nolo-cli 0.27.1 → 0.28.0

package/{chunk-VV4TYWNV.js → chunk-WX3ZOSTL.js}

@@ -1,6 +1,17 @@
 import {
-  getAntigravityUserAgent
-} from "./chunk-UTYJ47H2.js";
+  ANTIGRAVITY_AUTH_URL,
+  ANTIGRAVITY_CALLBACK_PATH,
+  ANTIGRAVITY_CALLBACK_PORT,
+  ANTIGRAVITY_CLIENT_ID,
+  ANTIGRAVITY_CLIENT_SECRET,
+  ANTIGRAVITY_CLOUD_CODE_BASE_URL,
+  ANTIGRAVITY_SCOPES,
+  ANTIGRAVITY_TOKEN_URL,
+  ANTIGRAVITY_USERINFO_URL,
+  getAntigravityUserAgent,
+  normalizeAntigravityTokenPayload,
+  refreshAntigravityToken
+} from "./chunk-2FX23RGA.js";
 import {
   writeOAuthCredential
 } from "./chunk-JZPBVBIY.js";
@@ -153,28 +164,9 @@ function generatePkcePair(length = PKCE_VERIFIER_LENGTH) {
 }
 
 // packages/cli/oauth/flows/antigravity.ts
-var decode = (s) => Buffer.from(s, "base64").toString("utf8");
-var CLIENT_ID = decode(
-  "MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ=="
-);
-var CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
-var CALLBACK_PORT = 51121;
-var CALLBACK_PATH = "/oauth-callback";
-var SCOPES = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile",
-  "https://www.googleapis.com/auth/cclog",
-  "https://www.googleapis.com/auth/experimentsandconfigs"
-];
-var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL = "https://oauth2.googleapis.com/token";
-var USERINFO_URL = "https://www.googleapis.com/oauth2/v1/userinfo?alt=json";
-var CLOUD_CODE_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
 var TIER_LEGACY = "legacy-tier";
 var PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
 var PROJECT_ONBOARD_INTERVAL_MS = 2e3;
-var ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
 var ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
   ideType: "ANTIGRAVITY",
   platform: "PLATFORM_UNSPECIFIED",
@@ -251,7 +243,7 @@ async function discoverProject(fetchImpl, accessToken, onProgress) {
     "User-Agent": getAntigravityUserAgent()
   };
   onProgress?.("Checking for existing project...");
-  const endpoint = CLOUD_CODE_ENDPOINT;
+  const endpoint = ANTIGRAVITY_CLOUD_CODE_BASE_URL;
   const loadResponse = await fetchImpl(`${endpoint}/v1internal:loadCodeAssist`, {
     method: "POST",
     headers,
@@ -286,7 +278,7 @@ async function discoverProject(fetchImpl, accessToken, onProgress) {
 }
 async function getUserEmail(fetchImpl, accessToken) {
   try {
-    const response = await fetchImpl(USERINFO_URL, {
+    const response = await fetchImpl(ANTIGRAVITY_USERINFO_URL, {
       headers: { Authorization: `Bearer ${accessToken}` }
     });
     if (!response.ok) return void 0;
@@ -305,32 +297,32 @@ async function runAntigravityOAuthLogin(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const output = deps.output ?? console;
   const error = deps.error ?? console;
-  const redirectUri = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;
+  const redirectUri = `http://127.0.0.1:${ANTIGRAVITY_CALLBACK_PORT}${ANTIGRAVITY_CALLBACK_PATH}`;
   let handle;
   try {
     handle = await startCallbackServer({
-      port: CALLBACK_PORT,
+      port: ANTIGRAVITY_CALLBACK_PORT,
       hostname: "127.0.0.1",
       timeoutMs: 5 * 6e4
     });
   } catch (err) {
     throw new Error(
-      `Failed to start Antigravity OAuth callback server on ${CALLBACK_PORT}: ${toErrorMessage(err)}`
+      `Failed to start Antigravity OAuth callback server on ${ANTIGRAVITY_CALLBACK_PORT}: ${toErrorMessage(err)}`
     );
   }
   try {
     const state = generateState();
     const pkce = await generatePkcePair();
     const authParams = new URLSearchParams({
-      client_id: CLIENT_ID,
+      client_id: ANTIGRAVITY_CLIENT_ID,
       response_type: "code",
       redirect_uri: redirectUri,
-      scope: SCOPES.join(" "),
+      scope: ANTIGRAVITY_SCOPES.join(" "),
       state,
       access_type: "offline",
       prompt: "consent"
     });
-    const authUrl = `${AUTH_URL}?${authParams.toString()}`;
+    const authUrl = `${ANTIGRAVITY_AUTH_URL}?${authParams.toString()}`;
     output.log(
       `Open the following URL in your browser to log in to Antigravity:
   ${authUrl}`
@@ -345,15 +337,16 @@ async function runAntigravityOAuthLogin(deps = {}) {
       }
     }
     const callback = await handle.waitForCode();
-    const tokenResponse = await fetchImpl(TOKEN_URL, {
+    const tokenResponse = await fetchImpl(ANTIGRAVITY_TOKEN_URL, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams({
-        client_id: CLIENT_ID,
-        client_secret: CLIENT_SECRET,
+        client_id: ANTIGRAVITY_CLIENT_ID,
+        client_secret: ANTIGRAVITY_CLIENT_SECRET,
         code: callback.code,
         grant_type: "authorization_code",
-        redirect_uri: redirectUri
+        redirect_uri: redirectUri,
+        code_verifier: pkce.verifier
       })
     });
     if (!tokenResponse.ok) {
@@ -361,66 +354,43 @@ async function runAntigravityOAuthLogin(deps = {}) {
       throw new Error(`Antigravity token exchange failed: ${body}`);
     }
     const tokenData = await tokenResponse.json();
-    if (!tokenData.refresh_token) {
+    if (typeof tokenData.refresh_token !== "string" || !tokenData.refresh_token.trim()) {
       throw new Error("No refresh token received. Please try again.");
     }
-    const email = await getUserEmail(fetchImpl, tokenData.access_token);
+    if (typeof tokenData.access_token !== "string" || !tokenData.access_token.trim()) {
+      throw new Error("No access token received. Please try again.");
+    }
+    const email = await getUserEmail(fetchImpl, tokenData.access_token.trim());
     const projectId = await discoverProject(
       fetchImpl,
-      tokenData.access_token,
+      tokenData.access_token.trim(),
       (message) => output.log(message)
     );
     const now = (deps.now ?? Date.now)();
-    return {
-      provider: "antigravity",
-      accessToken: tokenData.access_token,
-      refreshToken: tokenData.refresh_token,
-      expiresAt: now + tokenData.expires_in * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS,
-      scope: tokenData.scope,
