@xopcai/xopc 0.0.102 → 0.0.104

package/dist/src/auth/oauth/{vendor-pi-google → google-oauth}/pkce.js

@@ -1,4 +1,4 @@
-//#region src/auth/oauth/vendor-pi-google/pkce.ts
+//#region src/auth/oauth/google-oauth/pkce.ts
 /**
 * PKCE utilities using Web Crypto API.
 * Works in both Node.js 20+ and browsers.
@@ -13,7 +13,7 @@ function base64urlEncode(bytes) {
 }
 /**
 * Generate PKCE code verifier and challenge.
-* Uses Web Crypto API for cross-platform compatibility.
+* Uses Web Crypto API.
 */
 async function generatePKCE() {
 	const verifierBytes = new Uint8Array(32);

package/dist/src/auth/oauth/google-oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","names":[],"sources":["../../../../../src/auth/oauth/google-oauth/pkce.ts"],"sourcesContent":["/**\n * PKCE utilities using Web Crypto API.\n * Works in both Node.js 20+ and browsers.\n */\n\n/**\n * Encode bytes as base64url string.\n */\nfunction base64urlEncode(bytes: Uint8Array): string {\n\tlet binary = \"\";\n\tfor (const byte of bytes) {\n\t\tbinary += String.fromCharCode(byte);\n\t}\n\treturn btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n * Uses Web Crypto API.\n */\nexport async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {\n\t// Generate random verifier\n\tconst verifierBytes = new Uint8Array(32);\n\tcrypto.getRandomValues(verifierBytes);\n\tconst verifier = base64urlEncode(verifierBytes);\n\n\t// Compute SHA-256 challenge\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n\tconst challenge = base64urlEncode(new Uint8Array(hashBuffer));\n\n\treturn { verifier, challenge };\n}\n"],"mappings":";;;;;;;;AAQA,SAAS,gBAAgB,OAA2B;CACnD,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MAClB,WAAU,OAAO,aAAa,KAAK;AAEpC,QAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO9E,eAAsB,eAAiE;CAEtF,MAAM,gBAAgB,IAAI,WAAW,GAAG;AACxC,QAAO,gBAAgB,cAAc;CACrC,MAAM,WAAW,gBAAgB,cAAc;CAI/C,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG9D,QAAO;EAAE;EAAU,WAFD,gBAAgB,IAAI,WAAW,WAAW,CAEhC;EAAE"}

package/dist/src/auth/oauth/index.js

@@ -3,9 +3,9 @@ import { minimaxOAuthProvider } from "./minimax.js";
 import { minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken } from "./github-copilot.js";
-import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./vendor-pi-google/google-gemini-cli.js";
+import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-oauth/google-gemini-cli.js";
 import "./google-gemini-cli.js";
-import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./vendor-pi-google/google-antigravity.js";
+import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-oauth/google-antigravity.js";
 import "./google-antigravity.js";
 import { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
 export { anthropicOAuthProvider, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginGitHubCopilot, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, normalizeDomain, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGitHubCopilotToken, refreshGoogleCloudToken, refreshOpenAICodexToken };

package/dist/src/auth/oauth/kimi-coding.d.ts

@@ -1,5 +1,5 @@
 /**
- * Kimi Coding (Moonshot AI) OAuth — device code flow for pi-ai `kimi-coding` provider.
+ * Kimi Coding (Moonshot AI) OAuth device code flow.
  * @see https://auth.kimi.com
  */
 import type { OAuthProviderInterface } from './types.js';

package/dist/src/auth/oauth/kimi-coding.js

@@ -6,7 +6,7 @@ const KIMI_OAUTH_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const kimiCodingOAuthProvider = {
 	id: "kimi-coding",
 	name: "Kimi For Coding (月之暗面)",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {
 			method: "POST",

package/dist/src/auth/oauth/kimi-coding.js.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-coding.js","names":[],"sources":["../../../../src/auth/oauth/kimi-coding.ts"],"sourcesContent":["/**\n * Kimi Coding (Moonshot AI) OAuth — device code flow for pi-ai `kimi-coding` provider.\n * @see https://auth.kimi.com\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst KIMI_OAUTH_BASE_URL = 'https://auth.kimi.com';\nconst KIMI_OAUTH_DEVICE_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/device_authorization`;\nconst KIMI_OAUTH_TOKEN_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/token`;\nconst KIMI_OAUTH_CLIENT_ID = '17e5f671-d194-4dfb-9706-5516cb48c098';\n\nexport const kimiCodingOAuthProvider: OAuthProviderInterface = {\n\tid: 'kimi-coding',\n\tname: 'Kimi For Coding (月之暗面)',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\tconst deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\tscope: 'kimi-code',\n\t\t\t}),\n\t\t});\n\n\t\tif (!deviceResponse.ok) {\n\t\t\tconst error = await deviceResponse.text();\n\t\t\tthrow new Error(`Device code request failed: ${error}`);\n\t\t}\n\n\t\tconst deviceData = (await deviceResponse.json()) as {\n\t\t\tdevice_code: string;\n\t\t\tuser_code: string;\n\t\t\tverification_uri: string;\n\t\t\tverification_uri_complete: string;\n\t\t\tinterval: number;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tcallbacks.onAuth({\n\t\t\turl: deviceData.verification_uri_complete || deviceData.verification_uri,\n\t\t\tinstructions: `Please visit ${deviceData.verification_uri} and enter code: ${deviceData.user_code}`,\n\t\t});\n\n\t\tconst expiresAt = Date.now() + deviceData.expires_in * 1000;\n\t\tconst pollInterval = (deviceData.interval || 5) * 1000;\n\n\t\twhile (Date.now() < expiresAt) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, pollInterval));\n\n\t\t\tconst tokenResponse = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: {\n\t\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n\t\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\t\tdevice_code: deviceData.device_code,\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (tokenResponse.ok) {\n\t\t\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\t\t\taccess_token: string;\n\t\t\t\t\trefresh_token: string;\n\t\t\t\t\texpires_in: number;\n\t\t\t\t};\n\n\t\t\t\treturn {\n\t\t\t\t\taccess: tokenData.access_token,\n\t\t\t\t\trefresh: tokenData.refresh_token,\n\t\t\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst errorData = (await tokenResponse.json()) as { error?: string };\n\t\t\tif (errorData.error === 'expired_token') {\n\t\t\t\tthrow new Error('Device code expired. Please try again.');\n\t\t\t}\n\t\t}\n\n\t\tthrow new Error('Device code expired. Please try again.');\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('Kimi OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`Kimi OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = (await response.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n"],"mappings":";AAOA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB,GAAG,oBAAoB;AACrD,MAAM,uBAAuB,GAAG,oBAAoB;AACpD,MAAM,uBAAuB;AAE7B,MAAa,0BAAkD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EACtE,MAAM,iBAAiB,MAAM,MAAM,uBAAuB;GACzD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,OAAO;IACP,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,eAAe,IAAI;GACvB,MAAM,QAAQ,MAAM,eAAe,MAAM;AACzC,SAAM,IAAI,MAAM,+BAA+B,QAAQ;;EAGxD,MAAM,aAAc,MAAM,eAAe,MAAM;AAS/C,YAAU,OAAO;GAChB,KAAK,WAAW,6BAA6B,WAAW;GACxD,cAAc,gBAAgB,WAAW,iBAAiB,mBAAmB,WAAW;GACxF,CAAC;EAEF,MAAM,YAAY,KAAK,KAAK,GAAG,WAAW,aAAa;EACvD,MAAM,gBAAgB,WAAW,YAAY,KAAK;AAElD,SAAO,KAAK,KAAK,GAAG,WAAW;AAC9B,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;GAEjE,MAAM,gBAAgB,MAAM,MAAM,sBAAsB;IACvD,QAAQ;IACR,SAAS,EACR,gBAAgB,qCAChB;IACD,MAAM,IAAI,gBAAgB;KACzB,YAAY;KACZ,WAAW;KACX,aAAa,WAAW;KACxB,CAAC;IACF,CAAC;AAEF,OAAI,cAAc,IAAI;IACrB,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,WAAO;KACN,QAAQ,UAAU;KAClB,SAAS,UAAU;KACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;KAC7C;;AAIF,QAAI,MADqB,cAAc,MAAM,EAC/B,UAAU,gBACvB,OAAM,IAAI,MAAM,yCAAyC;;AAI3D,QAAM,IAAI,MAAM,yCAAyC;;CAG1D,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,qDAAqD;EAGtE,MAAM,WAAW,MAAM,MAAM,sBAAsB;GAClD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,8BAA8B,OAAO;;EAGtD,MAAM,UAAW,MAAM,SAAS,MAAM;AAMtC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB"}
+{"version":3,"file":"kimi-coding.js","names":[],"sources":["../../../../src/auth/oauth/kimi-coding.ts"],"sourcesContent":["/**\n * Kimi Coding (Moonshot AI) OAuth device code flow.\n * @see https://auth.kimi.com\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst KIMI_OAUTH_BASE_URL = 'https://auth.kimi.com';\nconst KIMI_OAUTH_DEVICE_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/device_authorization`;\nconst KIMI_OAUTH_TOKEN_URL = `${KIMI_OAUTH_BASE_URL}/api/oauth/token`;\nconst KIMI_OAUTH_CLIENT_ID = '17e5f671-d194-4dfb-9706-5516cb48c098';\n\nexport const kimiCodingOAuthProvider: OAuthProviderInterface = {\n\tid: 'kimi-coding',\n\tname: 'Kimi For Coding (月之暗面)',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\tconst deviceResponse = await fetch(KIMI_OAUTH_DEVICE_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\tscope: 'kimi-code',\n\t\t\t}),\n\t\t});\n\n\t\tif (!deviceResponse.ok) {\n\t\t\tconst error = await deviceResponse.text();\n\t\t\tthrow new Error(`Device code request failed: ${error}`);\n\t\t}\n\n\t\tconst deviceData = (await deviceResponse.json()) as {\n\t\t\tdevice_code: string;\n\t\t\tuser_code: string;\n\t\t\tverification_uri: string;\n\t\t\tverification_uri_complete: string;\n\t\t\tinterval: number;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tcallbacks.onAuth({\n\t\t\turl: deviceData.verification_uri_complete || deviceData.verification_uri,\n\t\t\tinstructions: `Please visit ${deviceData.verification_uri} and enter code: ${deviceData.user_code}`,\n\t\t});\n\n\t\tconst expiresAt = Date.now() + deviceData.expires_in * 1000;\n\t\tconst pollInterval = (deviceData.interval || 5) * 1000;\n\n\t\twhile (Date.now() < expiresAt) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, pollInterval));\n\n\t\t\tconst tokenResponse = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: {\n\t\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n\t\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\t\tdevice_code: deviceData.device_code,\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (tokenResponse.ok) {\n\t\t\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\t\t\taccess_token: string;\n\t\t\t\t\trefresh_token: string;\n\t\t\t\t\texpires_in: number;\n\t\t\t\t};\n\n\t\t\t\treturn {\n\t\t\t\t\taccess: tokenData.access_token,\n\t\t\t\t\trefresh: tokenData.refresh_token,\n\t\t\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst errorData = (await tokenResponse.json()) as { error?: string };\n\t\t\tif (errorData.error === 'expired_token') {\n\t\t\t\tthrow new Error('Device code expired. Please try again.');\n\t\t\t}\n\t\t}\n\n\t\tthrow new Error('Device code expired. Please try again.');\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('Kimi OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(KIMI_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: KIMI_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`Kimi OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = (await response.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n"],"mappings":";AAOA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB,GAAG,oBAAoB;AACrD,MAAM,uBAAuB,GAAG,oBAAoB;AACpD,MAAM,uBAAuB;AAE7B,MAAa,0BAAkD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EACtE,MAAM,iBAAiB,MAAM,MAAM,uBAAuB;GACzD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,OAAO;IACP,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,eAAe,IAAI;GACvB,MAAM,QAAQ,MAAM,eAAe,MAAM;AACzC,SAAM,IAAI,MAAM,+BAA+B,QAAQ;;EAGxD,MAAM,aAAc,MAAM,eAAe,MAAM;AAS/C,YAAU,OAAO;GAChB,KAAK,WAAW,6BAA6B,WAAW;GACxD,cAAc,gBAAgB,WAAW,iBAAiB,mBAAmB,WAAW;GACxF,CAAC;EAEF,MAAM,YAAY,KAAK,KAAK,GAAG,WAAW,aAAa;EACvD,MAAM,gBAAgB,WAAW,YAAY,KAAK;AAElD,SAAO,KAAK,KAAK,GAAG,WAAW;AAC9B,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;GAEjE,MAAM,gBAAgB,MAAM,MAAM,sBAAsB;IACvD,QAAQ;IACR,SAAS,EACR,gBAAgB,qCAChB;IACD,MAAM,IAAI,gBAAgB;KACzB,YAAY;KACZ,WAAW;KACX,aAAa,WAAW;KACxB,CAAC;IACF,CAAC;AAEF,OAAI,cAAc,IAAI;IACrB,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,WAAO;KACN,QAAQ,UAAU;KAClB,SAAS,UAAU;KACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;KAC7C;;AAIF,QAAI,MADqB,cAAc,MAAM,EAC/B,UAAU,gBACvB,OAAM,IAAI,MAAM,yCAAyC;;AAI3D,QAAM,IAAI,MAAM,yCAAyC;;CAG1D,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,qDAAqD;EAGtE,MAAM,WAAW,MAAM,MAAM,sBAAsB;GAClD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,8BAA8B,OAAO;;EAGtD,MAAM,UAAW,MAAM,SAAS,MAAM;AAMtC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB"}

