@theokit/sdk 5.13.0 → 5.14.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 5.14.0
+
+### Minor Changes
+
+- [#859](https://github.com/usetheokit/theokit-sdk/pull/859) [`3f2e8fb`](https://github.com/usetheokit/theokit-sdk/commit/3f2e8fbdd14a06dc2bf65a0a97265b339d388843) Thanks [@usetheodev](https://github.com/usetheodev)! - An application can ship skills in its own package and gate them on a binary. `skills.bundledDirs`
+  lists extra skill roots read after the project roots and plugin bundles, so a workspace skill of the
+  same name always wins. A skill declaring `requires-bins: git, rg` in its frontmatter is not offered
+  to the model while one of those executables is absent from PATH; `skills.get(name)` still resolves
+  it. `SkillReadTool.create` also accepts a function returning the skills, evaluated on every call, so
+  a skill discovered after the agent was created is readable by the model.
+
+- [#859](https://github.com/usetheokit/theokit-sdk/pull/859) [`8469d37`](https://github.com/usetheokit/theokit-sdk/commit/8469d37b56e3c4551f90b8707c55d4ed79c5621b) Thanks [@usetheodev](https://github.com/usetheodev)! - The OAuth ID token is now kept from the token response to the credential file ([#821](https://github.com/usetheokit/theokit-sdk/issues/821)). `exchangeCode`,
+  `refreshOAuthTokens`, `pollDeviceToken` and `openaiDeviceLogin` return it as `OAuthTokens.idToken` when
+  the provider sends a non-empty `id_token`, `persistOAuthTokens` writes it as `id_token`, and
+  `readStoredOAuth` reads it back on `StoredOAuthCredential.id_token`. `ensureFreshCredential` keeps the
+  stored ID token when a refresh response has none and stores the new one when it has one. It used to be
+  read only to derive the account id and then dropped, so a consumer that drives the Codex CLI, which reads
+  the plan and account from the ID token's claims, had to run its own login. A provider that sends no ID
+  token gets exactly the file it got before. A file that holds an `id_token` is refused by the read schema
+  of earlier SDK versions, so a store shared with an older reader should stay on one version.
+
+- [#859](https://github.com/usetheokit/theokit-sdk/pull/859) [`f43cea5`](https://github.com/usetheokit/theokit-sdk/commit/f43cea503a2af8a2ca3ed842dbd0bb6d5732f7e9) Thanks [@usetheodev](https://github.com/usetheodev)! - A run can now stop resending old tool results to the model. Every tool result used to be resent on
+  every later LLM call of a run, so a run whose tools print a lot grew its request by that output on
+  every round. The new per-send option `pruneToolResults: { olderThanRounds: n }` replaces the
+  content of each tool result older than `n` tool rounds with a short stub in the request the agent
+  loop sends. The stub keeps the result's `toolUseId` and `isError`. The transcript the run keeps,
+  persists and resumes from stays whole, so the stub applies only to the request. The option is off by default, and
+  without it the request is unchanged. `olderThanRounds` must be an integer of at least 1. Any other
+  value fails the send with `ConfigurationError` code `invalid_prune_tool_results` before any provider
+  call. The option type is exported as `PruneToolResultsOptions`.
+  Pruning trades request size against prefix-cache reuse: each new round stubs one more previously
+  sent result, so on providers that cache message prefixes the cached prefix ends earlier. That cost
+  was not measured.
+
 ## 5.13.0
 
 ### Minor Changes

package/dist/{agent-iW5kPpfT.d.cts → agent-DExqjqYy.d.cts}

@@ -1,4 +1,4 @@
-import { W as MemoryFact, T as MemoryAdapter, V as MemoryContext, aU as SystemPromptSkillRef, M as McpServerConfig, C as ContextSettings, P as ProviderRoutingSettings, a as PluginsSettings, c as Processor, S as SDKAgent } from './sdk-agent-4-dXI2GS.cjs';
+import { W as MemoryFact, T as MemoryAdapter, V as MemoryContext, aV as SystemPromptSkillRef, M as McpServerConfig, C as ContextSettings, P as ProviderRoutingSettings, a as PluginsSettings, c as Processor, S as SDKAgent } from './sdk-agent-DwzHcuxy.cjs';
 import { M as ModelSelection, C as CustomTool, P as PermissionMode } from './agent-prims-CZyxfCmS.cjs';
 
