@pixelzx/genesis 2026.5.5-1 → 2026.5.5-2

package/dist/store-zVJHt5-N.js

@@ -0,0 +1,1235 @@
+import "./errors-Jbvi20TW.js";
+import { c as normalizeOptionalString } from "./string-coerce-C1IzJjqi.js";
+import { m as resolveUserPath } from "./utils-DaGfogP-.js";
+import { t as createSubsystemLogger } from "./subsystem-DTMy5YmO.js";
+import { g as resolveOAuthPath } from "./paths-DmR9mjUX.js";
+import { a as coerceSecretRef, u as normalizeSecretInputString } from "./types.secrets-ews2W8BF.js";
+import { r as normalizeProviderId } from "./provider-id-BLh32HP1.js";
+import { a as withFileLock } from "./file-lock-BMf7Dd83.js";
+import "./file-lock-COJsWxeA.js";
+import { n as saveJsonFile, t as loadJsonFile } from "./json-file-B3lYrFNr.js";
+import { a as replaceRuntimeAuthProfileStoreSnapshots$1, d as resolveLegacyAuthStorePath, i as hasRuntimeAuthProfileStoreSnapshot, l as resolveAuthStorePath, n as clearRuntimeAuthProfileStoreSnapshots$1, o as setRuntimeAuthProfileStoreSnapshot, r as getRuntimeAuthProfileStoreSnapshot, s as resolveAuthStatePath } from "./source-check-DseWz2_m.js";
+import { C as resolveExternalAuthProfilesWithPlugins } from "./provider-runtime-CE8zqYv8.js";
+import fs from "node:fs";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+//#region src/agents/auth-profiles/constants.ts
+const CLAUDE_CLI_PROFILE_ID = "anthropic:claude-cli";
+const CODEX_CLI_PROFILE_ID = "openai-codex:codex-cli";
+const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai-codex:default";
+const MINIMAX_CLI_PROFILE_ID = "minimax-portal:minimax-cli";
+const AUTH_STORE_LOCK_OPTIONS = {
+	retries: {
+		retries: 10,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 3e4
+};
+const OAUTH_REFRESH_LOCK_OPTIONS = {
+	retries: {
+		retries: 20,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 18e4
+};
+const OAUTH_REFRESH_CALL_TIMEOUT_MS = 12e4;
+const EXTERNAL_CLI_SYNC_TTL_MS = 900 * 1e3;
+const log$1 = createSubsystemLogger("agents/auth-profiles");
+//#endregion
+//#region src/agents/cli-credentials.ts
+const log = createSubsystemLogger("agents/auth-profiles");
+const CLAUDE_CLI_CREDENTIALS_RELATIVE_PATH = ".claude/.credentials.json";
+const CODEX_CLI_AUTH_FILENAME = "auth.json";
+const MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH = ".minimax/oauth_creds.json";
+const CLAUDE_CLI_KEYCHAIN_SERVICE = "Claude Code-credentials";
+let claudeCliCache = null;
+let codexCliCache = null;
+let minimaxCliCache = null;
+function resolveClaudeCliCredentialsPath(homeDir) {
+	const baseDir = homeDir ?? resolveUserPath("~");
+	return path.join(baseDir, CLAUDE_CLI_CREDENTIALS_RELATIVE_PATH);
+}
+function parseClaudeCliOauthCredential(claudeOauth) {
+	if (!claudeOauth || typeof claudeOauth !== "object") return null;
+	const accessToken = claudeOauth.accessToken;
+	const refreshToken = claudeOauth.refreshToken;
+	const expiresAt = claudeOauth.expiresAt;
+	if (typeof accessToken !== "string" || !accessToken) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= 0) return null;
+	if (typeof refreshToken === "string" && refreshToken) return {
+		type: "oauth",
+		provider: "anthropic",
+		access: accessToken,
+		refresh: refreshToken,
+		expires: expiresAt
+	};
+	return {
+		type: "token",
+		provider: "anthropic",
+		token: accessToken,
+		expires: expiresAt
+	};
+}
+function resolveCodexHomePath(codexHome) {
+	const configured = codexHome ?? process.env.CODEX_HOME;
+	const home = configured ? resolveUserPath(configured) : resolveUserPath("~/.codex");
+	try {
+		return fs.realpathSync.native(home);
+	} catch {
+		return home;
+	}
+}
+function resolveMiniMaxCliCredentialsPath(homeDir) {
+	const baseDir = homeDir ?? resolveUserPath("~");
+	return path.join(baseDir, MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH);
+}
+function readFileMtimeMs(filePath) {
+	try {
+		return fs.statSync(filePath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function readCachedCliCredential(options) {
+	const { ttlMs, cache, cacheKey, read, setCache, readSourceFingerprint } = options;
+	if (ttlMs <= 0) return read();
+	const now = Date.now();
+	const sourceFingerprint = readSourceFingerprint?.();
+	if (cache && cache.cacheKey === cacheKey && cache.sourceFingerprint === sourceFingerprint && now - cache.readAt < ttlMs) return cache.value;
+	const value = read();
+	const cachedSourceFingerprint = readSourceFingerprint?.();
+	if (!readSourceFingerprint || cachedSourceFingerprint === sourceFingerprint) setCache({
+		value,
+		readAt: now,
+		cacheKey,
+		sourceFingerprint: cachedSourceFingerprint
+	});
+	else setCache(null);
+	return value;
+}
+function computeCodexKeychainAccount(codexHome) {
+	return `cli|${createHash("sha256").update(codexHome).digest("hex").slice(0, 16)}`;
+}
+function resolveCodexKeychainParams(options) {
+	return {
+		platform: options?.platform ?? process.platform,
+		execSyncImpl: options?.execSync ?? execSync,
+		codexHome: resolveCodexHomePath(options?.codexHome)
+	};
+}
+function decodeJwtExpiryMs(token) {
+	const parts = token.split(".");
+	if (parts.length < 2) return null;
+	try {
+		const payloadRaw = Buffer.from(parts[1], "base64url").toString("utf8");
+		const payload = JSON.parse(payloadRaw);
+		return typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0 ? payload.exp * 1e3 : null;
+	} catch {
+		return null;
+	}
+}
+function readCodexKeychainAuthRecord(options) {
+	const { platform, execSyncImpl, codexHome } = resolveCodexKeychainParams(options);
+	if (platform !== "darwin") return null;
+	const account = computeCodexKeychainAccount(codexHome);
+	try {
+		const secret = execSyncImpl(`security find-generic-password -s "Codex Auth" -a "${account}" -w`, {
+			encoding: "utf8",
+			timeout: 5e3,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+		return JSON.parse(secret);
+	} catch {
+		return null;
+	}
+}
+function readCodexKeychainCredentials(options) {
