@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/services/pluginLifecycle/index.cjs

@@ -0,0 +1,71 @@
+//#region src/services/pluginLifecycle/index.ts
+/** Owns one mounted plugin, independently of the host supplying its context. */
+function createPluginLifecycle(makeContext) {
+	const controller = new AbortController();
+	const context = makeContext(controller.signal);
+	const cleanups = [];
+	let hooks;
+	let startup;
+	let disposal;
+	let started = false;
+	let draining = false;
+	const dispose = () => {
+		if (disposal) return disposal;
+		disposal = Promise.resolve().then(async () => {
+			await startup?.catch(() => void 0);
+			draining = true;
+			const errors = [];
+			const attempt = async (cleanup) => {
+				try {
+					await cleanup();
+				} catch (error) {
+					errors.push(error);
+				}
+			};
+			const onStop = hooks?.onStop;
+			if (started && onStop) await attempt(() => onStop(context));
+			for (const cleanup of cleanups.reverse()) await attempt(cleanup);
+			cleanups.length = 0;
+			const onDispose = hooks?.onDispose;
+			if (onDispose) await attempt(() => onDispose(context));
+			if (errors.length) throw new AggregateError(errors, "Plugin cleanup failed.");
+		});
+		controller.abort();
+		return disposal;
+	};
+	return {
+		context,
+		own(cleanup) {
+			if (draining) throw new Error("Cannot own a registration after plugin cleanup begins.");
+			cleanups.push(cleanup);
+		},
+		mount(definition, register) {
+			if (startup || disposal) return Promise.reject(/* @__PURE__ */ new Error("A plugin lifecycle can only mount once."));
+			startup = Promise.resolve().then(async () => {
+				controller.signal.throwIfAborted();
+				const resolved = typeof definition === "function" ? await definition() : definition;
+				hooks = resolved;
+				controller.signal.throwIfAborted();
+				await register(resolved);
+				controller.signal.throwIfAborted();
+				started = true;
+				if (resolved.onStart) await resolved.onStart(context);
+				controller.signal.throwIfAborted();
+			});
+			return startup.catch(async (error) => {
+				try {
+					await dispose();
+				} catch (cleanupError) {
+					const errors = cleanupError instanceof AggregateError ? cleanupError.errors : [cleanupError];
+					throw new AggregateError([error, ...errors], error instanceof Error ? error.message : String(error), { cause: error });
+				}
+				throw error;
+			});
+		},
+		dispose
+	};
+}
+//#endregion
+exports.createPluginLifecycle = createPluginLifecycle;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/pluginLifecycle/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/pluginLifecycle/index.ts"],"sourcesContent":["export interface PluginLifecycleContext {\n  readonly signal: AbortSignal;\n}\n\nexport interface PluginLifecycleHooks<TContext> {\n  onStart?(this: void, context: TContext): void | Promise<void>;\n  onStop?(this: void, context: TContext): void | Promise<void>;\n  onDispose?(this: void, context: TContext): void | Promise<void>;\n}\n\nexport interface PluginLifecycle<TContext> {\n  readonly context: TContext;\n  own(cleanup: () => void | Promise<void>): void;\n  mount<TDefinition extends PluginLifecycleHooks<TContext>>(\n    definition: TDefinition | (() => TDefinition | Promise<TDefinition>),\n    register: (definition: TDefinition) => void | Promise<void>,\n  ): Promise<void>;\n  dispose(): Promise<void>;\n}\n\n/** Owns one mounted plugin, independently of the host supplying its context. */\nexport function createPluginLifecycle<TContext>(\n  makeContext: (signal: AbortSignal) => TContext,\n): PluginLifecycle<TContext> {\n  const controller = new AbortController();\n  const context = makeContext(controller.signal);\n  const cleanups: (() => void | Promise<void>)[] = [];\n  let hooks: PluginLifecycleHooks<TContext> | undefined;\n  let startup: Promise<void> | undefined;\n  let disposal: Promise<void> | undefined;\n  let started = false;\n  let draining = false;\n\n  const dispose = (): Promise<void> => {\n    if (disposal) return disposal;\n    disposal = Promise.resolve().then(async () => {\n      // Wait only for startup, never mount's rollback promise.