 /**
@@ -224,6 +224,8 @@ interface Skill$1 {
     source: string;
     category?: string;
     dependencies?: string[];
+    /** `requires-bins` — executables that must be on PATH for the model to be offered this skill. */
+    requiresBins?: string[];
     /** `disable-model-invocation: true` — the model is never told this skill exists. */
     disableModelInvocation?: boolean;
     /** `user-invocable: false` — carried for a host that has a picker; this SDK has no such surface. */
@@ -1377,6 +1379,12 @@ interface SkillsSettings {
      * default `<cwd>/.theokit/skills`. Absent ⇒ the default root.
      */
     skillsDir?: string;
+    /**
+     * B-546 — directories (each containing `<name>/SKILL.md`) an application ships inside its own
+     * package. They are read AFTER the project roots and plugin bundles, so a workspace skill of the
+     * same name always wins, and they are kept even when `skillsDir` replaces the default roots.
+     */
+    bundledDirs?: string[];
     /**
      * M22 — code-defined skills (from `createSkill`) merged with the discovered ones. An inline skill
      * overrides a discovered file skill of the same name.

package/dist/{agent-DSMuwADp.d.ts → agent-Dfw3VsIX.d.ts}

@@ -1,4 +1,4 @@
-import { W as MemoryFact, T as MemoryAdapter, V as MemoryContext, aU as SystemPromptSkillRef, M as McpServerConfig, C as ContextSettings, P as ProviderRoutingSettings, a as PluginsSettings, c as Processor, S as SDKAgent } from './sdk-agent-CTOJlWA_.js';
+import { W as MemoryFact, T as MemoryAdapter, V as MemoryContext, aV as SystemPromptSkillRef, M as McpServerConfig, C as ContextSettings, P as ProviderRoutingSettings, a as PluginsSettings, c as Processor, S as SDKAgent } from './sdk-agent-a3fW1xUK.js';
 import { M as ModelSelection, C as CustomTool, P as PermissionMode } from './agent-prims-CZyxfCmS.js';
 
 /**
@@ -224,6 +224,8 @@ interface Skill$1 {
     source: string;
     category?: string;
     dependencies?: string[];
+    /** `requires-bins` — executables that must be on PATH for the model to be offered this skill. */
+    requiresBins?: string[];
     /** `disable-model-invocation: true` — the model is never told this skill exists. */
     disableModelInvocation?: boolean;
     /** `user-invocable: false` — carried for a host that has a picker; this SDK has no such surface. */
@@ -1377,6 +1379,12 @@ interface SkillsSettings {
      * default `<cwd>/.theokit/skills`. Absent ⇒ the default root.
      */
     skillsDir?: string;
+    /**
+     * B-546 — directories (each containing `<name>/SKILL.md`) an application ships inside its own
+     * package. They are read AFTER the project roots and plugin bundles, so a workspace skill of the
+     * same name always wins, and they are kept even when `skillsDir` replaces the default roots.
+     */
+    bundledDirs?: string[];
     /**
      * M22 — code-defined skills (from `createSkill`) merged with the discovered ones. An inline skill
      * overrides a discovered file skill of the same name.

package/dist/{agent-5DSDDH7K.js → agent-T34LCGQM.js}

@@ -1,6 +1,6 @@
-export { Agent } from './chunk-JX4LB6XO.js';
+export { Agent } from './chunk-GARVAUCU.js';
 import './chunk-HWMGR3HA.js';
-import './chunk-XOYNB3YN.js';
+import './chunk-3ONIVO2I.js';
 import './chunk-K2BQQ445.js';
 import './chunk-2C24NSNV.js';
 import './chunk-HJ2LV464.js';
@@ -10,7 +10,7 @@ import './chunk-H73MEMQB.js';
 import './chunk-QK2ERTO3.js';
 import './chunk-DF77RBF4.js';
 import './chunk-AB4OPJLD.js';
-import './chunk-2PRGRYEQ.js';
+import './chunk-ZOL3L4EH.js';
 import './chunk-5AR6O7GW.js';
 import './chunk-2XC6KDJM.js';
 import './chunk-ZJAYFSVI.js';
@@ -27,7 +27,7 @@ import './chunk-FJWQP6EE.js';
 import './chunk-NAF4L3T6.js';
 import './chunk-VZGE7NAI.js';
 import './chunk-6X6ID4MO.js';
-import './chunk-NHOEXFZT.js';
+import './chunk-2HXTNVLM.js';
 import './chunk-4QCJAJAG.js';
 import './chunk-SAGRF4IB.js';
 import './chunk-PKRPV3R7.js';
@@ -47,16 +47,16 @@ import './chunk-RN3XDZGS.js';
 import './chunk-YMVTUV5K.js';
 import './chunk-Q7UG242V.js';
 import './chunk-SZQFCHU6.js';
-import './chunk-2SFLLOMN.js';
+import './chunk-NVQSBRG6.js';
 import './chunk-R7WIIPUR.js';
-import './chunk-NKQVLWDF.js';
-import './chunk-5HSMH2ZZ.js';
+import './chunk-ULEK4OM4.js';
+import './chunk-CJN5CEI3.js';
 import './chunk-AGACYRJ2.js';
-import './chunk-3FSBE4PS.js';
-import './chunk-MS3TQSXU.js';
+import './chunk-3GTN4HOO.js';
+import './chunk-QD6B6W6I.js';
 import './chunk-5IUDICRK.js';
 import './chunk-Q7GYMXVC.js';
 import './chunk-TNFOU6SB.js';
 import './chunk-3OY6H3I7.js';
-//# sourceMappingURL=agent-5DSDDH7K.js.map
-//# sourceMappingURL=agent-5DSDDH7K.js.map
+//# sourceMappingURL=agent-T34LCGQM.js.map
+//# sourceMappingURL=agent-T34LCGQM.js.map