+	const parsed = readCodexKeychainAuthRecord(options);
+	if (!parsed) return null;
+	const tokens = parsed.tokens;
+	try {
+		const accessToken = tokens?.access_token;
+		const refreshToken = tokens?.refresh_token;
+		if (typeof accessToken !== "string" || !accessToken) return null;
+		if (typeof refreshToken !== "string" || !refreshToken) return null;
+		const lastRefreshRaw = parsed.last_refresh;
+		const lastRefresh = typeof lastRefreshRaw === "string" || typeof lastRefreshRaw === "number" ? new Date(lastRefreshRaw).getTime() : Date.now();
+		const fallbackExpiry = Number.isFinite(lastRefresh) ? lastRefresh + 3600 * 1e3 : Date.now() + 3600 * 1e3;
+		const expires = decodeJwtExpiryMs(accessToken) ?? fallbackExpiry;
+		const accountId = typeof tokens?.account_id === "string" ? tokens.account_id : void 0;
+		const idToken = typeof tokens?.id_token === "string" ? tokens.id_token : void 0;
+		log.info("read codex credentials from keychain", {
+			source: "keychain",
+			expires: new Date(expires).toISOString()
+		});
+		return {
+			type: "oauth",
+			provider: "openai-codex",
+			access: accessToken,
+			refresh: refreshToken,
+			expires,
+			accountId,
+			idToken
+		};
+	} catch {
+		return null;
+	}
+}
+function readPortalCliOauthCredentials(credPath, provider) {
+	const raw = loadJsonFile(credPath);
+	if (!raw || typeof raw !== "object") return null;
+	const data = raw;
+	const accessToken = data.access_token;
+	const refreshToken = data.refresh_token;
+	const expiresAt = data.expiry_date;
+	if (typeof accessToken !== "string" || !accessToken) return null;
+	if (typeof refreshToken !== "string" || !refreshToken) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	return {
+		type: "oauth",
+		provider,
+		access: accessToken,
+		refresh: refreshToken,
+		expires: expiresAt
+	};
+}
+function readMiniMaxCliCredentials(options) {
+	return readPortalCliOauthCredentials(resolveMiniMaxCliCredentialsPath(options?.homeDir), "minimax-portal");
+}
+function readClaudeCliKeychainCredentials(execSyncImpl = execSync) {
+	try {
+		const result = execSyncImpl(`security find-generic-password -s "${CLAUDE_CLI_KEYCHAIN_SERVICE}" -w`, {
+			encoding: "utf8",
+			timeout: 5e3,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		return parseClaudeCliOauthCredential(JSON.parse(result.trim())?.claudeAiOauth);
+	} catch {
+		return null;
+	}
+}
+function readClaudeCliCredentials(options) {
+	if ((options?.platform ?? process.platform) === "darwin" && options?.allowKeychainPrompt !== false) {
+		const keychainCreds = readClaudeCliKeychainCredentials(options?.execSync);
+		if (keychainCreds) {
+			log.info("read anthropic credentials from claude cli keychain", { type: keychainCreds.type });
+			return keychainCreds;
+		}
+	}
+	const raw = loadJsonFile(resolveClaudeCliCredentialsPath(options?.homeDir));
+	if (!raw || typeof raw !== "object") return null;
+	return parseClaudeCliOauthCredential(raw.claudeAiOauth);
+}
+function readClaudeCliCredentialsCached(options) {
+	return readCachedCliCredential({
+		ttlMs: options?.ttlMs ?? 0,
+		cache: claudeCliCache,
+		cacheKey: resolveClaudeCliCredentialsPath(options?.homeDir),
+		read: () => readClaudeCliCredentials({
+			allowKeychainPrompt: options?.allowKeychainPrompt,
+			platform: options?.platform,
+			homeDir: options?.homeDir,
+			execSync: options?.execSync
+		}),
+		setCache: (next) => {
+			claudeCliCache = next;
+		}
+	});
+}
+function readCodexCliCredentials(options) {
+	const keychain = readCodexKeychainCredentials({
+		codexHome: options?.codexHome,
+		platform: options?.platform,
+		execSync: options?.execSync
+	});
+	if (keychain) return keychain;
+	const authPath = path.join(resolveCodexHomePath(options?.codexHome), CODEX_CLI_AUTH_FILENAME);
+	const raw = loadJsonFile(authPath);
+	if (!raw || typeof raw !== "object") return null;
+	const tokens = raw.tokens;
+	if (!tokens || typeof tokens !== "object") return null;
+	const accessToken = tokens.access_token;
+	const refreshToken = tokens.refresh_token;
+	if (typeof accessToken !== "string" || !accessToken) return null;
+	if (typeof refreshToken !== "string" || !refreshToken) return null;
+	let fallbackExpiry;
+	try {
+		fallbackExpiry = fs.statSync(authPath).mtimeMs + 3600 * 1e3;
+	} catch {
+		fallbackExpiry = Date.now() + 3600 * 1e3;
+	}
+	return {
+		type: "oauth",
+		provider: "openai-codex",
+		access: accessToken,
+		refresh: refreshToken,
+		expires: decodeJwtExpiryMs(accessToken) ?? fallbackExpiry,
+		accountId: typeof tokens.account_id === "string" ? tokens.account_id : void 0,
+		idToken: typeof tokens.id_token === "string" ? tokens.id_token : void 0
+	};
+}
+function readCodexCliCredentialsCached(options) {
+	const authPath = path.join(resolveCodexHomePath(options?.codexHome), CODEX_CLI_AUTH_FILENAME);
+	return readCachedCliCredential({
+		ttlMs: options?.ttlMs ?? 0,
+		cache: codexCliCache,
+		cacheKey: `${options?.platform ?? process.platform}|${authPath}`,
+		read: () => readCodexCliCredentials({
+			codexHome: options?.codexHome,
+			platform: options?.platform,
+			execSync: options?.execSync
+		}),
+		setCache: (next) => {
+			codexCliCache = next;
+		},
+		readSourceFingerprint: () => readFileMtimeMs(authPath)
+	});
+}
+function readMiniMaxCliCredentialsCached(options) {
+	const credPath = resolveMiniMaxCliCredentialsPath(options?.homeDir);
+	return readCachedCliCredential({
+		ttlMs: options?.ttlMs ?? 0,
+		cache: minimaxCliCache,
+		cacheKey: credPath,
+		read: () => readMiniMaxCliCredentials({ homeDir: options?.homeDir }),
+		setCache: (next) => {
+			minimaxCliCache = next;
+		},
+		readSourceFingerprint: () => readFileMtimeMs(credPath)
+	});
+}
+//#endregion
+//#region src/agents/auth-profiles/credential-state.ts
+const DEFAULT_OAUTH_REFRESH_MARGIN_MS = 300 * 1e3;
+function resolveTokenExpiryState(expires, now = Date.now(), opts) {
+	if (expires === void 0) return "missing";