package/dist/src/auth/oauth/minimax-cn.js

@@ -6,7 +6,7 @@ const MINIMAX_CN_OAUTH_CLIENT_ID = "your_client_id";
 const minimaxCnOAuthProvider = {
 	id: "minimax-cn",
 	name: "MiniMax 国内版",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const codeVerifier = generateCodeVerifier();
 		const codeChallenge = await generateCodeChallenge(codeVerifier);

package/dist/src/auth/oauth/minimax-cn.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimax-cn.js","names":[],"sources":["../../../../src/auth/oauth/minimax-cn.ts"],"sourcesContent":["/**\n * MiniMax CN (China region) OAuth provider\n *\n * OAuth 2.0 for the MiniMax China platform: https://platform.minimax.chat/\n *\n * Endpoints differ from the international product:\n * - International: platform.minimaxi.com\n * - China: platform.minimax.chat\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_CN_OAUTH_BASE_URL = 'https://platform.minimax.chat';\nconst MINIMAX_CN_OAUTH_AUTHORIZE_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_CN_OAUTH_TOKEN_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_CN_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxCnOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax-cn',\n\tname: 'MiniMax 国内版',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax CN uses authorization code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_CN_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_CN_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: '请在浏览器中授权应用，然后输入返回的授权码。',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: '请输入授权码：',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax CN OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax CN OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AAYA,MAAM,4BAA4B;AAClC,MAAM,iCAAiC,GAAG,0BAA0B;AACpE,MAAM,6BAA6B,GAAG,0BAA0B;AAChE,MAAM,6BAA6B;AAEnC,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAEtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,+BAA+B;AACvD,UAAQ,aAAa,IAAI,aAAa,2BAA2B;AACjE,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,WACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,4BAA4B;GAC7D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,2DAA2D;EAG5E,MAAM,WAAW,MAAM,MAAM,4BAA4B;GACxD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,oCAAoC,OAAO;;EAG5D,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}
+{"version":3,"file":"minimax-cn.js","names":[],"sources":["../../../../src/auth/oauth/minimax-cn.ts"],"sourcesContent":["/**\n * MiniMax CN (China region) OAuth provider\n *\n * OAuth 2.0 for the MiniMax China platform: https://platform.minimax.chat/\n *\n * Endpoints differ from the international product:\n * - International: platform.minimaxi.com\n * - China: platform.minimax.chat\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_CN_OAUTH_BASE_URL = 'https://platform.minimax.chat';\nconst MINIMAX_CN_OAUTH_AUTHORIZE_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_CN_OAUTH_TOKEN_URL = `${MINIMAX_CN_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_CN_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxCnOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax-cn',\n\tname: 'MiniMax 国内版',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax CN uses authorization code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_CN_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_CN_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: '请在浏览器中授权应用，然后输入返回的授权码。',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: '请输入授权码：',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax CN OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_CN_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_CN_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax CN OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AAYA,MAAM,4BAA4B;AAClC,MAAM,iCAAiC,GAAG,0BAA0B;AACpE,MAAM,6BAA6B,GAAG,0BAA0B;AAChE,MAAM,6BAA6B;AAEnC,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAEtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,+BAA+B;AACvD,UAAQ,aAAa,IAAI,aAAa,2BAA2B;AACjE,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,WACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,4BAA4B;GAC7D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,2DAA2D;EAG5E,MAAM,WAAW,MAAM,MAAM,4BAA4B;GACxD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,oCAAoC,OAAO;;EAG5D,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}

package/dist/src/auth/oauth/minimax.js

@@ -6,7 +6,7 @@ const MINIMAX_OAUTH_CLIENT_ID = "your_client_id";
 const minimaxOAuthProvider = {
 	id: "minimax",
 	name: "MiniMax",
-	usesCallbackServer: true,
+	usesCallbackServer: false,
 	async login(callbacks) {
 		const codeVerifier = generateCodeVerifier();
 		const codeChallenge = await generateCodeChallenge(codeVerifier);

