@oracle-agent/oracle 0.35.38 → 0.35.39

package/dist/cli/commands/auth.mjs

@@ -1,17 +1,20 @@
-var ve=Object.defineProperty;var xe=(e,t,o)=>()=>{if(o)throw o[0];try{return e&&(t=e(e=0)),t}catch(r){throw o=[r],r}};var ke=(e,t)=>{for(var o in t)ve(e,o,{get:t[o],enumerable:!0})};var ce={};ke(ce,{OAUTH_USAGE_PROVIDERS:()=>Ze,collectOAuthUsage:()=>Qe,parseAnthropicUsage:()=>se,parseCodexUsage:()=>ae});function ie(e){let t=Number(e);return Number.isFinite(t)?t:null}function Ye(e){let t=ie(e);if(t==null)return null;let o=t<=1?t*100:t;return Math.max(0,Math.min(100,o))}function se(e){let t=[["five_hour","5h"],["seven_day","7d"],["seven_day_opus","Opus 7d"],["seven_day_sonnet","Sonnet 7d"]],o=[];for(let[r,n]of t){let i=e?.[r]||{},s=Ye(i.utilization);s!=null&&o.push({label:n,usedPercent:s,resetAt:i.resets_at||i.reset_at||null})}return{source:"oauth_usage_api",windows:o}}function ae(e){let t=e?.rate_limit||{},o=[["primary_window","5h"],["secondary_window","wk"]],r=[];for(let[n,i]of o){let s=t[n]||{},c=ie(s.used_percent);c!=null&&r.push({label:i,usedPercent:Math.max(0,Math.min(100,c)),resetAt:s.reset_at||s.resets_at||null})}return{source:"usage_api",windows:r}}function S({id:e,label:t,connected:o,windows:r=[],unavailable:n=null}){let i=r[0]||null;return{id:e,label:t,connected:o,usedPercent:i?i.usedPercent:null,windowLabel:i?i.label:null,resetAt:i?i.resetAt:null,windows:r,unavailable:n}}function J(e,t){try{return String(e?.get?.(t)?.accessToken||"").trim()}catch{return""}}async function ne(e,t,o){let r=await e(t,{headers:o});if(!r?.ok)throw new Error(`HTTP ${r?.status||0}`);return r.json()}async function Qe(e,{fetchFn:t=globalThis.fetch}={}){let o=new Date().toISOString(),r=[],n=J(e,"anthropic-oauth");if(!n)r.push(S({id:"anthropic-oauth",label:"Claude",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://api.anthropic.com/api/oauth/usage",{Authorization:`Bearer ${n}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":"claude-code/2.1.0"}),a=se(c);r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,unavailable:"quota unavailable"}))}let i=J(e,"openai-codex");if(!i)r.push(S({id:"openai-codex",label:"Codex",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://chatgpt.com/backend-api/wham/usage",{Authorization:`Bearer ${i}`,Accept:"application/json","User-Agent":"codex-cli"}),a=ae(c);r.push(S({id:"openai-codex",label:"Codex",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"openai-codex",label:"Codex",connected:!0,unavailable:"quota unavailable"}))}let s=J(e,"xai-oauth");return r.push(S({id:"xai-oauth",label:"Grok",connected:!!s,unavailable:s?"quota not published":"not connected"})),{fetchedAt:o,providers:r}}var Ze,ue=xe(()=>{Ze=Object.freeze([{id:"anthropic-oauth",label:"Claude"},{id:"openai-codex",label:"Codex"},{id:"xai-oauth",label:"Grok"}])});import z from"node:fs";import D from"node:path";import $ from"node:fs";import _e from"node:os";import E from"node:path";import{fileURLToPath as Ae}from"node:url";var Se=E.dirname(Ae(import.meta.url)),ut=E.resolve(Se,"../..");function Z(){return process.env.ORACLE_FAKE_HOME||_e.homedir()}function be(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function P(){return be()?process.env.ORACLE_CONFIG_DIR||E.join(Z(),".config","oracle"):E.join(Z(),".config","oracle")}function Oe(){return E.join(P(),"desk.json")}function Ee(){return E.join(P(),"env")}function O({force:e=!1}={}){if(O._done&&!e)return O._result||null;O._done=!0;let t={},o=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=Ee();if($.existsSync(n))for(let i of $.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),o(s[1],c)}}catch{}try{let n=Oe();if($.existsSync(n)){let i=JSON.parse($.readFileSync(n,"utf8"));i&&typeof i=="object"&&(o("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),o("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),o("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),o("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),o("ORACLE_EXEC_URL",i.execUrl),o("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(o("ORACLE_DESK_URL",r),o("ORACLE_DATA_URL",r),o("ORACLE_API_URL",r),o("ORACLE_PUBLIC_URL",r),o("MAD_DESK_URL",r)),O._result=Object.keys(t).length?t:null,O._result}try{O()}catch{}function T(e){return $.mkdirSync(e,{recursive:!0}),e}var Pe=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function Ce(e,{required:t=!1}={}){let o=I(e)?.toLowerCase();if(!o){if(t)throw new Error("model provider is required");return}if(!Pe.has(o))throw new Error(`unsupported provider: ${o}`);return o}function Ue(e,{required:t=!1}={}){let o=I(e);if(!o){if(t)throw new Error("model is required");return}if(o.includes("..")||o.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(o))throw new Error("invalid model id");return o}function Re(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let o;try{o=new URL(t)}catch{throw new Error("invalid custom base URL")}let r=o.