+	if (typeof expires !== "number") return "invalid_expires";
+	if (!Number.isFinite(expires) || expires <= 0) return "invalid_expires";
+	const remainingMs = expires - now;
+	if (remainingMs <= 0) return "expired";
+	const expiringWithinMs = Math.max(0, opts?.expiringWithinMs ?? 0);
+	if (expiringWithinMs > 0 && remainingMs <= expiringWithinMs) return "expiring";
+	return "valid";
+}
+function hasUsableOAuthCredential$1(credential, opts) {
+	if (!credential || credential.type !== "oauth") return false;
+	if (typeof credential.access !== "string" || credential.access.trim().length === 0) return false;
+	const now = opts?.now ?? Date.now();
+	const refreshMarginMs = Math.max(0, opts?.refreshMarginMs ?? 3e5);
+	return resolveTokenExpiryState(credential.expires, now, { expiringWithinMs: refreshMarginMs }) === "valid";
+}
+function hasConfiguredSecretRef(value) {
+	return coerceSecretRef(value) !== null;
+}
+function hasConfiguredSecretString(value) {
+	return normalizeSecretInputString(value) !== void 0;
+}
+function evaluateStoredCredentialEligibility(params) {
+	const now = params.now ?? Date.now();
+	const credential = params.credential;
+	if (credential.type === "api_key") {
+		const hasKey = hasConfiguredSecretString(credential.key);
+		const hasKeyRef = hasConfiguredSecretRef(credential.keyRef);
+		if (!hasKey && !hasKeyRef) return {
+			eligible: false,
+			reasonCode: "missing_credential"
+		};
+		return {
+			eligible: true,
+			reasonCode: "ok"
+		};
+	}
+	if (credential.type === "token") {
+		const hasToken = hasConfiguredSecretString(credential.token);
+		const hasTokenRef = hasConfiguredSecretRef(credential.tokenRef);
+		if (!hasToken && !hasTokenRef) return {
+			eligible: false,
+			reasonCode: "missing_credential"
+		};
+		const expiryState = resolveTokenExpiryState(credential.expires, now);
+		if (expiryState === "invalid_expires") return {
+			eligible: false,
+			reasonCode: "invalid_expires"
+		};
+		if (expiryState === "expired") return {
+			eligible: false,
+			reasonCode: "expired"
+		};
+		return {
+			eligible: true,
+			reasonCode: "ok"
+		};
+	}
+	if (normalizeSecretInputString(credential.access) === void 0 && normalizeSecretInputString(credential.refresh) === void 0) return {
+		eligible: false,
+		reasonCode: "missing_credential"
+	};
+	return {
+		eligible: true,
+		reasonCode: "ok"
+	};
+}
+//#endregion
+//#region src/agents/auth-profiles/oauth-shared.ts
+function areOAuthCredentialsEquivalent(a, b) {
+	if (!a || a.type !== "oauth") return false;
+	return a.provider === b.provider && a.access === b.access && a.refresh === b.refresh && a.expires === b.expires && a.email === b.email && a.enterpriseUrl === b.enterpriseUrl && a.projectId === b.projectId && a.accountId === b.accountId && a.idToken === b.idToken;
+}
+function hasNewerStoredOAuthCredential(existing, incoming) {
+	return Boolean(existing && existing.provider === incoming.provider && Number.isFinite(existing.expires) && (!Number.isFinite(incoming.expires) || existing.expires > incoming.expires));
+}
+function shouldReplaceStoredOAuthCredential(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return true;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return false;
+	return !hasNewerStoredOAuthCredential(existing, incoming);
+}
+function hasUsableOAuthCredential(credential, now = Date.now()) {
+	return hasUsableOAuthCredential$1(credential, { now });
+}
+function normalizeAuthIdentityToken$1(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function normalizeAuthEmailToken$1(value) {
+	return normalizeAuthIdentityToken$1(value)?.toLowerCase();
+}
+function hasOAuthIdentity(credential) {
+	return normalizeAuthIdentityToken$1(credential.accountId) !== void 0 || normalizeAuthEmailToken$1(credential.email) !== void 0;
+}
+function hasMatchingOAuthIdentity(existing, incoming) {
+	const existingAccountId = normalizeAuthIdentityToken$1(existing.accountId);
+	const incomingAccountId = normalizeAuthIdentityToken$1(incoming.accountId);
+	if (existingAccountId !== void 0 && incomingAccountId !== void 0) return existingAccountId === incomingAccountId;
+	const existingEmail = normalizeAuthEmailToken$1(existing.email);
+	const incomingEmail = normalizeAuthEmailToken$1(incoming.email);
+	if (existingEmail !== void 0 && incomingEmail !== void 0) return existingEmail === incomingEmail;
+	return false;
+}
+function isSafeToAdoptBootstrapOAuthIdentity(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return true;
+	if (existing.provider !== incoming.provider) return false;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return true;
+	if (!hasOAuthIdentity(existing)) return true;
+	return hasMatchingOAuthIdentity(existing, incoming);
+}
+function isSafeToAdoptMainStoreOAuthIdentity(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return false;
+	if (existing.provider !== incoming.provider) return false;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return true;
+	if (!hasOAuthIdentity(existing)) return true;
+	return hasMatchingOAuthIdentity(existing, incoming);
+}
+function shouldBootstrapFromExternalCliCredential(params) {
+	const now = params.now ?? Date.now();
+	if (hasUsableOAuthCredential(params.existing, now)) return false;
+	return hasUsableOAuthCredential(params.imported, now);
+}
+function overlayRuntimeExternalOAuthProfiles(store, profiles) {
+	const externalProfiles = Array.from(profiles);
+	if (externalProfiles.length === 0) return store;
+	const next = structuredClone(store);
+	for (const profile of externalProfiles) next.profiles[profile.profileId] = profile.credential;
+	return next;
+}
+function shouldPersistRuntimeExternalOAuthProfile(params) {
+	for (const profile of params.profiles) {
+		if (profile.profileId !== params.profileId) continue;
+		if (profile.persistence === "persisted") return true;
+		return !areOAuthCredentialsEquivalent(profile.credential, params.credential);
+	}