package/dist/{agent-5DSDDH7K.js.map → agent-T34LCGQM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-5DSDDH7K.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-T34LCGQM.js"}

package/dist/{agent-WOMRT3KX.cjs → agent-TL4K7BTG.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkKL7ZUMK3_cjs = require('./chunk-KL7ZUMK3.cjs');
+var chunk2WY2OFSC_cjs = require('./chunk-2WY2OFSC.cjs');
 require('./chunk-L7JPXZ2C.cjs');
-require('./chunk-DVP3YMDA.cjs');
+require('./chunk-LXG6VL6R.cjs');
 require('./chunk-BUUUWQMB.cjs');
 require('./chunk-CWQPQTUZ.cjs');
 require('./chunk-7YUPSBDV.cjs');
@@ -12,7 +12,7 @@ require('./chunk-GHX4P3V2.cjs');
 require('./chunk-RS7YQR4X.cjs');
 require('./chunk-SDZ4XDWS.cjs');
 require('./chunk-6OCJWGVD.cjs');
-require('./chunk-4UYHP6NF.cjs');
+require('./chunk-SNVYOX46.cjs');
 require('./chunk-SXH37C7X.cjs');
 require('./chunk-YJNYDJ2T.cjs');
 require('./chunk-NP362THY.cjs');
@@ -29,7 +29,7 @@ require('./chunk-YSTXFWQE.cjs');
 require('./chunk-FRITRLZQ.cjs');
 require('./chunk-H7HD6RXO.cjs');
 require('./chunk-NINIJCHU.cjs');
-require('./chunk-7WARNHWW.cjs');
+require('./chunk-3UMPP553.cjs');
 require('./chunk-SWALPLFQ.cjs');
 require('./chunk-IJ7M6GOG.cjs');
 require('./chunk-3KIUY67P.cjs');
@@ -49,13 +49,13 @@ require('./chunk-WDVG5R2Q.cjs');
 require('./chunk-YQ3XC6C2.cjs');
 require('./chunk-6XQLTQB6.cjs');
 require('./chunk-KX5QXLBS.cjs');
-require('./chunk-NWWTYBD3.cjs');
+require('./chunk-4KBI37F3.cjs');
 require('./chunk-3EE6LVWT.cjs');
-require('./chunk-LO6LIUZ6.cjs');
-require('./chunk-S46WJTDL.cjs');
+require('./chunk-R5UQL2R5.cjs');
+require('./chunk-4TEGFMSP.cjs');
 require('./chunk-NVXXWAU7.cjs');
-require('./chunk-5A4UFBHW.cjs');
-require('./chunk-QISSETTG.cjs');
+require('./chunk-A77UMVMD.cjs');
+require('./chunk-5645PMVU.cjs');
 require('./chunk-IOFMRS6T.cjs');
 require('./chunk-EHD25JBZ.cjs');
 require('./chunk-CEGU5AVD.cjs');
@@ -65,7 +65,7 @@ require('./chunk-RNXXYF22.cjs');
 