package/dist/src/auth/oauth/minimax.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimax.js","names":[],"sources":["../../../../src/auth/oauth/minimax.ts"],"sourcesContent":["/**\n * MiniMax OAuth Provider\n * \n * OAuth 2.0 authentication for MiniMax Platform.\n * https://platform.minimaxi.com/\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_OAUTH_BASE_URL = 'https://platform.minimaxi.com';\nconst MINIMAX_OAUTH_AUTHORIZE_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_OAUTH_TOKEN_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax',\n\tname: 'MiniMax',\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax uses authorization code flow\n\t\t// First, generate a device code or authorization URL\n\t\t\n\t\t// For simplicity, we'll use a manual code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: 'Please authorize the application and enter the code shown.',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: 'Enter the authorization code:',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AASA,MAAM,yBAAyB;AAC/B,MAAM,8BAA8B,GAAG,uBAAuB;AAC9D,MAAM,0BAA0B,GAAG,uBAAuB;AAC1D,MAAM,0BAA0B;AAEhC,MAAa,uBAA+C;CAC3D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAKtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,4BAA4B;AACpD,UAAQ,aAAa,IAAI,aAAa,wBAAwB;AAC9D,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,iCACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,yBAAyB;GAC1D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,wDAAwD;EAGzE,MAAM,WAAW,MAAM,MAAM,yBAAyB;GACrD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,iCAAiC,OAAO;;EAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}
+{"version":3,"file":"minimax.js","names":[],"sources":["../../../../src/auth/oauth/minimax.ts"],"sourcesContent":["/**\n * MiniMax OAuth Provider\n * \n * OAuth 2.0 authentication for MiniMax Platform.\n * https://platform.minimaxi.com/\n */\n\nimport type { OAuthCredentials, OAuthProviderInterface, OAuthLoginCallbacks } from './types.js';\n\nconst MINIMAX_OAUTH_BASE_URL = 'https://platform.minimaxi.com';\nconst MINIMAX_OAUTH_AUTHORIZE_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/authorize`;\nconst MINIMAX_OAUTH_TOKEN_URL = `${MINIMAX_OAUTH_BASE_URL}/oauth/token`;\nconst MINIMAX_OAUTH_CLIENT_ID = 'your_client_id'; // Users need to register their own app\n\nexport const minimaxOAuthProvider: OAuthProviderInterface = {\n\tid: 'minimax',\n\tname: 'MiniMax',\n\tusesCallbackServer: false,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t// MiniMax uses authorization code flow\n\t\t// First, generate a device code or authorization URL\n\t\t\n\t\t// For simplicity, we'll use a manual code flow\n\t\tconst codeVerifier = generateCodeVerifier();\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\t\n\t\tconst authUrl = new URL(MINIMAX_OAUTH_AUTHORIZE_URL);\n\t\tauthUrl.searchParams.set('client_id', MINIMAX_OAUTH_CLIENT_ID);\n\t\tauthUrl.searchParams.set('redirect_uri', 'http://localhost:3000/callback');\n\t\tauthUrl.searchParams.set('response_type', 'code');\n\t\tauthUrl.searchParams.set('scope', 'api');\n\t\tauthUrl.searchParams.set('code_challenge', codeChallenge);\n\t\tauthUrl.searchParams.set('code_challenge_method', 'S256');\n\n\t\t// Show user the auth URL\n\t\tcallbacks.onAuth({\n\t\t\turl: authUrl.toString(),\n\t\t\tinstructions: 'Please authorize the application and enter the code shown.',\n\t\t});\n\n\t\t// Prompt for the authorization code\n\t\tconst code = await callbacks.onPrompt({\n\t\t\tmessage: 'Enter the authorization code:',\n\t\t});\n\n\t\t// Exchange code for token\n\t\tconst tokenResponse = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\tcode,\n\t\t\t\tredirect_uri: 'http://localhost:3000/callback',\n\t\t\t\tcode_verifier: codeVerifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = await tokenResponse.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\taccess: tokenData.access_token,\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\texpires: Date.now() + tokenData.expires_in * 1000,\n\t\t};\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tif (!credentials.refresh) {\n\t\t\tthrow new Error('MiniMax OAuth refresh token missing. Re-authenticate.');\n\t\t}\n\n\t\tconst response = await fetch(MINIMAX_OAUTH_TOKEN_URL, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: MINIMAX_OAUTH_CLIENT_ID,\n\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t}),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst text = await response.text();\n\t\t\tthrow new Error(`MiniMax OAuth refresh failed: ${text}`);\n\t\t}\n\n\t\tconst payload = await response.json() as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\treturn {\n\t\t\t...credentials,\n\t\t\taccess: payload.access_token,\n\t\t\trefresh: payload.refresh_token || credentials.refresh,\n\t\t\texpires: Date.now() + payload.expires_in * 1000,\n\t\t};\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\treturn credentials.access;\n\t},\n};\n\nfunction generateCodeVerifier(): string {\n\tconst array = new Uint8Array(32);\n\tcrypto.getRandomValues(array);\n\treturn base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst digest = await crypto.subtle.digest('SHA-256', data);\n\treturn base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n\tlet str = '';\n\tbuffer.forEach(b => str += String.fromCharCode(b));\n\treturn btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n"],"mappings":";AASA,MAAM,yBAAyB;AAC/B,MAAM,8BAA8B,GAAG,uBAAuB;AAC9D,MAAM,0BAA0B,GAAG,uBAAuB;AAC1D,MAAM,0BAA0B;AAEhC,MAAa,uBAA+C;CAC3D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;EAKtE,MAAM,eAAe,sBAAsB;EAC3C,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;EAE/D,MAAM,UAAU,IAAI,IAAI,4BAA4B;AACpD,UAAQ,aAAa,IAAI,aAAa,wBAAwB;AAC9D,UAAQ,aAAa,IAAI,gBAAgB,iCAAiC;AAC1E,UAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,UAAQ,aAAa,IAAI,SAAS,MAAM;AACxC,UAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,UAAQ,aAAa,IAAI,yBAAyB,OAAO;AAGzD,YAAU,OAAO;GAChB,KAAK,QAAQ,UAAU;GACvB,cAAc;GACd,CAAC;EAGF,MAAM,OAAO,MAAM,UAAU,SAAS,EACrC,SAAS,iCACT,CAAC;EAGF,MAAM,gBAAgB,MAAM,MAAM,yBAAyB;GAC1D,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAY,MAAM,cAAc,MAAM;AAM5C,SAAO;GACN,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,KAAK,KAAK,GAAG,UAAU,aAAa;GAC7C;;CAGF,MAAM,aAAa,aAA0D;AAC5E,MAAI,CAAC,YAAY,QAChB,OAAM,IAAI,MAAM,wDAAwD;EAGzE,MAAM,WAAW,MAAM,MAAM,yBAAyB;GACrD,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,YAAY;IACZ,WAAW;IACX,eAAe,YAAY;IAC3B,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GACjB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,SAAM,IAAI,MAAM,iCAAiC,OAAO;;EAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;AAMrC,SAAO;GACN,GAAG;GACH,QAAQ,QAAQ;GAChB,SAAS,QAAQ,iBAAiB,YAAY;GAC9C,SAAS,KAAK,KAAK,GAAG,QAAQ,aAAa;GAC3C;;CAGF,UAAU,aAAuC;AAChD,SAAO,YAAY;;CAEpB;AAED,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;AAG9B,eAAe,sBAAsB,UAAmC;CAEvE,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,QAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;;AAG/C,SAAS,gBAAgB,QAA4B;CACpD,IAAI,MAAM;AACV,QAAO,SAAQ,MAAK,OAAO,OAAO,aAAa,EAAE,CAAC;AAClD,QAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG"}

package/dist/src/auth/oauth/openai-codex.d.ts

@@ -1,4 +1,9 @@
 /**
- * OpenAI Codex (ChatGPT) OAuth — delegated to @earendil-works/pi-ai.
+ * OpenAI Codex (ChatGPT) OAuth.
+ *
+ * Owns callback validation, manual prompt handling, and success/error pages.
  */
-export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from '@earendil-works/pi-ai/oauth';
+import type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './types.js';
+export declare function loginOpenAICodex(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;
+export declare const openaiCodexOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/openai-codex.js

@@ -1,2 +1,319 @@
-import { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "@earendil-works/pi-ai/oauth";
+import { generatePKCE } from "./pkce.js";
+import { randomBytes } from "node:crypto";
+import http from "node:http";
+//#region src/auth/oauth/openai-codex.ts
+/**
+* OpenAI Codex (ChatGPT) OAuth.
+*
+* Owns callback validation, manual prompt handling, and success/error pages.
+*/
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const SCOPE = "openid profile email offline_access";
+const MANUAL_PROMPT_DELAY_MS = 15e3;
+const TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+function xopcOAuthHtml(params) {
+	const color = params.tone === "success" ? "#2563eb" : "#dc2626";
+	const escapedTitle = escapeHtml(params.title);
+	return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapedTitle}</title>
+  <style>
+    :root { color-scheme: light dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #f8fafc; color: #0f172a; }
+    @media (prefers-color-scheme: dark) { body { background: #020617; color: #e2e8f0; } .card { background: #0f172a !important; border-color: #1e293b !important; } .muted { color: #94a3b8 !important; } }
+    .card { width: min(520px, calc(100vw - 32px)); background: white; border: 1px solid #e2e8f0; border-radius: 20px; padding: 28px; box-sizing: border-box; }
+    .brand { display: flex; align-items: center; gap: 12px; margin-bottom: 20px; font-weight: 700; }
