new Error("Claude OAuth state mismatch");let u=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:l,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return H(await A(u,"Claude OAuth token exchange"),e)}async function ze(e){let t=R["openai-codex"],r=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),i;for(let l=0;l<Math.ceil(900/n);l+=1){await e.sleepFn(n*1e3);let u=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(u.ok){i=await A(u,"Codex device authorization");break}if(![403,404].includes(u.status))throw new Error(`Codex device authorization failed (HTTP ${u.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:B({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function K(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Fe(e){let t=R["xai-oauth"],r=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");K(r.authorization_endpoint);let o=K(r.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=K(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),l=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let u=0;u<l;u+=1){let v=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let U=await A(v,"xAI OAuth token exchange");return H(U,{...e,discovery:{authorization_endpoint:K(r.authorization_endpoint),token_endpoint:o}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function te(e,t={}){let r=_(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Le,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?Ke(o):r==="openai-codex"?ze(o):Fe(o)}var re=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function q(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function De(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function Me(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
-`)},i=s=>{let l=String(s);for(let u of l){if(u==="\r"||u===`
-`){n(),t(o.trim());return}if(u===""){n(),r(new Error("cancelled"));return}u==="\x7F"||u==="\b"?o=o.slice(0,-1):o+=u}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function J(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function oe(e,t,r={}){return Z(J(e,t,r))}function Ne(e){process.stdout.write(`storage: ${e.storage}
-`);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
-`);return}for(let[o,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
-`)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
-`)}function Be(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var pt={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Be(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=ee();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):Ne(n),0}if(r==="login"){let n=t.find(u=>!u.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=Y(n),s=q(t,"--model")||i.model;J(i.id,s);let l=await te(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let u=o.get(i.id);o.set(i.id,l);try{oe(i.id,s)}catch(v){throw u?o.set(i.id,u):o.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${o.storage}
-`),0}if(r==="api-key"){let n=String(t.find(u=>!u.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(re,n))throw new Error(`unsupported API-key provider: ${n}`);let i=q(t,"--model")||re[n].model,s=q(t,"--base-url");J(n,i,{baseUrl:s});let l=t.includes("--stdin")?await De():await Me();return await o.withLock(async()=>{let u=o.getApiKey(n);o.setApiKey(n,l);try{oe(n,i,{baseUrl:s})}catch(v){throw u?o.setApiKey(n,u):o.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${o.storage}
-`),0}if(r==="logout"){let n=String(t.find(l=>!l.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=o.remove(_(n))}catch{}let s=o.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
-`),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};export{pt as default};
+var ve=Object.defineProperty;var xe=(e,t,o)=>()=>{if(o)throw o[0];try{return e&&(t=e(e=0)),t}catch(r){throw o=[r],r}};var ke=(e,t)=>{for(var o in t)ve(e,o,{get:t[o],enumerable:!0})};var ce={};ke(ce,{OAUTH_USAGE_PROVIDERS:()=>Ze,collectOAuthUsage:()=>Qe,parseAnthropicUsage:()=>se,parseCodexUsage:()=>ae});function ie(e){let t=Number(e);return Number.isFinite(t)?t:null}function Ye(e){let t=ie(e);if(t==null)return null;let o=t<=1?t*100:t;return Math.max(0,Math.min(100,o))}function se(e){let t=[["five_hour","5h"],["seven_day","7d"],["seven_day_opus","Opus 7d"],["seven_day_sonnet","Sonnet 7d"]],o=[];for(let[r,n]of t){let i=e?.[r]||{},s=Ye(i.utilization);s!=null&&o.push({label:n,usedPercent:s,resetAt:i.resets_at||i.reset_at||null})}return{source:"oauth_usage_api",windows:o}}function ae(e){let t=e?.rate_limit||{},o=[["primary_window","5h"],["secondary_window","wk"]],r=[];for(let[n,i]of o){let s=t[n]||{},c=ie(s.used_percent);c!=null&&r.push({label:i,usedPercent:Math.max(0,Math.min(100,c)),resetAt:s.reset_at||s.resets_at||null})}return{source:"usage_api",windows:r}}function S({id:e,label:t,connected:o,windows:r=[],unavailable:n=null}){let i=r[0]||null;return{id:e,label:t,connected:o,usedPercent:i?i.usedPercent:null,windowLabel:i?i.label:null,resetAt:i?i.resetAt:null,windows:r,unavailable:n}}function J(e,t){try{return String(e?.get?.