wotann 0.5.0

package/dist/auth/oauth-rotator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rotator.js","sourceRoot":"","sources":["../../src/auth/oauth-rotator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA+CH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAErC,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,gBAAgB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,UAAU,SAAS;QACtB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,OAAO,EAAE,2CAA4C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnF,OAAO,CAAC,CAAC,SAAS,GAAG,GAAG,IAAI,QAAQ,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7B,GAAG,CAAC,MAAM,EAAE,6BAA6B,GAAG,CAAC,MAAM,+BAA+B,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CACD,MAAM,EACN,qCAAqC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,MAAO,GAAa,CAAC,OAAO,EAAE,CAC5F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,SAAS,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,KAAK,SAAS,EAAE,CAAC;IACnB,CAAC,EAAE,eAAe,CAAC,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;KAC5B,CAAC;AACJ,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Local OAuth callback server for browser-based authentication.
+ *
+ * PORT STRATEGY (from OpenClaude research):
+ * Uses `server.listen(0)` to let the OS assign any available port.
+ * This is atomic — no TOCTOU race between checking and binding.
+ * Eliminates all port-conflict issues entirely.
+ *
+ * FALLBACK: If the browser can't be opened (headless, SSH, WSL),
+ * falls back to manual auth code paste or device code flow.
+ *
+ * CROSS-PLATFORM: macOS (open), Linux (xdg-open), Windows (start).
+ */
+export interface OAuthConfig {
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly scopes: readonly string[];
+    readonly redirectUri?: string;
+    readonly usePKCE?: boolean;
+    /** Additional query params to include in the auth URL */
+    readonly extraParams?: Record<string, string>;
+}
+export interface OAuthTokens {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly idToken?: string;
+    readonly expiresIn?: number;
+    readonly scope?: string;
+    readonly accountId?: string;
+}
+export interface OAuthResult {
+    readonly success: boolean;
+    readonly tokens?: OAuthTokens;
+    readonly error?: string;
+    readonly method: "browser" | "device-code" | "manual";
+    readonly port?: number;
+}
+/**
+ * Run a full OAuth authorization code flow with PKCE.
+ *
+ * Uses OS-assigned port via listen(0) — eliminates all port conflicts.
+ * (Pattern from OpenClaude: AuthCodeListener uses listen(0, 'localhost'))
+ *
+ * Flow:
+ * 1. Start local callback server on OS-assigned port
+ * 2. Open browser to authorization URL
+ * 3. Wait for callback with auth code
+ * 4. Exchange code for tokens
+ * 5. Return tokens
+ */
+export declare function runOAuthBrowserFlow(config: OAuthConfig, timeoutMs?: number): Promise<OAuthResult>;
+/**
+ * Refresh an OAuth token using a refresh token.
+ * Works for both Codex (auth.openai.com) and Anthropic.
+ */
+export declare function refreshOAuthToken(tokenUrl: string, clientId: string, refreshToken: string): Promise<OAuthTokens | null>;
+export interface DeviceCodeConfig {
+    readonly deviceCodeUrl: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly scopes: readonly string[];
+}
+export interface DeviceCodeResponse {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly expiresIn: number;
+    readonly interval: number;
+}
+/**
+ * Run a device code flow — displays a code for the user to enter in browser.
+ * Used for GitHub Copilot and as fallback when browser can't be opened.
+ */
+export declare function runDeviceCodeFlow(config: DeviceCodeConfig, onUserCode: (response: DeviceCodeResponse) => void, timeoutMs?: number): Promise<OAuthResult>;
+/**
+ * GitHub Copilot device code flow config.
+ * Client ID: Iv1.b507a08c87ecfe98 (GitHub's public Copilot client ID).
+ * Scope: read:user (from OpenClaw research — allows token exchange for Copilot API).
+ */
+export declare function getGitHubDeviceCodeConfig(): DeviceCodeConfig;
+/**
+ * Anthropic OAuth config for direct browser-based login.
+ * Client ID from OpenClaude source (constants/oauth.ts): the production Claude Code client.
+ * Scopes from the same source.