\n      await startup?.catch(() => undefined);\n      draining = true;\n      const errors: unknown[] = [];\n      const attempt = async (cleanup: () => void | Promise<void>): Promise<void> => {\n        try {\n          await cleanup();\n        } catch (error) {\n          errors.push(error);\n        }\n      };\n      const onStop = hooks?.onStop;\n      if (started && onStop) await attempt(() => onStop(context));\n      for (const cleanup of cleanups.reverse()) await attempt(cleanup);\n      cleanups.length = 0;\n      const onDispose = hooks?.onDispose;\n      if (onDispose) await attempt(() => onDispose(context));\n      if (errors.length) throw new AggregateError(errors, 'Plugin cleanup failed.');\n    });\n    controller.abort();\n    return disposal;\n  };\n\n  return {\n    context,\n    own(cleanup) {\n      if (draining) throw new Error('Cannot own a registration after plugin cleanup begins.');\n      cleanups.push(cleanup);\n    },\n    mount(definition, register) {\n      if (startup || disposal) return Promise.reject(new Error('A plugin lifecycle can only mount once.'));\n      startup = Promise.resolve().then(async () => {\n        controller.signal.throwIfAborted();\n        const resolved = typeof definition === 'function' ? await definition() : definition;\n        hooks = resolved;\n        controller.signal.throwIfAborted();\n        await register(resolved);\n        controller.signal.throwIfAborted();\n        started = true;\n        if (resolved.onStart) {\n          await resolved.onStart(context);\n        }\n        controller.signal.throwIfAborted();\n      });\n      return startup.catch(async (error: unknown) => {\n        try {\n          await dispose();\n        } catch (cleanupError) {\n          const errors = cleanupError instanceof AggregateError ? cleanupError.errors : [cleanupError];\n          throw new AggregateError([error, ...errors], error instanceof Error ? error.message : String(error), {\n            cause: error,\n          });\n        }\n        throw error;\n      });\n    },\n    dispose,\n  };\n}\n"],"mappings":";;AAqBA,SAAgB,sBACd,aAC2B;CAC3B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,YAAY,WAAW,MAAM;CAC7C,MAAM,WAA2C,CAAC;CAClD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,UAAU;CACd,IAAI,WAAW;CAEf,MAAM,gBAA+B;EACnC,IAAI,UAAU,OAAO;EACrB,WAAW,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GAE5C,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;GACX,MAAM,SAAoB,CAAC;GAC3B,MAAM,UAAU,OAAO,YAAuD;IAC5E,IAAI;KACF,MAAM,QAAQ;IAChB,SAAS,OAAO;KACd,OAAO,KAAK,KAAK;IACnB;GACF;GACA,MAAM,SAAS,OAAO;GACtB,IAAI,WAAW,QAAQ,MAAM,cAAc,OAAO,OAAO,CAAC;GAC1D,KAAK,MAAM,WAAW,SAAS,QAAQ,GAAG,MAAM,QAAQ,OAAO;GAC/D,SAAS,SAAS;GAClB,MAAM,YAAY,OAAO;GACzB,IAAI,WAAW,MAAM,cAAc,UAAU,OAAO,CAAC;GACrD,IAAI,OAAO,QAAQ,MAAM,IAAI,eAAe,QAAQ,wBAAwB;EAC9E,CAAC;EACD,WAAW,MAAM;EACjB,OAAO;CACT;CAEA,OAAO;EACL;EACA,IAAI,SAAS;GACX,IAAI,UAAU,MAAM,IAAI,MAAM,wDAAwD;GACtF,SAAS,KAAK,OAAO;EACvB;EACA,MAAM,YAAY,UAAU;GAC1B,IAAI,WAAW,UAAU,OAAO,QAAQ,uBAAO,IAAI,MAAM,yCAAyC,CAAC;GACnG,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;IAC3C,WAAW,OAAO,eAAe;IACjC,MAAM,WAAW,OAAO,eAAe,aAAa,MAAM,WAAW,IAAI;IACzE,QAAQ;IACR,WAAW,OAAO,eAAe;IACjC,MAAM,SAAS,QAAQ;IACvB,WAAW,OAAO,eAAe;IACjC,UAAU;IACV,IAAI,SAAS,SACX,MAAM,SAAS,QAAQ,OAAO;IAEhC,WAAW,OAAO,eAAe;GACnC,CAAC;GACD,OAAO,QAAQ,MAAM,OAAO,UAAmB;IAC7C,IAAI;KACF,MAAM,QAAQ;IAChB,SAAS,cAAc;KACrB,MAAM,SAAS,wBAAwB,iBAAiB,aAAa,SAAS,CAAC,YAAY;KAC3F,MAAM,IAAI,eAAe,CAAC,OAAO,GAAG,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,EACnG,OAAO,MACT,CAAC;IACH;IACA,MAAM;GACR,CAAC;EACH;EACA;CACF;AACF"}

package/dist/src/services/pluginLifecycle/index.d.mts

@@ -0,0 +1,11 @@
+//#region src/services/pluginLifecycle/index.d.ts
+export interface PluginLifecycleContext {
+  readonly signal: AbortSignal;
+}
+export interface PluginLifecycleHooks<TContext> {
+  onStart?(this: void, context: TContext): void | Promise<void>;