-      obtainedAt: now,
-      metadata: {
-        projectId,
-        email
-      }
-    };
+    return normalizeAntigravityTokenPayload({
+      payload: tokenData,
+      baseCredential: {
+        provider: "antigravity",
+        accountId: email,
+        metadata: {
+          projectId,
+          email
+        }
+      },
+      now
+    });
   } finally {
     await handle.close();
   }
 }
-async function refreshAntigravityOAuthToken(credential) {
-  if (!credential.refreshToken) {
-    throw new Error("Antigravity credential has no refresh_token");
-  }
-  const fetchImpl = fetch;
-  const projectId = credential.metadata?.projectId ?? void 0;
-  const response = await fetchImpl(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: CLIENT_ID,
-      client_secret: CLIENT_SECRET,
-      refresh_token: credential.refreshToken,
-      grant_type: "refresh_token"
-    })
-  });
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`Antigravity token refresh failed: ${body}`);
-  }
-  const data = await response.json();
-  const now = Date.now();
-  return {
-    ...credential,
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token || credential.refreshToken,
-    expiresAt: now + data.expires_in * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS,
-    scope: data.scope ?? credential.scope,
-    obtainedAt: now
-  };
+async function refreshAntigravityOAuthToken(credential, deps = {}) {
+  return refreshAntigravityToken(credential, deps);
 }
 
 // packages/cli/oauth/flows/openai-codex.ts
 import { createHash as createHash2 } from "node:crypto";
+
+// packages/agent-runtime/openaiCodexOAuth.ts
 var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var OPENAI_CODEX_SCOPES = [
   "openid",
@@ -440,8 +410,104 @@ var OPENAI_CODEX_ORIGINATOR = "codex_cli_rs";
 var OPENAI_CODEX_CALLBACK_PORT = 1455;
 var OPENAI_CODEX_CALLBACK_PATH = "/auth/callback";
 var OPENAI_CODEX_CALLBACK_URL = `http://localhost:${OPENAI_CODEX_CALLBACK_PORT}${OPENAI_CODEX_CALLBACK_PATH}`;
+var OPENAI_CODEX_ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+function decodeOpenAiIdToken(idToken) {
+  if (!idToken || typeof idToken !== "string") return {};
+  const parts = idToken.split(".");
+  if (parts.length < 2) return {};
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf-8")
+    );
+    const authClaim = payload["https://api.openai.com/auth"];
+    const nestedAccountId = authClaim && typeof authClaim === "object" ? authClaim.chatgpt_account_id : void 0;
+    const accountId = nestedAccountId ?? payload["chatgpt_account_id"] ?? payload["account_id"];
+    const email = payload["email"];
+    return {
+      ...typeof accountId === "string" && accountId.trim() ? { accountId: accountId.trim() } : {},
+      ...typeof email === "string" && email.trim() ? { email: email.trim() } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function normalizeOpenAiCodexTokenPayload(args) {
+  const { payload, baseCredential, now = Date.now() } = args;
+  if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
+    throw new Error("OpenAI Codex token response missing access_token");
+  }
+  const accessToken = payload.access_token.trim();
+  const expiresIn = asOptionalFiniteNumber(payload.expires_in);
+  const clientSkewMs = args.clientSkewMs ?? OPENAI_CODEX_ACCESS_TOKEN_CLIENT_SKEW_MS;
+  const expiresAt = expiresIn !== void 0 ? now + expiresIn * 1e3 - clientSkewMs : baseCredential?.expiresAt;
+  const idTokenStr = typeof payload.id_token === "string" && payload.id_token.trim() ? payload.id_token.trim() : void 0;
+  const fromAccess = decodeOpenAiIdToken(accessToken);
+  const fromId = idTokenStr ? decodeOpenAiIdToken(idTokenStr) : {};
+  const accountId = fromAccess.accountId ?? fromId.accountId ?? baseCredential?.accountId;
+  const email = fromAccess.email ?? fromId.email ?? baseCredential?.metadata?.email;
+  const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.trim() ? payload.refresh_token.trim() : baseCredential?.refreshToken;
+  const scope = typeof payload.scope === "string" && payload.scope.trim() ? payload.scope.trim() : baseCredential?.scope;
+  const metadata = {
+    ...baseCredential?.metadata ?? {},
+    ...email ? { email } : {}
+  };
+  return {
+    ...baseCredential ?? {},
+    provider: "chatgpt",
+    accessToken,
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {},
+    obtainedAt: now,
+    ...scope ? { scope } : {},
+    ...accountId ? { accountId } : {},
+    ...Object.keys(metadata).length > 0 ? { metadata } : {}
+  };
+}
+async function refreshOpenAiCodexToken(credential, deps = {}) {
+  if (!credential.refreshToken) {
+    throw new Error("Cannot refresh OpenAI Codex token without a refresh token.");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    client_id: OPENAI_CODEX_CLIENT_ID,
+    grant_type: "refresh_token",
+    refresh_token: credential.refreshToken
+  });
+  let response;
+  try {
+    response = await fetchImpl(OPENAI_CODEX_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: body.toString(),
+      signal: AbortSignal.timeout(OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `OpenAI Codex token refresh failed: ${toErrorMessage(error)}`
+    );
+  }
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const detail = typeof payload.error_description === "string" && payload.error_description ? payload.error_description : typeof payload.error === "string" && payload.error ? payload.error : `HTTP ${response.status}`;
+    throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
+  }
+  if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
+    throw new Error("OpenAI Codex token refresh response missing access_token");
+  }
+  const now = deps.now?.() ?? Date.now();
+  return normalizeOpenAiCodexTokenPayload({
+    payload,
+    baseCredential: credential,
+    now
+  });
+}
+
+// packages/cli/oauth/flows/openai-codex.ts
 var AUTHORIZATION_CODE_GRANT_TYPE = "authorization_code";
-var REFRESH_TOKEN_GRANT_TYPE = "refresh_token";
 var DEVICE_CODE_DEFAULT_INTERVAL_MS = 5e3;