+    .logo { width: 36px; height: 36px; border-radius: 12px; display: grid; place-items: center; color: white; background: ${color}; font-weight: 800; letter-spacing: -0.04em; }
+    h1 { font-size: 22px; margin: 0 0 10px; }
+    p { margin: 0; line-height: 1.6; }
+    .muted { color: #64748b; margin-top: 14px; font-size: 14px; }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="brand"><div class="logo">x</div><div>xopc</div></div>
+    <h1>${escapedTitle}</h1>
+    <p>${escapeHtml(params.message)}</p>
+    <p class="muted">You can close this window and return to the terminal.</p>
+  </main>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+	return value.replace(/[&<>"]/g, (char) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;"
+	})[char] ?? char);
+}
+function createState() {
+	return randomBytes(16).toString("hex");
+}
+function waitForManualPromptDelay(signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+			return;
+		}
+		const timeout = setTimeout(() => resolve({ type: "unavailable" }), MANUAL_PROMPT_DELAY_MS);
+		timeout.unref?.();
+		const abort = () => {
+			clearTimeout(timeout);
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function parseOAuthAuthorizationInput(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return {};
+	try {
+		const url = new URL(trimmed);
+		return {
+			code: url.searchParams.get("code") ?? void 0,
+			state: url.searchParams.get("state") ?? void 0
+		};
+	} catch {}
+	if (trimmed.includes("=")) {
+		const params = new URLSearchParams(trimmed.startsWith("?") ? trimmed.slice(1) : trimmed);
+		return {
+			code: params.get("code") ?? void 0,
+			state: params.get("state") ?? void 0
+		};
+	}
+	return { code: trimmed };
+}
+async function parsePromptedAuthorizationCode(inputPromise, state) {
+	const parsed = parseOAuthAuthorizationInput(await inputPromise);
+	if (parsed.state && parsed.state !== state) throw new Error("State mismatch. Paste the redirect URL from the most recent xopc OAuth login.");
+	if (!parsed.code) throw new Error("Missing authorization code");
+	return parsed.code;
+}
+async function createAuthorizationFlow() {
+	const { verifier, challenge } = await generatePKCE();
+	const state = createState();
+	const url = new URL(AUTHORIZE_URL);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", REDIRECT_URI);
+	url.searchParams.set("scope", SCOPE);
+	url.searchParams.set("code_challenge", challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("state", state);
+	url.searchParams.set("id_token_add_organizations", "true");
+	url.searchParams.set("codex_cli_simplified_flow", "true");
+	url.searchParams.set("originator", "xopc");
+	return {
+		verifier,
+		state,
+		url: url.toString()
+	};
+}
+async function startLocalOAuthServer(state) {
+	let settleWait;
+	const waitForCodePromise = new Promise((resolve) => {
+		let settled = false;
+		settleWait = (value) => {
+			if (settled) return;
+			settled = true;
+			resolve(value);
+		};
+	});
+	const server = http.createServer((req, res) => {
+		try {
+			const url = new URL(req.url || "", "http://localhost");
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			if (url.pathname !== CALLBACK_PATH) {
+				res.statusCode = 404;
+				res.end(xopcOAuthHtml({
+					title: "Callback route not found",
+					message: "This xopc OAuth callback URL is not valid.",
+					tone: "error"
+				}));
+				return;
+			}
+			const code = url.searchParams.get("code");
+			if (!code) {
+				res.statusCode = 400;
+				res.end(xopcOAuthHtml({
+					title: "Authentication failed",
+					message: "OpenAI did not return an authorization code.",
+					tone: "error"
+				}));
+				return;
+			}
+			if (url.searchParams.get("state") !== state) {
+				res.statusCode = 400;
+				res.end(xopcOAuthHtml({
+					title: "Authentication needs manual confirmation",
+					message: "This callback belongs to a different xopc OAuth attempt. Copy the full URL from the address bar and paste it in the terminal prompt for the latest login.",
+					tone: "error"
+				}));
+				settleWait?.({ type: "unavailable" });
+				return;
+			}
+			res.statusCode = 200;
+			res.end(xopcOAuthHtml({
+				title: "OpenAI authentication complete",
+				message: "xopc received the authorization callback successfully.",
+				tone: "success"
+			}));
+			settleWait?.({
+				type: "code",
+				code
+			});
+		} catch {
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			res.end(xopcOAuthHtml({
+				title: "Authentication failed",
+				message: "xopc could not process the OAuth callback.",
+				tone: "error"
+			}));
+		}
+	});
+	return new Promise((resolve) => {
+		server.listen(CALLBACK_PORT, () => {
+			resolve({
+				available: true,
+				close: () => server.close(),
+				cancelWait: () => settleWait?.({ type: "unavailable" }),
+				waitForCode: () => waitForCodePromise
+			});
+		}).on("error", () => {
+			resolve({
+				available: false,
+				close: () => {},
+				cancelWait: () => settleWait?.({ type: "unavailable" }),
+				waitForCode: async () => ({ type: "unavailable" })
+			});
+		});
+	});
+}
+async function postTokenForm(body, signal) {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		},
+		body,
+		signal: signal ?? AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	const contentType = response.headers.get("content-type") ?? "";
+	const text = await response.text();
+	if (!response.ok) throw new Error(`OpenAI Codex token request failed (${response.status}): ${text || response.statusText}`);
+	if (!contentType.toLowerCase().includes("application/json")) throw new Error(`OpenAI Codex token response was not JSON: ${contentType || "missing content-type"}`);
+	return JSON.parse(text);
+}
+async function exchangeAuthorizationCode(code, verifier, signal) {
+	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
+		grant_type: "authorization_code",
+		client_id: CLIENT_ID,
+		code,
+		code_verifier: verifier,
+		redirect_uri: REDIRECT_URI
+	}), signal));
+}
+async function refreshAccessToken(refreshToken) {
+	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
+		grant_type: "refresh_token",
+		client_id: CLIENT_ID,
+		refresh_token: refreshToken
+	})));
+}
+function normalizeTokenResponse(json) {
+	if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+		const missing = [
+			!json.access_token ? "access_token" : "",
+			!json.refresh_token ? "refresh_token" : "",
+			typeof json.expires_in !== "number" ? "expires_in" : ""
+		].filter(Boolean).join(", ");
+		throw new Error(`OpenAI Codex token response missing fields: ${missing}`);
+	}
+	const accountId = getAccountId(json.access_token);
+	if (!accountId) throw new Error("Failed to extract accountId from token");
+	return {
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3,
+		accountId
+	};
+}
+function getAccountId(accessToken) {
+	const [, payload] = accessToken.split(".");
+	if (!payload) return null;
+	try {
+		const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+		const json = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+		const authClaim = json["https://api.openai.com/auth"];
+		if (authClaim && typeof authClaim === "object") {
+			const accountId = authClaim.chatgpt_account_id;
+			if (typeof accountId === "string" && accountId.length > 0) return accountId;
+		}
+		return typeof json.sub === "string" && json.sub.length > 0 ? json.sub : null;
+	} catch {
+		return null;
+	}
+}
+async function loginOpenAICodex(callbacks) {
+	const { verifier, state, url } = await createAuthorizationFlow();
+	const server = await startLocalOAuthServer(state);
+	try {
+		callbacks.onAuth({
+			url,
+			instructions: server.available ? "A browser window should open. Complete login to finish. If it does not complete automatically, paste the final redirect URL in the terminal." : "Open this URL and paste the final redirect URL in the terminal. xopc could not bind localhost:1455 for the automatic callback."
+		});
+		let code;
+		if (server.available) {
+			const callback = await Promise.race([server.waitForCode(), waitForManualPromptDelay(callbacks.signal)]);
+			if (callback.type === "code") code = callback.code;
+		}
+		if (!code) {
+			const manualCode = parsePromptedAuthorizationCode(callbacks.onManualCodeInput ? callbacks.onManualCodeInput() : callbacks.onPrompt({ message: "Paste the authorization code (or full redirect URL):" }), state).then((value) => {
+				server.cancelWait();
+				return {
+					type: "code",
+					code: value
+				};
+			});
+			const callback = await Promise.race([server.waitForCode(), manualCode]);
+			if (callback.type === "code") code = callback.code;
+		}
+		if (!code) throw new Error("Missing authorization code");
+		return await exchangeAuthorizationCode(code, verifier, callbacks.signal);
+	} finally {
+		server.close();
+	}
+}
+async function refreshOpenAICodexToken(refreshToken) {
+	return refreshAccessToken(refreshToken);
+}
+const openaiCodexOAuthProvider = {
+	id: "openai-codex",
+	name: "OpenAI Codex",
+	usesCallbackServer: true,
+	async login(callbacks) {
+		return loginOpenAICodex(callbacks);
+	},
+	async refreshToken(credentials) {
+		return refreshOpenAICodexToken(credentials.refresh);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
 export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken };
+
+//# sourceMappingURL=openai-codex.js.map