+  onStop?(this: void, context: TContext): void | Promise<void>;
+  onDispose?(this: void, context: TContext): void | Promise<void>;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/pluginLifecycle/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/pluginLifecycle/index.ts"],"mappings":";iBAAiB;WACN,QAAQ;;iBAGF,qBAAqB;EACpC,SAAS,YAAY,SAAS,kBAAkB;EAChD,QAAQ,YAAY,SAAS,kBAAkB;EAC/C,WAAW,YAAY,SAAS,kBAAkB"}

package/dist/src/services/pluginLifecycle/index.mjs

@@ -0,0 +1,71 @@
+//#region src/services/pluginLifecycle/index.ts
+/** Owns one mounted plugin, independently of the host supplying its context. */
+function createPluginLifecycle(makeContext) {
+	const controller = new AbortController();
+	const context = makeContext(controller.signal);
+	const cleanups = [];
+	let hooks;
+	let startup;
+	let disposal;
+	let started = false;
+	let draining = false;
+	const dispose = () => {
+		if (disposal) return disposal;
+		disposal = Promise.resolve().then(async () => {
+			await startup?.catch(() => void 0);
+			draining = true;
+			const errors = [];
+			const attempt = async (cleanup) => {
+				try {
+					await cleanup();
+				} catch (error) {
+					errors.push(error);
+				}
+			};
+			const onStop = hooks?.onStop;
+			if (started && onStop) await attempt(() => onStop(context));
+			for (const cleanup of cleanups.reverse()) await attempt(cleanup);
+			cleanups.length = 0;
+			const onDispose = hooks?.onDispose;
+			if (onDispose) await attempt(() => onDispose(context));
+			if (errors.length) throw new AggregateError(errors, "Plugin cleanup failed.");
+		});
+		controller.abort();
+		return disposal;
+	};
+	return {
+		context,
+		own(cleanup) {
+			if (draining) throw new Error("Cannot own a registration after plugin cleanup begins.");
+			cleanups.push(cleanup);
+		},
+		mount(definition, register) {
+			if (startup || disposal) return Promise.reject(/* @__PURE__ */ new Error("A plugin lifecycle can only mount once."));
+			startup = Promise.resolve().then(async () => {
+				controller.signal.throwIfAborted();
+				const resolved = typeof definition === "function" ? await definition() : definition;
+				hooks = resolved;
+				controller.signal.throwIfAborted();
+				await register(resolved);
+				controller.signal.throwIfAborted();
+				started = true;
+				if (resolved.onStart) await resolved.onStart(context);
+				controller.signal.throwIfAborted();
+			});
+			return startup.catch(async (error) => {
+				try {
+					await dispose();
+				} catch (cleanupError) {
+					const errors = cleanupError instanceof AggregateError ? cleanupError.errors : [cleanupError];
+					throw new AggregateError([error, ...errors], error instanceof Error ? error.message : String(error), { cause: error });
+				}
+				throw error;
+			});
+		},
+		dispose
+	};
+}
+//#endregion
+export { createPluginLifecycle };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/pluginLifecycle/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/pluginLifecycle/index.ts"],"sourcesContent":["export interface PluginLifecycleContext {\n  readonly signal: AbortSignal;\n}\n\nexport interface PluginLifecycleHooks<TContext> {\n  onStart?(this: void, context: TContext): void | Promise<void>;\n  onStop?(this: void, context: TContext): void | Promise<void>;\n  onDispose?(this: void, context: TContext): void | Promise<void>;\n}\n\nexport interface PluginLifecycle<TContext> {\n  readonly context: TContext;\n  own(cleanup: () => void | Promise<void>): void;\n  mount<TDefinition extends PluginLifecycleHooks<TContext>>(\n    definition: TDefinition | (() => TDefinition | Promise<TDefinition>),\n    register: (definition: TDefinition) => void | Promise<void>,\n  ): Promise<void>;\n  dispose(): Promise<void>;\n}\n\n/** Owns one mounted plugin, independently of the host supplying its context. */\nexport function createPluginLifecycle<TContext>(\n  makeContext: (signal: AbortSignal) => TContext,\n): PluginLifecycle<TContext> {\n  const controller = new AbortController();\n  const context = makeContext(controller.signal);\n  const cleanups: (() => void | Promise<void>)[] = [];\n  let hooks: PluginLifecycleHooks<TContext> | undefined;\n  let startup: Promise<void> | undefined;\n  let disposal: Promise<void> | undefined;\n  let started = false;\n  let draining = false;\n\n  const dispose = (): Promise<void> => {\n    if (disposal) return disposal;\n    disposal = Promise.resolve().then(async () => {\n      // Wait only for startup, never mount's rollback promise.