+	return true;
+}
+//#endregion
+//#region src/agents/auth-profiles/external-cli-sync.ts
+function normalizeAuthIdentityToken(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function normalizeAuthEmailToken(value) {
+	return normalizeAuthIdentityToken(value)?.toLowerCase();
+}
+function isSafeToUseExternalCliCredential(existing, imported) {
+	if (!existing) return true;
+	if (existing.provider !== imported.provider) return false;
+	const existingAccountId = normalizeAuthIdentityToken(existing.accountId);
+	const importedAccountId = normalizeAuthIdentityToken(imported.accountId);
+	const existingEmail = normalizeAuthEmailToken(existing.email);
+	const importedEmail = normalizeAuthEmailToken(imported.email);
+	if (existingAccountId !== void 0 && importedAccountId !== void 0) return existingAccountId === importedAccountId;
+	if (existingEmail !== void 0 && importedEmail !== void 0) return existingEmail === importedEmail;
+	if (existingAccountId !== void 0 || existingEmail !== void 0) return false;
+	return true;
+}
+const EXTERNAL_CLI_SYNC_PROVIDERS = [{
+	profileId: OPENAI_CODEX_DEFAULT_PROFILE_ID,
+	provider: "openai-codex",
+	readCredentials: () => readCodexCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS }),
+	bootstrapOnly: true
+}, {
+	profileId: MINIMAX_CLI_PROFILE_ID,
+	provider: "minimax-portal",
+	readCredentials: () => readMiniMaxCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS })
+}];
+function resolveExternalCliSyncProvider(params) {
+	const provider = EXTERNAL_CLI_SYNC_PROVIDERS.find((entry) => entry.profileId === params.profileId);
+	if (!provider) return null;
+	if (params.credential && provider.provider !== params.credential.provider) return null;
+	return provider;
+}
+function readExternalCliBootstrapCredential(params) {
+	const provider = resolveExternalCliSyncProvider(params);
+	if (!provider) return null;
+	if (provider.bootstrapOnly) return null;
+	return provider.readCredentials();
+}
+const readManagedExternalCliCredential = readExternalCliBootstrapCredential;
+function resolveExternalCliAuthProfiles(store) {
+	const profiles = [];
+	const now = Date.now();
+	for (const providerConfig of EXTERNAL_CLI_SYNC_PROVIDERS) {
+		const creds = providerConfig.readCredentials();
+		if (!creds) continue;
+		const existing = store.profiles[providerConfig.profileId];
+		const existingOAuth = existing?.type === "oauth" && existing.provider === providerConfig.provider ? existing : void 0;
+		if (existing && !existingOAuth) {
+			log$1.debug("kept explicit local auth over external cli bootstrap", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider,
+				localType: existing.type,
+				localProvider: existing.provider
+			});
+			continue;
+		}
+		if (providerConfig.bootstrapOnly && existingOAuth) {
+			log$1.debug("kept local oauth over external cli bootstrap-only provider", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider
+			});
+			continue;
+		}
+		if (existingOAuth && !isSafeToUseExternalCliCredential(existingOAuth, creds)) {
+			log$1.warn("refused external cli oauth bootstrap: identity mismatch", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider
+			});
+			continue;
+		}
+		if (existingOAuth && !isSafeToAdoptBootstrapOAuthIdentity(existingOAuth, creds) && !areOAuthCredentialsEquivalent(existingOAuth, creds)) {
+			log$1.warn("refused external cli oauth bootstrap: identity mismatch or missing binding", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider
+			});
+			continue;
+		}
+		if (!shouldBootstrapFromExternalCliCredential({
+			existing: existingOAuth,
+			imported: creds,
+			now
+		})) {
+			if (existingOAuth) log$1.debug("kept usable local oauth over external cli bootstrap", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider,
+				localExpires: existingOAuth.expires,
+				externalExpires: creds.expires
+			});
+			continue;
+		}
+		log$1.debug("used external cli oauth bootstrap because local oauth was missing or unusable", {
+			profileId: providerConfig.profileId,
+			provider: providerConfig.provider,
+			localExpires: existingOAuth?.expires,
+			externalExpires: creds.expires
+		});
+		profiles.push({
+			profileId: providerConfig.profileId,
+			credential: creds
+		});
+	}
+	return profiles;
+}
+//#endregion
+//#region src/agents/auth-profiles/external-auth.ts
+let resolveExternalAuthProfilesForRuntime;
+function normalizeExternalAuthProfile(profile) {
+	if (!profile?.profileId || !profile.credential) return null;
+	return {
+		...profile,
+		persistence: profile.persistence ?? "runtime-only"
+	};
+}
+function resolveExternalAuthProfileMap(params) {
+	const env = params.env ?? process.env;
+	const profiles = (resolveExternalAuthProfilesForRuntime ?? resolveExternalAuthProfilesWithPlugins)({
+		env,
+		context: {
+			config: void 0,
+			agentDir: params.agentDir,
+			workspaceDir: void 0,
+			env,
+			store: params.store
+		}
+	});
+	const resolved = /* @__PURE__ */ new Map();
+	const cliProfiles = resolveExternalCliAuthProfiles?.(params.store) ?? [];
+	for (const profile of cliProfiles) resolved.set(profile.profileId, {
+		profileId: profile.profileId,
+		credential: profile.credential,
+		persistence: "runtime-only"
+	});
+	for (const rawProfile of profiles) {
+		const profile = normalizeExternalAuthProfile(rawProfile);
+		if (!profile) continue;
+		resolved.set(profile.profileId, profile);
+	}
+	return resolved;
+}
+function listRuntimeExternalAuthProfiles(params) {
+	return Array.from(resolveExternalAuthProfileMap({
+		store: params.store,
+		agentDir: params.agentDir,
+		env: params.env
+	}).values());
+}
+function overlayExternalAuthProfiles(store, params) {
+	return overlayRuntimeExternalOAuthProfiles(store, listRuntimeExternalAuthProfiles({
+		store,
+		agentDir: params?.agentDir,
+		env: params?.env
+	}));
+}
+function shouldPersistExternalAuthProfile(params) {
+	const profiles = listRuntimeExternalAuthProfiles({
