@xopcai/xopc 0.0.102 → 0.0.104

package/dist/src/agent/workflow/subagent-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner, SubagentProgressEvent } from './types.js';\n\nconst log = createLogger('Agent:WorkflowSubagent');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n    const streamMode = resolveSubagentStreamMode(this.deps.getConfig);\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n      progressHooks:\n        opts.onProgress && streamMode !== 'off'\n          ? {\n              mode: streamMode === 'full' ? 'full' : 'steps',\n              onProgress: (event) => {\n                opts.onProgress?.(mapChildProgressEvent(event));\n              },\n            }\n          : undefined,\n    };\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary } = await handle.run();\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n\nfunction resolveSubagentStreamMode(\n  getConfig: () => Config | undefined,\n): 'off' | 'steps' | 'full' {\n  const mode = getConfig()?.agents?.defaults?.workflow?.subagentStream;\n  if (mode === 'off' || mode === 'steps' || mode === 'full') return mode;\n  return 'steps';\n}\n\nfunction mapChildProgressEvent(event: {\n  type: 'tool_start' | 'tool_end' | 'iteration' | 'text_delta' | 'thinking_delta';\n  toolCallId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  isError?: boolean;\n  resultPreview?: string;\n  error?: string;\n  count?: number;\n  max?: number;\n  delta?: string;\n}): SubagentProgressEvent {\n  switch (event.type) {\n    case 'tool_start':\n      return {\n        type: 'tool_start',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        args: event.args ?? {},\n      };\n    case 'tool_end':\n      return {\n        type: 'tool_end',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        isError: Boolean(event.isError),\n        resultPreview: event.resultPreview,\n        error: event.error,\n      };\n    case 'iteration':\n      return {\n        type: 'iteration',\n        count: event.count ?? 0,\n        max: event.max ?? 0,\n      };\n    case 'text_delta':\n      return { type: 'text_delta', delta: event.delta ?? '' };\n    case 'thinking_delta':\n      return { type: 'thinking_delta', delta: event.delta ?? '' };\n    default:\n      return { type: 'text_delta', delta: '' };\n  }\n}\n"],"mappings":";;;;;;aAqBqD;AAoBrD,MAAM,MAAM,aAAa,yBAAyB;AAElD,MAAM,yBAAyB;AAkB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAC5D,MAAM,aAAa,0BAA0B,KAAK,KAAK,UAAU;EAgCjE,MAAM,SAAS,0BAA0B;GA7BvC,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAEH,eACE,KAAK,cAAc,eAAe,QAC9B;IACE,MAAM,eAAe,SAAS,SAAS;IACvC,aAAa,UAAU;AACrB,UAAK,aAAa,sBAAsB,MAAM,CAAC;;IAElD,GACD,KAAA;GAG6C,CAAC;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,YAAY,MAAM,OAAO,KAAK;AACtC,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;;AAKxD,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO;;;AAIX,SAAS,0BACP,WAC0B;CAC1B,MAAM,OAAO,WAAW,EAAE,QAAQ,UAAU,UAAU;AACtD,KAAI,SAAS,SAAS,SAAS,WAAW,SAAS,OAAQ,QAAO;AAClE,QAAO;;AAGT,SAAS,sBAAsB,OAWL;AACxB,SAAQ,MAAM,MAAd;EACE,KAAK,aACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,MAAM,MAAM,QAAQ,EAAE;GACvB;EACH,KAAK,WACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,SAAS,QAAQ,MAAM,QAAQ;GAC/B,eAAe,MAAM;GACrB,OAAO,MAAM;GACd;EACH,KAAK,YACH,QAAO;GACL,MAAM;GACN,OAAO,MAAM,SAAS;GACtB,KAAK,MAAM,OAAO;GACnB;EACH,KAAK,aACH,QAAO;GAAE,MAAM;GAAc,OAAO,MAAM,SAAS;GAAI;EACzD,KAAK,iBACH,QAAO;GAAE,MAAM;GAAkB,OAAO,MAAM,SAAS;GAAI;EAC7D,QACE,QAAO;GAAE,MAAM;GAAc,OAAO;GAAI"}
+{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport type { SessionStore } from '../../session/store.js';\nimport { emitSessionTranscriptUpdate } from '../../session/transcript-events.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner, SubagentProgressEvent } from './types.js';\n\nconst log = createLogger('Agent:WorkflowSubagent');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  sessionStore?: SessionStore;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n    const streamMode = resolveSubagentStreamMode(this.deps.getConfig);\n\n    let transcriptPersistQueue: Promise<void> = Promise.resolve();\n    const persistTranscriptSnapshot = opts.sessionKey && this.deps.sessionStore\n      ? (messages: Parameters<SessionStore['saveMessages']>[1]) => {\n          const store = this.deps.sessionStore;\n          const key = opts.sessionKey;\n          if (!store || !key) return;\n          const snapshot = cloneAgentMessages(messages);\n          transcriptPersistQueue = transcriptPersistQueue\n            .then(async () => {\n              await store.saveMessages(key, snapshot);\n              emitSessionTranscriptUpdate({ sessionKey: key });\n            })\n            .catch((err) => {\n              const msg = err instanceof Error ? err.message : String(err);\n              log.warn(\n                { err, sessionKey: key, errorMessage: msg },\n                `Failed to persist workflow subagent transcript snapshot: ${msg}`,\n              );\n            });\n        }\n      : undefined;\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n      progressHooks:\n        opts.onProgress && streamMode !== 'off'\n          ? {\n              mode: streamMode === 'full' ? 'full' : 'steps',\n              onProgress: (event) => {\n                opts.onProgress?.