(t)?.accessToken||"").trim()}catch{return""}}async function ne(e,t,o){let r=await e(t,{headers:o});if(!r?.ok)throw new Error(`HTTP ${r?.status||0}`);return r.json()}async function Qe(e,{fetchFn:t=globalThis.fetch}={}){let o=new Date().toISOString(),r=[],n=J(e,"anthropic-oauth");if(!n)r.push(S({id:"anthropic-oauth",label:"Claude",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://api.anthropic.com/api/oauth/usage",{Authorization:`Bearer ${n}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":"claude-code/2.1.0"}),a=se(c);r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,unavailable:"quota unavailable"}))}let i=J(e,"openai-codex");if(!i)r.push(S({id:"openai-codex",label:"Codex",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://chatgpt.com/backend-api/wham/usage",{Authorization:`Bearer ${i}`,Accept:"application/json","User-Agent":"codex-cli"}),a=ae(c);r.push(S({id:"openai-codex",label:"Codex",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"openai-codex",label:"Codex",connected:!0,unavailable:"quota unavailable"}))}let s=J(e,"xai-oauth");return r.push(S({id:"xai-oauth",label:"Grok",connected:!!s,unavailable:s?"quota not published":"not connected"})),{fetchedAt:o,providers:r}}var Ze,ue=xe(()=>{Ze=Object.freeze([{id:"anthropic-oauth",label:"Claude"},{id:"openai-codex",label:"Codex"},{id:"xai-oauth",label:"Grok"}])});import z from"node:fs";import D from"node:path";import $ from"node:fs";import _e from"node:os";import E from"node:path";import{fileURLToPath as Ae}from"node:url";var Se=E.dirname(Ae(import.meta.url)),ut=E.resolve(Se,"../..");function Z(){return process.env.ORACLE_FAKE_HOME||_e.homedir()}function be(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function P(){return be()?process.env.ORACLE_CONFIG_DIR||E.join(Z(),".config","oracle"):E.join(Z(),".config","oracle")}function Oe(){return E.join(P(),"desk.json")}function Ee(){return E.join(P(),"env")}function O({force:e=!1}={}){if(O._done&&!e)return O._result||null;O._done=!0;let t={},o=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=Ee();if($.existsSync(n))for(let i of $.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),o(s[1],c)}}catch{}try{let n=Oe();if($.existsSync(n)){let i=JSON.parse($.readFileSync(n,"utf8"));i&&typeof i=="object"&&(o("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),o("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),o("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),o("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),o("ORACLE_EXEC_URL",i.execUrl),o("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(o("ORACLE_DESK_URL",r),o("ORACLE_DATA_URL",r),o("ORACLE_API_URL",r),o("ORACLE_PUBLIC_URL",r),o("MAD_DESK_URL",r)),O._result=Object.keys(t).length?t:null,O._result}try{O()}catch{}function T(e){return $.mkdirSync(e,{recursive:!0}),e}var Pe=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function Ce(e,{required:t=!1}={}){let o=I(e)?.toLowerCase();if(!o){if(t)throw new Error("model provider is required");return}if(!Pe.has(o))throw new Error(`unsupported provider: ${o}`);return o}function Ue(e,{required:t=!1}={}){let o=I(e);if(!o){if(t)throw new Error("model is required");return}if(o.includes("..")||o.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(o))throw new Error("invalid model id");return o}function Re(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let o;try{o=new URL(t)}catch{throw new Error("invalid custom base URL")}let r=o.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=r==="localhost"||r==="127.0.0.1"||r==="::1";if(o.protocol!=="https:"&&!(o.protocol==="http:"&&n)||o.username||o.password||o.search||o.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return o.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:o}={},{requireModel:r=!1}={}){let n=Ce(e),i=Ue(t,{required:r});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:Re(o)};if(I(o))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var je=new Set(["auto","standalone","hermes","remote","arch"]);function $e(){return D.join(P(),"model.json")}function C(e){return String(e||"").trim()||void 0}function Te(e={}){let t=C(e.backend)?.toLowerCase()||"auto",o=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),r=C(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=C(e.reasoningEffort),s=C(e.computeHost||e.remoteHost),c=C(e.computeUser||e.remoteUser),a=C(e.computePath||e.remotePath);if(!je.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(r&&!/^[A-Z][A-Z0-9_]*$/.test(r))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...o,...r?{apiKeyEnv:r}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...c?{computeUser:c}:{},...a?{computePath:a}:{}}}function Y(e){let t=Te(e),o=$e();T(D.dirname(o)),process.platform!=="win32"&&z.chmodSync(D.dirname(o),448);let r=`${o}.${process.pid}.tmp`;return z.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),z.renameSync(r,o),process.platform!=="win32"&&z.chmodSync(o,384),t}import{createHash as Ie,randomBytes as B,timingSafeEqual as Le}from"node:crypto";import g from"node:fs";import x from"node:path";import ze from"node:readline/promises";import{spawn as Fe,spawnSync as Ke}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),De=12e4;function Me(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[o,r]of Object.entries(R))if(r.aliases.includes(t))return o;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function ee(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let o=JSON.parse(g.readFileSync(e,"utf8"));if(!o||typeof o!