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=r==="localhost"||r==="127.0.0.1"||r==="::1";if(o.protocol!=="https:"&&!(o.protocol==="http:"&&n)||o.username||o.password||o.search||o.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return o.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:o}={},{requireModel:r=!1}={}){let n=Ce(e),i=Ue(t,{required:r});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:Re(o)};if(I(o))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var je=new Set(["auto","standalone","hermes","remote","arch"]);function $e(){return D.join(P(),"model.json")}function C(e){return String(e||"").trim()||void 0}function Te(e={}){let t=C(e.backend)?.toLowerCase()||"auto",o=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),r=C(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=C(e.reasoningEffort),s=C(e.computeHost||e.remoteHost),c=C(e.computeUser||e.remoteUser),a=C(e.computePath||e.remotePath);if(!je.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(r&&!/^[A-Z][A-Z0-9_]*$/.test(r))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...o,...r?{apiKeyEnv:r}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...c?{computeUser:c}:{},...a?{computePath:a}:{}}}function Y(e){let t=Te(e),o=$e();T(D.dirname(o)),process.platform!=="win32"&&z.chmodSync(D.dirname(o),448);let r=`${o}.${process.pid}.tmp`;return z.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),z.renameSync(r,o),process.platform!=="win32"&&z.chmodSync(o,384),t}import{createHash as Ie,randomBytes as B,timingSafeEqual as Le}from"node:crypto";import g from"node:fs";import x from"node:path";import ze from"node:readline/promises";import{spawn as Fe,spawnSync as Ke}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),De=12e4;function Me(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[o,r]of Object.entries(R))if(r.aliases.includes(t))return o;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function ee(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let o=JSON.parse(g.readFileSync(e,"utf8"));if(!o||typeof o!="object"||Array.isArray(o))throw new Error("invalid object");return o}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function te(e){T(e),process.platform!=="win32"&&g.chmodSync(e,448)}function k(e,t){te(x.dirname(e));let o=`${e}.${process.pid}.${B(4).toString("hex")}.tmp`;g.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),g.renameSync(o,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ne(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function M(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function U(e={}){let t=String(e.accessToken||e.access_token||"").trim(),o=String(e.refreshToken||e.refresh_token||"").trim(),r=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(r)&&r>=1e9&&r<1e12&&(r=r*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:o,expiresAt:Number.isFinite(r)?r:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function Be(e={}){let t=e.file||x.join(P(),"oauth.json"),o=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),r=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Ke,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ne(i),c=s?"linux-secret-service":"private-file",a=`${t}.lock`;async function v(f){te(x.dirname(a));let p;for(let u=0;u<400;u+=1)try{p=g.openSync(a,"wx",384);break}catch(d){if(d?.code!=="EEXIST")throw d;try{Date.now()-g.statSync(a).mtimeMs>3e5&&g.unlinkSync(a)}catch{}await new Promise(l=>setTimeout(l,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(a)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function j(f){if(!g.existsSync(r))return null;let u=m(r,{providers:{}}).providers?.[f];if(!Array.isArray(u))return null;let d=[];for(let l of u)if(x.isAbsolute(String(l||"")))try{let h=m(l,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let b=U(h.claudeAiOauth);d.push({...b,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let b=y[f]||y[f.replace(/-oauth$/,"")]||[],ge=Array.isArray(b)?b:b?[b]:[];for(let K of ge)if(!(!K||typeof K!="object"))try{let ye=U(K);d.push({...ye,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return d.length?d.find(l=>!l.expiresAt||l.expiresAt>n()+De)||d[0]:null}function G(f){let p=_(f);if(s){let l=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!l.error&&l.status===0&&String(l.stdout||"").trim())try{return U(JSON.parse(String(l.stdout).trim()))}catch{}return j(p)}let d=m(t,{providers:{}}).providers?.[p];if(d)try{return U(d)}catch{}return j(p)}function pe(f,p){let u=_(f),d=U(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} OAuth`,...w(u)],{input:JSON.stringify(d),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(o,{providers:{}});return y.providers||={},y.providers[u]={expiresAt:d.expiresAt,source:d.source},k(o,y),d}let l=m(t,{providers:{}});return l.providers||={},l.providers[u]=d,k(t,l),d}function fe(f){let p=_(f);if(s){let l=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{}});return h.providers&&delete h.providers[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{}}),d=!!u.providers?.