(mapChildProgressEvent(event));\n              },\n            }\n          : undefined,\n      onTranscriptSnapshot: persistTranscriptSnapshot,\n    };\n\n    if (opts.sessionKey && opts.sessionMetadata && this.deps.sessionStore) {\n      await this.preparePersistentSubagentSession(opts.sessionKey, opts.sessionMetadata);\n    }\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary, messages } = await handle.run();\n      await transcriptPersistQueue;\n      if (opts.sessionKey && this.deps.sessionStore) {\n        await this.deps.sessionStore.saveMessages(opts.sessionKey, messages);\n        emitSessionTranscriptUpdate({ sessionKey: opts.sessionKey });\n      }\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n\n  private async preparePersistentSubagentSession(\n    sessionKey: string,\n    metadata: NonNullable<SubagentRunOptions['sessionMetadata']>,\n  ): Promise<void> {\n    const store = this.deps.sessionStore;\n    if (!store) return;\n    await store.resolveTranscriptPath(sessionKey);\n    await store.updateMetadata(sessionKey, {\n      sessionType: 'workflow-subagent',\n      hiddenFromSessionList: true,\n      parentSessionKey: metadata.parentSessionKey,\n      workflowRunId: metadata.workflowRunId,\n      workflowDefinitionId: metadata.workflowDefinitionId,\n      workflowAgentId: metadata.workflowAgentId,\n      workflowAgentLabel: metadata.workflowAgentLabel,\n      name: metadata.workflowAgentLabel,\n      tags: ['workflow-subagent', metadata.workflowDefinitionId],\n    });\n  }\n}\n\nfunction cloneAgentMessages(messages: Parameters<SessionStore['saveMessages']>[1]): Parameters<SessionStore['saveMessages']>[1] {\n  return messages.map((message) => structuredClone(message));\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n\nfunction resolveSubagentStreamMode(\n  getConfig: () => Config | undefined,\n): 'off' | 'steps' | 'full' {\n  const mode = getConfig()?.agents?.defaults?.workflow?.subagentStream;\n  if (mode === 'off' || mode === 'steps' || mode === 'full') return mode;\n  return 'steps';\n}\n\nfunction mapChildProgressEvent(event: {\n  type: 'tool_start' | 'tool_end' | 'iteration' | 'text_delta' | 'thinking_delta';\n  toolCallId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  isError?: boolean;\n  resultPreview?: string;\n  error?: string;\n  count?: number;\n  max?: number;\n  delta?: string;\n}): SubagentProgressEvent {\n  switch (event.type) {\n    case 'tool_start':\n      return {\n        type: 'tool_start',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        args: event.args ?? {},\n      };\n    case 'tool_end':\n      return {\n        type: 'tool_end',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        isError: Boolean(event.isError),\n        resultPreview: event.resultPreview,\n        error: event.error,\n      };\n    case 'iteration':\n      return {\n        type: 'iteration',\n        count: event.count ?? 0,\n        max: event.max ?? 0,\n      };\n    case 'text_delta':\n      return { type: 'text_delta', delta: event.delta ?? '' };\n    case 'thinking_delta':\n      return { type: 'thinking_delta', delta: event.delta ?? '' };\n    default:\n      return { type: 'text_delta', delta: '' };\n  }\n}\n"],"mappings":";;;;;;;aAuBqD;AAoBrD,MAAM,MAAM,aAAa,yBAAyB;AAElD,MAAM,yBAAyB;AAmB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAC5D,MAAM,aAAa,0BAA0B,KAAK,KAAK,UAAU;EAEjE,IAAI,yBAAwC,QAAQ,SAAS;EAC7D,MAAM,4BAA4B,KAAK,cAAc,KAAK,KAAK,gBAC1D,aAA0D;GACzD,MAAM,QAAQ,KAAK,KAAK;GACxB,MAAM,MAAM,KAAK;AACjB,OAAI,CAAC,SAAS,CAAC,IAAK;GACpB,MAAM,WAAW,mBAAmB,SAAS;AAC7C,4BAAyB,uBACtB,KAAK,YAAY;AAChB,UAAM,MAAM,aAAa,KAAK,SAAS;AACvC,gCAA4B,EAAE,YAAY,KAAK,CAAC;KAChD,CACD,OAAO,QAAQ;IACd,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAI,KACF;KAAE;KAAK,YAAY;KAAK,cAAc;KAAK,EAC3C,4DAA4D,MAC7D;KACD;MAEN,KAAA;EAEJ,MAAM,eAA2C;GAC/C,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAEH,eACE,KAAK,cAAc,eAAe,QAC9B;IACE,MAAM,eAAe,SAAS,SAAS;IACvC,aAAa,UAAU;AACrB,UAAK,aAAa,sBAAsB,MAAM,CAAC;;IAElD,GACD,KAAA;GACN,sBAAsB;GACvB;AAED,MAAI,KAAK,cAAc,KAAK,mBAAmB,KAAK,KAAK,aACvD,OAAM,KAAK,iCAAiC,KAAK,YAAY,KAAK,gBAAgB;EAGpF,MAAM,SAAS,0BAA0B,aAAa;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,SAAS,aAAa,MAAM,OAAO,KAAK;AAChD,SAAM;AACN,OAAI,KAAK,cAAc,KAAK,KAAK,cAAc;AAC7C,UAAM,KAAK,KAAK,aAAa,aAAa,KAAK,YAAY,SAAS;AACpE,gCAA4B,EAAE,YAAY,KAAK,YAAY,CAAC;;AAE9D,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;CAItD,MAAc,iCACZ,YACA,UACe;EACf,MAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO;AACZ,QAAM,MAAM,sBAAsB,WAAW;AAC7C,QAAM,MAAM,eAAe,YAAY;GACrC,aAAa;GACb,uBAAuB;GACvB,kBAAkB,SAAS;GAC3B,eAAe,SAAS;GACxB,sBAAsB,SAAS;GAC/B,iBAAiB,SAAS;GAC1B,oBAAoB,SAAS;GAC7B,MAAM,SAAS;GACf,MAAM,CAAC,qBAAqB,SAAS,qBAAqB;GAC3D,CAAC;;;AAIN,SAAS,mBAAmB,UAAoG;AAC9H,QAAO,SAAS,KAAK,YAAY,gBAAgB,QAAQ,CAAC;;AAG5D,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO;;;AAIX,SAAS,0BACP,WAC0B;CAC1B,MAAM,OAAO,WAAW,EAAE,QAAQ,UAAU,UAAU;AACtD,KAAI,SAAS,SAAS,SAAS,WAAW,SAAS,OAAQ,QAAO;AAClE,QAAO;;AAGT,SAAS,sBAAsB,OAWL;AACxB,SAAQ,MAAM,MAAd;EACE,KAAK,aACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,MAAM,MAAM,QAAQ,EAAE;GACvB;EACH,KAAK,WACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,SAAS,QAAQ,MAAM,QAAQ;GAC/B,eAAe,MAAM;GACrB,OAAO,MAAM;GACd;EACH,KAAK,YACH,QAAO;GACL,MAAM;GACN,OAAO,MAAM,SAAS;GACtB,KAAK,MAAM,OAAO;GACnB;EACH,KAAK,aACH,QAAO;GAAE,MAAM;GAAc,OAAO,MAAM,SAAS;GAAI;EACzD,KAAK,iBACH,QAAO;GAAE,MAAM;GAAkB,OAAO,MAAM,SAAS;GAAI;EAC7D,QACE,QAAO;GAAE,MAAM;GAAc,OAAO;GAAI"}

