@xopcai/xopc 0.0.101 → 0.0.103

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/google-antigravity.js

@@ -1,6 +1,6 @@
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
-//#region src/auth/oauth/vendor-pi-google/google-antigravity.ts
+//#region src/auth/oauth/google-oauth/google-antigravity.ts
 let _createServer = null;
 let _httpImportPromise = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) _httpImportPromise = import("node:http").then((m) => {
@@ -28,7 +28,6 @@ const SCOPES = [
 ];
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const DEFAULT_PROJECT_ID = "rising-fact-p41fc";
 /**
 * Start a local HTTP server to receive the OAuth callback
 */
@@ -80,7 +79,7 @@ async function startCallbackServer() {
 		server.on("error", (err) => {
 			reject(err);
 		});
-		server.listen(51121, "127.0.0.1", () => {
+		server.listen(51121, () => {
 			resolve({
 				server,
 				cancelWait: () => {
@@ -140,8 +139,7 @@ async function discoverProject(accessToken, onProgress) {
 			if (data.cloudaicompanionProject && typeof data.cloudaicompanionProject === "object" && data.cloudaicompanionProject.id) return data.cloudaicompanionProject.id;
 		}
 	} catch {}
-	onProgress?.("Using default project...");
-	return DEFAULT_PROJECT_ID;
+	throw new Error("Failed to discover Google Cloud companion project");
 }
 /**
 * Get user email from the access token

package/dist/src/auth/oauth/google-oauth/google-antigravity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-antigravity.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/google-antigravity.ts"],"sourcesContent":["/**\n * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)\n * Uses different OAuth credentials than google-gemini-cli for access to additional models.\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype AntigravityCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst ANTIGRAVITY_CLIENT_ID_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_ID';\nconst ANTIGRAVITY_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_SECRET';\n\n/** Desktop OAuth client for this flow — must be set locally (not committed; avoids GitHub push protection). */\nfunction getAntigravityOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[ANTIGRAVITY_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[ANTIGRAVITY_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Antigravity OAuth requires ${ANTIGRAVITY_CLIENT_ID_ENV} and ${ANTIGRAVITY_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:51121/oauth-callback\";\n\n// Antigravity requires additional scopes\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n\t\"https://www.googleapis.com/auth/cclog\",\n\t\"https://www.googleapis.com/auth/experimentsandconfigs\",\n];\n\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Antigravity OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:51121`);\n\n\t\t\tif (url.pathname === \"/oauth-callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(51121, () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string | { id?: string };\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Discover or provision a project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"google-cloud-sdk vscode_cloudshelleditor/0.1\",\n\t\t\"Client-Metadata\": JSON.stringify({\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t}),\n\t};\n\n\t// Try endpoints in order: prod first, then sandbox\n\tconst endpoints = [\"https://cloudcode-pa.googleapis.com\", \"https://daily-cloudcode-pa.sandbox.googleapis.com\"];\n\n\tonProgress?.(\"Checking for existing project...\");\n\n\tfor (const endpoint of endpoints) {\n\t\ttry {\n\t\t\tconst loadResponse = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (loadResponse.ok) {\n\t\t\t\tconst data = (await loadResponse.json()) as LoadCodeAssistPayload;\n\n\t\t\t\t// Handle both string and object formats\n\t\t\t\tif (typeof data.cloudaicompanionProject === \"string\" && data.cloudaicompanionProject) {\n\t\t\t\t\treturn data.cloudaicompanionProject;\n\t\t\t\t}\n\t\t\t\tif (\n\t\t\t\t\tdata.cloudaicompanionProject &&\n\t\t\t\t\ttypeof data.cloudaicompanionProject === \"object\" &&\n\t\t\t\t\tdata.cloudaicompanionProject.id\n\t\t\t\t) {\n\t\t\t\t\treturn data.cloudaicompanionProject.id;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Try next endpoint\n\t\t}\n\t}\n\n\tthrow new Error(\"Failed to discover Google Cloud companion project\");\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Antigravity token\n */\nexport async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Antigravity token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Antigravity OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginAntigravity(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const antigravityOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-antigravity\",\n\tname: \"Antigravity (Gemini 3, Claude, GPT-OSS)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginAntigravity(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Antigravity credentials missing projectId\");\n\t\t}\n\t\treturn refreshAntigravityToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;;AAGtC,SAAS,4BAAwE;CAChF,MAAM,WAAW,QAAQ,IAAI,4BAA4B,MAAM;CAC/D,MAAM,eAAe,QAAQ,IAAI,gCAAgC,MAAM;AACvE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,qCAAqC,0BAA0B,OAAO,8BAA8B,GACpG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AAGrB,MAAM,SAAS;CACd;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,WAAW;AACjB,MAAM,YAAY;;;;AAYlB,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,8DAA8D;;AAG/E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,yBAAyB;AAE5D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,aAAa;AAC1B,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;;;;AAaX,eAAe,gBAAgB,aAAqB,YAAyD;CAC5G,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB,mBAAmB,KAAK,UAAU;GACjC,SAAS;GACT,UAAU;GACV,YAAY;GACZ,CAAC;EACF;CAGD,MAAM,YAAY,CAAC,uCAAuC,oDAAoD;AAE9G,cAAa,mCAAmC;AAEhD,MAAK,MAAM,YAAY,UACtB,KAAI;EACH,MAAM,eAAe,MAAM,MAAM,GAAG,SAAS,6BAA6B;GACzE,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,EACpB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,EACD,CAAC;GACF,CAAC;AAEF,MAAI,aAAa,IAAI;GACpB,MAAM,OAAQ,MAAM,aAAa,MAAM;AAGvC,OAAI,OAAO,KAAK,4BAA4B,YAAY,KAAK,wBAC5D,QAAO,KAAK;AAEb,OACC,KAAK,2BACL,OAAO,KAAK,4BAA4B,YACxC,KAAK,wBAAwB,GAE7B,QAAO,KAAK,wBAAwB;;SAG/B;AAKT,OAAM,IAAI,MAAM,oDAAoD;;;;;AAMrE,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;CAC9D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,qCAAqC,QAAQ;;CAG9D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,iBACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;AAG9D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,2BAAmD;CAC/D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,iBAAiB,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG7F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,4CAA4C;AAE7D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/google-gemini-cli.js