[p];return u.providers&&delete u.providers[p],k(t,u),d}function X(f){let p=M(f);if(s){let u=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function he(f,p){let u=M(f),d=String(p||"").trim();if(!d)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} API key`,...w(u,"api-key")],{input:d,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(o,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[u]={configured:!0},k(o,y),!0}let l=m(t,{providers:{},apiKeys:{}});return l.apiKeys||={},l.apiKeys[u]=d,k(t,l),!0}function me(f){let p=M(f);if(s){let l=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{},apiKeys:{}}),d=!!u.apiKeys?.[p];return u.apiKeys&&delete u.apiKeys[p],k(t,u),d}function we(){let f={},p={};if(s){let u=m(o,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!G(d),expiresAt:Number(l.expiresAt||0),source:String(l.source||"oracle"),storage:c};for(let d of Object.keys(u.apiKeys||{}))p[d]={configured:!!X(d),storage:c}}else{let u=m(t,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!l?.accessToken,expiresAt:Number(l?.expiresAt||0),source:String(l?.source||"oracle"),storage:c};for(let[d,l]of Object.entries(u.apiKeys||{}))p[d]={configured:!!l,storage:c}}for(let u of Object.keys(R)){if(f[u])continue;let d=j(u);d&&(f[u]={loggedIn:!0,expiresAt:d.expiresAt,source:d.source,storage:"external-access-source"})}return{storage:c,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:c,get:G,set:pe,remove:fe,getApiKey:X,setApiKey:he,removeApiKey:me,status:we,withLock:v})}var Q;function oe(){return Q||=Be(),Q}function N(e){return Buffer.from(e).toString("base64url")}function qe(){let e=N(B(32));return{verifier:e,challenge:N(Ie("sha256").update(e).digest()),state:N(B(24))}}function He(e,t){let o=Buffer.from(String(e||"")),r=Buffer.from(String(t||""));return o.length===r.length&&Le(o,r)}function Je(e){let t=String(e),o=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return Fe(o[0],o[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function q(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let r="";try{r=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${r?`, ${r}`:""})`)}let o=await e.json();if(!o||typeof o!="object")throw new Error(`${t} returned invalid JSON`);return o}async function We(e){if(e)return String(await e()).trim();let t=ze.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let o=String(e.access_token||"").trim(),r=String(e.refresh_token||t.refreshToken||"").trim();if(!o)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return U({accessToken:o,refreshToken:r,expiresAt:Me(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ve(e){let t=R["anthropic-oauth"],o=e.pkce||qe(),r=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:o.challenge,code_challenge_method:"S256",state:o.state}),n=`${t.authorizeUrl}?${r}`;e.output(`Open: ${n}`),e.openFn(n);let i=await We(e.inputFn),[s,c]=i.split("#",2);if(!s||!He(c,o.state))throw new Error("Claude OAuth state mismatch");let a=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:c,redirect_uri:t.redirectUri,code_verifier:o.verifier})});return H(await A(a,"Claude OAuth token exchange"),e)}async function Ge(e){let t=R["openai-codex"],o=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!o.user_code||!o.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let r=`${t.issuer}/codex/device`;e.output(`Open: ${r}`),e.output(`Code: ${o.user_code}`),e.openFn(r);let n=Math.max(3,Number(o.interval||5)),i;for(let c=0;c<Math.ceil(900/n);c+=1){await e.sleepFn(n*1e3);let a=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:o.device_auth_id,user_code:o.user_code})});if(a.ok){i=await A(a,"Codex device authorization");break}if(![403,404].includes(a.status))throw new Error(`Codex device authorization failed (HTTP ${a.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:q({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function F(e){let t=new URL(String(e)),o=t.hostname.toLowerCase();if(t.protocol!=="https:"||o!=="x.ai"&&!o.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Xe(e){let t=R["xai-oauth"],o=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");F(o.authorization_endpoint);let r=F(o.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=F(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),c=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let a=0;a<c;a+=1){let v=await e.fetchFn(r,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let j=await A(v,"xAI OAuth token exchange");return H(j,{...e,discovery:{authorization_endpoint:F(o.authorization_endpoint),token_endpoint:r}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function re(e,t={}){let o=_(e),r={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Je,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return o==="anthropic-oauth"?Ve(r):o==="openai-codex"?Ge(r):Xe(r)}var de=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function W(e,t){let o=e.indexOf(t);return o>=0&&e[o+1]?e[o+1]:""}async function et(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function tt(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,o)=>{let r="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