package/dist/src/auth/oauth/openai-codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-codex.js","names":[],"sources":["../../../../src/auth/oauth/openai-codex.ts"],"sourcesContent":["/**\n * OpenAI Codex (ChatGPT) OAuth.\n *\n * Owns callback validation, manual prompt handling, and success/error pages.\n */\n\nimport { randomBytes } from 'node:crypto';\nimport http from 'node:http';\n\nimport { generatePKCE } from './pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './types.js';\n\nconst CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\nconst AUTHORIZE_URL = 'https://auth.openai.com/oauth/authorize';\nconst TOKEN_URL = 'https://auth.openai.com/oauth/token';\nconst CALLBACK_PORT = 1455;\nconst CALLBACK_PATH = '/auth/callback';\nconst REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;\nconst SCOPE = 'openid profile email offline_access';\nconst MANUAL_PROMPT_DELAY_MS = 15_000;\nconst TOKEN_REQUEST_TIMEOUT_MS = 30_000;\n\ntype TokenResponseJson = {\n  access_token?: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n};\n\ntype CallbackResult =\n  | { type: 'code'; code: string }\n  | { type: 'unavailable' };\n\ntype LocalOAuthServer = {\n  close: () => void;\n  cancelWait: () => void;\n  waitForCode: () => Promise<CallbackResult>;\n  available: boolean;\n};\n\nfunction xopcOAuthHtml(params: { title: string; message: string; tone: 'success' | 'error' }): string {\n  const color = params.tone === 'success' ? '#2563eb' : '#dc2626';\n  const escapedTitle = escapeHtml(params.title);\n  const escapedMessage = escapeHtml(params.message);\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>${escapedTitle}</title>\n  <style>\n    :root { color-scheme: light dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; }\n    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #f8fafc; color: #0f172a; }\n    @media (prefers-color-scheme: dark) { body { background: #020617; color: #e2e8f0; } .card { background: #0f172a !important; border-color: #1e293b !important; } .muted { color: #94a3b8 !important; } }\n    .card { width: min(520px, calc(100vw - 32px)); background: white; border: 1px solid #e2e8f0; border-radius: 20px; padding: 28px; box-sizing: border-box; }\n    .brand { display: flex; align-items: center; gap: 12px; margin-bottom: 20px; font-weight: 700; }\n    .logo { width: 36px; height: 36px; border-radius: 12px; display: grid; place-items: center; color: white; background: ${color}; font-weight: 800; letter-spacing: -0.04em; }\n    h1 { font-size: 22px; margin: 0 0 10px; }\n    p { margin: 0; line-height: 1.6; }\n    .muted { color: #64748b; margin-top: 14px; font-size: 14px; }\n  </style>\n</head>\n<body>\n  <main class=\"card\">\n    <div class=\"brand\"><div class=\"logo\">x</div><div>xopc</div></div>\n    <h1>${escapedTitle}</h1>\n    <p>${escapedMessage}</p>\n    <p class=\"muted\">You can close this window and return to the terminal.</p>\n  </main>\n</body>\n</html>`;\n}\n\nfunction escapeHtml(value: string): string {\n  return value.replace(/[&<>\"]/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;' })[char] ?? char);\n}\n\nfunction createState(): string {\n  return randomBytes(16).toString('hex');\n}\n\nfunction waitForManualPromptDelay(signal?: AbortSignal): Promise<CallbackResult> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n    const timeout = setTimeout(() => resolve({ type: 'unavailable' }), MANUAL_PROMPT_DELAY_MS);\n    timeout.unref?.();\n    const abort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n    signal?.addEventListener('abort', abort, { once: true });\n  });\n}\n\nfunction parseOAuthAuthorizationInput(input: string): { code?: string; state?: string } {\n  const trimmed = input.trim();\n  if (!trimmed) return {};\n\n  try {\n    const url = new URL(trimmed);\n    return {\n      code: url.searchParams.get('code') ?? undefined,\n      state: url.searchParams.get('state') ?? undefined,\n    };\n  } catch {\n    // Continue: raw code or query-string paste.\n  }\n\n  if (trimmed.includes('=')) {\n    const params = new URLSearchParams(trimmed.startsWith('?') ? trimmed.slice(1) : trimmed);\n    return {\n      code: params.get('code') ?? undefined,\n      state: params.get('state') ?? undefined,\n    };\n  }\n\n  return { code: trimmed };\n}\n\nasync function parsePromptedAuthorizationCode(inputPromise: Promise<string>, state: string): Promise<string> {\n  const input = await inputPromise;\n  const parsed = parseOAuthAuthorizationInput(input);\n  if (parsed.state && parsed.state !== state) {\n    throw new Error('State mismatch. Paste the redirect URL from the most recent xopc OAuth login.');\n  }\n  if (!parsed.code) {\n    throw new Error('Missing authorization code');\n  }\n  return parsed.code;\n}\n\nasync function createAuthorizationFlow(): Promise<{ verifier: string; state: string; url: string }> {\n  const { verifier, challenge } = await generatePKCE();\n  const state = createState();\n  const url = new URL(AUTHORIZE_URL);\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', CLIENT_ID);\n  url.searchParams.set('redirect_uri', REDIRECT_URI);\n  url.searchParams.set('scope', SCOPE);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('state', state);\n  url.searchParams.set('id_token_add_organizations', 'true');\n  url.searchParams.set('codex_cli_simplified_flow', 'true');\n  url.searchParams.set('originator', 'xopc');\n  return { verifier, state, url: url.toString() };\n}\n\nasync function startLocalOAuthServer(state: string): Promise<LocalOAuthServer> {\n  let settleWait: ((value: CallbackResult) => void) | undefined;\n  const waitForCodePromise = new Promise<CallbackResult>((resolve) => {\n    let settled = false;\n    settleWait = (value) => {\n      if (settled) return;\n      settled = true;\n      resolve(value);\n    };\n  });\n\n  const server = http.createServer((req, res) => {\n    try {\n      const url = new URL(req.url || '', 'http://localhost');\n      res.setHeader('Content-Type', 'text/html; charset=utf-8');\n      if (url.pathname !== CALLBACK_PATH) {\n        res.statusCode = 404;\n        res.end(xopcOAuthHtml({ title: 'Callback route not found', message: 'This xopc OAuth callback URL is not valid.', tone: 'error' }));\n        return;\n      }\n\n      const code = url.searchParams.get('code');\n      if (!code) {\n        res.statusCode = 400;\n        res.end(xopcOAuthHtml({ title: 'Authentication failed', message: 'OpenAI did not return an authorization code.', tone: 'error' }));\n        return;\n      }\n\n      if (url.searchParams.get('state') !== state) {\n        res.statusCode = 400;\n        res.end(\n          xopcOAuthHtml({\n            title: 'Authentication needs manual confirmation',\n            message: 'This callback belongs to a different xopc OAuth attempt. Copy the full URL from the address bar and paste it in the terminal prompt for the latest login.',\n            tone: 'error',\n          }),\n        );\n        settleWait?.({ type: 'unavailable' });\n        return;\n      }\n\n      res.statusCode = 200;\n      res.end(xopcOAuthHtml({ title: 'OpenAI authentication complete', message: 'xopc received the authorization callback successfully.', tone: 'success' }));\n      settleWait?.({ type: 'code', code });\n    } catch {\n      res.statusCode = 500;\n      res.setHeader('Content-Type', 'text/html; charset=utf-8');\n      res.end(xopcOAuthHtml({ title: 'Authentication failed', message: 'xopc could not process the OAuth callback.', tone: 'error' }));\n    }\n  });\n\n  return new Promise((resolve) => {\n    server\n      .listen(CALLBACK_PORT, () => {\n        resolve({\n          available: true,\n          close: () => server.close(),\n          cancelWait: () => settleWait?.({ type: 'unavailable' }),\n          waitForCode: () => waitForCodePromise,\n        });\n      })\n      .on('error', () => {\n        resolve({\n          available: false,\n          close: () => {},\n          cancelWait: () => settleWait?.({ type: 'unavailable' }),\n          waitForCode: async () => ({ type: 'unavailable' }),\n        });\n      });\n  });\n}\n\nasync function postTokenForm(body: URLSearchParams, signal?: AbortSignal): Promise<TokenResponseJson> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      Accept: 'application/json',\n    },\n    body,\n    signal: signal ?? AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),\n  });\n\n  const contentType = response.headers.get('content-type') ?? '';\n  const text = await response.text();\n  if (!response.ok) {\n    throw new Error(`OpenAI Codex token request failed (${response.status}): ${text || response.statusText}`);\n  }\n  if (!contentType.toLowerCase().includes('application/json')) {\n    throw new Error(`OpenAI Codex token response was not JSON: ${contentType || 'missing content-type'}`);\n  }\n  return JSON.parse(text) as TokenResponseJson;\n}\n\nasync function exchangeAuthorizationCode(code: string, verifier: string, signal?: AbortSignal): Promise<OAuthCredentials> {\n  const json = await postTokenForm(\n    new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code,\n      code_verifier: verifier,\n      redirect_uri: REDIRECT_URI,\n    }),\n    signal,\n  );\n  return normalizeTokenResponse(json);\n}\n\nasync function refreshAccessToken(refreshToken: string): Promise<OAuthCredentials> {\n  const json = await postTokenForm(\n    new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  );\n  return normalizeTokenResponse(json);\n}\n\nfunction normalizeTokenResponse(json: TokenResponseJson): OAuthCredentials {\n  if (!json.access_token || !json.refresh_token || typeof json.expires_in !