@@ -1,6 +1,6 @@
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
-//#region src/auth/oauth/vendor-pi-google/google-gemini-cli.ts
+//#region src/auth/oauth/google-oauth/google-gemini-cli.ts
 let _createServer = null;
 let _httpImportPromise = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) _httpImportPromise = import("node:http").then((m) => {
@@ -77,7 +77,7 @@ async function startCallbackServer() {
 		server.on("error", (err) => {
 			reject(err);
 		});
-		server.listen(8085, "127.0.0.1", () => {
+		server.listen(8085, () => {
 			resolve({
 				server,
 				cancelWait: () => {
@@ -105,7 +105,6 @@ function parseRedirectUrl(input) {
 	}
 }
 const TIER_FREE = "free-tier";
-const TIER_LEGACY = "legacy-tier";
 const TIER_STANDARD = "standard-tier";
 /**
 * Wait helper for onboarding retries
@@ -117,8 +116,8 @@ function wait(ms) {
 * Get default tier from allowed tiers
 */
 function getDefaultTier(allowedTiers) {
-	if (!allowedTiers || allowedTiers.length === 0) return { id: TIER_LEGACY };
-	return allowedTiers.find((t) => t.isDefault) ?? { id: TIER_LEGACY };
+	if (!allowedTiers || allowedTiers.length === 0) return { id: TIER_FREE };
+	return allowedTiers.find((t) => t.isDefault) ?? allowedTiers[0] ?? { id: TIER_FREE };
 }
 function isVpcScAffectedUser(payload) {
 	if (!payload || typeof payload !== "object") return false;