-`)},i=s=>{let c=String(s);for(let a of c){if(a==="\r"||a===`
-`){n(),t(r.trim());return}if(a===""){n(),o(new Error("cancelled"));return}a==="\x7F"||a==="\b"?r=r.slice(0,-1):r+=a}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function V(e,t,{baseUrl:o=""}={}){if(e==="custom"&&!String(o||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:o},{requireModel:!0})}}function le(e,t,o={}){return Y(V(e,t,o))}function ot(e){process.stdout.write(`storage: ${e.storage}
-`);let t=Object.entries(e.providers||{}),o=Object.entries(e.apiKeys||{});if(!t.length&&!o.length){process.stdout.write(`no credentials configured
-`);return}for(let[r,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${r}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
-`)}for(let[r,n]of o)process.stdout.write(`${r}: API key ${n.configured?"configured":"missing"}
-`)}function rt(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth usage [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var Et={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:rt(),async run(e){let t=[...e.argv],o=t.shift()||"status",r=oe();try{if(o==="status"){let n=r.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):ot(n),0}if(o==="usage"){let{collectOAuthUsage:n}=await Promise.resolve().then(()=>(ue(),ce)),i=await n(r);return process.stdout.write(`${JSON.stringify(i)}
-`),0}if(o==="login"){let n=t.find(a=>!a.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=ee(n),s=W(t,"--model")||i.model;V(i.id,s);let c=await re(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await r.withLock(async()=>{let a=r.get(i.id);r.set(i.id,c);try{le(i.id,s)}catch(v){throw a?r.set(i.id,a):r.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${r.storage}
-`),0}if(o==="api-key"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(de,n))throw new Error(`unsupported API-key provider: ${n}`);let i=W(t,"--model")||de[n].model,s=W(t,"--base-url");V(n,i,{baseUrl:s});let c=t.includes("--stdin")?await et():await tt();return await r.withLock(async()=>{let a=r.getApiKey(n);r.setApiKey(n,c);try{le(n,i,{baseUrl:s})}catch(v){throw a?r.setApiKey(n,a):r.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${r.storage}
-`),0}if(o==="logout"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=r.remove(_(n))}catch{}let s=r.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
-`),0}throw new Error(`unknown auth action: ${o}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};export{Et as default};
+var Ie=Object.defineProperty;var Le=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(o){throw r=[o],o}};var De=(e,t)=>{for(var r in t)Ie(e,r,{get:t[r],enumerable:!0})};var be={};De(be,{OAUTH_USAGE_PROVIDERS:()=>xt,collectOAuthUsage:()=>St,parseAnthropicUsage:()=>Ae,parseCodexUsage:()=>Se});function xe(e){let t=Number(e);return Number.isFinite(t)?t:null}function At(e){let t=xe(e);if(t==null)return null;let r=t<=1?t*100:t;return Math.max(0,Math.min(100,r))}function Ae(e){let t=[["five_hour","5h"],["seven_day","7d"],["seven_day_opus","Opus 7d"],["seven_day_sonnet","Sonnet 7d"]],r=[];for(let[o,n]of t){let i=e?.[o]||{},s=At(i.utilization);s!=null&&r.push({label:n,usedPercent:s,resetAt:i.resets_at||i.reset_at||null})}return{source:"oauth_usage_api",windows:r}}function Se(e){let t=e?.rate_limit||{},r=[["primary_window","5h"],["secondary_window","wk"]],o=[];for(let[n,i]of r){let s=t[n]||{},c=xe(s.used_percent);c!=null&&o.push({label:i,usedPercent:Math.max(0,Math.min(100,c)),resetAt:s.reset_at||s.resets_at||null})}return{source:"usage_api",windows:o}}function P({id:e,label:t,connected:r,windows:o=[],unavailable:n=null}){let i=o[0]||null;return{id:e,label:t,connected:r,usedPercent:i?i.usedPercent:null,windowLabel:i?i.label:null,resetAt:i?i.resetAt:null,windows:o,unavailable:n}}function re(e,t){try{return String(e?.get?.(t)?.accessToken||"").trim()}catch{return""}}async function ke(e,t,r){let o=await e(t,{headers:r});if(!o?.ok)throw new Error(`HTTP ${o?.status||0}`);return o.json()}async function St(e,{fetchFn:t=globalThis.fetch}={}){let r=new Date().toISOString(),o=[],n=re(e,"anthropic-oauth");if(!n)o.push(P({id:"anthropic-oauth",label:"Claude",connected:!1,unavailable:"not connected"}));else try{let c=await ke(t,"https://api.anthropic.com/api/oauth/usage",{Authorization:`Bearer ${n}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":"claude-code/2.1.0"}),u=Ae(c);o.push(P({id:"anthropic-oauth",label:"Claude",connected:!0,windows:u.windows,unavailable:u.windows.length?null:"quota unavailable"}))}catch{o.push(P({id:"anthropic-oauth",label:"Claude",connected:!0,unavailable:"quota