\n      await startup?.catch(() => undefined);\n      draining = true;\n      const errors: unknown[] = [];\n      const attempt = async (cleanup: () => void | Promise<void>): Promise<void> => {\n        try {\n          await cleanup();\n        } catch (error) {\n          errors.push(error);\n        }\n      };\n      const onStop = hooks?.onStop;\n      if (started && onStop) await attempt(() => onStop(context));\n      for (const cleanup of cleanups.reverse()) await attempt(cleanup);\n      cleanups.length = 0;\n      const onDispose = hooks?.onDispose;\n      if (onDispose) await attempt(() => onDispose(context));\n      if (errors.length) throw new AggregateError(errors, 'Plugin cleanup failed.');\n    });\n    controller.abort();\n    return disposal;\n  };\n\n  return {\n    context,\n    own(cleanup) {\n      if (draining) throw new Error('Cannot own a registration after plugin cleanup begins.');\n      cleanups.push(cleanup);\n    },\n    mount(definition, register) {\n      if (startup || disposal) return Promise.reject(new Error('A plugin lifecycle can only mount once.'));\n      startup = Promise.resolve().then(async () => {\n        controller.signal.throwIfAborted();\n        const resolved = typeof definition === 'function' ? await definition() : definition;\n        hooks = resolved;\n        controller.signal.throwIfAborted();\n        await register(resolved);\n        controller.signal.throwIfAborted();\n        started = true;\n        if (resolved.onStart) {\n          await resolved.onStart(context);\n        }\n        controller.signal.throwIfAborted();\n      });\n      return startup.catch(async (error: unknown) => {\n        try {\n          await dispose();\n        } catch (cleanupError) {\n          const errors = cleanupError instanceof AggregateError ? cleanupError.errors : [cleanupError];\n          throw new AggregateError([error, ...errors], error instanceof Error ? error.message : String(error), {\n            cause: error,\n          });\n        }\n        throw error;\n      });\n    },\n    dispose,\n  };\n}\n"],"mappings":";;AAqBA,SAAgB,sBACd,aAC2B;CAC3B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,YAAY,WAAW,MAAM;CAC7C,MAAM,WAA2C,CAAC;CAClD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,UAAU;CACd,IAAI,WAAW;CAEf,MAAM,gBAA+B;EACnC,IAAI,UAAU,OAAO;EACrB,WAAW,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GAE5C,MAAM,SAAS,YAAY,KAAA,CAAS;GACpC,WAAW;GACX,MAAM,SAAoB,CAAC;GAC3B,MAAM,UAAU,OAAO,YAAuD;IAC5E,IAAI;KACF,MAAM,QAAQ;IAChB,SAAS,OAAO;KACd,OAAO,KAAK,KAAK;IACnB;GACF;GACA,MAAM,SAAS,OAAO;GACtB,IAAI,WAAW,QAAQ,MAAM,cAAc,OAAO,OAAO,CAAC;GAC1D,KAAK,MAAM,WAAW,SAAS,QAAQ,GAAG,MAAM,QAAQ,OAAO;GAC/D,SAAS,SAAS;GAClB,MAAM,YAAY,OAAO;GACzB,IAAI,WAAW,MAAM,cAAc,UAAU,OAAO,CAAC;GACrD,IAAI,OAAO,QAAQ,MAAM,IAAI,eAAe,QAAQ,wBAAwB;EAC9E,CAAC;EACD,WAAW,MAAM;EACjB,OAAO;CACT;CAEA,OAAO;EACL;EACA,IAAI,SAAS;GACX,IAAI,UAAU,MAAM,IAAI,MAAM,wDAAwD;GACtF,SAAS,KAAK,OAAO;EACvB;EACA,MAAM,YAAY,UAAU;GAC1B,IAAI,WAAW,UAAU,OAAO,QAAQ,uBAAO,IAAI,MAAM,yCAAyC,CAAC;GACnG,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;IAC3C,WAAW,OAAO,eAAe;IACjC,MAAM,WAAW,OAAO,eAAe,aAAa,MAAM,WAAW,IAAI;IACzE,QAAQ;IACR,WAAW,OAAO,eAAe;IACjC,MAAM,SAAS,QAAQ;IACvB,WAAW,OAAO,eAAe;IACjC,UAAU;IACV,IAAI,SAAS,SACX,MAAM,SAAS,QAAQ,OAAO;IAEhC,WAAW,OAAO,eAAe;GACnC,CAAC;GACD,OAAO,QAAQ,MAAM,OAAO,UAAmB;IAC7C,IAAI;KACF,MAAM,QAAQ;IAChB,SAAS,cAAc;KACrB,MAAM,SAAS,wBAAwB,iBAAiB,aAAa,SAAS,CAAC,YAAY;KAC3F,MAAM,IAAI,eAAe,CAAC,OAAO,GAAG,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,EACnG,OAAO,MACT,CAAC;IACH;IACA,MAAM;GACR,CAAC;EACH;EACA;CACF;AACF"}

package/dist/src/services/providerAuth/index.cjs