 var DEVICE_POLL_SAFETY_MARGIN_MS = 3e3;
 var DEVICE_MAX_POLLS = 120;
@@ -470,76 +536,14 @@ async function postForm(fetchImpl, url, body, deps) {
   return response;
 }
 async function parseJsonResponse(response) {
-  const text = await response.text().catch(() => "");
-  if (!text) return {};
   try {
-    return JSON.parse(text);
+    return await response.json();
   } catch {
     return {};
   }
 }
-function scopeString(scopes = OPENAI_CODEX_SCOPES) {
-  return scopes.join(" ");
-}
-function base64UrlDecode(value) {
-  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  return Buffer.from(padded, "base64").toString("utf8");
-}
-var OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
-var OPENAI_PROFILE_CLAIM = "https://api.openai.com/profile";
-function readClaimString(claim, key) {
-  if (!claim || typeof claim !== "object") return void 0;
-  const value = claim[key];
-  return typeof value === "string" && value ? value : void 0;
-}
-function decodeOpenAiIdToken(idToken) {
-  if (!idToken) return {};
-  const parts = idToken.split(".");
-  if (parts.length < 2) return {};
-  try {
-    const payload = JSON.parse(base64UrlDecode(parts[1]));
-    const authClaim = payload[OPENAI_AUTH_CLAIM];
-    const profileClaim = payload[OPENAI_PROFILE_CLAIM];
-    return {
-      chatgptAccountId: readClaimString(authClaim, "chatgpt_account_id") ?? (typeof payload["chatgpt_account_id"] === "string" ? payload["chatgpt_account_id"] : void 0),
-      email: readClaimString(profileClaim, "email") ?? (typeof payload["email"] === "string" ? payload["email"] : void 0),
-      payload
-    };
-  } catch {
-    return {};
-  }
-}
-function tokenResponseToCredential(token, now) {
-  const fromAccess = decodeOpenAiIdToken(token.accessToken);
-  const fromId = decodeOpenAiIdToken(token.idToken);
-  const decoded = {
-    chatgptAccountId: fromAccess.chatgptAccountId ?? fromId.chatgptAccountId,
-    email: fromAccess.email ?? fromId.email
-  };
-  const expiresAt = typeof token.expiresIn === "number" && token.expiresIn > 0 ? now + token.expiresIn * 1e3 : void 0;
-  return {
-    provider: "chatgpt",
-    accessToken: token.accessToken,
-    ...token.refreshToken ? { refreshToken: token.refreshToken } : {},
-    ...expiresAt ? { expiresAt } : {},
-    ...token.scope ? { scope: token.scope } : {},
-    ...token.idToken ? { idToken: token.idToken } : {},
-    ...decoded.chatgptAccountId ? { accountId: decoded.chatgptAccountId } : {},
-    obtainedAt: now
-  };
-}
-function extractTokenResponse(data) {
-  const accessToken = data["access_token"];
-  if (typeof accessToken !== "string" || !accessToken) return null;
-  const expiresInRaw = data["expires_in"];
-  return {
-    accessToken,
-    ...typeof data["refresh_token"] === "string" ? { refreshToken: data["refresh_token"] } : {},
-    ...typeof expiresInRaw === "number" ? { expiresIn: expiresInRaw } : {},
-    ...typeof data["scope"] === "string" ? { scope: data["scope"] } : {},
-    ...typeof data["id_token"] === "string" ? { idToken: data["id_token"] } : {}
-  };
+function scopeString() {
+  return OPENAI_CODEX_SCOPES.join(" ");
 }
 async function startDeviceCodeFlow(deps) {
   const fetchImpl = deps.fetchImpl ?? fetch;
@@ -574,11 +578,11 @@ async function startDeviceCodeFlow(deps) {
 }
 async function pollDeviceCodeToken(args) {
   const fetchImpl = args.deps?.fetchImpl ?? fetch;
-  const sleep3 = args.sleep ?? args.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep2 = args.sleep ?? args.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const intervalMs = args.intervalMs ?? DEVICE_CODE_DEFAULT_INTERVAL_MS;
   const maxPolls = args.maxPolls ?? DEVICE_MAX_POLLS;
   for (let poll = 0; poll < maxPolls; poll++) {
-    await sleep3(poll === 0 ? Math.min(intervalMs, DEVICE_CODE_DEFAULT_INTERVAL_MS) : intervalMs);
+    await sleep2(poll === 0 ? Math.min(intervalMs, DEVICE_CODE_DEFAULT_INTERVAL_MS) : intervalMs);
     const response = await postJson(
       fetchImpl,
       OPENAI_CODEX_DEVICE_TOKEN_URL,
@@ -644,7 +648,7 @@ async function runOpenAiCodexDeviceCode(deps = {}) {
 }
 async function exchangeCodexAuthorizationCode(args) {
   const fetchImpl = args.deps?.fetchImpl ?? fetch;
-  const now = args.now ?? Date.now;
+  const now = (args.now ?? Date.now)();
   const response = await postForm(
     fetchImpl,
     OPENAI_CODEX_TOKEN_URL,
@@ -663,11 +667,10 @@ async function exchangeCodexAuthorizationCode(args) {
       `OpenAI authorization-code exchange failed (HTTP ${response.status}): ${JSON.stringify(data)}`
     );
   }
-  const token = extractTokenResponse(data);
-  if (!token) {
-    throw new Error(`OpenAI authorization-code exchange returned no token: ${JSON.stringify(data)}`);
-  }
-  return tokenResponseToCredential(token, now());
+  return normalizeOpenAiCodexTokenPayload({
+    payload: data,
+    now
+  });
 }
 async function exchangeAuthorizationCode(args) {
   return exchangeCodexAuthorizationCode({
@@ -726,42 +729,14 @@ async function runOpenAiCodexBrowserPkce(deps = {}) {
     });
   }
 }
-var refreshOpenAiCodexToken = async (credential, deps = {}) => {
-  if (!credential.refreshToken) {
-    throw new Error("Cannot refresh ChatGPT OAuth token without a refresh_token.");
-  }
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const now = deps.now ?? Date.now;
-  const response = await postForm(
-    fetchImpl,
-    OPENAI_CODEX_TOKEN_URL,
-    {
-      grant_type: REFRESH_TOKEN_GRANT_TYPE,
-      refresh_token: credential.refreshToken,
-      client_id: OPENAI_CODEX_CLIENT_ID,
-      scope: scopeString()
-    },
-    deps
-  );
-  const data = await parseJsonResponse(response);
-  if (!response.ok) {
-    throw new Error(
-      `OpenAI token refresh failed (HTTP ${response.status}): ${JSON.stringify(data)}`
-    );
-  }
-  const token = extractTokenResponse(data);
-  if (!token) {
-    throw new Error(`OpenAI token refresh returned no token: ${JSON.stringify(data)}`);
-  }
-  const refreshed = tokenResponseToCredential(token, now());