unavailable"}))}let i=re(e,"openai-codex");if(!i)o.push(P({id:"openai-codex",label:"Codex",connected:!1,unavailable:"not connected"}));else try{let c=await ke(t,"https://chatgpt.com/backend-api/wham/usage",{Authorization:`Bearer ${i}`,Accept:"application/json","User-Agent":"codex-cli"}),u=Se(c);o.push(P({id:"openai-codex",label:"Codex",connected:!0,windows:u.windows,unavailable:u.windows.length?null:"quota unavailable"}))}catch{o.push(P({id:"openai-codex",label:"Codex",connected:!0,unavailable:"quota unavailable"}))}let s=re(e,"xai-oauth");return o.push(P({id:"xai-oauth",label:"Grok",connected:!!s,unavailable:s?"quota not published":"not connected"})),{fetchedAt:r,providers:o}}var xt,_e=Le(()=>{xt=Object.freeze([{id:"anthropic-oauth",label:"Claude"},{id:"openai-codex",label:"Codex"},{id:"xai-oauth",label:"Grok"}])});import B from"node:fs";import W from"node:path";import L from"node:fs";import Fe from"node:os";import R from"node:path";import{fileURLToPath as ze}from"node:url";var Ke=R.dirname(ze(import.meta.url)),$t=R.resolve(Ke,"../..");function z(){return process.env.ORACLE_FAKE_HOME||Fe.homedir()}function Me(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function A(){return Me()?process.env.ORACLE_CONFIG_DIR||R.join(z(),".config","oracle"):R.join(z(),".config","oracle")}function Ne(){return R.join(A(),"desk.json")}function Be(){return R.join(A(),"env")}function C({force:e=!1}={}){if(C._done&&!e)return C._result||null;C._done=!0;let t={},r=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=Be();if(L.existsSync(n))for(let i of L.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),r(s[1],c)}}catch{}try{let n=Ne();if(L.existsSync(n)){let i=JSON.parse(L.readFileSync(n,"utf8"));i&&typeof i=="object"&&(r("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),r("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),r("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),r("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),r("ORACLE_EXEC_URL",i.execUrl),r("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),C._result=Object.keys(t).length?t:null,C._result}try{C()}catch{}function K(e){return L.mkdirSync(e,{recursive:!0}),e}var Je=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function M(e){return String(e||"").trim()||void 0}function He(e,{required:t=!1}={}){let r=M(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!Je.has(r))throw new Error(`unsupported provider: ${r}`);return r}function qe(e,{required:t=!1}={}){let r=M(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function We(e){let t=M(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function N({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=He(e),i=qe(t,{required:o});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:We(r)};if(M(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var Ve=new Set(["auto","standalone","hermes","remote","arch"]);function Ge(){return W.join(A(),"model.json")}function U(e){return String(e||"").trim()||void 0}function Xe(e={}){let t=U(e.backend)?.toLowerCase()||"auto",r=N({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=U(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=U(e.reasoningEffort),s=U(e.computeHost||e.remoteHost),c=U(e.computeUser||e.remoteUser),u=U(e.computePath||e.remotePath);if(!Ve.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...c?{computeUser:c}:{},...u?{computePath:u}:{}}}function ce(e){let t=Xe(e),r=Ge();K(W.dirname(r)),process.platform!=="win32"&&B.chmodSync(W.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return B.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),B.renameSync(o,r),process.platform!=="win32"&&B.chmodSync(r,384),t}import{createHash as st,randomBytes as Q,timingSafeEqual as at}from"node:crypto";import k from"node:fs";import y from"node:path";import ct from"node:readline/promises";import{spawn as ut,spawnSync as dt}from"node:child_process";import b from"node:fs";import v from"node:path";var V=Object.freeze(["anthropic-oauth","openai-codex","xai-oauth"]);function ue(e){let t=String(e||"").trim();if(!t||!v.isAbsolute(t))return"";try{return b.statSync(t).isFile()?t:""}catch{return""}}function Ze(e){try{return b.readdirSync(e,{withFileTypes:!0})}catch{return[]}}function Ye(e=process.env){return!(e.ORACLE_PUBLIC_DESKTOP==="1"&&e.ORACLE_OWNER_DESKTOP!=="1")}function Qe(e=process.env){let t=String(e.ORACLE_REAL_HOME||"").trim();return t&&v.isAbsolute(t)?t:z()}function et(e={}){let t=e.home||Qe(e.env),r={"anthropic-oauth":[],"openai-codex":[],"xai-oauth":[]},o=(i,s)=>{let c=ue(s);c&&(r[i].includes(c)||r[i].push(c))};o("anthropic-oauth",v.join(t,".claude",".credentials.json"));for(let i of Ze(v.join(t,".claude-lanes")))!i.isDirectory()||i.name.startsWith(".")