package/dist/src/auth/oauth/google-oauth/google-gemini-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-gemini-cli.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/google-gemini-cli.ts"],"sourcesContent":["/**\n * Gemini CLI OAuth flow (Google Cloud Code Assist)\n * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype GeminiCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst GEMINI_CLI_CLIENT_ID_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_ID';\nconst GEMINI_CLI_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_SECRET';\n\nfunction getGeminiCliOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[GEMINI_CLI_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[GEMINI_CLI_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Gemini CLI OAuth requires ${GEMINI_CLI_CLIENT_ID_ENV} and ${GEMINI_CLI_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:8085/oauth2callback\";\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n];\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\nconst CODE_ASSIST_ENDPOINT = \"https://cloudcode-pa.googleapis.com\";\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Gemini CLI OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:8085`);\n\n\t\t\tif (url.pathname === \"/oauth2callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(8085, () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string;\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Long-running operation response from onboardUser\n */\ninterface LongRunningOperationResponse {\n\tname?: string;\n\tdone?: boolean;\n\tresponse?: {\n\t\tcloudaicompanionProject?: { id?: string };\n\t};\n}\n\n// Tier IDs as used by the Cloud Code API\nconst TIER_FREE = \"free-tier\";\nconst TIER_STANDARD = \"standard-tier\";\n\ninterface GoogleRpcErrorResponse {\n\terror?: {\n\t\tdetails?: Array<{ reason?: string }>;\n\t};\n}\n\n/**\n * Wait helper for onboarding retries\n */\nfunction wait(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Get default tier from allowed tiers\n */\nfunction getDefaultTier(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): { id?: string } {\n\tif (!allowedTiers || allowedTiers.length === 0) return { id: TIER_FREE };\n\tconst defaultTier = allowedTiers.find((t) => t.isDefault);\n\treturn defaultTier ?? allowedTiers[0] ?? { id: TIER_FREE };\n}\n\nfunction isVpcScAffectedUser(payload: unknown): boolean {\n\tif (!payload || typeof payload !== \"object\") return false;\n\tif (!(\"error\" in payload)) return false;\n\tconst error = (payload as GoogleRpcErrorResponse).error;\n\tif (!error?.details || !Array.isArray(error.details)) return false;\n\treturn error.details.some((detail) => detail.reason === \"SECURITY_POLICY_VIOLATED\");\n}\n\n/**\n * Poll a long-running operation until completion\n */\nasync function pollOperation(\n\toperationName: string,\n\theaders: Record<string, string>,\n\tonProgress?: (message: string) => void,\n): Promise<LongRunningOperationResponse> {\n\tlet attempt = 0;\n\twhile (true) {\n\t\tif (attempt > 0) {\n\t\t\tonProgress?.(`Waiting for project provisioning (attempt ${attempt + 1})...`);\n\t\t\tawait wait(5000);\n\t\t}\n\n\t\tconst response = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal/${operationName}`, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to poll operation: ${response.status} ${response.statusText}`);\n\t\t}\n\n\t\tconst data = (await response.json()) as LongRunningOperationResponse;\n\t\tif (data.done) {\n\t\t\treturn data;\n\t\t}\n\n\t\tattempt += 1;\n\t}\n}\n\n/**\n * Discover or provision a Google Cloud project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\t// Check for user-provided project ID via environment variable\n\tconst envProjectId = process.env.GOOGLE_CLOUD_PROJECT || process.env.GOOGLE_CLOUD_PROJECT_ID;\n\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"gl-node/22.17.0\",\n\t};\n\n\t// Try to load existing project via loadCodeAssist\n\tonProgress?.(\"Checking for existing Cloud Code Assist project...\");\n\tconst loadResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify({\n\t\t\tcloudaicompanionProject: envProjectId,\n\t\t\tmetadata: {\n\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\tduetProject: envProjectId,\n\t\t\t},\n\t\t}),\n\t});\n\n\tlet data: LoadCodeAssistPayload;\n\n\tif (!loadResponse.ok) {\n\t\tlet errorPayload: unknown;\n\t\ttry {\n\t\t\terrorPayload = await loadResponse.clone().json();\n\t\t} catch {\n\t\t\terrorPayload = undefined;\n\t\t}\n\n\t\tif (isVpcScAffectedUser(errorPayload)) {\n\t\t\tdata = { currentTier: { id: TIER_STANDARD } };\n\t\t} else {\n\t\t\tconst errorText = await loadResponse.text();\n\t\t\tthrow new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);\n\t\t}\n\t} else {\n\t\tdata = (await loadResponse.json()) as LoadCodeAssistPayload;\n\t}\n\n\t// If user already has a current tier and project, use it\n\tif (data.currentTier) {\n\t\tif (data.cloudaicompanionProject) {\n\t\t\treturn data.cloudaicompanionProject;\n\t\t}\n\t\t// User has a tier but no managed project - they need to provide one via env var\n\t\tif (envProjectId) {\n\t\t\treturn envProjectId;\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\t// User needs to be onboarded - get the default tier\n\tconst tier = getDefaultTier(data.allowedTiers);\n\tconst tierId = tier?.id ?? TIER_FREE;\n\n\tif (tierId !== TIER_FREE && !envProjectId) {\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\tonProgress?.(\"Provisioning Cloud Code Assist project (this may take a moment)...