="object"||Array.isArray(o))throw new Error("invalid object");return o}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function te(e){T(e),process.platform!=="win32"&&g.chmodSync(e,448)}function k(e,t){te(x.dirname(e));let o=`${e}.${process.pid}.${B(4).toString("hex")}.tmp`;g.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),g.renameSync(o,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ne(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function M(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function U(e={}){let t=String(e.accessToken||e.access_token||"").trim(),o=String(e.refreshToken||e.refresh_token||"").trim(),r=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(r)&&r>=1e9&&r<1e12&&(r=r*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:o,expiresAt:Number.isFinite(r)?r:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function Be(e={}){let t=e.file||x.join(P(),"oauth.json"),o=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),r=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Ke,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ne(i),c=s?"linux-secret-service":"private-file",a=`${t}.lock`;async function v(f){te(x.dirname(a));let p;for(let u=0;u<400;u+=1)try{p=g.openSync(a,"wx",384);break}catch(d){if(d?.code!=="EEXIST")throw d;try{Date.now()-g.statSync(a).mtimeMs>3e5&&g.unlinkSync(a)}catch{}await new Promise(l=>setTimeout(l,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(a)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function j(f){if(!g.existsSync(r))return null;let u=m(r,{providers:{}}).providers?.[f];if(!Array.isArray(u))return null;let d=[];for(let l of u)if(x.isAbsolute(String(l||"")))try{let h=m(l,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let b=U(h.claudeAiOauth);d.push({...b,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let b=y[f]||y[f.replace(/-oauth$/,"")]||[],ge=Array.isArray(b)?b:b?[b]:[];for(let K of ge)if(!(!K||typeof K!="object"))try{let ye=U(K);d.push({...ye,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return d.length?d.find(l=>!l.expiresAt||l.expiresAt>n()+De)||d[0]:null}function G(f){let p=_(f);if(s){let l=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!l.error&&l.status===0&&String(l.stdout||"").trim())try{return U(JSON.parse(String(l.stdout).trim()))}catch{}return j(p)}let d=m(t,{providers:{}}).providers?.[p];if(d)try{return U(d)}catch{}return j(p)}function pe(f,p){let u=_(f),d=U(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} OAuth`,...w(u)],{input:JSON.stringify(d),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(o,{providers:{}});return y.providers||={},y.providers[u]={expiresAt:d.expiresAt,source:d.source},k(o,y),d}let l=m(t,{providers:{}});return l.providers||={},l.providers[u]=d,k(t,l),d}function fe(f){let p=_(f);if(s){let l=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{}});return h.providers&&delete h.providers[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{}}),d=!!u.providers?.[p];return u.providers&&delete u.providers[p],k(t,u),d}function X(f){let p=M(f);if(s){let u=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function he(f,p){let u=M(f),d=String(p||"").trim();if(!d)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} API key`,...w(u,"api-key")],{input:d,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(o,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[u]={configured:!0},k(o,y),!0}let l=m(t,{providers:{},apiKeys:{}});return l.apiKeys||={},l.apiKeys[u]=d,k(t,l),!0}function me(f){let p=M(f);if(s){let l=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{},apiKeys:{}}),d=!!u.apiKeys?.[p];return u.apiKeys&&delete u.apiKeys[p],k(t,u),d}function we(){let f={},p={};if(s){let u=m(o,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!G(d),expiresAt:Number(l.expiresAt||0),source:String(l.source||"oracle"),storage:c};for(let d of Object.keys(u.apiKeys||{}))p[d]={configured:!!X(d),storage:c}}else{let u=m(t,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!l?.accessToken,expiresAt:Number(l?.expiresAt||0),source:String(l?.source||"oracle"),storage:c};for(let[d,l]of Object.entries(u.apiKeys||{}))p[d]={configured:!!l,storage:c}}for(let u of Object.keys(R)){if(f[u])continue;let d=j(u);d&&(f[u]={loggedIn:!0,expiresAt:d.expiresAt,source:d.source,storage:"external-access-source"})}return{storage:c,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:c,get:G,set:pe,remove:fe,getApiKey:X,setApiKey:he,removeApiKey:me,status:we,withLock:v})}var Q;function oe(){return Q||=Be(),Q}function N(e){return Buffer.from(e).toString("base64url")}function qe(){let e=N(B(32));return{verifier:e,challenge:N(Ie("sha256").update(e).digest()),state:N(B(24))}}function He(e,t){let o=Buffer.from(String(e||"")),r=Buffer.from(String(t||""));return o.length===r.length&&Le(o,r)}function Je(e){let t=String(e),o=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return Fe(o[0],o[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function q(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let r="";try{r=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${r?`, ${r}`:""})`)}let o=await e.json();if(!o||typeof o!="object")throw new Error(`${t} returned invalid JSON`);return o}async function We(e){if(e)return String(await e()).trim();let t=ze.