+		store: params.store,
+		agentDir: params.agentDir,
+		env: params.env
+	});
+	return shouldPersistRuntimeExternalOAuthProfile({
+		profileId: params.profileId,
+		credential: params.credential,
+		profiles
+	});
+}
+//#endregion
+//#region src/agents/auth-profiles/paths.ts
+function ensureAuthStoreFile(pathname) {
+	if (fs.existsSync(pathname)) return;
+	saveJsonFile(pathname, {
+		version: 1,
+		profiles: {}
+	});
+}
+//#endregion
+//#region src/agents/auth-profiles/state.ts
+function normalizeAuthProfileOrder(raw) {
+	if (!raw || typeof raw !== "object") return;
+	const normalized = Object.entries(raw).reduce((acc, [provider, value]) => {
+		if (!Array.isArray(value)) return acc;
+		const list = value.map((entry) => normalizeOptionalString(entry) ?? "").filter(Boolean);
+		if (list.length > 0) acc[provider] = list;
+		return acc;
+	}, {});
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function coerceAuthProfileState(raw) {
+	if (!raw || typeof raw !== "object") return {};
+	const record = raw;
+	return {
+		order: normalizeAuthProfileOrder(record.order),
+		lastGood: record.lastGood && typeof record.lastGood === "object" ? record.lastGood : void 0,
+		usageStats: record.usageStats && typeof record.usageStats === "object" ? record.usageStats : void 0
+	};
+}
+function mergeAuthProfileState(base, override) {
+	const mergeRecord = (left, right) => {
+		if (!left && !right) return;
+		if (!left) return { ...right };
+		if (!right) return { ...left };
+		return {
+			...left,
+			...right
+		};
+	};
+	return {
+		order: mergeRecord(base.order, override.order),
+		lastGood: mergeRecord(base.lastGood, override.lastGood),
+		usageStats: mergeRecord(base.usageStats, override.usageStats)
+	};
+}
+function loadPersistedAuthProfileState(agentDir) {
+	return coerceAuthProfileState(loadJsonFile(resolveAuthStatePath(agentDir)));
+}
+function buildPersistedAuthProfileState(store) {
+	const state = coerceAuthProfileState(store);
+	if (!state.order && !state.lastGood && !state.usageStats) return null;
+	return {
+		version: 1,
+		...state.order ? { order: state.order } : {},
+		...state.lastGood ? { lastGood: state.lastGood } : {},
+		...state.usageStats ? { usageStats: state.usageStats } : {}
+	};
+}
+function savePersistedAuthProfileState(store, agentDir) {
+	const payload = buildPersistedAuthProfileState(store);
+	const statePath = resolveAuthStatePath(agentDir);
+	if (!payload) {
+		try {
+			fs.unlinkSync(statePath);
+		} catch (error) {
+			if (error?.code !== "ENOENT") throw error;
+		}
+		return null;
+	}
+	saveJsonFile(statePath, payload);
+	return payload;
+}
+//#endregion
+//#region src/agents/auth-profiles/persisted.ts
+const AUTH_PROFILE_TYPES = new Set([
+	"api_key",
+	"oauth",
+	"token"
+]);
+function normalizeSecretBackedField(params) {
+	const value = params.entry[params.valueField];
+	if (value == null || typeof value === "string") return;
+	const ref = coerceSecretRef(value);
+	if (ref && !coerceSecretRef(params.entry[params.refField])) params.entry[params.refField] = ref;
+	delete params.entry[params.valueField];
+}
+function normalizeRawCredentialEntry(raw) {
+	const entry = { ...raw };
+	if (!("type" in entry) && typeof entry["mode"] === "string") entry["type"] = entry["mode"];
+	if (!("key" in entry) && typeof entry["apiKey"] === "string") entry["key"] = entry["apiKey"];
+	normalizeSecretBackedField({
+		entry,
+		valueField: "key",
+		refField: "keyRef"
+	});
+	normalizeSecretBackedField({
+		entry,
+		valueField: "token",
+		refField: "tokenRef"
+	});
+	return entry;
+}
+function parseCredentialEntry(raw, fallbackProvider) {
+	if (!raw || typeof raw !== "object") return {
+		ok: false,
+		reason: "non_object"
+	};
+	const typed = normalizeRawCredentialEntry(raw);
+	if (!AUTH_PROFILE_TYPES.has(typed.type)) return {
+		ok: false,
+		reason: "invalid_type"
+	};
+	const provider = typed.provider ?? fallbackProvider;
+	if (typeof provider !== "string" || provider.trim().length === 0) return {
+		ok: false,
+		reason: "missing_provider"
+	};
+	return {
+		ok: true,
+		credential: {
+			...typed,
+			provider
+		}
+	};
+}
+function warnRejectedCredentialEntries(source, rejected) {
+	if (rejected.length === 0) return;
+	const reasons = rejected.reduce((acc, current) => {
+		acc[current.reason] = (acc[current.reason] ?? 0) + 1;
+		return acc;
+	}, {});
+	log$1.warn("ignored invalid auth profile entries during store load", {
+		source,
+		dropped: rejected.length,
+		reasons,
+		keys: rejected.slice(0, 10).map((entry) => entry.key)
+	});
+}
+function coerceLegacyAuthStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if ("profiles" in record) return null;
+	const entries = {};
+	const rejected = [];
+	for (const [key, value] of Object.entries(record)) {
+		const parsed = parseCredentialEntry(value, key);
+		if (!parsed.ok) {
+			rejected.push({
+				key,
+				reason: parsed.reason
+			});
+			continue;
+		}
+		entries[key] = parsed.credential;
+	}
+	warnRejectedCredentialEntries("auth.json", rejected);
+	return Object.keys(entries).length > 0 ? entries : null;
+}
+function coercePersistedAuthProfileStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if (!record.profiles || typeof record.profiles !== "object") return null;
+	const profiles = record.profiles;
+	const normalized = {};
+	const rejected = [];
+	for (const [key, value] of Object.entries(profiles)) {
+		const parsed = parseCredentialEntry(value);
+		if (!parsed.ok) {
+			rejected.push({
+				key,
+				reason: parsed.reason
+			});
+			continue;
+		}
+		normalized[key] = parsed.credential;
+	}
+	warnRejectedCredentialEntries("auth-profiles.json", rejected);
+	return {
+		version: Number(record.version ?? 1),
+		profiles: normalized,
+		...coerceAuthProfileState(record)
+	};
+}
+function mergeRecord(base, override) {
+	if (!base && !override) return;
+	if (!base) return { ...override };