@@ -0,0 +1,156 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_index = require("../loginFlow/index.cjs");
+let node_crypto = require("node:crypto");
+node_crypto = require_runtime.__toESM(node_crypto, 1);
+//#region src/services/providerAuth/index.ts
+/** Matches the timeout Pi's own /logout gives the credential store. */
+const LOGOUT_TIMEOUT_MS = 15e3;
+function describe(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** The methods a page can start, in the order the TUI's selector lists them. */
+function methodsOf(provider) {
+	const methods = [];
+	const { oauth, apiKey } = provider.auth;
+	if (oauth) methods.push({
+		type: "oauth",
+		label: oauth.loginLabel ?? oauth.name
+	});
+	if (apiKey?.login) methods.push({
+		type: "api_key",
+		label: apiKey.name
+	});
+	return methods;
+}
+/** Mirrors the status the TUI's login selector shows beside each provider. */
+function summarize(runtime, provider) {
+	const summary = {
+		id: provider.id,
+		name: provider.name,
+		methods: methodsOf(provider)
+	};
+	const status = runtime.getProviderAuthStatus(provider.id);
+	if (status.configured) summary.authenticated = {
+		type: runtime.isUsingOAuth(provider.id) ? "oauth" : "api_key",
+		source: status.label ?? status.source
+	};
+	return summary;
+}
+function createProviderAuth(options) {
+	const notice = options.onNotice ?? (() => {});
+	const load = options.runtime;
+	const flows = /* @__PURE__ */ new Map();
+	let loading;
+	const runtime = () => {
+		loading ??= load().catch((error) => {
+			loading = void 0;
+			throw error;
+		});
+		return loading;
+	};
+	const findProvider = (current, providerId) => current.getProviders().find((provider) => provider.id === providerId);
+	const runningFor = (providerId) => [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === "running");
+	return {
+		async listProviders() {
+			const current = await runtime();
+			try {
+				await current.refresh({ allowNetwork: false });
+			} catch (error) {
+				notice(`provider auth refresh failed: ${describe(error)}`);
+			}
+			return current.getProviders().map((provider) => summarize(current, provider)).sort((left, right) => left.name.localeCompare(right.name));
+		},
+		async startLogin(providerId, type, remote) {
+			const current = await runtime();
+			const provider = findProvider(current, providerId);
+			if (!provider) return {
+				ok: false,
+				code: "unknown_provider",
+				error: `Unknown provider: ${providerId}`
+			};
+			if (!methodsOf(provider).some((method) => method.type === type)) return {
+				ok: false,
+				code: "unsupported_method",
+				error: `${provider.name} has no ${type} login.`
+			};
+			if (runningFor(providerId)) return {
+				ok: false,
+				code: "busy",
+				error: `A login for ${provider.name} is already in progress.`
+			};
+			for (const [id, flow] of flows) if (flow.snapshot().status !== "running") flows.delete(id);
+			const flow = require_index.createLoginFlow({
+				id: node_crypto.default.randomUUID(),
+				providerId,
+				providerName: provider.name,
+				type,
+				...remote === true ? { remote: true } : {}
+			});
+			flows.set(flow.id, flow);
+			current.login(providerId, type, flow.interaction).then(() => {
+				flow.settle({ ok: true });
+				notice(`signed in to ${provider.name} (${type})`);
+			}, (error) => {
+				flow.settle({
+					ok: false,
+					error: describe(error)
+				});
+			});
+			return {
+				ok: true,
+				flow: flow.snapshot()
+			};
+		},
+		getLogin(flowId) {
+			return flows.get(flowId)?.snapshot();
+		},
+		answerLogin(flowId, promptId, value) {
+			const flow = flows.get(flowId);
+			if (!flow) return "unknown_flow";
+			return flow.answer(promptId, value) ? "answered" : "not_waiting";
+		},
+		cancelLogin(flowId) {
+			const flow = flows.get(flowId);
+			if (!flow) return void 0;
+			flow.cancel();
+			return flow.snapshot();
+		},
+		async logout(providerId) {
+			const current = await runtime();
+			const provider = findProvider(current, providerId);
+			if (!provider) return {