-  return {
-    ...refreshed,
-    refreshToken: refreshed.refreshToken ?? credential.refreshToken,
-    accountId: refreshed.accountId ?? credential.accountId
-  };
+var refreshOpenAiCodexToken2 = async (credential, deps = {}) => {
+  return refreshOpenAiCodexToken(credential, {
+    fetchImpl: deps.fetchImpl,
+    now: deps.now
+  });
 };
 
-// packages/cli/oauth/flows/xai.ts
+// packages/agent-runtime/xaiOAuth.ts
 var XAI_OAUTH_ISSUER = "https://auth.x.ai";
 var XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
 var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
@@ -769,15 +744,16 @@ var XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:a
 var XAI_OAUTH_REDIRECT_HOST = "127.0.0.1";
 var XAI_OAUTH_REDIRECT_PORT = 56121;
 var XAI_OAUTH_REDIRECT_PATH = "/callback";
+var XAI_OAUTH_REDIRECT_URI = `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`;
 var XAI_OAUTH_DOCS_URL = "https://hermes-agent.nousresearch.com/docs/guides/xai-grok-oauth";
 var XAI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 var XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS = 5e3;
 var XAI_DEVICE_CODE_MIN_INTERVAL_MS = 1e3;
 var XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS = 5e3;
 var XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS = 5 * 6e4;
-var ACCESS_TOKEN_CLIENT_SKEW_MS2 = 5 * 60 * 1e3;
-var DISCOVERY_TIMEOUT_MS = 15e3;
-var TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+var XAI_ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var XAI_DISCOVERY_TIMEOUT_MS = 15e3;
+var XAI_TOKEN_REQUEST_TIMEOUT_MS = 2e4;
 function validateXAIEndpoint(url, field) {
   let parsed;
   try {
@@ -835,8 +811,8 @@ async function readJsonBody(response, context) {
     );
   }
 }
-async function xaiOAuthDiscovery(fetchImpl, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DISCOVERY_TIMEOUT_MS;
+async function xaiOAuthDiscovery(fetchImpl = fetch, options = {}) {
+  const timeoutMs = options.timeoutMs ?? XAI_DISCOVERY_TIMEOUT_MS;
   let response;
   try {
     response = await fetchImpl(XAI_OAUTH_DISCOVERY_URL, {
@@ -850,6 +826,14 @@ async function xaiOAuthDiscovery(fetchImpl, options = {}) {
     );
   }
   if (response.status !== 200) {
+    if (isLikelyHtmlOrCloudflareChallenge(
+      response,
+      await response.clone().text().catch(() => "")
+    )) {
+      throw new Error(
+        `xAI OIDC discovery failed (${response.status}): xAI returned an HTML/Cloudflare challenge instead of OAuth JSON`
+      );
+    }
     throw new Error(`xAI OIDC discovery returned status ${response.status}.`);
   }
   const obj = await readJsonBody(response, "xAI OIDC discovery");
@@ -879,72 +863,53 @@ async function xaiOAuthDiscovery(fetchImpl, options = {}) {
     ...deviceAuthorizationEndpoint ? { device_authorization_endpoint: deviceAuthorizationEndpoint } : {}
   };
 }
-function buildXAIAuthorizeUrl(opts) {
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: XAI_OAUTH_CLIENT_ID,
-    redirect_uri: opts.redirectUri,
-    scope: XAI_OAUTH_SCOPE,
-    code_challenge: opts.codeChallenge,
-    code_challenge_method: "S256",
-    state: opts.state,
-    nonce: opts.nonce,
-    plan: "generic",
-    referrer: "nolo-cli"
-  });
-  return `${opts.authorizationEndpoint}?${params.toString()}`;
-}
-function generateState2() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
-}
-function parsePositiveSecondsToMs(value, fallbackMs) {
-  const sec = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
-  if (!Number.isFinite(sec) || sec <= 0) return fallbackMs;
-  return Math.max(1, Math.floor(sec * 1e3));
-}
-function parseOAuthTokenPayload(data, context, options = {}) {
-  if (typeof data.access_token !== "string" || !data.access_token) {
+function normalizeXaiTokenPayload(args) {
+  const {
+    payload,
+    baseCredential,
+    now = Date.now(),
+    requireRefreshToken = false,
+    context = "xAI OAuth token response"
+  } = args;
+  const accessToken = typeof payload.access_token === "string" ? payload.access_token.trim() : "";
+  if (!accessToken) {
     throw new Error(`${context} missing access_token`);
   }
-  const refreshToken = typeof data.refresh_token === "string" && data.refresh_token ? data.refresh_token : void 0;
-  if (options.requireRefreshToken && !refreshToken) {
+  const rawRefreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.trim() ? payload.refresh_token.trim() : void 0;
+  if (requireRefreshToken && !rawRefreshToken) {
     throw new Error(`${context} missing refresh_token`);
   }
-  const expiresIn = asOptionalFiniteNumber(data.expires_in);
+  const expiresIn = asOptionalFiniteNumber(payload.expires_in);
   if (expiresIn === void 0) {
     throw new Error(`${context} missing expires_in`);
   }
+  const refreshToken = rawRefreshToken ?? baseCredential?.refreshToken;
+  const scope = typeof payload.scope === "string" && payload.scope.trim() ? payload.scope.trim() : baseCredential?.scope;
+  const idToken = typeof payload.id_token === "string" && payload.id_token.trim() ? payload.id_token.trim() : baseCredential?.idToken;
+  const accountId = typeof payload.account_id === "string" && payload.account_id ? payload.account_id : baseCredential?.accountId;
   return {
-    accessToken: data.access_token,
-    ...refreshToken ? { refreshToken } : {},
-    expiresIn,
-    scope: typeof data.scope === "string" ? data.scope : void 0,
-    idToken: typeof data.id_token === "string" ? data.id_token : void 0
-  };
-}
-function tokenToCredential(token, now) {
-  const expiresIn = token.expiresIn;
-  return {
+    ...baseCredential,
     provider: "xai",
-    accessToken: token.accessToken,
-    refreshToken: token.refreshToken,
-    expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS2,
-    scope: token.scope,
-    idToken: token.idToken,
+    accessToken,
+    ...refreshToken ? { refreshToken } : {},
+    expiresAt: now + expiresIn * 1e3 - XAI_ACCESS_TOKEN_CLIENT_SKEW_MS,
+    ...scope ? { scope } : {},
+    ...idToken ? { idToken } : {},