== 'number') {\n    const missing = [\n      !json.access_token ? 'access_token' : '',\n      !json.refresh_token ? 'refresh_token' : '',\n      typeof json.expires_in !== 'number' ? 'expires_in' : '',\n    ].filter(Boolean).join(', ');\n    throw new Error(`OpenAI Codex token response missing fields: ${missing}`);\n  }\n  const accountId = getAccountId(json.access_token);\n  if (!accountId) {\n    throw new Error('Failed to extract accountId from token');\n  }\n  return {\n    access: json.access_token,\n    refresh: json.refresh_token,\n    expires: Date.now() + json.expires_in * 1000,\n    accountId,\n  };\n}\n\nfunction getAccountId(accessToken: string): string | null {\n  const [, payload] = accessToken.split('.');\n  if (!payload) return null;\n  try {\n    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');\n    const json = JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as Record<string, unknown>;\n    const authClaim = json['https://api.openai.com/auth'];\n    if (authClaim && typeof authClaim === 'object') {\n      const accountId = (authClaim as Record<string, unknown>).chatgpt_account_id;\n      if (typeof accountId === 'string' && accountId.length > 0) return accountId;\n    }\n    return typeof json.sub === 'string' && json.sub.length > 0 ? json.sub : null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function loginOpenAICodex(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n  const { verifier, state, url } = await createAuthorizationFlow();\n  const server = await startLocalOAuthServer(state);\n\n  try {\n    callbacks.onAuth({\n      url,\n      instructions: server.available\n        ? 'A browser window should open. Complete login to finish. If it does not complete automatically, paste the final redirect URL in the terminal.'\n        : 'Open this URL and paste the final redirect URL in the terminal. xopc could not bind localhost:1455 for the automatic callback.',\n    });\n\n    let code: string | undefined;\n    if (server.available) {\n      const callback = await Promise.race([server.waitForCode(), waitForManualPromptDelay(callbacks.signal)]);\n      if (callback.type === 'code') {\n        code = callback.code;\n      }\n    }\n\n    if (!code) {\n      const manualInput = callbacks.onManualCodeInput\n        ? callbacks.onManualCodeInput()\n        : callbacks.onPrompt({ message: 'Paste the authorization code (or full redirect URL):' });\n      const manualCode = parsePromptedAuthorizationCode(manualInput, state).then((value) => {\n        server.cancelWait();\n        return { type: 'code' as const, code: value };\n      });\n      const callback = await Promise.race([server.waitForCode(), manualCode]);\n      if (callback.type === 'code') {\n        code = callback.code;\n      }\n    }\n\n    if (!code) {\n      throw new Error('Missing authorization code');\n    }\n\n    return await exchangeAuthorizationCode(code, verifier, callbacks.signal);\n  } finally {\n    server.close();\n  }\n}\n\nexport async function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials> {\n  return refreshAccessToken(refreshToken);\n}\n\nexport const openaiCodexOAuthProvider: OAuthProviderInterface = {\n  id: 'openai-codex',\n  name: 'OpenAI Codex',\n  usesCallbackServer: true,\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginOpenAICodex(callbacks);\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshOpenAICodexToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;;;;;;;AAYA,MAAM,YAAY;AAClB,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;AACtB,MAAM,eAAe,oBAAoB,gBAAgB;AACzD,MAAM,QAAQ;AACd,MAAM,yBAAyB;AAC/B,MAAM,2BAA2B;AAqBjC,SAAS,cAAc,QAA+E;CACpG,MAAM,QAAQ,OAAO,SAAS,YAAY,YAAY;CACtD,MAAM,eAAe,WAAW,OAAO,MAAM;AAE7C,QAAO;;;;;WAKE,aAAa;;;;;;;4HAOoG,MAAM;;;;;;;;;UASxH,aAAa;SAtBE,WAAW,OAAO,QAuBpB,CAAC;;;;;;AAOxB,SAAS,WAAW,OAAuB;AACzC,QAAO,MAAM,QAAQ,YAAY,UAAU;EAAE,KAAK;EAAS,KAAK;EAAQ,KAAK;EAAQ,MAAK;EAAU,EAAE,SAAS,KAAK;;AAGtH,SAAS,cAAsB;AAC7B,QAAO,YAAY,GAAG,CAAC,SAAS,MAAM;;AAGxC,SAAS,yBAAyB,QAA+C;AAC/E,QAAO,IAAI,SAAS,SAAS,WAAW;AACtC,MAAI,QAAQ,SAAS;AACnB,0BAAO,IAAI,MAAM,kBAAkB,CAAC;AACpC;;EAEF,MAAM,UAAU,iBAAiB,QAAQ,EAAE,MAAM,eAAe,CAAC,EAAE,uBAAuB;AAC1F,UAAQ,SAAS;EACjB,MAAM,cAAc;AAClB,gBAAa,QAAQ;AACrB,0BAAO,IAAI,MAAM,kBAAkB,CAAC;;AAEtC,UAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC;GACxD;;AAGJ,SAAS,6BAA6B,OAAkD;CACtF,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,SAAO;GACL,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACzC;SACK;AAIR,KAAI,QAAQ,SAAS,IAAI,EAAE;EACzB,MAAM,SAAS,IAAI,gBAAgB,QAAQ,WAAW,IAAI,GAAG,QAAQ,MAAM,EAAE,GAAG,QAAQ;AACxF,SAAO;GACL,MAAM,OAAO,IAAI,OAAO,IAAI,KAAA;GAC5B,OAAO,OAAO,IAAI,QAAQ,IAAI,KAAA;GAC/B;;AAGH,QAAO,EAAE,MAAM,SAAS;;AAG1B,eAAe,+BAA+B,cAA+B,OAAgC;CAE3G,MAAM,SAAS,6BAA6B,MADxB,aAC8B;AAClD,KAAI,OAAO,SAAS,OAAO,UAAU,MACnC,OAAM,IAAI,MAAM,gFAAgF;AAElG,KAAI,CAAC,OAAO,KACV,OAAM,IAAI,MAAM,6BAA6B;AAE/C,QAAO,OAAO;;AAGhB,eAAe,0BAAqF;CAClG,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,QAAQ,aAAa;CAC3B,MAAM,MAAM,IAAI,IAAI,cAAc;AAClC,KAAI,aAAa,IAAI,iBAAiB,OAAO;AAC7C,KAAI,aAAa,IAAI,aAAa,UAAU;AAC5C,KAAI,aAAa,IAAI,gBAAgB,aAAa;AAClD,KAAI,aAAa,IAAI,SAAS,MAAM;AACpC,KAAI,aAAa,IAAI,kBAAkB,UAAU;AACjD,KAAI,aAAa,IAAI,yBAAyB,OAAO;AACrD,KAAI,aAAa,IAAI,SAAS,MAAM;AACpC,KAAI,aAAa,IAAI,8BAA8B,OAAO;AAC1D,KAAI,aAAa,IAAI,6BAA6B,OAAO;AACzD,KAAI,aAAa,IAAI,cAAc,OAAO;AAC1C,QAAO;EAAE;EAAU;EAAO,KAAK,IAAI,UAAU;EAAE;;AAGjD,eAAe,sBAAsB,OAA0C;CAC7E,IAAI;CACJ,MAAM,qBAAqB,IAAI,SAAyB,YAAY;EAClE,IAAI,UAAU;AACd,gBAAc,UAAU;AACtB,OAAI,QAAS;AACb,aAAU;AACV,WAAQ,MAAM;;GAEhB;CAEF,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;AAC7C,MAAI;GACF,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,mBAAmB;AACtD,OAAI,UAAU,gBAAgB,2BAA2B;AACzD,OAAI,IAAI,aAAa,eAAe;AAClC,QAAI,aAAa;AACjB,QAAI,IAAI,cAAc;KAAE,OAAO;KAA4B,SAAS;KAA8C,MAAM;KAAS,CAAC,CAAC;AACnI;;GAGF,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;AACzC,OAAI,CAAC,MAAM;AACT,QAAI,aAAa;AACjB,QAAI,IAAI,cAAc;KAAE,OAAO;KAAyB,SAAS;KAAgD,MAAM;KAAS,CAAC,CAAC;AAClI;;AAGF,OAAI,IAAI,aAAa,IAAI,QAAQ,KAAK,OAAO;AAC3C,QAAI,aAAa;AACjB,QAAI,IACF,cAAc;KACZ,OAAO;KACP,SAAS;KACT,MAAM;KACP,CAAC,CACH;AACD,iBAAa,EAAE,MAAM,eAAe,CAAC;AACrC;;AAGF,OAAI,aAAa;AACjB,OAAI,IAAI,cAAc;IAAE,OAAO;IAAkC,SAAS;IAA0D,MAAM;IAAW,CAAC,CAAC;AACvJ,gBAAa;IAAE,MAAM;IAAQ;IAAM,CAAC;UAC9B;AACN,OAAI,aAAa;AACjB,OAAI,UAAU,gBAAgB,2BAA2B;AACzD,OAAI,IAAI,cAAc;IAAE,OAAO;IAAyB,SAAS;IAA8C,MAAM;IAAS,CAAC,CAAC;;GAElI;AAEF,QAAO,IAAI,SAAS,YAAY;AAC9B,SACG,OAAO,qBAAqB;AAC3B,WAAQ;IACN,WAAW;IACX,aAAa,OAAO,OAAO;IAC3B,kBAAkB,aAAa,EAAE,MAAM,eAAe,CAAC;IACvD,mBAAmB;IACpB,CAAC;IACF,CACD,GAAG,eAAe;AACjB,WAAQ;IACN,WAAW;IACX,aAAa;IACb,kBAAkB,aAAa,EAAE,MAAM,eAAe,CAAC;IACvD,aAAa,aAAa,EAAE,MAAM,eAAe;IAClD,CAAC;IACF;GACJ;;AAGJ,eAAe,cAAc,MAAuB,QAAkD;CACpG,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,QAAQ;GACT;EACD;EACA,QAAQ,UAAU,YAAY,QAAQ,yBAAyB;EAChE,CAAC;CAEF,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;CAC5D,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,sCAAsC,SAAS,OAAO,KAAK,QAAQ,SAAS,aAAa;AAE3G,KAAI,CAAC,YAAY,aAAa,CAAC,SAAS,mBAAmB,CACzD,OAAM,IAAI,MAAM,6CAA6C,eAAe,yBAAyB;AAEvG,QAAO,KAAK,MAAM,KAAK;;AAGzB,eAAe,0BAA0B,MAAc,UAAkB,QAAiD;AAWxH,QAAO,uBAAuB,MAVX,cACjB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW;EACX;EACA,eAAe;EACf,cAAc;EACf,CAAC,EACF,OACD,CACkC;;AAGrC,eAAe,mBAAmB,cAAiD;AAQjF,QAAO,uBAAuB,MAPX,cACjB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW;EACX,eAAe;EAChB,CAAC,CACH,CACkC;;AAGrC,SAAS,uBAAuB,MAA2C;AACzE,KAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,iBAAiB,OAAO,KAAK,eAAe,UAAU;EACpF,MAAM,UAAU;GACd,CAAC,KAAK,eAAe,iBAAiB;GACtC,CAAC,KAAK,gBAAgB,kBAAkB;GACxC,OAAO,KAAK,eAAe,WAAW,eAAe;GACtD,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;AAC5B,QAAM,IAAI,MAAM,+CAA+C,UAAU;;CAE3E,MAAM,YAAY,aAAa,KAAK,aAAa;AACjD,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,yCAAyC;AAE3D,QAAO;EACL,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa;EACxC;EACD;;AAGH,SAAS,aAAa,aAAoC;CACxD,MAAM,GAAG,WAAW,YAAY,MAAM,IAAI;AAC1C,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,aAAa,QAAQ,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;EAChE,MAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,EAAE,GAAG,GAAG,IAAI;EAC3E,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,SAAS,CAAC,SAAS,OAAO,CAAC;EACvE,MAAM,YAAY,KAAK;AACvB,MAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,MAAM,YAAa,UAAsC;AACzD,OAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,QAAO;;AAEpE,SAAO,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;SAClE;AACN,SAAO;;;AAIX,eAAsB,iBAAiB,WAA2D;CAChG,MAAM,EAAE,UAAU,OAAO,QAAQ,MAAM,yBAAyB;CAChE,MAAM,SAAS,MAAM,sBAAsB,MAAM;AAEjD,KAAI;AACF,YAAU,OAAO;GACf;GACA,cAAc,OAAO,YACjB,iJACA;GACL,CAAC;EAEF,IAAI;AACJ,MAAI,OAAO,WAAW;GACpB,MAAM,WAAW,MAAM,QAAQ,KAAK,CAAC,OAAO,aAAa,EAAE,yBAAyB,UAAU,OAAO,CAAC,CAAC;AACvG,OAAI,SAAS,SAAS,OACpB,QAAO,SAAS;;AAIpB,MAAI,CAAC,MAAM;GAIT,MAAM,aAAa,+BAHC,UAAU,oBAC1B,UAAU,mBAAmB,GAC7B,UAAU,SAAS,EAAE,SAAS,wDAAwD,CAAC,EAC5B,MAAM,CAAC,MAAM,UAAU;AACpF,WAAO,YAAY;AACnB,WAAO;KAAE,MAAM;KAAiB,MAAM;KAAO;KAC7C;GACF,MAAM,WAAW,MAAM,QAAQ,KAAK,CAAC,OAAO,aAAa,EAAE,WAAW,CAAC;AACvE,OAAI,SAAS,SAAS,OACpB,QAAO,SAAS;;AAIpB,MAAI,CAAC,KACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,SAAO,MAAM,0BAA0B,MAAM,UAAU,UAAU,OAAO;WAChE;AACR,SAAO,OAAO;;;AAIlB,eAAsB,wBAAwB,cAAiD;AAC7F,QAAO,mBAAmB,aAAa;;AAGzC,MAAa,2BAAmD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACrE,SAAO,iBAAiB,UAAU;;CAGpC,MAAM,aAAa,aAA0D;AAC3E,SAAO,wBAAwB,YAAY,QAAQ;;CAGrD,UAAU,aAAuC;AAC/C,SAAO,YAAY;;CAEtB"}