package/dist/src/agent/workflow/types.d.ts

@@ -88,6 +88,7 @@ export interface WorkflowAgentSnapshot {
     streamText?: string;
 }
 export interface WorkflowSnapshot {
+    runId?: string;
     name: string;
     description?: string;
     phases: string[];
@@ -118,6 +119,15 @@ export interface SubagentRunOptions<T = unknown> {
     rethrow?: boolean;
     /** Hint about which phase this agent belongs to (passed through for logging). */
     phase?: string;
+    /** Persistent hidden session for this workflow subagent. */
+    sessionKey?: string;
+    sessionMetadata?: {
+        parentSessionKey?: string;
+        workflowRunId: string;
+        workflowDefinitionId: string;
+        workflowAgentId: string;
+        workflowAgentLabel: string;
+    };
     /** Live progress from the child agent loop (workflow tool binds per agent id). */
     onProgress?: (event: SubagentProgressEvent) => void;
     /** Pre-bound capture for structured output (internal: created by the adapter when schema present). */

package/dist/src/auth/credentials.d.ts

@@ -81,6 +81,13 @@ export declare class CredentialResolver {
      * Load the raw OAuth token record, including expired tokens for status UIs.
      */
     loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null>;
+    /**
+     * List persisted OAuth tokens without exposing access/refresh values.
+     */
+    listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & {
+        hasAccess: boolean;
+        hasRefresh: boolean;
+    }>>;
     /**
      * Save OAuth token for a provider.
      */

package/dist/src/auth/credentials.js

@@ -4,7 +4,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { mkdir, readFile, rm } from "fs/promises";
+import { mkdir, readFile, readdir, rm } from "fs/promises";
 import { dirname, join } from "path";
 //#region src/auth/credentials.ts
 function getCredentialResolver(options) {
@@ -16,13 +16,14 @@ async function resolveApiKey(provider, options) {
 async function hasCredentials(provider, options) {
 	return getCredentialResolver(options).hasCredentials(provider);
 }
-var log, CredentialResolver;
+var log, warnedExpiredOAuthTokens, CredentialResolver;
 var init_credentials = __esmMin((() => {
 	init_write_file_atomic();
 	init_logger();
 	init_env_keys();
 	init_paths();
 	log = createLogger("Credentials");
+	warnedExpiredOAuthTokens = /* @__PURE__ */ new Set();
 	CredentialResolver = class {
 		credentialsDir;
 		agentId;
@@ -163,10 +164,14 @@ var init_credentials = __esmMin((() => {
 			const token = await this.loadOAuthTokenRecord(provider);
 			if (!token) return null;
 			if (token.expiresAt && token.expiresAt < Date.now()) {
-				log.warn({
-					provider,
-					expiresAt: token.expiresAt
-				}, "OAuth token is expired");
+				const warnKey = `${provider}:${token.expiresAt}`;
+				if (!warnedExpiredOAuthTokens.has(warnKey)) {
+					warnedExpiredOAuthTokens.add(warnKey);
+					log.warn({
+						provider,
+						expiresAt: token.expiresAt
+					}, "OAuth token is expired");
+				}
 				return null;
 			}
 			return token;
@@ -186,6 +191,36 @@ var init_credentials = __esmMin((() => {
 			}
 		}
 		/**
+		* List persisted OAuth tokens without exposing access/refresh values.
+		*/
+		async listOAuthTokens() {
+			const oauthDir = join(this.credentialsDir, "oauth");
+			let files;
+			try {
+				files = await readdir(oauthDir);
+			} catch {
+				return [];
+			}
+			const tokens = [];
+			for (const file of files) {
+				if (!file.endsWith(".json")) continue;
+				try {
+					const content = await readFile(join(oauthDir, file), "utf-8");
+					const token = JSON.parse(content);
+					if (token.type !== "oauth" || !token.provider) continue;
+					const { access, refresh, ...safe } = token;
+					tokens.push({
+						...safe,
+						hasAccess: Boolean(access?.trim()),
+						hasRefresh: Boolean(refresh?.trim())
+					});
+				} catch {
+					continue;
+				}
+			}
+			return tokens.sort((a, b) => a.provider.localeCompare(b.provider));
+		}
+		/**
 		* Save OAuth token for a provider.
 		*/
 		async saveOAuthToken(provider, token) {
@@ -214,7 +249,10 @@ var init_credentials = __esmMin((() => {
 		*/
 		async deleteProviderCredential(provider) {
 			const normalizedProvider = provider.toLowerCase();
-			await this.deleteProfile(`${normalizedProvider}:default`);
+			const file = await this.loadAuthProfilesFile();
+			await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });
+			for (const [profileId, profile] of Object.entries(file.profiles)) if (profile.provider === normalizedProvider) delete file.profiles[profileId];
+			await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));
 			await this.deleteOAuthToken(normalizedProvider);
 		}
 		async loadFromAgentCredentials(provider) {