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkKL7ZUMK3_cjs.Agent; }
+  get: function () { return chunk2WY2OFSC_cjs.Agent; }
 });
-//# sourceMappingURL=agent-WOMRT3KX.cjs.map
-//# sourceMappingURL=agent-WOMRT3KX.cjs.map
+//# sourceMappingURL=agent-TL4K7BTG.cjs.map
+//# sourceMappingURL=agent-TL4K7BTG.cjs.map

package/dist/{agent-WOMRT3KX.cjs.map → agent-TL4K7BTG.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-WOMRT3KX.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-TL4K7BTG.cjs"}

package/dist/auth/index.cjs

@@ -1,8 +1,8 @@
 'use strict';
 
 var chunkFRITRLZQ_cjs = require('../chunk-FRITRLZQ.cjs');
-var chunk5A4UFBHW_cjs = require('../chunk-5A4UFBHW.cjs');
-var chunkQISSETTG_cjs = require('../chunk-QISSETTG.cjs');
+var chunkA77UMVMD_cjs = require('../chunk-A77UMVMD.cjs');
+var chunk5645PMVU_cjs = require('../chunk-5645PMVU.cjs');
 var chunkIOFMRS6T_cjs = require('../chunk-IOFMRS6T.cjs');
 require('../chunk-EHD25JBZ.cjs');
 require('../chunk-CEGU5AVD.cjs');
@@ -104,7 +104,8 @@ async function pollDeviceToken(config, grant, deps) {
         // token as the refresh handle.
         refresh: data.refresh_token ?? data.access_token,
         expires: deps.now() + expiresIn * 1e3,
-        ...accountId !== void 0 ? { accountId } : {}
+        ...accountId !== void 0 ? { accountId } : {},
+        ...typeof data.id_token === "string" && data.id_token.length > 0 ? { idToken: data.id_token } : {}
       };
     }
     if (data.error === "authorization_pending") {
@@ -202,7 +203,7 @@ async function openaiDeviceLogin(config, deps, hooks) {
           "device poll returned no authorization_code"
         );
       }
-      const tokens = await chunk5A4UFBHW_cjs.exchangeCode(
+      const tokens = await chunkA77UMVMD_cjs.exchangeCode(
         config,
         { code: data.authorization_code, verifier: data.code_verifier },
         deps
@@ -250,51 +251,51 @@ Object.defineProperty(exports, "providerFromApiKeyPrefix", {
 });
 Object.defineProperty(exports, "ensureFreshCredential", {
   enumerable: true,
-  get: function () { return chunk5A4UFBHW_cjs.ensureFreshCredential; }
+  get: function () { return chunkA77UMVMD_cjs.ensureFreshCredential; }
 });
 Object.defineProperty(exports, "exchangeCode", {
   enumerable: true,
-  get: function () { return chunk5A4UFBHW_cjs.exchangeCode; }
+  get: function () { return chunkA77UMVMD_cjs.exchangeCode; }
 });
 Object.defineProperty(exports, "persistOAuthTokens", {
   enumerable: true,
-  get: function () { return chunk5A4UFBHW_cjs.persistOAuthTokens; }
+  get: function () { return chunkA77UMVMD_cjs.persistOAuthTokens; }
 });
 Object.defineProperty(exports, "refreshOAuthTokens", {
   enumerable: true,
-  get: function () { return chunk5A4UFBHW_cjs.refreshOAuthTokens; }
+  get: function () { return chunkA77UMVMD_cjs.refreshOAuthTokens; }
 });
 Object.defineProperty(exports, "resolveCredential", {
   enumerable: true,
-  get: function () { return chunk5A4UFBHW_cjs.resolveCredential; }
+  get: function () { return chunkA77UMVMD_cjs.resolveCredential; }
 });
 Object.defineProperty(exports, "CredentialError", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.CredentialError; }
+  get: function () { return chunk5645PMVU_cjs.CredentialError; }
 });
 Object.defineProperty(exports, "assertSecureModes", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.assertSecureModes; }
+  get: function () { return chunk5645PMVU_cjs.assertSecureModes; }
 });
 Object.defineProperty(exports, "authFilePath", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.authFilePath; }
+  get: function () { return chunk5645PMVU_cjs.authFilePath; }
 });
 Object.defineProperty(exports, "credentialHome", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.credentialHome; }
+  get: function () { return chunk5645PMVU_cjs.credentialHome; }
 });
 Object.defineProperty(exports, "readAuthFile", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.readAuthFile; }
+  get: function () { return chunk5645PMVU_cjs.readAuthFile; }
 });
 Object.defineProperty(exports, "readStoredOAuth", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.readStoredOAuth; }
+  get: function () { return chunk5645PMVU_cjs.readStoredOAuth; }
 });
 Object.defineProperty(exports, "writeCredential", {
   enumerable: true,
-  get: function () { return chunkQISSETTG_cjs.writeCredential; }
+  get: function () { return chunk5645PMVU_cjs.writeCredential; }
 });
 exports.deviceLogin = deviceLogin;
 exports.extractAccountId = extractAccountId;