package/dist/src/auth/profiles/store.js

@@ -1,7 +1,7 @@
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { homedir } from "os";
 //#region src/auth/profiles/store.ts
 /**
 * Auth Profile Store
@@ -10,11 +10,12 @@ import { homedir } from "os";
 * Handles loading and saving auth credentials.
 */
 init_write_file_atomic();
+init_paths();
 const AUTH_STORE_VERSION = 1;
 const AUTH_STORE_FILENAME = "auth-profiles.json";
 /** Get the auth profiles file path */
 function resolveAuthStorePath(dataDir) {
-	const dir = dataDir ?? path.join(homedir(), ".xopc");
+	const dir = dataDir ?? resolveCredentialsDir();
 	return path.join(dir, AUTH_STORE_FILENAME);
 }
 /** Ensure auth store file exists */

package/dist/src/auth/profiles/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","names":[],"sources":["../../../../src/auth/profiles/store.ts"],"sourcesContent":["/**\n * Auth Profile Store\n * \n * Persistent storage for auth profiles.\n * Handles loading and saving auth credentials.\n */\n\nimport { chmodSync, existsSync, mkdirSync, readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { writeTextAtomicSync } from '../../infra/write-file-atomic.js';\nimport { homedir } from 'os';\nimport type { AuthProfileCredential, AuthProfileStore, ProfileUsageStats } from './types.js';\n\nconst AUTH_STORE_VERSION = 1;\nconst AUTH_STORE_FILENAME = 'auth-profiles.json';\n\n/** Get the auth profiles file path */\nexport function resolveAuthStorePath(dataDir?: string): string {\n\tconst dir = dataDir ?? path.join(homedir(), '.xopc');\n\treturn path.join(dir, AUTH_STORE_FILENAME);\n}\n\n/** Ensure auth store file exists */\nexport function ensureAuthStoreFile(authPath: string): void {\n\tconst dir = path.dirname(authPath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t}\n\tif (!existsSync(authPath)) {\n\t\twriteTextAtomicSync(\n\t\t\tauthPath,\n\t\t\tJSON.stringify({ version: AUTH_STORE_VERSION, profiles: {} }, null, 2),\n\t\t);\n\t\tchmodSync(authPath, 0o600);\n\t}\n}\n\nfunction loadJsonFile(filePath: string): unknown {\n\tif (!existsSync(filePath)) {\n\t\treturn null;\n\t}\n\ttry {\n\t\tconst content = readFileSync(filePath, 'utf-8');\n\t\treturn JSON.parse(content);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction saveJsonFile(filePath: string, data: unknown): void {\n\tconst dir = path.dirname(filePath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t}\n\twriteTextAtomicSync(filePath, JSON.stringify(data, null, 2));\n\tchmodSync(filePath, 0o600);\n}\n\nfunction coerceAuthStore(raw: unknown): AuthProfileStore | null {\n\tif (!raw || typeof raw !== 'object') {\n\t\treturn null;\n\t}\n\tconst record = raw as Record<string, unknown>;\n\tif (!record.profiles || typeof record.profiles !== 'object') {\n\t\treturn null;\n\t}\n\tconst profiles = record.profiles as Record<string, unknown>;\n\tconst normalized: Record<string, AuthProfileCredential> = {};\n\tfor (const [key, value] of Object.entries(profiles)) {\n\t\tif (!value || typeof value !== 'object') {\n\t\t\tcontinue;\n\t\t}\n\t\tconst typed = value as Partial<AuthProfileCredential>;\n\t\tif (typed.type !== 'api_key' && typed.type !== 'oauth' && typed.type !== 'token') {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!typed.provider) {\n\t\t\tcontinue;\n\t\t}\n\t\tnormalized[key] = typed as AuthProfileCredential;\n\t}\n\tconst order =\n\t\trecord.order && typeof record.order === 'object'\n\t\t\t? Object.entries(record.order as Record<string, unknown>).reduce(\n\t\t\t\t(acc, [provider, value]) => {\n\t\t\t\t\tif (!Array.isArray(value)) {\n\t\t\t\t\t\treturn acc;\n\t\t\t\t\t}\n\t\t\t\t\tconst list = value\n\t\t\t\t\t\t.map((entry) => (typeof entry === 'string' ? entry.trim() : ''))\n\t\t\t\t\t\t.filter(Boolean);\n\t\t\t\t\tif (list.length === 0) {\n\t\t\t\t\t\treturn acc;\n\t\t\t\t\t}\n\t\t\t\t\tacc[provider] = list;\n\t\t\t\t\treturn acc;\n\t\t\t\t},\n\t\t\t\t{} as Record<string, string[]>,\n\t\t\t)\n\t\t\t: undefined;\n\treturn {\n\t\tversion: Number(record.version ?? AUTH_STORE_VERSION),\n\t\tprofiles: normalized,\n\t\torder,\n\t\tlastGood:\n\t\t\trecord.lastGood && typeof record.lastGood === 'object'\n\t\t\t\t? (record.lastGood as Record<string, string>)\n\t\t\t\t: undefined,\n\t\tusageStats:\n\t\t\trecord.usageStats && typeof record.usageStats === 'object'\n\t\t\t\t? (record.usageStats as Record<string, ProfileUsageStats>)\n\t\t\t\t: undefined,\n\t};\n}\n\nfunction mergeRecord<T>(\n\tbase?: Record<string, T>,\n\toverride?: Record<string, T>,\n): Record<string, T> | undefined {\n\tif (!base && !override) {\n\t\treturn undefined;\n\t}\n\tif (!base) {\n\t\treturn { ...override };\n\t}\n\tif (!override) {\n\t\treturn { ...base };\n\t}\n\treturn { ...base, ...override };\n}\n\nfunction _mergeAuthProfileStores(\n\tbase: AuthProfileStore,\n\toverride: AuthProfileStore,\n): AuthProfileStore {\n\tif (\n\t\tObject.keys(override.profiles).length === 0 &&\n\t\t!override.order &&\n\t\t!override.lastGood &&\n\t\t!override.usageStats\n\t) {\n\t\treturn base;\n\t}\n\treturn {\n\t\tversion: Math.max(base.version, override.version ?? base.version),\n\t\tprofiles: { ...base.profiles, ...override.profiles },\n\t\torder: mergeRecord(base.order, override.order),\n\t\tlastGood: mergeRecord(base.lastGood, override.lastGood),\n\t\tusageStats: mergeRecord(base.usageStats, override.usageStats),\n\t};\n}\n\n/** Load auth profile store from disk */\nexport function loadAuthProfileStore(dataDir?: string): AuthProfileStore {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tconst raw = loadJsonFile(authPath);\n\tconst asStore = coerceAuthStore(raw);\n\tif (asStore) {\n\t\treturn asStore;\n\t}\n\n\treturn { version: AUTH_STORE_VERSION, profiles: {} };\n}\n\n/** Ensure auth profile store exists */\nexport function ensureAuthProfileStore(dataDir?: string): AuthProfileStore {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tensureAuthStoreFile(authPath);\n\treturn loadAuthProfileStore(dataDir);\n}\n\n/** Save auth profile store to disk */\nexport function saveAuthProfileStore(store: AuthProfileStore, dataDir?: string): void {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tconst payload = {\n\t\tversion: AUTH_STORE_VERSION,\n\t\tprofiles: store.profiles,\n\t\torder: store.order ?? undefined,\n\t\tlastGood: store.lastGood ?? undefined,\n\t\tusageStats: store.usageStats ?? undefined,\n\t} satisfies AuthProfileStore;\n\tsaveJsonFile(authPath, payload);\n}\n"],"mappings":";;;;;;;;;;;wBASuE;AAIvE,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAG5B,SAAgB,qBAAqB,SAA0B;CAC9D,MAAM,MAAM,WAAW,KAAK,KAAK,SAAS,EAAE,QAAQ;AACpD,QAAO,KAAK,KAAK,KAAK,oBAAoB;;;AAI3C,SAAgB,oBAAoB,UAAwB;CAC3D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,KAAI,CAAC,WAAW,IAAI,CACnB,WAAU,KAAK;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAEjD,KAAI,CAAC,WAAW,SAAS,EAAE;AAC1B,sBACC,UACA,KAAK,UAAU;GAAE,SAAS;GAAoB,UAAU,EAAE;GAAE,EAAE,MAAM,EAAE,CACtE;AACD,YAAU,UAAU,IAAM;;;AAI5B,SAAS,aAAa,UAA2B;AAChD,KAAI,CAAC,WAAW,SAAS,CACxB,QAAO;AAER,KAAI;EACH,MAAM,UAAU,aAAa,UAAU,QAAQ;AAC/C,SAAO,KAAK,MAAM,QAAQ;SACnB;AACP,SAAO;;;AAIT,SAAS,aAAa,UAAkB,MAAqB;CAC5D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,KAAI,CAAC,WAAW,IAAI,CACnB,WAAU,KAAK;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAEjD,qBAAoB,UAAU,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC5D,WAAU,UAAU,IAAM;;AAG3B,SAAS,gBAAgB,KAAuC;AAC/D,KAAI,CAAC,OAAO,OAAO,QAAQ,SAC1B,QAAO;CAER,MAAM,SAAS;AACf,KAAI,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,SAClD,QAAO;CAER,MAAM,WAAW,OAAO;CACxB,MAAM,aAAoD,EAAE;AAC5D,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,EAAE;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAC9B;EAED,MAAM,QAAQ;AACd,MAAI,MAAM,SAAS,aAAa,MAAM,SAAS,WAAW,MAAM,SAAS,QACxE;AAED,MAAI,CAAC,MAAM,SACV;AAED,aAAW,OAAO;;CAEnB,MAAM,QACL,OAAO,SAAS,OAAO,OAAO,UAAU,WACrC,OAAO,QAAQ,OAAO,MAAiC,CAAC,QACxD,KAAK,CAAC,UAAU,WAAW;AAC3B,MAAI,CAAC,MAAM,QAAQ,MAAM,CACxB,QAAO;EAER,MAAM,OAAO,MACX,KAAK,UAAW,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,GAAI,CAC/D,OAAO,QAAQ;AACjB,MAAI,KAAK,WAAW,EACnB,QAAO;AAER,MAAI,YAAY;AAChB,SAAO;IAER,EAAE,CACF,GACC,KAAA;AACJ,QAAO;EACN,SAAS,OAAO,OAAO,WAAW,mBAAmB;EACrD,UAAU;EACV;EACA,UACC,OAAO,YAAY,OAAO,OAAO,aAAa,WAC1C,OAAO,WACR,KAAA;EACJ,YACC,OAAO,cAAc,OAAO,OAAO,eAAe,WAC9C,OAAO,aACR,KAAA;EACJ;;;AAyCF,SAAgB,qBAAqB,SAAoC;CAGxE,MAAM,UAAU,gBADJ,aADK,qBAAqB,QACL,CACE,CAAC;AACpC,KAAI,QACH,QAAO;AAGR,QAAO;EAAE,SAAS;EAAoB,UAAU,EAAE;EAAE;;;AAIrD,SAAgB,uBAAuB,SAAoC;AAE1E,qBADiB,qBAAqB,QACV,CAAC;AAC7B,QAAO,qBAAqB,QAAQ;;;AAIrC,SAAgB,qBAAqB,OAAyB,SAAwB;AASrF,cARiB,qBAAqB,QAQjB,EAAE;EANtB,SAAS;EACT,UAAU,MAAM;EAChB,OAAO,MAAM,SAAS,KAAA;EACtB,UAAU,MAAM,YAAY,KAAA;EAC5B,YAAY,MAAM,cAAc,KAAA;EAEH,CAAC"}