+	if (!override) return { ...base };
+	return {
+		...base,
+		...override
+	};
+}
+function dedupeMergedProfileOrder(profileIds) {
+	return Array.from(new Set(profileIds));
+}
+function hasComparableOAuthIdentityConflict(existing, candidate) {
+	const existingAccountId = normalizeAuthIdentityToken$1(existing.accountId);
+	const candidateAccountId = normalizeAuthIdentityToken$1(candidate.accountId);
+	if (existingAccountId !== void 0 && candidateAccountId !== void 0 && existingAccountId !== candidateAccountId) return true;
+	const existingEmail = normalizeAuthEmailToken$1(existing.email);
+	const candidateEmail = normalizeAuthEmailToken$1(candidate.email);
+	return existingEmail !== void 0 && candidateEmail !== void 0 && existingEmail !== candidateEmail;
+}
+function isLegacyDefaultOAuthProfile(profileId, credential) {
+	return profileId === `${normalizeProviderId(credential.provider)}:default`;
+}
+function isNewerUsableOAuthCredential(existing, candidate) {
+	if (!hasUsableOAuthCredential(candidate)) return false;
+	if (!hasUsableOAuthCredential(existing)) return true;
+	return Number.isFinite(candidate.expires) && (!Number.isFinite(existing.expires) || candidate.expires > existing.expires);
+}
+function findMainStoreOAuthReplacement(params) {
+	const providerKey = normalizeProviderId(params.legacyCredential.provider);
+	const candidates = Object.entries(params.base.profiles).flatMap(([profileId, credential]) => {
+		if (profileId === params.legacyProfileId || credential.type !== "oauth" || normalizeProviderId(credential.provider) !== providerKey) return [];
+		return [[profileId, credential]];
+	}).filter(([, credential]) => isNewerUsableOAuthCredential(params.legacyCredential, credential)).toSorted(([leftId, leftCredential], [rightId, rightCredential]) => {
+		const leftExpires = Number.isFinite(leftCredential.expires) ? leftCredential.expires : 0;
+		const rightExpires = Number.isFinite(rightCredential.expires) ? rightCredential.expires : 0;
+		if (rightExpires !== leftExpires) return rightExpires - leftExpires;
+		return leftId.localeCompare(rightId);
+	});
+	const exactIdentityCandidates = candidates.filter(([, credential]) => isSafeToAdoptMainStoreOAuthIdentity(params.legacyCredential, credential));
+	if (exactIdentityCandidates.length > 0) {
+		if (!hasOAuthIdentity(params.legacyCredential) && exactIdentityCandidates.length > 1) return;
+		return exactIdentityCandidates[0]?.[0];
+	}
+	if (hasUsableOAuthCredential(params.legacyCredential)) return;
+	const fallbackCandidates = candidates.filter(([, credential]) => !hasComparableOAuthIdentityConflict(params.legacyCredential, credential));
+	if (fallbackCandidates.length !== 1) return;
+	return fallbackCandidates[0]?.[0];
+}
+function replaceMergedProfileReferences(params) {
+	const { store, base, replacements } = params;
+	if (replacements.size === 0) return store;
+	const profiles = { ...store.profiles };
+	for (const [legacyProfileId, replacementProfileId] of replacements) {
+		const baseCredential = base.profiles[legacyProfileId];
+		if (baseCredential) profiles[legacyProfileId] = baseCredential;
+		else delete profiles[legacyProfileId];
+		const replacementBaseCredential = base.profiles[replacementProfileId];
+		const replacementCredential = profiles[replacementProfileId];
+		if (replacementBaseCredential && (!replacementCredential || replacementCredential.type === "oauth" && replacementBaseCredential.type === "oauth" && isNewerUsableOAuthCredential(replacementCredential, replacementBaseCredential))) profiles[replacementProfileId] = replacementBaseCredential;
+	}
+	const order = store.order ? Object.fromEntries(Object.entries(store.order).map(([provider, profileIds]) => [provider, dedupeMergedProfileOrder(profileIds.map((profileId) => replacements.get(profileId) ?? profileId))])) : void 0;
+	const lastGood = store.lastGood ? Object.fromEntries(Object.entries(store.lastGood).map(([provider, profileId]) => [provider, replacements.get(profileId) ?? profileId])) : void 0;
+	const usageStats = store.usageStats ? { ...store.usageStats } : void 0;
+	if (usageStats) for (const legacyProfileId of replacements.keys()) {
+		const baseStats = base.usageStats?.[legacyProfileId];
+		if (baseStats) usageStats[legacyProfileId] = baseStats;
+		else delete usageStats[legacyProfileId];
+	}
+	return {
+		...store,
+		profiles,
+		...order && Object.keys(order).length > 0 ? { order } : { order: void 0 },
+		...lastGood && Object.keys(lastGood).length > 0 ? { lastGood } : { lastGood: void 0 },
+		...usageStats && Object.keys(usageStats).length > 0 ? { usageStats } : { usageStats: void 0 }
+	};
+}
+function reconcileMainStoreOAuthProfileDrift(params) {
+	const replacements = /* @__PURE__ */ new Map();
+	for (const [profileId, credential] of Object.entries(params.override.profiles)) {
+		if (credential.type !== "oauth" || !isLegacyDefaultOAuthProfile(profileId, credential)) continue;
+		const replacementProfileId = findMainStoreOAuthReplacement({
+			base: params.base,
+			legacyProfileId: profileId,
+			legacyCredential: credential
+		});
+		if (replacementProfileId) replacements.set(profileId, replacementProfileId);
+	}
+	return replaceMergedProfileReferences({
+		store: params.merged,
+		base: params.base,
+		replacements
+	});
+}
+function mergeAuthProfileStores(base, override) {
+	if (Object.keys(override.profiles).length === 0 && !override.order && !override.lastGood && !override.usageStats) return base;
+	return reconcileMainStoreOAuthProfileDrift({
+		base,
+		override,
+		merged: {
+			version: Math.max(base.version, override.version ?? base.version),
+			profiles: {
+				...base.profiles,
+				...override.profiles
+			},
+			order: mergeRecord(base.order, override.order),
+			lastGood: mergeRecord(base.lastGood, override.lastGood),
+			usageStats: mergeRecord(base.usageStats, override.usageStats)
+		}
+	});
+}