+    ...accountId ? { accountId } : {},
     obtainedAt: now
   };
 }
-async function exchangeXAIToken(fetchImpl, code, redirectUri, verifier) {
+async function refreshXaiToken(credential, deps = {}) {
+  if (!credential.refreshToken) {
+    throw new Error("xAI credential has no refresh_token");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
   const discovery = await xaiOAuthDiscovery(fetchImpl);
   const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
   const body = new URLSearchParams({
-    grant_type: "authorization_code",
+    grant_type: "refresh_token",
     client_id: XAI_OAUTH_CLIENT_ID,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
+    refresh_token: credential.refreshToken
   });
   let response;
   try {
@@ -955,448 +920,175 @@ async function exchangeXAIToken(fetchImpl, code, redirectUri, verifier) {
         Accept: "application/json"
       },
       body,
-      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+      signal: AbortSignal.timeout(XAI_TOKEN_REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
     throw new Error(
-      `xAI token exchange failed: ${toErrorMessage(error)}`
+      `xAI token refresh failed: ${toErrorMessage(error)}`
     );
   }
-  const data = await readJsonBody(response, "xAI token exchange");
+  const data = await readJsonBody(response, "xAI token refresh");
   if (!response.ok) {
     const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
     throw new Error(
-      `xAI token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`
+      `xAI token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`
     );
   }
-  return parseOAuthTokenPayload(data, "xAI token exchange response", {
-    requireRefreshToken: true
+  const now = deps.now?.() ?? Date.now();
+  return normalizeXaiTokenPayload({
+    payload: data,
+    baseCredential: credential,
+    now,
+    context: "xAI token refresh response"
   });
 }
-async function requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint) {
-  const endpoint = validateXAIEndpoint(
-    deviceAuthorizationEndpoint,
-    "device_authorization_endpoint"
-  );
-  let response;
-  try {
-    response = await fetchImpl(endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json"
-      },
-      body: new URLSearchParams({
-        client_id: XAI_OAUTH_CLIENT_ID,
-        scope: XAI_OAUTH_SCOPE
-      }),
-      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
-    });
-  } catch (error) {
-    throw new Error(
-      `xAI device code request failed: ${toErrorMessage(error)}`
-    );
-  }
-  const data = await readJsonBody(response, "xAI device code request");
-  if (!response.ok) {
-    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
-    throw new Error(
-      `xAI device code request failed (${response.status})${detail ? `: ${detail}` : ""}`
-    );
-  }
-  const deviceCode = asTrimmedString(data.device_code);
-  const userCode = asTrimmedString(data.user_code);
-  const verificationUri = asTrimmedString(data.verification_uri);
-  const verificationUriComplete = asTrimmedString(
-    data.verification_uri_complete
-  );
-  if (!deviceCode || !userCode || !verificationUri) {
-    throw new Error(
-      "xAI device code response is missing device_code, user_code, or verification_uri"
-    );
-  }
-  validateXAIEndpoint(verificationUri, "verification_uri");
-  if (verificationUriComplete) {
-    validateXAIEndpoint(verificationUriComplete, "verification_uri_complete");
-  }
+var xaiRefresh = refreshXaiToken;
+
+// packages/agent-runtime/anthropicOAuth.ts
+var ANTHROPIC_OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var ANTHROPIC_OAUTH_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var ANTHROPIC_OAUTH_TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+var ANTHROPIC_OAUTH_CALLBACK_PORT = 54545;
+var ANTHROPIC_OAUTH_REDIRECT_URI = `http://localhost:${ANTHROPIC_OAUTH_CALLBACK_PORT}/callback`;
+var ANTHROPIC_OAUTH_SCOPES = [
+  "org:create_api_key",
+  "user:profile",
+  "user:inference",
+  "user:sessions:claude_code",
+  "user:mcp_servers",
+  "user:file_upload"
+];
+var ANTHROPIC_ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var ANTHROPIC_OAUTH_BETA = "oauth-2025-04-20";
+function normalizeAnthropicTokenPayload(args) {
+  const { payload, baseCredential, now = Date.now() } = args;
+  if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
+    throw new Error("Claude OAuth token response missing access_token");
+  }
+  const expiresIn = asOptionalFiniteNumber(payload.expires_in);
+  const accountId = typeof payload.account?.uuid === "string" && payload.account.uuid ? payload.account.uuid : baseCredential?.accountId;
+  const email = typeof payload.account?.email_address === "string" && payload.account.email_address ? payload.account.email_address : baseCredential?.metadata?.email;
+  const organizationId = typeof payload.organization?.uuid === "string" && payload.organization.uuid ? payload.organization.uuid : baseCredential?.metadata?.organizationId;
+  const organizationName = typeof payload.organization?.name === "string" && payload.organization.name ? payload.organization.name : baseCredential?.metadata?.organizationName;
+  const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.trim() ? payload.refresh_token.trim() : baseCredential?.refreshToken;
+  const scope = typeof payload.scope === "string" && payload.scope ? payload.scope : baseCredential?.scope;
+  const metadata = {
+    ...baseCredential?.metadata ?? {},
+    ...email ? { email } : {},
+    ...organizationId ? { organizationId } : {},
+    ...organizationName ? { organizationName } : {}
+  };
   return {
-    deviceCode,
-    userCode,
-    verificationUri,
-    ...verificationUriComplete ? { verificationUriComplete } : {},
-    expiresInMs: parsePositiveSecondsToMs(
-      data.expires_in,
-      XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS
-    ),
-    intervalMs: Math.max(
-      parsePositiveSecondsToMs(data.interval, XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS),