\");\n\n\t// Build onboard request - for free tier, don't include project ID (Google provisions one)\n\t// For other tiers, include the user's project ID if available\n\tconst onboardBody: Record<string, unknown> = {\n\t\ttierId,\n\t\tmetadata: {\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t},\n\t};\n\n\tif (tierId !== TIER_FREE && envProjectId) {\n\t\tonboardBody.cloudaicompanionProject = envProjectId;\n\t\t(onboardBody.metadata as Record<string, unknown>).duetProject = envProjectId;\n\t}\n\n\t// Start onboarding - this returns a long-running operation\n\tconst onboardResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify(onboardBody),\n\t});\n\n\tif (!onboardResponse.ok) {\n\t\tconst errorText = await onboardResponse.text();\n\t\tthrow new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);\n\t}\n\n\tlet lroData = (await onboardResponse.json()) as LongRunningOperationResponse;\n\n\t// If the operation isn't done yet, poll until completion\n\tif (!lroData.done && lroData.name) {\n\t\tlroData = await pollOperation(lroData.name, headers, onProgress);\n\t}\n\n\t// Try to get project ID from the response\n\tconst projectId = lroData.response?.cloudaicompanionProject?.id;\n\tif (projectId) {\n\t\treturn projectId;\n\t}\n\n\t// If no project ID from onboarding, fall back to env var\n\tif (envProjectId) {\n\t\treturn envProjectId;\n\t}\n\n\tthrow new Error(\n\t\t\"Could not discover or provision a Google Cloud project. \" +\n\t\t\t\"Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t);\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Google Cloud Code Assist token\n */\nexport async function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Google Cloud token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Gemini CLI (Google Cloud Code Assist) OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginGeminiCli(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const geminiCliOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-gemini-cli\",\n\tname: \"Google Cloud Code Assist (Gemini CLI)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginGeminiCli(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Google Cloud credentials missing projectId\");\n\t\t}\n\t\treturn refreshGoogleCloudToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AAErC,SAAS,0BAAsE;CAC9E,MAAM,WAAW,QAAQ,IAAI,2BAA2B,MAAM;CAC9D,MAAM,eAAe,QAAQ,IAAI,+BAA+B,MAAM;AACtE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,oCAAoC,yBAAyB,OAAO,6BAA6B,GACjG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AACrB,MAAM,SAAS;CACd;CACA;CACA;CACA;AACD,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,uBAAuB;;;;AAW7B,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,6DAA6D;;AAG9E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,wBAAwB;AAE3D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,YAAY;AACzB,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;AAsBX,MAAM,YAAY;AAClB,MAAM,gBAAgB;;;;AAWtB,SAAS,KAAK,IAA2B;AACxC,QAAO,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;;;;;AAMzD,SAAS,eAAe,cAA6E;AACpG,KAAI,CAAC,gBAAgB,aAAa,WAAW,EAAG,QAAO,EAAE,IAAI,WAAW;AAExE,QADoB,aAAa,MAAM,MAAM,EAAE,UAC7B,IAAI,aAAa,MAAM,EAAE,IAAI,WAAW;;AAG3D,SAAS,oBAAoB,SAA2B;AACvD,KAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,KAAI,EAAE,WAAW,SAAU,QAAO;CAClC,MAAM,QAAS,QAAmC;AAClD,KAAI,CAAC,OAAO,WAAW,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAAE,QAAO;AAC7D,QAAO,MAAM,QAAQ,MAAM,WAAW,OAAO,WAAW,2BAA2B;;;;;AAMpF,eAAe,cACd,eACA,SACA,YACwC;CACxC,IAAI,UAAU;AACd,QAAO,MAAM;AACZ,MAAI,UAAU,GAAG;AAChB,gBAAa,6CAA6C,UAAU,EAAE,MAAM;AAC5E,SAAM,KAAK,IAAK;;EAGjB,MAAM,WAAW,MAAM,MAAM,GAAG,qBAAqB,cAAc,iBAAiB;GACnF,QAAQ;GACR;GACA,CAAC;AAEF,MAAI,CAAC,SAAS,GACb,OAAM,IAAI,MAAM,6BAA6B,SAAS,OAAO,GAAG,SAAS,aAAa;EAGvF,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,MAAI,KAAK,KACR,QAAO;AAGR,aAAW;;;;;;AAOb,eAAe,gBAAgB,aAAqB,YAAyD;CAE5G,MAAM,eAAe,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;CAErE,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB;AAGD,cAAa,qDAAqD;CAClE,MAAM,eAAe,MAAM,MAAM,GAAG,qBAAqB,6BAA6B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACpB,yBAAyB;GACzB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb;GACD,CAAC;EACF,CAAC;CAEF,IAAI;AAEJ,KAAI,CAAC,aAAa,IAAI;EACrB,IAAI;AACJ,MAAI;AACH,kBAAe,MAAM,aAAa,OAAO,CAAC,MAAM;UACzC;AACP,kBAAe,KAAA;;AAGhB,MAAI,oBAAoB,aAAa,CACpC,QAAO,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE;OACvC;GACN,MAAM,YAAY,MAAM,aAAa,MAAM;AAC3C,SAAM,IAAI,MAAM,0BAA0B,aAAa,OAAO,GAAG,aAAa,WAAW,IAAI,YAAY;;OAG1G,QAAQ,MAAM,aAAa,MAAM;AAIlC,KAAI,KAAK,aAAa;AACrB,MAAI,KAAK,wBACR,QAAO,KAAK;AAGb,MAAI,aACH,QAAO;AAER,QAAM,IAAI,MACT,iKAEA;;CAKF,MAAM,SADO,eAAe,KAAK,aACd,EAAE,MAAM;AAE3B,KAAI,WAAW,aAAa,CAAC,aAC5B,OAAM,IAAI,MACT,iKAEA;AAGF,cAAa,qEAAqE;CAIlF,MAAM,cAAuC;EAC5C;EACA,UAAU;GACT,SAAS;GACT,UAAU;GACV,YAAY;GACZ;EACD;AAED,KAAI,WAAW,aAAa,cAAc;AACzC,cAAY,0BAA0B;AACrC,cAAY,SAAqC,cAAc;;CAIjE,MAAM,kBAAkB,MAAM,MAAM,GAAG,qBAAqB,0BAA0B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,YAAY;EACjC,CAAC;AAEF,KAAI,CAAC,gBAAgB,IAAI;EACxB,MAAM,YAAY,MAAM,gBAAgB,MAAM;AAC9C,QAAM,IAAI,MAAM,uBAAuB,gBAAgB,OAAO,GAAG,gBAAgB,WAAW,IAAI,YAAY;;CAG7G,IAAI,UAAW,MAAM,gBAAgB,MAAM;AAG3C,KAAI,CAAC,QAAQ,QAAQ,QAAQ,KAC5B,WAAU,MAAM,cAAc,QAAQ,MAAM,SAAS,WAAW;CAIjE,MAAM,YAAY,QAAQ,UAAU,yBAAyB;AAC7D,KAAI,UACH,QAAO;AAIR,KAAI,aACH,QAAO;AAGR,OAAM,IAAI,MACT,uMAGA;;;;;AAMF,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;CAC5D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,sCAAsC,QAAQ;;CAG/D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,eACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;AAG5D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,eAAe,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG3F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,6CAA6C;AAE9D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/oauth-page.js