||o("anthropic-oauth",v.join(t,".claude-lanes",i.name,".credentials.json"));let n=v.join(t,".hermes","auth.json");for(let i of V)o(i,n);return o("anthropic-oauth",v.join(t,".hermes","profiles","hermes-macbook","auth.json")),o("openai-codex",v.join(t,".hermes","profiles","hermes-macbook","auth.json")),o("xai-oauth",v.join(t,".hermes","profiles","hermes-macbook","auth.json")),r}function tt(e){if(!b.existsSync(e))return{providers:{}};try{let t=JSON.parse(b.readFileSync(e,"utf8"));return!t||typeof t!="object"||Array.isArray(t)?{providers:{}}:{providers:t.providers&&typeof t.providers=="object"&&!Array.isArray(t.providers)?t.providers:{}}}catch{return{providers:{}}}}function rt(e,t){let r=[];for(let o of[...Array.isArray(e)?e:[],...t]){let n=ue(o)||(v.isAbsolute(String(o||""))?String(o):"");!n||r.includes(n)||r.push(n)}return r}function de(e={}){if(!Ye(e.env))return{wrote:!1,providers:{}};let t=e.linksFile||v.join(A(),"oauth-links.json"),r=et(e),n={providers:{...tt(t).providers||{}}},i=!1;for(let m of V){let w=rt(n.providers[m],r[m]);JSON.stringify(w)!==JSON.stringify(n.providers[m]||[])?(n.providers[m]=w,i=!0):w.length&&(n.providers[m]=w)}if(!V.some(m=>(n.providers[m]||[]).length))return{wrote:!1,providers:n.providers};if(!i&&b.existsSync(t))return{wrote:!1,providers:n.providers};let c=v.dirname(t);if(b.mkdirSync(c,{recursive:!0}),process.platform!=="win32")try{b.chmodSync(c,448)}catch{}let u=`${t}.${process.pid}.tmp`;return b.writeFileSync(u,`${JSON.stringify(n,null,2)}
+`,{mode:384}),b.renameSync(u,t),process.platform!=="win32"&&b.chmodSync(t,384),{wrote:!0,providers:n.providers}}import O from"node:fs";import fe from"node:path";var le=/access|refresh|idToken|id_token|token|secret|key|seed|mnemonic/i;function ot(e=A()){return fe.join(e,"user-profile.json")}function nt(e){if(!O.existsSync(e))return{identities:{},wallets:{}};try{let t=JSON.parse(O.readFileSync(e,"utf8"));return!t||typeof t!="object"||Array.isArray(t)?{identities:{},wallets:{}}:{identities:t.identities&&typeof t.identities=="object"?t.identities:{},wallets:t.wallets&&typeof t.wallets=="object"?t.wallets:{},updatedAt:t.updatedAt}}catch{return{identities:{},wallets:{}}}}function pe(e){if(!e||typeof e!="object"||Array.isArray(e))return{};let t={};for(let[r,o]of Object.entries(e))if(!le.test(r)){if(typeof o=="string"||typeof o=="number"||typeof o=="boolean"){t[r]=o;continue}if(o&&typeof o=="object"&&!Array.isArray(o)){let n={};for(let[i,s]of Object.entries(o))le.test(i)||(typeof s=="string"||typeof s=="number"||typeof s=="boolean")&&(n[i]=s);t[r]=n}}return t}function it(e,t){let r=fe.dirname(e);if(O.mkdirSync(r,{recursive:!0}),process.platform!=="win32")try{O.chmodSync(r,448)}catch{}let o={updatedAt:new Date().toISOString(),identities:pe(t.identities),wallets:pe(t.wallets)},n=`${e}.${process.pid}.tmp`;return O.writeFileSync(n,`${JSON.stringify(o,null,2)}
+`,{mode:384}),O.renameSync(n,e),process.platform!=="win32"&&O.chmodSync(e,384),o}function G(e){let r=String(e||"").trim().split(".");if(r.length<2)return{};try{let o=JSON.parse(Buffer.from(r[1],"base64url").toString("utf8")),n=String(o.email||"").trim(),i=String(o.name||o.preferred_username||"").trim();return{...n?{email:n}:{},...i?{name:i}:{}}}catch{return{}}}function X(e,t={},r={}){let o=String(e||"").trim();if(!o)return null;let n=r.file||ot(r.configDir),i=nt(n),s=i.identities[o]&&typeof i.identities[o]=="object"?i.identities[o]:{};return i.identities[o]={...s,provider:o,source:String(t.source||s.source||"oracle"),loggedInAt:t.loggedInAt||new Date().toISOString(),...t.label?{label:String(t.label)}:{},...t.email?{email:String(t.email)}:{},...t.name?{name:String(t.name)}:{}},it(n,i)}var T=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),he=12e4;function lt(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function E(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(T))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function ye(e){let t=E(e);return{id:t,...T[t]}}function g(e,t={}){if(!k.existsSync(e))return t;try{let r=JSON.parse(k.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${y.basename(e)}`)}}function we(e){K(e),process.platform!=="win32"&&k.chmodSync(e,448)}function _(e,t){we(y.dirname(e));let r=`${e}.${process.pid}.${Q(4).toString("hex")}.tmp`;k.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),k.renameSync(r,e),process.platform!=="win32"&&k.chmodSync(e,384)}function pt(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function Z(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function $(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ft(e={}){let t=e.file||y.join(A(),"oauth.json"),r=e.metadataFile||y.join(y.dirname(t),"oauth-meta.json"),o=e.linksFile||y.join(y.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||dt,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&pt(i),c=s?"linux-secret-service":"private-file",u=`${t}.lock`;async function m(f){we(y.dirname(u));let l;for(let a=0;a<400;a+=1)try{l=k.openSync(u,"wx",384);break}catch(d){if(d?.code!