-      XAI_DEVICE_CODE_MIN_INTERVAL_MS
-    )
+    ...baseCredential,
+    provider: "claude",
+    accessToken: payload.access_token.trim(),
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresIn !== void 0 ? { expiresAt: now + expiresIn * 1e3 - ANTHROPIC_ACCESS_TOKEN_CLIENT_SKEW_MS } : baseCredential?.expiresAt !== void 0 ? { expiresAt: baseCredential.expiresAt } : {},
+    ...scope ? { scope } : {},
+    ...accountId ? { accountId } : {},
+    ...Object.keys(metadata).length > 0 ? { metadata } : {},
+    obtainedAt: now
   };
 }
-async function pollXaiDeviceCodeToken(args) {
-  const tokenEndpoint = validateXAIEndpoint(args.tokenEndpoint, "token_endpoint");
-  const deadlineMs = args.now() + args.expiresInMs;
-  let intervalMs = args.intervalMs;
-  while (args.now() < deadlineMs) {
-    const remainingMs = Math.max(0, deadlineMs - args.now());
-    const delayMs = Math.min(Math.max(intervalMs, XAI_DEVICE_CODE_MIN_INTERVAL_MS), remainingMs);
-    if (delayMs > 0) {
-      await args.sleep(delayMs);
-    }
-    if (args.now() >= deadlineMs) break;
-    let response;
-    try {
-      response = await args.fetchImpl(tokenEndpoint, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: new URLSearchParams({
-          grant_type: XAI_DEVICE_CODE_GRANT_TYPE,
-          client_id: XAI_OAUTH_CLIENT_ID,
-          device_code: args.deviceCode
-        }),
-        signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
-      });
-    } catch (error) {
-      const message = toErrorMessage(error);
-      if (/abort|timeout/i.test(message)) {
-        throw new Error(`xAI device token poll aborted or timed out: ${message}`);
-      }
-      throw new Error(`xAI device token poll failed: ${message}`);
-    }
-    let data;
-    try {
-      data = await readJsonBody(response, "xAI device token exchange");
-    } catch (error) {
-      throw error;
-    }
-    if (response.ok) {
-      return parseOAuthTokenPayload(data, "xAI device token exchange response", {
-        requireRefreshToken: true
-      });
-    }
-    const oauthError = typeof data.error === "string" ? data.error : "";
-    if (oauthError === "authorization_pending") {
-      continue;
-    }
-    if (oauthError === "slow_down") {
-      intervalMs += XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS;
-      continue;
-    }
-    if (oauthError === "access_denied" || oauthError === "authorization_denied") {
-      throw new Error("xAI device authorization was denied");
-    }
-    if (oauthError === "expired_token") {
-      throw new Error("xAI device code expired. Re-run the login.");
-    }
-    const detail = typeof data.error_description === "string" && data.error_description || oauthError || "";
-    throw new Error(
-      `xAI device token exchange failed (${response.status})${detail ? `: ${detail}` : ""}`
-    );
-  }
-  throw new Error("xAI device authorization timed out");
-}
-async function runXaiOAuthLogin(deps = {}) {
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const output = deps.output ?? console;
-  const error = deps.error ?? console;
-  const redirectUri = `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`;
-  let handle;
-  try {
-    handle = await startCallbackServer({
-      port: XAI_OAUTH_REDIRECT_PORT,
-      hostname: XAI_OAUTH_REDIRECT_HOST,
-      timeoutMs: 5 * 6e4
-    });
-  } catch (err) {
-    throw new Error(
-      `Failed to start xAI OAuth callback server on ${XAI_OAUTH_REDIRECT_PORT}: ${toErrorMessage(err)}`
-    );
-  }
-  try {
-    const state = generateState2();
-    const pkce = await generatePkcePair();
-    const nonce = crypto.randomUUID().replace(/-/g, "");
-    const discovery = await xaiOAuthDiscovery(fetchImpl);
-    const authUrl = buildXAIAuthorizeUrl({
-      authorizationEndpoint: discovery.authorization_endpoint,
-      redirectUri,
-      codeChallenge: pkce.challenge,
-      state,
-      nonce
-    });
-    output.log(
-      `Open the following URL in your browser to log in to xAI Grok (SuperGrok):
-  ${authUrl}
-
-Docs: ${XAI_OAUTH_DOCS_URL}`
-    );
-    if (deps.openBrowser) {
-      try {
-        await deps.openBrowser(authUrl);
-      } catch (err) {
-        error.error(
-          `Failed to open browser automatically: ${toErrorMessage(err)}`
-        );
-      }
-    }
-    const callback = await handle.waitForCode();
-    const token = await exchangeXAIToken(
-      fetchImpl,
-      callback.code,
-      redirectUri,
-      pkce.verifier
-    );
-    const now = (deps.now ?? Date.now)();
-    return tokenToCredential(token, now);
-  } finally {
-    await handle.close();
+async function refreshAnthropicToken(credential, deps = {}) {
+  if (!credential.refreshToken) {
+    throw new Error("Claude credential has no refresh_token");
   }
-}
-async function runXaiOAuthDeviceCode(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const output = deps.output ?? console;
-  const error = deps.error ?? console;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const now = deps.now ?? Date.now;
-  const discovery = await xaiOAuthDiscovery(fetchImpl, {
-    requireDeviceAuthorization: true
+  const response = await fetchImpl(ANTHROPIC_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "anthropic-beta": ANTHROPIC_OAUTH_BETA,
+      "User-Agent": "nolo-cli userOAuthProvider"
+    },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      client_id: ANTHROPIC_OAUTH_CLIENT_ID,
+      refresh_token: credential.refreshToken
+    }),
+    signal: AbortSignal.timeout(3e4)
   });
-  const deviceAuthorizationEndpoint = discovery.device_authorization_endpoint;
-  if (!deviceAuthorizationEndpoint) {
-    throw new Error("xAI OIDC discovery missing device_authorization_endpoint");
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
+    throw new Error(`Claude token refresh failed: ${detail}`);
   }
-  const start = await requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint);
-  const browserUrl = start.verificationUriComplete ?? start.verificationUri;