+ */
+export declare function getAnthropicOAuthConfig(): OAuthConfig;
+//# sourceMappingURL=oauth-server.d.ts.map

package/dist/auth/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAkCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,SAAS,GAAE,MAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC,CA+ItB;AA6ED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA4B7B;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,EAClD,SAAS,GAAE,MAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC,CA8EtB;AAWD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,gBAAgB,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,WAAW,CAQrD"}

package/dist/auth/oauth-server.js

@@ -0,0 +1,382 @@
+/**
+ * Local OAuth callback server for browser-based authentication.
+ *
+ * PORT STRATEGY (from OpenClaude research):
+ * Uses `server.listen(0)` to let the OS assign any available port.
+ * This is atomic — no TOCTOU race between checking and binding.
+ * Eliminates all port-conflict issues entirely.
+ *
+ * FALLBACK: If the browser can't be opened (headless, SSH, WSL),
+ * falls back to manual auth code paste or device code flow.
+ *
+ * CROSS-PLATFORM: macOS (open), Linux (xdg-open), Windows (start).
+ */
+import { createServer } from "node:http";
+import { execFileSync } from "node:child_process";
+import { randomBytes, createHash } from "node:crypto";
+import { platform } from "node:os";
+// ── PKCE Helpers ───────────────────────────────────────────
+function generateCodeVerifier() {
+    return randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+// ── Browser Opening ────────────────────────────────────────
+function openBrowser(url) {
+    try {
+        const os = platform();
+        if (os === "darwin") {
+            execFileSync("open", [url], { stdio: "pipe" });
+        }
+        else if (os === "linux") {
+            execFileSync("xdg-open", [url], { stdio: "pipe" });
+        }
+        else if (os === "win32") {
+            execFileSync("cmd", ["/c", "start", "", url], { stdio: "pipe" });
+        }
+        else {
+            return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── OAuth Browser Flow ─────────────────────────────────────
+/**
+ * Run a full OAuth authorization code flow with PKCE.
+ *
+ * Uses OS-assigned port via listen(0) — eliminates all port conflicts.
+ * (Pattern from OpenClaude: AuthCodeListener uses listen(0, 'localhost'))
+ *
+ * Flow:
+ * 1. Start local callback server on OS-assigned port
+ * 2. Open browser to authorization URL
+ * 3. Wait for callback with auth code
+ * 4. Exchange code for tokens
+ * 5. Return tokens
+ */
+export async function runOAuthBrowserFlow(config, timeoutMs = 120_000) {
+    const state = randomBytes(16).toString("hex");
+    const codeVerifier = config.usePKCE !== false ? generateCodeVerifier() : undefined;
+    const codeChallenge = codeVerifier ? generateCodeChallenge(codeVerifier) : undefined;
+    return new Promise((resolve) => {
+        let server = null;
+        let timeoutHandle;
+        let assignedPort = 0;
+        // Timeout handler
+        timeoutHandle = setTimeout(() => {
+            cleanup();
+            resolve({
+                success: false,
+                error: "OAuth flow timed out. Please try again or use manual auth.",
+                method: "browser",
+            });
+        }, timeoutMs);
+        // Success page HTML
+        const successHtml = `<!DOCTYPE html><html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;background:#0f0f1a;color:#e0e0e0;margin:0">
+<div style="text-align:center;max-width:500px">
+<div style="font-size:48px;margin-bottom:16px">&#10003;</div>
+<h1 style="color:#00d4aa;margin:0 0 8px">WOTANN</h1>
+<h2 style="font-weight:normal;color:#a0a0b0;margin:0 0 24px">Authentication Successful</h2>
+<p style="color:#808090">You can close this tab and return to the terminal.</p>
+</div></body></html>`;
+        const errorHtml = (msg) => `<!DOCTYPE html><html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;background:#0f0f1a;color:#e0e0e0;margin:0">
+<div style="text-align:center"><h1 style="color:#ff4444">Authentication Failed</h1><p>${msg}</p></div></body></html>`;
+        function cleanup() {
+            clearTimeout(timeoutHandle);
+            if (server) {
+                server.close();
+                server = null;
+            }
+        }
+        // Start callback server
+        server = createServer(async (req, res) => {
+            const url = new URL(req.url ?? "/", `http://127.0.0.1:${assignedPort}`);
+            if (url.pathname !== "/callback") {
+                res.writeHead(404);
+                res.end("Not found");
+                return;
+            }
+            const code = url.searchParams.get("code");
+            const returnedState = url.searchParams.get("state");