=="EEXIST")throw d;try{Date.now()-k.statSync(u).mtimeMs>3e5&&k.unlinkSync(u)}catch{}await new Promise(p=>setTimeout(p,25))}if(l===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{k.closeSync(l)}catch{}try{k.unlinkSync(u)}catch{}}}function w(f,l="oauth"){return["application","oracle","kind",l,"provider",f]}let D=!1;function ie(){if(D)return;D=!0;let f=y.join(A(),"oauth-links.json");if(y.resolve(o)===y.resolve(f))try{de({linksFile:o})}catch{}}function F(f){if(ie(),!k.existsSync(o))return[];let a=g(o,{providers:{}}).providers?.[f];if(!Array.isArray(a))return[];let d=[];for(let p of a)if(y.isAbsolute(String(p||"")))try{let h=g(p,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let S=$(h.claudeAiOauth);d.push({...S,refreshToken:"",source:"external-access-only",label:y.basename(y.dirname(p))||"claude-lane"});continue}let x=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(x){let S=x[f]||x[f.replace(/-oauth$/,"")]||[],$e=Array.isArray(S)?S:S?[S]:[];for(let I of $e)if(!(!I||typeof I!="object"))try{let Te=$(I);d.push({...Te,refreshToken:"",source:"external-access-only",label:String(I.label||I.id||y.basename(y.dirname(p))||f)})}catch{}}}catch{}return d}function H(f){let l=F(f);return l.length?l.find(a=>!a.expiresAt||a.expiresAt>n()+he)||l[0]:null}function q(f){return f.map(l=>({label:String(l.label||"lane"),source:"external-access-only",expiresAt:Number(l.expiresAt||0),healthy:!l.expiresAt||l.expiresAt>n()+he}))}function se(f){let l=E(f);if(s){let p=i("secret-tool",["lookup",...w(l)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!p.error&&p.status===0&&String(p.stdout||"").trim())try{return $(JSON.parse(String(p.stdout).trim()))}catch{}return H(l)}let d=g(t,{providers:{}}).providers?.[l];if(d)try{return $(d)}catch{}return H(l)}function je(f,l){let a=E(f),d=$(l);if(s){let h=i("secret-tool",["store",`--label=Oracle ${a} OAuth`,...w(a)],{input:JSON.stringify(d),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let x=g(r,{providers:{}});x.providers||={},x.providers[a]={expiresAt:d.expiresAt,source:d.source},_(r,x);try{let S=G(d.idToken);X(a,{source:d.source,...S,label:S.name||S.email||a},{configDir:y.dirname(t)})}catch{}return d}let p=g(t,{providers:{}});p.providers||={},p.providers[a]=d,_(t,p);try{let h=G(d.idToken);X(a,{source:d.source,...h,label:h.name||h.email||a},{configDir:y.dirname(t)})}catch{}return d}function Pe(f){let l=E(f);if(s){let p=i("secret-tool",["clear",...w(l)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=g(r,{providers:{}});return h.providers&&delete h.providers[l],_(r,h),!p.error&&p.status===0}let a=g(t,{providers:{}}),d=!!a.providers?.[l];return a.providers&&delete a.providers[l],_(t,a),d}function ae(f){let l=Z(f);if(s){let a=i("secret-tool",["lookup",...w(l,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return a.error||a.status!==0?"":String(a.stdout||"").trim()}return String(g(t,{apiKeys:{}}).apiKeys?.[l]||"").trim()}function Ce(f,l){let a=Z(f),d=String(l||"").trim();if(!d)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${a} API key`,...w(a,"api-key")],{input:d,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let x=g(r,{providers:{},apiKeys:{}});return x.apiKeys||={},x.apiKeys[a]={configured:!0},_(r,x),!0}let p=g(t,{providers:{},apiKeys:{}});return p.apiKeys||={},p.apiKeys[a]=d,_(t,p),!0}function Re(f){let l=Z(f);if(s){let p=i("secret-tool",["clear",...w(l,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=g(r,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[l],_(r,h),!p.error&&p.status===0}let a=g(t,{providers:{},apiKeys:{}}),d=!!a.apiKeys?.[l];return a.apiKeys&&delete a.apiKeys[l],_(t,a),d}function Ue(){ie();let f={},l={};if(s){let a=g(r,{providers:{},apiKeys:{}});for(let[d,p]of Object.entries(a.providers||{}))f[d]={loggedIn:!!se(d),expiresAt:Number(p.expiresAt||0),source:String(p.source||"oracle"),storage:c,lanes:q(F(d))};for(let d of Object.keys(a.apiKeys||{}))l[d]={configured:!!ae(d),storage:c}}else{let a=g(t,{providers:{},apiKeys:{}});for(let[d,p]of Object.entries(a.providers||{}))f[d]={loggedIn:!!p?.accessToken,expiresAt:Number(p?.expiresAt||0),source:String(p?.source||"oracle"),storage:c,lanes:q(F(d))};for(let[d,p]of Object.entries(a.apiKeys||{}))l[d]={configured:!!p,storage:c}}for(let a of Object.keys(T)){let d=q(F(a));if(f[a]){f[a].lanes=d;continue}let p=H(a);p&&(f[a]={loggedIn:!0,expiresAt:p.expiresAt,source:p.source,storage:"external-access-source",lanes:d})}return{storage:c,providers:f,apiKeys:l}}return Object.freeze({file:t,storage:c,get:se,set:je,remove:Pe,getApiKey:ae,setApiKey:Ce,removeApiKey:Re,status:Ue,withLock:m})}var me;function ge(){return me||=ft(),me}function Y(e){return Buffer.from(e).toString("base64url")}function ht(){let e=Y(Q(32));return{verifier:e,challenge:Y(st("sha256").update(e).digest()),state:Y(Q(24))}}function mt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&at(r,o)}function yt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return ut(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ee(e){return new URLSearchParams(e).toString()}async function j(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function wt(e){if(e)return String(await e()).trim();let t=ct.