@@ -1,5 +1,5 @@
-//#region src/auth/oauth/vendor-pi-google/oauth-page.ts
-const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg>`;
+//#region src/auth/oauth/google-oauth/oauth-page.ts
+const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 72 72" aria-hidden="true"><rect width="72" height="72" rx="20" fill="#2563eb"/><path d="M22 22l28 28M50 22L22 50" stroke="#fff" stroke-width="8" stroke-linecap="round"/></svg>`;
 function escapeHtml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
 }
@@ -44,11 +44,19 @@ function renderPage(options) {
       align-items: center;
       justify-content: center;
     }
+    .brand {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      gap: 10px;
+      margin-bottom: 24px;
+      font-weight: 700;
+      letter-spacing: -0.02em;
+    }
     .logo {
       width: 72px;
       height: 72px;
       display: block;
-      margin-bottom: 24px;
     }
     h1 {
       margin: 0 0 10px;
@@ -75,7 +83,7 @@ function renderPage(options) {
 </head>
 <body>
   <main>
-    <div class="logo">${LOGO_SVG}</div>
+    <div class="brand"><div class="logo">${LOGO_SVG}</div><div>xopc</div></div>
     <h1>${heading}</h1>
     <p>${message}</p>
     ${details ? `<div class="details">${details}</div>` : ""}