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAwaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBArbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\nconst warnedExpiredOAuthTokens = new Set<string>();\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      const warnKey = `${provider}:${token.expiresAt}`;\n      if (!warnedExpiredOAuthTokens.has(warnKey)) {\n        warnedExpiredOAuthTokens.add(warnKey);\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      }\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAgdA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBA7dsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AACjC,4CAA2B,IAAI,KAAa;AA8CrC,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;IACnD,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM;AACrC,QAAI,CAAC,yBAAyB,IAAI,QAAQ,EAAE;AAC1C,8BAAyB,IAAI,QAAQ;AACrC,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;;AAE9E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/auth/index.d.ts

@@ -1,3 +1,3 @@
 export * from './credentials.js';
 export { anthropicOAuthProvider } from './oauth/anthropic.js';
-export type { OAuthLoginCallbacks } from './oauth/types.js';
+export type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './oauth/types.js';

package/dist/src/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/auth/index.ts"],"sourcesContent":["export * from './credentials.js';\nexport { anthropicOAuthProvider } from './oauth/anthropic.js';\nexport type { OAuthLoginCallbacks } from './oauth/types.js';\n"],"mappings":""}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/auth/index.ts"],"sourcesContent":["export * from './credentials.js';\nexport { anthropicOAuthProvider } from './oauth/anthropic.js';\nexport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './oauth/types.js';\n"],"mappings":""}

package/dist/src/auth/oauth/github-copilot.d.ts

@@ -1,4 +1,4 @@
 /**
- * GitHub Copilot OAuth — delegated to @earendil-works/pi-ai (device code flow).
+ * GitHub Copilot OAuth device code flow.
  */
 export { githubCopilotOAuthProvider, getGitHubCopilotBaseUrl, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from '@earendil-works/pi-ai/oauth';

package/dist/src/auth/oauth/google-antigravity.d.ts

@@ -1,6 +1,4 @@
 /**
  * Google Antigravity OAuth.
- * Implementation is vendored under `vendor-pi-google/` — upstream removed these exports from
- * `@earendil-works/pi-ai/oauth` while keeping the same OAuth credential shape.
  */
-export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken, } from './vendor-pi-google/google-antigravity.js';
+export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken, } from './google-oauth/google-antigravity.js';

package/dist/src/auth/oauth/google-antigravity.js

@@ -1,2 +1,2 @@
-import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./vendor-pi-google/google-antigravity.js";
+import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-oauth/google-antigravity.js";
 export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken };

package/dist/src/auth/oauth/google-gemini-cli.d.ts

@@ -1,6 +1,4 @@
 /**
  * Google Gemini CLI (Cloud Code Assist) OAuth.
- * Implementation is vendored under `vendor-pi-google/` — upstream removed these exports from
- * `@earendil-works/pi-ai/oauth` while keeping the same OAuth credential shape.
  */
-export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken, } from './vendor-pi-google/google-gemini-cli.js';
+export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken, } from './google-oauth/google-gemini-cli.js';

package/dist/src/auth/oauth/google-gemini-cli.js

@@ -1,2 +1,2 @@
-import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./vendor-pi-google/google-gemini-cli.js";
+import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-oauth/google-gemini-cli.js";
 export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken };

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/google-antigravity.js

@@ -1,6 +1,6 @@
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
-//#region src/auth/oauth/vendor-pi-google/google-antigravity.ts
+//#region src/auth/oauth/google-oauth/google-antigravity.ts
 let _createServer = null;
 let _httpImportPromise = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) _httpImportPromise = import("node:http").then((m) => {
@@ -28,7 +28,6 @@ const SCOPES = [
 ];
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const DEFAULT_PROJECT_ID = "rising-fact-p41fc";
 /**
 * Start a local HTTP server to receive the OAuth callback
 */
@@ -80,7 +79,7 @@ async function startCallbackServer() {
 		server.on("error", (err) => {
 			reject(err);
 		});
-		server.listen(51121, "127.0.0.1", () => {
+		server.listen(51121, () => {
 			resolve({
 				server,
 				cancelWait: () => {
@@ -140,8 +139,7 @@ async function discoverProject(accessToken, onProgress) {
 			if (data.cloudaicompanionProject && typeof data.cloudaicompanionProject === "object" && data.cloudaicompanionProject.id) return data.cloudaicompanionProject.id;
 		}
 	} catch {}
-	onProgress?.("Using default project...");
-	return DEFAULT_PROJECT_ID;
+	throw new Error("Failed to discover Google Cloud companion project");
 }
 /**
 * Get user email from the access token