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function te(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return $({accessToken:r,refreshToken:o,expiresAt:lt(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function gt(e){let t=T["anthropic-oauth"],r=e.pkce||ht(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let i=await wt(e.inputFn),[s,c]=i.split("#",2);if(!s||!mt(c,r.state))throw new Error("Claude OAuth state mismatch");let u=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:c,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return te(await j(u,"Claude OAuth token exchange"),e)}async function vt(e){let t=T["openai-codex"],r=await j(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),i;for(let c=0;c<Math.ceil(900/n);c+=1){await e.sleepFn(n*1e3);let u=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(u.ok){i=await j(u,"Codex device authorization");break}if(![403,404].includes(u.status))throw new Error(`Codex device authorization failed (HTTP ${u.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ee({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return te(await j(s,"Codex OAuth token exchange"),e)}function J(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function kt(e){let t=T["xai-oauth"],r=await j(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");J(r.authorization_endpoint);let o=J(r.token_endpoint),n=await j(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ee({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=J(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),c=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let u=0;u<c;u+=1){let m=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ee({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(m.ok){let D=await j(m,"xAI OAuth token exchange");return te(D,{...e,discovery:{authorization_endpoint:J(r.authorization_endpoint),token_endpoint:o}})}let w="";try{w=String((await m.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${m.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function ve(e,t={}){let r=E(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||yt,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?gt(o):r==="openai-codex"?vt(o):kt(o)}var Oe=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function oe(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function bt(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function _t(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`)},i=s=>{let c=String(s);for(let u of c){if(u==="\r"||u===`
+`){n(),t(o.trim());return}if(u===""){n(),r(new Error("cancelled"));return}u==="\x7F"||u==="\b"?o=o.slice(0,-1):o+=u}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function ne(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...N({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Ee(e,t,r={}){return ce(ne(e,t,r))}function Ot(e){process.stdout.write(`storage: ${e.storage}
+`);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
+`);return}for(let[o,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
+`);for(let s of n.lanes||[])process.stdout.write(`  ${s.label}: ${s.healthy?"ready":"expired"}
+`)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
+`)}function Et(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth usage [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
+`)}var ar={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Et(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=ge();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):Ot(n),0}if(r==="usage"){let{collectOAuthUsage:n}=await Promise.resolve().then(()=>(_e(),be)),i=await n(o);return process.stdout.write(`${JSON.stringify(i)}
+`),0}if(r==="login"){let n=t.find(u=>!u.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=ye(n),s=oe(t,"--model")||i.model;ne(i.id,s);let c=await ve(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let u=o.get(i.id);o.set(i.id,c);try{Ee(i.id,s)}catch(m){throw u?o.set(i.id,u):o.remove(i.id),m}}),process.stdout.write(`${i.id}: logged in, stored in ${o.storage}
+`),0}if(r==="api-key"){let n=String(t.find(u=>!u.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(Oe,n))throw new Error(`unsupported API-key provider: ${n}`);let i=oe(t,"--model")||Oe[n].model,s=oe(t,"--base-url");ne(n,i,{baseUrl:s});let c=t.includes("--stdin")?await bt():await _t();return await o.withLock(async()=>{let u=o.getApiKey(n);o.setApiKey(n,c);try{Ee(n,i,{baseUrl:s})}catch(m){throw u?o.setApiKey(n,u):o.removeApiKey(n),m}}),process.stdout.write(`${n}: API key configured in ${o.storage}
+`),0}if(r==="logout"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=o.remove(E(n))}catch{}let s=o.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
+`),1}}};export{ar as default};