+{"version":3,"file":"store.js","names":[],"sources":["../../../../src/auth/profiles/store.ts"],"sourcesContent":["/**\n * Auth Profile Store\n * \n * Persistent storage for auth profiles.\n * Handles loading and saving auth credentials.\n */\n\nimport { chmodSync, existsSync, mkdirSync, readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { writeTextAtomicSync } from '../../infra/write-file-atomic.js';\nimport { resolveCredentialsDir } from '../../config/paths.js';\nimport type { AuthProfileCredential, AuthProfileStore, ProfileUsageStats } from './types.js';\n\nconst AUTH_STORE_VERSION = 1;\nconst AUTH_STORE_FILENAME = 'auth-profiles.json';\n\n/** Get the auth profiles file path */\nexport function resolveAuthStorePath(dataDir?: string): string {\n\tconst dir = dataDir ?? resolveCredentialsDir();\n\treturn path.join(dir, AUTH_STORE_FILENAME);\n}\n\n/** Ensure auth store file exists */\nexport function ensureAuthStoreFile(authPath: string): void {\n\tconst dir = path.dirname(authPath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t}\n\tif (!existsSync(authPath)) {\n\t\twriteTextAtomicSync(\n\t\t\tauthPath,\n\t\t\tJSON.stringify({ version: AUTH_STORE_VERSION, profiles: {} }, null, 2),\n\t\t);\n\t\tchmodSync(authPath, 0o600);\n\t}\n}\n\nfunction loadJsonFile(filePath: string): unknown {\n\tif (!existsSync(filePath)) {\n\t\treturn null;\n\t}\n\ttry {\n\t\tconst content = readFileSync(filePath, 'utf-8');\n\t\treturn JSON.parse(content);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction saveJsonFile(filePath: string, data: unknown): void {\n\tconst dir = path.dirname(filePath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t}\n\twriteTextAtomicSync(filePath, JSON.stringify(data, null, 2));\n\tchmodSync(filePath, 0o600);\n}\n\nfunction coerceAuthStore(raw: unknown): AuthProfileStore | null {\n\tif (!raw || typeof raw !== 'object') {\n\t\treturn null;\n\t}\n\tconst record = raw as Record<string, unknown>;\n\tif (!record.profiles || typeof record.profiles !== 'object') {\n\t\treturn null;\n\t}\n\tconst profiles = record.profiles as Record<string, unknown>;\n\tconst normalized: Record<string, AuthProfileCredential> = {};\n\tfor (const [key, value] of Object.entries(profiles)) {\n\t\tif (!value || typeof value !== 'object') {\n\t\t\tcontinue;\n\t\t}\n\t\tconst typed = value as Partial<AuthProfileCredential>;\n\t\tif (typed.type !== 'api_key' && typed.type !== 'oauth' && typed.type !== 'token') {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!typed.provider) {\n\t\t\tcontinue;\n\t\t}\n\t\tnormalized[key] = typed as AuthProfileCredential;\n\t}\n\tconst order =\n\t\trecord.order && typeof record.order === 'object'\n\t\t\t? Object.entries(record.order as Record<string, unknown>).reduce(\n\t\t\t\t(acc, [provider, value]) => {\n\t\t\t\t\tif (!Array.isArray(value)) {\n\t\t\t\t\t\treturn acc;\n\t\t\t\t\t}\n\t\t\t\t\tconst list = value\n\t\t\t\t\t\t.map((entry) => (typeof entry === 'string' ? entry.trim() : ''))\n\t\t\t\t\t\t.filter(Boolean);\n\t\t\t\t\tif (list.length === 0) {\n\t\t\t\t\t\treturn acc;\n\t\t\t\t\t}\n\t\t\t\t\tacc[provider] = list;\n\t\t\t\t\treturn acc;\n\t\t\t\t},\n\t\t\t\t{} as Record<string, string[]>,\n\t\t\t)\n\t\t\t: undefined;\n\treturn {\n\t\tversion: Number(record.version ?? AUTH_STORE_VERSION),\n\t\tprofiles: normalized,\n\t\torder,\n\t\tlastGood:\n\t\t\trecord.lastGood && typeof record.lastGood === 'object'\n\t\t\t\t? (record.lastGood as Record<string, string>)\n\t\t\t\t: undefined,\n\t\tusageStats:\n\t\t\trecord.usageStats && typeof record.usageStats === 'object'\n\t\t\t\t? (record.usageStats as Record<string, ProfileUsageStats>)\n\t\t\t\t: undefined,\n\t};\n}\n\nfunction mergeRecord<T>(\n\tbase?: Record<string, T>,\n\toverride?: Record<string, T>,\n): Record<string, T> | undefined {\n\tif (!base && !override) {\n\t\treturn undefined;\n\t}\n\tif (!base) {\n\t\treturn { ...override };\n\t}\n\tif (!override) {\n\t\treturn { ...base };\n\t}\n\treturn { ...base, ...override };\n}\n\nfunction _mergeAuthProfileStores(\n\tbase: AuthProfileStore,\n\toverride: AuthProfileStore,\n): AuthProfileStore {\n\tif (\n\t\tObject.keys(override.profiles).length === 0 &&\n\t\t!override.order &&\n\t\t!override.lastGood &&\n\t\t!override.usageStats\n\t) {\n\t\treturn base;\n\t}\n\treturn {\n\t\tversion: Math.max(base.version, override.version ?? base.version),\n\t\tprofiles: { ...base.profiles, ...override.profiles },\n\t\torder: mergeRecord(base.order, override.order),\n\t\tlastGood: mergeRecord(base.lastGood, override.lastGood),\n\t\tusageStats: mergeRecord(base.usageStats, override.usageStats),\n\t};\n}\n\n/** Load auth profile store from disk */\nexport function loadAuthProfileStore(dataDir?: string): AuthProfileStore {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tconst raw = loadJsonFile(authPath);\n\tconst asStore = coerceAuthStore(raw);\n\tif (asStore) {\n\t\treturn asStore;\n\t}\n\n\treturn { version: AUTH_STORE_VERSION, profiles: {} };\n}\n\n/** Ensure auth profile store exists */\nexport function ensureAuthProfileStore(dataDir?: string): AuthProfileStore {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tensureAuthStoreFile(authPath);\n\treturn loadAuthProfileStore(dataDir);\n}\n\n/** Save auth profile store to disk */\nexport function saveAuthProfileStore(store: AuthProfileStore, dataDir?: string): void {\n\tconst authPath = resolveAuthStorePath(dataDir);\n\tconst payload = {\n\t\tversion: AUTH_STORE_VERSION,\n\t\tprofiles: store.profiles,\n\t\torder: store.order ?? undefined,\n\t\tlastGood: store.lastGood ?? undefined,\n\t\tusageStats: store.usageStats ?? undefined,\n\t} satisfies AuthProfileStore;\n\tsaveJsonFile(authPath, payload);\n}\n"],"mappings":";;;;;;;;;;;wBASuE;YACT;AAG9D,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAG5B,SAAgB,qBAAqB,SAA0B;CAC9D,MAAM,MAAM,WAAW,uBAAuB;AAC9C,QAAO,KAAK,KAAK,KAAK,oBAAoB;;;AAI3C,SAAgB,oBAAoB,UAAwB;CAC3D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,KAAI,CAAC,WAAW,IAAI,CACnB,WAAU,KAAK;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAEjD,KAAI,CAAC,WAAW,SAAS,EAAE;AAC1B,sBACC,UACA,KAAK,UAAU;GAAE,SAAS;GAAoB,UAAU,EAAE;GAAE,EAAE,MAAM,EAAE,CACtE;AACD,YAAU,UAAU,IAAM;;;AAI5B,SAAS,aAAa,UAA2B;AAChD,KAAI,CAAC,WAAW,SAAS,CACxB,QAAO;AAER,KAAI;EACH,MAAM,UAAU,aAAa,UAAU,QAAQ;AAC/C,SAAO,KAAK,MAAM,QAAQ;SACnB;AACP,SAAO;;;AAIT,SAAS,aAAa,UAAkB,MAAqB;CAC5D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,KAAI,CAAC,WAAW,IAAI,CACnB,WAAU,KAAK;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAEjD,qBAAoB,UAAU,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC5D,WAAU,UAAU,IAAM;;AAG3B,SAAS,gBAAgB,KAAuC;AAC/D,KAAI,CAAC,OAAO,OAAO,QAAQ,SAC1B,QAAO;CAER,MAAM,SAAS;AACf,KAAI,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,SAClD,QAAO;CAER,MAAM,WAAW,OAAO;CACxB,MAAM,aAAoD,EAAE;AAC5D,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,EAAE;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAC9B;EAED,MAAM,QAAQ;AACd,MAAI,MAAM,SAAS,aAAa,MAAM,SAAS,WAAW,MAAM,SAAS,QACxE;AAED,MAAI,CAAC,MAAM,SACV;AAED,aAAW,OAAO;;CAEnB,MAAM,QACL,OAAO,SAAS,OAAO,OAAO,UAAU,WACrC,OAAO,QAAQ,OAAO,MAAiC,CAAC,QACxD,KAAK,CAAC,UAAU,WAAW;AAC3B,MAAI,CAAC,MAAM,QAAQ,MAAM,CACxB,QAAO;EAER,MAAM,OAAO,MACX,KAAK,UAAW,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,GAAI,CAC/D,OAAO,QAAQ;AACjB,MAAI,KAAK,WAAW,EACnB,QAAO;AAER,MAAI,YAAY;AAChB,SAAO;IAER,EAAE,CACF,GACC,KAAA;AACJ,QAAO;EACN,SAAS,OAAO,OAAO,WAAW,mBAAmB;EACrD,UAAU;EACV;EACA,UACC,OAAO,YAAY,OAAO,OAAO,aAAa,WAC1C,OAAO,WACR,KAAA;EACJ,YACC,OAAO,cAAc,OAAO,OAAO,eAAe,WAC9C,OAAO,aACR,KAAA;EACJ;;;AAyCF,SAAgB,qBAAqB,SAAoC;CAGxE,MAAM,UAAU,gBADJ,aADK,qBAAqB,QACL,CACE,CAAC;AACpC,KAAI,QACH,QAAO;AAGR,QAAO;EAAE,SAAS;EAAoB,UAAU,EAAE;EAAE;;;AAIrD,SAAgB,uBAAuB,SAAoC;AAE1E,qBADiB,qBAAqB,QACV,CAAC;AAC7B,QAAO,qBAAqB,QAAQ;;;AAIrC,SAAgB,qBAAqB,OAAyB,SAAwB;AASrF,cARiB,qBAAqB,QAQjB,EAAE;EANtB,SAAS;EACT,UAAU,MAAM;EAChB,OAAO,MAAM,SAAS,KAAA;EACtB,UAAU,MAAM,YAAY,KAAA;EAC5B,YAAY,MAAM,cAAc,KAAA;EAEH,CAAC"}

package/dist/src/browser/actions/extension-registry-bridge.js

@@ -1,7 +1,7 @@
-import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 import { resolveBrowserCommandTimeoutMs } from "../browser-command-timeout.js";
 import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern } from "../url-policy.js";
 import { truncateSnapshotAtBoundary } from "../snapshot-helpers.js";
+import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 //#region src/browser/actions/extension-registry-bridge.ts
 /**
 * Runs browser registry actions against the Chrome Extension bridge (no Playwright page).