package/dist/src/auth/oauth/google-oauth/google-antigravity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-antigravity.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/google-antigravity.ts"],"sourcesContent":["/**\n * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)\n * Uses different OAuth credentials than google-gemini-cli for access to additional models.\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype AntigravityCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst ANTIGRAVITY_CLIENT_ID_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_ID';\nconst ANTIGRAVITY_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_SECRET';\n\n/** Desktop OAuth client for this flow — must be set locally (not committed; avoids GitHub push protection). */\nfunction getAntigravityOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[ANTIGRAVITY_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[ANTIGRAVITY_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Antigravity OAuth requires ${ANTIGRAVITY_CLIENT_ID_ENV} and ${ANTIGRAVITY_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:51121/oauth-callback\";\n\n// Antigravity requires additional scopes\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n\t\"https://www.googleapis.com/auth/cclog\",\n\t\"https://www.googleapis.com/auth/experimentsandconfigs\",\n];\n\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Antigravity OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:51121`);\n\n\t\t\tif (url.pathname === \"/oauth-callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(51121, () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string | { id?: string };\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Discover or provision a project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"google-cloud-sdk vscode_cloudshelleditor/0.1\",\n\t\t\"Client-Metadata\": JSON.stringify({\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t}),\n\t};\n\n\t// Try endpoints in order: prod first, then sandbox\n\tconst endpoints = [\"https://cloudcode-pa.googleapis.com\", \"https://daily-cloudcode-pa.sandbox.googleapis.com\"];\n\n\tonProgress?.(\"Checking for existing project...\");\n\n\tfor (const endpoint of endpoints) {\n\t\ttry {\n\t\t\tconst loadResponse = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (loadResponse.ok) {\n\t\t\t\tconst data = (await loadResponse.json()) as LoadCodeAssistPayload;\n\n\t\t\t\t// Handle both string and object formats\n\t\t\t\tif (typeof data.cloudaicompanionProject === \"string\" && data.cloudaicompanionProject) {\n\t\t\t\t\treturn data.cloudaicompanionProject;\n\t\t\t\t}\n\t\t\t\tif (\n\t\t\t\t\tdata.cloudaicompanionProject &&\n\t\t\t\t\ttypeof data.cloudaicompanionProject === \"object\" &&\n\t\t\t\t\tdata.cloudaicompanionProject.id\n\t\t\t\t) {\n\t\t\t\t\treturn data.cloudaicompanionProject.id;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Try next endpoint\n\t\t}\n\t}\n\n\tthrow new Error(\"Failed to discover Google Cloud companion project\");\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Antigravity token\n */\nexport async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Antigravity token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Antigravity OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginAntigravity(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const antigravityOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-antigravity\",\n\tname: \"Antigravity (Gemini 3, Claude, GPT-OSS)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginAntigravity(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Antigravity credentials missing projectId\");\n\t\t}\n\t\treturn refreshAntigravityToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;;AAGtC,SAAS,4BAAwE;CAChF,MAAM,WAAW,QAAQ,IAAI,4BAA4B,MAAM;CAC/D,MAAM,eAAe,QAAQ,IAAI,gCAAgC,MAAM;AACvE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,qCAAqC,0BAA0B,OAAO,8BAA8B,GACpG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AAGrB,MAAM,SAAS;CACd;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,WAAW;AACjB,MAAM,YAAY;;;;AAYlB,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,8DAA8D;;AAG/E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,yBAAyB;AAE5D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,aAAa;AAC1B,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;;;;AAaX,eAAe,gBAAgB,aAAqB,YAAyD;CAC5G,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB,mBAAmB,KAAK,UAAU;GACjC,SAAS;GACT,UAAU;GACV,YAAY;GACZ,CAAC;EACF;CAGD,MAAM,YAAY,CAAC,uCAAuC,oDAAoD;AAE9G,cAAa,mCAAmC;AAEhD,MAAK,MAAM,YAAY,UACtB,KAAI;EACH,MAAM,eAAe,MAAM,MAAM,GAAG,SAAS,6BAA6B;GACzE,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,EACpB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,EACD,CAAC;GACF,CAAC;AAEF,MAAI,aAAa,IAAI;GACpB,MAAM,OAAQ,MAAM,aAAa,MAAM;AAGvC,OAAI,OAAO,KAAK,4BAA4B,YAAY,KAAK,wBAC5D,QAAO,KAAK;AAEb,OACC,KAAK,2BACL,OAAO,KAAK,4BAA4B,YACxC,KAAK,wBAAwB,GAE7B,QAAO,KAAK,wBAAwB;;SAG/B;AAKT,OAAM,IAAI,MAAM,oDAAoD;;;;;AAMrE,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;CAC9D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,qCAAqC,QAAQ;;CAG9D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,iBACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;AAG9D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,2BAAmD;CAC/D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,iBAAiB,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG7F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,4CAA4C;AAE7D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/google-gemini-cli.js

@@ -1,6 +1,6 @@
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
-//#region src/auth/oauth/vendor-pi-google/google-gemini-cli.ts
+//#region src/auth/oauth/google-oauth/google-gemini-cli.ts
 let _createServer = null;
 let _httpImportPromise = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) _httpImportPromise = import("node:http").then((m) => {
@@ -77,7 +77,7 @@ async function startCallbackServer() {
 		server.on("error", (err) => {
 			reject(err);
 		});
-		server.listen(8085, "127.0.0.1", () => {
+		server.listen(8085, () => {
 			resolve({
 				server,
 				cancelWait: () => {
@@ -105,7 +105,6 @@ function parseRedirectUrl(input) {
 	}
 }
 const TIER_FREE = "free-tier";
-const TIER_LEGACY = "legacy-tier";
 const TIER_STANDARD = "standard-tier";
 /**
 * Wait helper for onboarding retries
@@ -117,8 +116,8 @@ function wait(ms) {
 * Get default tier from allowed tiers
 */
 function getDefaultTier(allowedTiers) {
-	if (!allowedTiers || allowedTiers.length === 0) return { id: TIER_LEGACY };
-	return allowedTiers.find((t) => t.isDefault) ?? { id: TIER_LEGACY };
+	if (!allowedTiers || allowedTiers.length === 0) return { id: TIER_FREE };
+	return allowedTiers.find((t) => t.isDefault) ?? allowedTiers[0] ?? { id: TIER_FREE };
 }
 function isVpcScAffectedUser(payload) {
 	if (!payload || typeof payload !== "object") return false;