+function buildPersistedAuthProfileSecretsStore(store, shouldPersistProfile) {
+	return {
+		version: 1,
+		profiles: Object.fromEntries(Object.entries(store.profiles).flatMap(([profileId, credential]) => {
+			if (shouldPersistProfile && !shouldPersistProfile({
+				profileId,
+				credential
+			})) return [];
+			if (credential.type === "api_key" && credential.keyRef && credential.key !== void 0) {
+				const sanitized = { ...credential };
+				delete sanitized.key;
+				return [[profileId, sanitized]];
+			}
+			if (credential.type === "token" && credential.tokenRef && credential.token !== void 0) {
+				const sanitized = { ...credential };
+				delete sanitized.token;
+				return [[profileId, sanitized]];
+			}
+			return [[profileId, credential]];
+		}))
+	};
+}
+function applyLegacyAuthStore(store, legacy) {
+	for (const [provider, cred] of Object.entries(legacy)) {
+		const profileId = `${provider}:default`;
+		const credentialProvider = cred.provider ?? provider;
+		if (cred.type === "api_key") {
+			store.profiles[profileId] = {
+				type: "api_key",
+				provider: credentialProvider,
+				key: cred.key,
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		if (cred.type === "token") {
+			store.profiles[profileId] = {
+				type: "token",
+				provider: credentialProvider,
+				token: cred.token,
+				...typeof cred.expires === "number" ? { expires: cred.expires } : {},
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider: credentialProvider,
+			access: cred.access,
+			refresh: cred.refresh,
+			expires: cred.expires,
+			...cred.enterpriseUrl ? { enterpriseUrl: cred.enterpriseUrl } : {},
+			...cred.projectId ? { projectId: cred.projectId } : {},
+			...cred.accountId ? { accountId: cred.accountId } : {},
+			...cred.email ? { email: cred.email } : {}
+		};
+	}
+}
+function mergeOAuthFileIntoStore(store) {
+	const oauthRaw = loadJsonFile(resolveOAuthPath());
+	if (!oauthRaw || typeof oauthRaw !== "object") return false;
+	const oauthEntries = oauthRaw;
+	let mutated = false;
+	for (const [provider, creds] of Object.entries(oauthEntries)) {
+		if (!creds || typeof creds !== "object") continue;
+		const profileId = `${provider}:default`;
+		if (store.profiles[profileId]) continue;
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider,
+			...creds
+		};
+		mutated = true;
+	}
+	return mutated;
+}
+function loadPersistedAuthProfileStore(agentDir) {
+	const raw = loadJsonFile(resolveAuthStorePath(agentDir));
+	const store = coercePersistedAuthProfileStore(raw);
+	if (!store) return null;
+	return {
+		...store,
+		...mergeAuthProfileState(coerceAuthProfileState(raw), loadPersistedAuthProfileState(agentDir))
+	};
+}
+function loadLegacyAuthProfileStore(agentDir) {
+	return coerceLegacyAuthStore(loadJsonFile(resolveLegacyAuthStorePath(agentDir)));
+}
+//#endregion
+//#region src/agents/auth-profiles/store.ts
+const loadedAuthStoreCache = /* @__PURE__ */ new Map();
+function cloneAuthProfileStore(store) {
+	return structuredClone(store);
+}
+function resolveRuntimeAuthProfileStore(agentDir) {
+	const mainKey = resolveAuthStorePath(void 0);
+	const requestedKey = resolveAuthStorePath(agentDir);
+	const mainStore = getRuntimeAuthProfileStoreSnapshot(void 0);
+	const requestedStore = getRuntimeAuthProfileStoreSnapshot(agentDir);
+	if (!agentDir || requestedKey === mainKey) {
+		if (!mainStore) return null;
+		return mainStore;
+	}
+	if (mainStore && requestedStore) return mergeAuthProfileStores(mainStore, requestedStore);
+	if (requestedStore) return requestedStore;
+	if (mainStore) return mainStore;
+	return null;
+}
+function readAuthStoreMtimeMs(authPath) {
+	try {
+		return fs.statSync(authPath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function readCachedAuthProfileStore(params) {
+	const cached = loadedAuthStoreCache.get(params.authPath);
+	if (!cached || cached.authMtimeMs !== params.authMtimeMs || cached.stateMtimeMs !== params.stateMtimeMs) return null;
+	if (Date.now() - cached.syncedAtMs >= 9e5) return null;
+	return cloneAuthProfileStore(cached.store);
+}
+function writeCachedAuthProfileStore(params) {
+	loadedAuthStoreCache.set(params.authPath, {
+		authMtimeMs: params.authMtimeMs,
+		stateMtimeMs: params.stateMtimeMs,
+		syncedAtMs: Date.now(),
+		store: cloneAuthProfileStore(params.store)
+	});
+}
+async function updateAuthProfileStoreWithLock(params) {
+	const authPath = resolveAuthStorePath(params.agentDir);
+	ensureAuthStoreFile(authPath);
+	try {
+		return await withFileLock(authPath, AUTH_STORE_LOCK_OPTIONS, async () => {
+			const store = loadAuthProfileStoreForAgent(params.agentDir);
+			if (params.updater(store)) saveAuthProfileStore(store, params.agentDir);
+			return store;
+		});
+	} catch {
+		return null;
+	}
+}
+function loadAuthProfileStore() {
+	const asStore = loadPersistedAuthProfileStore();
+	if (asStore) return overlayExternalAuthProfiles(asStore);
+	const legacy = loadLegacyAuthProfileStore();
+	if (legacy) {
+		const store = {
+			version: 1,
+			profiles: {}
+		};
+		applyLegacyAuthStore(store, legacy);
+		return overlayExternalAuthProfiles(store);
+	}
+	return overlayExternalAuthProfiles({
+		version: 1,
+		profiles: {}
+	});
+}
+function loadAuthProfileStoreForAgent(agentDir, options) {
+	const readOnly = options?.readOnly === true;
+	const authPath = resolveAuthStorePath(agentDir);
+	const statePath = resolveAuthStatePath(agentDir);
+	const authMtimeMs = readAuthStoreMtimeMs(authPath);
+	const stateMtimeMs = readAuthStoreMtimeMs(statePath);
+	if (!readOnly) {
+		const cached = readCachedAuthProfileStore({
+			authPath,
+			authMtimeMs,
+			stateMtimeMs
+		});
+		if (cached) return cached;
+	}
+	const asStore = loadPersistedAuthProfileStore(agentDir);
+	if (asStore) {
+		if (!readOnly) writeCachedAuthProfileStore({
+			authPath,
+			authMtimeMs: readAuthStoreMtimeMs(authPath),
+			stateMtimeMs: readAuthStoreMtimeMs(statePath),
+			store: asStore
+		});