+            const error = url.searchParams.get("error");
+            if (error) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(errorHtml(error));
+                cleanup();
+                resolve({ success: false, error: `OAuth error: ${error}`, method: "browser" });
+                return;
+            }
+            if (!code || returnedState !== state) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(errorHtml("Invalid callback — state mismatch or missing code"));
+                cleanup();
+                resolve({ success: false, error: "State mismatch or missing code", method: "browser" });
+                return;
+            }
+            // Exchange code for tokens
+            const redirectUri = `http://127.0.0.1:${assignedPort}/callback`;
+            try {
+                const tokens = await exchangeCodeForTokens(config.tokenUrl, {
+                    code,
+                    clientId: config.clientId,
+                    redirectUri,
+                    codeVerifier,
+                });
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(successHtml);
+                cleanup();
+                resolve({ success: true, tokens, method: "browser", port: assignedPort });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : "Token exchange failed";
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(errorHtml(msg));
+                cleanup();
+                resolve({ success: false, error: msg, method: "browser" });
+            }
+        });
+        // Use listen(0) for OS-assigned port — no port conflicts possible.
+        // (Pattern from OpenClaude: AuthCodeListener.start() uses listen(port ?? 0))
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server?.address();
+            if (!addr || typeof addr === "string") {
+                cleanup();
+                resolve({ success: false, error: "Failed to get server address", method: "browser" });
+                return;
+            }
+            assignedPort = addr.port;
+            // Build redirect URI with the actual assigned port
+            const redirectUri = config.redirectUri ?? `http://127.0.0.1:${assignedPort}/callback`;
+            // Build authorization URL
+            const authParams = new URLSearchParams({
+                response_type: "code",
+                client_id: config.clientId,
+                redirect_uri: redirectUri,
+                state,
+                scope: config.scopes.join(" "),
+            });
+            if (codeChallenge) {
+                authParams.set("code_challenge", codeChallenge);
+                authParams.set("code_challenge_method", "S256");
+            }
+            // Include any extra params (e.g., codex_cli_simplified_flow, originator)
+            if (config.extraParams) {
+                for (const [key, value] of Object.entries(config.extraParams)) {
+                    authParams.set(key, value);
+                }
+            }
+            const authUrl = `${config.authorizationUrl}?${authParams.toString()}`;
+            const opened = openBrowser(authUrl);
+            if (!opened) {
+                // Can't open browser — show URL for manual paste
+                console.log(`\n  Visit this URL to authenticate:\n  ${authUrl}\n`);
+                // Keep server running — user might paste the URL in a browser
+            }
+        });
+        server.on("error", (err) => {
+            cleanup();
+            resolve({ success: false, error: `Server error: ${err.message}`, method: "browser" });
+        });
+    });
+}
+// ── Token Exchange ─────────────────────────────────────────
+async function exchangeCodeForTokens(tokenUrl, params) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: params.code,
+        client_id: params.clientId,
+        redirect_uri: params.redirectUri,
+    });
+    if (params.codeVerifier) {
+        body.set("code_verifier", params.codeVerifier);
+    }
+    const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Token exchange failed (${response.status}): ${text.slice(0, 200)}`);
+    }
+    const data = (await response.json());
+    // Extract account ID from JWT if present (Codex pattern)
+    let accountId;
+    const idToken = data["id_token"] ? String(data["id_token"]) : undefined;
+    if (idToken) {
+        accountId = extractAccountIdFromJWT(idToken);
+    }
+    return {
+        accessToken: String(data["access_token"] ?? ""),
+        refreshToken: data["refresh_token"] ? String(data["refresh_token"]) : undefined,
+        idToken,
+        expiresIn: typeof data["expires_in"] === "number" ? data["expires_in"] : undefined,
+        scope: data["scope"] ? String(data["scope"]) : undefined,
+        accountId,
+    };
+}
+/**
+ * Extract chatgpt_account_id from a JWT's payload.