-  const expiresMinutes = Math.max(1, Math.round(start.expiresInMs / 6e4));
-  output.log("Authorize nolo-cli for xAI Grok (device code / headless):");
-  output.log(`  URL: ${start.verificationUri}`);
-  if (start.verificationUriComplete) {
-    output.log(`  Complete URL: ${start.verificationUriComplete}`);
+  if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
+    throw new Error("Claude token refresh response missing access_token");
   }
-  output.log(`  Code: ${start.userCode}`);
-  output.log(
-    `  Code expires in ~${expiresMinutes} minute(s). Never share the code or tokens.`
-  );
-  if (deps.openBrowser) {
-    try {
-      const opened = await deps.openBrowser(browserUrl);
-      if (!opened) {
-        output.log("Could not open a browser automatically. Open the URL above.");
-      }
-    } catch (err) {
-      error.error(
-        `Failed to open browser automatically: ${toErrorMessage(err)}`
-      );
-    }
-  } else {
-    output.log("Open the URL above in a browser and enter the code to approve.");
-  }
-  const token = await pollXaiDeviceCodeToken({
-    fetchImpl,
-    tokenEndpoint: discovery.token_endpoint,
-    deviceCode: start.deviceCode,
-    expiresInMs: start.expiresInMs,
-    intervalMs: start.intervalMs,
-    sleep: sleep3,
+  const now = deps.now?.() ?? Date.now();
+  return normalizeAnthropicTokenPayload({
+    payload,
+    baseCredential: credential,
     now
   });
-  return tokenToCredential(token, now());
-}
-async function refreshXaiOAuthToken(credential) {
-  if (!credential.refreshToken) {
-    throw new Error("xAI credential has no refresh_token");
-  }
-  const fetchImpl = fetch;
-  const discovery = await xaiOAuthDiscovery(fetchImpl);
-  const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: XAI_OAUTH_CLIENT_ID,
-    refresh_token: credential.refreshToken
-  });
-  let response;
-  try {
-    response = await fetchImpl(tokenEndpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json"
-      },
-      body,
-      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
-    });
-  } catch (error) {
-    throw new Error(
-      `xAI token refresh failed: ${toErrorMessage(error)}`
-    );
-  }
-  const data = await readJsonBody(response, "xAI token refresh");
-  if (!response.ok) {
-    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
-    throw new Error(
-      `xAI token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`
-    );
-  }
-  if (typeof data.access_token !== "string" || !data.access_token) {
-    throw new Error("xAI token refresh response missing access_token");
-  }
-  const expiresIn = asOptionalFiniteNumber(data.expires_in);
-  if (expiresIn === void 0) {
-    throw new Error("xAI token refresh response missing expires_in");
-  }
-  const newRefresh = typeof data.refresh_token === "string" && data.refresh_token ? data.refresh_token : credential.refreshToken;
-  const now = Date.now();
-  return {
-    ...credential,
-    accessToken: data.access_token,
-    refreshToken: newRefresh,
-    expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS2,
-    obtainedAt: now
-  };
 }
+var anthropicRefresh = refreshAnthropicToken;
 
-// packages/cli/oauth/flows/cursor.ts
+// packages/agent-runtime/cursorOAuth.ts
 var CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
 var CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
 var CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
-var POLL_MAX_ATTEMPTS = 150;
-var POLL_BASE_DELAY_MS = 1e3;
-var POLL_MAX_DELAY_MS = 1e4;
-var POLL_BACKOFF_MULTIPLIER = 1.2;
-var POLL_MAX_CONSECUTIVE_ERRORS = 3;
-var ACCESS_TOKEN_CLIENT_SKEW_MS3 = 5 * 60 * 1e3;
+var CURSOR_POLL_MAX_ATTEMPTS = 150;
+var CURSOR_POLL_BASE_DELAY_MS = 1e3;
+var CURSOR_POLL_MAX_DELAY_MS = 1e4;
+var CURSOR_POLL_BACKOFF_MULTIPLIER = 1.2;
+var CURSOR_POLL_MAX_CONSECUTIVE_ERRORS = 3;
+var CURSOR_ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var CURSOR_TOKEN_REQUEST_TIMEOUT_MS = 3e4;
 function decodeJwtExp(token) {
   try {
     const parts = token.split(".");
-    if (parts.length !== 3) return void 0;
-    const payload = parts[1];
-    if (!payload) return void 0;
-    const decoded = JSON.parse(
-      Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
-    );
-    if (decoded && typeof decoded === "object" && typeof decoded.exp === "number") {
-      return decoded.exp * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
+    if (parts.length < 2) return null;
+    const payloadJson = Buffer.from(parts[1], "base64url").toString("utf-8");
+    const payload = JSON.parse(payloadJson);
+    if (typeof payload.exp === "number" && Number.isFinite(payload.exp)) {
+      return payload.exp * 1e3;
     }
+    return null;
   } catch {
+    return null;
   }
-  return void 0;
-}
-function sleep2(ms, signal) {
-  if (signal) {
-    return new Promise((resolve, reject) => {
-      if (signal.aborted) {
-        reject(new Error("Aborted"));
-        return;
-      }
-      const timer = setTimeout(resolve, ms);
-      signal.addEventListener(
-        "abort",
-        () => {
-          clearTimeout(timer);
-          reject(new Error("Aborted"));
-        },
-        { once: true }
-      );
-    });
-  }
-  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function pollCursorAuth(uuid, verifier, deps = {}) {
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleepFn = deps.sleepFn ?? ((ms) => sleep2(ms));
-  let delay = POLL_BASE_DELAY_MS;
-  let consecutiveErrors = 0;
-  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
-    await sleepFn(delay);
-    let response;
-    try {
-      response = await fetchImpl(
-        `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`
-      );
-    } catch {
-      consecutiveErrors++;
-      if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
-        throw new Error("Too many consecutive network errors during Cursor auth polling");
-      }
-      continue;
-    }
-    if (response.status === 404) {