package/dist/src/auth/oauth/google-oauth/google-gemini-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-gemini-cli.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/google-gemini-cli.ts"],"sourcesContent":["/**\n * Gemini CLI OAuth flow (Google Cloud Code Assist)\n * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype GeminiCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst GEMINI_CLI_CLIENT_ID_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_ID';\nconst GEMINI_CLI_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_SECRET';\n\nfunction getGeminiCliOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[GEMINI_CLI_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[GEMINI_CLI_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Gemini CLI OAuth requires ${GEMINI_CLI_CLIENT_ID_ENV} and ${GEMINI_CLI_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:8085/oauth2callback\";\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n];\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\nconst CODE_ASSIST_ENDPOINT = \"https://cloudcode-pa.googleapis.com\";\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Gemini CLI OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:8085`);\n\n\t\t\tif (url.pathname === \"/oauth2callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(8085, () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string;\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Long-running operation response from onboardUser\n */\ninterface LongRunningOperationResponse {\n\tname?: string;\n\tdone?: boolean;\n\tresponse?: {\n\t\tcloudaicompanionProject?: { id?: string };\n\t};\n}\n\n// Tier IDs as used by the Cloud Code API\nconst TIER_FREE = \"free-tier\";\nconst TIER_STANDARD = \"standard-tier\";\n\ninterface GoogleRpcErrorResponse {\n\terror?: {\n\t\tdetails?: Array<{ reason?: string }>;\n\t};\n}\n\n/**\n * Wait helper for onboarding retries\n */\nfunction wait(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Get default tier from allowed tiers\n */\nfunction getDefaultTier(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): { id?: string } {\n\tif (!allowedTiers || allowedTiers.length === 0) return { id: TIER_FREE };\n\tconst defaultTier = allowedTiers.find((t) => t.isDefault);\n\treturn defaultTier ?? allowedTiers[0] ?? { id: TIER_FREE };\n}\n\nfunction isVpcScAffectedUser(payload: unknown): boolean {\n\tif (!payload || typeof payload !== \"object\") return false;\n\tif (!(\"error\" in payload)) return false;\n\tconst error = (payload as GoogleRpcErrorResponse).error;\n\tif (!error?.details || !Array.isArray(error.details)) return false;\n\treturn error.details.some((detail) => detail.reason === \"SECURITY_POLICY_VIOLATED\");\n}\n\n/**\n * Poll a long-running operation until completion\n */\nasync function pollOperation(\n\toperationName: string,\n\theaders: Record<string, string>,\n\tonProgress?: (message: string) => void,\n): Promise<LongRunningOperationResponse> {\n\tlet attempt = 0;\n\twhile (true) {\n\t\tif (attempt > 0) {\n\t\t\tonProgress?.(`Waiting for project provisioning (attempt ${attempt + 1})...`);\n\t\t\tawait wait(5000);\n\t\t}\n\n\t\tconst response = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal/${operationName}`, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to poll operation: ${response.status} ${response.statusText}`);\n\t\t}\n\n\t\tconst data = (await response.json()) as LongRunningOperationResponse;\n\t\tif (data.done) {\n\t\t\treturn data;\n\t\t}\n\n\t\tattempt += 1;\n\t}\n}\n\n/**\n * Discover or provision a Google Cloud project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\t// Check for user-provided project ID via environment variable\n\tconst envProjectId = process.env.GOOGLE_CLOUD_PROJECT || process.env.GOOGLE_CLOUD_PROJECT_ID;\n\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"gl-node/22.17.0\",\n\t};\n\n\t// Try to load existing project via loadCodeAssist\n\tonProgress?.(\"Checking for existing Cloud Code Assist project...\");\n\tconst loadResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify({\n\t\t\tcloudaicompanionProject: envProjectId,\n\t\t\tmetadata: {\n\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\tduetProject: envProjectId,\n\t\t\t},\n\t\t}),\n\t});\n\n\tlet data: LoadCodeAssistPayload;\n\n\tif (!loadResponse.ok) {\n\t\tlet errorPayload: unknown;\n\t\ttry {\n\t\t\terrorPayload = await loadResponse.clone().json();\n\t\t} catch {\n\t\t\terrorPayload = undefined;\n\t\t}\n\n\t\tif (isVpcScAffectedUser(errorPayload)) {\n\t\t\tdata = { currentTier: { id: TIER_STANDARD } };\n\t\t} else {\n\t\t\tconst errorText = await loadResponse.text();\n\t\t\tthrow new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);\n\t\t}\n\t} else {\n\t\tdata = (await loadResponse.json()) as LoadCodeAssistPayload;\n\t}\n\n\t// If user already has a current tier and project, use it\n\tif (data.currentTier) {\n\t\tif (data.cloudaicompanionProject) {\n\t\t\treturn data.cloudaicompanionProject;\n\t\t}\n\t\t// User has a tier but no managed project - they need to provide one via env var\n\t\tif (envProjectId) {\n\t\t\treturn envProjectId;\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\t// User needs to be onboarded - get the default tier\n\tconst tier = getDefaultTier(data.allowedTiers);\n\tconst tierId = tier?.id ?? TIER_FREE;\n\n\tif (tierId !== TIER_FREE && !envProjectId) {\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\tonProgress?.(\"Provisioning Cloud Code Assist project (this may take a moment)...\");\n\n\t// Build onboard request - for free tier, don't include project ID (Google provisions one)\n\t// For other tiers, include the user's project ID if available\n\tconst onboardBody: Record<string, unknown> = {\n\t\ttierId,\n\t\tmetadata: {\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t},\n\t};\n\n\tif (tierId !== TIER_FREE && envProjectId) {\n\t\tonboardBody.cloudaicompanionProject = envProjectId;\n\t\t(onboardBody.metadata as Record<string, unknown>).duetProject = envProjectId;\n\t}\n\n\t// Start onboarding - this returns a long-running operation\n\tconst onboardResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify(onboardBody),\n\t});\n\n\tif (!onboardResponse.ok) {\n\t\tconst errorText = await onboardResponse.text();\n\t\tthrow new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);\n\t}\n\n\tlet lroData = (await onboardResponse.json()) as LongRunningOperationResponse;\n\n\t// If the operation isn't done yet, poll until completion\n\tif (!lroData.done && lroData.name) {\n\t\tlroData = await pollOperation(lroData.name, headers, onProgress);\n\t}\n\n\t// Try to get project ID from the response\n\tconst projectId = lroData.response?.cloudaicompanionProject?.id;\n\tif (projectId) {\n\t\treturn projectId;\n\t}\n\n\t// If no project ID from onboarding, fall back to env var\n\tif (envProjectId) {\n\t\treturn envProjectId;\n\t}\n\n\tthrow new Error(\n\t\t\"Could not discover or provision a Google Cloud project. \" +\n\t\t\t\"Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t);\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Google Cloud Code Assist token\n */\nexport async function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Google Cloud token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Gemini CLI (Google Cloud Code Assist) OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginGeminiCli(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const geminiCliOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-gemini-cli\",\n\tname: \"Google Cloud Code Assist (Gemini CLI)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginGeminiCli(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Google Cloud credentials missing projectId\");\n\t\t}\n\t\treturn refreshGoogleCloudToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AAErC,SAAS,0BAAsE;CAC9E,MAAM,WAAW,QAAQ,IAAI,2BAA2B,MAAM;CAC9D,MAAM,eAAe,QAAQ,IAAI,+BAA+B,MAAM;AACtE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,oCAAoC,yBAAyB,OAAO,6BAA6B,GACjG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AACrB,MAAM,SAAS;CACd;CACA;CACA;CACA;AACD,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,uBAAuB;;;;AAW7B,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,6DAA6D;;AAG9E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,wBAAwB;AAE3D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,YAAY;AACzB,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;AAsBX,MAAM,YAAY;AAClB,MAAM,gBAAgB;;;;AAWtB,SAAS,KAAK,IAA2B;AACxC,QAAO,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;;;;;AAMzD,SAAS,eAAe,cAA6E;AACpG,KAAI,CAAC,gBAAgB,aAAa,WAAW,EAAG,QAAO,EAAE,IAAI,WAAW;AAExE,QADoB,aAAa,MAAM,MAAM,EAAE,UAC7B,IAAI,aAAa,MAAM,EAAE,IAAI,WAAW;;AAG3D,SAAS,oBAAoB,SAA2B;AACvD,KAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,KAAI,EAAE,WAAW,SAAU,QAAO;CAClC,MAAM,QAAS,QAAmC;AAClD,KAAI,CAAC,OAAO,WAAW,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAAE,QAAO;AAC7D,QAAO,MAAM,QAAQ,MAAM,WAAW,OAAO,WAAW,2BAA2B;;;;;AAMpF,eAAe,cACd,eACA,SACA,YACwC;CACxC,IAAI,UAAU;AACd,QAAO,MAAM;AACZ,MAAI,UAAU,GAAG;AAChB,gBAAa,6CAA6C,UAAU,EAAE,MAAM;AAC5E,SAAM,KAAK,IAAK;;EAGjB,MAAM,WAAW,MAAM,MAAM,GAAG,qBAAqB,cAAc,iBAAiB;GACnF,QAAQ;GACR;GACA,CAAC;AAEF,MAAI,CAAC,SAAS,GACb,OAAM,IAAI,MAAM,6BAA6B,SAAS,OAAO,GAAG,SAAS,aAAa;EAGvF,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,MAAI,KAAK,KACR,QAAO;AAGR,aAAW;;;;;;AAOb,eAAe,gBAAgB,aAAqB,YAAyD;CAE5G,MAAM,eAAe,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;CAErE,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB;AAGD,cAAa,qDAAqD;CAClE,MAAM,eAAe,MAAM,MAAM,GAAG,qBAAqB,6BAA6B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACpB,yBAAyB;GACzB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb;GACD,CAAC;EACF,CAAC;CAEF,IAAI;AAEJ,KAAI,CAAC,aAAa,IAAI;EACrB,IAAI;AACJ,MAAI;AACH,kBAAe,MAAM,aAAa,OAAO,CAAC,MAAM;UACzC;AACP,kBAAe,KAAA;;AAGhB,MAAI,oBAAoB,aAAa,CACpC,QAAO,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE;OACvC;GACN,MAAM,YAAY,MAAM,aAAa,MAAM;AAC3C,SAAM,IAAI,MAAM,0BAA0B,aAAa,OAAO,GAAG,aAAa,WAAW,IAAI,YAAY;;OAG1G,QAAQ,MAAM,aAAa,MAAM;AAIlC,KAAI,KAAK,aAAa;AACrB,MAAI,KAAK,wBACR,QAAO,KAAK;AAGb,MAAI,aACH,QAAO;AAER,QAAM,IAAI,MACT,iKAEA;;CAKF,MAAM,SADO,eAAe,KAAK,aACd,EAAE,MAAM;AAE3B,KAAI,WAAW,aAAa,CAAC,aAC5B,OAAM,IAAI,MACT,iKAEA;AAGF,cAAa,qEAAqE;CAIlF,MAAM,cAAuC;EAC5C;EACA,UAAU;GACT,SAAS;GACT,UAAU;GACV,YAAY;GACZ;EACD;AAED,KAAI,WAAW,aAAa,cAAc;AACzC,cAAY,0BAA0B;AACrC,cAAY,SAAqC,cAAc;;CAIjE,MAAM,kBAAkB,MAAM,MAAM,GAAG,qBAAqB,0BAA0B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,YAAY;EACjC,CAAC;AAEF,KAAI,CAAC,gBAAgB,IAAI;EACxB,MAAM,YAAY,MAAM,gBAAgB,MAAM;AAC9C,QAAM,IAAI,MAAM,uBAAuB,gBAAgB,OAAO,GAAG,gBAAgB,WAAW,IAAI,YAAY;;CAG7G,IAAI,UAAW,MAAM,gBAAgB,MAAM;AAG3C,KAAI,CAAC,QAAQ,QAAQ,QAAQ,KAC5B,WAAU,MAAM,cAAc,QAAQ,MAAM,SAAS,WAAW;CAIjE,MAAM,YAAY,QAAQ,UAAU,yBAAyB;AAC7D,KAAI,UACH,QAAO;AAIR,KAAI,aACH,QAAO;AAGR,OAAM,IAAI,MACT,uMAGA;;;;;AAMF,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;CAC5D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,sCAAsC,QAAQ;;CAG/D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,eACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;AAG5D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,eAAe,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG3F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,6CAA6C;AAE9D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/oauth-page.js