+		return asStore;
+	}
+	if (agentDir && !readOnly) {
+		const mainStore = loadPersistedAuthProfileStore();
+		if (mainStore && Object.keys(mainStore.profiles).length > 0) {
+			saveJsonFile(authPath, buildPersistedAuthProfileSecretsStore(mainStore));
+			log$1.info("inherited auth-profiles from main agent", { agentDir });
+			const inherited = {
+				version: mainStore.version,
+				profiles: { ...mainStore.profiles }
+			};
+			writeCachedAuthProfileStore({
+				authPath,
+				authMtimeMs: readAuthStoreMtimeMs(authPath),
+				stateMtimeMs: readAuthStoreMtimeMs(statePath),
+				store: inherited
+			});
+			return inherited;
+		}
+	}
+	const legacy = loadLegacyAuthProfileStore(agentDir);
+	const store = {
+		version: 1,
+		profiles: {}
+	};
+	if (legacy) applyLegacyAuthStore(store, legacy);
+	const mergedOAuth = mergeOAuthFileIntoStore(store);
+	const forceReadOnly = process.env.GENESIS_AUTH_STORE_READONLY === "1";
+	const shouldWrite = !readOnly && !forceReadOnly && (legacy !== null || mergedOAuth);
+	if (shouldWrite) saveAuthProfileStore(store, agentDir);
+	if (shouldWrite && legacy !== null) {
+		const legacyPath = resolveLegacyAuthStorePath(agentDir);
+		try {
+			fs.unlinkSync(legacyPath);
+		} catch (err) {
+			if (err?.code !== "ENOENT") log$1.warn("failed to delete legacy auth.json after migration", {
+				err,
+				legacyPath
+			});
+		}
+	}
+	if (!readOnly) writeCachedAuthProfileStore({
+		authPath,
+		authMtimeMs: readAuthStoreMtimeMs(authPath),
+		stateMtimeMs: readAuthStoreMtimeMs(statePath),
+		store
+	});
+	return store;
+}
+function loadAuthProfileStoreForRuntime(agentDir, options) {
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return overlayExternalAuthProfiles(store, { agentDir });
+	return overlayExternalAuthProfiles(mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store), { agentDir });
+}
+function loadAuthProfileStoreForSecretsRuntime(agentDir) {
+	return loadAuthProfileStoreForRuntime(agentDir, {
+		readOnly: true,
+		allowKeychainPrompt: false
+	});
+}
+function loadAuthProfileStoreWithoutExternalProfiles(agentDir) {
+	const options = {
+		readOnly: true,
+		allowKeychainPrompt: false
+	};
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return store;
+	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+}
+function ensureAuthProfileStore(agentDir, options) {
+	return overlayExternalAuthProfiles(ensureAuthProfileStoreWithoutExternalProfiles(agentDir, options), { agentDir });
+}
+function ensureAuthProfileStoreWithoutExternalProfiles(agentDir, options) {
+	const runtimeStore = resolveRuntimeAuthProfileStore(agentDir);
+	if (runtimeStore) return runtimeStore;
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return store;
+	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+}
+function findPersistedAuthProfileCredential(params) {
+	const requestedProfile = loadPersistedAuthProfileStore(params.agentDir)?.profiles[params.profileId];
+	if (requestedProfile || !params.agentDir) return requestedProfile;
+	if (resolveAuthStorePath(params.agentDir) === resolveAuthStorePath()) return requestedProfile;
+	return loadPersistedAuthProfileStore()?.profiles[params.profileId];
+}
+function ensureAuthProfileStoreForLocalUpdate(agentDir) {
+	const store = loadAuthProfileStoreForAgent(agentDir, { syncExternalCli: false });
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return store;
+	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, {
+		readOnly: true,
+		syncExternalCli: false
+	}), store);
+}
+function replaceRuntimeAuthProfileStoreSnapshots(entries) {
+	replaceRuntimeAuthProfileStoreSnapshots$1(entries);
+}
+function clearRuntimeAuthProfileStoreSnapshots() {
+	clearRuntimeAuthProfileStoreSnapshots$1();
+	loadedAuthStoreCache.clear();
+}
+function saveAuthProfileStore(store, agentDir, options) {
+	const authPath = resolveAuthStorePath(agentDir);
+	const statePath = resolveAuthStatePath(agentDir);
+	saveJsonFile(authPath, buildPersistedAuthProfileSecretsStore(store, ({ profileId, credential }) => {
+		if (credential.type !== "oauth") return true;
+		if (options?.filterExternalAuthProfiles === false) return true;
+		return shouldPersistExternalAuthProfile({
+			store,
+			profileId,
+			credential,
+			agentDir
+		});
+	}));
+	savePersistedAuthProfileState(store, agentDir);
+	const runtimeStore = cloneAuthProfileStore(store);
+	writeCachedAuthProfileStore({
+		authPath,
+		authMtimeMs: readAuthStoreMtimeMs(authPath),
+		stateMtimeMs: readAuthStoreMtimeMs(statePath),
+		store: runtimeStore
+	});
+	if (hasRuntimeAuthProfileStoreSnapshot(agentDir)) setRuntimeAuthProfileStoreSnapshot(runtimeStore, agentDir);
+}
+//#endregion
+export { CLAUDE_CLI_PROFILE_ID as A, DEFAULT_OAUTH_REFRESH_MARGIN_MS as C, readClaudeCliCredentialsCached as D, resolveTokenExpiryState as E, OAUTH_REFRESH_CALL_TIMEOUT_MS as M, OAUTH_REFRESH_LOCK_OPTIONS as N, readCodexCliCredentialsCached as O, log$1 as P, shouldReplaceStoredOAuthCredential as S, hasUsableOAuthCredential$1 as T, areOAuthCredentialsEquivalent as _, findPersistedAuthProfileCredential as a, isSafeToAdoptMainStoreOAuthIdentity as b, loadAuthProfileStoreForSecretsRuntime as c, saveAuthProfileStore as d, updateAuthProfileStoreWithLock as f, readManagedExternalCliCredential as g, ensureAuthStoreFile as h, ensureAuthProfileStoreWithoutExternalProfiles as i, CODEX_CLI_PROFILE_ID as j, AUTH_STORE_LOCK_OPTIONS as k, loadAuthProfileStoreWithoutExternalProfiles as l, loadPersistedAuthProfileStore as m, ensureAuthProfileStore as n, loadAuthProfileStore as o, coercePersistedAuthProfileStore as p, ensureAuthProfileStoreForLocalUpdate as r, loadAuthProfileStoreForRuntime as s, clearRuntimeAuthProfileStoreSnapshots as t, replaceRuntimeAuthProfileStoreSnapshots as u, hasUsableOAuthCredential as v, evaluateStoredCredentialEligibility as w, shouldBootstrapFromExternalCliCredential as x, isSafeToAdoptBootstrapOAuthIdentity as y };