package/dist/src/auth/oauth/google-oauth/oauth-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-page.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/oauth-page.ts"],"sourcesContent":["const LOGO_SVG = `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 72 72\" aria-hidden=\"true\"><rect width=\"72\" height=\"72\" rx=\"20\" fill=\"#2563eb\"/><path d=\"M22 22l28 28M50 22L22 50\" stroke=\"#fff\" stroke-width=\"8\" stroke-linecap=\"round\"/></svg>`;\n\nfunction escapeHtml(value: string): string {\n\treturn value\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#39;\");\n}\n\nfunction renderPage(options: { title: string; heading: string; message: string; details?: string }): string {\n\tconst title = escapeHtml(options.title);\n\tconst heading = escapeHtml(options.heading);\n\tconst message = escapeHtml(options.message);\n\tconst details = options.details ? escapeHtml(options.details) : undefined;\n\n\treturn `<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>${title}</title>\n  <style>\n    :root {\n      --text: #fafafa;\n      --text-dim: #a1a1aa;\n      --page-bg: #09090b;\n      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, \"Noto Sans\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\";\n      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace;\n    }\n    * { box-sizing: border-box; }\n    html { color-scheme: dark; }\n    body {\n      margin: 0;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 24px;\n      background: var(--page-bg);\n      color: var(--text);\n      font-family: var(--font-sans);\n      text-align: center;\n    }\n    main {\n      width: 100%;\n      max-width: 560px;\n      display: flex;\n      flex-direction: column;\n      align-items: center;\n      justify-content: center;\n    }\n    .brand {\n      display: flex;\n      flex-direction: column;\n      align-items: center;\n      gap: 10px;\n      margin-bottom: 24px;\n      font-weight: 700;\n      letter-spacing: -0.02em;\n    }\n    .logo {\n      width: 72px;\n      height: 72px;\n      display: block;\n    }\n    h1 {\n      margin: 0 0 10px;\n      font-size: 28px;\n      line-height: 1.15;\n      font-weight: 650;\n      color: var(--text);\n    }\n    p {\n      margin: 0;\n      line-height: 1.7;\n      color: var(--text-dim);\n      font-size: 15px;\n    }\n    .details {\n      margin-top: 16px;\n      font-family: var(--font-mono);\n      font-size: 13px;\n      color: var(--text-dim);\n      white-space: pre-wrap;\n      word-break: break-word;\n    }\n  </style>\n</head>\n<body>\n  <main>\n    <div class=\"brand\"><div class=\"logo\">${LOGO_SVG}</div><div>xopc</div></div>\n    <h1>${heading}</h1>\n    <p>${message}</p>\n    ${details ? `<div class=\"details\">${details}</div>` : \"\"}\n  </main>\n</body>\n</html>`;\n}\n\nexport function oauthSuccessHtml(message: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication successful\",\n\t\theading: \"Authentication successful\",\n\t\tmessage,\n\t});\n}\n\nexport function oauthErrorHtml(message: string, details?: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication failed\",\n\t\theading: \"Authentication failed\",\n\t\tmessage,\n\t\tdetails,\n\t});\n}\n"],"mappings":";AAAA,MAAM,WAAW;AAEjB,SAAS,WAAW,OAAuB;AAC1C,QAAO,MACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,QAAQ;;AAG3B,SAAS,WAAW,SAAwF;CAC3G,MAAM,QAAQ,WAAW,QAAQ,MAAM;CACvC,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,QAAQ,UAAU,WAAW,QAAQ,QAAQ,GAAG,KAAA;AAEhE,QAAO;;;;;WAKG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAsE0B,SAAS;UAC1C,QAAQ;SACT,QAAQ;MACX,UAAU,wBAAwB,QAAQ,UAAU,GAAG;;;;;AAM7D,SAAgB,iBAAiB,SAAyB;AACzD,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA,CAAC;;AAGH,SAAgB,eAAe,SAAiB,SAA0B;AACzE,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA;EACA,CAAC"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/pkce.d.ts

@@ -4,7 +4,7 @@
  */
 /**
  * Generate PKCE code verifier and challenge.
- * Uses Web Crypto API for cross-platform compatibility.
+ * Uses Web Crypto API.
  */
 export declare function generatePKCE(): Promise<{
     verifier: string;

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/pkce.js

@@ -1,4 +1,4 @@
-//#region src/auth/oauth/vendor-pi-google/pkce.ts
+//#region src/auth/oauth/google-oauth/pkce.ts
 /**
 * PKCE utilities using Web Crypto API.
 * Works in both Node.js 20+ and browsers.
@@ -13,7 +13,7 @@ function base64urlEncode(bytes) {
 }
 /**
 * Generate PKCE code verifier and challenge.
-* Uses Web Crypto API for cross-platform compatibility.
+* Uses Web Crypto API.
 */
 async function generatePKCE() {
 	const verifierBytes = new Uint8Array(32);

package/dist/src/auth/oauth/google-oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/pkce.ts"],"sourcesContent":["/**\n * PKCE utilities using Web Crypto API.\n * Works in both Node.js 20+ and browsers.\n */\n\n/**\n * Encode bytes as base64url string.\n */\nfunction base64urlEncode(bytes: Uint8Array): string {\n\tlet binary = \"\";\n\tfor (const byte of bytes) {\n\t\tbinary += String.fromCharCode(byte);\n\t}\n\treturn btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n * Uses Web Crypto API.\n */\nexport async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {\n\t// Generate random verifier\n\tconst verifierBytes = new Uint8Array(32);\n\tcrypto.getRandomValues(verifierBytes);\n\tconst verifier = base64urlEncode(verifierBytes);\n\n\t// Compute SHA-256 challenge\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n\tconst challenge = base64urlEncode(new Uint8Array(hashBuffer));\n\n\treturn { verifier, challenge };\n}\n"],"mappings":";;;;;;;;AAQA,SAAS,gBAAgB,OAA2B;CACnD,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MAClB,WAAU,OAAO,aAAa,KAAK;AAEpC,QAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO9E,eAAsB,eAAiE;CAEtF,MAAM,gBAAgB,IAAI,WAAW,GAAG;AACxC,QAAO,gBAAgB,cAAc;CACrC,MAAM,WAAW,gBAAgB,cAAc;CAI/C,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG9D,QAAO;EAAE;EAAU,WAFD,gBAAgB,IAAI,WAAW,WAAW,CAEhC;EAAE"}

package/dist/src/auth/oauth/index.js

@@ -3,9 +3,9 @@ import { minimaxOAuthProvider } from "./minimax.js";
 import { minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken } from "./github-copilot.js";
-import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./vendor-pi-google/google-gemini-cli.js";
+import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-oauth/google-gemini-cli.js";
 import "./google-gemini-cli.js";
-import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./vendor-pi-google/google-antigravity.js";
+import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-oauth/google-antigravity.js";
 import "./google-antigravity.js";
 import { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
 export { anthropicOAuthProvider, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginGitHubCopilot, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, normalizeDomain, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGitHubCopilotToken, refreshGoogleCloudToken, refreshOpenAICodexToken };

package/dist/src/auth/oauth/kimi-coding.d.ts

@@ -1,5 +1,5 @@
 /**
- * Kimi Coding (Moonshot AI) OAuth — device code flow for pi-ai `kimi-coding` provider.
+ * Kimi Coding (Moonshot AI) OAuth device code flow.
  * @see https://auth.kimi.com
  */
 import type { OAuthProviderInterface } from './types.js';