@@ -1,5 +1,5 @@
-//#region src/auth/oauth/vendor-pi-google/oauth-page.ts
-const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg>`;
+//#region src/auth/oauth/google-oauth/oauth-page.ts
+const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 72 72" aria-hidden="true"><rect width="72" height="72" rx="20" fill="#2563eb"/><path d="M22 22l28 28M50 22L22 50" stroke="#fff" stroke-width="8" stroke-linecap="round"/></svg>`;
 function escapeHtml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
 }
@@ -44,11 +44,19 @@ function renderPage(options) {
       align-items: center;
       justify-content: center;
     }
+    .brand {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      gap: 10px;
+      margin-bottom: 24px;
+      font-weight: 700;
+      letter-spacing: -0.02em;
+    }
     .logo {
       width: 72px;
       height: 72px;
       display: block;
-      margin-bottom: 24px;
     }
     h1 {
       margin: 0 0 10px;
@@ -75,7 +83,7 @@ function renderPage(options) {
 </head>
 <body>
   <main>
-    <div class="logo">${LOGO_SVG}</div>
+    <div class="brand"><div class="logo">${LOGO_SVG}</div><div>xopc</div></div>
     <h1>${heading}</h1>
     <p>${message}</p>
     ${details ? `<div class="details">${details}</div>` : ""}