+				ok: false,
+				code: "unknown_provider",
+				error: `Unknown provider: ${providerId}`
+			};
+			try {
+				await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });
+			} catch (error) {
+				return {
+					ok: false,
+					code: "runtime",
+					error: describe(error)
+				};
+			}
+			notice(`signed out of ${provider.name}`);
+			return { ok: true };
+		},
+		async listModels() {
+			const current = await runtime();
+			const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));
+			return current.getAvailableSnapshot().filter((model) => current.hasConfiguredAuth(model.provider)).map((model) => ({
+				value: `${model.provider}/${model.id}`,
+				label: model.id,
+				group: providers.get(model.provider) ?? model.provider
+			}));
+		},
+		close() {
+			for (const flow of flows.values()) flow.cancel();
+			flows.clear();
+		}
+	};
+}
+//#endregion
+exports.createProviderAuth = createProviderAuth;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/providerAuth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createLoginFlow","crypto"],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  return {\n    async listProviders() {\n      const current = await runtime();\n      // Another client may have stored a credential since the last look (a\n      // TUI /login, a hand-edited auth.json); the stale snapshot still lists\n      // on a failed refresh, which the notice explains.\n      try {\n        await current.refresh({ allowNetwork: false });\n      } catch (error) {\n        notice(`provider auth refresh failed: ${describe(error)}`);\n      }\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await runtime();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;;;AAkBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAE3G,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,QAAQ;GAI9B,IAAI;IACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;GAC/C,SAAS,OAAO;IACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;GAC3D;GACA,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAOA,cAAAA,gBAAgB;IAC3B,IAAIC,YAAAA,QAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}

package/dist/src/services/providerAuth/index.mjs

@@ -0,0 +1,154 @@
+import { createLoginFlow } from "../loginFlow/index.mjs";
+import crypto from "node:crypto";
+//#region src/services/providerAuth/index.ts
+/** Matches the timeout Pi's own /logout gives the credential store. */
+const LOGOUT_TIMEOUT_MS = 15e3;
+function describe(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** The methods a page can start, in the order the TUI's selector lists them. */
+function methodsOf(provider) {
+	const methods = [];
+	const { oauth, apiKey } = provider.auth;
+	if (oauth) methods.push({
+		type: "oauth",
+		label: oauth.loginLabel ?? oauth.name
+	});
+	if (apiKey?.login) methods.push({
+		type: "api_key",
+		label: apiKey.name
+	});
+	return methods;
+}
+/** Mirrors the status the TUI's login selector shows beside each provider. */
+function summarize(runtime, provider) {
+	const summary = {
+		id: provider.id,
+		name: provider.name,
+		methods: methodsOf(provider)
+	};
+	const status = runtime.getProviderAuthStatus(provider.id);
+	if (status.configured) summary.authenticated = {
+		type: runtime.isUsingOAuth(provider.id) ? "oauth" : "api_key",
+		source: status.label ?? status.source
+	};
+	return summary;
+}
+function createProviderAuth(options) {
+	const notice = options.onNotice ?? (() => {});
+	const load = options.runtime;
+	const flows = /* @__PURE__ */ new Map();
+	let loading;
+	const runtime = () => {
+		loading ??= load().catch((error) => {
+			loading = void 0;
+			throw error;
+		});
+		return loading;
+	};
+	const findProvider = (current, providerId) => current.getProviders().find((provider) => provider.id === providerId);
+	const runningFor = (providerId) => [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === "running");
+	return {
+		async listProviders() {
+			const current = await runtime();
+			try {
+				await current.refresh({ allowNetwork: false });