-      consecutiveErrors = 0;
-      delay = Math.min(delay * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY_MS);
-      continue;
-    }
-    if (response.ok) {
-      const data = await response.json();
-      if (typeof data.accessToken !== "string" || typeof data.refreshToken !== "string") {
-        throw new Error("Cursor poll response missing accessToken or refreshToken");
-      }
-      return { accessToken: data.accessToken, refreshToken: data.refreshToken };
-    }
-    consecutiveErrors++;
-    if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
-      throw new Error(`Cursor auth poll failed: ${response.status}`);
-    }
-  }
-  throw new Error("Cursor authentication polling timed out");
-}
-async function runCursorOAuthLogin(deps = {}) {
-  const output = deps.output ?? console;
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const pkce = generatePkcePair();
-  const uuid = crypto.randomUUID();
-  const params = new URLSearchParams({
-    challenge: pkce.challenge,
-    uuid,
-    mode: "login",
-    redirectTarget: "cli"
-  });
-  const loginUrl = `${CURSOR_LOGIN_URL}?${params.toString()}`;
-  output.log(
-    `
-Open this URL in your browser to authorize Cursor:
-${loginUrl}
-
-Waiting for browser authentication... (polling ${CURSOR_POLL_URL})`
-  );
-  const openBrowser = deps.openBrowser;
-  if (openBrowser) {
-    try {
-      await openBrowser(loginUrl);
-    } catch {
-    }
+function normalizeCursorTokenPayload(args) {
+  const { payload, baseCredential, now } = args;
+  if (typeof payload.accessToken !== "string" || !payload.accessToken.trim()) {
+    throw new Error("Cursor token refresh response missing accessToken");
   }
-  const { accessToken, refreshToken } = await pollCursorAuth(uuid, pkce.verifier, {
-    fetchImpl,
-    ...deps.sleep ? { sleepFn: deps.sleep } : {}
-  });
-  const now = deps.now?.() ?? Date.now();
-  const expiresAt = decodeJwtExp(accessToken) ?? now + 3600 * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
+  const accessToken = payload.accessToken.trim();
+  const expiresAt = decodeJwtExp(accessToken) ?? now + 3600 * 1e3 - CURSOR_ACCESS_TOKEN_CLIENT_SKEW_MS;
+  const newRefresh = typeof payload.refreshToken === "string" && payload.refreshToken.trim() ? payload.refreshToken.trim() : baseCredential?.refreshToken;
   return {
+    ...baseCredential ?? {},
     provider: "cursor",
     accessToken,
-    refreshToken,
+    ...newRefresh ? { refreshToken: newRefresh } : {},
     expiresAt,
     obtainedAt: now
   };
 }
-var cursorRefresh = async (credential, deps = {}) => {
+async function refreshCursorToken(credential, deps = {}) {
   if (!credential.refreshToken) {
     throw new Error("Cursor credential has no refresh_token");
   }
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const response = await fetchImpl(CURSOR_REFRESH_URL, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${credential.refreshToken}`,
-      "Content-Type": "application/json"
-    },
-    body: "{}",
-    signal: AbortSignal.timeout(3e4)
-  });
+  let response;
+  try {
+    response = await fetchImpl(CURSOR_REFRESH_URL, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${credential.refreshToken}`,
+        "Content-Type": "application/json"
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(CURSOR_TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `Cursor token refresh failed: ${toErrorMessage(error)}`
+    );
+  }
   if (!response.ok) {
     let detail = "";
     try {
@@ -1407,22 +1099,20 @@ var cursorRefresh = async (credential, deps = {}) => {
       `Cursor token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`
     );
   }
-  const data = await response.json();
-  if (typeof data.accessToken !== "string" || !data.accessToken) {
-    throw new Error("Cursor token refresh response missing accessToken");
+  let data;
+  try {
+    data = await response.json();
+  } catch {
+    throw new Error("Cursor token refresh response is not valid JSON");
   }
   const now = deps.now?.() ?? Date.now();
-  const expiresAt = decodeJwtExp(data.accessToken) ?? now + 3600 * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
-  const newRefresh = typeof data.refreshToken === "string" && data.refreshToken ? data.refreshToken : credential.refreshToken;
-  return {
-    ...credential,
-    provider: "cursor",
-    accessToken: data.accessToken,
-    refreshToken: newRefresh,
-    expiresAt,
-    obtainedAt: now
-  };
-};
+  return normalizeCursorTokenPayload({
+    payload: data,
+    baseCredential: credential,
+    now
+  });
+}
+var cursorRefresh = refreshCursorToken;
 
 export {
   startCallbackServer,
@@ -1431,10 +1121,40 @@ export {
   refreshAntigravityOAuthToken,
   runOpenAiCodexDeviceCode,
   runOpenAiCodexBrowserPkce,
-  refreshOpenAiCodexToken,
-  runXaiOAuthLogin,
-  runXaiOAuthDeviceCode,
-  refreshXaiOAuthToken,
-  runCursorOAuthLogin,
+  refreshOpenAiCodexToken2 as refreshOpenAiCodexToken,
+  XAI_OAUTH_CLIENT_ID,
+  XAI_OAUTH_SCOPE,
+  XAI_OAUTH_REDIRECT_HOST,
+  XAI_OAUTH_REDIRECT_PORT,
+  XAI_OAUTH_REDIRECT_PATH,
+  XAI_OAUTH_DOCS_URL,
+  XAI_DEVICE_CODE_GRANT_TYPE,
+  XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS,
+  XAI_DEVICE_CODE_MIN_INTERVAL_MS,
+  XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS,
+  XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS,
+  XAI_ACCESS_TOKEN_CLIENT_SKEW_MS,
+  XAI_TOKEN_REQUEST_TIMEOUT_MS,
+  validateXAIEndpoint,
+  readJsonBody,
+  xaiOAuthDiscovery,
+  xaiRefresh,
+  ANTHROPIC_OAUTH_CLIENT_ID,
+  ANTHROPIC_OAUTH_AUTHORIZE_URL,
+  ANTHROPIC_OAUTH_TOKEN_URL,
+  ANTHROPIC_OAUTH_CALLBACK_PORT,
+  ANTHROPIC_OAUTH_REDIRECT_URI,
+  ANTHROPIC_OAUTH_SCOPES,
+  normalizeAnthropicTokenPayload,
+  anthropicRefresh,
+  CURSOR_LOGIN_URL,
+  CURSOR_POLL_URL,
+  CURSOR_POLL_MAX_ATTEMPTS,
+  CURSOR_POLL_BASE_DELAY_MS,
+  CURSOR_POLL_MAX_DELAY_MS,
+  CURSOR_POLL_BACKOFF_MULTIPLIER,
+  CURSOR_POLL_MAX_CONSECUTIVE_ERRORS,
+  CURSOR_ACCESS_TOKEN_CLIENT_SKEW_MS,
+  decodeJwtExp,
   cursorRefresh
 };