package/dist/src/auth/oauth/kimi-coding.js

@@ -6,7 +6,7 @@ const KIMI_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const kimiCodingOAuthProvider = {
 	id: "kimi-coding",
 	name: "Kimi For Coding (月之暗面)",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {
 			method: "POST",

package/dist/src/auth/oauth/kimi-coding.js.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-coding.js","names":[],"sources":["../../../../src/auth/oauth/kimi-coding.ts"],"sourcesContent":["/**\n * Kimi Coding (Moonshot AI) OAuth — device code flow for pi-ai `kimi-coding` provider.\n * @see https://auth.kimi.com\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst KIMI_OAUTH_BASE_URL = 'https://auth.kimi.com';\nconst KIMI_OAUTH_DEVICE_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/device_authorization`;\nconst KIMI_OAUTH_TOKEN_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/token`;\nconst KIMI_OAUTH_CLIENT_ID = '17e5f671-d194-4dfb-9706-5516cb48c098';\n\nexport const kimiCodingOAuthProvider: OAuthProviderInterface = {\n\tid: 'kimi-coding',\n\tname: 'Kimi For Coding (月之暗面)',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\tconst deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\tscope: 'kimi-code',\n\t\t\t}),\n\t\t});\n\n\t\tif (!deviceResponse.ok) {\n\t\t\tconst error = await deviceResponse.text();\n\t\t\tthrow new Error(`Device code request failed: ${error}`);\n\t\t}\n\n\t\tconst deviceData = (await deviceResponse.json()) as {\n\t\t\tdevice_code: string;\n\t\t\tuser_code: string;\n\t\t\tverification_uri: string;\n\t\t\tverification_uri_complete: string;\n\t\t\tinterval: number;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tcallbacks.onAuth({\n\t\t\turl: deviceData.verification_uri_complete || deviceData.verification_uri,\n\t\t\tinstructions: `Please visit ${deviceData.verification_uri} and enter code: ${deviceData.user_code}`,\n\t\t});\n\n\t\tconst expiresAt = Date.now() + deviceData.expires_in * 1000;\n\t\tconst pollInterval = (deviceData.interval || 5) * 1000;\n\n\t\twhile (Date.now() < expiresAt) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, pollInterval));\n\n\t\t\tconst tokenResponse = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: {\n\t\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n\t\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\t\tdevice_code: deviceData.device_code,\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (tokenResponse.ok) {\n\t\t\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\t\t\taccess_token: string;\n\t\t\t\t\trefresh_token: string;\n\t\t\t\t\texpires_in: number;\n\t\t\t\t};\n\n\t\t\t\treturn {\n\t\t\t\t\taccess: tokenData.access_token,\n\t\t\t\t\trefresh: tokenData.refresh_token,\n\t\t\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst errorData = (await tokenResponse.json()) as { error?: string };\n\t\t\tif (errorData.error === 'expired_token') {\n\t\t\t\tthrow new Error('Device code expired. Please try again.');\n\t\t\t}\n\t\t}\n\n\t\tthrow new Error('Device code expired. Please try again.');\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('Kimi OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`Kimi OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = (await response.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n"],"mappings":";AAOA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB,GAAG,oBAAoB;AACrD,MAAM,uBAAuB,GAAG,oBAAoB;AACpD,MAAM,uBAAuB;AAE7B,MAAa,0BAAkD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EACtE,MAAM,iBAAiB,MAAM,MAAM,uBAAuB;GACzD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,OAAO;IACP,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,eAAe,IAAI;GACvB,MAAM,QAAQ,MAAM,eAAe,MAAM;AACzC,SAAM,IAAI,MAAM,+BAA+B,QAAQ;;EAGxD,MAAM,aAAc,MAAM,eAAe,MAAM;AAS/C,YAAU,OAAO;GAChB,KAAK,WAAW,6BAA6B,WAAW;GACxD,cAAc,gBAAgB,WAAW,iBAAiB,mBAAmB,WAAW;GACxF,CAAC;EAEF,MAAM,YAAY,KAAK,KAAK,GAAG,WAAW,aAAa;EACvD,MAAM,gBAAgB,WAAW,YAAY,KAAK;AAElD,SAAO,KAAK,KAAK,GAAG,WAAW;AAC9B,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;GAEjE,MAAM,gBAAgB,MAAM,MAAM,sBAAsB;IACvD,QAAQ;IACR,SAAS,EACR,gBAAgB,qCAChB;IACD,MAAM,IAAI,gBAAgB;KACzB,YAAY;KACZ,WAAW;KACX,aAAa,WAAW;KACxB,CAAC;IACF,CAAC;AAEF,OAAI,cAAc,IAAI;IACrB,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,WAAO;KACN,QAAQ,UAAU;KAClB,SAAS,UAAU;KACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;KAC7C;;AAIF,QAAI,MADqB,cAAc,MAAM,EAC/B,UAAU,gBACvB,OAAM,IAAI,MAAM,yCAAyC;;AAI3D,QAAM,IAAI,MAAM,yCAAyC;;CAG1D,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,qDAAqD;EAGtE,MAAM,WAAW,MAAM,MAAM,sBAAsB;GAClD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,8BAA8B,OAAO;;EAGtD,MAAM,UAAW,MAAM,SAAS,MAAM;AAMtC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB"}
+{"version":3,"file":"kimi-coding.js","names":[],"sources":["../../../../src/auth/oauth/kimi-coding.ts"],"sourcesContent":["/**\n * Kimi Coding (Moonshot AI) OAuth device code flow.\n * @see https://auth.kimi.com\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst KIMI_OAUTH_BASE_URL = 'https://auth.kimi.com';\nconst KIMI_OAUTH_DEVICE_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/device_authorization`;\nconst KIMI_OAUTH_TOKEN_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/token`;\nconst KIMI_OAUTH_CLIENT_ID = '17e5f671-d194-4dfb-9706-5516cb48c098';\n\nexport const kimiCodingOAuthProvider: OAuthProviderInterface = {\n\tid: 'kimi-coding',\n\tname: 'Kimi For Coding (月之暗面)',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\tconst deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\tscope: 'kimi-code',\n\t\t\t}),\n\t\t});\n\n\t\tif (!deviceResponse.ok) {\n\t\t\tconst error = await deviceResponse.text();\n\t\t\tthrow new Error(`Device code request failed: ${error}`);\n\t\t}\n\n\t\tconst deviceData = (await deviceResponse.json()) as {\n\t\t\tdevice_code: string;\n\t\t\tuser_code: string;\n\t\t\tverification_uri: string;\n\t\t\tverification_uri_complete: string;\n\t\t\tinterval: number;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tcallbacks.onAuth({\n\t\t\turl: deviceData.verification_uri_complete || deviceData.verification_uri,\n\t\t\tinstructions: `Please visit ${deviceData.verification_uri} and enter code: ${deviceData.user_code}`,\n\t\t});\n\n\t\tconst expiresAt = Date.now() + deviceData.expires_in * 1000;\n\t\tconst pollInterval = (deviceData.interval || 5) * 1000;\n\n\t\twhile (Date.now() < expiresAt) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, pollInterval));\n\n\t\t\tconst tokenResponse = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: {\n\t\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n\t\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\t\tdevice_code: deviceData.device_code,\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (tokenResponse.ok) {\n\t\t\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\t\t\taccess_token: string;\n\t\t\t\t\trefresh_token: string;\n\t\t\t\t\texpires_in: number;\n\t\t\t\t};\n\n\t\t\t\treturn {\n\t\t\t\t\taccess: tokenData.access_token,\n\t\t\t\t\trefresh: tokenData.refresh_token,\n\t\t\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst errorData = (await tokenResponse.json()) as { error?: string };\n\t\t\tif (errorData.error === 'expired_token') {\n\t\t\t\tthrow new Error('Device code expired. Please try again.');\n\t\t\t}\n\t\t}\n\n\t\tthrow new Error('Device code expired. Please try again.');\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('Kimi OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`Kimi OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = (await response.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n"],"mappings":";AAOA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB,GAAG,oBAAoB;AACrD,MAAM,uBAAuB,GAAG,oBAAoB;AACpD,MAAM,uBAAuB;AAE7B,MAAa,0BAAkD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EACtE,MAAM,iBAAiB,MAAM,MAAM,uBAAuB;GACzD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,OAAO;IACP,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,eAAe,IAAI;GACvB,MAAM,QAAQ,MAAM,eAAe,MAAM;AACzC,SAAM,IAAI,MAAM,+BAA+B,QAAQ;;EAGxD,MAAM,aAAc,MAAM,eAAe,MAAM;AAS/C,YAAU,OAAO;GAChB,KAAK,WAAW,6BAA6B,WAAW;GACxD,cAAc,gBAAgB,WAAW,iBAAiB,mBAAmB,WAAW;GACxF,CAAC;EAEF,MAAM,YAAY,KAAK,KAAK,GAAG,WAAW,aAAa;EACvD,MAAM,gBAAgB,WAAW,YAAY,KAAK;AAElD,SAAO,KAAK,KAAK,GAAG,WAAW;AAC9B,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;GAEjE,MAAM,gBAAgB,MAAM,MAAM,sBAAsB;IACvD,QAAQ;IACR,SAAS,EACR,gBAAgB,qCAChB;IACD,MAAM,IAAI,gBAAgB;KACzB,YAAY;KACZ,WAAW;KACX,aAAa,WAAW;KACxB,CAAC;IACF,CAAC;AAEF,OAAI,cAAc,IAAI;IACrB,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,WAAO;KACN,QAAQ,UAAU;KAClB,SAAS,UAAU;KACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;KAC7C;;AAIF,QAAI,MADqB,cAAc,MAAM,EAC/B,UAAU,gBACvB,OAAM,IAAI,MAAM,yCAAyC;;AAI3D,QAAM,IAAI,MAAM,yCAAyC;;CAG1D,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,qDAAqD;EAGtE,MAAM,WAAW,MAAM,MAAM,sBAAsB;GAClD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,8BAA8B,OAAO;;EAGtD,MAAM,UAAW,MAAM,SAAS,MAAM;AAMtC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB"}