package/dist/src/auth/oauth/google-oauth/oauth-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-page.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/oauth-page.ts"],"sourcesContent":["const LOGO_SVG = `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 72 72\" aria-hidden=\"true\"><rect width=\"72\" height=\"72\" rx=\"20\" fill=\"#2563eb\"/><path d=\"M22 22l28 28M50 22L22 50\" stroke=\"#fff\" stroke-width=\"8\" stroke-linecap=\"round\"/></svg>`;\n\nfunction escapeHtml(value: string): string {\n\treturn value\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#39;\");\n}\n\nfunction renderPage(options: { title: string; heading: string; message: string; details?: string }): string {\n\tconst title = escapeHtml(options.title);\n\tconst heading = escapeHtml(options.heading);\n\tconst message = escapeHtml(options.message);\n\tconst details = options.details ? escapeHtml(options.details) : undefined;\n\n\treturn `<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>${title}</title>\n  <style>\n    :root {\n      --text: #fafafa;\n      --text-dim: #a1a1aa;\n      --page-bg: #09090b;\n      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, \"Noto Sans\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\";\n      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace;\n    }\n    * { box-sizing: border-box; }\n    html { color-scheme: dark; }\n    body {\n      margin: 0;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 24px;\n      background: var(--page-bg);\n      color: var(--text);\n      font-family: var(--font-sans);\n      text-align: center;\n    }\n    main {\n      width: 100%;\n      max-width: 560px;\n      display: flex;\n      flex-direction: column;\n      align-items: center;\n      justify-content: center;\n    }\n    .brand {\n      display: flex;\n      flex-direction: column;\n      align-items: center;\n      gap: 10px;\n      margin-bottom: 24px;\n      font-weight: 700;\n      letter-spacing: -0.02em;\n    }\n    .logo {\n      width: 72px;\n      height: 72px;\n      display: block;\n    }\n    h1 {\n      margin: 0 0 10px;\n      font-size: 28px;\n      line-height: 1.15;\n      font-weight: 650;\n      color: var(--text);\n    }\n    p {\n      margin: 0;\n      line-height: 1.7;\n      color: var(--text-dim);\n      font-size: 15px;\n    }\n    .details {\n      margin-top: 16px;\n      font-family: var(--font-mono);\n      font-size: 13px;\n      color: var(--text-dim);\n      white-space: pre-wrap;\n      word-break: break-word;\n    }\n  </style>\n</head>\n<body>\n  <main>\n    <div class=\"brand\"><div class=\"logo\">${LOGO_SVG}</div><div>xopc</div></div>\n    <h1>${heading}</h1>\n    <p>${message}</p>\n    ${details ? `<div class=\"details\">${details}</div>` : \"\"}\n  </main>\n</body>\n</html>`;\n}\n\nexport function oauthSuccessHtml(message: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication successful\",\n\t\theading: \"Authentication successful\",\n\t\tmessage,\n\t});\n}\n\nexport function oauthErrorHtml(message: string, details?: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication failed\",\n\t\theading: \"Authentication failed\",\n\t\tmessage,\n\t\tdetails,\n\t});\n}\n"],"mappings":";AAAA,MAAM,WAAW;AAEjB,SAAS,WAAW,OAAuB;AAC1C,QAAO,MACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,QAAQ;;AAG3B,SAAS,WAAW,SAAwF;CAC3G,MAAM,QAAQ,WAAW,QAAQ,MAAM;CACvC,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,QAAQ,UAAU,WAAW,QAAQ,QAAQ,GAAG,KAAA;AAEhE,QAAO;;;;;WAKG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAsE0B,SAAS;UAC1C,QAAQ;SACT,QAAQ;MACX,UAAU,wBAAwB,QAAQ,UAAU,GAAG;;;;;AAM7D,SAAgB,iBAAiB,SAAyB;AACzD,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA,CAAC;;AAGH,SAAgB,eAAe,SAAiB,SAA0B;AACzE,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA;EACA,CAAC"}

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/pkce.d.ts

@@ -4,7 +4,7 @@
  */
 /**
  * Generate PKCE code verifier and challenge.
- * Uses Web Crypto API for cross-platform compatibility.
+ * Uses Web Crypto API.
  */
 export declare function generatePKCE(): Promise<{
     verifier: string;