+			} catch (error) {
+				notice(`provider auth refresh failed: ${describe(error)}`);
+			}
+			return current.getProviders().map((provider) => summarize(current, provider)).sort((left, right) => left.name.localeCompare(right.name));
+		},
+		async startLogin(providerId, type, remote) {
+			const current = await runtime();
+			const provider = findProvider(current, providerId);
+			if (!provider) return {
+				ok: false,
+				code: "unknown_provider",
+				error: `Unknown provider: ${providerId}`
+			};
+			if (!methodsOf(provider).some((method) => method.type === type)) return {
+				ok: false,
+				code: "unsupported_method",
+				error: `${provider.name} has no ${type} login.`
+			};
+			if (runningFor(providerId)) return {
+				ok: false,
+				code: "busy",
+				error: `A login for ${provider.name} is already in progress.`
+			};
+			for (const [id, flow] of flows) if (flow.snapshot().status !== "running") flows.delete(id);
+			const flow = createLoginFlow({
+				id: crypto.randomUUID(),
+				providerId,
+				providerName: provider.name,
+				type,
+				...remote === true ? { remote: true } : {}
+			});
+			flows.set(flow.id, flow);
+			current.login(providerId, type, flow.interaction).then(() => {
+				flow.settle({ ok: true });
+				notice(`signed in to ${provider.name} (${type})`);
+			}, (error) => {
+				flow.settle({
+					ok: false,
+					error: describe(error)
+				});
+			});
+			return {
+				ok: true,
+				flow: flow.snapshot()
+			};
+		},
+		getLogin(flowId) {
+			return flows.get(flowId)?.snapshot();
+		},
+		answerLogin(flowId, promptId, value) {
+			const flow = flows.get(flowId);
+			if (!flow) return "unknown_flow";
+			return flow.answer(promptId, value) ? "answered" : "not_waiting";
+		},
+		cancelLogin(flowId) {
+			const flow = flows.get(flowId);
+			if (!flow) return void 0;
+			flow.cancel();
+			return flow.snapshot();
+		},
+		async logout(providerId) {
+			const current = await runtime();
+			const provider = findProvider(current, providerId);
+			if (!provider) return {
+				ok: false,
+				code: "unknown_provider",
+				error: `Unknown provider: ${providerId}`
+			};
+			try {
+				await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });
+			} catch (error) {
+				return {
+					ok: false,
+					code: "runtime",
+					error: describe(error)
+				};
+			}
+			notice(`signed out of ${provider.name}`);
+			return { ok: true };
+		},
+		async listModels() {
+			const current = await runtime();
+			const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));
+			return current.getAvailableSnapshot().filter((model) => current.hasConfiguredAuth(model.provider)).map((model) => ({
+				value: `${model.provider}/${model.id}`,
+				label: model.id,
+				group: providers.get(model.provider) ?? model.provider
+			}));
+		},
+		close() {
+			for (const flow of flows.values()) flow.cancel();
+			flows.clear();
+		}
+	};
+}
+//#endregion
+export { createProviderAuth };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/providerAuth/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  return {\n    async listProviders() {\n      const current = await runtime();\n      // Another client may have stored a credential since the last look (a\n      // TUI /login, a hand-edited auth.json); the stale snapshot still lists\n      // on a failed refresh, which the notice explains.\n      try {\n        await current.refresh({ allowNetwork: false });\n      } catch (error) {\n        notice(`provider auth refresh failed: ${describe(error)}`);\n      }\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await runtime();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;AAkBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAE3G,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,QAAQ;GAI9B,IAAI;IACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;GAC/C,SAAS,OAAO;IACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;GAC3D;GACA,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAO,gBAAgB;IAC3B,IAAI,OAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}