package/dist/src/auth/oauth/minimax-cn.js

@@ -6,7 +6,7 @@ const MINIMAX_CN_OAUTH_CLIENT_ID = "your_client_id";
 const minimaxCnOAuthProvider = {
 	id: "minimax-cn",
 	name: "MiniMax 国内版",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const codeVerifier = generateCodeVerifier();
 		const codeChallenge = await generateCodeChallenge(codeVerifier);

package/dist/src/auth/oauth/minimax-cn.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimax-cn.js","names":[],"sources":["../../../../src/auth/oauth/minimax-cn.ts"],"sourcesContent":["/**\n * MiniMax CN (China region) OAuth provider\n *\n * OAuth 2.0 for the MiniMax China platform: https://platform.minimax.chat/\n *\n * Endpoints differ from the international product:\n * - International: platform.minimaxi.com\n * - China: platform.minimax.chat\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_CN_OAUTH_BASE_URL = 'https://platform.minimax.chat';\nconst MINIMAX_CN_OAUTH_AUTHORIZE_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_CN_OAUTH_TOKEN_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_CN_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxCnOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax-cn',\n\tname: 'MiniMax 国内版',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax CN uses authorization code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_CN_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_CN_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: '请在浏览器中授权应用，然后输入返回的授权码。',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: '请输入授权码：',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax CN OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax CN OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AAYA,MAAM,4BAA4B;AAClC,MAAM,iCAAiC,GAAG,0BAA0B;AACpE,MAAM,6BAA6B,GAAG,0BAA0B;AAChE,MAAM,6BAA6B;AAEnC,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAEtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,+BAA+B;AACvD,UAAQ,aAAa,IAAI,aAAa,2BAA2B;AACjE,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,WACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,4BAA4B;GAC7D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,2DAA2D;EAG5E,MAAM,WAAW,MAAM,MAAM,4BAA4B;GACxD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,oCAAoC,OAAO;;EAG5D,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}
+{"version":3,"file":"minimax-cn.js","names":[],"sources":["../../../../src/auth/oauth/minimax-cn.ts"],"sourcesContent":["/**\n * MiniMax CN (China region) OAuth provider\n *\n * OAuth 2.0 for the MiniMax China platform: https://platform.minimax.chat/\n *\n * Endpoints differ from the international product:\n * - International: platform.minimaxi.com\n * - China: platform.minimax.chat\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_CN_OAUTH_BASE_URL = 'https://platform.minimax.chat';\nconst MINIMAX_CN_OAUTH_AUTHORIZE_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_CN_OAUTH_TOKEN_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_CN_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxCnOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax-cn',\n\tname: 'MiniMax 国内版',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax CN uses authorization code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_CN_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_CN_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: '请在浏览器中授权应用，然后输入返回的授权码。',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: '请输入授权码：',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax CN OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax CN OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AAYA,MAAM,4BAA4B;AAClC,MAAM,iCAAiC,GAAG,0BAA0B;AACpE,MAAM,6BAA6B,GAAG,0BAA0B;AAChE,MAAM,6BAA6B;AAEnC,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAEtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,+BAA+B;AACvD,UAAQ,aAAa,IAAI,aAAa,2BAA2B;AACjE,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,WACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,4BAA4B;GAC7D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,2DAA2D;EAG5E,MAAM,WAAW,MAAM,MAAM,4BAA4B;GACxD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,oCAAoC,OAAO;;EAG5D,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}

package/dist/src/auth/oauth/minimax.js

@@ -6,7 +6,7 @@ const MINIMAX_OAUTH_CLIENT_ID = "your_client_id";
 const minimaxOAuthProvider = {
 	id: "minimax",
 	name: "MiniMax",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const codeVerifier = generateCodeVerifier();
 		const codeChallenge = await generateCodeChallenge(codeVerifier);

package/dist/src/auth/oauth/minimax.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimax.js","names":[],"sources":["../../../../src/auth/oauth/minimax.ts"],"sourcesContent":["/**\n * MiniMax OAuth Provider\n * \n * OAuth 2.0 authentication for MiniMax Platform.\n * https://platform.minimaxi.com/\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_OAUTH_BASE_URL = 'https://platform.minimaxi.com';\nconst MINIMAX_OAUTH_AUTHORIZE_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_OAUTH_TOKEN_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax',\n\tname: 'MiniMax',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax uses authorization code flow\n\t\t// First, generate a device code or authorization URL\n\t\t\n\t\t// For simplicity, we'll use a manual code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: 'Please authorize the application and enter the code shown.',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: 'Enter the authorization code:',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AASA,MAAM,yBAAyB;AAC/B,MAAM,8BAA8B,GAAG,uBAAuB;AAC9D,MAAM,0BAA0B,GAAG,uBAAuB;AAC1D,MAAM,0BAA0B;AAEhC,MAAa,uBAA+C;CAC3D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAKtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,4BAA4B;AACpD,UAAQ,aAAa,IAAI,aAAa,wBAAwB;AAC9D,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,iCACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,yBAAyB;GAC1D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,wDAAwD;EAGzE,MAAM,WAAW,MAAM,MAAM,yBAAyB;GACrD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,iCAAiC,OAAO;;EAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}
+{"version":3,"file":"minimax.js","names":[],"sources":["../../../../src/auth/oauth/minimax.ts"],"sourcesContent":["/**\n * MiniMax OAuth Provider\n * \n * OAuth 2.0 authentication for MiniMax Platform.\n * https://platform.minimaxi.com/\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_OAUTH_BASE_URL = 'https://platform.minimaxi.com';\nconst MINIMAX_OAUTH_AUTHORIZE_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_OAUTH_TOKEN_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax',\n\tname: 'MiniMax',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax uses authorization code flow\n\t\t// First, generate a device code or authorization URL\n\t\t\n\t\t// For simplicity, we'll use a manual code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: 'Please authorize the application and enter the code shown.',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: 'Enter the authorization code:',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AASA,MAAM,yBAAyB;AAC/B,MAAM,8BAA8B,GAAG,uBAAuB;AAC9D,MAAM,0BAA0B,GAAG,uBAAuB;AAC1D,MAAM,0BAA0B;AAEhC,MAAa,uBAA+C;CAC3D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAKtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,4BAA4B;AACpD,UAAQ,aAAa,IAAI,aAAa,wBAAwB;AAC9D,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,iCACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,yBAAyB;GAC1D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,wDAAwD;EAGzE,MAAM,WAAW,MAAM,MAAM,yBAAyB;GACrD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,iCAAiC,OAAO;;EAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}

package/dist/src/auth/oauth/openai-codex.d.ts

@@ -1,4 +1,9 @@
 /**
- * OpenAI Codex (ChatGPT) OAuth — delegated to @earendil-works/pi-ai.
+ * OpenAI Codex (ChatGPT) OAuth.
+ *
+ * Owns callback validation, manual prompt handling, and success/error pages.
  */
-export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from '@earendil-works/pi-ai/oauth';
+import type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './types.js';
+export declare function loginOpenAICodex(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;
+export declare const openaiCodexOAuthProvider: OAuthProviderInterface;