+ * Looks in multiple claim locations (from OpenClaude's providerConfig.ts).
+ */
+function extractAccountIdFromJWT(jwt) {
+    try {
+        const parts = jwt.split(".");
+        if (parts.length < 2)
+            return undefined;
+        const payload = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf-8"));
+        return (payload["https://api.openai.com/auth.chatgpt_account_id"] ??
+            payload["chatgpt_account_id"] ??
+            payload["chatgpt_account_user_id"] ??
+            payload["chatgpt_user_id"]);
+    }
+    catch {
+        return undefined;
+    }
+}
+// ── Token Refresh ─────────────────────────────────────────
+/**
+ * Refresh an OAuth token using a refresh token.
+ * Works for both Codex (auth.openai.com) and Anthropic.
+ */
+export async function refreshOAuthToken(tokenUrl, clientId, refreshToken) {
+    try {
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            client_id: clientId,
+            refresh_token: refreshToken,
+        });
+        const response = await fetch(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        if (!data["access_token"])
+            return null;
+        return {
+            accessToken: String(data["access_token"]),
+            refreshToken: data["refresh_token"] ? String(data["refresh_token"]) : refreshToken,
+            idToken: data["id_token"] ? String(data["id_token"]) : undefined,
+            expiresIn: typeof data["expires_in"] === "number" ? data["expires_in"] : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Run a device code flow — displays a code for the user to enter in browser.
+ * Used for GitHub Copilot and as fallback when browser can't be opened.
+ */
+export async function runDeviceCodeFlow(config, onUserCode, timeoutMs = 300_000) {
+    const codeResponse = await fetch(config.deviceCodeUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        },
+        body: JSON.stringify({
+            client_id: config.clientId,
+            scope: config.scopes.join(" "),
+        }),
+    });
+    if (!codeResponse.ok) {
+        return {
+            success: false,
+            error: `Device code request failed: ${codeResponse.status}`,
+            method: "device-code",
+        };
+    }
+    const codeData = (await codeResponse.json());
+    const deviceResponse = {
+        deviceCode: String(codeData["device_code"] ?? ""),
+        userCode: String(codeData["user_code"] ?? ""),
+        verificationUri: String(codeData["verification_uri"] ?? codeData["verification_url"] ?? ""),
+        expiresIn: Number(codeData["expires_in"] ?? 600),
+        interval: Number(codeData["interval"] ?? 5),
+    };
+    onUserCode(deviceResponse);
+    openBrowser(deviceResponse.verificationUri);
+    const startTime = Date.now();
+    const pollInterval = Math.max(deviceResponse.interval, 5) * 1000;
+    while (Date.now() - startTime < timeoutMs) {
+        await new Promise((r) => setTimeout(r, pollInterval));
+        const tokenResponse = await fetch(config.tokenUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify({
+                client_id: config.clientId,
+                device_code: deviceResponse.deviceCode,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const tokenData = (await tokenResponse.json());
+        const error = tokenData["error"];
+        if (error === "authorization_pending")
+            continue;
+        if (error === "slow_down") {
+            await new Promise((r) => setTimeout(r, 5000));
+            continue;
+        }
+        if (error) {
+            return { success: false, error: `Device flow error: ${error}`, method: "device-code" };
+        }
+        return {
+            success: true,
+            method: "device-code",
+            tokens: {
+                accessToken: String(tokenData["access_token"] ?? ""),
+                refreshToken: tokenData["refresh_token"] ? String(tokenData["refresh_token"]) : undefined,
+                expiresIn: typeof tokenData["expires_in"] === "number" ? tokenData["expires_in"] : undefined,
+                scope: tokenData["scope"] ? String(tokenData["scope"]) : undefined,
+            },
+        };
+    }
+    return { success: false, error: "Device code flow timed out", method: "device-code" };
+}
+// ── Provider-Specific Login Configs ────────────────────────
+//
+// Codex/ChatGPT OAuth config removed per V9 T0.2 — running our own PKCE
+// flow with the official Codex CLI's public client_id against OpenAI's
+// OAuth endpoint masquerades as that CLI. Codex auth is now
+// read-existing-`~/.codex/auth.json`-only (see
+// src/providers/codex-detector.ts). Users authenticate by running
+// `codex login` themselves.