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":["AuthCallbackError","exchangeCode"],"mappings":";;;;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAIA,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAMC,8BAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAID,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":["AuthCallbackError","exchangeCode"],"mappings":";;;;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,QAC/C,GAAI,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,CAAS,MAAA,GAAS,CAAA,GAC5D,EAAE,OAAA,EAAS,IAAA,CAAK,QAAA,KAChB;AAAC,OACP;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAIA,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAMC,8BAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAID,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n        ...(typeof data.id_token === \"string\" && data.id_token.length > 0\n          ? { idToken: data.id_token }\n          : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/auth/index.js

@@ -1,7 +1,7 @@
 export { providerFromApiKeyPrefix } from '../chunk-NAF4L3T6.js';
-import { exchangeCode } from '../chunk-3FSBE4PS.js';
-export { ensureFreshCredential, exchangeCode, persistOAuthTokens, refreshOAuthTokens, resolveCredential } from '../chunk-3FSBE4PS.js';
-export { CredentialError, assertSecureModes, authFilePath, credentialHome, readAuthFile, readStoredOAuth, writeCredential } from '../chunk-MS3TQSXU.js';
+import { exchangeCode } from '../chunk-3GTN4HOO.js';
+export { ensureFreshCredential, exchangeCode, persistOAuthTokens, refreshOAuthTokens, resolveCredential } from '../chunk-3GTN4HOO.js';
+export { CredentialError, assertSecureModes, authFilePath, credentialHome, readAuthFile, readStoredOAuth, writeCredential } from '../chunk-QD6B6W6I.js';
 import { AuthCallbackError } from '../chunk-5IUDICRK.js';
 import '../chunk-Q7GYMXVC.js';
 import '../chunk-TNFOU6SB.js';
@@ -103,7 +103,8 @@ async function pollDeviceToken(config, grant, deps) {
         // token as the refresh handle.
         refresh: data.refresh_token ?? data.access_token,
         expires: deps.now() + expiresIn * 1e3,
-        ...accountId !== void 0 ? { accountId } : {}
+        ...accountId !== void 0 ? { accountId } : {},
+        ...typeof data.id_token === "string" && data.id_token.length > 0 ? { idToken: data.id_token } : {}
       };
     }
     if (data.error === "authorization_pending") {

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,QAC/C,GAAI,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,CAAS,MAAA,GAAS,CAAA,GAC5D,EAAE,OAAA,EAAS,IAAA,CAAK,QAAA,KAChB;AAAC,OACP;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n        ...(typeof data.id_token === \"string\" && data.id_token.length > 0\n          ? { idToken: data.id_token }\n          : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/{chunk-NHOEXFZT.js → chunk-2HXTNVLM.js}

@@ -65,6 +65,8 @@ function buildFrontmatter(fields, parsed, name) {
   if (hasContent(fields.category)) result.category = fields.category;
   const deps = parseDependencies(fields.dependencies);
   if (deps !== void 0) result.dependencies = deps;
+  const bins = parseDependencies(fields["requires-bins"]);
+  if (bins !== void 0) result.requiresBins = bins;
   const disable = readAuthorizationFlag(parsed, "disable-model-invocation", name);
   if (disable !== void 0) result.disableModelInvocation = disable;
   const invocable = readAuthorizationFlag(parsed, "user-invocable", name);
@@ -129,6 +131,7 @@ function tryParseSkill(raw, fallbackName, source, options) {
     };
     if (frontmatter.category !== void 0) skill.category = frontmatter.category;
     if (frontmatter.dependencies !== void 0) skill.dependencies = frontmatter.dependencies;
+    if (frontmatter.requiresBins !== void 0) skill.requiresBins = frontmatter.requiresBins;
     if (frontmatter.disableModelInvocation !== void 0) {
       skill.disableModelInvocation = frontmatter.disableModelInvocation;
     }
@@ -166,5 +169,5 @@ ${lines.join("\n")}
 }
 
 export { buildSkillsBlock, discoverSkills, escapeBlockBody, loadSkillInstructions, stripSkillFrontmatter };
-//# sourceMappingURL=chunk-NHOEXFZT.js.map
-//# sourceMappingURL=chunk-NHOEXFZT.js.map
+//# sourceMappingURL=chunk-2HXTNVLM.js.map
+//# sourceMappingURL=chunk-2HXTNVLM.js.map