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let o=String(e.access_token||"").trim(),r=String(e.refresh_token||t.refreshToken||"").trim();if(!o)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return U({accessToken:o,refreshToken:r,expiresAt:Me(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ve(e){let t=R["anthropic-oauth"],o=e.pkce||qe(),r=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:o.challenge,code_challenge_method:"S256",state:o.state}),n=`${t.authorizeUrl}?${r}`;e.output(`Open: ${n}`),e.openFn(n);let i=await We(e.inputFn),[s,c]=i.split("#",2);if(!s||!He(c,o.state))throw new Error("Claude OAuth state mismatch");let a=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:c,redirect_uri:t.redirectUri,code_verifier:o.verifier})});return H(await A(a,"Claude OAuth token exchange"),e)}async function Ge(e){let t=R["openai-codex"],o=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!o.user_code||!o.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let r=`${t.issuer}/codex/device`;e.output(`Open: ${r}`),e.output(`Code: ${o.user_code}`),e.openFn(r);let n=Math.max(3,Number(o.interval||5)),i;for(let c=0;c<Math.ceil(900/n);c+=1){await e.sleepFn(n*1e3);let a=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:o.device_auth_id,user_code:o.user_code})});if(a.ok){i=await A(a,"Codex device authorization");break}if(![403,404].includes(a.status))throw new Error(`Codex device authorization failed (HTTP ${a.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:q({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function F(e){let t=new URL(String(e)),o=t.hostname.toLowerCase();if(t.protocol!=="https:"||o!=="x.ai"&&!o.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Xe(e){let t=R["xai-oauth"],o=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");F(o.authorization_endpoint);let r=F(o.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=F(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),c=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let a=0;a<c;a+=1){let v=await e.fetchFn(r,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let j=await A(v,"xAI OAuth token exchange");return H(j,{...e,discovery:{authorization_endpoint:F(o.authorization_endpoint),token_endpoint:r}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function re(e,t={}){let o=_(e),r={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Je,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return o==="anthropic-oauth"?Ve(r):o==="openai-codex"?Ge(r):Xe(r)}var de=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function W(e,t){let o=e.indexOf(t);return o>=0&&e[o+1]?e[o+1]:""}async function et(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function tt(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,o)=>{let r="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`)},i=s=>{let c=String(s);for(let a of c){if(a==="\r"||a===`
+`){n(),t(r.trim());return}if(a===""){n(),o(new Error("cancelled"));return}a==="\x7F"||a==="\b"?r=r.slice(0,-1):r+=a}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function V(e,t,{baseUrl:o=""}={}){if(e==="custom"&&!String(o||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:o},{requireModel:!0})}}function le(e,t,o={}){return Y(V(e,t,o))}function ot(e){process.stdout.write(`storage: ${e.storage}
+`);let t=Object.entries(e.providers||{}),o=Object.entries(e.apiKeys||{});if(!t.length&&!o.length){process.stdout.write(`no credentials configured
+`);return}for(let[r,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${r}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
+`)}for(let[r,n]of o)process.stdout.write(`${r}: API key ${n.configured?"configured":"missing"}
+`)}function rt(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth usage [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
+`)}var Et={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:rt(),async run(e){let t=[...e.argv],o=t.shift()||"status",r=oe();try{if(o==="status"){let n=r.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):ot(n),0}if(o==="usage"){let{collectOAuthUsage:n}=await Promise.resolve().then(()=>(ue(),ce)),i=await n(r);return process.stdout.write(`${JSON.stringify(i)}
+`),0}if(o==="login"){let n=t.find(a=>!a.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=ee(n),s=W(t,"--model")||i.model;V(i.id,s);let c=await re(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await r.withLock(async()=>{let a=r.get(i.id);r.set(i.id,c);try{le(i.id,s)}catch(v){throw a?r.set(i.id,a):r.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${r.storage}
+`),0}if(o==="api-key"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(de,n))throw new Error(`unsupported API-key provider: ${n}`);let i=W(t,"--model")||de[n].model,s=W(t,"--base-url");V(n,i,{baseUrl:s});let c=t.includes("--stdin")?await et():await tt();return await r.withLock(async()=>{let a=r.getApiKey(n);r.setApiKey(n,c);try{le(n,i,{baseUrl:s})}catch(v){throw a?r.setApiKey(n,a):r.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${r.storage}
+`),0}if(o==="logout"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=r.remove(_(n))}catch{}let s=r.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`),0}throw new Error(`unknown auth action: ${o}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
+`),1}}};export{Et as default};