+/**
+ * GitHub Copilot device code flow config.
+ * Client ID: Iv1.b507a08c87ecfe98 (GitHub's public Copilot client ID).
+ * Scope: read:user (from OpenClaw research — allows token exchange for Copilot API).
+ */
+export function getGitHubDeviceCodeConfig() {
+    return {
+        deviceCodeUrl: "https://github.com/login/device/code",
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        clientId: "Iv1.b507a08c87ecfe98",
+        scopes: ["read:user"],
+    };
+}
+/**
+ * Anthropic OAuth config for direct browser-based login.
+ * Client ID from OpenClaude source (constants/oauth.ts): the production Claude Code client.
+ * Scopes from the same source.
+ */
+export function getAnthropicOAuthConfig() {
+    return {
+        authorizationUrl: "https://claude.ai/oauth/authorize",
+        tokenUrl: "https://console.anthropic.com/oauth/token",
+        clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+        scopes: ["org:create_api_key", "user:profile", "user:inference", "user:sessions:claude_code"],
+        usePKCE: true,
+    };
+}
+//# sourceMappingURL=oauth-server.js.map

package/dist/auth/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAgCnC,8DAA8D;AAE9D,SAAS,oBAAoB;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,8DAA8D;AAE9D,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,YAAY,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8DAA8D;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB,EACnB,YAAoB,OAAO;IAE3B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErF,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;QAC1C,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,aAA4C,CAAC;QACjD,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,kBAAkB;QAClB,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4DAA4D;gBACnE,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,oBAAoB;QACpB,MAAM,WAAW,GAAG;;;;;;qBAMH,CAAC;QAElB,MAAM,SAAS,GAAG,CAChB,GAAW,EACX,EAAE,CAAC;wFAC+E,GAAG,0BAA0B,CAAC;QAElH,SAAS,OAAO;YACd,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;YAExE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBACxE,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,2BAA2B;YAC3B,MAAM,WAAW,GAAG,oBAAoB,YAAY,WAAW,CAAC;YAChE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1D,IAAI;oBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,6EAA6E;QAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;YAEzB,mDAAmD;YACnD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,YAAY,WAAW,CAAC;YAEtF,0BAA0B;YAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;gBACrC,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,WAAW;gBACzB,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YACH,IAAI,aAAa,EAAE,CAAC;gBAClB,UAAU,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;gBAChD,UAAU,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,yEAAyE;YACzE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC9D,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;YAEtE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iDAAiD;gBACjD,OAAO,CAAC,GAAG,CAAC,0CAA0C,OAAO,IAAI,CAAC,CAAC;gBACnE,8DAA8D;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAE9D,KAAK,UAAU,qBAAqB,CAClC,QAAgB,EAChB,MAKC;IAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAEhE,yDAAyD;IACzD,IAAI,SAA6B,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/E,OAAO;QACP,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QAClF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAChC,CAAC;QAE7B,OAAO,CAAC,OAAO,CAAC,gDAAgD,CAAC;YAC/D,OAAO,CAAC,oBAAoB,CAAC;YAC7B,OAAO,CAAC,yBAAyB,CAAC;YAClC,OAAO,CAAC,iBAAiB,CAAC,CAAuB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6DAA6D;AAE7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,QAAgB,EAChB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACzC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;YAClF,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;SACnF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAmBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAwB,EACxB,UAAkD,EAClD,YAAoB,OAAO;IAE3B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B,YAAY,CAAC,MAAM,EAAE;YAC3D,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;IACxE,MAAM,cAAc,GAAuB;QACzC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC3F,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAC5C,CAAC;IAEF,UAAU,CAAC,cAAc,CAAC,CAAC;IAC3B,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QAEtD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,WAAW,EAAE,cAAc,CAAC,UAAU;gBACtC,UAAU,EAAE,8CAA8C;aAC3D,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAuB,CAAC;QAEvD,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACzF,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACpD,YAAY,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzF,SAAS,EACP,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACxF,CAAC;AAED,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,4DAA4D;AAC5D,+CAA+C;AAC/C,kEAAkE;AAClE,4BAA4B;AAE5B;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,aAAa,EAAE,sCAAsC;QACrD,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,CAAC,WAAW,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,gBAAgB,EAAE,mCAAmC;QACrD,QAAQ,EAAE,2CAA2C;QACrD,QAAQ,EAAE,sCAAsC;QAChD,MAAM,EAAE,CAAC,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA2B,CAAC;QAC7F,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC"}

package/dist/auth/secure-store.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Wave 6-QQ — Linux/macOS/Windows secure-store with file fallback.
+ *
+ * H-K1 fix: prefers `@napi-rs/keyring` (current, MIT, last published 2026)
+ * over `keytar` (archived 2022-12-15) for fresh installs. Both are kept as
+ * optionalDependencies so existing installs continue to work and the
+ * Linux-without-libsecret path still degrades gracefully.
+ *
+ * Resolution order on each call:
+ *   1. @napi-rs/keyring (current, native, sync API wrapped in Promise)
+ *   2. keytar (legacy fallback for environments where @napi-rs/keyring's
+ *      prebuilt binary doesn't ship; Node 16-18 on some musl/Alpine images)
+ *   3. file fallback at `~/.wotann/credentials.json` with mode 0600
+ *
+ * Design notes:
+ *   - Dynamic `import()` so the optionalDeps stay truly optional.
+ *   - Per-process state — no module-global cache (QB#7).
+ *   - File fallback uses the SAME `~/.wotann/credentials.json` path so the
+ *     existing `CredentialStore` data survives the migration.
+ *   - Honest fallback chain (QB#6): keyring → keytar → file → failure result.
+ *   - QB#15: APIs source-verified:
+ *       @napi-rs/keyring  https://github.com/Brooooooklyn/keyring-node
+ *         new Entry(service, account)
+ *         entry.setPassword(p) / entry.getPassword() / entry.deletePassword()
+ *       keytar           https://github.com/atom/node-keytar
+ *         getPassword/setPassword/deletePassword(service, account, ...)
+ */
+/** Tag describing where a credential physically lives. */
+export type SecureStoreSource = "keychain" | "file";
+export interface SecureStoreSetResult {
+    /** Where the credential ended up. */
+    readonly stored: SecureStoreSource;
+    /** Populated when keytar was tried and failed (informational only). */
+    readonly error?: string;
+}
+export interface SecureStoreGetResult {
+    /** The decrypted password, or null when not found in either backend. */
+    readonly password: string | null;
+    /** Backend that produced the value (or "file" when both backends miss). */
+    readonly source: SecureStoreSource;
+}
+/**
+ * Persist a credential. Tries keytar first; on any failure falls back to
+ * the file store. Returns which backend was used and (for diagnostics)
+ * the keytar error message when the fallback fired.
+ */
+export declare function secureStoreSet(account: string, password: string): Promise<SecureStoreSetResult>;
+/**
+ * Read a credential. Tries keytar first; on miss or failure consults the
+ * file store. Returns `{ password: null, source: "file" }` when neither
+ * backend has it (file is the fallback default — caller decides what to do).
+ */
+export declare function secureStoreGet(account: string): Promise<SecureStoreGetResult>;
+/**
+ * Remove a credential from BOTH backends (keychain + file). Returns true
+ * if at least one backend reported a deletion. Best-effort — never throws.
+ */
+export declare function secureStoreDelete(account: string): Promise<boolean>;
+/**
+ * Test-only escape hatch: synchronously detect whether keytar would load
+ * in this process. Useful for diagnostics ("Why did Wave 6-QQ fall back to
+ * file?"). Async because the underlying loader is async.
+ */
+export declare function secureStoreBackendAvailable(): Promise<SecureStoreSource>;
+//# sourceMappingURL=secure-store.d.ts.map

package/dist/auth/secure-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../../src/auth/secure-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAUH,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,CAAC;AAmIpD,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAiB/B;AASD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuBnF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BzE;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAG9E"}